libheif-bundle.js — corresponding source manifest ================================================= This manifest is the single source of truth for what is shipped, where it came from, and how to reproduce it. The public page at /open-source links here rather than repeating these facts, so they can only go stale in one place. Machine-readable pins (parsed by LibheifLicenseComplianceTest, do not reformat) ------------------------------------------------------------------------------ libheif-js-version: 1.19.8 sha256-libheif-bundle.js: 793b36c913689784b2bfba60456fd87c14ed49e2d13f3b4d2611baaf05148f81 Shipped components ------------------ libheif-js 1.19.8 Copyright (c) Kiril Vatev GNU Lesser General Public License, version 3 https://github.com/catdad-experiments/libheif-js libheif 1.19.8 Copyright (c) 2017-2023 Dirk Farin , struktur AG GNU Lesser General Public License, version 3 or later https://github.com/strukturag/libheif commit 5e9deb19fe6b3768af0bb8e9e5e8438b15171bf3 libde265 1.0.15 Copyright (c) 2013-2014 struktur AG, Dirk Farin GNU Lesser General Public License, version 3 or later https://github.com/strukturag/libde265 Pinned as LIBDE265_VERSION in libheif's build-emscripten.sh. Note: libde265 is named in none of the licence files that upstream ships. Its notice is supplied by Empik Foto. No AV1, HEVC or JPEG 2000 encoder is compiled in. The build script carries AOM_VERSION=3.6.1 but aom is not enabled, so no BSD-2 attribution is owed. The build is decode-only. Build chain ----------- libheif + libde265 -> compiled by catdad-experiments/libheif-emscripten v1.19.8 with EMSCRIPTEN_VERSION 3.1.61 -> bundled by catdad-experiments/libheif-js 1.19.8 using esbuild -> published to npm as libheif-js@1.19.8 -> libheif-wasm/libheif-bundle.js copied verbatim into this repository Note on tags: libheif-js git tags have no "v" prefix (1.19.8); libheif-emscripten tags do (v1.19.8). Shipped file hashes ------------------- 793b36c913689784b2bfba60456fd87c14ed49e2d13f3b4d2611baaf05148f81 libheif-bundle.js e3a994d82e644b03a792a930f574002658412f62407f5fee083f2555c5f23118 licenses/LGPL-3.0.txt 3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986 licenses/GPL-3.0.txt fa81ce652315b013359d6e8e4744335f31a50c7c192907176d3632f78a3b4596 licenses/libheif-COPYING.txt 02cc1585a20677992e0ba578fa692635dc193735f2691dc81de924b51c4e8020 licenses/libde265-COPYING.txt Verifying the shipped file is unmodified ---------------------------------------- npm pack libheif-js@1.19.8 tar xzf libheif-js-1.19.8.tgz sha256sum package/libheif-wasm/libheif-bundle.js The result must equal sha256-libheif-bundle.js above. Rebuilding the archive ---------------------- scripts/build-libheif-source-archive.sh Upgrading the library --------------------- 1. Bump the version in package.json and in this manifest. 2. npm pack the new version and confirm the vendored file is byte-identical to package/libheif-wasm/libheif-bundle.js. Update sha256-libheif-bundle.js. 3. Re-run the component scan on the new WebAssembly binary. This step is not optional: a newer libheif build may compile in an additional decoder such as aom or dav1d, which brings its own licence and its own notice obligations. python3 - <<'PYEOF' import re, base64 s = open('src/Uploader/UploaderBundle/Resources/public/libheif/libheif-bundle.js', encoding='utf8', errors='replace').read() blob = re.findall(r'"([A-Za-z0-9+/=]{5000,})"', s)[0] open('/tmp/libheif.wasm', 'wb').write(base64.b64decode(blob)) PYEOF strings -a /tmp/libheif.wasm | grep -iE 'libde265|libheif|aom|dav1d|x265|rav1e|kvazaar' Anything new in that output means new licence work before shipping. 4. Rebuild the archive, refresh every hash in this manifest, and update the version in the archive filename and in the /open-source page links. 5. Re-run the compliance test. Contact ------- Empik Foto Sp. z o.o. Requests concerning this source code should go through the contact form at https://www.empikfoto.pl/kontakt