# Streaming media source distribution / 流式媒体源码分发

Mediabunny 和 MP3 adapter 均为 **1.56.1 / MPL-2.0**。内嵌 **LAME 3.100 为 LGPL-2.0-or-later**。这不是对自研应用的 GPL 授权。原始许可证见 `LICENSES/`，各文件的来源和哈希见 `source-files.json`、`license-files.json`、`binary-provenance.json`。网页目录下这些 JSON 可直接访问；解压包中位于 `assets/media-source-distribution/`。

Both Mediabunny packages are **1.56.1 / MPL-2.0**; embedded **LAME 3.100 is LGPL-2.0-or-later**. This distribution does not license proprietary application source under GPL. Original licenses, copyright notices, pinned sources and per-file hashes are supplied. Only the media library is rebuilt by the commands below.

## Exact inputs / 固定输入

- Mediabunny tag `v1.56.1` and both npm `gitHead` values: `cee57d1cdfd1776d515c081057b50eb337291e32`. All published npm package files are hashed and compared with the installation. Published TS is also compared to the fixed repository snapshot.
- Complete original LAME `lame-3.100.tar.gz` from SourceForge, SHA-256 `ddfe36cab873794038ae2c1210557ad34857a4b6bdc515785d1da9e175b1da1e`. The adapter's LAME header matches the release. `COPYING` is GNU **Library** GPL v2; source headers allow later versions.
- The same 223033-byte embedded WASM is verified in the fixed repository `packages/mp3-encoder/build/lame.js`, npm generated glue and npm ESM bundle. This proves artifact correspondence, not a source-to-binary reproduction. See `binary-provenance.json` for its hash.
- Full relevant original Mediabunny `src/`, `shared/`, MP3 extension and build scripts are under `upstream/`. Other optional codec extensions are excluded. Original native static library and glue are preserved for inspection; rebuilding LAME replaces them. The downloaded complete GitHub snapshot is only a local verification input; the public archive records every selected original file.
- LAME, QR Code generator, npm packages, Emscripten 4.0.10, emsdk and esbuild input archives are under `inputs/`. Emscripten **4.0.10 is a pinned replacement toolchain**, not the claimed original npm compiler. Its emsdk release is `8103ffedfb0c42d231c6af6859a5a1a832260b43`. The upstream static library contains a clang 22.0.0git / LLVM `7f93487862d98bf1c168babba87daf6224d8a46f` producer string, but the release workflow consumes already committed WASM without identifying its full build environment.
- esbuild is fixed at 0.28.2. Its native platform package is fetched separately at that exact version when installing the build tool. Compiler/OS installation prerequisites are external; this is not a hermetic or fully offline toolchain claim.

## Check the archive / 校验

Download `mediabunny-1.56.1-sources.tar.gz` and `SHA256SUMS` from the same public directory. Compare the SHA-256 with the extension notice or release manifest, then run:

```sh
shasum -a 256 -c SHA256SUMS
tar -xzf mediabunny-1.56.1-sources.tar.gz
cd mediabunny-1.56.1-sources
shasum -a 256 -c SHA256SUMS
```

The inner checksum list covers every included file except itself. The outer list covers the complete archive. `SOURCE-SHA256SUMS` additionally records original download inputs, including the complete upstream snapshot retained locally. It is not a list of files all present at the archive root.

## Rebuild from editable source / 从可修改源码重建

Use Node 22+, npm, Python 3, GNU make and a POSIX shell. Work inside the extracted source archive, in a directory separate from the installed product. Installing the build tool downloads its exact-version native binary:

```sh
npm install --prefix build-tools --no-package-lock ./inputs/esbuild-0.28.2.tgz
node rebuild/rebuild-vendor.mjs upstream replacement build-tools/node_modules/esbuild/lib/main.js
```

This compiles original TypeScript with the supplied original prebuilt LAME glue. To modify and rebuild **LAME itself**, first extract the fixed source and toolchain installer. Installation stays in `emsdk/`; no product build, deployment or store operation is involved:

```sh
mkdir -p lame emsdk
tar -xzf inputs/lame-3.100.tar.gz -C lame --strip-components=1
tar -xzf inputs/emsdk-62a853cd3b3134398ce85cde8bb5cbb2ef0194cb.tar.gz -C emsdk --strip-components=1
./emsdk/emsdk install 4.0.10
./emsdk/emsdk activate 4.0.10
source ./emsdk/emsdk_env.sh
# Edit lame/ and/or upstream/packages/mp3-encoder/src/lame-bridge.c as desired.
bash rebuild/rebuild-lame.sh lame upstream
node rebuild/rebuild-vendor.mjs upstream replacement build-tools/node_modules/esbuild/lib/main.js
```

The LAME configure flags and bridge linker arguments follow the pinned upstream MP3 README, also supplied in `evidence/upstream-mp3-README.md`. The replacement recipe adds `--host=wasm32-unknown-none`: with the fixed toolchain, the original configure otherwise tries to execute a WASM program as a native binary; LAME's old `config.sub` does not recognize the `emscripten` OS name. The decoder, frontend, shared library, GTK checks and analyzer hooks are disabled. Rebuild scripts fail on a toolchain or package version mismatch. They export the full Mediabunny API and `registerMp3Encoder` and emit a local `mp3-encoder.worker.js` beside `index.js`. This static worker is needed for Chrome MV3: the upstream Blob-worker recipe is incompatible with its extension CSP. The original upstream sources are unchanged; the alternate worker construction is contained in the supplied reconstruction helper.

To run the **product's original npm-based vendor recipe** instead, the exact captured script is `rebuild/build-media-vendor.mjs`:

```sh
npm install --prefix npm-rebuild --no-package-lock ./inputs/mediabunny-1.56.1.tgz ./inputs/mp3-encoder-1.56.1.tgz ./inputs/esbuild-0.28.2.tgz
mkdir -p npm-rebuild/scripts
cp rebuild/build-media-vendor.mjs npm-rebuild/scripts/build-media-vendor.mjs
node npm-rebuild/scripts/build-media-vendor.mjs npm-replacement
```

That route starts from npm's executable JS/WASM. Use the preceding editable-source route for changes to LAME or TypeScript. No byte-identical rebuild is promised for either route.

## Replace and relink / 替换与重新链接

1. Keep the supplied licenses and source information with your copy. Unzip the extension into a **new local folder**.
2. Replace its `vendor/media/` contents with both files from `replacement/vendor/media/`: `index.js` and `mp3-encoder.worker.js`. Its first-party modules continue importing the same ESM API; no proprietary source recompilation or signing key is needed for this replacement.
3. In Chrome/Chromium's extensions page, enable developer mode and load that local folder as an unpacked extension. Reload it after replacement and test MP3 encoding. Browser/organization policies may restrict unpacked extensions; the product must not add its own signature/hash check that prevents local library replacement.
4. For a local website copy, replace both files in `vendor/media/` and reload its workers. Do not upload a modified build to production as part of this procedure.

Recipients may modify the LGPL-linked work for their own use and reverse engineer it to debug modifications under LGPL section 6. Product terms must preserve those rights. Supplying this library material does not by itself decide the license of independent application files. MPL remains a file-level license for covered sources and changes to them; no GPL election is required for ordinary distribution of separate MPL files.

## Boundaries before release / 发布边界

本地准备不解除用户验收与发布暂停。发布责任方必须保证：固定源码包在与二进制相同的下载站点持续可取、不需要付款或登录；条款保留 LGPL 所需权利；最终扩展可加载本地替换库；打包清单记录最终 vendor 字节哈希。此任务只拥有材料与集成脚本，不能修改应用条款、发布门禁或替用户授权自研源码。

Local preparation does not authorize a release. The release owner must verify same-site, unauthenticated source availability, compatible product terms, replacement in the final unpacked extension and final vendor checksums. Store distribution requires an effective source access arrangement alongside that distribution; no unsupported three-year written offer is invented here. The supplied sources/recipes implement the technical reconstruction path, but do not certify all legal or store obligations.

Upstream does not attest the exact historical Emscripten environment or all transformations that produced the npm WASM. No bit-identical rebuild is claimed. LAME's documentation reports use of 3.100 and its header matches; the supplied source correspondence cannot prove absence of undisclosed upstream changes. Keep that limitation visible when assessing a release.

## Primary sources / 官方依据

- [Mediabunny MP3 guide](https://mediabunny.dev/guide/extensions/mp3-encoder)
- [Pinned MP3 source and build recipe](https://github.com/Vanilagy/mediabunny/blob/cee57d1cdfd1776d515c081057b50eb337291e32/packages/mp3-encoder/README.md)
- [Pinned release workflow](https://github.com/Vanilagy/mediabunny/blob/cee57d1cdfd1776d515c081057b50eb337291e32/.github/workflows/release.yml)
- [MPL 2.0 and FAQ](https://www.mozilla.org/en-US/MPL/2.0/FAQ/)
- [LAME official release](https://sourceforge.net/projects/lame/files/lame/3.100/) and original `COPYING`, `LICENSE`, `include/lame.h` in the supplied source
- [Emscripten installation](https://emscripten.org/docs/getting_started/downloads.html)
- [Chrome MV3 CSP and worker restrictions](https://developer.chrome.com/docs/extensions/develop/migrate/improve-security)