# Third-party register

M1 selections, immutable source revisions, archive SHA-256 values, and licences
are recorded in `dependencies/manifests/m1-dependencies.json`. FFmpeg configure
flags are recorded in `dependencies/manifests/ffmpeg-windows-x64.configure.txt`.

The portable package bundles FFmpeg, x264, combined 8/10-bit x265, libplacebo,
Qt, and their
MinGW runtime dependencies. Because FFmpeg is built with GPL components x264
and x265, SmartCut64 is distributed as GPL-3.0-or-later software and recipients
must receive the complete corresponding source for the exact binary release.
No nonfree FFmpeg option is enabled. FFmpeg and x264/x265 remain under their
respective GPL-2.0-or-later terms; the package also dynamically links Qt under
LGPL-3.0. The GPLv3 distribution terms provide a single compatible licence for
the combined application while preserving every component's original notices.

libaom 3.14.1 (BSD-2-Clause) and libvpx 1.16.0 (BSD-3-Clause) are built as
locked static libraries and linked into the FFmpeg runtime to provide AV1 and
VP9 decoding and boundary encoding.

Runtime support libraries copied from MSYS2 UCRT64 include GCC runtime
libraries (GPL with the GCC Runtime Library Exception), libb2 (CC0), PCRE2
(BSD-3-Clause), zstd (BSD-3-Clause), zlib (Zlib), and Brotli (MIT). ZIP
packaging includes the corresponding available licence texts, a deterministic
CycloneDX SBOM, separate GNU debug symbols, and a verified source bundle
containing the exact locked dependency archives. Code signing remains an
external release step because no signing identity is stored in the project.

These copyright licences do not grant a blanket patent licence for the media
standards implemented by the codecs. Commercial distributors must obtain
jurisdiction-specific advice on AVC/H.264, HEVC/H.265, AAC, MPEG-2/MPEG-4,
AV1/VP9, and any other enabled standards before sale. See
`COMMERCIAL_DISTRIBUTION.md`.

Windows hardware acceleration uses FFmpeg's D3D11VA interfaces and the default
display adapter. NVIDIA NVENC and AMD AMF are compiled from their MIT-licensed
header packages; Intel Quick Sync uses the MIT-licensed oneVPL headers and
redistributed `libvpl-2.dll`. The package includes those licence texts and the
SBOM records all three build/runtime inputs. Vendor display drivers and their
codec runtimes are not redistributed by SmartCut64.

The pinned libdovi source is built with cargo-c
`0.10.24+cargo-0.98.0`. A tracked MIT-source patch exposes the upstream
`set_scene_cut` operation through the C API and marks rewritten RPUs modified so
libdovi recomputes their CRC32. The patch does not alter Dolby metadata parsing
or serialization rules.
