NAVARRE - CORRESPONDING SOURCE FOR THE VENDORED libVLC RUNTIME
==============================================================

This archive is the Navarre-authored half of the complete corresponding source for the
libVLC runtime distributed inside Navarre for Windows: the build scripts, the audits, the
curation allow-list, the guard, and the measured evidence of the build that produced the
shipped DLLs. Navarre is the BUILDER of that runtime, not a redistributor of an upstream
binary, so the recipe is part of the source, not documentation about it.

The other two halves are published beside this archive on https://navarre.tv/source :

  1. The upstream VLC source tarball at the exact version built:
       vlc-3.0.23.tar.xz
       https://download.videolan.org/pub/videolan/vlc/3.0.23/vlc-3.0.23.tar.xz
       sha256 e891cae6aa3ccda69bf94173d5105cbc55c7a7d9b1d21b9b21666e69eff3e7e0
     Every patch applied to a contrib package lives inside that tarball, under
     contrib/src/<package>/, together with the SHA512SUMS file that pins the exact
     contrib tarball each recipe consumes. Navarre applies no patch of its own.

  2. The 26 contrib source archives at the exact versions this build consumed. Each one
     was verified against the SHA512 recorded in vlc-3.0.23/contrib/src/<package>/SHA512SUMS,
     so the mirrored bytes are provably the bytes this build compiled.

WHERE THE RECIPE IS
-------------------
  RECIPE.md   how to rebuild from a clean machine; the three licence levers; the two
              corrections that were required (--enable-ad-clauses for FreeType, and
              --disable-asdcplib), and the exact configure lines
  RESULTS.md  the measured proving run: the FFmpeg licence ship gate, the red controls,
              the absent-contrib scan, playback, and the file and byte counts
  rig/        every script that was run, in numbered order
  logs/       the verbatim build output of the contrib and VLC stages
  out/        the evidence: the plugin census, the curation report, the guard report with
              a per-file sha256 inventory, and the configure lines extracted back out of
              the shipped binaries

THE ONE DEVIATION FROM THE STOCK RECIPE
---------------------------------------
contrib/src/main.mak pins a SourceForge mirror that no longer resolves. The rig overrides
it with SF=https://master.dl.sourceforge.net. This costs no integrity: every contrib
tarball is checked against VLC's own SHA512SUMS, so the mirror is a transport choice only.

WHAT WAS BUILT
--------------
VLC 3.0.23 win64, configured so that FFmpeg reports "LGPL version 2.1 or later" about
itself rather than the stock build's "GPL version 2 or later", then curated down to a
126-file runtime by rig/curate.py. The allow-list is a LICENSING control, not a size
optimisation: VLC's own configure has no GPL switch, so four GPL modules in VLC's own tree
(access/dshow, access/dtv, demux/real, video_filter/rotate) are built and are kept out of
the product by the allow-list and by nothing else.

FreeType is redistributed under the FreeType Licence, elected with --enable-ad-clauses.

RELINKING
---------
The runtime ships as loose DLL files under Navarre\app\resources\vlc\. Replace any of them
with an interface-compatible build of your own and the application will load yours.

Packaged 2026-09-03 by Navarre Enterprises LLC. support@navarre.tv
