# Subtitle sources and notices

JASSUB is pinned to npm 2.5.16 by package-lock.json. Its two WASM binaries match
Git blobs 843ad3e9377627c0867683722439db740ccd3167 and
6c75087fd908354cac91ee56a0907f7bb64dffa4 in upstream revision
656371af1c904be59a1008dcdb93f18dfe5e23d0. No native binary patch is applied.

The main JavaScript bundle omits rvfc-polyfill because Tandem supplies the playback
clock. Bundled dependencies are abslink 1.2.2 (Apache-2.0), lfa-ponyfill 1.1.1 (MIT),
and throughput 1.0.2 (MIT). Their package metadata and JavaScript notices are
included here. queryFonts=false disables local/remote font discovery.

Native source archives are served in ../source/: jassub.tar.gz, brotli.tar.gz,
freetype.tar.gz, fribidi.tar.gz, harfbuzz.tar.gz, and libass.tar.gz. Exact revisions
are in revisions.json. Extract the JASSUB tree and place dependency source trees
under lib/<name>. Its Makefile, functions.mk, build patches, and Dockerfile provide
the upstream build recipe (emscripten/emsdk:6.0.4). The FreeType GitHub mirror was
verified to contain the exact git submodule commit from the upstream GitLab repo.
Source archives retain their original license notices. All downloaded archives,
WASM modules, bundles, and notices have hashes in scripts/subtitle-vendor-lock.json.

jassub-native-license-texts.txt preserves the upstream build/license_fullnotice
file verbatim. Component COPYING/LICENSE files supplement it, including the
FreeType License, which is the selected FreeType licensing option. This software
uses the FreeType Project (https://freetype.org/).

native-copyrights.txt was generated from the pinned native source trees using
upstream build/license_extract.sh and license_defaults with Debian licensecheck.
Extraction follows upstream exclusions for FreeType tools, FriBidi tools, and
HarfBuzz tests; Brotli scans its native c/ tree, excluding unused JS/Java decoders.
File arguments are batched to avoid spawning Perl for every source file. An
initial broad scan incorrectly treated strings in Brotli's JS dictionary as
copyright statements; that output is not distributed. Component source archives
provide the complete original per-file notices, including source-only utilities.