{
  "schemaVersion": 1,
  "auditedAt": "2026-07-27",
  "product": "Mango Player Android",
  "release": {
    "versionName": "0.7.19",
    "versionCode": 52,
    "applicationId": "com.akyz.player",
    "distribution": "google-play",
    "productCommit": "d01490723b63632748ff579066228787b3e266a7",
    "aabBytes": 168177962,
    "aabSha256": "3E3AA815258263BB43D20E18F056B739F9BEDF34FD5FA01725FC60ED79811B83",
    "nativeSymbolsBytes": 18784626,
    "nativeSymbolsSha256": "6833512669E0CC446AB49C0DA67E6DBB435A1D3E43E53F284EB0C79697AAD556",
    "certificateSha256": "68:44:6E:5C:48:39:01:00:A6:70:FE:CC:E8:99:A0:EC:F5:38:01:1B:19:5E:F3:51:A0:56:C9:BE:15:C0:B3:B5",
    "pageAlignment": "PAGE_ALIGNMENT_16K"
  },
  "artifactInspection": {
    "abis": {"arm64-v8a": 20, "armeabi-v7a": 28, "x86_64": 20},
    "forbiddenPayloadsAbsent": ["libvlc.so", "libvlcjni.so", "libffmpegJNI.so", "libpostproc.so", "org.jellyfin.media3:media3-ffmpeg-decoder"],
    "scanner": "passed",
    "android14Smoke": "passed",
    "downloadsFeature": "retained"
  },
  "components": [
    {
      "id": "ffmpeg-kit-flutter-wrapper",
      "version": "2.3.2",
      "licence": "LGPL-3.0-or-later",
      "pubSha256": "05b2554a7ba9bee46998fad3d3b616c92c50fe3f716c3be6ea23feab8daab2ab",
      "sourceCommit": "053d77a894d7e0eb98158c4b7e8c6208702315c0",
      "sourceMatch": "236 of 238 packaged files match Git blobs exactly; README and gradlew.bat differ by packaging/encoding transformations while critical code and build files match",
      "status": "critical-source-match-proven"
    },
    {
      "id": "ffmpeg-kit-android-full",
      "version": "2.2.1",
      "mavenCoordinate": "com.antonkarpenko:ffmpeg-kit-full:2.2.1",
      "licence": "LGPL-3.0-or-later",
      "aarSha256": "073246A65F49E67A9BB1CF67DDC90AA30241546F2A70341F1C2C8CEB17F8A705",
      "nativeSourceCommit": "f437b23c04b295cf3e4c26b5f7dec72ed4d270ab",
      "ffmpegVersion": "n8.1.2",
      "flags": ["--enable-version3", "no --enable-gpl", "no --enable-nonfree"],
      "binarySourceMatch": "48 native shared objects and all 32 Maven Java sources match the pinned native commit",
      "security": "FFmpeg n8.1.2 fixes CVE-2026-8461",
      "status": "exact-binary-source-pin-proven-complete-supplier-build-script-closure-open"
    },
    {
      "id": "media-kit",
      "version": "1.1.11",
      "licence": "MIT",
      "pubSha256": "1f1deee148533d75129a6f38251ff8388e33ee05fc2d20a6a80e57d6051b7b62",
      "source": "https://github.com/media-kit/media-kit",
      "status": "notice-proven"
    },
    {
      "id": "media-kit-libmpv-android-default",
      "version": "1.1.7",
      "licence": "LGPL-2.1-or-later / LGPL-3.0-or-later for FFmpeg built with --enable-version3",
      "buildSourceCommit": "fe8c3ac1a91c09aa6fb1deccbc833f1bafa54768",
      "mpvCommit": "78d43740f52db817d98bcf24fb30a76ab6fa13ff",
      "ffmpegVersion": "6.0",
      "flags": ["mpv:-Dgpl=false", "ffmpeg:--disable-gpl", "ffmpeg:--disable-nonfree", "ffmpeg:--enable-version3"],
      "payloadSha256": {
        "arm64-v8a": "ADF83FDE58A9F6751CE6E83B9B187F651425D53EC0E20DA04DEB8DFB4AA775E1",
        "armeabi-v7a": "8AA2B23D16D941A8D685B8EB995B1CB31677ED3E28C55C776954EB1618AB1A2E",
        "x86_64": "F030E9A1A4D4664E89D7160A3D4528CD5875EE023FF6262E16E95AAC28FFAEC5"
      },
      "status": "build-scripts-and-default-flavor-inputs-mirrored-independent-lgpl-review-open"
    }
  ],
  "legalGate": "OPEN: the FFmpegKit supplier does not publish the exact modified third-party build scripts used to produce its complete full dependency payload. This dossier does not declare Store distribution legally cleared."
}