{
  "schemaVersion": 1,
  "auditedAt": "2026-07-26",
  "product": "Mango Player",
  "policy": {
    "storeVariants": [
      "android-mobile-play",
      "android-tv-play",
      "android-tv-amazon",
      "ios-app-store",
      "ipados-app-store",
      "windows-store"
    ],
    "forbiddenInStoreArtifacts": [
      "org.jellyfin.media3:media3-ffmpeg-decoder",
      "libffmpegJNI.so"
    ],
    "notes": "A component is not cleared merely because its wrapper is MIT or its upstream POM names a licence. The exact native payload, corresponding source and relink path must be evidenced."
  },
  "components": [
    {
      "id": "media-kit",
      "version": "1.1.11",
      "licence": "MIT",
      "source": "https://github.com/media-kit/media-kit",
      "pubSha256": "1f1deee148533d75129a6f38251ff8388e33ee05fc2d20a6a80e57d6051b7b62",
      "status": "notice-proven",
      "scope": ["android-mobile", "ios", "ipados", "windows"]
    },
    {
      "id": "media-kit-libmpv-android-default",
      "version": "1.1.7",
      "licence": "LGPL-2.1-or-later / LGPL-3.0-or-later for FFmpeg built with --enable-version3",
      "buildSource": "https://github.com/media-kit/libmpv-android-video-build/tree/fe8c3ac1a91c09aa6fb1deccbc833f1bafa54768",
      "mpvCommit": "78d43740f52db817d98bcf24fb30a76ab6fa13ff",
      "ffmpegVersion": "6.0",
      "flags": ["mpv:-Dgpl=false", "ffmpeg:--disable-gpl", "ffmpeg:--disable-nonfree", "ffmpeg:--enable-version3"],
      "artifacts": [
        {"abi": "arm64-v8a", "md5": "83df25b61193af8fa815e373143ac9af", "sha256": "4363dfa5d3d415b91c1f16f6fb90c3fe59a77dfd3f9b824d2b24b492d6b09df9", "payloadSha256": "adf83fde58a9f6751ce6e83b9b187f651425d53ec0e20da04deb8dfb4aa775e1"},
        {"abi": "armeabi-v7a", "md5": "22e21526fefc0a2b8f17adbec9f57590", "sha256": "8ead114fc5a43348d89dc0eb8f41823e549b15115c29f73ee26973f973620995", "payloadSha256": "8aa2b23d16d941a8d685b8eb995b1cb31677ed3e28c55c776954eb1618ab1a2e"},
        {"abi": "x86", "md5": "0d742b756dc9d1fcd84ea271d8b68f32", "sha256": "94c13cb6188b774710e5e487afff6e500c4af504df74b2494d7b12cf9be8a66a", "payloadSha256": "2c39d1dfc33e668a98a82ed50992a12f762e7449ef58c9bf4ca5aca7f21d35e9"},
        {"abi": "x86_64", "md5": "6fa26bf0459b11f1c0b0dbc29e5b940d", "sha256": "90268cd15f0766e07fb8e427388c621161177c9eb343c544f327bd63232bb236", "payloadSha256": "f030e9a1a4d4664e89d7160a3d4528cd5875ee023ff6262e16e95aac28ffaec5"}
      ],
      "status": "binary-flags-and-build-source-proven",
      "scope": ["android-mobile"]
    },
    {
      "id": "media-kit-libmpv-ios-default",
      "version": "0.6.0",
      "licence": "LGPL-2.1-or-later / LGPL-3.0-or-later for FFmpeg built with --enable-version3",
      "buildSource": "https://github.com/media-kit/libmpv-darwin-build/tree/4286f5557bdccc0747030e3c376ce5cd160a96a0",
      "mpvVersion": "0.36.0",
      "ffmpegVersion": "6.0",
      "flags": ["mpv:-Dgpl=false", "ffmpeg:--enable-version3", "ffmpeg:no --enable-gpl", "ffmpeg:no --enable-nonfree"],
      "artifact": {
        "name": "libmpv-xcframeworks_v0.6.0_ios-universal-video-default.tar.gz",
        "sha256": "a95bc18508af26136b8a408341c05b5585d644ec013f00ac07db09d2e28d36ae"
      },
      "status": "binary-flavor-and-build-source-proven-relink-evidence-required",
      "scope": ["ios", "ipados"]
    },
    {
      "id": "media-kit-libmpv-windows",
      "version": "2023-09-24-git-652a1dd",
      "licence": "LGPL-2.1-or-later / LGPL-3.0-or-later for FFmpeg built with --enable-version3",
      "archive": {
        "name": "mpv-dev-x86_64-20230924-git-652a1dd.7z",
        "md5": "a832ef24b3a6ff97cd2560b5b9d04cd8",
        "sha256": "dce982222d7a23e4a1c6f0fb6cc39f6e899a6714624b95ea49cff6558ee97572"
      },
      "payload": {
        "name": "libmpv-2.dll",
        "sha256": "d5f0694b08c124e785d858d00082f3e3b158dd9138bfc48c0382bf1eb443a5fc"
      },
      "mpvCommit": "652a1dd90711839acdccc08004056d25514ef2d8",
      "ffmpegVersion": "6.0",
      "embeddedFlags": ["mpv:-Dgpl=false", "ffmpeg:--disable-gpl", "ffmpeg:--disable-nonfree", "ffmpeg:--enable-version3"],
      "status": "binary-licence-proven-exact-complete-build-closure-open",
      "scope": ["windows"]
    },
    {
      "id": "libvlc-android-mobile",
      "version": "3.3.5",
      "licenceClaim": "LGPL-2.1",
      "sourceCommit": "85eade3c91438c91137a6ac3d67ff5b1a7661e5b",
      "aarSha256": "cdaa91b4e79c59f31a02a64e4a85dd1e4c43815a8f23f7a9b7c4faaf03cc472f",
      "status": "upstream-lgpl-source-pin-and-binary-hash-proven-independent-static-closure-review-open",
      "scope": ["android-mobile-play", "android-mobile-sideload"]
    },
    {
      "id": "libvlc-android-tv",
      "version": "3.6.0",
      "licenceClaim": "LGPL-2.1",
      "sourceTag": "libvlc-3.6.0",
      "sourceCommit": "38a29a083b2de8483db8a562692206bb6168b71d",
      "vlcCommit": "5ee481afa798f281304754b001572dfe5dc0078e",
      "aarSha256": "cd1855371bc0008e89ef7ec1fcb0042e740ee185d79408193f02d3824c88cb61",
      "libvlcjniCommit": "05d76f37559e2a2e5cd4248053a76ceff5a523e1",
      "provenance": "The official vlc-android libvlc-3.6.0 tag pins this libvlcjni commit in buildsystem/compile.sh; that libvlcjni commit pins the VLC commit in buildsystem/get-vlc.sh. The separate vlc-android 3.6.0 application tag is not the AAR provenance.",
      "status": "upstream-lgpl-build-chain-and-binary-hash-proven-independent-static-closure-review-open",
      "scope": ["android-tv-play", "android-tv-amazon", "android-tv-sideload"]
    },
    {
      "id": "jellyfin-media3-ffmpeg-tv",
      "version": "1.5.0+1",
      "licence": "GPL-3.0",
      "sourceCommit": "9bbeb8b73a05ec3f09751a6589cc87ce651585d6",
      "aarSha256": "6b58e4576492be77fc8f9540db0a38793df45319d0659039904f161f7780a328",
      "status": "sideload-only-forbidden-in-store-legal-review-open",
      "legalGate": "OPEN: GPL-3.0 compatibility with the proprietary application requires independent legal clearance or documented upstream permission before the sideload distribution can be declared compliant.",
      "scope": ["android-tv-sideload"]
    },
    {
      "id": "jellyfin-media3-ffmpeg-mobile",
      "version": "1.6.1+2",
      "licence": "GPL-3.0",
      "sourceCommit": "414d3fca8321b4875a5272f852a2abebe24b1bfe",
      "aarSha256": "c34814127291b8094f24c6287322e1cbeb131e6f2da8de7f6773c2765364d7ab",
      "status": "sideload-only-forbidden-in-store-legal-review-open",
      "legalGate": "OPEN: GPL-3.0 compatibility with the proprietary application requires independent legal clearance or documented upstream permission before the sideload distribution can be declared compliant.",
      "scope": ["android-mobile-sideload"]
    },
    {
      "id": "angle-windows-binaries",
      "version": "v1.0.1",
      "licence": "BSD-3-Clause (ANGLE); bundled third-party notices also apply",
      "wrapperSourceCommit": "f5aecbb3afb7101d62688d83aa9c19442161d024",
      "archiveMd5": "e866f13e8d552348058afaafe869b1ed",
      "archiveSha256": "cc5911bb15d596fd5a2b362613ad35b7093b427117269a7359054a65746a5f9a",
      "status": "notice-added-exact-angle-source-revision-not-published-by-upstream-wrapper",
      "scope": ["windows"]
    }
  ]
}