{
  "schemaVersion": 1,
  "publishedAt": "2026-07-26",
  "product": "Mango Player TV",
  "release": {
    "versionName": "1.2.29",
    "versionCode": 253,
    "canonicalExportCommit": "3bf7d60e351fd9f47d7be5dea6b39b9e3b575e51",
    "libvlcAar": "org.videolan.android:libvlc-all:3.6.0",
    "libvlcAarSha256": "cd1855371bc0008e89ef7ec1fcb0042e740ee185d79408193f02d3824c88cb61"
  },
  "status": {
    "officialPinChain": "verified",
    "sourceArchives": "mirrored-and-hash-verified",
    "independentStaticDependencyClosure": "open",
    "storeDistributionClearance": "not-declared"
  },
  "files": [
    {
      "file": "vlc-android-38a29a083b2de8483db8a562692206bb6168b71d.tar.gz",
      "bytes": 8094578,
      "sha256": "5E7545E804E0CDFBFCBB057E9FC2AFA1031299643FE7B14E47369BE39B9B0276",
      "upstream": "https://code.videolan.org/videolan/vlc-android/-/archive/38a29a083b2de8483db8a562692206bb6168b71d/vlc-android-38a29a083b2de8483db8a562692206bb6168b71d.tar.gz",
      "role": "Official vlc-android libvlc-3.6.0 tag source and build entry point"
    },
    {
      "file": "libvlcjni-05d76f37559e2a2e5cd4248053a76ceff5a523e1.tar.gz",
      "bytes": 257566,
      "sha256": "A966D91B6C25327F7EDB853E047214CBBED9C34F24E26A7AA7FDED39E024E42F",
      "upstream": "https://code.videolan.org/videolan/libvlcjni/-/archive/05d76f37559e2a2e5cd4248053a76ceff5a523e1/libvlcjni-05d76f37559e2a2e5cd4248053a76ceff5a523e1.tar.gz",
      "role": "JNI bindings, VideoLAN patches and VLC source pin"
    },
    {
      "file": "vlc-5ee481afa798f281304754b001572dfe5dc0078e.tar.gz",
      "bytes": 32505943,
      "sha256": "E02007790715967E869E0F34DF137DE3DE9C61EE6944B3266C27A299A0424A64",
      "upstream": "https://code.videolan.org/videolan/vlc/-/archive/5ee481afa798f281304754b001572dfe5dc0078e/vlc-5ee481afa798f281304754b001572dfe5dc0078e.tar.gz",
      "role": "Pinned VLC engine source before the libvlcjni patch series"
    },
    {
      "file": "libvlc-all-3.6.0-sources.jar",
      "bytes": 75023,
      "sha256": "DDB8078F6274CF729CA7208196FCDDA3CF38C0A303159BAEA5FC278FC04D89FF",
      "upstream": "https://repo1.maven.org/maven2/org/videolan/android/libvlc-all/3.6.0/libvlc-all-3.6.0-sources.jar",
      "role": "Official Maven Java/Kotlin source attachment"
    },
    {
      "file": "libvlc-all-3.6.0.pom",
      "bytes": 2054,
      "sha256": "36617A2F6C4C27B4A90C7F8AA6D25112818B7BC026A216306538575F898565EC",
      "upstream": "https://repo1.maven.org/maven2/org/videolan/android/libvlc-all/3.6.0/libvlc-all-3.6.0.pom",
      "role": "Official Maven coordinates, licence claim and SCM metadata"
    }
  ],
  "warning": "This evidence set does not by itself certify that every statically linked dependency obligation is closed. The independent closure review remains open."
}