# Android Native Media License Audit

Last reviewed: 2026-07-24

## Scope

This note closes the remaining Android FFmpegKit/GPL follow-up after
`ffmpeg_kit_16kb` was removed from HL Player.

It covers only the Android video playback stack supplied through media_kit:

- `media_kit_libs_android_video: 1.3.8`
- `media-kit/libmpv-android-video-build` release `v1.1.7`
- The bundled `default-*.jar` Android artifacts that contain `libmpv.so`
- FFmpeg symbols statically linked inside `libmpv.so`

It does not cover the separate source-built app-side FFmpeg/FFprobe runtime
adopted for subtitle generation and highlight/compact-video compatibility
fallbacks. That runtime is tracked in
`docs/compliance/android-lgpl-ffmpeg-adoption-evidence.md`.

## Conclusion

The current Android release build no longer bundles FFmpegKit.

For the playback path covered by this document, FFmpeg symbols come from the
`media_kit_libs_android_video` `default` libmpv runtime. That upstream default
build is configured with GPL and nonfree components disabled:

- `buildscripts/bundle_default.sh` packages `default-*.jar`.
- The GitHub Actions workflow runs `bundle_default.sh`.
- `buildscripts/flavors/default.sh` sets `--disable-gpl` and
  `--disable-nonfree`.
- `buildscripts/flavors/default.sh` does not enable `libx264`, `libx265`,
  `xvid`, or other GPL encoder libraries.
- `buildscripts/scripts/mpv.sh` sets `-Dgpl=false`.
- The upstream `encoders-gpl` flavor exists separately but is not the artifact
  referenced by `media_kit_libs_android_video: 1.3.8`.

Therefore the former FFmpegKit GPL release blocker remains closed for the
media_kit playback dependency set. This is not a waiver of LGPL/MIT/BSD/Apache
notice and source-offer obligations for the bundled native media stack, and it
does not replace the separate app-side FFmpeg adoption evidence.

The distribution side of that obligation is implemented by the versioned
`HLPlayer-Android-libmpv-v1.1.7-corresponding-source.zip` bundle under
`hosting/open-source/downloads/android`. The app and public notice page link
directly to it. The bundle contains the pinned default-flavor build repository,
all sources in the default dependency graph, full LGPL license texts, the
GPLv3 text referenced by LGPLv3, checksums, and final artifact verification
evidence.

## Local Evidence

HL Player dependency:

```yaml
media_kit: ^1.1.10
media_kit_video: ^1.2.4
media_kit_libs_android_video: ^1.3.6
```

Resolved package:

```text
media_kit_libs_android_video 1.3.8
```

2026-05-16 source re-check:

- `pubspec.lock` still resolves `media_kit_libs_android_video` to `1.3.8`.
- The upstream `v1.1.7` `buildscripts/scripts/mpv.sh` uses `-Dgpl=false`.
- The release AAB scan found `libmpv.so` but no standalone FFmpegKit,
  FFmpeg CLI, x264, x265, xvid, `mobile-ffmpeg`, or `arthenica` binary entries.

2026-05-24 source and artifact re-check:

- `pubspec.lock` still resolves `media_kit_libs_android_video` to `1.3.8`.
- Since the 2026-05-16 notice review, `pubspec.lock` and
  `android/app/build.gradle.kts` have no media dependency changes.
- The local pub cache for `media_kit_libs_android_video-1.3.8` contains the MIT
  package license and its Android Gradle script still downloads
  `libmpv-android-video-build` `v1.1.7` `default-*.jar` artifacts.
- The rebuilt release AAB from `tool/build_android_release.ps1 -Target
  appbundle` contains `libmpv.so` and `libmediakitandroidhelper.so` for
  `arm64-v8a`, `armeabi-v7a`, and `x86_64`.
- The rebuilt release AAB scan found no standalone FFmpegKit, FFmpeg CLI,
  FFmpeg shared libraries, x264, x265, xvid, `mobile-ffmpeg`, `arthenica`,
  `encoders-gpl`, `nonfree`, or GPL artifact path entries.
- The release manifest permission gate also passed: no `ACCESS_WIFI_STATE` or
  `CHANGE_NETWORK_STATE` permission is present in the merged release manifest.

The package Gradle script downloads these upstream release artifacts:

```text
https://github.com/media-kit/libmpv-android-video-build/releases/download/v1.1.7/default-arm64-v8a.jar
https://github.com/media-kit/libmpv-android-video-build/releases/download/v1.1.7/default-armeabi-v7a.jar
https://github.com/media-kit/libmpv-android-video-build/releases/download/v1.1.7/default-x86_64.jar
https://github.com/media-kit/libmpv-android-video-build/releases/download/v1.1.7/default-x86.jar
```

Upstream source tag:

```text
media-kit/libmpv-android-video-build v1.1.7
commit fe8c3ac1a91c09aa6fb1deccbc833f1bafa54768
```

Local jar SHA-256 values:

```text
default-arm64-v8a.jar    4363DFA5D3D415B91C1F16F6FB90C3FE59A77DFD3F9B824D2B24B492D6B09DF9
default-armeabi-v7a.jar  8EAD114FC5A43348D89DC0EB8F41823E549B15115C29F73EE26973F973620995
default-x86_64.jar       90268CD15F0766E07FB8E427388C621161177C9EB343C544F327BD63232BB236
default-x86.jar          94C13CB6188B774710E5E487AFFF6E500C4AF504DF74B2494D7B12CF9BE8A66A
```

The 2026-05-24 reviewed release AAB contained `libmpv.so` for Android ABIs, but
no standalone `ffmpeg`, `ffprobe`, `libavcodec.so`, `libavformat.so`,
`libavutil.so`, `libswresample.so`, `libswscale.so`, `x264`, `x265`, or `xvid`
binary entries. Current releases may intentionally contain the separate
app-side FFmpeg runtime described in
`android-lgpl-ffmpeg-adoption-evidence.md`.

Inspection of `libmpv.so` confirms FFmpeg symbols are statically linked. This is
expected for the upstream default flavor and is not the removed FFmpegKit GPL
package.

## Bundled Native Media Components

The audited default libmpv stack includes:

- media_kit / media_kit_video / media_kit_libs_android_video
- media-kit/libmpv-android-video-build wrapper
- mpv/libmpv, built with `-Dgpl=false`
- FFmpeg 6.0, built with `--disable-gpl`, `--disable-nonfree`,
  `--enable-version3`, static libraries, and selected decoders/demuxers
- libass 0.17.1
- FreeType 2.13.0
- FriBidi 1.0.12
- HarfBuzz 7.2.0
- dav1d 1.2.0
- mbed TLS 3.4.0
- libxml2 2.10.3

The upstream `encoders-gpl` flavor adds GPL encoder support such as `libx264`.
HL Player must not switch to `encoders-gpl-*.jar` or any artifact built with
`--enable-gpl` / `--enable-nonfree` without a separate legal decision.

## Required Distribution Posture

For public Android distribution:

- Keep using `default-*.jar`, not `encoders-gpl-*.jar`.
- Keep the manual open-source notices for libmpv, FFmpeg, and the transitive
  media dependencies.
- Publish the exact versioned corresponding-source bundle on the same service
  as the application notice page and keep its direct link stable.
- Include the LGPL-2.1, LGPL-3.0, and GPL-3.0 license texts. GPL-3.0 is included
  because LGPLv3 is expressed as additional permissions to GPLv3; it is not
  evidence that the GPL-only build flavor was used.
- Preserve copyright and warranty-disclaimer notices.
- Re-run this audit whenever `media_kit_libs_android_video` changes version or
  its downloaded release URL changes.

## Re-Audit Commands

```powershell
rg "ffmpeg_kit_16kb|FFmpegKit|FFprobeKit|ReturnCode|com\.arthenica|mobile-ffmpeg" pubspec.yaml pubspec.lock lib android -S
tar -tf build\app\outputs\bundle\release\app-release.aab | Select-String "ffmpeg|ffprobe|avcodec|avformat|avutil|swresample|swscale|x264|x265|xvid"
tar -tf build\media_kit_libs_android_video\v1.1.7\default-arm64-v8a.jar
```

For upstream verification:

```powershell
git clone --depth 1 --branch v1.1.7 https://github.com/media-kit/libmpv-android-video-build.git
rg "disable-gpl|disable-nonfree|enable-gpl|enable-nonfree|libx264|encoders-gpl|-Dgpl=false" buildscripts .github -S
```
