# Zyryn custom libmpv App Store build

Zyryn keeps MPV enabled in iOS and macOS App Store builds. The media-kit
v0.6.0 `Mpv` binary imports `fstatfs` only to classify mounted AFP/NFS/SMB
filesystems for cache and read-ahead hints. That behavior is not a disk-capacity
check and does not match an Apple-approved Disk Space required-reason purpose.
The App Store build therefore uses a narrowly patched source rebuild instead
of removing MPV or declaring a false privacy reason.

## Pinned source and binary inputs

- media-kit `libmpv-darwin-build` tag `v0.6.0`, commit
  `4286f5557bdccc0747030e3c376ce5cd160a96a0`.
- mpv `v0.36.0`, source archive SHA-256
  `29abc44f8ebee013bb2f9fe14d80b30db19b534c679056e4851ceadf5a5e8bf6`.
- FFmpeg `6.0`, source SHA-256
  `57be87c22d9b49c112b6d24bc67d42508660e6b718b3db89c44e47e289137082`.
- libass `0.17.1`, source SHA-256
  `f0da0bbfba476c16ae3e1cfd862256d30915911f7abaa1b16ce62ee653192784`.
- uchardet `0.0.8`, source SHA-256
  `e97a60cfc00a1c147a674b097bb1422abd9fa78a2d9ce3f3fdcc2e78a34ac5f0`.
- Exact media-kit v0.6.0 per-architecture `video-default` dependency
  archives, whose checksums are pinned in `build_custom_libmpv.sh` and recorded
  in each artifact's `provenance.json`.
- Meson `1.2.1` wheel SHA-256
  `08f83fc17513e99cd6e82c7554c1f58af70425211887f8f9c7363b2a90209462`.

The published dependency dylibs remain immutable link inputs. Zyryn rebuilds
only mpv from the exact upstream source/feature recipe, then replaces only
`Mpv.xcframework` inside a workspace-local copy of the Flutter plugin. Debug,
direct-download, Android, and the global Flutter pub cache are unchanged.

## Reviewed changes

`patches/libmpv-0.36.0-no-fstatfs.patch` makes Apple targets use mpv's existing
portable fallback for `check_stream_network`. File opening, reads, seeking,
decoding, explicit HTTP/HTTPS and other network URLs, the public client/render
API, and both player engines remain enabled. The only behavior removed is
automatic classification of a file path residing on a mounted network
filesystem as a streaming input.

`patches/libmpv-darwin-v0.6.0-xcode26.patch` changes the obsolete simulator
deployment flag to `-mios-simulator-version-min`, applies the reviewed privacy
patch, and disables the embedded build timestamp. It does not change mpv's
enabled feature set.

## Build and stage

From the repository root:

```bash
bash scripts/appstore/build_custom_libmpv.sh all
```

The script downloads and verifies every pinned input, bootstraps the exact
Meson wheel in the ignored cache, rebuilds five slices, constructs the iOS and
macOS XCFrameworks from the upstream templates, and writes source provenance.
Artifacts remain under
`.appstore-cache/libmpv-0.36.0-media-kit-v0.6.0`.

The iOS/macOS delivery scripts copy the media-kit package into a temporary
workspace-local staging directory and invoke `stage_custom_libmpv.sh`. The
verifier requires:

- iOS arm64 device plus arm64/x86_64 simulator slices;
- macOS arm64/x86_64 slices;
- minimum OS versions no higher than Zyryn's iOS 15.0/macOS 13.5 floors;
- the stock mpv 0.36.0 exported API digest, install name, and linked media-kit
  framework paths for every architecture;
- no `statfs`, `fstatfs`, `statvfs`, or `fstatvfs` import;
- an unsigned cache that can be signed and strictly verified by `codesign`;
- exact source, patch, LGPL license, and copyright provenance.

## End-user notice and corresponding source

The shipped app links Settings > Legal > Open Source Licenses to
`https://zyryn.com/open-source`. That page provides the full LGPL-2.1-or-later
text, upstream copyright notices, exact source revisions, downloadable Zyryn
patches/build scripts, and a corresponding-source request path. The app bundle
also carries the mpv LGPL and copyright text under `assets/licenses`.

mpv is built with Meson's `gpl=false` option and is distributed under
LGPL-2.1-or-later terms. Nothing in Zyryn's EULA is intended to restrict
reverse engineering permitted by an applicable open-source license for the
purpose of debugging a user's modification of an LGPL component.

Before distributing a new binary, retain its complete corresponding source,
build recipe, dependency source revisions, notices, and toolchain provenance
for the required distribution period. Re-run legal/license review whenever
mpv or any enabled dependency changes. This file records engineering
provenance and is not legal advice.