Imgovo - build notes for the LGPL / CDDL components
====================================================
Prepared: 2026-09-30. These notes summarise upstream build files. We have NOT run these builds
(the Emscripten toolchain could not be downloaded in our environment), so nothing below is a claim
that a rebuild reproduces the shipped binaries byte for byte.

A. RAW decoding - libraw.wasm  (npm package libraw-wasm 1.6.0)
--------------------------------------------------------------
What is shipped: libraw.wasm (SHA-256 8947f7e668e488461c3e9defe7007583aa8477b4886aa603b36b407f2f0846ff)
plus its JavaScript glue. Inside the WebAssembly file: the wrapper (libraw_wrapper.cpp), LibRaw, Little CMS,
IJG libjpeg and the Emscripten runtime (musl libc, LLVM libc++), all statically linked into one module.

Upstream release recipe (libraw-wasm .github/workflows/release.yml at tag v1.6.0):
  1. Ubuntu runner, Node 20, packages autoconf, automake, libtool
  2. Emscripten 5.0.7 (mymindstorm/setup-emsdk, version: 5.0.7)
  3. npm ci
  4. bash compileLibraw.sh
  5. npm run test, integration test, npm publish --provenance

compileLibraw.sh (in libraw-wasm-1.6.0-build-files.tar.gz):
  Stage A - builds two static libraries with emconfigure/emmake:
    * Little CMS: git clone --branch lcms2.19.1 https://github.com/mm2/Little-CMS.git
    * LibRaw:     git clone --branch 0.22.1 https://github.com/LibRaw/LibRaw.git ; autoreconf ;
                  configure --host=wasm32-unknown-emscripten --enable-openmp --enable-lcms --enable-jpeg
                  --disable-shared --disable-examples, with CFLAGS/CXXFLAGS
                  "-O3 -flto -ffast-math -msimd128 -DNDEBUG -DUSE_LCMS2 -DUSE_JPEG -DUSE_JPEG8 -sUSE_LIBJPEG=1"
                  (USE_X3FTOOLS is not defined, so LibRaw's Foveon/X3F code is not compiled - by reading the script.)
  Stage B - emcc --bind ... libraw_wrapper.cpp liblcms2.a libraw.a -o libraw.js
            with -s USE_LIBPNG=1 -s USE_LIBJPEG=1 -s USE_ZLIB=1 -s MODULARIZE=1 -s EXPORT_ES6=1
            -s ALLOW_MEMORY_GROWTH=1 -s INITIAL_MEMORY=256MB -s USE_PTHREADS=1 -msimd128 -O3 -flto -pthread
  Then "node build.js" produces dist/.
  libjpeg (IJG 9f) is fetched by Emscripten's port system; the same file is provided as jpegsrc.v9f.tar.gz.

Things to know:
  * Upstream's script skips Stage A when libs/ already exists and reuses the pre-built libs/*.a that its own
    CI committed (last rebuilt in upstream commit 4847c66, 2026-06-26, after the script last changed in 7bbc584).
    Our archive leaves libs/ out, so running the script rebuilds them from the tags named above.
  * The script downloads sources with git clone from GitHub. LibRaw-0.22.1.tar.gz and lcms2-2.19.1.tar.gz
    contain the same tag content; to build offline the git clone lines have to be replaced by these
    archives (we have not prepared or tested such a change).
  * Imgovo did not modify LibRaw, Little CMS, libjpeg or libraw-wasm.
  * Imgovo's own build (Vite/Rolldown) copies libraw.wasm unchanged into its output and bundles the
    JavaScript glue.

B. HEIC / HEIF decoding  (npm package heic-to 1.5.2)
----------------------------------------------------
What is shipped: a JavaScript file that contains heic-to's wrapper and, as an embedded worker script,
a pre-built libheif module (JavaScript, not WebAssembly; the libheif code and its data are inside the JS).
The header of heic-to's src/lib/libheif.js says: "Build from libheif 1.22.2 with LIBDE265_VERSION=1.0.16".

Upstream recipe (heic-to README, "How to build libheif.js"):
  1. Install Emscripten (the README uses Homebrew on macOS; the Emscripten version is NOT stated)
  2. git clone https://github.com/strukturag/libheif.git  (tag v1.22.2 = libheif-1.22.2.tar.gz)
  3. Edit build-emscripten.sh - the README shows one changed line (the llvm-nm path used to build
     EXPORTED_FUNCTIONS); the rest of the edit is not published
  4. mkdir buildjs && cd buildjs && LIBDE265_VERSION=1.0.16 USE_WASM=0 ../build-emscripten.sh ..
     (for the CSP variant: add USE_UNSAFE_EVAL=0)
     build-emscripten.sh downloads libde265 from
     https://github.com/strukturag/libde265/releases/download/v1.0.16/libde265-1.0.16.tar.gz
     (our libde265-1.0.16.tar.gz is the git tag content, not that release tarball)
  5. Copy libheif.js into heic-to/src/lib, then "npm run build" (node esbuild.mjs, esbuild ^0.25.4)
     produces dist/heic-to.js.

Things to know:
  * Imgovo did not modify heic-to, libheif or libde265.
  * Imgovo's build bundles heic-to's ES module into one of its own JavaScript files
    (heic-to.<hash>.js). Only the small wrapper around the embedded library is rewritten; we compared the
    embedded library text with the npm file and found it identical apart from that wrapper.
  * Because heic-to is bundled that way, a user cannot simply drop in a modified copy of heic-to.
    Whether that is acceptable under LGPL-3.0 is an open question - see the licences page and
    docs/LICENSE-AUDIT.md (internal).

Not verified (both A and B)
---------------------------
  * We did not rebuild any binary. Byte-for-byte reproduction is not expected (the WebAssembly file
    contains build-machine paths).
  * LibRaw 0.22.0 and 0.22.1 cannot be told apart by looking at strings in the WebAssembly file; the
    version claim rests on upstream's script, its CI files and the npm provenance record.
  * The Emscripten version used for heic-to's libheif.js is unknown.