Slurp — third-party software acknowledgements
================================================

Runtime prepared: 2026-08-23T19:26:01Z
Architecture: arm64

Current Slurp runtime policy:
- bundled yt-dlp fallback: pristine PyPI wheel under its source license
- managed yt-dlp updates: authenticated official zipimport artifact stored outside Slurp.app;
  signature and SHA-256 are verified before first execution
- embedded CPython: python-build-standalone distribution with its full license corpus preserved
- Python packages: generated license inventory; unexpected GPL/AGPL/LGPL pip packages are rejected by release policy
- Streamlink: BSD-2-Clause live-stream engine; pycountry is its explicitly tracked LGPL-2.1-only dependency with source redistribution
- Telethon: MIT Telegram provider; user credentials/session remain local
- Truststore: MIT; embedded Python/yt-dlp HTTPS uses Apple Security.framework trust policy
- QuickJS: MIT
- FFmpeg: LGPL configuration with --disable-gpl --disable-nonfree
- LAME: LGPL shared encoding library, decoder/mpglib disabled, dynamically loaded by FFmpeg

CPython 3.13.15
  Role: Embedded interpreter for yt-dlp, Streamlink and Telethon
  Distribution: python-build-standalone release 20260807
  Project: https://github.com/astral-sh/python-build-standalone
  Archive SHA-256: ebcf53fe921c356ad2eecfcea370cb744e7bd96fdef41a53e1e8f32a15c6dfeb
  Python executable SHA-256: 298d21ab43a8940a867fe356aca16bb216a2129f8df7f23a6a52e8bfa37446fa
  License corpus: PYTHON-RUNTIME-LICENSES.txt

yt-dlp nightly 2026.08.04.234419 (upstream commit 5d6b8c8)
  Role: Media extraction, site support and download orchestration
  Distribution: PyPI wheel installed into the standalone Python runtime
  License: The Unlicense
  Project: https://github.com/yt-dlp/yt-dlp
  Important: Slurp does not redistribute yt-dlp's GPLv3+ PyInstaller executable.


Streamlink 8.4.0
  Role: Live-stream discovery and recording engine
  Distribution: PyPI wheel installed into the standalone Python runtime
  License: BSD-2-Clause
  Project: https://streamlink.github.io/
  Dependency closure: PYTHON-PACKAGE-DEPENDENCY-MAP.txt
  Note: Slurp itself owns queue/session state, segmented recording lifecycle,
  pause/resume/reconnect behavior and recovery UI. Those Slurp components are
  not Streamlink code.
  Note: Streamlink depends on pycountry 24.6.1 (LGPL-2.1-only);
  its exact source archive is included in Slurp's exportable open-source materials.

Telethon 1.44.0
  Role: Telegram MTProto client used for authenticated media access
  Distribution: PyPI package installed into the standalone Python runtime
  License: MIT
  Project: https://docs.telethon.dev/
  Dependency closure: PYTHON-PACKAGE-DEPENDENCY-MAP.txt
  Session storage: local to Slurp Application Support; API hash is stored in macOS Keychain.

curl_cffi 0.15.1b2
  Role: Browser/TLS impersonation transport used by yt-dlp
  Distribution: Precompiled PyPI wheel installed into the standalone Python runtime
  License: MIT
  Project: https://github.com/lexiforest/curl_cffi
  Native lineage: curl-impersonate 2.0.0a5
  Exact native component audit: PYTHON-NATIVE-COMPONENTS.txt
  Exact dependency closure: PYTHON-PACKAGE-DEPENDENCY-MAP.txt
  Source materials: exact curl_cffi sdist and curl-impersonate source archive
  are retained in Slurp's exportable open-source materials.

yt-dlp-ejs 0.8.0 and selected Python dependencies
  Role: JavaScript challenge scripts, HTTP/browser impersonation and extractor support
  Exact installed package lock: PYTHON-PACKAGES-LOCK.txt
  Resolved root dependency closures: PYTHON-PACKAGE-DEPENDENCY-MAP.txt
  Native wheel component audit: PYTHON-NATIVE-COMPONENTS.txt
  License details: PYTHON-PACKAGES-LICENSES.txt
  Mutagen (GPL-2.0+) is intentionally not included.

Truststore 0.10.4
  Role: Native macOS certificate trust for embedded Python/yt-dlp HTTPS
  Platform backend: Apple Security.framework
  License: MIT
  Project: https://github.com/sethmlarson/truststore
  License text: TRUSTSTORE-LICENSE.txt
  Certificate verification remains enabled; this replaces static-only CA trust with macOS trust policy.

QuickJS 2026-06-04
  Role: JavaScript runtime used by yt-dlp challenge-solving workflows
  License: MIT
  Project: https://bellard.org/quickjs/
  Runtime: QuickJS 2026-06-04
  SHA-256: 384273fb3b5fcce03aa21589cc42dbf76199e60724a73a416cce610bc5c4ab8c

FFmpeg 9.0.1
  Role: Media muxing, conversion, merging and post-processing
  License: GNU Lesser General Public License v2.1 or later (LGPL v2.1+)
  Project: https://ffmpeg.org
  Runtime: ffmpeg version 9.0.1 Copyright (c) 2000-2026 the FFmpeg developers
  SHA-256: 0c7fd80bfa1e8091fdc6785abc2e3b7eba9bcb0391ee069e8119261ed4109a69
  Build policy: --disable-gpl --disable-nonfree --enable-libmp3lame

LAME 3.100 / libmp3lame.0.dylib
  Role: MP3 encoding for FFmpeg
  License: GNU Lesser General Public License (LGPL)
  Project: https://lame.sourceforge.io
  Packaging: separate dynamically linked encoding library; decoder/mpglib disabled; not statically compiled into FFmpeg
  SHA-256: 5d98f79c0e14194df0d026e5716956e66e912999048ed3cb7c683cc441622659

Slurp's original application code is proprietary. Third-party components
remain governed by their own licenses. Exact license texts are included with the
application. About Slurp > Licenses & Notices can export the corresponding
source archives, redistribution materials, and exact runtime build scripts that
are bundled inside this version of Slurp.