From 1361a71510d8e4aaf6b67033859d1131229b8d76 Mon Sep 17 00:00:00 2001 From: Dafka <322898297+dafka007@users.noreply.github.com> Date: Mon, 12 Oct 2026 19:48:56 +0300 Subject: [PATCH 1/3] docs: correct CHANGELOG.md for public v0.2.3 release --- CHANGELOG.md | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d4dc088..16a76af 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ All notable changes to FramePier are documented here. Versions follow Semantic Versioning. -## [Unreleased] +## [0.2.3] - 2026-10-12 ### Added @@ -26,14 +26,6 @@ All notable changes to FramePier are documented here. Versions follow Semantic V - Replaced the FFmpeg LGPL-3.0 license text with LGPL-2.1, added LAME and winpthreads license texts, the MinGW-w64 runtime text, the FFmpeg build provenance and a source-availability index to `licenses/`. - Every yt-dlp process is now created by one helper that always passes `--ignore-config`, `--no-plugin-dirs`, `--no-remote-components` and `--no-js-runtimes`, then enables only the bundled Deno by absolute path for YouTube. User-level yt-dlp configuration, plugins, remotely fetched components and runtimes found on PATH are no longer used. -## [0.2.3] - 2026-09-20 - -### Changed - -- Upgraded FFmpeg from Gyan 8.1.1 (GPL) to BtbN 8.1.2 LGPL-3.0 build (`autobuild-2026-08-31-13-27`), fixing CVE-2026-8461 (CVSS 8.8) and CVE-2026-30999. -- Updated build script to pin the immutable BtbN release-tag URL with SHA-256 verification on both the archive and extracted binaries. -- Updated `THIRD_PARTY_NOTICES.md` to document the BtbN provider, build-repo commit, FFmpeg source commit, and LGPL-3.0 licensing. - ## [0.2.2] - 2026-09-05 ### Fixed From 69faadfd8d6c583d52b5d78b010466c35e3b91a3 Mon Sep 17 00:00:00 2001 From: Dafka <322898297+dafka007@users.noreply.github.com> Date: Mon, 12 Oct 2026 19:48:58 +0300 Subject: [PATCH 2/3] docs: correct README.md for public v0.2.3 release --- README.md | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 7bb16b4..cd9c50e 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ FramePier is an open-source Windows video downloader that works through a browse Use FramePier only for media you own, have permission to download, or are otherwise legally allowed to save. -Version: **0.2.3** +Version: **0.2.3** — [latest Windows installer and corresponding source archives](https://github.com/dafka007/FramePier/releases/tag/v0.2.3) ## Support @@ -15,7 +15,7 @@ Version: **0.2.3** ## Requirements -The Windows installer includes the FramePier helper, a checksum-verified official `yt-dlp` Windows release, and a shared FFmpeg build (see below). It also includes a pinned, checksum-verified Deno JavaScript runtime, which yt-dlp needs to extract YouTube videos. No Python or other runtime is required after installation. +The Windows installer includes the FramePier helper, a SHA-256-verified FramePier-built `yt-dlp.exe` from the upstream 2026.08.19 source tag, and a shared FFmpeg build (see below). It also includes a pinned, checksum-verified Deno JavaScript runtime, which yt-dlp needs to extract YouTube videos. No Python or other runtime is required after installation. ## Install the helper @@ -146,14 +146,21 @@ Use **Installed apps → FramePier → Uninstall** or the FramePier Start Menu s ## Build from source -From PowerShell on Windows: +For the v0.2.3 build, first provide the exact verified Windows dependencies in the following local locations: + +- `.tools\ytdlp-openssl3\yt-dlp.exe` — FramePier's own build of yt-dlp 2026.08.19 with Python 3.13.16 and OpenSSL 3.5.9. The build checks its pinned SHA-256. See `third-party/ytdlp-openssl3/` and the corresponding-source archive on the v0.2.3 release. +- `.tools\ffmpeg-shared\` — verified `ffmpeg.exe`, `ffprobe.exe`, and nine DLLs from the shared LGPL FFmpeg/LAME build. The build checks each file's pinned SHA-256. See `third-party/ffmpeg-shared/` and the FFmpeg/LAME corresponding-source archive on the v0.2.3 release. + +**The build script does not download these two custom binary builds.** Obtain or rebuild them from the documented source/build materials and verify the expected hashes before running it. A byte-for-byte reproducible toolchain has not been independently established. You may alternatively supply them through `-YtDlpPath` and `-FFmpegSharedDir`. + +From PowerShell on Windows, with Inno Setup 6 installed: ```powershell .\scripts\build-icons.ps1 -Source .\assets\framepier-mark.png .\scripts\build.ps1 ``` -The build script obtains the current stable Go Windows archive from `go.dev`, validates its official checksum, runs Go tests, builds a static helper, downloads and verifies the two media tools, packages the extension, and compiles the Inno Setup installer. Inno Setup 6 must be installed (`winget install --id JRSoftware.InnoSetup -e`). Build downloads and artifacts live under ignored `.tools` and `dist` directories. +The build script uses an installed Go SDK or obtains and checksum-verifies the official stable Windows SDK from `go.dev`, runs Go tests, builds the Windows helper, copies and checksum-verifies the supplied yt-dlp and shared FFmpeg binaries, downloads and checksum-verifies bundled Deno 2.9.7, packages the extension, and compiles the Inno Setup installer. Inno Setup 6 must be installed (`winget install --id JRSoftware.InnoSetup -e`). Build downloads and artifacts live under ignored `.tools` and `dist` directories. Run all local checks with: From 155d1cf3c60cb2fcc9fafc989fc11ee5f4da47e0 Mon Sep 17 00:00:00 2001 From: Dafka <322898297+dafka007@users.noreply.github.com> Date: Mon, 12 Oct 2026 19:49:01 +0300 Subject: [PATCH 3/3] docs: correct docs/redistribution-gate.md for public v0.2.3 release --- docs/redistribution-gate.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/docs/redistribution-gate.md b/docs/redistribution-gate.md index 8ab3d12..142870c 100644 --- a/docs/redistribution-gate.md +++ b/docs/redistribution-gate.md @@ -1,13 +1,13 @@ # FramePier 0.2.3 redistribution gate -**Status: documentation complete; owner sign-off pending (see Owner decisions).** This file is a repository document; it is not installed. A working build or a source archive is not a compliance finding. +**Status: FramePier v0.2.3 publicly released on 2026-10-12.** The installer, extension and both corresponding-source archives were confirmed on [the GitHub v0.2.3 release](https://github.com/dafka007/FramePier/releases/tag/v0.2.3) with the previously recorded SHA-256 hashes. The download directions are in its release description. This file is not installed. **Publication does not establish complete legal compliance or independent legal sign-off.** See remaining decisions below. ## Component status | Component | Status | Evidence / remaining | |---|---|---| -| FFmpeg + LAME + 9 DLLs | Material ready; publication and owner review pending | `FramePier-0.2.3-FFmpeg-LAME-Source.zip` (SHA-256 `61b8539d5866b899ca173a7edb71502ff78d0b090500990f7442f36b54b1327a`, reproduced byte-identically by `third-party/build-source-bundles.py`) holds the FFmpeg commit, the LAME 3.100 tarball (hash and `COPYING` checked), `BUILD-INSTRUCTIONS.txt`, configuration, package versions, workflow and licenses. Must be attached to the same release as the installer. One build run; not shown to be byte-reproducible. | -| yt-dlp 2026.08.19 (FramePier build, Python 3.13.16 / OpenSSL 3.5.9) | Source and notices complete; OpenSSL 1.1.1t issue removed | See below. | +| FFmpeg + LAME + 9 DLLs | Corresponding-source archive published with the v0.2.3 installer; independent legal review not recorded | `FramePier-0.2.3-FFmpeg-LAME-Source.zip` (SHA-256 `61b8539d5866b899ca173a7edb71502ff78d0b090500990f7442f36b54b1327a`, reproduced byte-identically by `third-party/build-source-bundles.py`) holds the FFmpeg commit, the LAME 3.100 tarball (hash and `COPYING` checked), `BUILD-INSTRUCTIONS.txt`, configuration, package versions, workflow and licenses. Verified attached to the same public release as the installer. Both must remain available together. One build run; not shown to be byte-reproducible. | +| yt-dlp 2026.08.19 (FramePier build, Python 3.13.16 / OpenSSL 3.5.9) | Source archive published with installer; OpenSSL 1.1.1t issue removed | See below. | | Deno 2.9.7 | Notices compiled; two input steps recorded below | See below. | | winpthreads / MinGW-w64 runtime | Done | License texts match mingw-w64 revision `4564ee4b5063097bf747af3a3f8270a28adff820` byte for byte. | | Inno Setup | Closed | `jrsoftware/issrc` `license.txt` permits any purpose "including commercial applications"; the copyright notices in the setup program must stay. The FAQ position was supplied by the owner; the installed version's `license.txt` was not read. | @@ -32,7 +32,8 @@ Evidence (VERIFIED): the release archive contains only `deno.exe`; the repositor Notices compiled: `licenses/DENO-2.9.7-CRATE-LICENSES.txt` (all license/notice files of 930 crates that ship them, 574 distinct texts, each listed with the crates it covers; all 1,046 crates accounted for), `licenses/DENO-V8-LICENSES.txt` (V8, rusty_v8 and the build libraries FP16, Highway, fast_float, dragonbox, simdutf, abseil-cpp, ICU, LLVM libc++/libc++abi/libunwind/llvm-libc, Chromium, Rust std; taken from the projects' GitHub repositories, dragonbox at the pinned commit, the others at the default branch because Chromium's git host was not reachable), and `licenses/DENO-2.9.7-CRATE-AUTHORS.txt` (generated by `third-party/deno/collect-missing-crate-authors.ps1` for the 116 crates that ship no license file). Limit: the V8 library texts are not the exact pinned commits except dragonbox; terms are unchanged between them, copyright years may differ. -## Owner decisions +## Post-publication verification and unresolved decisions -- Review the published release page text (both source zips and directions next to the installer). -- v0.2.2 remains public with a GPL FFmpeg and no source bundle: leave, replace or withdraw. +- **Verified:** The v0.2.3 public release has the installer, browser extension, FFmpeg/LAME source ZIP and yt-dlp source ZIP with matching recorded SHA-256 values; the source-download directions are next to the installer. Keep both source archives available without charge for as long as the installer is distributed. +- **Not independently certified:** The documented Deno/V8 provenance limits above and overall license obligations still warrant owner or qualified legal review; do not treat an uploaded archive or successful automated test as a legal clearance. +- **v0.2.2 still needs remediation:** Its public installer bundles GPL FFmpeg 8.1.1, but its release lists no exact corresponding-source bundle. Either provide/verify the complete corresponding source and build materials for the exact v0.2.2 distribution, or withdraw the v0.2.2 installer from distribution. The v0.2.3 source archives **do not** cover v0.2.2. This is unresolved until the v0.2.2 release assets are corrected or removed.