{
  "formatVersion": 1,
  "refreshContract": {
    "rules": [
      "Audit each new upstream release before changing its version, URL, ref, commit, or SHA-256.",
      "For an archive, verify upstream release evidence first, hash the complete reviewed file, and update URL and SHA-256 together.",
      "For Git, verify the upstream release-producing tag record, record the full dereferenced root commit, and review its dependency lock or gitlinks before updating.",
      "Run python3 scripts/verify_runtime_inputs.py and bash linux/packaging/build-libmpv_test.sh before a Linux build.",
      "Never derive an expected checksum from bytes inside the production build or verification command."
    ]
  },
  "inputs": {
    "ffmpeg": {
      "kind": "archive",
      "version": "7.1",
      "url": "https://ffmpeg.org/releases/ffmpeg-7.1.tar.xz",
      "sha256": "40973d44970dbc83ef302b0609f2e74982be2d85916dd2ee7472d30678a7abe6",
      "provenance": "FFmpeg release archive verified against ffmpeg-7.1.tar.xz.asc with the official ffmpeg-devel.asc full fingerprint FCF986EA15E6E293A5644F10B4322F04D67658D8 before recording this digest."
    },
    "shaderc": {
      "kind": "git",
      "version": "2024.4",
      "url": "https://github.com/google/shaderc.git",
      "ref": "v2024.4",
      "commit": "caa54d9779d5605aca4e1a0c0c962a3d8f4aeb31",
      "provenance": "Official GitHub annotated tag object 3cd72062f297df05e6a042f2616c42bc8956c326 dereferences to this root commit; its DEPS file pins synchronized dependencies by full commit."
    },
    "libplacebo": {
      "kind": "git",
      "version": "7.351.0",
      "url": "https://code.videolan.org/videolan/libplacebo.git",
      "mirror": "https://github.com/haasn/libplacebo.git",
      "ref": "v7.351.0",
      "commit": "3188549fba13bbdf3a5a98de2a38c2e71f04e21e",
      "provenance": "Official VideoLAN GitLab tag record v7.351.0 contains a PGP-signed release message and dereferences to this root commit; its gitlinks pin recursive submodules. The mirror is upstream's own author repository (haasn/libplacebo, not a fork), whose annotated v7.351.0 tag object 98c1416e95b21cd767b84ac9ee430ccadf263ff6 dereferences to that same commit. It is consulted only after the primary fails, and the commit pin is verified identically either way, so it cannot introduce a different tree."
    },
    "mpv": {
      "kind": "archive",
      "version": "0.40.0",
      "url": "https://github.com/mpv-player/mpv/archive/refs/tags/v0.40.0.tar.gz",
      "sha256": "10a0f4654f62140a6dd4d380dcf0bbdbdcf6e697556863dc499c296182f081a3",
      "commit": "e48ac7ce08462f5e33af6ef9deeac6fa87eef01e",
      "provenance": "GitHub reports annotated tag object 287d7cdb78975ae350d7c2a287eae3c2072c93f7 as a valid PGP signature over release commit e48ac7ce08462f5e33af6ef9deeac6fa87eef01e; the complete tag archive was then hashed."
    },
    "simdutf": {
      "kind": "archive",
      "version": "6.4.2",
      "url": "https://github.com/simdutf/simdutf/releases/download/v6.4.2/singleheader.zip",
      "sha256": "9fe4d6f515724a55c8de88fee4463e0890a1abe2267cda13c4b5d245d58039e6",
      "provenance": "Official GitHub release 210237657 records asset 243345703 as singleheader.zip with size 3013061 bytes; the complete release asset was independently hashed before recording this digest."
    }
  }
}