# Open-source counsel review packet

Status: **review required; no approval is represented by this file**.

## Artifact under review

- Binary release: Film Buddy 0.7.0 (build 1)
- Candidate source archive:
  `FilmBuddy-0.7.0-1-corresponding-source.tar.xz`
- GPL-covered executable:
  `Film Buddy.app/Contents/MacOS/filmbuddy-raw-decode-libraw`
- Public download and final archive SHA-256: to be filled only after approval

## Evidence prepared

- exact source/component identities in `COMPONENTS.md`;
- complete archive file hashes in `SOURCE-MANIFEST.sha256`;
- modifications and packaging steps in `MODIFICATIONS.md`;
- build instructions in `BUILDING.md`;
- practical replacement/signing instructions in
  `INSTALLING_MODIFIED_HELPER.md`;
- included GPL, LGPL, Boost, and LLVM source/license material; and
- local rebuild, unsigned-binary comparison, replacement, signing, and status
  execution performed by `tools/verify_corresponding_source_archive.sh` in the
  Film Buddy repository.

For the byte comparison, both shipped and rebuilt Mach-O copies receive the
same temporary ad-hoc signature and then have it removed. This normalizes the
`__LINKEDIT` reservation left by differently sized Developer ID and ad-hoc
signatures. LLVM `__FILE__` assertion strings are reproduced with
`-ffile-prefix-map`; executable code and data are not masked from comparison.

## Requested conclusions

Ask qualified open-source counsel to review and record conclusions on:

1. whether the included material is complete Corresponding Source for the
   shipped helper and bundled `libomp.dylib` under GPLv3;
2. the process boundary between the proprietary app and GPL helper;
3. Film Buddy's LGPL-2.1 selection and static-link/relinking obligations for
   LibRaw;
4. whether the Installation Information and replacement steps are sufficient;
5. required notices, source-link placement, availability period, and whether
   any written offer is needed for each distribution channel;
6. whether the added SPDX statement and public licensing authority are
   supported by chain-of-title records; and
7. whether any additional build inputs, interface material, or scripts must be
   included before publication.

## Approval record

Do not complete this section without the reviewer's authorization.

```text
Reviewer / firm:
Review date:
Approved archive SHA-256:
Approved public URL:
Scope and assumptions:
Required changes:
Final conclusion:
```
