CouchPotatoPlayer Android mobile 1.2.0 (373) — source and notice materials
Source commit: 1e3bebaa5ddec21daa963205d6590db023ee4aad
APK SHA256: f2e86817387cb80089307981bc35689ba6b1fc2a081254d95b451dc5ce9c95f7

Scope: the Google Play signed universal Android MOBILE APK373. These materials
are prepared for a new373 publication directory. Historical367 files remain
unchanged. This is a technical correspondence record, not a legal certification.
No Store purchase, OAuth login or source rebuild was performed by this check.

FILES
CouchPotatoPlayer-source-v1.2.0-373-1e3bebaa.zip: git archive of the exact recorded
app source commit, including lockfile and tracked native integration sources.
This copy does not alter the proprietary LICENSE or grant new rights to original
application/CPPlayerKit code. No ignored release credentials or signing secrets
are included. Android SDK, installed npm packages and generated native output
are separate build inputs rather than contents of this git archive.

android-libmpv-lgpl-sources-373.zip: the actual373 provider's complete source
closure archive (24217 files), build.py, patches, source lock, build configuration,
original notices and provenance. Actual AAR hash413adddae5450e5f53837ed4129420c1f7dc5d00a8766a012d0ae702c2a48f15.
All20 shipped provider shared libraries, ARMv7+ARM64, match both AAR and recorded
source provenance SHA256. Follow its README/build script with the specified
NDK29.0.14206865/API26. Binary matching is proven; a fresh rebuild was not run.

android-media3-ffmpeg-8.1.3-source-373.zip: all10158 FFmpeg8.1.3/Media3 decoder
source files were compared byte-for-byte to the actual373 build checkout.
The free decoder/2ABI metadata and build script also match. The host Gradle
module and additional host version files are the actual373 inputs. Newly built
libffmpegJNI.so binaries are not claimed byte-identical to367. Follow the included
build-materials/build-media3-ffmpeg.sh and373 build-material notes.

pro-iap-notices-373.zip: unchanged separately prepared IAP notices and POMs.
The actual APK billing.properties confirms Google Play Billing9.1.0. Preserve
the SDK-specific license attribution and its bundled third-party notice files;
it is not labeled MIT. Supplement also contains Apple notices for the shared
Pro implementation; their presence does not claim Android ships Apple code.

npm-notices-373.zip: unchanged root notice texts from802 actually installed
package identities, including build tools; complete original READMEs are used
where they contain the notice. Its inventory and explicit57 missing-root-notice
mapping entries are included.44 are members of the conservative production
package graph, which itself includes CLI/build tooling. Monorepo root-license
mapping and exact runtime-shipment classification remain unverified. This ZIP
must not be described as a completed all-dependency license audit.

apk-embedded-notices-373.zip: original LICENSE/NOTICE payloads and Billing version
metadata directly copied from the Google-signed APK. COMPONENTS.txt maps APK
native SHA256s and the observed source correspondence. SHA256SUMS.txt identifies
the exact publication payloads.

REPLACING SHARED LIBRARIES
For Android, rebuild compatible LGPL shared libraries using the provided sources
and configuration, replace the appropriate APK/AAR ABI entries, and sign your
modified installation with your own Android credentials. No service signing key,
Google app-signing private key, Android SDK or production secret is supplied.
Nothing here changes rights granted by upstream licenses, including rights
concerning modification or reverse engineering to debug changes to those library
components. The original copyright/license texts remain controlling.

LIMITS AND FOLLOW-UP
Current source/notice mapping is Android373 only. Apple373 relink inputs are not
provided here;367 Apple object kits must not be asserted to match373. TV374 is
another source/artifact and needs its own correspondence receipt. Remaining
npm notice mapping is documented rather than silently assumed complete. Optional
platform dependency edges absent on this host are listed in the npm gap report.
