CouchPotatoPlayer Android tv 1.2.0 (374) — source and notice materials
Exact application source commit: e601550fdf3d5834d4f5959ca30e643ae2c30752
Recorded upload AAB SHA256: 07a6537b356eb52396f7a4b4a61e7fc2ce6cd966da8be15ed16c1465d5b27969
Hermes application bundle SHA256: ce7eca1bd0e51488cd30566b1db6626076b4934f46971ee720a672af792ff352
Recorded local QA APK SHA256: b48e254157ad12e94f027780739be6995d1a0ca53fff260f5e50064782320f79

SCOPE AND SIGNATURE
The source correspondence below is verified against the recorded Play upload
AAB and its AAB-derived local QA APK. The QA APK uses the existing upload key;
it is NOT Google-app-signed and is NOT a website distribution download. A matching
Google-signed universal APK has not been verified by this pack. No Google-signed
APK hash, website availability date or public store rollout is asserted.

EXACT NEW APPLICATION SOURCE
CouchPotatoPlayer-source-v1.2.0-374-e601550f.zip is a fresh git archive of the exact commit above, with its Git ZIP
comment and selected source bytes checked. Historical373 application source is
not used as the source of this build. Original app and CPPlayerKit licensing is
unchanged; this publication grants no new rights to proprietary original code.
Production signing credentials, OAuth values and generated bundles are excluded.
The repository's existing development debug.keystore is unchanged from373 and
is not a production signing credential. Android SDKs and installed dependencies remain separate build inputs.

REUSED COMPONENT SOURCE AND NOTICE FILES
The manifest explicitly identifies each byte-identical reused373 component file
and retains its original filename/hash/public URL. It does not relabel old files.
- android-libmpv-lgpl-sources-373.zip: all20 actual provider shared libraries in
  ARMv7/ARM64 match the373 APK, actual AAR and the already published source
  provenance hashes. The complete provider source closure, patches, build.py,
  configuration, notices and build instructions therefore remain applicable.
- android-media3-ffmpeg-8.1.3-source-373.zip: all10158 FFmpeg/Media3 decoder source
  files, build script, free2ABI metadata and referenced module/host inputs were
  freshly compared with this build's checkout and match. Rebuilt libffmpegJNI
  binaries have their own recorded hashes; bit-for-bit rebuilds are not claimed.
  Current additional host inputs are in android-tv-374-host-build-materials.zip; they supersede any older
  build-number/target-specific descriptions in the reused373 source package.
- pro-iap-notices-373.zip: the dependency/lock inputs are unchanged, expo-iap6.3.0,
  OpenIAP Google/Core4.0.6 and actual Billing9.1.0 remain in use. Billing's SDK
  license and bundled notices are retained. Shared Apple notices in that pack do
  not mean this Android build ships Apple code or supplies Apple relink materials.
- npm-notices-373.zip: all802 recorded installed identities resolve in this build;
  all751 supplied package notice payloads match their installed files. This is
  reuse of unchanged notice bytes, not an assertion of complete attribution.
- apk-embedded-notices-373.zip: all7 actual original notice/Billing payloads in
  this AAB and local QA APK match those373 bytes; its historical README is not a
  claim that the373 APK is this build. Current provenance is in COMPONENTS-374.json.

REPLACING SHARED LIBRARIES
Use the component source archives and included build scripts/configuration to
rebuild compatible shared libraries. Replace appropriate Android ABI entries in
an APK/AAR and sign a modified installation with your own Android credentials.
No production signing key, Google app-signing key or SDK is supplied. Nothing in
this publication restricts rights granted by the controlling upstream licenses,
including applicable rights to modify or debug changes to library components.

LIMITATIONS
This is a technical correspondence record, not a complete license audit or legal
certification.57 installed package identities in the inherited npm inventory lack
package-root notice files;44 are in a conservative production graph which also
includes build/CLI tools. Monorepo attribution and exact runtime-shipment mapping
remain unverified. This Android-only pack makes no Apple source/relink claim.
No OAuth grant, working TV Drive sync, real Store purchase or fresh native source
rebuild was performed as part of this source publication audit. Google-signed
universal APK comparison remains an explicit separate step.
