CouchPotatoPlayer Android mobile 1.2.0 (375) — source and notice materials
Exact application source commit: 35691635910e3cef185cc4b015dff411cd67cae6
Recorded upload AAB SHA256: 84d2da25f6baa8fcdf6a768788e2bfffb8b6432a82e355b74dbb4c4d4d9b2bb1
Hermes application bundle SHA256: 00c8afe820738f64a9f7159f2f19f0326a1024152719ffca2c205e17b426137c
Recorded local QA APK SHA256: 54ebd2cd5f886dcb3c25a07ede30edca9751f64cbf49ba0152dfa4f97ada2c3e

SCOPE AND SIGNATURE
The source correspondence below is verified against the recorded Play upload
AAB and its AAB-derived local QA APK. The QA APK uses the existing upload key;
it is NOT Google-app-signed and is NOT a website distribution download. A matching
Google-signed universal APK has not been verified by this pack. No Google-signed
APK hash, website availability date or public store rollout is asserted.

EXACT NEW APPLICATION SOURCE
CouchPotatoPlayer-source-v1.2.0-375-35691635.zip is a fresh git archive of the exact commit above, with its Git ZIP
comment and selected source bytes checked. Historical373 application source is
not used as the source of this build. Original app and CPPlayerKit licensing is
unchanged; this publication grants no new rights to proprietary original code.
Production signing credentials, OAuth values and generated bundles are excluded.
The repository's existing development debug.keystore is unchanged from373 and
is not a production signing credential. Android SDKs and installed dependencies remain separate build inputs.

REUSED COMPONENT SOURCE AND NOTICE FILES
The manifest explicitly identifies each byte-identical reused373 component file
and retains its original filename/hash/public URL. It does not relabel old files.
- android-libmpv-lgpl-sources-373.zip: all20 actual provider shared libraries in
  ARMv7/ARM64 match the373 APK, actual AAR and the already published source
  provenance hashes. The complete provider source closure, patches, build.py,
  configuration, notices and build instructions therefore remain applicable.
- android-media3-ffmpeg-8.1.3-source-373.zip: all10158 FFmpeg/Media3 decoder source
  files, build script, free2ABI metadata and referenced module/host inputs were
  freshly compared with this build's checkout and match. Rebuilt libffmpegJNI
  binaries have their own recorded hashes; bit-for-bit rebuilds are not claimed.
  Current additional host inputs are in android-mobile-375-host-build-materials.zip; they supersede any older
  build-number/target-specific descriptions in the reused373 source package.
- pro-iap-notices-373.zip: the dependency/lock inputs are unchanged, expo-iap6.3.0,
  OpenIAP Google/Core4.0.6 and actual Billing9.1.0 remain in use. Billing's SDK
  license and bundled notices are retained. Shared Apple notices in that pack do
  not mean this Android build ships Apple code or supplies Apple relink materials.
- npm-notices-373.zip: all802 recorded installed identities resolve in this build;
  all751 supplied package notice payloads match their installed files. This is
  reuse of unchanged notice bytes, not an assertion of complete attribution.
- apk-embedded-notices-373.zip: all7 actual original notice/Billing payloads in
  this AAB and local QA APK match those373 bytes; its historical README is not a
  claim that the373 APK is this build. Current provenance is in COMPONENTS-375.json.

REPLACING SHARED LIBRARIES
Use the component source archives and included build scripts/configuration to
rebuild compatible shared libraries. Replace appropriate Android ABI entries in
an APK/AAR and sign a modified installation with your own Android credentials.
No production signing key, Google app-signing key or SDK is supplied. Nothing in
this publication restricts rights granted by the controlling upstream licenses,
including applicable rights to modify or debug changes to library components.

LIMITATIONS
This is a technical correspondence record, not a complete license audit or legal
certification.57 installed package identities in the inherited npm inventory lack
package-root notice files;44 are in a conservative production graph which also
includes build/CLI tools. Monorepo attribution and exact runtime-shipment mapping
remain unverified. This Android-only pack makes no Apple source/relink claim.
No OAuth grant, working TV Drive sync, real Store purchase or fresh native source
rebuild was performed as part of this source publication audit. Google-signed
universal APK comparison remains an explicit separate step.
