yt-dlp 2026.08.19 Windows x64: native/runtime/bootloader source correspondence
Prepared 2026-10-28. This is technical provenance and source material, not a claim that a rebuild was executed or legal approval.

Scope
This folder supplements the parent source bundle containing yt-dlp itself, CPython3.10.11 and the exact Python-package source distributions from the yt-dlp requirements locks. Combine BOTH sets for distribution. A bare yt-dlp source tarball is not the whole standalone executable's corresponding source.

Observed shipped CLI
stable@2026.08.19 commit594bd50c2 win_exe; Python3.10.11/OpenSSL1.1.1t; mutagen1.48.1, Cryptodome3.23.0, brotli1.2.0, certifi2026.07.22, curl_cffi0.16.0, requests2.34.2, sqlite3.40.1, urllib3 2.7.0, websockets16.1.1, yt_dlp_ejs0.8.0. Offline no-URL audit disabled config, plugins and cache. Deno observed from host PATH is not included in the distributed CLI and not part of this component set.

curl source association
The embedded curl DLL exactly matches the official PyPI curl_cffi0.16.0 cp310-abi3-win_amd64 wheel. Its curl_version() string is:
libcurl/8.21.0-IMPERSONATE BoringSSL zlib/1.3.1 brotli/1.2.0 zstd/1.5.7 WinIDN nghttp2/1.63.0 ngtcp2/1.20.0 nghttp3/1.15.0
curl_cffi v0.16.0 scripts/build.py pins libcurl-impersonate2.0.0; the full source tag is included with Windows workflow, win/build.bat and all patches. Its eight CMake dependency archive SHA256 pins have all been verified against the full downloaded archive bytes. Windows win/build.bat explicitly disables libidn2 and uses clang-cl /MT. Linux-only libidn2 is not part of the observed Windows DLL.
To reproduce this native build in the matching Windows Visual Studio/clang-cl/Ninja environment, unpack the source and invoke win/build.bat vcvars64; for offline use seed CMake's dependency download locations with the provided exact source archives, preserving the source CMake SHA256 values. Review upstream scripts before execution; no build was run here.

PyInstaller source association
The exact requirements lock references the immutable yt-dlp/Pyinstaller-Builds release2026.08.19.215425 wheel. Both its wheel and same-release source sdist were downloaded and checked against immutable GitHub asset digests. That release records upstream PyInstaller commit70fc17210920bce17f4ab09bbf8104b0dbd45338; the complete commit archive and exact Pyinstaller-Builds release recipe are included too. Actual CLI .text/.data/.rdata/.pdata/.xdata/.idata/.reloc sections match the wheel's Windows-64bit-intel/run.exe exactly; expected icon/version resources differ. The source sdist contains43 bootloader C/H files, waf and COPYING.txt. The recipe builds bootloader with: python ./waf --target-arch="64bit" --gcc distclean all; then builds the wheel in its pinned environment.

CPython Windows external sources
Exact CPythonv3.10.11 PCbuild/get_externals.bat and python.props pin bzip2 1.0.8, libffi3.3.0, OpenSSL1.1.1t, sqlite3.40.1.0, xz5.2.5 and zlib1.2.13. Their official python/cpython-source-deps TAGS were resolved to commit hashes and full commit archives downloaded. These are CPython's own patched dependency trees, rather than substituted newer releases. Tcl/Tk is not embedded in this CLI and excluded here; the GUI apps have separate Tcl/Tk notices.

Files
cli-curl-source-manifest.json: dependency source URLs, exact pins, SHA256 checks.
cli-curl-binary-correspondence.json: actual embedded CLI/DLL and wheel SHA256 evidence.
cli-pyinstaller-source-manifest.json: immutable assets, source revision, bootloader section comparison.
cli-python-externals-source-manifest.json: official CPython external tag/commit/archive hashes.
../cli-native-copied-notices.json and ../notices/cli-native: verbatim public license/notice texts copied from these complete sources. Some sources include tools/tests under additional licenses; their texts are retained without claiming every included auxiliary tool is linked into the runtime.

Evidence binaries
embedded-libcurl-impersonate.dll and the two .whl files are audit evidence, not replacement app binaries and not source. They may be omitted from the final corresponding-source archive; retain manifests. No installed app files, credentials, user media, issuance keys, registered license data or configuration files were included or changed.

Distribution
Upstream identifies yt-dlp Windows release binaries as a GPLv3+ combined work; preserve its actual THIRD_PARTY_LICENSES and GPL rights. The parent app's subscription does not restrict rights to these separate open-source components. When distributing a different/newly updated CLI version, refresh sources/locks/notices for that exact binary. This correspondence bundle applies to the audited2026.08.19 binary and must not be represented as covering future downloads. No byte-identical rebuild was attempted.
