Private PDF Toolkit
Version: 1.0.0
Build date: 2026-11-09
Electron: 44.10.0
Unsigned Windows x64; no updater/runtime downloads.

qpdf 12.4.2 Windows x64 audit - 2026-11-07

Choice: msvc64. Executed version 12.4.2; Apache-2.0 chosen for qpdf.
Crypto providers reported: openssl (default), native. Zopfli not compiled in.
Version/copyright/provider output: metadata.json. All PE imports and individual
binary SHA-256 hashes, for both archives: imports.json.

Official release and build sources:
https://github.com/qpdf/qpdf/releases/tag/v12.4.2
https://github.com/qpdf/qpdf/blob/v12.4.2/build-scripts/run-vcpkg
https://github.com/qpdf/qpdf/blob/v12.4.2/build-scripts/package-vcpkg
https://github.com/qpdf/qpdf/blob/v12.4.2/libqpdf/CMakeLists.txt
https://github.com/qpdf/qpdf/blob/v12.4.2/LICENSE.txt
https://github.com/qpdf/qpdf/blob/v12.4.2/NOTICE.md

Archive hashes, verified against the separately pinned official checksum file:
msvc64: db87077e683630c1217e0e8f9a20a9749d952ab676e881c3689187763a5de25d
mingw64: 773d2fa0c7d161e2271430734338e560a07b25d0edf11ceee8e53de435012766
vcpkg.zip: 82005252fee032135d07c85ad7626a38f26fb253c1e098d1d185f315bea15ebb
The vcpkg archive was needed to establish versions. It is ignored, on D:.
Its qpdf-dep-versions and both x64 vcpkg-list files agree on:
- libjpeg-turbo 3.2.0#1: IJG AND BSD-3-Clause; internal SIMD Zlib terms.
- OpenSSL 3.6.4#1: Apache-2.0.
- zlib 1.3.2#2: Zlib.
The vcpkg lists also include libspng 0.7.4#1 (BSD-2-Clause AND libpng-2.0),
used by libjpeg-turbo's cjpeg/djpeg tools, not qpdf's libjpeg API dependency.
It is conservatively recorded in static-dependencies.json; do not ship its
build tools. vcpkg-cmake packages are build-time tooling, not qpdf payload.
JPEG binary string confirms libjpeg-turbo 3.2.0 (build 20260924).

qpdf's own NOTICE also records:
- Rijndael implementation: public domain (Erdelsky).
- sphlib 3.0 SHA-2: permissive MIT-style text, retained in NOTICE.
- qtest: Artistic-2.0; upstream test harness, not the qpdf runtime binary.
Keep qpdf LICENSE and NOTICE with the chosen runtime. M6 notices must also
include zlib, IJG/libjpeg-turbo and OpenSSL texts; qpdf NOTICE alone is not
sufficient. Exact extracted copyright-file hashes are in static-dependencies.json.

Dynamic runtimes:
- msvc64 requires qpdf30.dll, MSVC runtime DLLs and Windows system DLLs.
  The official ZIP includes MSVC runtime DLLs. Those are Microsoft
  redistributables, not Apache-licensed qpdf code. M6 must record the exact
  applicable Microsoft redistribution terms before packaging them. This
  audit does not grant redistribution permission or declare them OSS.
- mingw64 includes libgcc_s_seh-1.dll, libstdc++-6.dll and libwinpthread-1.dll.
  GCC runtime GPL-with-exception terms are outside this repository's allowed
  shipped-code policy. This build was downloaded for inspection only; it
  was not executed and is not selected. No GPL exception was assumed.

No claim is made that msvc64 was benchmarked against mingw64. Only the
selected MSVC build was used for the measurements. Audit source downloads
and vcpkg contents are development-only and must not be packaged.
M6 licensed-runtime staging (O8 A), 2026-11-08
The historical audit above describes the ZIP. Release payload uses only
qpdf.exe and qpdf30.dll from it; no Microsoft file is copied from that ZIP.
Recursive normal and delay-load import closure selects exactly three Microsoft
DLLs, copied unmodified from the owner-licensed Community redist folder.
Microsoft Visual C++ runtime, distributed under the Visual Studio Community
2026 licence terms; these are not open-source components.
msvcp140.dll | 14.51.36247.0 | SHA-256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
Source: C:\Program Files\Microsoft Visual Studio\18\Community\VC\Redist\MSVC\14.51.36231\x64\Microsoft.VC145.CRT
vcruntime140.dll | 14.51.36247.0 | SHA-256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
Source: C:\Program Files\Microsoft Visual Studio\18\Community\VC\Redist\MSVC\14.51.36231\x64\Microsoft.VC145.CRT
vcruntime140_1.dll | 14.51.36247.0 | SHA-256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
Source: C:\Program Files\Microsoft Visual Studio\18\Community\VC\Redist\MSVC\14.51.36231\x64\Microsoft.VC145.CRT
Full closure/hashes: config/qpdf-runtime.json. Package audit rejects extra or
changed Microsoft DLLs. System/API-set imports are supplied by Windows.
