Pin the exact source of every open-source binary Steam ships:
- 6766 runtime binaries (verified by SHA-256 against their .debs) map to
755 exact Debian/Valve source packages, plus steam-runtime-tools tags
- Valve-built bundled libraries map to upstream tags identified from version
strings: FFmpeg 8.1.2 / 4.3.4, SDL 3.4.0, SDL_image 3.2.0, SDL_ttf 3.1.0,
libvpx v1.10.0-78-g338013712, libaom 3.6.1, libvorbis 1.3.7, libavif 1.0.3/1.0.4
- Inferred (kept decompiled as well): dav1d 1.0.0, and ANGLE / SwiftShader /
Vulkan-ValidationLayers / CEF via Chromium 126.0.6478.183 DEPS
SOURCES.tsv and BINARY_SOURCES.tsv record versions and evidence;
tools/sources.py fetches them into the gitignored sources/ tree.
Decompiled output for exactly-pinned binaries is removed; the proprietary
NVIDIA Cg toolkit binaries stay decompiled.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
SalastilandClaude Opus 5.5
5e2fd8dab8