Why we build our own FFmpeg: a ready-made “LGPL” build that carried GPL code, 25 October 2026

What the licence asks of us

Karhu Player plays media with FFmpeg’s libraries, and we do not publish the player’s own source. FFmpeg’s libraries allow that under the GNU Lesser General Public License, the LGPL, on terms: they ship as separate files beside the player, anyone may replace them with a build of their own, and their source is offered with them. The GNU General Public License, the GPL, does not allow it: a program combined with GPL code must offer its own source too. So every piece of code compiled into the libraries we ship has to be under the LGPL or a more permissive licence. Our player cannot carry GPL code and stay as it is.

What we found in a ready-made build

For Linux we already built FFmpeg ourselves. For Windows we had started from a set of ready-made FFmpeg builds published on GitHub, in the variant its makers label LGPL. Before shipping we went through those libraries to write the licence notices that must go with them, and found that one of them, avformat-61.dll, has FFTW 3.3.11 compiled into it. FFTW is a fast Fourier transform library licensed under the GPL, version 2 or later; it comes in with an audio fingerprinting library that uses it. The libraries also describe their own licence as “LGPL version 3 or later”, and the licence text in the download is the LGPL version 3 alone, with no notice for FFTW.

A list of notices could not have fixed that: GPL code inside a library we ship beside a program whose source we do not publish is the case the licence rules out. Our own test had not caught it either. It checked that the libraries were the version we expected and named the LGPL, and this build passed.

What we did

We now build FFmpeg ourselves for Windows too, from FFmpeg’s own release source, cross-compiled on Linux. Both systems compile the same FFmpeg components under the LGPL version 2.1, with the dav1d AV1 decoder (BSD licence) built in. Windows adds zlib, built in; otherwise each system uses its own video decoding and TLS: VA-API, zlib and OpenSSL on Linux, D3D11VA and Schannel on Windows. The Windows build takes nothing it was not asked for.

The test is now a list of what is allowed, for each system. It requires the libraries to describe their licence as the LGPL version 2.1 or later, and every outside library FFmpeg is configured with to be on our list; anything else fails it. The only two built in, dav1d and zlib, are built from their own source by the same script. Run against the ready-made build, it fails on that build’s licence, as it should.

Some of the code inside FFmpeg is under other permissive licences whose conditions travel with a binary: the Independent JPEG Group’s, and BSD, MIT and ISC texts. We gather those notices from the build itself, file by file, and ship them with the player. The source of the libraries, the release tarballs they were built from and the script that built them with every setting, is packaged beside each package of the player.