BEAM iOS MobileVLCKit replacement guide
========================================

Applies to: MobileVLCKit 3.7.3-beam.2 in BEAM TV for iOS
Bundle ID: solutions.primecode.beam
Device framework architecture: arm64
Minimum iOS version: 15.0

BEAM uses MobileVLCKit as an embedded dynamic framework. You may rebuild an
interface-compatible modified version of the LGPL-covered framework, replace
the copy inside a BEAM .app bundle, and re-sign that bundle with an Apple
identity and provisioning profile you control. BEAM's Terms permit reverse
engineering needed to debug such a modification.

Materials
---------

Download the exact source package, audit, manifests, notices, SBOM, and this
guide from:

https://beamtv.app/open-source

The exact corresponding-source archive for this version has SHA-256:

df35d4b7e8d926c05e77a488c3a8182e456cb832deed3cf34dc657ffb52c9208

The reviewed device framework binary has SHA-256:

5fb1e4632b6ec741e4622dc55d1c4bc3407ff05a2c7af5d74b40503214ea15c8

Verify the public downloads before use:

  shasum -a 256 -c PUBLIC-SHA256SUMS.txt

Rebuild the framework
---------------------

Use a Mac with Xcode 26 or newer. Extract the corresponding-source package.
It contains the exact patched VLCKit and VLC trees, every downloaded build and
contrib source archive, BEAM's patches and audit tools, and checksum manifests.

The public helper `rebuild_from_source_package.sh` restores the downloaded
archives to the included source tree, runs the build with networking disabled,
retains the LGPL-only module filter, and writes a replacement XCFramework plus
fresh audit evidence. It never needs BEAM's app source, signing identity, CI,
or store account:

  ./rebuild_from_source_package.sh \
    beam-vlckit-ios-corresponding-source-3.7.3-beam.2.tar.xz \
    ./replacement-output

To modify the library, edit the extracted `source/VLCKit` or
`source/VLCKit/libvlc/vlc` tree before the helper's build invocation, or copy
the helper and pause it after extraction. Preserve the LGPL notices on changed
files and document your modifications.

Replace and re-sign an app bundle
---------------------------------

1. Obtain a re-signable BEAM Runner.app bundle for your own device. An Apple
   App Store download is FairPlay-protected and is not the appropriate input.
   You may request a development/relink bundle for this released version from
   support@beamtv.app with subject "iOS LGPL relink bundle".

2. Select the device framework from the rebuilt XCFramework:

     replacement-output/MobileVLCKit.xcframework/ios-arm64/MobileVLCKit.framework

3. Copy the app bundle, replace only
   `Frameworks/MobileVLCKit.framework`, and preserve the framework bundle ID
   `org.videolan.mobilevlckit` and its public ABI.

4. Sign the replacement framework, then the containing app. For a local
   ad-hoc verification (not installable on a stock device):

     codesign --force --sign - --timestamp=none \
       Runner-modified.app/Frameworks/MobileVLCKit.framework
     codesign --force --deep --sign - --timestamp=none Runner-modified.app
     codesign --verify --deep --strict --verbose=2 Runner-modified.app

5. For installation on a stock device, use an Apple Development identity and
   a provisioning profile whose application identifier matches the re-signed
   app. Sign nested frameworks first, embed the profile, sign the app with the
   profile's entitlements, and install it using Xcode's Devices and Simulators
   window. Apple controls certificates, provisioning, and device installation;
   BEAM cannot supply or authorize another person's Apple credentials.

Verification expectations
-------------------------

The replacement must contain an iPhoneOS arm64 Mach-O, not a simulator slice:

  lipo -archs MobileVLCKit.framework/MobileVLCKit
  otool -l MobileVLCKit.framework/MobileVLCKit

The first command must print exactly `arm64`; the load commands must identify
the iOS device platform. Launch the re-signed app, play a supported stream,
pause, seek, resume, and stop. A modified framework may add its own visible
version marker to confirm that its code ran.

Support and written offer
-------------------------

For at least three years after the last distribution of this version, BEAM
will provide the exact corresponding source, build scripts, notices, and a
re-signable development/relink bundle reasonably needed to exercise the LGPL
replacement right. Requests do not include BEAM production signing keys,
server credentials, store access, or proprietary backend source.

Contact: support@beamtv.app