FFmpeg is built by CI from the signed release source recorded in
src/PROVENANCE.md. Generated headers, shared libraries, DLLs and import
libraries are build products and are deliberately not committed to this
repository.

The tracked inputs are:

* build.lock: source URL/version/SHA-256, policy revision and builder identities
* src/: the signed FFmpeg release tarball, detached signature and provenance
* patches/: backported security patches applied before building
* ci/build_ffmpeg.sh: native Linux x86_64/aarch64 SDK builder
* ci/build_ffmpeg_windows.sh: Linux-to-Windows x86_64 MinGW-w64 SDK builder
* ci/materialize_ffmpeg.sh and ci/verify_ffmpeg_artifact.sh: cache,
  materialization and validation contract

Every pipeline has three required FFmpeg dependency jobs: Linux x86_64, Linux
aarch64 and Windows x86_64. A content key covers build.lock, the target,
relevant scripts, the actual job image and the actual compiler/binutils
identity. An unchanged build may reuse .cache/ffmpeg/<target>/<sha256>/, but a
cache hit is fully validated before use. Cache writes are isolated per Git ref
and protected status. GitLab cache is optional acceleration only. Each
dependency job publishes a validated same-pipeline artifact, and that artifact
is the exact FFmpeg input consumed by the corresponding wheel job through
FFMPEG_DIR.

The required build:sdist job packages the signed source, signature, lock,
recipes and project native sources as Corresponding Source, rejects compiled
SDK outputs, and the tag publish job uploads it beside the wheels.

SDK layouts:

    linux-{x86_64,aarch64}/
        include/   generated FFmpeg headers
        lib/       ELF libraries and pkg-config metadata
        reports/   manifest, checksums and validation evidence

    windows-x86_64/
        include/   generated FFmpeg headers
        lib/       x64 COFF import libraries consumed by MSVC
        bin/       PE32+ x86-64 runtime DLLs bundled into the wheel
        reports/   manifest, checksums and validation evidence

The Windows SDK is cross-compiled on the Linux amd64 fleet; the project-locked
Windows runner only builds and verifies the wheel. It receives the SDK as a
GitLab artifact and therefore does not need MinGW or Git LFS.

Common configure posture (all platforms):

    ./configure \
        --prefix=<prefix> \
        --disable-gpl --disable-nonfree \
        --enable-static --disable-shared --enable-pic \
        --disable-autodetect --disable-x86asm \
        --disable-everything --disable-programs --disable-doc --disable-libdrm \
        --disable-encoders --disable-decoders --disable-hwaccels \
        --disable-swresample --disable-swscale --disable-avfilter --disable-avdevice \
        --enable-demuxers --enable-muxers --enable-protocols --enable-parsers --enable-bsfs \
        --disable-bsf=dovi_split \
        --enable-avformat --enable-avcodec --enable-avutil \
        --extra-cflags='-fvisibility=default' \
        --arch=<target-architecture>

Windows adds --enable-cross-compile, --target-os=mingw32 and
--cross-prefix=x86_64-w64-mingw32-. libavcodec is statically embedded in
libavformat on every target, so the SDK exposes only avformat and avutil
runtime libraries. Video encoding and decoding are performed by NVENC and
NVDEC; the FFmpeg libraries supply the demux/mux/container layer.

To reproduce an SDK locally:

    bash ci/materialize_ffmpeg.sh <target> ffmpeg-sdk/<target> .cache/ffmpeg

where <target> is linux-x86_64, linux-aarch64 or windows-x86_64. Run Linux
targets natively and the Windows target in a Linux environment with the
x86_64-w64-mingw32 toolchain. Then set FFMPEG_DIR to the SDK root before
building a wheel. See ci/README.md for complete toolchain and wheel commands.

Changing the source pin or digest, policy/configuration, relevant scripts,
target, compiler or binutils fingerprint invalidates the content key and
forces a rebuild. Do not create or commit external/ffmpeg/include/ or
external/ffmpeg/lib/; generated outputs belong under ignored ffmpeg-sdk/.
