# pdfium — provenance & integrity

BlindLock renders PDF previews (vault "explorer" stage B) with `pdfium-render`,
which binds a per-OS native pdfium library at runtime. The library path per OS is
fixed in `src-tauri/src/commands/preview.rs`:

| OS      | bundled path                              |
|---------|-------------------------------------------|
| macOS   | `resources/pdfium/macos/libpdfium.dylib`  |
| Windows | `resources/pdfium/windows/pdfium.dll`     |
| Linux   | `resources/pdfium/linux/libpdfium.so`     |

All libraries are the **non-V8** builds published by
[bblanchon/pdfium-binaries](https://github.com/bblanchon/pdfium-binaries)
(MIT, © Benoit Blanchon; upstream license copied to `<os>/LICENSE`).

## Windows + Linux (added 2026-07-09, Phase-1 build prep)

Pinned release: **`chromium/7934`** — pdfium version **152.0.7934.0**.
Downloaded over HTTPS from the official GitHub release; each archive's SHA-256 was
verified **byte-for-byte against the digest GitHub publishes for that asset**:

| asset                   | archive SHA-256 (matches GitHub `digest`)                          |
|-------------------------|--------------------------------------------------------------------|
| `pdfium-win-x64.tgz`    | `c2c05e752ef41a1af21ad24f7f09e75e6e24c3d2cf84bbc88f11efa42edd341c` |
| `pdfium-linux-x64.tgz`  | `60975aea26c0c6e2f0e0ca3e3c55d184085362f78ac689e4cba2d7d7997920bb` |

Extracted binaries actually committed here:

| file                     | SHA-256                                                            |
|--------------------------|--------------------------------------------------------------------|
| `windows/pdfium.dll`     | `25b8345c7d002f132e091c6cade39bed8ae7db69b7e6a4d7d0c543ad023c81ff` |
| `linux/libpdfium.so`     | `d3fb75e51ab2fd70037cbfcda0cccadca518fb39ac0362757b76338eec17d94f` |

To re-fetch and re-verify: `scripts/fetch-pdfium.sh` (pins the same tag + digests).

## macOS (pre-existing)

`macos/libpdfium.dylib` — SHA-256
`9fe879c4e1ef0c57feaffdcd5036ecb8d633d3f6d531b0ad1cdb504e7feba652`, arm64,
6 987 440 bytes. This binary is a **stripped** bblanchon pdfium build: its hash
does **not** match any pristine `pdfium-mac-arm64.tgz` across the full release
history (it is ~55 KB smaller than the nearest upstream, consistent with a `strip`
pass), so its exact upstream version cannot be recovered by hash. By size it sits
in the ~148–149 / chromium-77xx era (≈ April 2026).

## Known caveat — version skew (Phase-2 reconciliation)

macOS currently ships an older, stripped pdfium (≈ v148–149) while Windows/Linux
are pinned to v152.0.7934.0. This is a deliberate Phase-1 choice: re-syncing macOS
would change a component of the already-notarized macOS artifact and needs a full
macOS rebuild + PDF-preview smoke test, which is out of Phase-1 scope.

**Phase-2 TODO (real build machine):**
1. Re-sync all three OSes to one pinned pdfium release via `scripts/fetch-pdfium.sh`.
2. Load-test PDF preview on each OS (Windows/Linux libraries have **not** been
   load-tested here — only integrity-verified and type-checked as PE32+/ELF x86-64).
