# PDFium binary provenance

Cade M8 uses the Windows x64 binary package published by
`bblanchon/pdfium-binaries` for upstream PDFium. The package is pinned rather
than fetched during configure so builds remain reproducible and offline.

- Package tag: `chromium/7988`
- PDFium version: `153.0.7988.0`
- Asset: `pdfium-win-x64.tgz`
- Published: 2026-08-03
- Source: <https://github.com/bblanchon/pdfium-binaries/releases/tag/chromium%2F7988>
- SHA-256: `654daf488d9357d2787cec439d0dbdb93d7e180e2cb28e5f1d41c66d2645daec`

`cmake/CadePDFium.cmake` checks the hash before extracting the archive into the
build tree. The archive contains its distributor MIT license, upstream PDFium
BSD-3-Clause notice, and all notices for components linked into `pdfium.dll`.
Exact copies are committed as `LICENSE` and `licenses/`, remain inside the
unmodified archive, and are installed beside Cade's PDFium notice bundle.

The package's only operating-system DLL dependencies on this build are
`KERNEL32.dll`, `ADVAPI32.dll`, `GDI32.dll`, and `USER32.dll`. A notice scan
found no AGPL component. The GNU GPL text embedded in the ICU notice applies to
Autoconf helper files with a distribution exception; those source-build helper
files are not present in this binary package and are not runtime dependencies.
No GPL or AGPL library is linked into Cade.
