# Complete upstream source

Complete, version-pinned upstream source archives can be obtained without
login or payment from the official locations recorded below and in
[source-manifest.json](source-manifest.json). Skilly also provides a
[source mirror](https://skilly.uk/demos/charts-runtime/sources/) with this release.

- [Graphviz 16.1.0 complete source](https://gitlab.com/api/v4/projects/4207231/packages/generic/graphviz-releases/16.1.0/graphviz-16.1.0.tar.gz)
- [Viz.js exact source commit](https://codeload.github.com/mdaines/viz-js/tar.gz/c8ce050d28eb0dc1ed1629ea32ab7f3dc117db0f)
- [Expat 2.8.5 complete source](https://github.com/libexpat/libexpat/releases/download/R_2_8_5/expat-2.8.5.tar.gz)

The official archives were retrieved in full and matched their recorded
sizes and SHA-256 hashes on 2026-10-07. See source-access-verification.json.
The original gzip and Skilly's xz transport have different compressed hashes;
verify each against its own manifest entry.

Graphviz 16.1.0 Source Code is supplied under EPL-2.0. The distribution must
include its original EPL agreement and this reasonable source-acquisition
notice, consistent with EPL sections 3.1(a) and 3.2. Preserve these materials
on redistribution. See [source-manifest.json](source-manifest.json).

The published Graphviz transport archive is prepared by decompressing the
official gzip stream and recompressing the ENTIRE unchanged tar stream as xz.
No member, source, build script, mode, link, timestamp or tar metadata is
removed or normalized. Both decompressions have the same tar SHA-256.
Recipients obtain one ordinary tar.xz download; no login, payment, expiring
link, proprietary client or archive splitting is required.

The original complete Viz.js repository snapshot and official Expat release
archive accompany it as separate ordinary downloads. Viz.js's build recipe
links Graphviz and Expat using Emscripten. Expat source is a rebuild input;
MIT itself does not impose source-disclosure duties.
Read [REBUILDING_UPSTREAM.md](REBUILDING_UPSTREAM.md).

Per-product application source and independent npm locks are supplied in the
product's source/ directory. Those product materials are distinct from the
original engine source archives. Independent original workflows, instructions
and prompts are delivered in the purchased package; no public application
source snapshot is needed to use these source-download instructions.
EPL does not automatically relicense separate original Canvas2D/SVG renderers
or the entire application.

Keep the immutable downloads for distributed versions and verify actual
unauthenticated retrieval before release. Online and offline downstream
redistributors must retain the applicable licenses and a working reasonable
source-acquisition method; a broken or obsolete source URL is not sufficient.