SendToKobo receiver 0.4.21 corresponding source -- GPL-3.0-or-later

Original project source is licensed under GPL-3.0-or-later by the copyright
holder's 2026-10-16 authorization. Read SOURCE_LICENSE.txt and LICENSE for the
exact scope and terms. Third-party notices and terms remain unchanged.
This source kit cannot install/update a Kobo and is not deployment approval.
The web USB installer's separate source archive accompanies its static page;
this archive contains the receiver and its related supporting materials.

Contents
- workspace/: 144 exact source/build/asset files bound to the reviewed receiver
  candidate, plus the editable acknowledgement PNG generator.
- modules/: exact go-qrcode module ZIP, module metadata and go.mod; go.sum is
  in workspace/receiver. This is a local file-only Go module proxy.
- toolchains/: the reviewed Go 1.27.0 Windows amd64 ZIP, including Go sources,
  LICENSE and PATENTS. Its digest is fixed in binding.json and the rebuild script.
- support/: FBInk 886f25f parent and four submodule archives, build-origin notes,
  FBInk v1.25 font sources, acknowledgement generator, Go/go-qrcode/NickelMenu
  notices and Go patent grant. The framebuffer sources are not receiver code.
- binding.json and SHA256SUMS.json: exact candidate/source/toolchain association
  and file inventory. These hashes are not independent publisher authentication.

Offline receiver rebuild (Windows x64, PowerShell 7)
1. Extract this ZIP into a NEW local computer folder, not a Kobo drive.
2. Run: pwsh -NoProfile -File ./rebuild-receiver.ps1
3. Read rebuild-*/result.json and go-validation.log. It uses the included Go,
   a file-only dependency proxy, new empty caches, telemetry off and readonly
   dependencies. It runs native tests, then cross-compiles Linux ARMv7 without
   CGO, tags or VCS metadata. It never executes the ARM receiver.
4. Success requires exactly the expected receiver SHA256, not just a successful
   compiler exit. A new extraction is required for another build.
PowerShell itself is a separately installed host prerequisite, not bundled.

The original repository-bound builder and two independent diagnostic command
trees are excluded: they are not linked into kobo-receiver and included private
test book fingerprints. No book, pairing identity, token, run state, endpoint
configuration, user database or server source is included. Synthetic unit-test
values and the embedded public ISRG certificates are source fixtures, not secrets.

Editable changes are supported by the supplied source, but this fixed candidate
verification script deliberately rejects changed hashes. For a modified build,
review/update the expected inventory and binary comparison explicitly; do not
claim it is the same tested candidate. The build command is:
go build -mod=readonly -trimpath -buildvcs=false -ldflags "-s -w -buildid= -X main.releaseIdentity=KSS_RECEIVER_RELEASE_V1|0.4.21|3|d8a0074a3bf1d11a0148f515139f0fd79e18cc5ebe859175030aeb748c334625|KSSEND" -o kobo-receiver ./cmd/kobo-receiver
with GOOS=linux GOARCH=arm GOARM=7 CGO_ENABLED=0 and no build tags.
The public release stamp supplies runtime version, sequence and verification
key. It is not a private signing key. Neither rebuilding nor installing needs
the private key. Node.js >=22 optionally runs the cross-language signature test;
when Node is absent, that one integration test explicitly reports a skip.

FBInk rebuild guidance is in support/FBINK_UNIVERSAL_ORIGIN.txt and the pinned
source archive's Makefile and .github/workflows/build.yaml. Restore font8x8, stb,
libunibreak and i2c-tools into their corresponding submodule folders. The shipped
fbink target does not require the excluded finger_trace utility's libevdev.
The historical CI downloaded an unpinned koxtoolchain; this kit does not claim
byte-identical FBInk reproduction or completed legal/compliance review.

NickelMenu is a separate unmodified MIT dependency. Its origin/digest/license
are provided; this kit does not stage KoboRoot.tgz or run NickelMenu.

The two acknowledgement PNGs are reproducible with Node.js >=22 using the
workspace/scripts/generate-finish-acknowledgement.mjs generator. It has no npm
dependencies. Its font provenance and GPL text/credits are preserved in support.

The source kit is separate from the program installed on Kobo. Do NOT copy this
whole kit or the compiler to Kobo. Public publication, browser installation
permission UI, physical USB behavior and device runtime require separate review.
