Oxford PDF website source - 31 October 2026
Source refresh: 2026-10-31T201407Z; fifteen browser tools, the /pdf-tools/ directory and the company/contact page.

Software grant: AGPL-3.0-or-later for the website application, website Worker and included shared browser runtime. Original third-party licences/notices remain. The software grant does not grant rights in third-party paper content, trademarks or promotional images. See /licenses/OxfordPDF-WEBSITE-LICENSE.txt.

1. Download oxfordpdf-website-2026-10-31T201407Z-source.tar.gz and extract it. Its README gives the website build commands. The oxford-pdf folder contains only the shared browser runtime, not the desktop application.
2. For each split dependency archive you want to inspect/rebuild, download ALL numbered parts. Concatenate in numeric order, preserving their bytes. Verify SHA-256, then extract.

macOS/Linux example:
cat mupdf-1.28.1-source.tar.gz.part-001 mupdf-1.28.1-source.tar.gz.part-002 mupdf-1.28.1-source.tar.gz.part-003 > mupdf-1.28.1-source.tar.gz
shasum -a 256 mupdf-1.28.1-source.tar.gz

Windows Command Prompt example:
copy /b mupdf-1.28.1-source.tar.gz.part-001+mupdf-1.28.1-source.tar.gz.part-002+mupdf-1.28.1-source.tar.gz.part-003 mupdf-1.28.1-source.tar.gz
certutil -hashfile mupdf-1.28.1-source.tar.gz SHA256

Use the same process for the other split archives. The manifest lists every part and the reconstructed archive hashes. SHA256SUMS.txt includes the downloadable files plus complete archive hashes; when verifying only downloaded parts, ignore missing complete-archive entries until after joining.

MuPDF: official full1.28.1source includes bundled third-party sources and platform/wasm wrapper/build. Tag1.28.1/registrygitHead20061bd45183f5a2bff8f43675e4da91e5ac2901. Its build script selects Emscripten4.0.8. Canonicalupstream: https://mupdf.com/downloads/archive/mupdf-1.28.1-source.tar.gz
PDF.js: exact6.4.299source and decoder wrapper/C/Rust sources; see PDFJS-BUILD.md and provenance.
Tesseract: exact7.0.0root/source submodules and build instructions; see TESSERACT-BUILD.md and provenance.
Npm packages: exact27runtimearchives match the package-lock integrity. To populate a local npm cache, extract the npm packet and use npm cache add PATH_TO_PACKAGE.tgz for its packages before npm ci. Node/npm build tool packages may still be obtained from the normal registry.
Additional JavaScript source: matching registrygitHead/tag sources for packages whose npm distribution is generated.

Original licence/copyright files remain with every upstream component. Source metadata and hashes are in manifest.json and provenance/. No downloaded upstream Docker/compiler build was executed during source collection. This packet records source/build inputs and does not assert byte-identical upstream engine reproduction.
