Tockly HEIC converter source and replacement information 24 October 2026 Distributed worker: /heic-worker.js Notices: /open-source-notices Full download: /open-source/heic-to-1.5.2/converter-source.tar.gz Individual files and SHA-256 hashes are available at the same directory. Downloads are available without an account or payment. Components: - heic-to 1.5.2, Hopper Gee, LGPL-3.0-or-later. https://github.com/hoppergee/heic-to/tree/v1.5.2 - libheif 1.22.2, struktur AG, Dirk Farin and contributors, LGPL-3.0-or-later. https://github.com/strukturag/libheif/tree/v1.22.2 - libde265 1.0.16, struktur AG, Dirk Farin and contributors, LGPL-3.0-or-later. https://github.com/strukturag/libde265/tree/v1.0.16 Copyright notices are preserved in the source files and COPYING/LICENSE files inside the supplied archives. Both GPL v3 and LGPL v3 are supplied separately. Libraries are provided WITHOUT ANY WARRANTY; see their licences. What Tockly changed: Tockly extracts the CSP worker string from the published heic-to 1.5.2 package into a separately served /heic-worker.js file. It adds the notice header. It does not change the decoder algorithms. The exact extraction script and browser-side application adapter routines are supplied here. The adapters convert decoded pixels to JPEG using browser canvas APIs. Each source download is versioned and should remain available after upgrades. Rebuild or modify the worker: 1. Extract heic-to-1.5.2.tar.gz. It contains the wrapper's editable src files, esbuild.mjs, and the exact upstream precompiled libheif JavaScript modules. 2. In that source directory run: npm install --no-save esbuild@0.25.4 3. Copy the supplied rebuild-worker.mjs into that directory. 4. Modify src/worker.js or src/lib/libheif-without-unsafe-eval.js as required. 5. Run: node rebuild-worker.mjs This emits a separate heic-worker.js with the same message interface. Minifier/compiler versions can change bytes; byte-identical output is not promised. Tockly's shipped worker bytes and hashes are also supplied. 6. To build the C/C++ decoder instead of using the upstream precompiled module, extract libheif-1.22.2.tar.gz and libde265-1.0.16.tar.gz. See libheif's build-emscripten.sh and heic-to's README for prerequisites. In libheif/buildjs place libde265-1.0.16.tar.gz (and its extracted source) so that the script can build it without downloading another version. With the Emscripten SDK active, use: LIBDE265_VERSION=1.0.16 ENABLE_AOM=0 USE_WASM=0 USE_UNSAFE_EVAL=0 ../build-emscripten.sh .. On macOS see the upstream README's llvm-nm path adjustment. Copy the resulting module to heic-to's src/lib/libheif-without-unsafe-eval.js, preserving the same ESM export as the supplied file, then repeat step 5. Use a modified library: The application creates a standard classic Web Worker at /heic-worker.js. It passes {id,buffer} (ArrayBuffer) and receives {id,imageData,error}. The three supplied TypeScript adapters are the actual application routines; compile with TypeScript's DOM library or remove only TypeScript annotations. Ready-to-run JavaScript copies and demo.html are included. Extract the full download into a directory, run python3 -m http.server 8000 there, and open http://localhost:8000/demo.html. Replacing heic-worker.js then runs the same application adapter with your modified library. They use standard browser APIs, have no private service/API dependency, and can be combined with your rebuilt worker in a local page or your own host. For a local copy serve the modified worker at /heic-worker.js; keep the adapter unchanged. To test against the hosted UI you may use a browser's local response override feature to substitute /heic-worker.js with your rebuilt file. No signature or integrity check in the application prevents library substitution. Changing server-hosted Tockly resources requires server access; that is not required to run the provided adapters locally. Do not send private production data to an untrusted replacement converter. Permissions: Tockly's terms do not restrict rights granted by third-party licences, including modifying the LGPL libraries and reverse engineering to debug those modifications. Tockly's own extraction scripts, rebuild helper and three supplied photo-adapter routines are additionally licensed as follows: MIT License Copyright (c) 2026 Tockly Limited Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. Verification limits: The packaged libheif module matches the exact heic-to v1.5.2 source release; its runtime reports libheif 1.22.2 and libde265 1.0.16. Upstream C/C++ sources and build scripts for those versions are included. The upstream compiler version and every historic upstream build flag have not been established; a fresh C/C++ build has not been independently reproduced by Tockly. Specialist confirmation of complete corresponding source/recombination obligations, prior distributions and any native app delivery remains pending. This package is evidence and a remediation step, not legal certification.