Tockly HEIC converter source and replacement information
24 October 2026

Distributed worker: /heic-worker.js
Notices: /open-source-notices
Full download: /open-source/heic-to-1.5.2/converter-source.tar.gz
Individual files and SHA-256 hashes are available at the same directory.
Downloads are available without an account or payment.

Components:
- heic-to 1.5.2, Hopper Gee, LGPL-3.0-or-later.
  https://github.com/hoppergee/heic-to/tree/v1.5.2
- libheif 1.22.2, struktur AG, Dirk Farin and contributors, LGPL-3.0-or-later.
  https://github.com/strukturag/libheif/tree/v1.22.2
- libde265 1.0.16, struktur AG, Dirk Farin and contributors, LGPL-3.0-or-later.
  https://github.com/strukturag/libde265/tree/v1.0.16
Copyright notices are preserved in the source files and COPYING/LICENSE files
inside the supplied archives. Both GPL v3 and LGPL v3 are supplied separately.
Libraries are provided WITHOUT ANY WARRANTY; see their licences.

What Tockly changed:
Tockly extracts the CSP worker string from the published heic-to 1.5.2
package into a separately served /heic-worker.js file. It adds the notice
header. It does not change the decoder algorithms. The exact extraction
script and browser-side application adapter routines are supplied here.
The adapters convert decoded pixels to JPEG using browser canvas APIs.
Each source download is versioned and should remain available after upgrades.

Rebuild or modify the worker:
1. Extract heic-to-1.5.2.tar.gz. It contains the wrapper's editable src files,
   esbuild.mjs, and the exact upstream precompiled libheif JavaScript modules.
2. In that source directory run: npm install --no-save esbuild@0.25.4
3. Copy the supplied rebuild-worker.mjs into that directory.
4. Modify src/worker.js or src/lib/libheif-without-unsafe-eval.js as required.
5. Run: node rebuild-worker.mjs
   This emits a separate heic-worker.js with the same message interface.
   Minifier/compiler versions can change bytes; byte-identical output is not
   promised. Tockly's shipped worker bytes and hashes are also supplied.
6. To build the C/C++ decoder instead of using the upstream precompiled
   module, extract libheif-1.22.2.tar.gz and libde265-1.0.16.tar.gz.
   See libheif's build-emscripten.sh and heic-to's README for prerequisites.
   In libheif/buildjs place libde265-1.0.16.tar.gz (and its extracted source)
   so that the script can build it without downloading another version.
   With the Emscripten SDK active, use:
   LIBDE265_VERSION=1.0.16 ENABLE_AOM=0 USE_WASM=0 USE_UNSAFE_EVAL=0 ../build-emscripten.sh ..
   On macOS see the upstream README's llvm-nm path adjustment.
   Copy the resulting module to heic-to's src/lib/libheif-without-unsafe-eval.js,
   preserving the same ESM export as the supplied file, then repeat step 5.

Use a modified library:
The application creates a standard classic Web Worker at /heic-worker.js.
It passes {id,buffer} (ArrayBuffer) and receives {id,imageData,error}.
The three supplied TypeScript adapters are the actual application routines;
compile with TypeScript's DOM library or remove only TypeScript annotations.
Ready-to-run JavaScript copies and demo.html are included. Extract the full
download into a directory, run python3 -m http.server 8000 there, and open
http://localhost:8000/demo.html. Replacing heic-worker.js then runs the same
application adapter with your modified library.
They use standard browser APIs, have no private service/API dependency, and
can be combined with your rebuilt worker in a local page or your own host.
For a local copy serve the modified worker at /heic-worker.js; keep the
adapter unchanged. To test against the hosted UI you may use a browser's
local response override feature to substitute /heic-worker.js with your
rebuilt file. No signature or integrity check in the application prevents
library substitution. Changing server-hosted Tockly resources requires
server access; that is not required to run the provided adapters locally.
Do not send private production data to an untrusted replacement converter.

Permissions:
Tockly's terms do not restrict rights granted by third-party licences,
including modifying the LGPL libraries and reverse engineering to debug
those modifications. Tockly's own extraction scripts, rebuild helper and
three supplied photo-adapter routines are additionally licensed as follows:

MIT License
Copyright (c) 2026 Tockly Limited
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.

Verification limits:
The packaged libheif module matches the exact heic-to v1.5.2 source release;
its runtime reports libheif 1.22.2 and libde265 1.0.16. Upstream C/C++ sources
and build scripts for those versions are included. The upstream compiler
version and every historic upstream build flag have not been established;
a fresh C/C++ build has not been independently reproduced by Tockly.
Specialist confirmation of complete corresponding source/recombination
obligations, prior distributions and any native app delivery remains pending.
This package is evidence and a remediation step, not legal certification.
