# Corresponding source and build instructions

This directory supplies source snapshots, not merely upstream home-page links.

## Binary / release mapping

- Bundled `@ffmpeg/core@0.12.10`, single-thread ESM, is byte-identical to the npm release (both JS and WASM). WASM SHA-256: `9f57947a5bd530d8f00c5b3f2cb2a3492faa7e5d823315342d6a8656d0a6b7b7`.
- Release commit: `71aa99d37c02a7b4c435275ca9ef50e612f6efa1` (2025-01-07, message: `RELEASE: @ffmpeg/core and @ffmpeg/core-mt v0.12.10`). Note: tag `v0.12.10` is an older JS-wrapper release and is NOT the correct core 0.12.10 source.
- FFmpeg 5.1.4 / commit `4729204c17f756e186d622060088371d10b34f7e`; Emscripten 3.1.40 / compiler commit `5c27e79dd0a9c4e27ef2326841698cdd4f6b5784`.
- The wrapper `@ffmpeg/ffmpeg@0.12.15` source is in the same release snapshot (`packages/ffmpeg/src`); shipped ESM wrapper files have been compared against npm 0.12.15.
- `manifest.json` locks every recipe dependency to a Git commit, and lists archive SHA-256 hashes. x264 `4-cores` and LAME `master` point to commits from 2022 and 2020 respectively, predating the core release. The other dependencies use recipe tags. This is upstream-recipe provenance, not a claim that we have recreated the original publisher's entire build machine.
- Also included: zimg's pinned GoogleTest submodule, SDL2 release-2.24.2 used by Emscripten 3.1.40 (`sdl2-port.py`), Emscripten source (including runtime/system library sources and notices).
- The upstream ffmpeg.wasm `testdata` submodule contains test media, is not used by the core build, and is not required to compile the supplied code. It is intentionally not mirrored. Our own 6-second test fixture is supplied separately.

## What is provided

`archives/` contains full source trees, including their own per-file copyright notices, COPYING/LICENSE/PATENTS files, headers, binding code and build scripts. The top-level source archive is `ffmpeg.wasm-<release>.tar.gz`; it includes `Dockerfile`, `Makefile`, `build/`, `src/bind/`, `src/fftools/`, package TypeScript source, and license files. Source archives are not minified or stripped of license notices.

The generated `Dockerfile.local` changes only source acquisition: moving remote Git sources are replaced by `COPY` of pinned supplied snapshots, and the Dockerfile syntax directive uses the stable frontend. Codec sources and compiler options are not changed. The original Dockerfile remains in `Dockerfile.upstream`.

## Prepare source build context (Python 3.9+)

```sh
python3 prepare-build.py
cd build-context
```

This validates all supplied archive hashes, extracts the upstream project and dependencies, populates zimg's pinned GoogleTest submodule, and writes `Dockerfile.local`. Preparation has been executed successfully in this delivery. It requires local disk space for roughly several hundred MB of extracted sources.

## Compile the single-thread core

Requires Docker Engine + buildx, access to the upstream Emscripten image and OS build dependencies, sufficient disk/RAM, and internet for the base image/apt/Emscripten port setup. These are build-time requirements, not requirements of the WordPress server or website user.

```sh
docker buildx build --platform linux/amd64 \
  -f Dockerfile.local \
  --build-arg FFMPEG_ST=yes \
  --build-arg EXTRA_CFLAGS="-O3 -msimd128" \
  --output type=local,dest=./output .
```

This is equivalent to upstream `make prd` for single-thread, while taking application/library sources from the supplied pinned snapshots. SDL2 source is supplied in `source/sdl2/`; the unmodified Emscripten port loader also retrieves/checks its upstream `release-2.24.2` archive. Consult `sdl2-port.py` for its original URL/hash. No paid services are involved.

Generated ESM files are under `output/dist/esm/`. To test a rebuilt engine, replace BOTH `vendor/ffmpeg-core/ffmpeg-core.js` and `ffmpeg-core.wasm` together in an isolated test copy, then rerun `qa/` checks. Do not substitute an untested rebuilt engine into production.

## Actual observed compile configuration

```
--target-os=none --arch=x86_32 --enable-cross-compile --disable-asm
--disable-stripping --disable-programs --disable-doc --disable-debug
--disable-runtime-cpudetect --disable-autodetect
--nm=emnm --ar=emar --ranlib=emranlib --cc=emcc --cxx=em++ --objcc=emcc --dep-cc=emcc
--extra-cflags='-I/opt/include -O3 -msimd128'
--extra-cxxflags='-I/opt/include -O3 -msimd128'
--disable-pthreads --disable-w32threads --disable-os2threads --enable-gpl
--enable-libx264 --enable-libx265 --enable-libvpx --enable-libmp3lame
--enable-libtheora --enable-libvorbis --enable-libopus --enable-zlib
--enable-libwebp --enable-libfreetype --enable-libfribidi --enable-libass --enable-libzimg
```

## Verification limit

This machine has no available `docker` or `emcc` command. We therefore verified official binary identity, release/source mapping, complete dependency archives, source preparation, and build-command correspondence to upstream Makefile; we did **not** run a fresh compilation or a byte-for-byte reproducible-build comparison. The upstream image/tag alone does not promise bit-reproducible builds. Do not state that a clean build passed. Production publication remains disabled in this delivery; no legal certification is asserted.

## Source-access arrangement

The static tool provides a visible license/source page and direct download of the complete corresponding-source bundle at `sources/ffmpeg-corresponding-source.zip`. If the binary is ever published, publish/retain this source bundle and license notices together at the same site and with equivalent access; do not omit source files to shrink the deployment. The download contains the readable source snapshots, this build guide, manifest and preparation script. Users may inspect, modify, and rebuild under each included license. The proprietary website/theme is not silently relicensed by this notice; the app and third-party component licensing is stated separately.