FFmpeg.wasm core 0.12.10 corresponding-source and rebuild record
Verified on 2026-10-13. The site's FFmpeg-based tools remain unpublished while the remaining license review is completed.

The 17 source archives listed in index.json are the inputs used to build the previously distributed browser core. On 2026-10-13, a Docker build from those exact archives produced both an ESM JavaScript loader and a WebAssembly binary byte-for-byte identical to the retained distribution. The WebAssembly SHA-256 is 9f57947a5bd530d8f00c5b3f2cb2a3492faa7e5d823315342d6a8656d0a6b7b7; the ESM loader SHA-256 is 67a48f11645f85439f3fde4f2119042c16b374b910206b7a7a24f342e28dcae3. See build-verification.json for the test and build record.

To rebuild:
1. Download every archive part listed in index.json. For an archive with multiple parts, concatenate part01, part02, ... in order. Verify each part and complete archive against the SHA-256 values in index.json.
2. Extract ffmpeg.wasm-71aa99d37c02.tar.gz into a new build directory, removing its top-level folder if desired.
3. Create a sources directory within that build directory and place the other 16 complete, still-compressed source archives there using the archiveName values in index.json.
4. Place Dockerfile.pinned and source-lock.json from this directory into the build directory. Dockerfile.pinned is the only build recipe change relative to the pinned ffmpeg.wasm upstream source; its build scripts and binding sources were checked byte-for-byte against that upstream archive.
5. Run the command below from the build directory on a Docker host supporting Linux/amd64 and Buildx:

   docker buildx build --platform linux/amd64 --file Dockerfile.pinned --target exportor --output type=local,dest=./output --progress plain .

The output is under output/dist/esm and output/dist/umd. Dockerfile.pinned fixes the Emscripten 3.1.40 base image digest and single-thread production flags; source-lock.json records all archive hashes. The build log and test harness are retained in our compliance working copy. All license texts and original source URLs are linked from index.json.

This exact rebuild establishes source correspondence; it does not by itself resolve every license obligation or grant permission to redistribute unrelated proprietary code. The tool remains paused during that separate review.