ZoneBuilder’s mp3.wasm is now built directly from its recipient source package.
It is not the historical npm WASM. LAME and the JavaScript wrapper were not
upgraded, and the published wrapper/C bridge source is unchanged.
98db548e8e851defbba3184125ce10725355c332.4a45333baadbab312d1cc0911151dfad23157c51.a1d8ba08c80ec5e63d62ad30685e9656c9032126e9cd3b9c95991f8e17083b68.dd4e17abf5377dfecc726d6ec5e7b72dab01cf3522974278e5347f4e68480fb3.Current source download:
1,585,342 bytes, 372 files; SHA-256
1db1c9f00f5c50dc68c77ad0721228a8c9eb0b27a1463eeb98eb508a471ce034.
The archive is the prepared source package with updated documentation/provenance;
all source, wrapper, bridge, build inputs and rebuild-mp3.py are unchanged from
the prior package. Its original upstream identities are verified by npm gitHead,
Git submodule gitlink, pinned source archives, and per-file SHA-256. Its
manifest separates historical published references from
current runtime artifacts; the archive hash is outside the archive to avoid
circular provenance.
From a fresh extraction with the recorded SDK environment active:
python3 rebuild-mp3.py --metadce "$EMSDK/upstream/bin/wasm-metadce"
Output: wasm-media-encoders/wasm/mp3.wasm. The helper does not download,
install, upgrade or modify upstream source. It preserves the exact production
flags and MP3-only configure/link/export-pruning inputs. It retains generated
object files, libmp3lame.a and the full/intermediate WASM for relinking.
The recipe statically links LAME and MIT lame_enc.c, using -Oz -flto,
--strip-all, emmalloc, memory growth, standalone WASM and the original
minify_graph.json. Configuration disables shared libraries, decoder,
frontend, dependency tracking, GTK tests and analyzer hooks. The explicit
wasm-media-encoders-0.7.0 macro is the exact result of the original Yarn
version printer; rebuilding the unchanged JS wrapper is unnecessary.
| Tool/input | Exact identity |
|---|---|
| SDK release label | Emscripten 2.0.8, official mapping e4ed6c79f4db8b175d9bbe55869b697aba9bcf2a |
| Actual embedded compiler | emcc 2.0.7, commit d059fd603d0b45b584f634dc2365bc9e9a6ec1dd; known upstream SDK-label mismatch |
| LLVM | clang 12.0.0, commit 1a7a9efec3cf872dcf3e1a6e6fe39e797c4d9fc6 |
| Binaryen | wasm-metadce 98, version_97-120-gb8b457dda |
| Node | 12.18.1, the SDK’s recorded runtime |
| Python/host | Python 3.9.6; macOS Darwin 25.3 arm64, Rosetta for x86-64 tools |
| SDK archive SHA-256 | 85f25c13eb11fe263cbb23c1ff12732da0d14b1fbc528d58b3fb4d61d60b8332 |
| Node archive SHA-256 | 80e1d644fe78838da47cd16de234b612c20e06ffe14447125db9622e381ed1ba |
Exact tool download URLs/hashes are in the extracted README and the reproducibility evidence. Use the recorded compiler/runtime rather than modern Node: Node 24 fails this SDK’s configure probes. Reproducibility is verified for this toolchain/platform, not promised for arbitrary compiler versions. No compiler or dependency was installed into the application repository.
The repository’s third-party-source/lame-3.100/verify_rebuild.py provides a
focused fresh-extraction build test. It checks the archive/member hashes,
executes the packaged helper, compares output bytes with the current runtime,
and writes success/failure evidence. It refuses a nonempty working directory
and never deletes prior work. The evidence records the exact command and tools.
The worker and service metadata use the WASM’s full SHA-256 query identity. The service worker maps only the old, unversioned MP3 WASM URL to that current identity, including offline cache lookup. It never falls back to historical unversioned bytes. Existing authentication safeguards, Lab JS/CSS no-store handling and other cache policies are unchanged. No broad cache generation or product build bump was made.
An existing installation must activate the updated service worker through the normal update flow and reload; already-running encodes are not replaced in place. Tests cover a fresh Lab page, historical cached bytes, a legacy worker, reload, and offline use of the new cached WASM.
The source download has a new -zb1 filename to avoid serving a previously
cached source archive. System → About → Third-Party Software links directly to
it. It is served under the existing docs/ deployment boundary, never imported
or precached. The original source package remains available as historical
material. Future deployment must include the new archive, manifest, evidence
and notices; no remote publication occurred in this task.
The retired npm WASM was 132,999 bytes, SHA-256
85e81719250b9a667b1258143f689dda70e3e57a7e7c29ab0b4cef65c8f6eb9a.
It remains in the source archive’s reference/mp3.wasm solely for comparison.
It is not ZoneBuilder’s current runtime. Earlier functional-relink evidence is
retained in RELINK_VALIDATION.json as historical.
The original publisher’s exact build environment need not be reconstructed:
the current runtime’s source/build/output chain is directly verified.
Licenses, copyright and recipient modification/relink rights remain in the third-party notice. Library GPL v2-or-later remains applicable to LAME; the wrapper remains MIT. This is not legal certification.