Sources and audit record

This app uses theMagicalKarp/wasmdoom release v0.0.2, source commit 3edb40afadefe6b2d2955e02fa83b74f1b89bc7f. That commit and the repository's current release commit were GitHub-verified when audited on 2026-08-28. GitHub's build-provenance attestations for both release Wasm files verified successfully with gh attestation verify.

The browser bundle was reproduced from that exact source and its committed package-lock.json, using the attested release Wasm files and BASE_PATH=./. The complete patched corresponding source and build files are served beside the binaries as vendor/wasmdoom-v0.0.2-wimble-source.tar.gz; the original source remains available at the pinned GitHub commit. vendor/wimble-pointer-lock.patch separately records Wimble's only source change: removing canvas.requestPointerLock() from web/src/input.ts, leaving keyboard play and click-to-enable-audio intact without expanding Wimble's iframe sandbox. No engine source or WAD bytes are modified. Wimble must keep the local corresponding-source archive available for as long as it distributes these GPL binaries.

Both Wasm modules have zero imports. Static review found same-origin fetch, Canvas 2D, Web Audio/AudioWorklet, keyboard/touch event handling, and localStorage saves. It found no eval, Function constructor, WebSocket, XHR, service worker, cookie access, or third-party runtime request. The Wasm files therefore cannot directly access a network, filesystem, DOM, cookies, or Worker APIs; the small JavaScript host is the only browser-capability layer.

doom1.wad is the unmodified 4,196,020-byte DOOM v1.9 shareware IWAD (MD5 f0cefca49926d00903cf57551d901abe, SHA-1 5b2e249b9c5133ec987b3ea77596381dc0d6bc1d). It is redistributable shareware, not open-source game data. vendor/LICENSE.doom-shareware.txt preserves the original limited-use terms and Debian's archived 1999 redistribution clarification from John Carmack. The terms prohibit charging or receiving consideration for receipt or use without prior written consent, so this free fixture must be reviewed before attaching payment or paid access. Registered/commercial WADs are not included.

The engine and browser host are GPL-2.0; their license is in vendor/LICENSE.wasmdoom.txt. The local corresponding-source archive is offered through the same Wimble public directory as the object code rather than relying on continued third-party hosting. The bundled nipplejs 1.0.3 touch-control library is MIT-licensed; its license is in vendor/LICENSE.nipplejs.txt, and its exact installed source is included in the corresponding-source archive. The temporary upstream build dependencies reported advisories in Vite/PostCSS/nanoid, but they are not installed by Wimble or shipped as server code: the affected Vite development-server and source-map/generator paths processed only the pinned trusted source during the one-time audit build.