# License and provenance report

Review date: 2026-10-15. This report records inspected license texts and attribution; it does not claim trademark sponsorship or cryptographically authenticated authorship.

## Shipped components

| Component | Version / source | License and delivered notices |
| --- | --- | --- |
| Original Doom C engine and freestanding port | `theMagicalKarp/wasmdoom` commit `dd321b50b89b5085698cfbf2ff01b2f741da8206`, derived from id Software Doom | GPL v2. Root `LICENSE`, upstream source headers and full source archive retained. New host code is GPL-2.0-only. |
| OPL3 emulator in music module | Nuked OPL3 source included by pinned port | LGPL-2.1-or-later per source headers; full source present and `dist/docs/NUKED_OPL_LGPL-2.1.txt` retained. Combined executable distribution follows GPL v2; source can be modified/rebuilt. |
| Freedoom Phase 1 | Official **0.13.0**, release commit `cfb8644b1a8dc7d7d2177e6a892ccaa2922bdaae` | BSD 3-clause-style Freedoom license. Complete `FREEDOOM_COPYING.txt`, `FREEDOOM_CREDITS.txt` and `FREEDOOM_CREDITS-MUSIC.txt` included. No artwork, levels or tracks stripped. |
| LZMA decoder | npm `lzma` 2.3.2, decompression source only | MIT; `dist/docs/LZMA_MIT.txt`, copyright header in `src/lzma.js`. Modified for bounded byte output and worker integration. No npm dependency or package scripts at runtime. |
| Silkscreen Regular Latin WOFF2 | Google Fonts Silkscreen, The Silkscreen Project Authors | SIL Open Font License 1.1; `dist/docs/SILKSCREEN_OFL.txt`. Local font; no Google Fonts request. Only regular supplied; body bold uses system Arial. |
| Vite modulepreload fallback | Generated by Vite 8.3.4 | Small runtime helper under MIT; `dist/docs/VITE_MIT.txt`. Only preloads local module links; no extra runtime package. |
| UI, original SVG favicon/share image and host code | This implementation, made by IMD Swarm | GPL-2.0-only. Preview image is a framebuffer capture of the bundled Freedoom release, covered by its data license. |
| Better Interface guide adaptation | Pinned task-provided guide | MIT Better Interface guidance and Apache-2.0 documentation guidance, credited in `DESIGN.md`; pinned license/notice retained as `DESIGN_GUIDANCE_LICENSE.txt`. Not an application runtime dependency. |

The original id Software repository contains old historical license wording in some source comments; the inspected repository distributes GPL v2 in its license file. This edition preserves source notices and uses the GPL-distributed port. The [id repository](https://github.com/id-Software/DOOM) and [selected port](https://github.com/theMagicalKarp/wasmdoom) identify the sources. No proprietary shareware/commercial WAD from a source repository is copied into the product.

Vite 8.3.4 (MIT), TypeScript 6.0.3 (Apache-2.0), and Playwright 1.64.1 (Apache-2.0) are pinned **development tools**, not delivered dependency directories. Their transitive versions/integrities are recorded in `package-lock.json`; the compiler/bundler output has no framework/runtime package dependency; the small included Vite modulepreload helper is separately credited above. Zig 0.16.0 is an external build tool; it is not bundled. The official compiler was checksum-verified before use. Review dependency licenses again if replacing the toolchain or adding a runtime package.

## Complete corresponding source

`dist/source/wasmdoom-source.tar.xz` contains the complete patched C/header/build source and GPL license for **both** WASM modules, including the OPL code. The source is compressed to fit the assignment's 8 MiB total; it is not a precompiled dependency archive. Changed source files carry dated modification notices. `engine/hardening.patch` records the modifications against the pinned commit. `scripts/build-engine.py` rebuilds the source with Zig 0.16.0. `src/`, `index.html`, configuration, scripts, package manifest and lockfile contain the complete host source. A small `dist/source/site-source.tar.gz` mirrors that host/build source for static-site recipients. The static source landing page links both archives.

To reconstruct the host source download, extract `site-source.tar.gz` into a working directory and retain the site's `dist/assets/`, `dist/source/wasmdoom-source.tar.xz` as described by its README; license/report files are included in the host archive. No proprietary files, signing key, server secret, private registry, binary-only engine object or vendor cache is required. Keep source downloads and license notices available when redistributing `dist/`. The original source tree submitted alongside the export is also complete corresponding source.

## Asset integrity

Official release: [Freedoom 0.13.0](https://github.com/freedoom/freedoom/releases/tag/v0.13.0). The release ZIP was compared with the official published checksum file. Its detached PGP signature was **not** verified.

| Data | SHA-256 |
| --- | --- |
| `freedoom-0.13.0.zip` | `3f9b264f3e3ce503b4fb7f6bdcb1f419d93c7b546f4df3e874dd878db9688f59` |
| Complete uncompressed `freedoom1.wad` (28,795,076 bytes) | `7323bcc168c5a45ff10749b339960e98314740a734c30d4b9f3337001f9e703d` |
| Shipped `freedoom1.wad.lzma` (7,133,327 bytes) | `a6701455c4354448aaa1a18bae5a716f7316c91023818f6fa1dc23e9577ff692` |

The compression changes storage only; browser output must match the entire original WAD hash. At runtime a bounded adapter converts MIDI music to the engine's MUS interface in memory. Original bundled assets remain unchanged. The current WASM/source archive hashes and independently verified Zig checksum are recorded in [the independent security review](INDEPENDENT_SECURITY_REVIEW.md). The previous submission referenced an unavailable `artifacts/PROVENANCE.json`; its full historical download manifest is not present and is not represented as delivered evidence.

## Other researched repositories

`id-Software/DOOM` commit `a77dfb96cb91780ca334d0d4cfd86957558007e0` and `cloudflare/doom-wasm` commit `65e0d3ae2ffa604155eebd96ed40da6567bd08f4` were inspected as GPL candidates. Cloudflare code is not incorporated. Freedoom source head `3ac019628d70b812ffb722f7f2365771b76a9d29` was inspected; the older, separately pinned release supplies data. GitHub location/checksum verification is not signature verification.

## User-supplied games and mods

DOOM and DOOM II are id Software trademarks; this project is unaffiliated. Commercial DOOM.WAD/DOOM2.WAD files are neither included nor downloaded. Users may select their own legally obtained files; nothing is uploaded or republished. A mod's license remains its author's responsibility. Replacing a sprite keeps the engine's behavior and does not grant rights to someone else's artwork. Do not redistribute user-selected assets through a deployment unless their rights permit it.