TripSurf browser terminal: corresponding source and build instructions The /sources/ page ships these archives on the same host as the binaries. manifest.json records the exact download origin, byte size, full SHA-256 and individual part hashes. No private-repository account is required. For a split archive, download all parts and join in numeric order, for example: cat linux-6.12.tar.xz.part* > linux-6.12.tar.xz shasum -a 256 linux-6.12.tar.xz Compare with manifest.json before extracting. On Linux, sha256sum also works. All parts must be present; partial downloads are not source archives. Linux 6.12.115-r0, Alpine x86 linux-virt: linux-6.12.tar.xz + patch-6.12.115.patch.xz alpine-linux-* files, commit 7b58d3c9957ce2c95ee19af6f89241b818af5b3a Put these files in a main/linux-lts directory, removing the alpine-linux- prefix and renaming APKBUILD.txt to APKBUILD. These include all recipe patches/configs and were checked against its SHA512 list. The recipe's SHA512 list authenticates the upstream files and local inputs. Use an Alpine 3.21 x86 build environment with alpine-sdk installed, following Alpine's abuild setup (https://wiki.alpinelinux.org/wiki/Abuild_and_Helpers). Enter the reconstructed main/linux-lts, then run abuild -r as a configured, unprivileged builder. The recipe builds the linux-virt subpackage for x86, using virt.x86.config, the stable patch, and the listed Alpine patches. Supply downloaded sources through the abuild source cache or allow its pinned fetches. Extract boot/vmlinuz-virt from the resulting APK for kernel.bin. Do not use the unpatched linux-6.12 tree as the published kernel source. BusyBox 1.37.0-r14, Alpine x86 busybox-static: busybox-1.37.0.tar.bz2 aports-busybox.tar.gz, commit 284d827a2793963e6dcf88324bd1eb81adff579c In the same Alpine build environment, enter main/busybox and run abuild -r. APKBUILD contains static-subpackage options, busyboxconfig and all patches. Extract bin/busybox.static from busybox-static APK. musl's copyright/license notice is included under /runtime/licenses/; the static binary uses musl. SeaBIOS and VGA BIOS: seabios-1.16.2.tar.gz (upstream rel-1.16.2) v86-bios-provenance.tar.gz (315b2b0b758703ef0e6cc7b4088d6068f83f3c20) v86's bios/seabios.config and bios/fetch-and-build-seabios.sh identify the configuration and build. In an x86 Linux toolchain with GCC, binutils, make, Python and iasl, copy bios/seabios.config to the SeaBIOS tree's .config and run make. out/bios.bin and out/vgabios.bin are the two firmware files. The distributed SeaBIOS identifies itself as rel-1.16.2-0-gea1b7a0. No bochs BIOS, debug BIOS, EDK II or proprietary game assets are shipped. Steam locomotive and its guest-only dependencies: sl-5.02.tar.gz + alpine-sl-APKBUILD.txt Alpine commit 1f12bcb49a6fb0cdf9c9613e2a72969e3f2a4238 ncurses-6.5-20241006.tgz + alpine-ncurses-* recipe/patch Alpine commit 2cf24c798675a7f7deb2603c350d4adc7b59c8bb musl-1.2.5.tar.gz + alpine-musl-* recipe/patch/build inputs Alpine commit 5245849e14d213abe18d589b4b80d65793327940 Reconstruct community/sl, main/ncurses and main/musl from the corresponding alpine-COMPONENT-* files. Remove that prefix and the final .txt suffix; APKBUILD.txt becomes APKBUILD. Use each recipe's SHA512 list to check all source inputs, then abuild -r in the Alpine 3.21 x86 build environment. sl is unmodified. The initramfs takes only usr/bin/sl, lib/ld-musl-i386.so.1, usr/lib/libncursesw.so.6.5 and etc/terminfo/x/xterm-256color from their APKs, and creates the known library symlinks explicitly. No package scripts run. sl/ncurses/musl licenses are included both alongside the runtime and in its /usr/share/licenses directories. These are permissively licensed components; their source/build inputs are also provided for reproducibility. TripSurf initramfs: Save guest.mjs and assets.mjs as scripts/runtime/guest.mjs and assets.mjs; save diary.mjs as scripts/content/diary.mjs, runtime-assets.json as config/runtime-assets.json and diary.json as src/content/diary.json, and save homepage.html and languages.json alongside the command below. Download sl-LICENSE.txt, ncurses-COPYING.txt and musl-1.2.5-COPYRIGHT.txt from /runtime/licenses/ into third-party/. Node 24+ can reconstruct the initrd from exact pinned original APKs: node --input-type=module -e "import {readFile,writeFile} from 'node:fs/promises'; import {getRuntimeAssets} from './scripts/runtime/assets.mjs'; import {makeGuest} from './scripts/runtime/guest.mjs'; const a=await getRuntimeAssets(); await writeFile('initrd.gz',makeGuest(a.busybox,JSON.parse(await readFile('src/content/diary.json','utf8')),a.locomotive,await readFile('homepage.html','utf8'),JSON.parse(await readFile('languages.json','utf8')).map(item=>item.code)));" This fetches and verifies the APKs in runtime-assets.json, or uses matching cached files in .runtime/runtime-cache. It never executes package scripts. The generated /init, command wrappers, configuration and welcome files are readable in guest.mjs. No private data or external filesystem enters the image. build.mjs and worker.js document the runtime integration. These source downloads are not executed as web scripts. The original upstream and Alpine licenses apply to their respective components; see /runtime/licenses/ and the source archives. Source availability and known build recipes do not imply that different compilers produce byte-identical APKs or firmware. TripSurf verifies distributed originals by pinned SHA-256; a fresh independent kernel/firmware compilation has not been claimed as tested. Freedoom / doomgeneric build (2026-11-02) --------------------------------------- The doom-Makefile, doom-backend.c, doom-build.mjs, doom-frame.js, doom.css, doom-index.html, doom-runtime.js and doom-assets.json downloads are TripSurf's unminified game integration. The backend and frame integration are provided under GPL-2.0-or-later. Original licenses are linked on the source-download page. 1. Download and verify doomgeneric-e257a095.tar.gz and the exact Emscripten, SDL and SDL_mixer archives listed in manifest.json. Concatenate split files before verifying the complete hash. Emscripten's archive includes its runtime, libc and their licenses; SDL source versions match the official ports' hashes. 2. Install/activate Emscripten SDK 4.0.10 (emsdk tag 4.0.10, commit 62a853cd3b3134398ce85cde8bb5cbb2ef0194cb), then source emsdk_env.sh. This is a developer build tool, not a visitor dependency. 3. Extract doomgeneric-e257a095.tar.gz. In its doomgeneric directory, put doom-Makefile under that name and doom-backend.c as doomgeneric_tripsurf.c. Run: make -f doom-Makefile -j 4 It produces engine.js and engine.wasm. Compare their SHA256 and lengths with doom-assets.json. The recipe disables dynamic JavaScript evaluation and bounds WASM linear memory to 192 MiB. SDL2 and SDL_mixer are built from the pinned Emscripten ports; no external music format backend is enabled. 4. Freedoom's official 0.13.0 ZIP SHA256 matches its published CHECKSUM file: 3f9b264f3e3ce503b4fb7f6bdcb1f419d93c7b546f4df3e874dd878db9688f59. doom-build.mjs extracts only freedoom-0.13.0/freedoom1.wad after archive and member integrity checks, then compresses it for browser transfer. The full redistributable release archive, original credits and license are included. 5. The frame receives fixed verified WASM/WAD bytes from doom-runtime.js. Use doom-index.html as index.html, doom.css, doom-frame.js and the generated engine.js in the game's directory. Browser CSP and sandbox integration live in the TripSurf repository; no network, host file or server-shell backend is required by the game. Normal site builds reuse the checked engine artifacts; changes to the backend/recipe require rebuilding and updating their hashes. The game enables local sound effects, not background music. No persistent game saves, commercial Doom WAD, multiplayer, uploaded mods or external music fetches are part of this build. All game progress is discarded when the game frame ends.