TGDrive browser crypto corresponding source and replacement instructions Prepared 2026-10-31. These instructions and Dockerfile.tgdrive are local documentation/modifications. No upstream C, TypeScript, Makefile or original Dockerfile has been changed. No external compiler, Docker build or modified-WASM browser test was executed during preparation. What is included ---------------- The archive contains the complete packages/wasm/lib tree, the WASM wrapper TypeScript/types, upstream package/readme/build configuration, original MIT notice, source receipts and full required license texts. It is public third-party code from mtcute commit c43258260e8ceddb0ad37720b043f6891b837e27 (npm @mtcute/wasm 0.32.6 gitHead). It contains no TGDrive application source, Git history, private media, Telegram sessions or account credentials. Both distributed WASM binaries combine modified TgCrypto AES/IGE/CTR (LGPLv3) with libdeflate and SHA routines (MIT). The complete C inputs are supplied so the LGPL portions can be modified and the combined WASM rebuilt. The wrapper and other MIT portions retain their MIT terms. You may modify the LGPL portions and reverse engineer for debugging those modifications; TGDrive adds no restriction on doing so. See GPL-3.0.txt and LGPL-3.0.txt. This does not label all TGDrive application code as GPL/LGPL. Source and binary identity -------------------------- See SOURCE-MANIFEST.json in the archive or next to it for every upstream path, Git blob SHA1, SHA256, URL, and the exact npm package integrity and binary hashes. The immutable gitHead is used; the v0.32.6 tag is a later commit with the same tree. No original downloaded source files are executed by these preparation instructions. Build with a local compiler --------------------------- 1. Extract the source archive into a new local directory. 2. Provide make, clang16 and a matching wasm-capable lld linker on PATH. These are tools you install/choose; they are not included in this source archive. Other clang/lld versions may also work but can produce different bytes. 3. From the extracted archive root run: mkdir -p packages/wasm/src cd packages/wasm/lib make all WASM_CC=clang-16 If your compiler binary is named clang, select WASM_CC=clang instead. The Makefile targets wasm32-unknown-unknown, uses no system C library, and generates ../src/mtcute.wasm and ../src/mtcute-simd.wasm. The second target adds -msimd128. Keep all source directories, including hash/. 4. Keep the unchanged exported function signatures/memory contract in wasm.h, crypto headers and src/types.ts. An incompatible interface requires corresponding wrapper changes and is outside a simple binary replacement. Alternative Docker recipe ------------------------- The original upstream lib/Dockerfile omits COPY hash even though the Makefile needs hash/sha1.c and hash/sha256.c. Its unchanged copy is included for provenance. Dockerfile.tgdrive adds exactly COPY hash /src/hash and a local-change comment. From extracted packages/wasm/lib: docker build --file Dockerfile.tgdrive --output type=local,dest=../../../../wasm-output . The output folder receives mtcute.wasm and mtcute-simd.wasm. The recipe uses upstream alpine:3.18.4 plus lld/make/clang16/binaryen packages. Availability and exact resulting compiler package revisions can drift. This recipe has not been run here; it is a concrete corrected build recipe, not a claim of tested or byte-identical reproducibility. A local compiler build above is also available. Replace the standalone library binaries in a local static copy ------------------------------------------------------------- 1. Obtain a copy of the release's public static files only. Do not copy Telegram browser storage or runtime/session files. Keep the original public export recoverable. 2. In that local copy replace assets/mtcute-CCj5skST.wasm with your generated non-SIMD mtcute.wasm, and assets/mtcute-simd-BIiNGCYE.wasm with your generated SIMD mtcute-simd.wasm. These are the unit78/current pinned-content filenames; if a later release changes names, use its release manifest and the two .wasm URLs in assets/web-*.js. Keep the filenames referenced by that JS rather than inventing new names. Replace both because browsers choose according to SIMD support. If your source change is identical for both variants, still compile both with their appropriate flags. 3. The inspected @mtcute/web 0.32.7 loader calls plain fetch(input), then WebAssembly.instantiateStreaming/instantiate. It supplies no fetch integrity, digest/signature check, or version lock. @mtcute/wasm selects the separate URL based on SIMD availability. The filename hash is a build naming convention, not a runtime byte-integrity check. The current application adds no WASM-integrity check. Thus an interface-compatible replacement can be supplied at those same URLs without rebuilding TGDrive JS. This is static loader evidence; a modified binary was not executed for this receipt. 4. Serve that local static copy on localhost, for example with a current Python 3: python3 -m http.server 8080 --bind 127.0.0.1 Run this from the directory containing index.html, then open http://localhost:8080/. Browsers treat localhost as a secure context for service workers. Serve WASM as application/wasm where supported; the inspected SDK also has a bytes-based fallback. Use your own browser context and API/login configuration. A different local origin has separate storage; you do not need to transfer an existing session to test your own modified copy. 5. Close old app tabs/PWA windows. Remove the old local origin's service worker and Cache Storage entries through browser developer tools, clear HTTP cache or use a fresh localhost port, then reload/reopen. The current service worker caches only shell assets, not these WASM files, but resetting avoids an old shell and browser HTTP cache masking your replacement. Do not clear storage for the original live origin unless that is your deliberate choice. 6. Inspect the local browser Network panel to verify both replacement URLs/returned bytes and confirm the SDK uses your rebuilt binary. Test login/playback with your own account if desired. Only this local modified-copy test can establish your custom binary's runtime compatibility. Additional notes ---------------- Source archive packaging and asset-path renaming are the TGDrive transformations; the vendored C/TypeScript is unchanged. Record any further changes you make. No hosted-server signing key or approval token is needed to run this local static copy. This delivery uses corresponding source/build materials and documented binary replacement; it does not rely on a claim that browsers already contain the LGPL library or that LGPL 4(d)(1) is automatically satisfied by any WASM loader.