# Stockfish engine notices and corresponding source

ChessCue distributes Stockfish.js 17.1 Lite, single threaded WebAssembly build
`stockfish-17.1-lite-single-03e3232`, under [GPL version 3](Copying.txt).
Stockfish.js © 2025 Chess.com, LLC, ported by Nathan Rugg. Based on Stockfish
by Tord Romstad, Marco Costalba, Joona Kiiski, Gary Linscott and the
[upstream authors](AUTHORS). Neural network by Linmiao Xu (linrock).
The engine comes WITHOUT ANY WARRANTY; see the license for details.

## Exact distributed files

Both files are byte identical to the artifacts in the
[upstream source revision](https://github.com/nmrugg/stockfish.js/tree/602fd7e1a571a2be71f242942db90483731f2a1f),
also published in npm `stockfish@17.1.0`. ChessCue renamed the files only;
there are no ChessCue patches to the JavaScript, WebAssembly or embedded network.
The npm metadata's `gitHead` is `602fd7e1a571a2be71f242942db90483731f2a1f`.
Do not use the GitHub `v17.1.0` tag: it points at a different, older build.

| Distributed file | Upstream file in `src/` | Bytes | SHA256 |
| --- | --- | ---: | --- |
| [stockfish.js](stockfish.js) | `stockfish-17.1-lite-single-03e3232.js` | 20672 | `1c8265e52fdaef797684b4979b42c5dcfe0350df3e11a87e48e4ec5f86e0ca5c` |
| [stockfish.wasm](stockfish.wasm) | `stockfish-17.1-lite-single-03e3232.wasm` | 7280741 | `7ca31bedd166148931a1cc84dbd8dd9cf001744e9994caf23a3c6ff4988d7086` |

## Corresponding source and build

Download the [complete pinned source archive](https://codeload.github.com/nmrugg/stockfish.js/tar.gz/602fd7e1a571a2be71f242942db90483731f2a1f).
It includes the C++ engine, JavaScript glue, build scripts, Makefiles, and vendored
JavaScript build dependencies. The npm tarball contains compiled assets and is
not a replacement for this source archive.

The lite build embeds `nn-9067e33176e8.nnue`. Its SHA256 is
`9067e33176e8c5edb7aa8db6a3aedd012f84a1f39872e86357c6c2d0993f314d`.
The source build downloads it through `make net LITE_NET=yes`; a
[pinned upstream copy](https://raw.githubusercontent.com/nmrugg/stockfish.js/f9512ef9aff391026813a56855dd086cb72a2d58/src/nn-9067e33176e8.nnue)
is also available. This older revision is used only as a network mirror, not as
the engine source. Put the verified network in `src/` before building.

Use Node.js, Python 3, GNU Make, curl, Java for Closure Compiler, and
[Emscripten SDK 3.1.7](https://github.com/emscripten-core/emsdk/tree/3.1.7).
The pinned `build.js` enforces Emscripten 3.1.7; the upstream README's reference
to 2.0.27 is stale. With `emcc` and `em++` from SDK 3.1.7 on PATH, run:

```sh
curl -fL https://codeload.github.com/nmrugg/stockfish.js/tar.gz/602fd7e1a571a2be71f242942db90483731f2a1f -o stockfish-source.tar.gz
mkdir stockfish-source
tar -xzf stockfish-source.tar.gz --strip-components=1 -C stockfish-source
cd stockfish-source
curl -fL https://raw.githubusercontent.com/nmrugg/stockfish.js/f9512ef9aff391026813a56855dd086cb72a2d58/src/nn-9067e33176e8.nnue -o src/nn-9067e33176e8.nnue
printf '%s  %s\n' 9067e33176e8c5edb7aa8db6a3aedd012f84a1f39872e86357c6c2d0993f314d src/nn-9067e33176e8.nnue | shasum -a 256 -c -
node build.js --force --lite --single-threaded --no-split --hash
```

The flags select the small NNUE network, SIMD WebAssembly, one thread,
unsplit output, and the upstream filename hash. Default build settings enable
optimization and minification and omit Syzygy. The output is
`src/stockfish-17.1-lite-single-<hash>.js` and its `.wasm` sibling.
To distribute a rebuilt pair in ChessCue, copy them as `stockfish.js` and
`stockfish.wasm`, preserving the header, and update this inventory and its test.
The loader derives the WASM filename from its own URL, so the rename needs no patch.

The command above was verified with Linux amd64 image
`emscripten/emsdk:3.1.7` at digest
`sha256:6143f5b3d58fe6e7faf9f279d27ea9ea975983ee2b5490478abda126a6762f34`.
The rebuilt WASM matches the release SHA256 exactly. Upstream `build.js` inserts
the current year into the JavaScript copyright banner, so rebuilding in 2026
changes exactly one byte from the 2025 release and consequently its filename hash.
To reproduce the original release files, normalize only that generated banner
year and copy the build's output symlinks into a separate directory:

```sh
python3 - <<'PYTHON'
from pathlib import Path
import re
import shutil

Path("reproduced").mkdir(exist_ok=True)
loader = Path("src/stockfish.js").read_bytes()
loader = re.sub(rb"\(c\) \d{4}, Chess\.com, LLC", b"(c) 2025, Chess.com, LLC", loader, count=1)
Path("reproduced/stockfish.js").write_bytes(loader)
shutil.copyfile("src/stockfish.wasm", "reproduced/stockfish.wasm")
PYTHON
shasum -a 256 reproduced/stockfish.js reproduced/stockfish.wasm
```

Both resulting hashes were verified against the inventory above. This banner
normalization reproduces the historical upstream release; it is not an engine
patch applied by ChessCue. For a new or modified release, retain its appropriate
copyright notices and record new hashes instead.

## Redistribution

Keep this notice, the GPL text, author credits, and free access to the complete
corresponding source and network available alongside the engine downloads.
Preserve copyright and warranty notices. If the engine is modified, publish
those changes and the scripts needed to build it under the applicable GPL terms.
See [Stockfish's distribution guidance](https://github.com/official-stockfish/Stockfish#terms-of-use)
and GPL sections 4 through 6 in the bundled license. Remote source hosting does
not remove the distributor's responsibility to keep corresponding source available.