P0(supply-chain): pin BtbN ffmpeg URL via single FFMPEG_BTBN_VERSION constant
The BtbN/FFmpeg-Builds download URL in release.yml + tools.rs hard-coded
`latest` in two places per URL (release tag + filename datestamp), four
total URL strings. That made an actual pin — flipping from `latest` to
e.g. `autobuild-2026-04-15-12-50` — a fragile 4-place find-and-replace.
More importantly, `latest` is a moving target: BtbN can retag, the build
can regress, the binary can fail Windows SmartScreen, and the user-
facing failure mode is a 2am page when fresh installs start hanging on
ffmpeg download.
This commit doesn't change the pinned version — it stays at `latest` to
preserve current behaviour — but introduces the pin discipline as
infrastructure:
• release.yml: FFMPEG_BTBN_VERSION env var on the ffmpeg-bundling step.
The single string drives both the {tag} and {datestamp} substitutions
in the URL.
• tools.rs: pub const FFMPEG_BTBN_VERSION (next to UV_VERSION). Same
string drives both Linux and Windows first-run downloads via
format!().
• Comments in both files: link to BtbN releases page so the maintainer
can pick a real autobuild tag, and a note that the two constants
must match.
Pinning is now a two-file, one-string edit instead of a four-file,
eight-string edit. The next maintainer cycle (or this one) should flip
`latest` to a specific autobuild tag — but that decision needs a human
choosing a known-good build, not an autonomous guess.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
debpalash
co-authored by
Claude Opus 4.7
Claude Opus 4.7
parent
fb521400a2
commit
9545640661
@@ -253,10 +253,21 @@ jobs:
|
||||
# macOS: evermeet.cx — individual .zip per binary (x86_64,
|
||||
# runs fine on Apple Silicon via Rosetta 2)
|
||||
# Linux/Windows: BtbN/FFmpeg-Builds — single archive with both bins
|
||||
# Pinned BtbN/FFmpeg-Builds version for Linux + Windows ffmpeg
|
||||
# bundling. The string appears *twice* in each URL (once as the
|
||||
# release tag, once inside the archive filename) — BtbN tags their
|
||||
# autobuilds `autobuild-YYYY-MM-DD-HH-MM` and the inner filenames
|
||||
# use the same datestamp. Driving both from one variable means a
|
||||
# maintainer pin is a one-line edit: change `latest` to a specific
|
||||
# autobuild tag (https://github.com/BtbN/FFmpeg-Builds/releases) to
|
||||
# get reproducible installer builds. Same constant lives in
|
||||
# frontend/src-tauri/src/tools.rs:FFMPEG_BTBN_VERSION — bump
|
||||
# together.
|
||||
- name: Bundle ffmpeg + ffprobe (${{ matrix.rust_target }})
|
||||
shell: bash
|
||||
env:
|
||||
TRIPLE: ${{ matrix.rust_target }}
|
||||
FFMPEG_BTBN_VERSION: "latest"
|
||||
run: |
|
||||
set -euo pipefail
|
||||
BINDIR="frontend/src-tauri/binaries"
|
||||
@@ -281,8 +292,8 @@ jobs:
|
||||
done
|
||||
;;
|
||||
x86_64-unknown-linux-gnu)
|
||||
URL="https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-master-latest-linux64-gpl.tar.xz"
|
||||
echo "Fetching ffmpeg from BtbN (linux64)"
|
||||
URL="https://github.com/BtbN/FFmpeg-Builds/releases/download/${FFMPEG_BTBN_VERSION}/ffmpeg-master-${FFMPEG_BTBN_VERSION}-linux64-gpl.tar.xz"
|
||||
echo "Fetching ffmpeg from BtbN (linux64) — version=${FFMPEG_BTBN_VERSION}"
|
||||
curl -fsSL "$URL" -o "$WORK/ffmpeg.tar.xz"
|
||||
tar -xJf "$WORK/ffmpeg.tar.xz" -C "$WORK"
|
||||
# Archive extracts to ffmpeg-master-latest-linux64-gpl/bin/
|
||||
@@ -292,8 +303,8 @@ jobs:
|
||||
chmod +x "$BINDIR/ffmpeg-${TRIPLE}" "$BINDIR/ffprobe-${TRIPLE}"
|
||||
;;
|
||||
x86_64-pc-windows-msvc)
|
||||
URL="https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-master-latest-win64-gpl.zip"
|
||||
echo "Fetching ffmpeg from BtbN (win64)"
|
||||
URL="https://github.com/BtbN/FFmpeg-Builds/releases/download/${FFMPEG_BTBN_VERSION}/ffmpeg-master-${FFMPEG_BTBN_VERSION}-win64-gpl.zip"
|
||||
echo "Fetching ffmpeg from BtbN (win64) — version=${FFMPEG_BTBN_VERSION}"
|
||||
curl -fsSL "$URL" -o "$WORK/ffmpeg.zip"
|
||||
unzip -o "$WORK/ffmpeg.zip" -d "$WORK"
|
||||
EXTRACTED=$(find "$WORK" -type f -name "ffmpeg.exe" | head -1)
|
||||
|
||||
@@ -17,6 +17,20 @@ use crate::bootstrap::{BootstrapStage, set_stage};
|
||||
// when the toolchain needs a newer uv.
|
||||
pub const UV_VERSION: &str = "0.11.7";
|
||||
|
||||
// Version of BtbN/FFmpeg-Builds we download for Linux/Windows ffmpeg first-
|
||||
// run setup. The string appears *twice* in each URL (once as the release tag,
|
||||
// once inside the archive filename) — BtbN tags their autobuilds
|
||||
// `autobuild-YYYY-MM-DD-HH-MM` and the inner filenames use the same datestamp.
|
||||
// Driving both from one constant means pinning to a specific autobuild is a
|
||||
// one-line edit: change `"latest"` to e.g. `"autobuild-2026-04-15-12-50"` and
|
||||
// match the same constant in `.github/workflows/release.yml`
|
||||
// (FFMPEG_BTBN_VERSION env var). Reproducible installer builds without
|
||||
// surprise upstream regressions, AV reputation drift, or 2am pages when BtbN
|
||||
// retags `latest` to a build that fails Windows SmartScreen.
|
||||
//
|
||||
// Browse releases: https://github.com/BtbN/FFmpeg-Builds/releases
|
||||
pub const FFMPEG_BTBN_VERSION: &str = "latest";
|
||||
|
||||
// ── Sidecar detection ─────────────────────────────────────────────────────
|
||||
|
||||
/// Look for a sidecar binary bundled alongside the app via Tauri's
|
||||
@@ -148,10 +162,13 @@ pub fn install_ffmpeg_standalone(dest: &Path, region: &str) -> io::Result<()> {
|
||||
#[cfg(target_os = "linux")]
|
||||
{
|
||||
let url = resolve_github_url(
|
||||
"https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-master-latest-linux64-gpl.tar.xz",
|
||||
&format!(
|
||||
"https://github.com/BtbN/FFmpeg-Builds/releases/download/{ver}/ffmpeg-master-{ver}-linux64-gpl.tar.xz",
|
||||
ver = FFMPEG_BTBN_VERSION,
|
||||
),
|
||||
region,
|
||||
);
|
||||
log::info!("Downloading ffmpeg from BtbN (linux64)");
|
||||
log::info!("Downloading ffmpeg from BtbN (linux64) — version={}", FFMPEG_BTBN_VERSION);
|
||||
let archive_path = dest.join("ffmpeg.tar.xz");
|
||||
let resp = ureq::get(&url)
|
||||
.timeout(Duration::from_secs(300))
|
||||
@@ -216,10 +233,13 @@ pub fn install_ffmpeg_standalone(dest: &Path, region: &str) -> io::Result<()> {
|
||||
{
|
||||
use std::io::Read;
|
||||
let url = resolve_github_url(
|
||||
"https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-master-latest-win64-gpl.zip",
|
||||
&format!(
|
||||
"https://github.com/BtbN/FFmpeg-Builds/releases/download/{ver}/ffmpeg-master-{ver}-win64-gpl.zip",
|
||||
ver = FFMPEG_BTBN_VERSION,
|
||||
),
|
||||
region,
|
||||
);
|
||||
log::info!("Downloading ffmpeg from BtbN (win64)");
|
||||
log::info!("Downloading ffmpeg from BtbN (win64) — version={}", FFMPEG_BTBN_VERSION);
|
||||
let resp = ureq::get(&url)
|
||||
.timeout(Duration::from_secs(300))
|
||||
.call()
|
||||
|
||||
Reference in New Issue
Block a user