fix(supply-chain): verify CI and production inputs

Pin external actions, images, toolchains, native archives, and tvOS engine artifacts; enforce fail-closed CI checks and keep website privacy disclosures aligned with shipped behavior.
2026-07-24 03:56:40 +02:00
parent b41fb4fe75
commit 09656fa4d3
63 changed files with 5146 additions and 560 deletions
@@ -1,144 +1,260 @@
 #!/usr/bin/env bash
 set -euo pipefail

-PREFIX="$(pwd)/libmpv-prefix"
-JOBS="$(nproc)"
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+NATIVE_INPUTS_MANIFEST="${NATIVE_INPUTS_MANIFEST:-$SCRIPT_DIR/native-inputs.json}"

-FFMPEG_VERSION="7.1"
-SHADERC_VERSION="2024.4"
-LIBPLACEBO_VERSION="7.351.0"
-MPV_VERSION="0.40.0"
+manifest_value() {
+  python3 - "$NATIVE_INPUTS_MANIFEST" "$1" "$2" <<'PY'
+import json
+import sys

-PREFIX="$(realpath "$PREFIX")"
-mkdir -p "$PREFIX"
-export PKG_CONFIG_PATH="$PREFIX/lib/pkgconfig:$PREFIX/lib/$(uname -m)-linux-gnu/pkgconfig:${PKG_CONFIG_PATH:-}"
+with open(sys.argv[1], encoding="utf-8") as source:
+    manifest = json.load(source)
+value = manifest["inputs"][sys.argv[2]][sys.argv[3]]
+if not isinstance(value, str) or not value:
+    raise SystemExit(f"invalid manifest value: {sys.argv[2]}.{sys.argv[3]}")
+print(value)
+PY
+}

-SRCDIR="$(mktemp -d)"
-trap 'rm -rf "$SRCDIR"' EXIT
-cd "$SRCDIR"
+FFMPEG_VERSION="$(manifest_value ffmpeg version)"
+FFMPEG_URL="$(manifest_value ffmpeg url)"
+FFMPEG_SHA256="$(manifest_value ffmpeg sha256)"
+SHADERC_VERSION="$(manifest_value shaderc version)"
+SHADERC_URL="$(manifest_value shaderc url)"
+SHADERC_REF="$(manifest_value shaderc ref)"
+SHADERC_COMMIT="$(manifest_value shaderc commit)"
+LIBPLACEBO_VERSION="$(manifest_value libplacebo version)"
+LIBPLACEBO_URL="$(manifest_value libplacebo url)"
+LIBPLACEBO_REF="$(manifest_value libplacebo ref)"
+LIBPLACEBO_COMMIT="$(manifest_value libplacebo commit)"
+MPV_VERSION="$(manifest_value mpv version)"
+MPV_URL="$(manifest_value mpv url)"
+MPV_SHA256="$(manifest_value mpv sha256)"

-echo "==> Sources in $SRCDIR"
-echo "==> Install prefix: $PREFIX"
-echo ""
+sha256_file() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1" | cut -d ' ' -f 1
+  else
+    shasum -a 256 "$1" | cut -d ' ' -f 1
+  fi
+}

-# ─── Step 1: ffmpeg (static libraries) ───────────────────────────────────────
+download_verified() {
+  local url="$1"
+  local expected_sha256="$2"
+  local destination="$3"
+  local temporary
+  local actual_sha256

-echo "==> Building ffmpeg $FFMPEG_VERSION (static, decoder-only)..."
-curl -sL "https://ffmpeg.org/releases/ffmpeg-${FFMPEG_VERSION}.tar.xz" | tar xJ
-cd "ffmpeg-${FFMPEG_VERSION}"
+  if [[ ! "$expected_sha256" =~ ^[0-9a-f]{64}$ ]]; then
+    echo "Invalid SHA-256 pin for $url" >&2
+    return 1
+  fi

-./configure \
-  --prefix="$PREFIX" \
-  --enable-gpl \
-  --enable-version3 \
-  --enable-static \
-  --disable-shared \
-  --enable-pic \
-  --disable-programs \
-  --disable-doc \
-  --disable-encoders \
-  --disable-muxers \
-  --enable-muxer=spdif \
-  --disable-devices \
-  --disable-bsfs \
-  --enable-bsf=aac_adtstoasc,av1_metadata,extract_extradata,h264_metadata,h264_mp4toannexb,hevc_metadata,hevc_mp4toannexb,vp9_metadata \
-  --disable-filters \
-  --enable-filter=aformat,aresample,format,null,scale \
-  --enable-gnutls \
-  --enable-vaapi \
-  --enable-vdpau \
-  --disable-debug \
-  --disable-stripping
+  mkdir -p "$(dirname "$destination")"
+  temporary="$(mktemp "${destination}.tmp.XXXXXX")"
+  if ! curl \
+    --fail \
+    --location \
+    --silent \
+    --show-error \
+    --proto '=https,file' \
+    --tlsv1.2 \
+    --output "$temporary" \
+    "$url"; then
+    rm -f "$temporary"
+    return 1
+  fi

-make -j"$JOBS"
-make install
-cd "$SRCDIR"
+  actual_sha256="$(sha256_file "$temporary")"
+  if [ "$actual_sha256" != "$expected_sha256" ]; then
+    echo "SHA-256 mismatch for $url" >&2
+    echo "Expected: $expected_sha256" >&2
+    echo "Actual:   $actual_sha256" >&2
+    rm -f "$temporary" "$destination"
+    return 1
+  fi

-echo ""
-echo "==> ffmpeg done."
-echo ""
+  mv "$temporary" "$destination"
+}

-# ─── Step 2: shaderc (static library) ─────────────────────────────────────────
+checkout_verified_ref() {
+  local url="$1"
+  local ref="$2"
+  local expected_commit="$3"
+  local destination="$4"
+  local actual_commit

-echo "==> Building shaderc $SHADERC_VERSION (static)..."
-git clone --depth 1 --branch "v${SHADERC_VERSION}" \
-  https://github.com/google/shaderc.git "shaderc-v${SHADERC_VERSION}"
-cd "shaderc-v${SHADERC_VERSION}"
-./utils/git-sync-deps
+  if [[ ! "$expected_commit" =~ ^[0-9a-f]{40}$ ]]; then
+    echo "Invalid Git commit pin for $url at $ref" >&2
+    return 1
+  fi

-cmake -S . -B build \
-  -DCMAKE_BUILD_TYPE=Release \
-  -DCMAKE_INSTALL_PREFIX="$PREFIX" \
-  -DSHADERC_SKIP_TESTS=ON \
-  -DSHADERC_SKIP_EXAMPLES=ON \
-  -DSHADERC_SKIP_COPYRIGHT_CHECK=ON \
-  -DBUILD_SHARED_LIBS=OFF \
-  -DCMAKE_POSITION_INDEPENDENT_CODE=ON
+  rm -rf "$destination"
+  if ! git clone --quiet --depth 1 --branch "$ref" --no-checkout \
+    "$url" "$destination"; then
+    rm -rf "$destination"
+    return 1
+  fi

-cmake --build build -j"$JOBS"
-cmake --install build
+  actual_commit="$(git -C "$destination" rev-parse 'HEAD^{commit}')"
+  if [ "$actual_commit" != "$expected_commit" ]; then
+    echo "Git ref mismatch for $url at $ref" >&2
+    echo "Expected: $expected_commit" >&2
+    echo "Actual:   $actual_commit" >&2
+    rm -rf "$destination"
+    return 1
+  fi

-cd "$SRCDIR"
+  git -C "$destination" checkout --quiet --detach "$expected_commit"
+}

-echo ""
-echo "==> shaderc done."
-echo ""
+cleanup_srcdir=""

-# ─── Step 3: libplacebo (static library) ─────────────────────────────────────
+cleanup() {
+  if [ -n "$cleanup_srcdir" ]; then
+    rm -rf -- "$cleanup_srcdir"
+  fi
+}

-echo "==> Building libplacebo $LIBPLACEBO_VERSION (static)..."
-git clone --depth 1 --recursive --branch "v${LIBPLACEBO_VERSION}" \
-  https://code.videolan.org/videolan/libplacebo.git "libplacebo-v${LIBPLACEBO_VERSION}"
-cd "libplacebo-v${LIBPLACEBO_VERSION}"
+main() {
+  local prefix="${PREFIX:-$(pwd)/libmpv-prefix}"
+  local jobs="${JOBS:-$(nproc)}"
+  local srcdir

-meson setup build \
-  --prefix="$PREFIX" \
-  --default-library=static \
-  -Dvulkan=disabled \
-  -Dd3d11=disabled \
-  -Ddemos=false \
-  -Dtests=false
+  mkdir -p "$prefix"
+  prefix="$(realpath "$prefix")"
+  export PKG_CONFIG_PATH="$prefix/lib/pkgconfig:$prefix/lib/$(uname -m)-linux-gnu/pkgconfig:${PKG_CONFIG_PATH:-}"

-ninja -C build -j"$JOBS"
-ninja -C build install
-cd "$SRCDIR"
+  srcdir="$(mktemp -d)"
+  cleanup_srcdir="$srcdir"
+  trap cleanup EXIT
+  cd "$srcdir"

-echo ""
-echo "==> libplacebo done."
-echo ""
+  echo "==> Sources in $srcdir"
+  echo "==> Install prefix: $prefix"
+  echo ""

-# ─── Step 4: mpv (shared libmpv) ─────────────────────────────────────────────
+  # ─── Step 1: ffmpeg (static libraries) ─────────────────────────────────────
+  echo "==> Building ffmpeg $FFMPEG_VERSION (static, decoder-only)..."
+  download_verified "$FFMPEG_URL" "$FFMPEG_SHA256" "$srcdir/ffmpeg.tar.xz"
+  tar -xJf "$srcdir/ffmpeg.tar.xz"
+  cd "ffmpeg-${FFMPEG_VERSION}"

-echo "==> Building mpv $MPV_VERSION (shared libmpv only)..."
-curl -sL "https://github.com/mpv-player/mpv/archive/refs/tags/v${MPV_VERSION}.tar.gz" | tar xz
-cd "mpv-${MPV_VERSION}"
+  ./configure \
+    --prefix="$prefix" \
+    --enable-gpl \
+    --enable-version3 \
+    --enable-static \
+    --disable-shared \
+    --enable-pic \
+    --disable-programs \
+    --disable-doc \
+    --disable-encoders \
+    --disable-muxers \
+    --enable-muxer=spdif \
+    --disable-devices \
+    --disable-bsfs \
+    --enable-bsf=aac_adtstoasc,av1_metadata,extract_extradata,h264_metadata,h264_mp4toannexb,hevc_metadata,hevc_mp4toannexb,vp9_metadata \
+    --disable-filters \
+    --enable-filter=aformat,aresample,format,null,scale \
+    --enable-gnutls \
+    --enable-vaapi \
+    --enable-vdpau \
+    --disable-debug \
+    --disable-stripping

-meson setup build \
-  --prefix="$PREFIX" \
-  -Dlibmpv=true \
-  -Dcplayer=false \
-  -Dbuild-date=false \
-  -Dlua=enabled \
-  -Djavascript=enabled \
-  -Dcplugins=disabled \
-  -Dmanpage-build=disabled \
-  -Djack=disabled \
-  -Dvulkan=disabled \
-  -Dd3d11=disabled \
-  -Dgl=enabled \
-  -Dvaapi=enabled \
-  -Dvdpau=enabled \
-  -Dalsa=enabled \
-  -Dpulse=enabled \
-  -Dpipewire=enabled \
-  -Dwayland=disabled \
-  -Dx11=enabled
+  make -j"$jobs"
+  make install
+  cd "$srcdir"
+  echo ""
+  echo "==> ffmpeg done."
+  echo ""

-ninja -C build -j"$JOBS"
-ninja -C build install
-cd "$SRCDIR"
+  # ─── Step 2: shaderc (static library) ───────────────────────────────────────
+  echo "==> Building shaderc $SHADERC_VERSION (static)..."
+  checkout_verified_ref \
+    "$SHADERC_URL" "$SHADERC_REF" "$SHADERC_COMMIT" \
+    "$srcdir/shaderc-v${SHADERC_VERSION}"
+  cd "shaderc-v${SHADERC_VERSION}"
+  ./utils/git-sync-deps

-echo ""
-echo "==> mpv done."
-echo ""
-echo "==> libmpv build complete. Output in $PREFIX"
+  cmake -S . -B build \
+    -DCMAKE_BUILD_TYPE=Release \
+    -DCMAKE_INSTALL_PREFIX="$prefix" \
+    -DSHADERC_SKIP_TESTS=ON \
+    -DSHADERC_SKIP_EXAMPLES=ON \
+    -DSHADERC_SKIP_COPYRIGHT_CHECK=ON \
+    -DBUILD_SHARED_LIBS=OFF \
+    -DCMAKE_POSITION_INDEPENDENT_CODE=ON
+
+  cmake --build build -j"$jobs"
+  cmake --install build
+  cd "$srcdir"
+  echo ""
+  echo "==> shaderc done."
+  echo ""
+
+  # ─── Step 3: libplacebo (static library) ───────────────────────────────────
+  echo "==> Building libplacebo $LIBPLACEBO_VERSION (static)..."
+  checkout_verified_ref \
+    "$LIBPLACEBO_URL" "$LIBPLACEBO_REF" "$LIBPLACEBO_COMMIT" \
+    "$srcdir/libplacebo-v${LIBPLACEBO_VERSION}"
+  cd "libplacebo-v${LIBPLACEBO_VERSION}"
+  git submodule update --init --recursive
+
+  meson setup build \
+    --prefix="$prefix" \
+    --default-library=static \
+    -Dvulkan=disabled \
+    -Dd3d11=disabled \
+    -Ddemos=false \
+    -Dtests=false
+
+  ninja -C build -j"$jobs"
+  ninja -C build install
+  cd "$srcdir"
+  echo ""
+  echo "==> libplacebo done."
+  echo ""
+
+  # ─── Step 4: mpv (shared libmpv) ───────────────────────────────────────────
+  echo "==> Building mpv $MPV_VERSION (shared libmpv only)..."
+  download_verified "$MPV_URL" "$MPV_SHA256" "$srcdir/mpv.tar.gz"
+  tar -xzf "$srcdir/mpv.tar.gz"
+  cd "mpv-${MPV_VERSION}"
+
+  meson setup build \
+    --prefix="$prefix" \
+    -Dlibmpv=true \
+    -Dcplayer=false \
+    -Dbuild-date=false \
+    -Dlua=enabled \
+    -Djavascript=enabled \
+    -Dcplugins=disabled \
+    -Dmanpage-build=disabled \
+    -Djack=disabled \
+    -Dvulkan=disabled \
+    -Dd3d11=disabled \
+    -Dgl=enabled \
+    -Dvaapi=enabled \
+    -Dvdpau=enabled \
+    -Dalsa=enabled \
+    -Dpulse=enabled \
+    -Dpipewire=enabled \
+    -Dwayland=disabled \
+    -Dx11=enabled
+
+  ninja -C build -j"$jobs"
+  ninja -C build install
+  echo ""
+  echo "==> mpv done."
+  echo ""
+  echo "==> libmpv build complete. Output in $prefix"
+}
+
+if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+  main "$@"
+fi
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=build-libmpv.sh
+source "$SCRIPT_DIR/build-libmpv.sh"
+
+fail() {
+  echo "FAIL: $*" >&2
+  exit 1
+}
+
+assert_absent() {
+  [ ! -e "$1" ] || fail "unexpected path remains: $1"
+}
+
+temporary="$(mktemp -d)"
+trap 'rm -rf "$temporary"' EXIT
+
+fixture="$temporary/source.bin"
+destination="$temporary/download/output.bin"
+printf 'reviewed native input\n' >"$fixture"
+expected="$(sha256_file "$fixture")"
+download_verified "file://$fixture" "$expected" "$destination"
+cmp -s "$fixture" "$destination" || fail "verified download changed bytes"
+
+printf 'reviewed native inpuu\n' >"$fixture"
+rm -f "$destination"
+if download_verified "file://$fixture" "$expected" "$destination"; then
+  fail "changed archive was accepted"
+fi
+assert_absent "$destination"
+if compgen -G "$destination.tmp.*" >/dev/null; then
+  fail "failed download left a temporary file"
+fi
+
+repository="$temporary/repository"
+checkout="$temporary/checkout"
+mkdir -p "$repository"
+git -C "$repository" init --quiet
+git -C "$repository" config user.name "Plezy provenance test"
+git -C "$repository" config user.email "provenance-test@invalid.example"
+printf 'first\n' >"$repository/input.txt"
+git -C "$repository" add input.txt
+git -C "$repository" commit --quiet -m first
+git -C "$repository" tag release
+approved_commit="$(git -C "$repository" rev-parse HEAD)"
+checkout_verified_ref "file://$repository" release "$approved_commit" "$checkout"
+[ "$(git -C "$checkout" rev-parse HEAD)" = "$approved_commit" ] ||
+  fail "verified checkout selected the wrong commit"
+
+printf 'second\n' >"$repository/input.txt"
+git -C "$repository" commit --quiet -am second
+git -C "$repository" tag --force release >/dev/null
+if checkout_verified_ref "file://$repository" release "$approved_commit" "$checkout"; then
+  fail "moved tag was accepted"
+fi
+assert_absent "$checkout"
+
+echo "Linux native acquisition verification passed"
@@ -0,0 +1,52 @@
+{
+  "formatVersion": 1,
+  "refreshContract": {
+    "rules": [
+      "Audit each new upstream release before changing its version, URL, ref, commit, or SHA-256.",
+      "For an archive, verify upstream release evidence first, hash the complete reviewed file, and update URL and SHA-256 together.",
+      "For Git, verify the upstream release-producing tag record, record the full dereferenced root commit, and review its dependency lock or gitlinks before updating.",
+      "Run python3 scripts/verify_runtime_inputs.py and bash linux/packaging/build-libmpv_test.sh before a Linux build.",
+      "Never derive an expected checksum from bytes inside the production build or verification command."
+    ]
+  },
+  "inputs": {
+    "ffmpeg": {
+      "kind": "archive",
+      "version": "7.1",
+      "url": "https://ffmpeg.org/releases/ffmpeg-7.1.tar.xz",
+      "sha256": "40973d44970dbc83ef302b0609f2e74982be2d85916dd2ee7472d30678a7abe6",
+      "provenance": "FFmpeg release archive verified against ffmpeg-7.1.tar.xz.asc with the official ffmpeg-devel.asc full fingerprint FCF986EA15E6E293A5644F10B4322F04D67658D8 before recording this digest."
+    },
+    "shaderc": {
+      "kind": "git",
+      "version": "2024.4",
+      "url": "https://github.com/google/shaderc.git",
+      "ref": "v2024.4",
+      "commit": "caa54d9779d5605aca4e1a0c0c962a3d8f4aeb31",
+      "provenance": "Official GitHub annotated tag object 3cd72062f297df05e6a042f2616c42bc8956c326 dereferences to this root commit; its DEPS file pins synchronized dependencies by full commit."
+    },
+    "libplacebo": {
+      "kind": "git",
+      "version": "7.351.0",
+      "url": "https://code.videolan.org/videolan/libplacebo.git",
+      "ref": "v7.351.0",
+      "commit": "3188549fba13bbdf3a5a98de2a38c2e71f04e21e",
+      "provenance": "Official VideoLAN GitLab tag record v7.351.0 contains a PGP-signed release message and dereferences to this root commit; its gitlinks pin recursive submodules."
+    },
+    "mpv": {
+      "kind": "archive",
+      "version": "0.40.0",
+      "url": "https://github.com/mpv-player/mpv/archive/refs/tags/v0.40.0.tar.gz",
+      "sha256": "10a0f4654f62140a6dd4d380dcf0bbdbdcf6e697556863dc499c296182f081a3",
+      "commit": "e48ac7ce08462f5e33af6ef9deeac6fa87eef01e",
+      "provenance": "GitHub reports annotated tag object 287d7cdb78975ae350d7c2a287eae3c2072c93f7 as a valid PGP signature over release commit e48ac7ce08462f5e33af6ef9deeac6fa87eef01e; the complete tag archive was then hashed."
+    },
+    "simdutf": {
+      "kind": "archive",
+      "version": "6.4.2",
+      "url": "https://github.com/simdutf/simdutf/releases/download/v6.4.2/singleheader.zip",
+      "sha256": "9fe4d6f515724a55c8de88fee4463e0890a1abe2267cda13c4b5d245d58039e6",
+      "provenance": "Official GitHub release 210237657 records asset 243345703 as singleheader.zip with size 3013061 bytes; the complete release asset was independently hashed before recording this digest."
+    }
+  }
+}