fix(supply-chain): verify CI and production inputs

Pin external actions, images, toolchains, native archives, and tvOS engine artifacts; enforce fail-closed CI checks and keep website privacy disclosures aligned with shipped behavior.
2026-07-24 03:56:40 +02:00
parent b41fb4fe75
commit 09656fa4d3
63 changed files with 5146 additions and 560 deletions
@@ -0,0 +1,52 @@
+{
+  "formatVersion": 1,
+  "refreshContract": {
+    "rules": [
+      "Audit each new upstream release before changing its version, URL, ref, commit, or SHA-256.",
+      "For an archive, verify upstream release evidence first, hash the complete reviewed file, and update URL and SHA-256 together.",
+      "For Git, verify the upstream release-producing tag record, record the full dereferenced root commit, and review its dependency lock or gitlinks before updating.",
+      "Run python3 scripts/verify_runtime_inputs.py and bash linux/packaging/build-libmpv_test.sh before a Linux build.",
+      "Never derive an expected checksum from bytes inside the production build or verification command."
+    ]
+  },
+  "inputs": {
+    "ffmpeg": {
+      "kind": "archive",
+      "version": "7.1",
+      "url": "https://ffmpeg.org/releases/ffmpeg-7.1.tar.xz",
+      "sha256": "40973d44970dbc83ef302b0609f2e74982be2d85916dd2ee7472d30678a7abe6",
+      "provenance": "FFmpeg release archive verified against ffmpeg-7.1.tar.xz.asc with the official ffmpeg-devel.asc full fingerprint FCF986EA15E6E293A5644F10B4322F04D67658D8 before recording this digest."
+    },
+    "shaderc": {
+      "kind": "git",
+      "version": "2024.4",
+      "url": "https://github.com/google/shaderc.git",
+      "ref": "v2024.4",
+      "commit": "caa54d9779d5605aca4e1a0c0c962a3d8f4aeb31",
+      "provenance": "Official GitHub annotated tag object 3cd72062f297df05e6a042f2616c42bc8956c326 dereferences to this root commit; its DEPS file pins synchronized dependencies by full commit."
+    },
+    "libplacebo": {
+      "kind": "git",
+      "version": "7.351.0",
+      "url": "https://code.videolan.org/videolan/libplacebo.git",
+      "ref": "v7.351.0",
+      "commit": "3188549fba13bbdf3a5a98de2a38c2e71f04e21e",
+      "provenance": "Official VideoLAN GitLab tag record v7.351.0 contains a PGP-signed release message and dereferences to this root commit; its gitlinks pin recursive submodules."
+    },
+    "mpv": {
+      "kind": "archive",
+      "version": "0.40.0",
+      "url": "https://github.com/mpv-player/mpv/archive/refs/tags/v0.40.0.tar.gz",
+      "sha256": "10a0f4654f62140a6dd4d380dcf0bbdbdcf6e697556863dc499c296182f081a3",
+      "commit": "e48ac7ce08462f5e33af6ef9deeac6fa87eef01e",
+      "provenance": "GitHub reports annotated tag object 287d7cdb78975ae350d7c2a287eae3c2072c93f7 as a valid PGP signature over release commit e48ac7ce08462f5e33af6ef9deeac6fa87eef01e; the complete tag archive was then hashed."
+    },
+    "simdutf": {
+      "kind": "archive",
+      "version": "6.4.2",
+      "url": "https://github.com/simdutf/simdutf/releases/download/v6.4.2/singleheader.zip",
+      "sha256": "9fe4d6f515724a55c8de88fee4463e0890a1abe2267cda13c4b5d245d58039e6",
+      "provenance": "Official GitHub release 210237657 records asset 243345703 as singleheader.zip with size 3013061 bytes; the complete release asset was independently hashed before recording this digest."
+    }
+  }
+}