edde746
09656fa4d3
Pin external actions, images, toolchains, native archives, and tvOS engine artifacts; enforce fail-closed CI checks and keep website privacy disclosures aligned with shipped behavior.
53 lines
2.9 KiB
JSON
53 lines
2.9 KiB
JSON
{
|
|
"formatVersion": 1,
|
|
"refreshContract": {
|
|
"rules": [
|
|
"Audit each new upstream release before changing its version, URL, ref, commit, or SHA-256.",
|
|
"For an archive, verify upstream release evidence first, hash the complete reviewed file, and update URL and SHA-256 together.",
|
|
"For Git, verify the upstream release-producing tag record, record the full dereferenced root commit, and review its dependency lock or gitlinks before updating.",
|
|
"Run python3 scripts/verify_runtime_inputs.py and bash linux/packaging/build-libmpv_test.sh before a Linux build.",
|
|
"Never derive an expected checksum from bytes inside the production build or verification command."
|
|
]
|
|
},
|
|
"inputs": {
|
|
"ffmpeg": {
|
|
"kind": "archive",
|
|
"version": "7.1",
|
|
"url": "https://ffmpeg.org/releases/ffmpeg-7.1.tar.xz",
|
|
"sha256": "40973d44970dbc83ef302b0609f2e74982be2d85916dd2ee7472d30678a7abe6",
|
|
"provenance": "FFmpeg release archive verified against ffmpeg-7.1.tar.xz.asc with the official ffmpeg-devel.asc full fingerprint FCF986EA15E6E293A5644F10B4322F04D67658D8 before recording this digest."
|
|
},
|
|
"shaderc": {
|
|
"kind": "git",
|
|
"version": "2024.4",
|
|
"url": "https://github.com/google/shaderc.git",
|
|
"ref": "v2024.4",
|
|
"commit": "caa54d9779d5605aca4e1a0c0c962a3d8f4aeb31",
|
|
"provenance": "Official GitHub annotated tag object 3cd72062f297df05e6a042f2616c42bc8956c326 dereferences to this root commit; its DEPS file pins synchronized dependencies by full commit."
|
|
},
|
|
"libplacebo": {
|
|
"kind": "git",
|
|
"version": "7.351.0",
|
|
"url": "https://code.videolan.org/videolan/libplacebo.git",
|
|
"ref": "v7.351.0",
|
|
"commit": "3188549fba13bbdf3a5a98de2a38c2e71f04e21e",
|
|
"provenance": "Official VideoLAN GitLab tag record v7.351.0 contains a PGP-signed release message and dereferences to this root commit; its gitlinks pin recursive submodules."
|
|
},
|
|
"mpv": {
|
|
"kind": "archive",
|
|
"version": "0.40.0",
|
|
"url": "https://github.com/mpv-player/mpv/archive/refs/tags/v0.40.0.tar.gz",
|
|
"sha256": "10a0f4654f62140a6dd4d380dcf0bbdbdcf6e697556863dc499c296182f081a3",
|
|
"commit": "e48ac7ce08462f5e33af6ef9deeac6fa87eef01e",
|
|
"provenance": "GitHub reports annotated tag object 287d7cdb78975ae350d7c2a287eae3c2072c93f7 as a valid PGP signature over release commit e48ac7ce08462f5e33af6ef9deeac6fa87eef01e; the complete tag archive was then hashed."
|
|
},
|
|
"simdutf": {
|
|
"kind": "archive",
|
|
"version": "6.4.2",
|
|
"url": "https://github.com/simdutf/simdutf/releases/download/v6.4.2/singleheader.zip",
|
|
"sha256": "9fe4d6f515724a55c8de88fee4463e0890a1abe2267cda13c4b5d245d58039e6",
|
|
"provenance": "Official GitHub release 210237657 records asset 243345703 as singleheader.zip with size 3013061 bytes; the complete release asset was independently hashed before recording this digest."
|
|
}
|
|
}
|
|
}
|