From 6e8fcdb1ed57450b9df0cc382b1bb7d5e0bb845b Mon Sep 17 00:00:00 2001 From: TonyNa-code <278977922+TonyNa-code@users.noreply.github.com> Date: Mon, 17 Aug 2026 20:24:54 +0800 Subject: [PATCH 1/8] Pin GitHub Actions dependencies --- .github/workflows/build.yml | 6 +++--- .github/workflows/portable.yml | 4 ++-- .github/workflows/release-macos.yml | 10 +++++----- .github/workflows/release.yml | 6 +++--- 4 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index cc1ee5e..ff4e4e0 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -12,8 +12,8 @@ jobs: windows: runs-on: windows-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-dotnet@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x - name: Restore @@ -36,7 +36,7 @@ jobs: run: dotnet publish MusicDrop3/MFlacDrop.csproj -c Release -r win-x64 --self-contained true --no-restore -o artifacts/gui - name: Publish CLI run: dotnet publish MusicDrop3.Cli/MusicDrop3.Cli.csproj -c Release -r win-x64 --self-contained true --no-restore -o artifacts/cli - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: MusicDrop-community-win-x64-slim path: | diff --git a/.github/workflows/portable.yml b/.github/workflows/portable.yml index 486cc1f..56b3f1c 100644 --- a/.github/workflows/portable.yml +++ b/.github/workflows/portable.yml @@ -16,8 +16,8 @@ jobs: os: [windows-latest, macos-15] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v4 - - uses: actions/setup-dotnet@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x - run: dotnet restore MusicDrop.Portable.slnx --configfile NuGet.Config diff --git a/.github/workflows/release-macos.yml b/.github/workflows/release-macos.yml index d6279f5..bf612d6 100644 --- a/.github/workflows/release-macos.yml +++ b/.github/workflows/release-macos.yml @@ -20,15 +20,15 @@ jobs: rid: osx-arm64 runs-on: ${{ matrix.runner }} steps: - - uses: actions/checkout@v4 - - uses: actions/setup-dotnet@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x - name: Build pinned LGPL FFmpeg run: bash tools/build_ffmpeg_macos.sh "$RUNNER_TEMP/musicdrop-ffmpeg" - name: Build and package app run: bash tools/package_macos.sh "${{ matrix.rid }}" "$RUNNER_TEMP/musicdrop-ffmpeg" "$RUNNER_TEMP/dist" - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: MusicDrop-${{ matrix.rid }} path: | @@ -41,12 +41,12 @@ jobs: needs: build runs-on: ubuntu-latest steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: MusicDrop-osx-* path: release merge-multiple: true - - uses: softprops/action-gh-release@v2 + - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: files: | release/MusicDrop-*.zip diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7ea6887..cfca6da 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,8 +11,8 @@ jobs: release: runs-on: windows-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-dotnet@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x - run: dotnet restore MusicDrop.slnx --configfile NuGet.Config @@ -28,7 +28,7 @@ jobs: Compress-Archive -Path package/* -DestinationPath MusicDrop-${{ github.ref_name }}-Slim-Windows-x64.zip (Get-FileHash MusicDrop-${{ github.ref_name }}-Slim-Windows-x64.zip -Algorithm SHA256).Hash.ToLowerInvariant() | Set-Content MusicDrop-${{ github.ref_name }}-Slim-Windows-x64.zip.sha256.txt -Encoding ascii - - uses: softprops/action-gh-release@v2 + - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: files: | MusicDrop-*.zip From 444f7bbaa575ab38d2f3f142533c103526306c38 Mon Sep 17 00:00:00 2001 From: TonyNa-code <278977922+TonyNa-code@users.noreply.github.com> Date: Mon, 17 Aug 2026 23:21:29 +0800 Subject: [PATCH 2/8] Build verified cross-platform release packages --- .github/workflows/release-macos.yml | 11 +- .github/workflows/release.yml | 46 ++++--- docs/MACOS.md | 2 +- tools/package_macos.sh | 21 +++- tools/package_windows.ps1 | 183 ++++++++++++++++++++++++++++ 5 files changed, 242 insertions(+), 21 deletions(-) create mode 100644 tools/package_windows.ps1 diff --git a/.github/workflows/release-macos.yml b/.github/workflows/release-macos.yml index bf612d6..99c34ee 100644 --- a/.github/workflows/release-macos.yml +++ b/.github/workflows/release-macos.yml @@ -4,6 +4,11 @@ on: push: tags: ['v*'] workflow_dispatch: + inputs: + version: + description: Package version used for a non-release validation run + required: true + default: v3.1.0-preview.1-ci permissions: contents: write @@ -19,15 +24,17 @@ jobs: - runner: macos-15 rid: osx-arm64 runs-on: ${{ matrix.runner }} + env: + PACKAGE_VERSION: ${{ github.event_name == 'push' && github.ref_name || inputs.version }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: - dotnet-version: 10.0.x + dotnet-version: 10.0.301 - name: Build pinned LGPL FFmpeg run: bash tools/build_ffmpeg_macos.sh "$RUNNER_TEMP/musicdrop-ffmpeg" - name: Build and package app - run: bash tools/package_macos.sh "${{ matrix.rid }}" "$RUNNER_TEMP/musicdrop-ffmpeg" "$RUNNER_TEMP/dist" + run: bash tools/package_macos.sh "${{ matrix.rid }}" "$RUNNER_TEMP/musicdrop-ffmpeg" "$RUNNER_TEMP/dist" "$PACKAGE_VERSION" - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: MusicDrop-${{ matrix.rid }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cfca6da..c5ddc3e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -3,34 +3,50 @@ name: release on: push: tags: ['v*'] + workflow_dispatch: + inputs: + version: + description: Package version used for a non-release validation run + required: true + default: v3.1.0-preview.1-ci permissions: contents: write jobs: - release: + build: runs-on: windows-latest + env: + PACKAGE_VERSION: ${{ github.event_name == 'push' && github.ref_name || inputs.version }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: - dotnet-version: 10.0.x + dotnet-version: 10.0.301 - run: dotnet restore MusicDrop.slnx --configfile NuGet.Config - - run: dotnet publish MusicDrop3/MFlacDrop.csproj -c Release -r win-x64 --self-contained true --no-restore -o publish/gui - - run: dotnet publish MusicDrop3.Cli/MusicDrop3.Cli.csproj -c Release -r win-x64 --self-contained true --no-restore -o publish/cli - - name: Assemble slim archive + - name: Build verified Full and Slim packages shell: pwsh - run: | - New-Item -ItemType Directory -Path package | Out-Null - Copy-Item publish/gui/MusicDrop3.exe package/ - Copy-Item publish/cli/MusicDrop3.Cli.exe package/ - Copy-Item README.md,LICENSE,THIRD-PARTY-NOTICES.md,TRADEMARKS.md,PRIVACY.md package/ - Compress-Archive -Path package/* -DestinationPath MusicDrop-${{ github.ref_name }}-Slim-Windows-x64.zip - (Get-FileHash MusicDrop-${{ github.ref_name }}-Slim-Windows-x64.zip -Algorithm SHA256).Hash.ToLowerInvariant() | - Set-Content MusicDrop-${{ github.ref_name }}-Slim-Windows-x64.zip.sha256.txt -Encoding ascii + run: ./tools/package_windows.ps1 -Version $env:PACKAGE_VERSION -OutputDirectory release + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: MusicDrop-Windows-x64 + path: | + release/MusicDrop-*.zip + release/MusicDrop-*.sha256.txt + if-no-files-found: error + + release: + if: startsWith(github.ref, 'refs/tags/') + needs: build + runs-on: ubuntu-latest + steps: + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: MusicDrop-Windows-x64 + path: release - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: files: | - MusicDrop-*.zip - MusicDrop-*.sha256.txt + release/MusicDrop-*.zip + release/MusicDrop-*.sha256.txt generate_release_notes: true diff --git a/docs/MACOS.md b/docs/MACOS.md index c13e103..196dba7 100644 --- a/docs/MACOS.md +++ b/docs/MACOS.md @@ -41,7 +41,7 @@ On a matching Mac: ```bash ./tools/build_ffmpeg_macos.sh "$TMPDIR/musicdrop-ffmpeg" -./tools/package_macos.sh osx-arm64 "$TMPDIR/musicdrop-ffmpeg" "$PWD/dist" +./tools/package_macos.sh osx-arm64 "$TMPDIR/musicdrop-ffmpeg" "$PWD/dist" v3.1.0-preview.1 ``` ## Signing and notarization boundary diff --git a/tools/package_macos.sh b/tools/package_macos.sh index c963041..c905aa8 100644 --- a/tools/package_macos.sh +++ b/tools/package_macos.sh @@ -1,17 +1,22 @@ #!/usr/bin/env bash set -euo pipefail -rid="${1:?usage: package_macos.sh }" +rid="${1:?usage: package_macos.sh }" ffmpeg_prefix="${2:?missing FFmpeg prefix}" dist_dir="${3:?missing distribution directory}" +version="${4:?missing package version}" case "$rid" in osx-arm64|osx-x64) ;; *) echo "Unsupported RID: $rid" >&2; exit 2 ;; esac +if [[ ! "$version" =~ ^v[0-9A-Za-z.-]+$ ]]; then + echo "Unsupported version: $version" >&2 + exit 2 +fi repo_root="$(cd "$(dirname "$0")/.." && pwd)" mkdir -p "$dist_dir" dist_dir="$(cd "$dist_dir" && pwd)" publish_root="$dist_dir/publish-$rid" app="$dist_dir/MusicDrop.app" -archive="$dist_dir/MusicDrop-3.1.0-preview.1-${rid}.zip" +archive="$dist_dir/MusicDrop-${version}-${rid}.zip" dotnet publish "$repo_root/MusicDrop.Desktop/MusicDrop.Desktop.csproj" \ -c Release -r "$rid" --self-contained true -o "$publish_root/desktop" @@ -29,9 +34,19 @@ cp "$ffmpeg_prefix/FFMPEG-VERSION.txt" "$ffmpeg_prefix/FFMPEG-BUILDCONF.txt" \ "$ffmpeg_prefix/SHA256SUMS.txt" "$app/Contents/Resources/ffmpeg/" cp "$repo_root/tools/macos/Info.plist" "$app/Contents/Info.plist" cp "$repo_root/README.md" "$repo_root/README.zh-CN.md" "$repo_root/LICENSE" \ - "$repo_root/THIRD-PARTY-NOTICES.md" "$repo_root/PRIVACY.md" \ + "$repo_root/THIRD-PARTY-NOTICES.md" "$repo_root/TRADEMARKS.md" "$repo_root/PRIVACY.md" \ "$app/Contents/SharedSupport/" +dotnet_root="${DOTNET_ROOT:-}" +if [[ -z "$dotnet_root" || ! -f "$dotnet_root/LICENSE.txt" ]]; then + dotnet_root="$(cd "$(dirname "$(command -v dotnet)")" && pwd)" +fi +test -f "$dotnet_root/LICENSE.txt" +test -f "$dotnet_root/ThirdPartyNotices.txt" +cp "$dotnet_root/LICENSE.txt" "$app/Contents/SharedSupport/DOTNET-LICENSE.txt" +cp "$dotnet_root/ThirdPartyNotices.txt" \ + "$app/Contents/SharedSupport/DOTNET-THIRD-PARTY-NOTICES.txt" + iconset="$publish_root/MusicDrop.iconset" mkdir -p "$iconset" source_icon="$repo_root/MusicDrop3/Assets/musicdrop-logo-1024.png" diff --git a/tools/package_windows.ps1 b/tools/package_windows.ps1 new file mode 100644 index 0000000..20dc13d --- /dev/null +++ b/tools/package_windows.ps1 @@ -0,0 +1,183 @@ +[CmdletBinding()] +param( + [Parameter(Mandatory)] + [ValidatePattern('^v[0-9A-Za-z.-]+$')] + [string]$Version, + + [string]$OutputDirectory = 'artifacts/release-windows', + + [string]$FfmpegArchive = '' +) + +Set-StrictMode -Version Latest +$ErrorActionPreference = 'Stop' + +$repoRoot = [IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..')) +$distRoot = if ([IO.Path]::IsPathFullyQualified($OutputDirectory)) { + [IO.Path]::GetFullPath($OutputDirectory) +} else { + [IO.Path]::GetFullPath((Join-Path $repoRoot $OutputDirectory)) +} +[IO.Directory]::CreateDirectory($distRoot) | Out-Null + +$workRoot = Join-Path ([IO.Path]::GetTempPath()) ('MusicDropWindowsRelease-' + [guid]::NewGuid().ToString('N')) +[IO.Directory]::CreateDirectory($workRoot) | Out-Null +$createdOutputs = [Collections.Generic.List[string]]::new() + +$archiveName = 'ffmpeg-n8.1.2-34-g9b6c8969e0-win64-lgpl-shared-8.1.zip' +$archiveRoot = 'ffmpeg-n8.1.2-34-g9b6c8969e0-win64-lgpl-shared-8.1' +$archiveUrl = 'https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-08-11-13-11/' + $archiveName +$archiveSha256 = '026f3ba22f0acf4fe58bf4da28a7eb64ffb107b270119684b91e4cace3b577aa' +$ffmpegRevision = 'n8.1.2-34-g9b6c8969e0-20260811' +$ffmpegFiles = [ordered]@{ + 'bin/ffmpeg.exe' = '86a84607db881c93ac23ec8216b454e05ca8ae035ee8209fc2a9b10a845c2c84' + 'bin/ffprobe.exe' = '8e174683e435b089d7a9942afec5019e30ae6c550fcabfca3f917beb0768f7a6' + 'bin/avcodec-62.dll' = 'cc91ca4fc909f3d5a512e5b0d50a3d161305e005ca7febe969b5737acaef2475' + 'bin/avdevice-62.dll' = '2a229adf099eb360aad5bdda24a7f3d1a9d151db0e28365b6f428277360c320f' + 'bin/avfilter-11.dll' = 'e0d301cf78679caf8337a0babde8879924227a892e2e08abe04e9ec88bb9c351' + 'bin/avformat-62.dll' = '2fbd044d2a910035032d83dfd81d0f7fe442b73bea56341ccc171c941c62eb91' + 'bin/avutil-60.dll' = 'fd951227b0d1b574ed964d44ccca59422be1a821b67820600a4ac0a1b558e95a' + 'bin/swresample-6.dll' = '81d46648a06852f7123bc05501ec8c12bc396ad6f35b9ef2130ff9e3cadf80e5' + 'bin/swscale-9.dll' = '6f1214e30b4ebcef4468ff05954413c36ec83e4c8a0ed3dc7c6a04d42c26b0bd' + 'LICENSE.txt' = 'da7eabb7bafdf7d3ae5e9f223aa5bdc1eece45ac569dc21b3b037520b4464768' +} + +function Assert-Sha256([string]$Path, [string]$Expected) { + if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { throw "Missing release input: $Path" } + $actual = (Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash.ToLowerInvariant() + if ($actual -ne $Expected) { throw "SHA-256 mismatch: $Path" } +} + +function Copy-ReleaseDocuments([string]$Destination) { + foreach ($name in @('README.md', 'README.zh-CN.md', 'LICENSE', 'THIRD-PARTY-NOTICES.md', + 'TRADEMARKS.md', 'PRIVACY.md', 'SECURITY.md')) { + Copy-Item -LiteralPath (Join-Path $repoRoot $name) -Destination $Destination + } + + $dotnetRoot = Split-Path -Parent (Get-Command dotnet -ErrorAction Stop).Source + Copy-Item -LiteralPath (Join-Path $dotnetRoot 'LICENSE.txt') ` + -Destination (Join-Path $Destination 'DOTNET-LICENSE.txt') + Copy-Item -LiteralPath (Join-Path $dotnetRoot 'ThirdPartyNotices.txt') ` + -Destination (Join-Path $Destination 'DOTNET-THIRD-PARTY-NOTICES.txt') +} + +function Write-RecursiveSums([string]$Directory) { + $lines = foreach ($file in Get-ChildItem -LiteralPath $Directory -Recurse -File | + Where-Object Name -ne 'SHA256SUMS.txt' | Sort-Object FullName) { + $relative = $file.FullName.Substring($Directory.TrimEnd('\').Length + 1).Replace('\', '/') + $hash = (Get-FileHash -LiteralPath $file.FullName -Algorithm SHA256).Hash.ToLowerInvariant() + "$hash $relative" + } + $lines | Set-Content -LiteralPath (Join-Path $Directory 'SHA256SUMS.txt') -Encoding ascii +} + +function Write-ZipHash([string]$ZipPath) { + $hashPath = $ZipPath + '.sha256.txt' + $hash = (Get-FileHash -LiteralPath $ZipPath -Algorithm SHA256).Hash.ToLowerInvariant() + "$hash $([IO.Path]::GetFileName($ZipPath))" | Set-Content -LiteralPath $hashPath -Encoding ascii + $createdOutputs.Add($hashPath) +} + +try { + $archive = if ([string]::IsNullOrWhiteSpace($FfmpegArchive)) { + $download = Join-Path $workRoot $archiveName + Invoke-WebRequest -Uri $archiveUrl -OutFile $download + $download + } else { + [IO.Path]::GetFullPath($FfmpegArchive) + } + $archiveInfo = Get-Item -LiteralPath $archive + if ($archiveInfo.Length -le 0 -or $archiveInfo.Length -gt 128MB) { + throw 'FFmpeg archive size is outside the allowed range.' + } + Assert-Sha256 $archive $archiveSha256 + + $expanded = Join-Path $workRoot 'ffmpeg-expanded' + Expand-Archive -LiteralPath $archive -DestinationPath $expanded + $ffmpegRoot = Join-Path $expanded $archiveRoot + foreach ($entry in $ffmpegFiles.GetEnumerator()) { + Assert-Sha256 (Join-Path $ffmpegRoot $entry.Key.Replace('/', '\')) $entry.Value + } + + $ffmpegExe = Join-Path $ffmpegRoot 'bin\ffmpeg.exe' + $versionOutput = (& $ffmpegExe -hide_banner -version 2>&1 | Out-String) + if ($LASTEXITCODE -ne 0 -or -not $versionOutput.Contains($ffmpegRevision) -or + -not $versionOutput.Contains('--enable-version3') -or + -not $versionOutput.Contains('--enable-shared') -or + -not $versionOutput.Contains('--enable-libmp3lame') -or + -not $versionOutput.Contains('--enable-libvorbis') -or + $versionOutput.Contains('--enable-gpl')) { + throw 'FFmpeg version or LGPL capability verification failed.' + } + $encoders = (& $ffmpegExe -hide_banner -encoders 2>&1 | Out-String) + if ($LASTEXITCODE -ne 0 -or -not $encoders.Contains('libmp3lame') -or + -not $encoders.Contains('libvorbis') -or -not $encoders.Contains(' flac ')) { + throw 'FFmpeg is missing a required audio encoder.' + } + + $publishGui = Join-Path $workRoot 'publish-gui' + $publishCli = Join-Path $workRoot 'publish-cli' + & dotnet publish (Join-Path $repoRoot 'MusicDrop3\MFlacDrop.csproj') ` + -c Release -r win-x64 --self-contained true --no-restore -o $publishGui + if ($LASTEXITCODE -ne 0) { throw 'GUI publish failed.' } + & dotnet publish (Join-Path $repoRoot 'MusicDrop3.Cli\MusicDrop3.Cli.csproj') ` + -c Release -r win-x64 --self-contained true --no-restore -o $publishCli + if ($LASTEXITCODE -ne 0) { throw 'CLI publish failed.' } + + $slimRoot = Join-Path $workRoot 'package-slim' + $fullRoot = Join-Path $workRoot 'package-full' + [IO.Directory]::CreateDirectory($slimRoot) | Out-Null + [IO.Directory]::CreateDirectory($fullRoot) | Out-Null + Copy-Item -LiteralPath (Join-Path $publishGui 'MusicDrop3.exe') -Destination $slimRoot + Copy-Item -LiteralPath (Join-Path $publishCli 'MusicDrop3.Cli.exe') -Destination $slimRoot + Copy-ReleaseDocuments $slimRoot + Get-ChildItem -LiteralPath $slimRoot -Force | Copy-Item -Destination $fullRoot -Recurse + + $ffmpegTarget = Join-Path $fullRoot 'ffmpeg' + foreach ($entry in $ffmpegFiles.GetEnumerator()) { + $destination = Join-Path $ffmpegTarget $entry.Key.Replace('/', '\') + [IO.Directory]::CreateDirectory([IO.Path]::GetDirectoryName($destination)) | Out-Null + Copy-Item -LiteralPath (Join-Path $ffmpegRoot $entry.Key.Replace('/', '\')) -Destination $destination + } + @( + 'MusicDrop bundled FFmpeg provenance', + '', + "Build: $ffmpegRevision", + "Archive: $archiveName", + "Archive SHA-256: $archiveSha256", + 'Build project: https://github.com/BtbN/FFmpeg-Builds', + 'FFmpeg project: https://ffmpeg.org/', + 'Source revision: https://github.com/FFmpeg/FFmpeg/commit/9b6c8969e0' + ) | Set-Content -LiteralPath (Join-Path $ffmpegTarget 'FFMPEG-SOURCE.txt') -Encoding utf8 + + Write-RecursiveSums $slimRoot + Write-RecursiveSums $fullRoot + + $slimZip = Join-Path $distRoot "MusicDrop-$Version-Slim-Windows-x64.zip" + $fullZip = Join-Path $distRoot "MusicDrop-$Version-Full-Windows-x64.zip" + foreach ($path in @($slimZip, $fullZip, $slimZip + '.sha256.txt', $fullZip + '.sha256.txt')) { + if (Test-Path -LiteralPath $path) { throw "Refusing to overwrite release output: $path" } + } + Compress-Archive -Path (Join-Path $slimRoot '*') -DestinationPath $slimZip -CompressionLevel Optimal + $createdOutputs.Add($slimZip) + Compress-Archive -Path (Join-Path $fullRoot '*') -DestinationPath $fullZip -CompressionLevel Optimal + $createdOutputs.Add($fullZip) + Write-ZipHash $slimZip + Write-ZipHash $fullZip + + Get-Item -LiteralPath $slimZip, $fullZip | Select-Object FullName, Length +} +catch { + foreach ($path in $createdOutputs) { + try { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Force } } catch { } + } + throw +} +finally { + $tempRoot = [IO.Path]::GetFullPath([IO.Path]::GetTempPath()).TrimEnd('\') + '\' + $resolvedWork = [IO.Path]::GetFullPath($workRoot) + if ($resolvedWork.StartsWith($tempRoot, [StringComparison]::OrdinalIgnoreCase) -and + (Test-Path -LiteralPath $resolvedWork)) { + Remove-Item -LiteralPath $resolvedWork -Recurse -Force + } +} From 9172a4f73177cb5f4f03423289154e01cbd7af5a Mon Sep 17 00:00:00 2001 From: TonyNa-code <278977922+TonyNa-code@users.noreply.github.com> Date: Tue, 18 Aug 2026 02:02:40 +0800 Subject: [PATCH 3/8] Fix portable macOS FFmpeg packaging --- .github/workflows/release-macos.yml | 2 + tools/build_ffmpeg_macos.sh | 63 +++++++++++++++++++++++++++-- tools/package_macos.sh | 1 + 3 files changed, 62 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release-macos.yml b/.github/workflows/release-macos.yml index 99c34ee..8217abe 100644 --- a/.github/workflows/release-macos.yml +++ b/.github/workflows/release-macos.yml @@ -33,6 +33,8 @@ jobs: dotnet-version: 10.0.301 - name: Build pinned LGPL FFmpeg run: bash tools/build_ffmpeg_macos.sh "$RUNNER_TEMP/musicdrop-ffmpeg" + env: + GITHUB_TOKEN: ${{ github.token }} - name: Build and package app run: bash tools/package_macos.sh "${{ matrix.rid }}" "$RUNNER_TEMP/musicdrop-ffmpeg" "$RUNNER_TEMP/dist" "$PACKAGE_VERSION" - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 diff --git a/tools/build_ffmpeg_macos.sh b/tools/build_ffmpeg_macos.sh index a1ca482..96962ed 100644 --- a/tools/build_ffmpeg_macos.sh +++ b/tools/build_ffmpeg_macos.sh @@ -13,7 +13,22 @@ output_dir="$(cd "$output_dir" && pwd)" archive="$work_dir/ffmpeg.tar.gz" brew install pkg-config nasm lame libogg libvorbis -curl --fail --location --retry 3 --output "$archive" "$source_url" +curl_args=( + --fail + --location + --retry 10 + --retry-all-errors + --retry-delay 5 + --retry-max-time 900 + --connect-timeout 30 + --max-time 900 + --user-agent "MusicDrop-release-builder" + --output "$archive" +) +if [[ -n "${GITHUB_TOKEN:-}" ]]; then + curl_args+=(--header "Authorization: Bearer ${GITHUB_TOKEN}") +fi +curl "${curl_args[@]}" "$source_url" printf '%s %s\n' "$source_sha256" "$archive" | shasum -a 256 --check tar -xzf "$archive" -C "$work_dir" source_dir="$(find "$work_dir" -mindepth 1 -maxdepth 1 -type d -name 'FFmpeg-*' -print -quit)" @@ -22,6 +37,35 @@ test -n "$source_dir" lame_prefix="$(brew --prefix lame)" ogg_prefix="$(brew --prefix libogg)" vorbis_prefix="$(brew --prefix libvorbis)" + +# Homebrew installs both static archives and dylibs. FFmpeg's pkg-config checks +# normally emit -l flags, which let Apple's linker prefer the dylibs even when +# pkg-config is asked for static dependencies. Keep the verified Homebrew +# headers, but rewrite the four external audio libraries to their exact .a +# files so the resulting standalone executables remain portable. +real_pkg_config="$(command -v pkg-config)" +static_pkg_config="$work_dir/pkg-config-static" +cat > "$static_pkg_config" <<'PKG_CONFIG_WRAPPER' +#!/usr/bin/env bash +set -euo pipefail +output="$("$REAL_PKG_CONFIG" "$@")" +output="${output//-lvorbisenc/$VORBISENC_ARCHIVE}" +output="${output//-lvorbis/$VORBIS_ARCHIVE}" +output="${output//-lmp3lame/$LAME_ARCHIVE}" +output="${output//-logg/$OGG_ARCHIVE}" +printf '%s\n' "$output" +PKG_CONFIG_WRAPPER +chmod 0755 "$static_pkg_config" +export REAL_PKG_CONFIG="$real_pkg_config" +export LAME_ARCHIVE="$lame_prefix/lib/libmp3lame.a" +export OGG_ARCHIVE="$ogg_prefix/lib/libogg.a" +export VORBIS_ARCHIVE="$vorbis_prefix/lib/libvorbis.a" +export VORBISENC_ARCHIVE="$vorbis_prefix/lib/libvorbisenc.a" +test -f "$LAME_ARCHIVE" +test -f "$OGG_ARCHIVE" +test -f "$VORBIS_ARCHIVE" +test -f "$VORBISENC_ARCHIVE" + cd "$source_dir" PKG_CONFIG_PATH="$lame_prefix/lib/pkgconfig:$ogg_prefix/lib/pkgconfig:$vorbis_prefix/lib/pkgconfig" \ ./configure \ @@ -38,9 +82,9 @@ PKG_CONFIG_PATH="$lame_prefix/lib/pkgconfig:$ogg_prefix/lib/pkgconfig:$vorbis_pr --enable-ffprobe \ --enable-libmp3lame \ --enable-libvorbis \ + --pkg-config="$static_pkg_config" \ --pkg-config-flags="--static" \ - --extra-cflags="-I$lame_prefix/include -I$ogg_prefix/include -I$vorbis_prefix/include" \ - --extra-ldflags="-L$lame_prefix/lib -L$ogg_prefix/lib -L$vorbis_prefix/lib" + --extra-cflags="-I$lame_prefix/include -I$ogg_prefix/include -I$vorbis_prefix/include" make -j"$(sysctl -n hw.ncpu)" make install @@ -53,11 +97,22 @@ make install "$output_dir/bin/ffmpeg" -hide_banner -encoders | grep -Eq '[[:space:]]flac[[:space:]]' "$output_dir/bin/ffmpeg" -hide_banner -encoders | grep -Eq 'pcm_s(16|24|32)le' -if otool -L "$output_dir/bin/ffmpeg" "$output_dir/bin/ffprobe" | grep -Eq '/(opt/homebrew|usr/local/opt)/'; then +dependencies_file="$output_dir/FFMPEG-DEPENDENCIES.txt" +otool -L "$output_dir/bin/ffmpeg" "$output_dir/bin/ffprobe" | tee "$dependencies_file" +if grep -Eq '/(opt/homebrew|usr/local/opt)/' "$dependencies_file"; then echo "FFmpeg unexpectedly links to Homebrew dylibs; refusing a non-portable package." >&2 exit 1 fi +musicdrop_revision="${GITHUB_SHA:-main}" +cat > "$output_dir/FFMPEG-SOURCE.txt" < Date: Tue, 18 Aug 2026 02:10:50 +0800 Subject: [PATCH 4/8] Link macOS media dependencies statically --- THIRD-PARTY-NOTICES.md | 2 +- docs/FFMPEG.md | 4 +-- tools/build_ffmpeg_macos.sh | 52 +++++++++++++++++-------------------- 3 files changed, 27 insertions(+), 31 deletions(-) diff --git a/THIRD-PARTY-NOTICES.md b/THIRD-PARTY-NOTICES.md index 193c5ad..a67afb9 100644 --- a/THIRD-PARTY-NOTICES.md +++ b/THIRD-PARTY-NOTICES.md @@ -37,7 +37,7 @@ Upstream: · build scripts: "$static_pkg_config" <<'PKG_CONFIG_WRAPPER' -#!/usr/bin/env bash -set -euo pipefail -output="$("$REAL_PKG_CONFIG" "$@")" -output="${output//-lvorbisenc/$VORBISENC_ARCHIVE}" -output="${output//-lvorbis/$VORBIS_ARCHIVE}" -output="${output//-lmp3lame/$LAME_ARCHIVE}" -output="${output//-logg/$OGG_ARCHIVE}" -printf '%s\n' "$output" -PKG_CONFIG_WRAPPER -chmod 0755 "$static_pkg_config" -export REAL_PKG_CONFIG="$real_pkg_config" -export LAME_ARCHIVE="$lame_prefix/lib/libmp3lame.a" -export OGG_ARCHIVE="$ogg_prefix/lib/libogg.a" -export VORBIS_ARCHIVE="$vorbis_prefix/lib/libvorbis.a" -export VORBISENC_ARCHIVE="$vorbis_prefix/lib/libvorbisenc.a" -test -f "$LAME_ARCHIVE" -test -f "$OGG_ARCHIVE" -test -f "$VORBIS_ARCHIVE" -test -f "$VORBISENC_ARCHIVE" +# emit -l flags, which otherwise let Apple's linker select Homebrew dylibs. +# Put only the required archives in the first search path and explicitly use +# Apple's per-directory search order. This preserves FFmpeg's native +# pkg-config probes while producing standalone binaries. +static_lib_dir="$work_dir/static-libs" +mkdir -p "$static_lib_dir" +static_archives=( + "$lame_prefix/lib/libmp3lame.a" + "$mpg123_prefix/lib/libmpg123.a" + "$ogg_prefix/lib/libogg.a" + "$vorbis_prefix/lib/libvorbis.a" + "$vorbis_prefix/lib/libvorbisenc.a" +) +for static_archive in "${static_archives[@]}"; do + test -f "$static_archive" + ln -s "$static_archive" "$static_lib_dir/$(basename "$static_archive")" +done cd "$source_dir" PKG_CONFIG_PATH="$lame_prefix/lib/pkgconfig:$ogg_prefix/lib/pkgconfig:$vorbis_prefix/lib/pkgconfig" \ @@ -82,9 +74,9 @@ PKG_CONFIG_PATH="$lame_prefix/lib/pkgconfig:$ogg_prefix/lib/pkgconfig:$vorbis_pr --enable-ffprobe \ --enable-libmp3lame \ --enable-libvorbis \ - --pkg-config="$static_pkg_config" \ --pkg-config-flags="--static" \ - --extra-cflags="-I$lame_prefix/include -I$ogg_prefix/include -I$vorbis_prefix/include" + --extra-cflags="-I$lame_prefix/include -I$ogg_prefix/include -I$vorbis_prefix/include" \ + --extra-ldflags="-Wl,-search_paths_first -L$static_lib_dir" make -j"$(sysctl -n hw.ncpu)" make install @@ -110,12 +102,16 @@ FFmpeg commit: ${source_commit} Source archive: ${source_url} Source archive SHA-256: ${source_sha256} Build script: https://github.com/TonyNa-code/MusicDrop/blob/${musicdrop_revision}/tools/build_ffmpeg_macos.sh +Dependency formulas: $(brew list --versions lame mpg123 libogg libvorbis | tr '\n' ';') Configuration and runtime dependencies are recorded beside this file. SOURCE_PROVENANCE mkdir -p "$output_dir/licenses" cp COPYING.LGPLv2.1 COPYING.LGPLv3 "$output_dir/licenses/" cp "$lame_prefix/share/doc/lame/COPYING" "$output_dir/licenses/LAME-COPYING.txt" +mpg123_license="$(find "$mpg123_prefix" -type f \( -name COPYING -o -name LICENSE \) -print -quit)" +test -n "$mpg123_license" +cp "$mpg123_license" "$output_dir/licenses/MPG123-COPYING.txt" cp "$ogg_prefix/share/doc/libogg/COPYING" "$output_dir/licenses/LIBOGG-COPYING.txt" cp "$vorbis_prefix/share/doc/libvorbis/COPYING" "$output_dir/licenses/LIBVORBIS-COPYING.txt" shasum -a 256 "$output_dir/bin/ffmpeg" "$output_dir/bin/ffprobe" > "$output_dir/SHA256SUMS.txt" From 35b96cb25c6e190125d62e1de23e17d1a02622f2 Mon Sep 17 00:00:00 2001 From: TonyNa-code <278977922+TonyNa-code@users.noreply.github.com> Date: Tue, 18 Aug 2026 02:14:52 +0800 Subject: [PATCH 5/8] Expose macOS FFmpeg configure diagnostics --- tools/build_ffmpeg_macos.sh | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/tools/build_ffmpeg_macos.sh b/tools/build_ffmpeg_macos.sh index 10f5dfd..e895cdb 100644 --- a/tools/build_ffmpeg_macos.sh +++ b/tools/build_ffmpeg_macos.sh @@ -59,8 +59,8 @@ for static_archive in "${static_archives[@]}"; do done cd "$source_dir" -PKG_CONFIG_PATH="$lame_prefix/lib/pkgconfig:$ogg_prefix/lib/pkgconfig:$vorbis_prefix/lib/pkgconfig" \ -./configure \ +if ! PKG_CONFIG_PATH="$lame_prefix/lib/pkgconfig:$ogg_prefix/lib/pkgconfig:$vorbis_prefix/lib/pkgconfig" \ + ./configure \ --prefix="$output_dir" \ --disable-debug \ --disable-doc \ @@ -76,7 +76,11 @@ PKG_CONFIG_PATH="$lame_prefix/lib/pkgconfig:$ogg_prefix/lib/pkgconfig:$vorbis_pr --enable-libvorbis \ --pkg-config-flags="--static" \ --extra-cflags="-I$lame_prefix/include -I$ogg_prefix/include -I$vorbis_prefix/include" \ - --extra-ldflags="-Wl,-search_paths_first -L$static_lib_dir" + --extra-ldflags="-Wl,-search_paths_first -L$static_lib_dir"; then + echo "FFmpeg configure failed; showing the diagnostic log tail." >&2 + tail -n 250 ffbuild/config.log >&2 || true + exit 1 +fi make -j"$(sysctl -n hw.ncpu)" make install From f79cf39e4fade55eec69e3b510afc1614436440b Mon Sep 17 00:00:00 2001 From: TonyNa-code <278977922+TonyNa-code@users.noreply.github.com> Date: Tue, 18 Aug 2026 02:18:07 +0800 Subject: [PATCH 6/8] Complete static LAME dependency chain --- tools/build_ffmpeg_macos.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/build_ffmpeg_macos.sh b/tools/build_ffmpeg_macos.sh index e895cdb..82c885c 100644 --- a/tools/build_ffmpeg_macos.sh +++ b/tools/build_ffmpeg_macos.sh @@ -76,7 +76,8 @@ if ! PKG_CONFIG_PATH="$lame_prefix/lib/pkgconfig:$ogg_prefix/lib/pkgconfig:$vorb --enable-libvorbis \ --pkg-config-flags="--static" \ --extra-cflags="-I$lame_prefix/include -I$ogg_prefix/include -I$vorbis_prefix/include" \ - --extra-ldflags="-Wl,-search_paths_first -L$static_lib_dir"; then + --extra-ldflags="-Wl,-search_paths_first -L$static_lib_dir" \ + --extra-libs="-lmpg123"; then echo "FFmpeg configure failed; showing the diagnostic log tail." >&2 tail -n 250 ffbuild/config.log >&2 || true exit 1 From 48d4ca104ea30442d75286e17fb81127dfa23335 Mon Sep 17 00:00:00 2001 From: TonyNa-code <278977922+TonyNa-code@users.noreply.github.com> Date: Tue, 18 Aug 2026 02:23:28 +0800 Subject: [PATCH 7/8] Disable unintended macOS media dependencies --- docs/FFMPEG.md | 2 +- tools/build_ffmpeg_macos.sh | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/FFMPEG.md b/docs/FFMPEG.md index 986dc2c..9fc6969 100644 --- a/docs/FFMPEG.md +++ b/docs/FFMPEG.md @@ -19,7 +19,7 @@ The macOS release workflow does not copy an opaque third-party binary. It downlo The script: -- disables GPL, nonfree, network access, documentation and FFplay; +- disables GPL, nonfree, network access, documentation, FFplay and automatic external-library detection; - enables static LAME, mpg123 and Vorbis dependencies with compatible licenses; - rejects unexpected Homebrew dylib references; - verifies FLAC, PCM, MP3 and Vorbis encoders; diff --git a/tools/build_ffmpeg_macos.sh b/tools/build_ffmpeg_macos.sh index 82c885c..373534c 100644 --- a/tools/build_ffmpeg_macos.sh +++ b/tools/build_ffmpeg_macos.sh @@ -66,6 +66,7 @@ if ! PKG_CONFIG_PATH="$lame_prefix/lib/pkgconfig:$ogg_prefix/lib/pkgconfig:$vorb --disable-doc \ --disable-ffplay \ --disable-network \ + --disable-autodetect \ --disable-shared \ --enable-static \ --disable-gpl \ From 10a83d763542c916e59ea71bb426390c6480d35e Mon Sep 17 00:00:00 2001 From: TonyNa-code <278977922+TonyNa-code@users.noreply.github.com> Date: Tue, 18 Aug 2026 02:33:48 +0800 Subject: [PATCH 8/8] Bundle verified macOS dependency licenses --- docs/FFMPEG.md | 2 + third_party/licenses/LAME-COPYING.txt | 491 +++++++++++++++++++++ third_party/licenses/LIBOGG-COPYING.txt | 28 ++ third_party/licenses/LIBVORBIS-COPYING.txt | 28 ++ tools/build_ffmpeg_macos.sh | 17 +- 5 files changed, 560 insertions(+), 6 deletions(-) create mode 100644 third_party/licenses/LAME-COPYING.txt create mode 100644 third_party/licenses/LIBOGG-COPYING.txt create mode 100644 third_party/licenses/LIBVORBIS-COPYING.txt diff --git a/docs/FFMPEG.md b/docs/FFMPEG.md index 9fc6969..de41f31 100644 --- a/docs/FFMPEG.md +++ b/docs/FFMPEG.md @@ -26,4 +26,6 @@ The script: - records `-version`, `-buildconf` and SHA-256 outputs; - copies FFmpeg, LAME, mpg123, libogg and libvorbis license texts into the app bundle. +Homebrew bottles do not consistently install their `COPYING` files. The repository therefore carries the complete license texts extracted from the formula-pinned LAME 4.0, libogg 1.3.6 and libvorbis 1.3.7 source archives after verifying SHA-256 `3df512…16eb`, `83e670…4638` and `b33cc4…954b`; packaging never silently omits them. + See `tools/build_ffmpeg_macos.sh` and [macOS packaging](MACOS.md). A source-built LGPL configuration does not replace the need to comply with LGPL source/relinking obligations when distributing binaries. diff --git a/third_party/licenses/LAME-COPYING.txt b/third_party/licenses/LAME-COPYING.txt new file mode 100644 index 0000000..8e6fa60 --- /dev/null +++ b/third_party/licenses/LAME-COPYING.txt @@ -0,0 +1,491 @@ + GNU LIBRARY GENERAL PUBLIC LICENSE + Version 2, June 1991 + + Copyright (C) 1991 Free Software Foundation, Inc. + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA + + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + +[This is the first released version of the library GPL. It is + numbered 2 because it goes with version 2 of the ordinary GPL.] + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +Licenses are intended to guarantee your freedom to share and change +free software--to make sure the software is free for all its users. + + This license, the Library General Public License, applies to some +specially designated Free Software Foundation software, and to any +other libraries whose authors decide to use it. You can use it for +your libraries, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +this service if you wish), that you receive source code or can get it +if you want it, that you can change the software or use pieces of it +in new free programs; and that you know you can do these things. + + To protect your rights, we need to make restrictions that forbid +anyone to deny you these rights or to ask you to surrender the rights. +These restrictions translate to certain responsibilities for you if +you distribute copies of the library, or if you modify it. + + For example, if you distribute copies of the library, whether gratis +or for a fee, you must give the recipients all the rights that we gave +you. You must make sure that they, too, receive or can get the source +code. If you link a program with the library, you must provide +complete object files to the recipients so that they can relink them +with the library, after making changes to the library and recompiling +it. And you must show them these terms so they know their rights. + + Our method of protecting your rights has two steps: (1) copyright +the library, and (2) offer you this license which gives you legal +permission to copy, distribute and/or modify the library. + + Also, for each distributor's protection, we want to make certain +that everyone understands that there is no warranty for this free +library. If the library is modified by someone else and passed on, we +want its recipients to know that what they have is not the original +version, so that any problems introduced by others will not reflect on +the original authors' reputations. + + + Finally, any free program is threatened constantly by software +patents. We wish to avoid the danger that companies distributing free +software will individually obtain patent licenses, thus in effect +transforming the program into proprietary software. To prevent this, +we have made it clear that any patent must be licensed for everyone's +free use or not licensed at all. + + Most GNU software, including some libraries, is covered by the ordinary +GNU General Public License, which was designed for utility programs. This +license, the GNU Library General Public License, applies to certain +designated libraries. This license is quite different from the ordinary +one; be sure to read it in full, and don't assume that anything in it is +the same as in the ordinary license. + + The reason we have a separate public license for some libraries is that +they blur the distinction we usually make between modifying or adding to a +program and simply using it. Linking a program with a library, without +changing the library, is in some sense simply using the library, and is +analogous to running a utility program or application program. However, in +a textual and legal sense, the linked executable is a combined work, a +derivative of the original library, and the ordinary General Public License +treats it as such. + + Because of this blurred distinction, using the ordinary General +Public License for libraries did not effectively promote software +sharing, because most developers did not use the libraries. We +concluded that weaker conditions might promote sharing better. + + However, unrestricted linking of non-free programs would deprive the +users of those programs of all benefit from the free status of the +libraries themselves. This Library General Public License is intended to +permit developers of non-free programs to use free libraries, while +preserving your freedom as a user of such programs to change the free +libraries that are incorporated in them. (We have not seen how to achieve +this as regards changes in header files, but we have achieved it as regards +changes in the actual functions of the Library.) The hope is that this +will lead to faster development of free libraries. + + The precise terms and conditions for copying, distribution and +modification follow. Pay close attention to the difference between a +"work based on the library" and a "work that uses the library". The +former contains code derived from the library, while the latter only +works together with the library. + + Note that it is possible for a library to be covered by the ordinary +General Public License rather than by this special one. + + + GNU LIBRARY GENERAL PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. This License Agreement applies to any software library which +contains a notice placed by the copyright holder or other authorized +party saying it may be distributed under the terms of this Library +General Public License (also called "this License"). Each licensee is +addressed as "you". + + A "library" means a collection of software functions and/or data +prepared so as to be conveniently linked with application programs +(which use some of those functions and data) to form executables. + + The "Library", below, refers to any such software library or work +which has been distributed under these terms. A "work based on the +Library" means either the Library or any derivative work under +copyright law: that is to say, a work containing the Library or a +portion of it, either verbatim or with modifications and/or translated +straightforwardly into another language. (Hereinafter, translation is +included without limitation in the term "modification".) + + "Source code" for a work means the preferred form of the work for +making modifications to it. For a library, complete source code means +all the source code for all modules it contains, plus any associated +interface definition files, plus the scripts used to control compilation +and installation of the library. + + Activities other than copying, distribution and modification are not +covered by this License; they are outside its scope. The act of +running a program using the Library is not restricted, and output from +such a program is covered only if its contents constitute a work based +on the Library (independent of the use of the Library in a tool for +writing it). Whether that is true depends on what the Library does +and what the program that uses the Library does. + + 1. You may copy and distribute verbatim copies of the Library's +complete source code as you receive it, in any medium, provided that +you conspicuously and appropriately publish on each copy an +appropriate copyright notice and disclaimer of warranty; keep intact +all the notices that refer to this License and to the absence of any +warranty; and distribute a copy of this License along with the +Library. + + You may charge a fee for the physical act of transferring a copy, +and you may at your option offer warranty protection in exchange for a +fee. + + + 2. You may modify your copy or copies of the Library or any portion +of it, thus forming a work based on the Library, and copy and +distribute such modifications or work under the terms of Section 1 +above, provided that you also meet all of these conditions: + + a) The modified work must itself be a software library. + + b) You must cause the files modified to carry prominent notices + stating that you changed the files and the date of any change. + + c) You must cause the whole of the work to be licensed at no + charge to all third parties under the terms of this License. + + d) If a facility in the modified Library refers to a function or a + table of data to be supplied by an application program that uses + the facility, other than as an argument passed when the facility + is invoked, then you must make a good faith effort to ensure that, + in the event an application does not supply such function or + table, the facility still operates, and performs whatever part of + its purpose remains meaningful. + + (For example, a function in a library to compute square roots has + a purpose that is entirely well-defined independent of the + application. Therefore, Subsection 2d requires that any + application-supplied function or table used by this function must + be optional: if the application does not supply it, the square + root function must still compute square roots.) + +These requirements apply to the modified work as a whole. If +identifiable sections of that work are not derived from the Library, +and can be reasonably considered independent and separate works in +themselves, then this License, and its terms, do not apply to those +sections when you distribute them as separate works. But when you +distribute the same sections as part of a whole which is a work based +on the Library, the distribution of the whole must be on the terms of +this License, whose permissions for other licensees extend to the +entire whole, and thus to each and every part regardless of who wrote +it. + +Thus, it is not the intent of this section to claim rights or contest +your rights to work written entirely by you; rather, the intent is to +exercise the right to control the distribution of derivative or +collective works based on the Library. + +In addition, mere aggregation of another work not based on the Library +with the Library (or with a work based on the Library) on a volume of +a storage or distribution medium does not bring the other work under +the scope of this License. + + 3. You may opt to apply the terms of the ordinary GNU General Public +License instead of this License to a given copy of the Library. To do +this, you must alter all the notices that refer to this License, so +that they refer to the ordinary GNU General Public License, version 2, +instead of to this License. (If a newer version than version 2 of the +ordinary GNU General Public License has appeared, then you can specify +that version instead if you wish.) Do not make any other change in +these notices. + + + Once this change is made in a given copy, it is irreversible for +that copy, so the ordinary GNU General Public License applies to all +subsequent copies and derivative works made from that copy. + + This option is useful when you wish to copy part of the code of +the Library into a program that is not a library. + + 4. You may copy and distribute the Library (or a portion or +derivative of it, under Section 2) in object code or executable form +under the terms of Sections 1 and 2 above provided that you accompany +it with the complete corresponding machine-readable source code, which +must be distributed under the terms of Sections 1 and 2 above on a +medium customarily used for software interchange. + + If distribution of object code is made by offering access to copy +from a designated place, then offering equivalent access to copy the +source code from the same place satisfies the requirement to +distribute the source code, even though third parties are not +compelled to copy the source along with the object code. + + 5. A program that contains no derivative of any portion of the +Library, but is designed to work with the Library by being compiled or +linked with it, is called a "work that uses the Library". Such a +work, in isolation, is not a derivative work of the Library, and +therefore falls outside the scope of this License. + + However, linking a "work that uses the Library" with the Library +creates an executable that is a derivative of the Library (because it +contains portions of the Library), rather than a "work that uses the +library". The executable is therefore covered by this License. +Section 6 states terms for distribution of such executables. + + When a "work that uses the Library" uses material from a header file +that is part of the Library, the object code for the work may be a +derivative work of the Library even though the source code is not. +Whether this is true is especially significant if the work can be +linked without the Library, or if the work is itself a library. The +threshold for this to be true is not precisely defined by law. + + If such an object file uses only numerical parameters, data +structure layouts and accessors, and small macros and small inline +functions (ten lines or less in length), then the use of the object +file is unrestricted, regardless of whether it is legally a derivative +work. (Executables containing this object code plus portions of the +Library will still fall under Section 6.) + + Otherwise, if the work is a derivative of the Library, you may +distribute the object code for the work under the terms of Section 6. +Any executables containing that work also fall under Section 6, +whether or not they are linked directly with the Library itself. + + + 6. As an exception to the Sections above, you may also compile or +link a "work that uses the Library" with the Library to produce a +work containing portions of the Library, and distribute that work +under terms of your choice, provided that the terms permit +modification of the work for the customer's own use and reverse +engineering for debugging such modifications. + + You must give prominent notice with each copy of the work that the +Library is used in it and that the Library and its use are covered by +this License. You must supply a copy of this License. If the work +during execution displays copyright notices, you must include the +copyright notice for the Library among them, as well as a reference +directing the user to the copy of this License. Also, you must do one +of these things: + + a) Accompany the work with the complete corresponding + machine-readable source code for the Library including whatever + changes were used in the work (which must be distributed under + Sections 1 and 2 above); and, if the work is an executable linked + with the Library, with the complete machine-readable "work that + uses the Library", as object code and/or source code, so that the + user can modify the Library and then relink to produce a modified + executable containing the modified Library. (It is understood + that the user who changes the contents of definitions files in the + Library will not necessarily be able to recompile the application + to use the modified definitions.) + + b) Accompany the work with a written offer, valid for at + least three years, to give the same user the materials + specified in Subsection 6a, above, for a charge no more + than the cost of performing this distribution. + + c) If distribution of the work is made by offering access to copy + from a designated place, offer equivalent access to copy the above + specified materials from the same place. + + d) Verify that the user has already received a copy of these + materials or that you have already sent this user a copy. + + For an executable, the required form of the "work that uses the +Library" must include any data and utility programs needed for +reproducing the executable from it. However, as a special exception, +the source code distributed need not include anything that is normally +distributed (in either source or binary form) with the major +components (compiler, kernel, and so on) of the operating system on +which the executable runs, unless that component itself accompanies +the executable. + + It may happen that this requirement contradicts the license +restrictions of other proprietary libraries that do not normally +accompany the operating system. Such a contradiction means you cannot +use both them and the Library together in an executable that you +distribute. + + + 7. You may place library facilities that are a work based on the +Library side-by-side in a single library together with other library +facilities not covered by this License, and distribute such a combined +library, provided that the separate distribution of the work based on +the Library and of the other library facilities is otherwise +permitted, and provided that you do these two things: + + a) Accompany the combined library with a copy of the same work + based on the Library, uncombined with any other library + facilities. This must be distributed under the terms of the + Sections above. + + b) Give prominent notice with the combined library of the fact + that part of it is a work based on the Library, and explaining + where to find the accompanying uncombined form of the same work. + + 8. You may not copy, modify, sublicense, link with, or distribute +the Library except as expressly provided under this License. Any +attempt otherwise to copy, modify, sublicense, link with, or +distribute the Library is void, and will automatically terminate your +rights under this License. However, parties who have received copies, +or rights, from you under this License will not have their licenses +terminated so long as such parties remain in full compliance. + + 9. You are not required to accept this License, since you have not +signed it. However, nothing else grants you permission to modify or +distribute the Library or its derivative works. These actions are +prohibited by law if you do not accept this License. Therefore, by +modifying or distributing the Library (or any work based on the +Library), you indicate your acceptance of this License to do so, and +all its terms and conditions for copying, distributing or modifying +the Library or works based on it. + + 10. Each time you redistribute the Library (or any work based on the +Library), the recipient automatically receives a license from the +original licensor to copy, distribute, link with or modify the Library +subject to these terms and conditions. You may not impose any further +restrictions on the recipients' exercise of the rights granted herein. +You are not responsible for enforcing compliance by third parties to +this License. + + + 11. If, as a consequence of a court judgment or allegation of patent +infringement or for any other reason (not limited to patent issues), +conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot +distribute so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you +may not distribute the Library at all. For example, if a patent +license would not permit royalty-free redistribution of the Library by +all those who receive copies directly or indirectly through you, then +the only way you could satisfy both it and this License would be to +refrain entirely from distribution of the Library. + +If any portion of this section is held invalid or unenforceable under any +particular circumstance, the balance of the section is intended to apply, +and the section as a whole is intended to apply in other circumstances. + +It is not the purpose of this section to induce you to infringe any +patents or other property right claims or to contest validity of any +such claims; this section has the sole purpose of protecting the +integrity of the free software distribution system which is +implemented by public license practices. Many people have made +generous contributions to the wide range of software distributed +through that system in reliance on consistent application of that +system; it is up to the author/donor to decide if he or she is willing +to distribute software through any other system and a licensee cannot +impose that choice. + +This section is intended to make thoroughly clear what is believed to +be a consequence of the rest of this License. + + 12. If the distribution and/or use of the Library is restricted in +certain countries either by patents or by copyrighted interfaces, the +original copyright holder who places the Library under this License may add +an explicit geographical distribution limitation excluding those countries, +so that distribution is permitted only in or among countries not thus +excluded. In such case, this License incorporates the limitation as if +written in the body of this License. + + 13. The Free Software Foundation may publish revised and/or new +versions of the Library General Public License from time to time. +Such new versions will be similar in spirit to the present version, +but may differ in detail to address new problems or concerns. + +Each version is given a distinguishing version number. If the Library +specifies a version number of this License which applies to it and +"any later version", you have the option of following the terms and +conditions either of that version or of any later version published by +the Free Software Foundation. If the Library does not specify a +license version number, you may choose any version ever published by +the Free Software Foundation. + + + 14. If you wish to incorporate parts of the Library into other free +programs whose distribution conditions are incompatible with these, +write to the author to ask for permission. For software which is +copyrighted by the Free Software Foundation, write to the Free +Software Foundation; we sometimes make exceptions for this. Our +decision will be guided by the two goals of preserving the free status +of all derivatives of our free software and of promoting the sharing +and reuse of software generally. + + NO WARRANTY + + 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO +WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. +EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR +OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY +KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE +LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME +THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN +WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY +AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU +FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR +CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE +LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING +RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A +FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF +SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH +DAMAGES. + + END OF TERMS AND CONDITIONS + + + How to Apply These Terms to Your New Libraries + + If you develop a new library, and you want it to be of the greatest +possible use to the public, we recommend making it free software that +everyone can redistribute and change. You can do so by permitting +redistribution under these terms (or, alternatively, under the terms of the +ordinary General Public License). + + To apply these terms, attach the following notices to the library. It is +safest to attach them to the start of each source file to most effectively +convey the exclusion of warranty; and each file should have at least the +"copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This library is free software; you can redistribute it and/or + modify it under the terms of the GNU Library General Public + License as published by the Free Software Foundation; either + version 2 of the License, or (at your option) any later version. + + This library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Library General Public License for more details. + + You should have received a copy of the GNU Library General Public + License along with this library; if not, write to the Free Software + Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + +Also add information on how to contact you by electronic and paper mail. + +You should also get your employer (if you work as a programmer) or your +school, if any, to sign a "copyright disclaimer" for the library, if +necessary. Here is a sample; alter the names: + + Yoyodyne, Inc., hereby disclaims all copyright interest in the + library `Frob' (a library for tweaking knobs) written by James Random Hacker. + + , 1 April 1990 + Ty Coon, President of Vice + +That's all there is to it! diff --git a/third_party/licenses/LIBOGG-COPYING.txt b/third_party/licenses/LIBOGG-COPYING.txt new file mode 100644 index 0000000..6111c6c --- /dev/null +++ b/third_party/licenses/LIBOGG-COPYING.txt @@ -0,0 +1,28 @@ +Copyright (c) 2002, Xiph.org Foundation + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: + +- Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + +- Redistributions in binary form must reproduce the above copyright +notice, this list of conditions and the following disclaimer in the +documentation and/or other materials provided with the distribution. + +- Neither the name of the Xiph.org Foundation nor the names of its +contributors may be used to endorse or promote products derived from +this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION +OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/third_party/licenses/LIBVORBIS-COPYING.txt b/third_party/licenses/LIBVORBIS-COPYING.txt new file mode 100644 index 0000000..fb456a8 --- /dev/null +++ b/third_party/licenses/LIBVORBIS-COPYING.txt @@ -0,0 +1,28 @@ +Copyright (c) 2002-2020 Xiph.org Foundation + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: + +- Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + +- Redistributions in binary form must reproduce the above copyright +notice, this list of conditions and the following disclaimer in the +documentation and/or other materials provided with the distribution. + +- Neither the name of the Xiph.org Foundation nor the names of its +contributors may be used to endorse or promote products derived from +this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION +OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/tools/build_ffmpeg_macos.sh b/tools/build_ffmpeg_macos.sh index 373534c..b89e0d8 100644 --- a/tools/build_ffmpeg_macos.sh +++ b/tools/build_ffmpeg_macos.sh @@ -2,9 +2,14 @@ set -euo pipefail output_dir="${1:?usage: build_ffmpeg_macos.sh }" +repo_root="$(cd "$(dirname "$0")/.." && pwd)" source_commit="9b6c8969e0" source_sha256="7e779215eae16ad7e93ddad59bd82822bd3d34e4dc61f9996f9481b2c0605bc3" source_url="https://github.com/FFmpeg/FFmpeg/archive/${source_commit}.tar.gz" +lame_license_source_url="https://downloads.sourceforge.net/project/lame/lame/4.0/lame-4.0.tar.gz" +lame_license_source_sha256="3df5124d5ad3a98312ffd7ba6a9b36230e4f8a3e66d3ce0f425e336c32d216eb" +ogg_license_source_sha256="83e6704730683d004d20e21b8f7f55dcb3383cdf84c0daedf30bde175f774638" +vorbis_license_source_sha256="b33cc4934322bcbf6efcbacf49e3ca01aadbea4114ec9589d1b1e9d20f72954b" work_dir="$(mktemp -d "${TMPDIR:-/tmp}/musicdrop-ffmpeg.XXXXXX")" trap 'rm -rf "$work_dir"' EXIT @@ -109,15 +114,15 @@ Source archive: ${source_url} Source archive SHA-256: ${source_sha256} Build script: https://github.com/TonyNa-code/MusicDrop/blob/${musicdrop_revision}/tools/build_ffmpeg_macos.sh Dependency formulas: $(brew list --versions lame mpg123 libogg libvorbis | tr '\n' ';') +LAME license source: ${lame_license_source_url} +LAME license source SHA-256: ${lame_license_source_sha256} +libogg 1.3.6 source SHA-256: ${ogg_license_source_sha256} +libvorbis 1.3.7 source SHA-256: ${vorbis_license_source_sha256} Configuration and runtime dependencies are recorded beside this file. SOURCE_PROVENANCE mkdir -p "$output_dir/licenses" cp COPYING.LGPLv2.1 COPYING.LGPLv3 "$output_dir/licenses/" -cp "$lame_prefix/share/doc/lame/COPYING" "$output_dir/licenses/LAME-COPYING.txt" -mpg123_license="$(find "$mpg123_prefix" -type f \( -name COPYING -o -name LICENSE \) -print -quit)" -test -n "$mpg123_license" -cp "$mpg123_license" "$output_dir/licenses/MPG123-COPYING.txt" -cp "$ogg_prefix/share/doc/libogg/COPYING" "$output_dir/licenses/LIBOGG-COPYING.txt" -cp "$vorbis_prefix/share/doc/libvorbis/COPYING" "$output_dir/licenses/LIBVORBIS-COPYING.txt" +cp "$repo_root/third_party/licenses/"*.txt "$output_dir/licenses/" +cp COPYING.LGPLv2.1 "$output_dir/licenses/MPG123-COPYING.LGPLv2.1.txt" shasum -a 256 "$output_dir/bin/ffmpeg" "$output_dir/bin/ffprobe" > "$output_dir/SHA256SUMS.txt"