feat(prebuilt): ffmpeg and OCR stacks for dk.nikse.subtitleedit

README.md

@@ -33,6 +33,16 @@ rebuilding from the manifest at the tag, not by shipping them to every user.
 | `openssl-1.1-compat` | OpenSSL 1.1.1w shared libraries only (`libssl.so.1.1`, `libcrypto.so.1.1`) — no headers, runtime shim | `org.freedesktop.Sdk//25.08` | Legacy payloads whose bundled runtime predates OpenSSL 3 support (e.g. self-contained .NET 5) — **1.1.1 is EOL, see the manifest header** |
 | `wemeet-screenshare-hook` | libportal 0.9.1 + xuwd1/wemeet-wayland-screenshare `libhook.so` (built against `opencv-imgproc`; OpenCV not shipped but **dlopen'd at runtime**, so the app must also ship `opencv-imgproc`) | `org.freedesktop.Sdk//25.08` | `com.tencent.wemeet` (XWayland screen-share hook) |
 | `krb5-gss` | MIT krb5 1.22.1, the load-time closure of `libgssapi_krb5.so.2` and nothing else (`libkrb5`, `libk5crypto`, `libcom_err`, `libkrb5support`) — no KDC/kadmin libraries, no plugin tree, no headers | `org.freedesktop.Sdk//25.08` | Payloads bundling a Qt built with the GSSAPI feature, whose `libQt6Network` then hard-links `libgssapi_krb5.so.2` — `com.interactivebrokers.ibkrdesktop`. **Consumed as extra-data**, see below |
+| `x264` | x264 (commit `0480cb05`), `libx264.so.165`, dev-complete; no CLI | `org.gnome.Sdk//50` | Apps encoding H.264; `ffmpeg-full` builds against it |
+| `x265` | x265 4.2, `libx265.so.216`, 8-bit only, dev-complete; no CLI | `org.gnome.Sdk//50` | Apps encoding H.265; `ffmpeg-full` builds against it |
+| `lame` | LAME 3.100, `libmp3lame.so.0`, dev-complete; no front ends | `org.gnome.Sdk//50` | Apps encoding MP3; `ffmpeg-full` builds against it |
+| `rubberband` | Rubber Band v4.0.0, `librubberband.so.3` + its CLIs; built-in FFT and resampler pinned, so it links nothing beyond libstdc++/libm/libgcc/libc | `org.gnome.Sdk//50` | Time-stretch / pitch-shift; `ffmpeg-full` builds against it for the `rubberband` filter |
+| `libass` | libass 0.17.4, `libass.so.9`, dev-complete, fontconfig enabled | `org.gnome.Sdk//50` | ASS/SSA rendering — `ffmpeg-full` (the `ass` and `subtitles` filters) and, in future, mpv. Released separately so an app shipping both does not end up with two `libass.so.9` deciding by module order |
+| `ffmpeg-full` | FFmpeg n9.0, `ffmpeg` + `ffprobe` + `libav*`; libx264, libx265, libvpx-vp9, prores_ks, VAAPI and NVENC, aac/ac3/libmp3lame/libopus/libvorbis, `ass`/`subtitles`/`drawtext`. **No QSV or AMF** — see the manifest header | `org.gnome.Sdk//50` | Apps that drive ffmpeg as a tool because the runtime's own has no libass — `dk.nikse.subtitleedit`. Ships none of the codec libraries it links; the app pins those releases too |
+| `leptonica` | Leptonica 1.85.0, `libleptonica.so.6`, dev-complete; no demo programs | `org.gnome.Sdk//50` | Image processing; `tesseract` builds against it and the consuming app ships both |
+| `tesseract` | Tesseract 5.5.1, `libtesseract.so.5` + the `tesseract` CLI + `share/tessdata` presets. No leptonica, no language data, no training tools | `org.gnome.Sdk//50` | OCR — `dk.nikse.subtitleedit`. Stage `.traineddata` into its `share/tessdata` and point `TESSDATA_PREFIX` there |
+| `uchardet` | uchardet 0.0.8, `libuchardet.so.0`, dev-complete; no CLI | `org.gnome.Sdk//50` | Guessing the encoding of text files an app did not write, e.g. subtitle files |
+| `sevenzip` | 7-Zip 25.01 `7zr`, one dependency-free binary; .7z only | `org.gnome.Sdk//50` | Apps unpacking .7z downloads at run time |
 
 ## Archive module or extra-data
 
@@ -43,7 +53,9 @@ A stack can be consumed either way, and the choice decides where the bytes live:
   it becomes part of the app's OSTree commit and is stored in FlatPark's own
   repository. Content-addressed storage means a stack shared by many apps is
   held once; `ayatana-stack` is one object set for thirteen apps.
-- **`type: extra-data`** (`krb5-gss`, `openssl-1.1-compat`, `opencv-imgproc`) —
+- **`type: extra-data`** (`krb5-gss`, `openssl-1.1-compat`, `opencv-imgproc`, and the
+  ffmpeg and OCR stacks: `x264`, `x265`, `lame`, `rubberband`, `libass`,
+  `ffmpeg-full`, `leptonica`, `tesseract`, `uchardet`, `sevenzip`) —
   the archive is downloaded from this repository's release at install time and
   unpacked by the app's `apply_extra`
   into `/app/extra/<stack>/`. FlatPark's repository holds nothing, and the

ffmpeg-full.yml

@@ -0,0 +1,196 @@
+# FFmpeg, prebuilt for FlatPark apps.
+#
+# A full-featured ffmpeg/ffprobe pair. The runtimes do ship an ffmpeg, but it is
+# built for the runtime's own needs: no libass, so the `ass` and `subtitles`
+# filters do not exist and any attempt to burn subtitles into a video dies at
+# filter-graph parse time rather than at run time; and no hardware encoders
+# beyond the basics. Apps that drive ffmpeg as a tool need their own.
+#
+# The encoder set covers what a media application's export dialog typically
+# offers end to end: libx264, libx265, libvpx-vp9 and prores_ks in software,
+# VAAPI and NVENC for hardware, and aac, ac3, libmp3lame, libopus and libvorbis
+# for audio. First consumer: dk.nikse.subtitleedit (flatpark/flatpark#238).
+#
+# QSV and AMF are deliberately NOT enabled, and this is structural rather than a
+# preference. Both are two-layer: ffmpeg links a dispatcher (libvpl for QSV) or
+# dlopens a vendor library (libamfrt64.so.1 for AMF), and the layer that actually
+# encodes ships with the vendor's userspace — `libmfx-gen.so` from
+# intel-media-driver, or AMD's proprietary driver. Flatpak has no extension for
+# either, so neither can ever be present in a sandbox. Measured on an Intel
+# Arc 140V, the hardware QSV exists for, with --device=dri:
+#
+#   h264_vaapi  encode succeeded (exit 0)
+#   h264_qsv    Error creating a MFX session: -9   (dispatcher found no runtime)
+#   h264_amf    DLL libamfrt64.so.1 failed to open
+#
+# The GPU and the render node were never the problem — VAAPI used the same
+# /dev/dri/renderD128, because org.freedesktop.Platform.VAAPI.Intel and the
+# GL.* extensions do put a driver in the sandbox. NVENC is kept for the same
+# reason: org.freedesktop.Platform.GL.nvidia-* ships NVIDIA's userspace, so on an
+# NVIDIA host the library is there (not verified here — no NVIDIA GPU).
+#
+# Enabling them anyway is worse than leaving them out. Subtitle Edit 5.2 probes
+# `ffmpeg -encoders` and hides what is missing (SubtitleEdit/subtitleedit#13915),
+# but that probe sees "the encoder is compiled in" and cannot see "the vendor
+# runtime is absent" — so the entries would come back to the user's dropdown and
+# fail at encode time, which is the bug that probe was added to fix.
+#
+# Codec libraries the runtime lacks come from their OWN releases here — x264,
+# x265, lame, rubberband and libass — pinned below and used for the build.
+# They are then cleaned OUT of this archive: each is a separate release that the
+# consuming app pins and unpacks alongside this one, putting every lib/ on
+# LD_LIBRARY_PATH. That keeps one copy of libass in an app even when it also
+# ships mpv, and lets x265 move to a new version without re-cutting ffmpeg for
+# apps that only wanted the encoder.
+#
+# Everything else ffmpeg links here — gnutls, dav1d, freetype, opus, theora,
+# v4l2, vorbis, vpx, webp, xml2, vulkan — is present in both org.gnome.Sdk//50
+# and org.gnome.Platform//50, so it resolves against the runtime and travels
+# with nothing.
+id: org.flatpark.Prebuilt.FfmpegFull
+runtime: org.gnome.Platform
+runtime-version: "50"
+sdk: org.gnome.Sdk
+command: /usr/bin/true
+build-options:
+  # no-debuginfo suppresses the .Debug extension but does NOT strip: on its own
+  # it leaves full DWARF inside every library in the archive. Strip explicitly.
+  # A consumer that needs symbols rebuilds from this manifest at its release tag.
+  no-debuginfo: true
+  strip: true
+cleanup:
+  - "*.a"
+  - "*.la"
+  - /include
+  - /lib/pkgconfig
+  - /lib/cmake
+  - /share/ffmpeg/examples
+  # Build-time input from the stacks below: shipped by the consuming app from
+  # their own releases, not from here.
+  - /lib/libx264.so*
+  - /lib/libx265.so*
+  - /lib/libmp3lame.so*
+  - /lib/librubberband.so*
+  - /lib/libass.so*
+  - /bin/rubberband
+  - /bin/rubberband-r3
+  - /etc
+
+modules:
+  # Codec libraries for the build, each from its own reusable release. All
+  # cleaned out of the final archive above; the consuming app ships them.
+  - name: x264
+    buildsystem: simple
+    build-commands:
+      # Skip the archive's own manifest.json: copying it would leave a stale
+      # record of an unrelated stack in this release, renamed to the misleading
+      # manifest-base-N.json (flatpak-builder writes its own after cleanup runs,
+      # so it cannot be cleaned away).
+      - 'find . -mindepth 1 -maxdepth 1 ! -name manifest.json -exec cp -a {} /app/ \;'
+    sources:
+      - type: archive
+        url: https://github.com/flatpark/prebuilt/releases/download/x264-v1/x264-x264-v1-gnome-50-x86_64.tar.xz
+        sha256: f6d5ecf8620a60164d191aeb83ae9ba371e17fb0b3f217cce3d371f260c5f63f
+
+  - name: x265
+    buildsystem: simple
+    build-commands:
+      # Skip the archive's own manifest.json: copying it would leave a stale
+      # record of an unrelated stack in this release, renamed to the misleading
+      # manifest-base-N.json (flatpak-builder writes its own after cleanup runs,
+      # so it cannot be cleaned away).
+      - 'find . -mindepth 1 -maxdepth 1 ! -name manifest.json -exec cp -a {} /app/ \;'
+    sources:
+      - type: archive
+        url: https://github.com/flatpark/prebuilt/releases/download/x265-v1/x265-x265-v1-gnome-50-x86_64.tar.xz
+        sha256: 0e11378f93862669a832cfb58ae016d039aa65d2acbb8c64fc2a5a9db41a337e
+
+  - name: lame
+    buildsystem: simple
+    build-commands:
+      # Skip the archive's own manifest.json: copying it would leave a stale
+      # record of an unrelated stack in this release, renamed to the misleading
+      # manifest-base-N.json (flatpak-builder writes its own after cleanup runs,
+      # so it cannot be cleaned away).
+      - 'find . -mindepth 1 -maxdepth 1 ! -name manifest.json -exec cp -a {} /app/ \;'
+    sources:
+      - type: archive
+        url: https://github.com/flatpark/prebuilt/releases/download/lame-v1/lame-lame-v1-gnome-50-x86_64.tar.xz
+        sha256: cf65e7f57f5532f692ed7107af0cafb36afb2277f31c7cb749da206f56f0b396
+
+  - name: rubberband
+    buildsystem: simple
+    build-commands:
+      # Skip the archive's own manifest.json: copying it would leave a stale
+      # record of an unrelated stack in this release, renamed to the misleading
+      # manifest-base-N.json (flatpak-builder writes its own after cleanup runs,
+      # so it cannot be cleaned away).
+      - 'find . -mindepth 1 -maxdepth 1 ! -name manifest.json -exec cp -a {} /app/ \;'
+    sources:
+      - type: archive
+        url: https://github.com/flatpark/prebuilt/releases/download/rubberband-v1/rubberband-rubberband-v1-gnome-50-x86_64.tar.xz
+        sha256: 8f88a7640b9eba33cba667d14f72b1261934e28fa6ba9dfbaa1396eac0c63f5f
+
+  - name: libass
+    buildsystem: simple
+    build-commands:
+      # Skip the archive's own manifest.json: copying it would leave a stale
+      # record of an unrelated stack in this release, renamed to the misleading
+      # manifest-base-N.json (flatpak-builder writes its own after cleanup runs,
+      # so it cannot be cleaned away).
+      - 'find . -mindepth 1 -maxdepth 1 ! -name manifest.json -exec cp -a {} /app/ \;'
+    sources:
+      - type: archive
+        url: https://github.com/flatpark/prebuilt/releases/download/libass-v1/libass-libass-v1-gnome-50-x86_64.tar.xz
+        sha256: 2b246bd7d9f658b0678e366c8196d40daf1088433daeab9a01b06c15884b375d
+
+  - name: ffmpeg
+    buildsystem: autotools
+    config-opts:
+      - --disable-debug
+      - --disable-doc
+      - --disable-static
+      - --enable-shared
+      # ffplay is an SDL2 debug player no consumer drives, and shipping it puts
+      # an `ffplay` command on the consuming app's PATH — a behaviour surface
+      # this stack has no reason to add.
+      - --disable-ffplay
+      - --enable-gnutls
+      # GPL + version3 are required by x264, x265 and rubberband.
+      - --enable-gpl
+      - --enable-version3
+      - --enable-libass
+      - --enable-libdav1d
+      - --enable-libfreetype
+      # freetype alone is not enough for the drawtext filter in FFmpeg 7+; it
+      # also needs harfbuzz, and without it drawtext is silently absent.
+      # harfbuzz 11.4.5 is in org.gnome.Sdk//50 and libharfbuzz.so.0 in the
+      # Platform, so this costs nothing and travels with nothing.
+      - --enable-libharfbuzz
+      # ...and fontconfig on top of those two, or drawtext only accepts
+      # fontfile=/abs/path and refuses font=Sans. libass already resolves fonts
+      # this way, and fontconfig is in both the SDK and the Platform.
+      - --enable-libfontconfig
+      - --enable-libmp3lame
+      - --enable-libopus
+      - --enable-librubberband
+      - --enable-libtheora
+      - --enable-libv4l2
+      - --enable-libvorbis
+      - --enable-libvpx
+      - --enable-libwebp
+      - --enable-libx264
+      - --enable-libx265
+      - --enable-libxml2
+      - --enable-vulkan
+      - --enable-encoder=png
+      # Hardware encoders, limited to the two whose userspace Flatpak actually
+      # distributes (see the header). Both dlopen at run time, so a machine
+      # without the matching device simply does not expose them.
+      - --enable-vaapi
+      - --enable-nvenc
+    sources:
+      - type: git
+        url: https://github.com/FFmpeg/FFmpeg.git
+        tag: n9.0
+        commit: 5b9252abfe2fda0ccb71ed45cd7a954cc45d2b6f

lame.yml

@@ -0,0 +1,38 @@
+# LAME, prebuilt for FlatPark apps.
+#
+# libmp3lame is the MP3 encoder ffmpeg links for `-c:a libmp3lame`. Neither
+# runtime ships it, and the runtime's own ffmpeg is built without it, so an app
+# offering MP3 output has to bring its own.
+#
+# Dev-complete (library + headers + pkg-config) so a consumer can build against
+# it; ffmpeg-full.yml does. The `lame`/`mp3rtp` command-line front ends are not
+# built: consumers link the library.
+id: org.flatpark.Prebuilt.Lame
+runtime: org.gnome.Platform
+runtime-version: "50"
+sdk: org.gnome.Sdk
+command: /usr/bin/true
+build-options:
+  # no-debuginfo suppresses the .Debug extension but does NOT strip: on its own
+  # it leaves full DWARF inside every library in the archive. Strip explicitly.
+  # A consumer that needs symbols rebuilds from this manifest at its release tag.
+  no-debuginfo: true
+  strip: true
+cleanup:
+  - "*.a"
+  # .la files record absolute build paths and mislead a downstream libtool link.
+  - "*.la"
+  - /share/doc
+  - /share/man
+
+modules:
+  - name: lame
+    buildsystem: autotools
+    config-opts:
+      - --libdir=/app/lib
+      - --disable-static
+      - --disable-frontend
+    sources:
+      - type: archive
+        url: https://downloads.sourceforge.net/project/lame/lame/3.100/lame-3.100.tar.gz
+        sha256: ddfe36cab873794038ae2c1210557ad34857a4b6bdc515785d1da9e175b1da1e

leptonica.yml

@@ -0,0 +1,38 @@
+# Leptonica, prebuilt for FlatPark apps.
+#
+# Image-processing library. On its own it is a general-purpose toolkit, but the
+# reason it is here is that Tesseract is built on it and links it directly: an
+# app doing OCR needs both, and tesseract.yml consumes this release rather than
+# rebuilding it.
+#
+# Dev-complete (library + headers + pkg-config) so a consumer can build against
+# it. The command-line programs are not built — they are a large set of demos and
+# converters that nothing downstream calls. Its image codecs (zlib, libpng,
+# libjpeg, libtiff, libwebp, giflib) come from the runtime.
+id: org.flatpark.Prebuilt.Leptonica
+runtime: org.gnome.Platform
+runtime-version: "50"
+sdk: org.gnome.Sdk
+command: /usr/bin/true
+build-options:
+  # no-debuginfo suppresses the .Debug extension but does NOT strip: on its own
+  # it leaves full DWARF inside every library in the archive. Strip explicitly.
+  # A consumer that needs symbols rebuilds from this manifest at its release tag.
+  no-debuginfo: true
+  strip: true
+cleanup:
+  - "*.a"
+
+modules:
+  - name: leptonica
+    buildsystem: cmake-ninja
+    builddir: true
+    config-opts:
+      - -DCMAKE_BUILD_TYPE=Release
+      - -DCMAKE_INSTALL_LIBDIR=lib
+      - -DBUILD_SHARED_LIBS=ON
+      - -DBUILD_PROG=OFF
+    sources:
+      - type: archive
+        url: https://github.com/DanBloomberg/leptonica/releases/download/1.85.0/leptonica-1.85.0.tar.gz
+        sha256: 3745ae3bf271a6801a2292eead83ac926e3a9bc1bf622e9cd4dd0f3786e17205

libass.yml

@@ -0,0 +1,49 @@
+# libass, prebuilt for FlatPark apps.
+#
+# ASS/SSA subtitle renderer. Two quite different consumers need it:
+#
+#   * ffmpeg, for the `ass` and `subtitles` filters — burning subtitles into a
+#     video. An ffmpeg built without libass fails at filter-graph parse time,
+#     not at run time, so the feature is simply absent.
+#   * mpv, which renders subtitles through it during playback.
+#
+# It exists as its own release precisely because of that overlap. mpv-stack
+# currently builds its own copy, which means an app that ships both mpv-stack and
+# an ffmpeg built against a different libass ends up with two libass.so.9 files
+# fighting over the same soname in /app/lib, resolved by module ordering. Pinning
+# one release here is the fix at the root: consume this from both and there is
+# one libass in the tree, at one version, by construction.
+#
+# Dev-complete (library + headers + pkg-config) so consumers can build against it.
+id: org.flatpark.Prebuilt.Libass
+runtime: org.gnome.Platform
+runtime-version: "50"
+sdk: org.gnome.Sdk
+command: /usr/bin/true
+build-options:
+  # no-debuginfo suppresses the .Debug extension but does NOT strip: on its own
+  # it leaves full DWARF inside every library in the archive. Strip explicitly.
+  # A consumer that needs symbols rebuilds from this manifest at its release tag.
+  no-debuginfo: true
+  strip: true
+cleanup:
+  - "*.a"
+  # .la files record absolute build paths and mislead a downstream libtool link.
+  - "*.la"
+
+modules:
+  - name: libass
+    buildsystem: autotools
+    config-opts:
+      - --libdir=/app/lib
+      - --disable-static
+      # ASM rasteriser paths; nasm comes from the SDK.
+      - --enable-asm
+      # Font lookup through the runtime's fontconfig, so a subtitle naming a
+      # font by family resolves against the host's fonts rather than failing.
+      - --enable-fontconfig
+    sources:
+      - type: git
+        url: https://github.com/libass/libass.git
+        tag: "0.17.4"
+        commit: bbb3c7f1570a4a021e52683f3fbdf74fe492ae84