mirror of
https://github.com/webadderallorg/Recordly.git
synced 2026-11-09 07:23:14 +00:00
101 lines
3.4 KiB
JavaScript
101 lines
3.4 KiB
JavaScript
import { createHash } from "node:crypto";
|
|
import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import { afterEach, describe, expect, it } from "vitest";
|
|
import {
|
|
APPROVED_FFMPEG_BINARIES,
|
|
assertRedistributableFfmpegOutput,
|
|
verifyFfmpegDistribution,
|
|
} from "../scripts/ffmpeg-distribution.mjs";
|
|
|
|
const fixtures = [];
|
|
function fixture(overrides = {}) {
|
|
const directory = mkdtempSync(path.join(os.tmpdir(), "recordly-ffmpeg-provenance-"));
|
|
fixtures.push(directory);
|
|
const binary = path.join(directory, "ffmpeg");
|
|
const bytes = Buffer.from("unapproved executable fixture");
|
|
writeFileSync(binary, bytes);
|
|
writeFileSync(
|
|
`${binary}.distribution.json`,
|
|
JSON.stringify({
|
|
schemaVersion: 1,
|
|
platform: "win32",
|
|
arch: "x64",
|
|
sha256: createHash("sha256").update(bytes).digest("hex"),
|
|
...overrides,
|
|
}),
|
|
);
|
|
return binary;
|
|
}
|
|
afterEach(() => {
|
|
for (const directory of fixtures.splice(0)) rmSync(directory, { recursive: true, force: true });
|
|
});
|
|
|
|
describe("FFmpeg redistribution checks", () => {
|
|
it("does not accept a content-hash override for an unapproved Linux executable", () => {
|
|
const binary = fixture({
|
|
platform: "linux",
|
|
sha256: APPROVED_FFMPEG_BINARIES["linux-x64"],
|
|
contentSha256: createHash("sha256")
|
|
.update("unapproved executable fixture")
|
|
.digest("hex"),
|
|
});
|
|
expect(() => verifyFfmpegDistribution(binary, { platform: "linux", arch: "x64" })).toThrow(
|
|
"does not match",
|
|
);
|
|
});
|
|
it("accepts GPL/LGPL builds with nonfree explicitly disabled", () => {
|
|
expect(() =>
|
|
assertRedistributableFfmpegOutput(
|
|
"--disable-nonfree\nGNU General Public License version 3",
|
|
),
|
|
).not.toThrow();
|
|
expect(() =>
|
|
assertRedistributableFfmpegOutput("GNU Lesser General Public License version 2.1"),
|
|
).not.toThrow();
|
|
});
|
|
it("rejects the real nonredistributable build declaration despite GPL text", () => {
|
|
expect(() =>
|
|
assertRedistributableFfmpegOutput(
|
|
"GNU General Public License\nThis version of ffmpeg has nonfree parts compiled in. Therefore it is not legally redistributable.",
|
|
),
|
|
).toThrow("nonfree");
|
|
expect(() =>
|
|
assertRedistributableFfmpegOutput(
|
|
"configuration: --enable-gpl --enable-nonfree\nGNU General Public License",
|
|
),
|
|
).toThrow("nonfree");
|
|
});
|
|
it("rejects missing or unrecognized license output", () => {
|
|
expect(() => assertRedistributableFfmpegOutput("ffmpeg version 8.1.2")).toThrow(
|
|
"recognized",
|
|
);
|
|
});
|
|
it("rejects a changed executable even with an existing provenance record", () => {
|
|
const binary = fixture();
|
|
writeFileSync(binary, "changed after verification");
|
|
expect(() => verifyFfmpegDistribution(binary, { platform: "win32", arch: "x64" })).toThrow(
|
|
"does not match",
|
|
);
|
|
});
|
|
it("rejects an artifact from another target architecture", () => {
|
|
expect(() =>
|
|
verifyFfmpegDistribution(fixture(), { platform: "win32", arch: "arm64" }),
|
|
).toThrow("does not match");
|
|
});
|
|
it("does not trust an arbitrary binary merely because its manifest has a matching checksum", () => {
|
|
expect(() =>
|
|
verifyFfmpegDistribution(fixture(), { platform: "win32", arch: "x64" }),
|
|
).toThrow("Unapproved");
|
|
});
|
|
it("rejects a manifest pretending to be a macOS source build", () => {
|
|
expect(() =>
|
|
verifyFfmpegDistribution(
|
|
fixture({ platform: "darwin", arch: "arm64", buildId: "made-up" }),
|
|
{ platform: "darwin", arch: "arm64" },
|
|
),
|
|
).toThrow("pinned redistributable sources");
|
|
});
|
|
});
|