T12 code-quality reviewer flagged 2 IMPORTANT + 2 NITs (non-blocking, green-lit T12). Filed for batched cleanup before any non-Linux release or v0.7.x.
1. [IMPORTANT] Pin ffmpeg tarball by sha256 (supply-chain hardening)
`scripts/fetch-ffmpeg-sidecar.sh:52-57` — johnvansickle's URL is a rolling "release" tag. A compromised mirror would silently land an attacker-controlled binary that runs during `cargo build` (tauri-build invokes the sidecar at compile-time validation).
Suggested fix: hardcode an expected sha256 next to the URL + `sha256sum -c <<< "$expected $tmp_dir/ffmpeg.tar.xz"` before extraction. Update the pin when bumping ffmpeg.
2. [IMPORTANT] Composite action for shared CI setup
`.github/workflows/ci.yml:92-119` (matrix) + `.github/workflows/ci.yml:140-155` (bindings-drift) + `.github/workflows/mutants.yml:58-78` (mutant baseline) all duplicate "Install Tauri Linux deps" + "Fetch ffmpeg sidecar". Already a minor drift surface: mutants.yml uses `libayatana-appindicator3-dev`, ci.yml uses `libappindicator3-dev`.
Suggested fix: extract `.github/actions/setup-perima-build/action.yml` consolidating apt + sidecar fetch. Each workflow uses `uses: ./.github/actions/setup-perima-build` instead of inlining.
3. [NIT] `install -m755` over `cp` + `chmod +x`
`scripts/fetch-ffmpeg-sidecar.sh` — single syscall + atomic mode set is cleaner.
4. [NIT] Add issue link to stub-branch TODO markers
`scripts/fetch-ffmpeg-sidecar.sh:65,77` — macOS/Windows stub branches print "WARNING" + TODO with candidate upstreams (evermeet.cx, BtbN GitHub) but no issue number. Add `# TODO(#NNN)` once macOS + Windows fetcher issues are filed.
Sub-issues to file separately (but link here)
- macOS ffmpeg sidecar fetcher (replace stub; verify Tauri bundle on Darwin includes binary at `Contents/MacOS/ffmpeg-x86_64-apple-darwin` or a universal binary).
- Windows ffmpeg sidecar fetcher (replace stub; verify `.exe` extension preserved + Wix/NSIS bundle includes it).
- aarch64-apple-darwin (Apple Silicon) sidecar — Tauri's per-target naming pattern means a separate `ffmpeg-aarch64-apple-darwin` is needed.
Filed under ASR v2 milestone for batched cleanup before any non-Linux release.
T12 code-quality reviewer flagged 2 IMPORTANT + 2 NITs (non-blocking, green-lit T12). Filed for batched cleanup before any non-Linux release or v0.7.x.
1. [IMPORTANT] Pin ffmpeg tarball by sha256 (supply-chain hardening)
`scripts/fetch-ffmpeg-sidecar.sh:52-57` — johnvansickle's URL is a rolling "release" tag. A compromised mirror would silently land an attacker-controlled binary that runs during `cargo build` (tauri-build invokes the sidecar at compile-time validation).
Suggested fix: hardcode an expected sha256 next to the URL + `sha256sum -c <<< "$expected $tmp_dir/ffmpeg.tar.xz"` before extraction. Update the pin when bumping ffmpeg.
2. [IMPORTANT] Composite action for shared CI setup
`.github/workflows/ci.yml:92-119` (matrix) + `.github/workflows/ci.yml:140-155` (bindings-drift) + `.github/workflows/mutants.yml:58-78` (mutant baseline) all duplicate "Install Tauri Linux deps" + "Fetch ffmpeg sidecar". Already a minor drift surface: mutants.yml uses `libayatana-appindicator3-dev`, ci.yml uses `libappindicator3-dev`.
Suggested fix: extract `.github/actions/setup-perima-build/action.yml` consolidating apt + sidecar fetch. Each workflow uses `uses: ./.github/actions/setup-perima-build` instead of inlining.
3. [NIT] `install -m755` over `cp` + `chmod +x`
`scripts/fetch-ffmpeg-sidecar.sh` — single syscall + atomic mode set is cleaner.
4. [NIT] Add issue link to stub-branch TODO markers
`scripts/fetch-ffmpeg-sidecar.sh:65,77` — macOS/Windows stub branches print "WARNING" + TODO with candidate upstreams (evermeet.cx, BtbN GitHub) but no issue number. Add `# TODO(#NNN)` once macOS + Windows fetcher issues are filed.
Sub-issues to file separately (but link here)
Filed under ASR v2 milestone for batched cleanup before any non-Linux release.