Pin and verify the FFmpeg shared-library archive

[Blackspirits]

Purpose

Independent supply-chain hardening for the FFmpeg shared-library downloader, kept on the common audited base 3e4d052adc78464e71bbd5154880d935fd592960.

Current upstream SubtitleEdit/subtitleedit main was rechecked at d6917286e355976da953d0ee22208b4bf9461699; the latest upstream delta only changes the mpv preview subtitle margin setting and does not touch the FFmpeg downloader/player. The same rolling, unverified download remains present upstream. No open upstream PR was found for this pin/hash hardening.

Finding fixed

Executable FFmpeg DLLs were downloaded from a mutable latest release without integrity verification

The Windows x64 FFmpeg-player setup previously downloaded:

https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-n9.0-latest-win64-lgpl-shared-9.0.zip

and, once the transfer completed, the ViewModel extracted every /bin/*.dll into Subtitle Edit's FFmpeg library folder with overwrite enabled.

That archive contains native code loaded in-process by the FFmpeg player, but the download contract had neither a fixed release/tag, an exact asset identity, nor a SHA-256 check before extraction.

Reviewed upstream artifact

• repository: BtbN/FFmpeg-Builds
• tag: autobuild-2026-09-15-13-18
• asset: ffmpeg-n9.0.1-30-g9258bacca5-win64-lgpl-shared-9.0.zip
• asset id: 565742626
• size: 76,400,262 bytes
• GitHub asset digest: sha256:04d256aa477122949304a717bf61d8eec78e255c2c7c9be17fab1677227cb548
• release is immutable: false, so the digest remains mandatory even with a dated tag.

Fix

FfmpegLibsDownloadService now pins the dated autobuild tag, exact asset name and reviewed SHA-256; downloads that exact URL instead of /latest/; computes SHA-256 with the existing Sha256Util; succeeds only when the archive matches; and deletes a mismatching archive before throwing. The caller can therefore never extract unverified bytes.

Regression coverage

Focused tests pin the non-latest URL, reviewed tag/asset, 64-character lower-case digest, matching-digest success and mismatch fail-closed deletion.

Scope / branch state

• common audit base: 3e4d052adc78464e71bbd5154880d935fd592960
• current upstream main checked: d6917286e355976da953d0ee22208b4bf9461699
• HEAD: 88f1405ec15e2b73d9192c0307cb2efc3da65d3e
• 3 technical commits caused by connector single-file writes
• 2 files
• +94 / -2
• audit draft only; no merge/promotion intended

AI assistance: ChatGPT was used for current-upstream verification, BtbN release/asset provenance review, mutable-release threat modelling, reuse of Subtitle Edit's existing SHA-256 policy, and focused regression design.

Final CI

Authoritative latest run: SubtitleEdit#269 on 88f1405ec15e2b73d9192c0307cb2efc3da65d3e

• SeConv: 488 passed / 2 skipped / 0 failed
• LibUiLogic: 905 passed / 0 skipped / 0 failed
• LibSE: 2017 passed / 0 skipped / 0 failed
• UI: 5233 passed / 9 skipped / 0 failed
• build: 0 errors / 7 pre-existing warnings
• retry step skipped
• failure-artifact upload skipped

CI SubtitleEdit#267 had already passed on the same HEAD before the branch ref was restored after an accidental transient audit-only placeholder commit. The branch was reset exactly to this reviewed HEAD, and SubtitleEdit#269 independently revalidated the restored state. Final adversarial review remains anchored to this exact HEAD; no blocker found.

[Blackspirits]

Final adversarial review on exact HEAD 88f1405ec15e2b73d9192c0307cb2efc3da65d3e after authoritative CI SubtitleEdit#267. Verified that the pinned BtbN URL no longer uses the mutable latest alias, the reviewed tag/asset/digest are fixed together, SHA-256 verification occurs inside DownloadFfmpegLibs() immediately after transfer and before the caller can extract the archive, and mismatch remains fail-closed even if best-effort deletion itself fails. Focused regression coverage pins both matching and mismatching digests. No correctness or supply-chain blocker found. PR remains draft; no merge/promotion performed.