chore(engines): standardize FFmpeg 9.0.1

scripts/check-updates.js

@@ -324,7 +324,14 @@ function sourceEngineVersions(sourceLock) {
   const rows = [];
   for (const [target, engines] of Object.entries(sourceLock.targets || {})) {
     for (const [engine, meta] of Object.entries(engines)) {
-      rows.push({ target, engine, version: meta.version, url: meta.url, sha256: meta.sha256 });
+      rows.push({
+        target,
+        engine,
+        version: meta.version,
+        url: meta.url,
+        sha256: meta.sha256,
+        sourceSha256: meta.sourceSha256,
+      });
     }
   }
   return rows;
@@ -334,7 +341,14 @@ function packagedEngineVersions(engineLock) {
   const rows = [];
   for (const [target, targetLock] of Object.entries(engineLock.targets || {})) {
     for (const [engine, meta] of Object.entries(targetLock.engines || {})) {
-      rows.push({ target, engine, version: meta.version, url: meta.url, sha256: meta.sha256 });
+      rows.push({
+        target,
+        engine,
+        version: meta.version,
+        url: meta.url,
+        sha256: meta.sha256,
+        sourceSha256: meta.sourceSha256,
+      });
     }
   }
   return rows;
@@ -373,7 +387,8 @@ function checkRows(
     const versionOutdated = compareVersions(current, wanted) < 0;
     const sourceOutdated = Boolean(latestUrl && row.url && row.url !== latestUrl);
     const latestHash = latestHashesByTargetEngine[targetKey] || latestHashesByUrl[row.url];
-    const currentHash = typeof row.sha256 === 'string' ? row.sha256.toLowerCase() : '';
+    const checkedHash = row.sourceSha256 || row.sha256;
+    const currentHash = typeof checkedHash === 'string' ? checkedHash.toLowerCase() : '';
     const hashOutdated = Boolean(latestHash && currentHash !== latestHash);
     const status = versionOutdated
       ? 'outdated'
@@ -385,7 +400,7 @@ function checkRows(
     if (status !== 'current') outdated += 1;
     console.log(`  ${row.target} ${row.engine}: ${current} -> ${wanted} ${status}`);
     if (sourceOutdated) console.log(`    source: ${row.url} -> ${latestUrl}`);
-    if (hashOutdated) console.log(`    sha256: ${row.sha256 || 'missing'} -> ${latestHash}`);
+    if (hashOutdated) console.log(`    source sha256: ${checkedHash || 'missing'} -> ${latestHash}`);
   }
   return outdated;
 }

scripts/check-updates.node-test.js

@@ -95,6 +95,26 @@ test('checkRows detects a provider hash change when version and URL are current'
   assert.equal(outdated, 1);
 });
 
+test('checkRows compares packaged source provenance without confusing the payload digest', () => {
+  const outdated = checkRows(
+    [{
+      target: 'aarch64-apple-darwin',
+      engine: 'ffmpeg',
+      version: '9.0.1',
+      url: 'https://example.test/ffmpeg.zip',
+      sourceSha256: 'a'.repeat(64),
+      sha256: 'b'.repeat(64),
+    }],
+    { ffmpeg: '9.0.1' },
+    { 'aarch64-apple-darwin:ffmpeg': '9.0.1' },
+    { 'aarch64-apple-darwin:ffmpeg': 'https://example.test/ffmpeg.zip' },
+    new Set(['ffmpeg']),
+    { 'aarch64-apple-darwin:ffmpeg': 'a'.repeat(64) },
+  );
+
+  assert.equal(outdated, 0);
+});
+
 test('checkRows detects an aria2 asset digest change when the provider supplies it', () => {
   const url = 'https://github.com/aria2/aria2/releases/download/release-1.37.0/aria2-1.37.0-win-64bit-build1.zip';
   const digest = 'b'.repeat(64);

scripts/engine-download.node-test.js

@@ -225,3 +225,32 @@ test('propagates external cancellation without retrying an in-flight archive', a
     fs.rmSync(directory, { recursive: true, force: true });
   }
 });
+
+test('rejects and removes an archive with a mismatched checksum', async () => {
+  const { directory, archive } = makeArchivePath();
+  const corrupt = Buffer.from('corrupt engine archive');
+
+  try {
+    await withMockFetch(
+      async () => new Response(corrupt, {
+        status: 200,
+        headers: { 'Content-Length': String(corrupt.length) },
+      }),
+      async () => {
+        await assert.rejects(
+          downloadEngineArchive({
+            name: 'ffmpeg',
+            url: 'https://example.test/ffmpeg.zip',
+            archive,
+            expectedSha256: digest(Buffer.from('trusted engine archive')),
+            attempts: 1,
+          }),
+          /Archive checksum mismatch for ffmpeg/,
+        );
+      },
+    );
+    assert.equal(fs.existsSync(archive), false);
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+});