fix(ci): re-pin ffmpeg on a month-end BtbN build

[EtienneLescot]

Summary

scripts/fetch-ffmpeg.mjs was pinned to autobuild-2026-07-30-13-32 — a Thursday daily autobuild. BtbN keeps only ~15 days of dailies and prunes the rest, retaining month-end builds long term. The pin was due to 404 around 2026-08-14.

When it 404s, npm run fetch:ffmpeg* throws (downloadAndExtract has no retry and no fallback), so build:linux and build:win die before cargo — and publish-release has both in needs:. No release, any platform.

Evidence for the retention rule:

autobuild-2026-08-06 … autobuild-2026-07-23 ← 14 dailies
autobuild-2026-06-30, 2026-05-31, 2026-04-30, 2026-03-31, 2026-02-28, …

Nothing between 2026-07-23 and 2026-06-30 survives, and every older tag is a last-day-of-month build.

This is the second occurrence — 81e0597 re-pinned after autobuild-2026-07-15-14-01 was purged the same way. The header comment described the tag as "immutable", which is true and beside the point; it now states the retention rule and the gh api one-liner to check a candidate.

Re-pinned to autobuild-2026-07-31-14-10 (n8.1.2-34-g9b6c8969e0), the last day of July, still a release-branch 8.1.x build — not an N-… master snapshot.

Tag, asset names and digests move as one unit, so the diff covers all four places that name them:

File	What changed
scripts/fetch-ffmpeg.mjs	RELEASE_TAG, 4 PINNED + 3 SHARED_PINNED entries (asset + sha256), retention rule in the header comment
THIRD-PARTY-NOTICES.md	release tag ×2, corresponding-source commit — the LGPL source offer must point at the binaries we actually ship
crates/.cargo/config.toml	pin comment
technical-documentation/architecture/native-compositor.md	pin reference

Related issue

No issue — found while auditing the Linux build/packaging chain.

Type of change

• Bug fix

Release impact

• Patch

Desktop impact

• Windows
• Linux
• Installer / packaging

Screenshots / video

n/a

Testing

npm run fetch:ffmpeg on Ubuntu 24.04 x86_64, against a cleaned electron/native/bin/linux-x64/, exit 0:

Downloading ffmpeg-n8.1.2-34-g9b6c8969e0-linux64-lgpl-8.1.tar.xz
from autobuild-2026-07-31-14-10
sha256 ok (107 MB)
Verifying licence...
ffmpeg version n8.1.2-34-g9b6c8969e0-20260731
hardware encoders: h264_nvenc, h264_vaapi
LGPL verified: safe to ship with an MIT app.
Downloading ffmpeg-n8.1.2-34-g9b6c8969e0-linux64-lgpl-shared-8.1.tar.xz
sha256 ok (54 MB)
Vendored ffmpeg SDK (include/ + lib/) -> crates/thirdparty/ffmpeg-linux64-lgpl-shared
LGPL verified: safe to ship with an MIT app.

Both digests verified against the release's own checksums.sha256, and the script's own SHA-256 gate then re-verified them on the downloaded bytes. The Windows and arm64 digests come from the same file; they are not exercised by this run and will be by the first CI build.

Note for #293

That PR adds a linux-arm64 entry to SHARED_PINNED and will conflict here. Its digest at this tag is:

eec386482ac6799bb547b5f507dedd19ef6354eee0ca4ddb04bdd053d03c3cfb ffmpeg-n8.1.2-34-g9b6c8969e0-linuxarm64-lgpl-shared-8.1.tar.xz

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores

  • Updated the bundled multimedia processing components to a newer FFmpeg release.
  • Improved retrieval reliability across supported Windows and Linux builds.
  • Added integrity verification for downloaded components.

• Documentation

  • Updated technical documentation and notices to reflect the current FFmpeg release.
  • Documented release-selection guidance to help ensure long-term availability of required build artifacts.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a00005e1-b544-4437-999d-4d85e2ebdb0a

📥 Commits

Reviewing files that changed from the base of the PR and between e3dbb4c and f3a96f5.

📒 Files selected for processing (4)

• THIRD-PARTY-NOTICES.md
• crates/.cargo/config.toml
• scripts/fetch-ffmpeg.mjs
• technical-documentation/architecture/native-compositor.md

---

📝 Walkthrough

Walkthrough

Changes

FFmpeg release update

Layer / File(s)	Summary
Update FFmpeg assets and build pins scripts/fetch-ffmpeg.mjs, crates/.cargo/config.toml	The provisioning script and vendored build reference now use the n8.1.2-34 and autobuild-2026-07-31-14-10 artifacts. Static and shared-library checksums were updated.
Synchronize release documentation THIRD-PARTY-NOTICES.md, technical-documentation/architecture/native-compositor.md	The documented FFmpeg release URL, source commit, vendor build, and autobuild tag now match the new release.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description covers the change, issue status, change type, release and platform impact, screenshots status, testing, evidence, and affected files.
Title check	✅ Passed	The title clearly summarizes the main change: re-pinning FFmpeg to a month-end BtbN build for CI reliability.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/repin-ffmpeg-monthly

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}