docker: no265

.gitignore

@@ -29,6 +29,10 @@ copyparty.egg-info/
 copyparty/res/COPYING.txt
 copyparty/web/deps/
 srv/
+scripts/docker/base/b/
+scripts/docker/base/cver*
+scripts/docker/base/test-aac/
+scripts/docker/base/whl/
 scripts/docker/i/
 scripts/deps-docker/uncomment.py
 contrib/package/arch/pkg/

README.md

@@ -492,6 +492,9 @@ upgrade notes
 * thumbnails are broken (you get a colorful square which says the filetype instead)
   * you need to install `FFmpeg` or `Pillow`; see [thumbnails](#thumbnails)
 
+* thumbnails are broken, specifically for photos and videos taken by iphones
+  * the [docker image](https://github.com/9001/copyparty/blob/hovudstraum/scripts/docker) and [bootable flashdrive](https://a.ocv.me/pub/stuff/edcd001/enterprise-edition/) are not able to read heif/heic images and h265/HEVC video due to [legal reasons](docs/bad-codecs.md)
+
 * thumbnails are broken (some images appear, but other files just get a blank box, and/or the broken-image placeholder)
   * probably due to a reverse-proxy messing with the request URLs and stripping the query parameters (`?th=w`), so check your URL rewrite rules
   * could also be due to incorrect caching settings in reverse-proxies and/or CDNs, so make sure that nothing is set to ignore the query string
@@ -761,8 +764,7 @@ to show `/icons/exe.png` and `/icons/elf.gif` as the thumbnail for all `.exe` an
   * be careful with svg; chrome will crash if you have too many unique svg files showing on the same page (the limit is 250 or so) -- showing the same handful of svg files thousands of times is ok however
 
 note:
-* heif/heifs/heic/heics images usually require the `libvips` [optional dependency](#optional-dependencies) (available in the `iv` docker image, `withFastThumbnails` in nixos)
+* heif/heifs/heic/heics images usually require the `libvips` [optional dependency](#optional-dependencies) but this is not possible with the docker-images due to [legal reasons](docs/bad-codecs.md)
-  * technical trivia: FFmpeg has basic support for tiled heic as of v7.0; need `-show_stream_groups` for correct resolution
 
 config file example:
 

copyparty/th_srv.py

@@ -6,6 +6,7 @@ import io
 import logging
 import os
 import re
+import shlex
 import shutil
 import subprocess as sp
 import tempfile
@@ -554,11 +555,12 @@ class ThumbSrv(object):
                     conv_ok = True
                     break
                 except Exception as ex:
+                    r321 = getattr(ex, "returncode", 0) == 321
                     msg = "%s could not create thumbnail of %r\n%s"
-                    msg = msg % (fun.__name__, abspath, min_ex())
+                    msg = msg % (fun.__name__, abspath, ex if r321 else min_ex())
                     c: Union[str, int] = 1 if "<Signals.SIG" in msg else "90"
                     self.log(msg, c)
-                    if getattr(ex, "returncode", 0) != 321:
+                    if not r321:
                         if fun == funs[-1]:
                             try:
                                 with open(ttpath, "wb") as _:
@@ -826,7 +828,13 @@ class ThumbSrv(object):
 
         c: Union[str, int] = "90"
         t = "FFmpeg failed (probably a corrupt file):\n"
-        if (
+
+        if "but no decoder found for: hevc" in serr:
+            t = "thumbnail cannot be created due to legal reasons; https://github.com/9001/copyparty/blob/hovudstraum/docs/bad-codecs.md \033[0;90m\n"
+            ret = 321
+            c = 3
+
+        elif (
             (not self.args.th_ff_jpg or time.time() - int(self.args.th_ff_jpg) < 60)
             and cmd[-1].lower().endswith(b".webp")
             and (
@@ -841,7 +849,7 @@ class ThumbSrv(object):
             ret = 321
             c = 1
 
-        if (
+        elif (
             not self.args.th_ff_swr or time.time() - int(self.args.th_ff_swr) < 60
         ) and (
             "Requested resampling engine is unavailable" in serr
@@ -860,7 +868,12 @@ class ThumbSrv(object):
         if len(txt) > 5000:
             txt = txt[:2500] + "...\nff: [...]\nff: ..." + txt[-2500:]
 
-        self.log(t + txt, c=c)
+        try:
+            zs = shlex.join([x.decode("utf-8", "replace") for x in cmd])
+        except:
+            zs = "'" + (b"' '".join(cmd2)).decode("utf-8", "replace") + "'"
+
+        self.log("%scmd: %s\n%s" % (t, zs, txt), c=c)
         raise sp.CalledProcessError(ret, (cmd[0], b"...", cmd[-1]))
 
     def conv_waves(self, abspath: str, tpath: str, fmt: str, vn: VFS) -> None:

docs/bad-codecs.md

@@ -0,0 +1,53 @@
+due to legal reasons, the copyparty [docker image](https://github.com/9001/copyparty/blob/hovudstraum/scripts/docker) and [bootable flashdrive](https://a.ocv.me/pub/stuff/edcd001/enterprise-edition/) are not able to decode and display images and videos which were made using certain codecs
+
+* specifically, photos and videos taken with iphones will not work, and perhaps some samsung phones, idk
+* this also includes thumbnails thereof
+
+I suggest you stop reading at this point, unless you want to share my frustration, in which case please do continue
+
+
+## why hevc is not included
+
+the following is my understanding, which is probably wrong because [I anal](https://en.wikipedia.org/wiki/IANAL)
+
+* the h265 codec, also known as h.265 and hevc, is patent-encumbered and legally problematic to distribute;
+  * there are several patent-pools of patent-holders with conflicting and unclear requirements
+  * even FOSS is not exempt from demands of payment; https://en.wikipedia.org/wiki/High_Efficiency_Video_Coding#Provision_for_costless_software
+  * I have no idea how "number of sales" maps to FOSS, but copyparty doesn't have telemetry so it would be impossible to satisfy the requirements either way
+* due to this, both chrome and firefox refuse to add a built-in decoder for hevc; https://caniuse.com/hevc
+  * and while I haven't discussed this with a lawyer, I presume the reason is they did
+* most heif/heic images are hevc, meaning they are equally troublesome
+* safari is the only webbrowser willing to decode and display heif/heic photos, for self-inflicted reasons https://caniuse.com/heif
+
+and anyways there's no reason to use hevc in the first place because [av1](https://en.wikipedia.org/wiki/AV1) gives higher quality at a smaller filesize, is entirely free, and avif (its heif counterpart) is widely supported across all browsers: https://caniuse.com/avif
+
+
+## why only the docker and flashdrive images are affected
+
+supposedly, royalties is like a jigsaw puzzle, where whoever lays down the last piece wins the responsibility of dealing with that mess -- and because the docker-image has everything bundled as one big ball of software, that might(?) be a problem...idk, i anal
+
+so because ffmpeg is the component that handles everything regarding hevc, only the packages which include ffmpeg are affected, which means the docker-image and bootable-flashdrive-image
+
+if you use or install copyparty in any other way, then you are in charge of obtaining and providing an ffmpeg for copyparty to use, and thus nothing has changed
+
+
+## how hevc support was removed
+
+the regular ffmpeg package from the alpinelinux repos was replaced with a [custom ffmpeg build](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker/base) where the hevc decoder was physically stripped out, meaning hevc is not just "disabled", but entirely removed from all official copyparty distributions
+
+oh and the aac support has also been tampered with; now only AAC-LC can be decoded, which is fine because that's like 99% of all aac files (nobody uses HE-AAC or AAC-LD), and LC-AAC has become royalty-free in all relevant parts of the world at this point
+
+and any traces of vvc was also stripped out because that codec was dead on arrival, unable to compete with av1 (and soon av2)
+
+the silver lining is that this has made the docker images *much* smaller; the `ac` image is now half the size -- it went from 67 to 35 MiB gzipped, from 195 to 99 MiB installed, which is nice
+
+
+## how to enable hevc support
+
+all I can say is good luck; I legally cannot help you with that
+
+see, here's the fun part -- apparently I'm not allowed to assist with a technical explanation on how it could be done, because that would "facilitate access" as they call it?? but all copyparty does is call `ffmpeg` to generate the thumbnail; copyparty doesn't even know or care what "hevc" is; this is all purely on the ffmpeg side of things -- so technically none of this is even related to copyparty itself in the first place... ah whatever
+
+man I just wanna write software, I hate this
+
+pain peko

scripts/docker/Dockerfile.ac

@@ -10,11 +10,9 @@ ENV     XDG_CONFIG_HOME=/cfg
 RUN     apk --no-cache add !pyc \
             tzdata wget mimalloc2 mimalloc2-insecure \
             py3-jinja2 py3-argon2-cffi py3-pyzmq \
-            py3-openssl py3-paramiko py3-pillow \
+            py3-openssl py3-paramiko py3-pillow
-            ffmpeg
 
-COPY    i/dist/copyparty-sfx.py innvikler.sh ./
+COPY    i innvikler.sh ./
-ADD     base ./base
 RUN     ash innvikler.sh ac
 
 WORKDIR /state

scripts/docker/Dockerfile.dj

@@ -15,15 +15,15 @@ RUN     apk add -U !pyc \
             py3-jinja2 py3-argon2-cffi py3-pyzmq \
             py3-openssl py3-paramiko py3-pillow \
             py3-pip py3-cffi \
-            ffmpeg \
             py3-magic \
-            vips-jxl vips-heif vips-poppler vips-magick \
+            vips-jxl vips-poppler vips-magick \
             py3-numpy fftw libsndfile \
             vamp-sdk vamp-sdk-libs keyfinder-cli \
             libraw py3-numpy \
         && apk add -t .bd \
             bash wget gcc g++ make cmake patchelf \
-            python3-dev ffmpeg-dev fftw-dev libsndfile-dev \
+            ffmpeg ffmpeg-dev \
+            python3-dev fftw-dev libsndfile-dev \
             py3-wheel py3-numpy-dev libffi-dev \
             vamp-sdk-dev \
             libraw-dev py3-numpy-dev cython \
@@ -35,8 +35,7 @@ RUN     apk add -U !pyc \
         && chmod 777 /root \
         && ln -s /root/vamp /root/.local /
 
-COPY    i/dist/copyparty-sfx.py innvikler.sh ./
+COPY    i innvikler.sh ./
-ADD     base ./base
 RUN     ash innvikler.sh dj
 
 WORKDIR /state

scripts/docker/Dockerfile.im

@@ -12,8 +12,7 @@ RUN     apk --no-cache add !pyc \
             py3-jinja2 py3-argon2-cffi \
             py3-openssl py3-paramiko py3-pillow py3-mutagen
 
-COPY    i/dist/copyparty-sfx.py innvikler.sh ./
+COPY    i innvikler.sh ./
-ADD     base ./base
 RUN     ash innvikler.sh im
 
 WORKDIR /state

scripts/docker/Dockerfile.iv

@@ -12,9 +12,8 @@ RUN     apk add -U !pyc \
             py3-jinja2 py3-argon2-cffi py3-pyzmq \
             py3-openssl py3-paramiko py3-pillow \
             py3-pip py3-cffi \
-            ffmpeg \
             py3-magic \
-            vips-jxl vips-heif vips-poppler vips-magick \
+            vips-jxl vips-poppler vips-magick \
             libraw py3-numpy \
         && apk add -t .bd \
             bash wget gcc g++ make cmake patchelf \
@@ -25,8 +24,7 @@ RUN     apk add -U !pyc \
         && python3 -m pip install "$(wget -O- https://api.github.com/repos/letmaik/rawpy/releases/latest | awk -F\" '$2=="tarball_url"{print$4}')" \
         && apk del py3-pip .bd
 
-COPY    i/dist/copyparty-sfx.py innvikler.sh ./
+COPY    i innvikler.sh ./
-ADD     base ./base
 RUN     ash innvikler.sh iv
 
 WORKDIR /state

scripts/docker/Dockerfile.min

@@ -10,7 +10,7 @@ ENV     XDG_CONFIG_HOME=/cfg
 RUN     apk --no-cache add !pyc \
             py3-jinja2
 
-COPY    i/dist/copyparty-sfx.py innvikler.sh ./
+COPY    i innvikler.sh ./
 RUN     ash innvikler.sh min
 
 WORKDIR /state

scripts/docker/base/Dockerfile.zlibng

@@ -2,4 +2,7 @@ FROM    alpine:latest
 WORKDIR /z
 
 RUN     apk add py3-pip make gcc musl-dev python3-dev
-RUN     pip wheel https://files.pythonhosted.org/packages/c4/a7/0b7673be5945071e99364a3ac1987b02fc1d416617e97f3e8816d275174e/zlib_ng-0.5.1.tar.gz
+
+RUN     pip wheel https://files.pythonhosted.org/packages/46/7d/901c6e333fb031b5bfbd1532099200cf859f12aa83689be494eade6685ec/zlib_ng-1.0.0.tar.gz \
+        && mkdir whl \
+        && mv *.whl whl

scripts/docker/base/Makefile

@@ -1,14 +1,26 @@
 self := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
 
+
 all:
+# build all outdated
+	bash verchk.sh
+
+
+ff:
+# legally comfy
+	/usr/bin/time ./build-no265.sh img
+
+
+zlib:
 # 	build zlib-ng from source so we know how the sausage was made
 #	(still only doing the archs which are officially supported/tested)
 
 	podman build --arch amd64 -t localhost/cpp-zlibng-amd64:latest -f Dockerfile.zlibng .
-	podman run --arch amd64 --rm --log-driver=none -i localhost/cpp-zlibng-amd64:latest tar -cC/z . | tar -xv
+	podman run --arch amd64 --rm --log-driver=none -i localhost/cpp-zlibng-amd64:latest tar -cC/z whl | tar -xv
 
 	podman build --arch arm64 -t localhost/cpp-zlibng-amd64:latest -f Dockerfile.zlibng .
-	podman run --arch arm64 --rm --log-driver=none -i localhost/cpp-zlibng-amd64:latest tar -cC/z . | tar -xv
+	podman run --arch arm64 --rm --log-driver=none -i localhost/cpp-zlibng-amd64:latest tar -cC/z whl | tar -xv
+
 
 sh:
 	@printf "\n\033[1;31mopening a shell in the most recently created docker image\033[0m\n"

scripts/docker/base/arbeidspakke.sh

@@ -0,0 +1,65 @@
+#!/bin/ash
+set -e
+
+[ $1 = 1 ] && hub=1
+
+uname -a
+apk add alpine-sdk doas wget
+echo permit nopass root > /etc/doas.d/u.conf
+cp -pv /root/.abuild/*.pub /etc/apk/keys/ || abuild-keygen -ina
+
+##
+## yeet h265
+
+mkdir /ffmpeg
+cd /ffmpeg
+base=https://github.com/alpinelinux/aports/raw/refs/heads/3.23-stable/community/ffmpeg/
+wget ${base}APKBUILD
+awk <APKBUILD -vb="$base" '/"/{o=0}/^source=/{o=1;next}o{print b $1}' | wget -i-
+cp -pv APKBUILD /root/
+
+# grep -E '^extern const.* FF[^ ]+ +ff_(hevc|vvc)_' libavcodec/allcodecs.c libavcodec/hwaccels.h libavcodec/bitstream_filters.c libavcodec/parsers.c libavformat/allformats.c | sed -r 's/.* ff_([^/;]*)_([^/;]*);.*/--disable-\2=\1/' | tr '\n' ' '
+sed -ri 's/--enable-libx265/--disable-decoder=hevc --disable-decoder=hevc_qsv --disable-decoder=hevc_rkmpp --disable-encoder=hevc_rkmpp --disable-decoder=hevc_v4l2m2m --disable-decoder=vvc --disable-encoder=hevc_amf --disable-decoder=hevc_amf --disable-decoder=hevc_cuvid --disable-encoder=hevc_d3d12va --disable-decoder=hevc_mediacodec --disable-encoder=hevc_mediacodec --disable-encoder=hevc_mf --disable-encoder=hevc_nvenc --disable-decoder=hevc_oh --disable-encoder=hevc_oh --disable-encoder=hevc_qsv --disable-encoder=hevc_v4l2m2m --disable-encoder=hevc_vaapi --disable-encoder=hevc_videotoolbox --disable-encoder=hevc_vulkan --disable-decoder=vvc_qsv --disable-hwaccel=hevc_d3d11va --disable-hwaccel=hevc_d3d11va2 --disable-hwaccel=hevc_d3d12va --disable-hwaccel=hevc_dxva2 --disable-hwaccel=hevc_nvdec --disable-hwaccel=hevc_vaapi --disable-hwaccel=hevc_vdpau --disable-hwaccel=hevc_videotoolbox --disable-hwaccel=hevc_vulkan --disable-hwaccel=vvc_vaapi --disable-bsf=hevc_metadata --disable-bsf=hevc_mp4toannexb --disable-bsf=vvc_metadata --disable-bsf=vvc_mp4toannexb --disable-parser=hevc --disable-parser=vvc --disable-demuxer=hevc --disable-muxer=hevc --disable-demuxer=vvc --disable-muxer=vvc /;s/\bx265-dev\b//' APKBUILD
+
+##
+## yeet aac he/he+/ld (sbr/ps); keep lc only
+
+cat >>APKBUILD <<'EOF'
+prepare() {
+    default_prepare
+    tar -cC/opt/patch/ffmpeg . | tar -x
+    patch -p1 <aac-lc-only.patch
+}
+EOF
+
+##
+## shrink-ray
+
+sed -ri 's/--enable-lib(bluray|placebo|rav1e|shaderc)/--disable-lib\1/; s/--enable-(vdpau)/--disable-\1/; s/\b(rav1e|shaderc)-dev//; s/\blib(bluray|placebo|vdpau|xfixes)-dev\b//' APKBUILD
+# `- rm placebo+shaderc to drop spirv-tools (1.7 MiB apk)
+
+sed -ri 's/--enable-libxcb/--disable-libxcb --disable-indev=xcbgrab --disable-ffplay --disable-encoder=opus /' APKBUILD
+sed -ri 's/\bffplay$//; s/\bsdl2-dev\b//' APKBUILD
+
+##
+## golflympics; decode-only, super-specific for copyparty only
+
+[ $hub ] || {
+sed -ri 's/--enable-(ladspa|lv2|vaapi|vulkan)/--disable-\1/' APKBUILD
+sed -ri 's/--enable-lib(aom|ass|drm|fontconfig|freetype|fribidi|harfbuzz|pulse|rist|srt|ssh|v4l2|vidstab|x264|xvid|zimg|vpl)/--disable-lib\1/' APKBUILD
+sed -ri 's/\b(v4l-utils|libvpx)-dev\b//' APKBUILD  # (try to) drop v4l2_m2m, and use builtin vp8/vp9 instead of libvpx for decode
+sed -ri 's/(--disable-vulkan)/\1 --disable-devices --disable-hwaccels --disable-encoders --enable-encoder=flac --enable-encoder=libjxl --enable-encoder=libmp3lame --enable-encoder=libopus --enable-encoder=libwebp --enable-encoder=mjpeg --enable-encoder=pcm_s16le --enable-encoder=pcm_s16le_planar --enable-encoder=png --enable-encoder=rawvideo --enable-encoder=vnull --enable-encoder=wrapped_avframe --disable-muxers --enable-muxer=aiff --enable-muxer=apng --enable-muxer=caf --enable-muxer=ffmetadata --enable-muxer=fifo --enable-muxer=flac --enable-muxer=image2 --enable-muxer=image2pipe --enable-muxer=matroska --enable-muxer=matroska_audio --enable-muxer=mjpeg --enable-muxer=mp3 --enable-muxer=null --enable-muxer=opus --enable-muxer=pcm_s16le --enable-muxer=wav --enable-muxer=webm --enable-muxer=webp --enable-muxer=yuv4mpegpipe --disable-filters --enable-filter=anoisesrc --enable-filter=asplit --enable-filter=amerge --enable-filter=amix --enable-filter=aresample --enable-filter=crop --enable-filter=showspectrumpic --enable-filter=showwavespic --enable-filter=convolution --enable-filter=volume --enable-filter=compand --enable-filter=setsar --enable-filter=scale       --disable-decoder=av1 --disable-hwaccel=v4l2_m2m --disable-decoder=h263_v4l2m2m --disable-decoder=h264_v4l2m2m --disable-decoder=mpeg1_v4l2m2m --disable-decoder=mpeg2_v4l2m2m --disable-decoder=mpeg4_v4l2m2m --disable-decoder=vc1_v4l2m2m --disable-decoder=vp8_v4l2m2m --disable-decoder=vp9_v4l2m2m --disable-decoder=subrip --disable-decoder=srt --disable-decoder=pgssub --disable-decoder=cc_dec --disable-decoder=dvdsub --disable-decoder=dvbsub --disable-decoder=ssa --disable-decoder=ass --disable-decoder=opus /' APKBUILD
+# `- s/av1/libdav1d/; s/libvorbis/vorbis/; s/opus/libopus/; libvorbis and mpg123 gets pulled in by openmpt 
+}
+
+p=/root/packages/$(abuild -A)
+rm -rf $p
+abuild -FrcK
+
+mkdir $p/ex
+mv $p/ffmpeg-d* $p/ex  # dbg,dev,doc
+cp -pv src/ffmpeg-*/ffbuild/config.log $p/
+
+[ $hub ] && rm -rf $p.hub && mv $p $p.hub
+
+cp -pv /root/.abuild/*.pub ~/packages/

scripts/docker/base/build-no265.sh

@@ -0,0 +1,99 @@
+#!/bin/bash
+set -e
+
+[ $(id -u) -eq 0 ] && {
+	echo dont root
+	exit 1
+}
+self=$(cd -- "$(dirname "$BASH_SOURCE")"; pwd -P)
+cd "$self"
+
+sarchs="386 amd64 arm/v7 arm64/v8 ppc64le s390x"
+archs="amd64 amd64 386 arm64 arm s390x ppc64le"
+
+err=
+for x in awk jq podman python3 tar wget ; do
+	command -v $x >/dev/null && continue
+	err=1; echo ERROR: missing dependency: $x
+done
+[ $err ] && exit 1
+
+for v in "$@"; do
+	[ "$v" = pull ] && pull=1
+	[ "$v" = img  ] && img=1
+done
+
+[ $# -gt 0 ] || {
+	echo "need list of commands, for example: pull img"
+	exit 1
+}
+
+wt() {
+	printf '\033]0;%s\033\\' "$*"
+	[ -z "$TMUX" ] || tmux renamew "$*"
+}
+
+[ $pull ] && {
+	for a in $sarchs; do  # arm/v6
+		podman pull --arch=$a alpine:latest
+	done
+
+	podman images --format "{{.ID}} {{.History}}" |
+	awk '/library\/alpine/{print$1}' |
+	while read id; do
+		tag=alpine-$(podman inspect $id | jq -r '.[]|.Architecture' | tr / -)
+		[ -e .tag-$tag ] && continue
+		touch .tag-$tag
+		echo tagging $tag
+		podman untag $id
+		podman tag $id $tag
+	done
+	rm .tag-*
+}
+
+[ $img ] && {
+	mkdir -p "$self/b"
+
+	# enable arm32 crossbuild from aarch64 (macbook or whatever)
+	[ $(uname -m) = aarch64 ] && [ ! -e /proc/sys/fs/binfmt_misc/qemu-arm ] &&
+		echo ":qemu-arm:M:0:\x7f\x45\x4c\x46\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x28\x00:\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff:/usr/bin/qemu-arm-static:F" |
+		sudo tee >/dev/null /proc/sys/fs/binfmt_misc/register
+
+	# kill abandoned builders
+	ps aux | awk '/bin\/qemu-[^-]+-static/{print$2}' | xargs -r kill -9
+
+	n=0; set -x
+	for a in $archs; do
+		n=$((n+1)); wt "$n/$a"
+		#[ $n -le 3 ] || continue
+		touch b/t.$a.1.$(date +%s)
+
+		tar -c arbeidspakke.sh patch/ffmpeg |
+		time nice podman run \
+			--rm -i --pull=never -v "$self/b:/root:z" localhost/alpine-$a \
+			/bin/ash -c "cd /opt;tar -x;/bin/ash ./arbeidspakke.sh $n $a" 2>&1 |
+		tee b/log.$a
+
+		touch b/t.$a.2.$(date +%s)
+	done
+	wt -;wt ""
+}
+
+echo ok
+
+# just-no265
+#  4m18.77 x64
+#  4m22.81 386
+# 45m36.44 arm64 
+# 34m31.22 ppc64le
+# 50m01.04 s390x
+
+# golflympics
+#    4:09 x86_64-hub
+#    2:57 x86_64
+#    2:54 x86
+#   31:13 aarch64
+#   22:38 armv7
+#   32:17 s390x
+#   24:27 ppc64le
+# 2:00:35 summa summarum

scripts/docker/base/patch/ffmpeg/aac-lc-only.patch

@@ -0,0 +1,59 @@
+remove all advanced aac features, leaving only aac-lc which is
+no longer patent-encumbered in any relevant parts of the world
+( and 99% of all aac files are lc-aac anyways so that's fine )
+
+diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c
+index b8d53036d4..054c46f84e 100644
+--- a/libavcodec/aac/aacdec.c
++++ b/libavcodec/aac/aacdec.c
+@@ -880,9 +880,7 @@ static int decode_pce(AVCodecContext *avctx, MPEG4AudioConfig *m4ac,
+  */
+ static int decode_ga_specific_config(AACDecContext *ac, AVCodecContext *avctx,
+-                                     GetBitContext *gb,
+-                                     int get_bit_alignment,
+-                                     MPEG4AudioConfig *m4ac,
+-                                     int channel_config)
++    GetBitContext *gb, int get_bit_alignment, MPEG4AudioConfig *m4ac, int channel_config)
+ {
++    if (m4ac->sbr > 0) return AVERROR_DECODER_NOT_FOUND;
+     int extension_flag, ret, ep_config, res_flags;
+     uint8_t layout_map[MAX_ELEM_ID*4][3];
+@@ -961,8 +959,7 @@ static int decode_ga_specific_config(AACDecContext *ac, AVCodecContext *avctx,
+ 
+ static int decode_eld_specific_config(AACDecContext *ac, AVCodecContext *avctx,
+-                                     GetBitContext *gb,
+-                                     MPEG4AudioConfig *m4ac,
+-                                     int channel_config)
++    GetBitContext *gb, MPEG4AudioConfig *m4ac, int channel_config)
+ {
++    return AVERROR_DECODER_NOT_FOUND;  // kill ELD support
+     int ret, ep_config, res_flags;
+     uint8_t layout_map[MAX_ELEM_ID*4][3];
+@@ -1070,5 +1067,4 @@ static int decode_audio_specific_config_gb(AACDecContext *ac,
+     case AOT_AAC_LTP:
+     case AOT_ER_AAC_LC:
+-    case AOT_ER_AAC_LD:
+         if ((ret = decode_ga_specific_config(ac, avctx, gb, get_bit_alignment,
+                                              &oc->m4ac, m4ac->chan_config)) < 0)
+@@ -1948,4 +1944,5 @@ static int decode_extension_payload(AACDecContext *ac, GetBitContext *gb, int cn
+         crc_flag++;
+     case EXT_SBR_DATA:
++        return res;  // kill HE/SBR support
+         if (!che) {
+             av_log(ac->avctx, AV_LOG_ERROR, "SBR was found before the first channel element.\n");
+@@ -2087,4 +2084,5 @@ static void spectral_to_sample(AACDecContext *ac, int samples)
+                     }
+                     if (ac->oc[1].m4ac.sbr > 0) {
++                        exit(1);  // kill HE/SBR support
+                         ac->proc.sbr_apply(ac, che, type,
+                                            che->ch[0].output,
+diff --git a/libavcodec/aacsbr_template.c b/libavcodec/aacsbr_template.c
+index 31d2d844c4..b55f93752a 100644
+--- a/libavcodec/aacsbr_template.c
++++ b/libavcodec/aacsbr_template.c
+@@ -639,4 +639,5 @@ static int read_sbr_grid(AACDecContext *ac, SpectralBandReplication *sbr,
+                          GetBitContext *gb, SBRData *ch_data)
+ {
++    exit(1);  // kill SBR support
+     int i;
+     int bs_pointer = 0;

scripts/docker/base/patch/ffmpeg/libavcodec/aacps.c

@@ -0,0 +1,26 @@
+// just the signatures from the original file; all bodies/logic removed
+
+#include <stdint.h>
+#include "libavutil/common.h"
+#include "libavutil/mathematics.h"
+#include "libavutil/mem_internal.h"
+#include "aacps.h"
+#if USE_FIXED
+#include "aacps_fixed_tablegen.h"
+#else
+#include "libavutil/internal.h"
+#include "aacps_tablegen.h"
+#endif /* USE_FIXED */
+
+static void hybrid_analysis(PSDSPContext *dsp, INTFLOAT out[91][32][2],
+    INTFLOAT in[5][44][2], INTFLOAT L[2][38][64],
+    int is34, int len) {}
+
+static void hybrid_synthesis(PSDSPContext *dsp, INTFLOAT out[2][38][64],
+    INTFLOAT in[91][32][2], int is34, int len) {}
+
+static void decorrelation(PSContext *ps, INTFLOAT (*out)[32][2], const INTFLOAT (*s)[32][2], int is34) {}
+
+int AAC_RENAME(ff_ps_apply)(PSContext *ps, INTFLOAT L[2][38][64], INTFLOAT R[2][38][64], int top) { return 0; }
+
+av_cold void AAC_RENAME(ff_ps_init)(void) {}

scripts/docker/base/patch/ffmpeg/libavcodec/aacsbr.c

@@ -0,0 +1,41 @@
+// just the signatures from the original file; all bodies/logic removed
+
+#define USE_FIXED 0
+
+#include "aac.h"
+#include "sbr.h"
+#include "aacsbr.h"
+#include "aacsbrdata.h"
+#include "aacps.h"
+#include "sbrdsp.h"
+#include "libavutil/internal.h"
+#include "libavutil/intfloat.h"
+#include "libavutil/libm.h"
+#include "libavutil/avassert.h"
+#include "libavutil/mem_internal.h"
+
+#include <stdint.h>
+#include <float.h>
+#include <math.h>
+
+static void aacsbr_func_ptr_init(AACSBRContext *c);
+
+static void make_bands(int16_t* bands, int start, int stop, int num_bands) {}
+
+static void sbr_dequant(SpectralBandReplication *sbr, int id_aac) {}
+
+static void sbr_hf_inverse_filter(SBRDSPContext *dsp,
+    float (*alpha0)[2], float (*alpha1)[2],
+    const float X_low[32][40][2], int k0) {}
+
+static void sbr_chirp(SpectralBandReplication *sbr, SBRData *ch_data) {}
+
+static void sbr_gain_calc(SpectralBandReplication *sbr,
+    SBRData *ch_data, const int e_a[2]) {}
+
+static void sbr_hf_assemble(float Y1[38][64][2],
+    const float X_high[64][40][2],
+    SpectralBandReplication *sbr, SBRData *ch_data,
+    const int e_a[2]) {}
+
+#include "aacsbr_template.c"

scripts/docker/base/patch/ffmpeg/libavcodec/aacsbr_fixed.c

@@ -0,0 +1,45 @@
+// just the signatures from the original file; all bodies/logic removed
+
+#define USE_FIXED 1
+
+#include "aac.h"
+#include "sbr.h"
+#include "aacsbr.h"
+#include "aacsbrdata.h"
+#include "aacps.h"
+#include "sbrdsp.h"
+#include "libavutil/internal.h"
+#include "libavutil/libm.h"
+#include "libavutil/avassert.h"
+
+#include <stdint.h>
+#include <float.h>
+#include <math.h>
+
+static void aacsbr_func_ptr_init(AACSBRContext *c);
+static const int CONST_RECIP_LN2 = Q31(0.7);
+static const int CONST_076923    = Q31(0.7);
+
+static const int fixed_log_table[] = {Q31(0)};
+
+static int fixed_log(int x) {return 1;}
+
+static void make_bands(int16_t* bands, int start, int stop, int num_bands) {}
+
+static void sbr_dequant(SpectralBandReplication *sbr, int id_aac) {}
+
+static void sbr_hf_inverse_filter(SBRDSPContext *dsp,
+    int (*alpha0)[2], int (*alpha1)[2],
+    const int X_low[32][40][2], int k0) {}
+
+static void sbr_chirp(SpectralBandReplication *sbr, SBRData *ch_data) {}
+
+static void sbr_gain_calc(SpectralBandReplication *sbr,
+    SBRData *ch_data, const int e_a[2]) {}
+
+static void sbr_hf_assemble(int Y1[38][64][2],
+    const int X_high[64][40][2],
+    SpectralBandReplication *sbr, SBRData *ch_data,
+    const int e_a[2]) {}
+
+#include "aacsbr_template.c"

scripts/docker/base/patch/ffmpeg/libavcodec/aacsbrdata.h

@@ -0,0 +1,16 @@
+// just the signatures from the original file; all bodies/logic removed
+
+#ifndef AVCODEC_AACSBRDATA_H
+#define AVCODEC_AACSBRDATA_H
+
+#include <stdint.h>
+#include "libavutil/mem_internal.h"
+#include "aac_defines.h"
+
+static const int8_t sbr_offset[6][16] = {};
+
+static const DECLARE_ALIGNED(32, INTFLOAT, sbr_qmf_window_ds)[320] = {};
+
+static const DECLARE_ALIGNED(32, INTFLOAT, sbr_qmf_window_us)[640] = {};
+
+#endif /* AVCODEC_AACSBRDATA_H */

scripts/docker/base/verchk.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+set -e
+
+v=3.23
+
+mkdir -p cver
+rm -rf cver2
+mkdir cver2
+cd cver2
+curl \
+    -Lo1 https://raw.githubusercontent.com/alpinelinux/aports/refs/heads/$v-stable/main/musl/APKBUILD \
+    -Lo2 https://raw.githubusercontent.com/alpinelinux/aports/refs/heads/$v-stable/main/python3/APKBUILD \
+    -Lo3 https://raw.githubusercontent.com/alpinelinux/aports/refs/heads/$v-stable/community/ffmpeg/APKBUILD \
+    ;
+
+zlib= ff=
+cmp 1 ../cver/1 || zlib=1
+cmp 2 ../cver/2 || zlib=1
+cmp 3 ../cver/3 || ff=1
+echo zlib=$zlib ff=$ff
+
+[ $zlib ] && { make zlib; cp -pv 1 2 ../cver/; }
+[ $ff ] &&   { make ff;   cp -pv 3 ../cver/; }
+rm -rf cver2

scripts/docker/innvikler.sh

@@ -14,15 +14,29 @@ ised() {
 	tmv "$2"
 }
 
+# use custom ffmpeg if relevant
+echo $1 | grep -qE 'ac|iv|dj' && (
+  cp -pv /z/packages/*.pub /etc/apk/keys/
+  cd /z/packages/$(cat /etc/apk/arch)
+  apk add ./ffmpeg-*.apk
+  cd /z/test-aac
+  for f in *.m4a; do ffmpeg -v 0 -i $f ${f%.*}.flac || true; done
+  ls -1 *.flac | tee /dev/stderr | tr '\n' ' ' | grep -qE '^(lc.flac *)?$' || {
+    echo ERROR: incorrect aac decoder subset
+    exit 1
+  }
+)
+rm -rf /z/packages /z/test-aac
+
 # use zlib-ng if available
-f=/z/base/zlib_ng-0.5.1-cp312-cp312-linux_$(cat /etc/apk/arch).whl
+f=/z/whl/zlib_ng-0.5.1-cp312-cp312-linux_$(cat /etc/apk/arch).whl
 [ "$1" != min ] && [ -e $f ] && {
   apk add -t .bd !pyc py3-pip
   rm -f /usr/lib/python3*/EXTERNALLY-MANAGED
   pip install $f
   apk del .bd
 }
-rm -rf /z/base
+rm -rf /z/whl
 
 # cleanup for flavors with python build steps (dj/iv)
 rm -rf /var/cache/apk/* /root/.cache
@@ -70,6 +84,12 @@ rm -rf \
   /tmp/pe-* /z/copyparty-sfx.py \
   ensurepip pydoc_data turtle.py turtledemo lib2to3
 
+cd /usr/lib/python3.*/site-packages
+rm -rf \
+  numpy/*/tests \
+  cryptography/hazmat/bindings/_rust.abi3.so \
+  /usr/share/mime/packages/freedesktop.org.xml
+
 cd /usr/lib/python3.*/site-packages/copyparty/
 rm stolen/surrogateescape.py
 iawk '/^[^ ]/{s=0}/^if not VENDORED:/{s=1}!s' qrkode.py

scripts/docker/make.sh

@@ -1,5 +1,7 @@
 #!/bin/bash
 set -e
+self=$(cd -- "$(dirname "$BASH_SOURCE")"; pwd -P)
+cd "$self"
 
 [ $(id -u) -eq 0 ] && {
     echo dont root
@@ -78,6 +80,20 @@ filt=
 }
 
 [ $img ] && {
+    [ -e base/test-aac/lc.m4a ] || (
+        echo building aac smoketest
+        mkdir -p base/test-aac
+        cd base/test-aac
+        ffmpeg -nostdin -y -f lavfi -i sine -ac 2 -t 1 a.wav &&
+        fdkaac -m 3 -o lc.m4a a.wav &&
+        fdkaac -m 2 -p 5 -o he.m4a a.wav &&
+        fdkaac -m 1 -p 29 -o he2.m4a a.wav &&
+        fdkaac -m 3 -p 23 -o ld.m4a a.wav &&
+        fdkaac -m 3 -p 39 -o eld.m4a a.wav ||
+        echo "nevermind, failed to build test files, cannot verify aac decoding"
+        rm -f a.wav
+    )
+
     fp=../../dist/copyparty-sfx.py
     [ -e $fp ] || {
         echo downloading copyparty-sfx.py ...
@@ -96,7 +112,11 @@ filt=
     # grab deps
     rm -rf i err
     mkdir i
-    tar -cC../.. dist/copyparty-sfx.py bin/mtag | tar -xvCi
+    tar -cC "$self/base" whl test-aac \
+        -C "$self/base/b" packages \
+        -C "$self/../.."  bin/mtag \
+        -C dist copyparty-sfx.py \
+        | tar -xvCi
 
     for i in $imgs; do
         podman rm copyparty-$i || true  # old manifest

scripts/rls.sh

@@ -23,6 +23,7 @@ v=$1; shift
     printf '%s\n' "$v" | grep -qE '^[0-9\.]+$' || exit 1
     grep -E "(${v//./, })" ../copyparty/__version__.py || exit 1
 
+    make -C docker/base
     ./make-sfx.sh nopk gz
     ../dist/copyparty-sfx.py --version >/dev/null