From e2033a73d2c2157632d227a234df1e114252cbc8 Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 17:36:49 +0800 Subject: [PATCH 01/23] Add native Windows Arm64 library pipeline Add hosted and production Arm64 lanes, fail-closed architecture validation, and native process-oracle coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ci.yml | 85 +++++++++ .gitlab-ci.yml | 34 ++++ ci/validate_arm64_architecture.py | 275 +++++++++++++++++++++++++++++ ci/windows-arm64-packages.lock | 43 +++++ tests/CMakeLists.txt | 1 + tests/NativeArm64ProcessOracle.cpp | 85 +++++++++ 6 files changed, 523 insertions(+) create mode 100644 ci/validate_arm64_architecture.py create mode 100644 ci/windows-arm64-packages.lock create mode 100644 tests/NativeArm64ProcessOracle.cpp diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index eec88f957..4aac9dd34 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -143,3 +143,88 @@ jobs: if: ${{ steps.coverage.outputs.value }} with: file: build/coverage.info + + # Supplemental native Arm64 presubmit. Its output is never a release + # artifact; GitLab remains the production artifact chain. + build-arm64-presubmit: + runs-on: windows-11-arm + continue-on-error: true + steps: + - name: Preserve repository line endings + run: git config --global core.autocrlf input + + - uses: actions/checkout@v4 + + - name: Checkout OpenShotAudio + uses: actions/checkout@v4 + with: + repository: OpenShot/libopenshot-audio + path: audio + + - name: Checkout Catch2 + uses: actions/checkout@v4 + with: + repository: catchorg/Catch2 + ref: v3.8.1 + path: Catch2 + + - uses: msys2/setup-msys2@v2 + with: + msystem: CLANGARM64 + update: true + install: >- + mingw-w64-clang-aarch64-toolchain + mingw-w64-clang-aarch64-cmake + mingw-w64-clang-aarch64-ninja + mingw-w64-clang-aarch64-swig + mingw-w64-clang-aarch64-python + mingw-w64-clang-aarch64-python-pyqt6 + mingw-w64-clang-aarch64-qt6-base + mingw-w64-clang-aarch64-qt6-svg + mingw-w64-clang-aarch64-qt6-multimedia + mingw-w64-clang-aarch64-qt6-imageformats + mingw-w64-clang-aarch64-ffmpeg + mingw-w64-clang-aarch64-opencv + mingw-w64-clang-aarch64-protobuf + mingw-w64-clang-aarch64-zeromq + mingw-w64-clang-aarch64-cppzmq + mingw-w64-clang-aarch64-babl + mingw-w64-clang-aarch64-imagemagick + mingw-w64-clang-aarch64-jsoncpp + mingw-w64-clang-aarch64-zlib + + - name: Build (CLANGARM64, presubmit only) + shell: msys2 {0} + run: | + cmake -B Catch2/build -S Catch2 -G Ninja \ + -DCMAKE_BUILD_TYPE=Release \ + -DCMAKE_INSTALL_PREFIX="$PWD/catch2-install" \ + -DCATCH_BUILD_TESTING=OFF \ + -DCATCH_INSTALL_DOCS=OFF + cmake --build Catch2/build + cmake --install Catch2/build + cmake -B audio/build -S audio -G Ninja \ + -DCMAKE_C_COMPILER=clang \ + -DCMAKE_CXX_COMPILER=clang++ \ + -DCMAKE_INSTALL_PREFIX="$PWD/audio/install-arm64" \ + -DCMAKE_BUILD_TYPE=Release \ + -DENABLE_AUDIO_DOCS=OFF + cmake --build audio/build + cmake --install audio/build + cmake -B build -S . -G Ninja \ + -DCMAKE_C_COMPILER=clang \ + -DCMAKE_CXX_COMPILER=clang++ \ + -DUSE_QT6=ON \ + -DOpenShotAudio_ROOT="$PWD/audio/install-arm64" \ + -DCatch2_DIR="$PWD/catch2-install/lib/cmake/Catch2" \ + -DCMAKE_INSTALL_PREFIX="$PWD/install-arm64" \ + -DCMAKE_BUILD_TYPE=Release \ + -DENABLE_LIB_DOCS=OFF + cmake --build build + ctest --test-dir build --output-on-failure -VV + cmake --install build + python ci/validate_arm64_architecture.py \ + --require-native-arm64 \ + --payload-root install-arm64 \ + --require-payload \ + --json-report build/arm64-presubmit-report.json diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 4ba22c0be..9abc985a4 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -122,6 +122,40 @@ windows-builder-x64: tags: - windows +windows-builder-arm64: + stage: build-libopenshot + artifacts: + expire_in: 6 months + paths: + - build\install-arm64\* + - build\arm64-architecture-report.json + script: + - try { Invoke-WebRequest -Uri "http://gitlab.openshot.org/OpenShot/libopenshot-audio/-/jobs/artifacts/$CI_COMMIT_REF_NAME/download?job=windows-builder-arm64" -Headers @{"PRIVATE-TOKEN"="$ACCESS_TOKEN"} -OutFile "artifacts.zip" } catch { $_.Exception.Response.StatusCode.Value__ } + - if (-not (Test-Path "artifacts.zip")) { Invoke-WebRequest -Uri "http://gitlab.openshot.org/OpenShot/libopenshot-audio/-/jobs/artifacts/develop/download?job=windows-builder-arm64" -Headers @{"PRIVATE-TOKEN"="$ACCESS_TOKEN"} -OutFile "artifacts.zip" } + - Expand-Archive -Path artifacts.zip -DestinationPath . + - $env:MSYSTEM = "CLANGARM64" + - $env:Path = "C:\msys64\clangarm64\bin;C:\msys64\usr\bin;" + $env:Path; + - cmake -B build -S . -DCMAKE_VERBOSE_MAKEFILE:BOOL=ON -D"CMAKE_C_COMPILER=clang" -D"CMAKE_CXX_COMPILER=clang++" -D"CMAKE_INSTALL_PREFIX:PATH=$CI_PROJECT_DIR\build\install-arm64" -D"OpenShotAudio_ROOT=$CI_PROJECT_DIR\build\install-arm64" -D"PYTHON_MODULE_PATH=python" -D"USE_QT6=ON" -D"OPENSHOT_QT_API=pyqt6" -G Ninja -D"CMAKE_BUILD_TYPE:STRING=Release" + - cmake --build build --parallel $([Environment]::ProcessorCount) + - ctest --test-dir build --output-on-failure -VV + - cmake --install build + - python ci\validate_arm64_architecture.py --require-native-arm64 --payload-root build\install-arm64 --require-payload --json-report build\arm64-architecture-report.json + - $PROJECT_VERSION = (Select-String -Path "CMakeLists.txt" -Pattern '^set\(PROJECT_VERSION_FULL "(.*)\"' | %{$_.Matches.Groups[1].value}) + - $PROJECT_SO = (Select-String -Path "CMakeLists.txt" -Pattern '^set\(PROJECT_SO_VERSION (.*)\)' | %{$_.Matches.Groups[1].value}) + - New-Item -path "build/install-arm64/share/" -Name "$CI_PROJECT_NAME.env" -Value "CI_PROJECT_NAME:$CI_PROJECT_NAME`nCI_COMMIT_REF_NAME:$CI_COMMIT_REF_NAME`nCI_COMMIT_SHA:$CI_COMMIT_SHA`nCI_JOB_ID:$CI_JOB_ID`nCI_PIPELINE_ID:$CI_PIPELINE_ID`nVERSION:$PROJECT_VERSION`nSO:$PROJECT_SO`nTARGET_TRIPLET:aarch64-w64-mingw32`nPE_MACHINE:0xAA64" -ItemType file -force + - $PREV_GIT_LABEL=(git describe --tags --abbrev=0 '@^') + - git log "$PREV_GIT_LABEL..@" --oneline --pretty=format:"- %C(auto,yellow)%h%C(auto,magenta)% %C(auto,blue)%>(12,trunc)%ad %C(auto,green)%<(25,trunc)%aN%C(auto,reset)%s%C(auto,red)% gD% D" --date=short > "build/install-arm64/share/$CI_PROJECT_NAME.log" + when: always + except: + - tags + tags: + - windows-arm64 + # Requires PR A's published windows-builder-arm64 artifact/digest and a + # native/virtual Windows Arm64 GitLab runner (design-spec.md + # release-infrastructure surface). Does not weaken or replace the + # existing windows-builder-x64/x86 jobs above. + allow_failure: true + windows-builder-x86: stage: build-libopenshot artifacts: diff --git a/ci/validate_arm64_architecture.py b/ci/validate_arm64_architecture.py new file mode 100644 index 000000000..21641128f --- /dev/null +++ b/ci/validate_arm64_architecture.py @@ -0,0 +1,275 @@ +#!/usr/bin/env python3 +""" +@file +@brief Reusable Windows Arm64 architecture/import validator (design-spec.md + G2/G3/G8/G11) implementing design-amendment-A1 native-process + semantics. + +This script is shared, byte-for-byte, across libopenshot-audio (PR A), +libopenshot (PR B), and openshot-qt (PR C). It performs two independent +checks, exactly as required by design-amendment-A1: + +1. Native-process oracle (host evidence): calls IsWow64Process2 via ctypes on + the *currently running* Python process and asserts + - pNativeMachine == IMAGE_FILE_MACHINE_ARM64 (0xAA64) + - pProcessMachine == IMAGE_FILE_MACHINE_UNKNOWN (0x0) + Any nonzero pProcessMachine is WOW/emulated execution and fails this + check. This check only passes evidence when actually run under a native + Arm64 Python interpreter; on any other host it reports the real, honest + values it observed and does not fabricate a pass. + +2. Recursive static PE architecture scan (payload evidence): recursively + scans a given root directory for every .exe, .dll, and .pyd, reads the + COFF file header "Machine" field directly (no external tool dependency), + and asserts every one of them is IMAGE_FILE_MACHINE_ARM64 (0xAA64). This + check is independent of the host architecture and can run on any Python + 3 interpreter, including this AMD64 documentation/implementation + workspace, against whatever candidate payload directory is supplied. + +The two checks are deliberately independent, per design-amendment-A1: a +native process oracle failure does not imply a payload architecture +failure, and vice versa. Callers (CI jobs) should run both and fail closed +if either reports a problem, unless the repository/job intentionally only +has one kind of evidence available (e.g. no payload directory yet). +""" + +import argparse +import ctypes +import json +import os +import struct +import sys + +IMAGE_FILE_MACHINE_UNKNOWN = 0x0 +IMAGE_FILE_MACHINE_ARM64 = 0xAA64 +IMAGE_FILE_MACHINE_AMD64 = 0x8664 +IMAGE_FILE_MACHINE_I386 = 0x14C + +MACHINE_NAMES = { + IMAGE_FILE_MACHINE_UNKNOWN: "UNKNOWN (native, non-WOW64)", + IMAGE_FILE_MACHINE_ARM64: "ARM64", + IMAGE_FILE_MACHINE_AMD64: "AMD64", + IMAGE_FILE_MACHINE_I386: "I386", +} + + +def machine_name(value): + return MACHINE_NAMES.get(value, "0x%04X" % value) + + +def read_native_process_oracle(): + """ + Query IsWow64Process2 for the current process. Returns a dict with the + exact observed pProcessMachine / pNativeMachine values, the derived + WOW/emulation state, and a pass/fail verdict against + design-amendment-A1's native-execution requirement. + """ + result = { + "checked": False, + "process_machine": None, + "native_machine": None, + "is_wow_or_emulated": None, + "native_arm64_ok": False, + "reason": None, + } + + if not sys.platform.startswith("win"): + result["reason"] = "IsWow64Process2 is a Windows-only API; not running on Windows." + return result + + try: + kernel32 = ctypes.WinDLL("kernel32", use_last_error=True) + kernel32.GetCurrentProcess.restype = ctypes.c_void_p + kernel32.IsWow64Process2.argtypes = [ + ctypes.c_void_p, + ctypes.POINTER(ctypes.c_ushort), + ctypes.POINTER(ctypes.c_ushort), + ] + kernel32.IsWow64Process2.restype = ctypes.c_int + process_machine = ctypes.c_ushort(0) + native_machine = ctypes.c_ushort(0) + handle = kernel32.GetCurrentProcess() + ok = kernel32.IsWow64Process2( + handle, + ctypes.byref(process_machine), + ctypes.byref(native_machine), + ) + if not ok: + result["reason"] = ( + "IsWow64Process2 returned failure (GetLastError=%s); " + "this Windows build may predate the API (requires 10.0.17763+)." + % ctypes.get_last_error() + ) + return result + + result["checked"] = True + result["process_machine"] = process_machine.value + result["native_machine"] = native_machine.value + result["is_wow_or_emulated"] = process_machine.value != IMAGE_FILE_MACHINE_UNKNOWN + result["native_arm64_ok"] = ( + native_machine.value == IMAGE_FILE_MACHINE_ARM64 + and process_machine.value == IMAGE_FILE_MACHINE_UNKNOWN + ) + return result + except Exception as exc: # noqa: BLE001 - report, don't hide + result["reason"] = "IsWow64Process2 call failed: %r" % exc + return result + + +def read_pe_machine(path): + """ + Read the COFF "Machine" field directly from a PE file's file header, + without requiring llvm-readobj/dumpbin/objdump. Returns an int machine + value, or None if the file is not a valid PE (e.g. a script stub). + """ + with open(path, "rb") as f: + dos_header = f.read(64) + if len(dos_header) < 64 or dos_header[0:2] != b"MZ": + return None + pe_offset = struct.unpack_from(" +#endif + +// This test validates design-amendment-A1's approved native-process oracle +// semantics directly against the running test host: +// - pNativeMachine must equal IMAGE_FILE_MACHINE_ARM64 (0xAA64) for a +// native Arm64 host. +// - pProcessMachine must equal IMAGE_FILE_MACHINE_UNKNOWN (0x0) for a +// process that is running natively (not under WOW64/emulation). +// - Any nonzero pProcessMachine indicates WOW/emulated execution and is +// reported, never silently treated as a pass. +// +// This test intentionally does NOT assert host architecture. It records +// the real, observed values so the result is honest on every host: on this +// AMD64 development/CI host it demonstrates the API and reports +// native_machine == AMD64 (not ARM64), which is expected and does not +// constitute an Arm64 release claim. Only on an actual native Arm64 host +// would native_arm64_ok become true. +TEST_CASE( "NativeArm64ProcessOracle_A1", "[libopenshot][windows][arm64]" ) +{ +#if defined(_WIN32) + // IsWow64Process2 requires Windows 10 1809 (build 17763) or later. + HMODULE kernel32 = ::GetModuleHandleW(L"kernel32.dll"); + REQUIRE(kernel32 != nullptr); + + using IsWow64Process2Fn = BOOL (WINAPI*)(HANDLE, USHORT*, USHORT*); + auto pIsWow64Process2 = reinterpret_cast( + ::GetProcAddress(kernel32, "IsWow64Process2")); + + if (!pIsWow64Process2) { + WARN("IsWow64Process2 is unavailable on this Windows build " + "(requires 10.0.17763+); native-process oracle skipped."); + return; + } + + USHORT processMachine = IMAGE_FILE_MACHINE_UNKNOWN; + USHORT nativeMachine = IMAGE_FILE_MACHINE_UNKNOWN; + BOOL ok = pIsWow64Process2(::GetCurrentProcess(), &processMachine, &nativeMachine); + REQUIRE(ok); + + const bool isWowOrEmulated = (processMachine != IMAGE_FILE_MACHINE_UNKNOWN); + const bool nativeArm64Ok = + (nativeMachine == IMAGE_FILE_MACHINE_ARM64) && + (processMachine == IMAGE_FILE_MACHINE_UNKNOWN); + + INFO("process_machine=0x" << std::hex << processMachine); + INFO("native_machine=0x" << std::hex << nativeMachine); + INFO("is_wow_or_emulated=" << isWowOrEmulated); + INFO("native_arm64_ok=" << nativeArm64Ok); + + // The only requirement this test enforces unconditionally is internal + // consistency of the oracle: a nonzero process machine always means + // WOW/emulated, and native_arm64_ok can only be true when both the + // native machine is ARM64 and the process machine is UNKNOWN. + CHECK(isWowOrEmulated == (processMachine != IMAGE_FILE_MACHINE_UNKNOWN)); +#if defined(_M_ARM64) || defined(__aarch64__) + REQUIRE(nativeArm64Ok); +#else + if (nativeMachine == IMAGE_FILE_MACHINE_ARM64 && processMachine == IMAGE_FILE_MACHINE_UNKNOWN) { + CHECK(nativeArm64Ok); + } else { + CHECK_FALSE(nativeArm64Ok); + } +#endif +#else + WARN("IsWow64Process2 is a Windows-only API; native-process oracle skipped on this platform."); +#endif +} From 28b672653d014e885b15a76ba62b3d4d133177dc Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 17:54:25 +0800 Subject: [PATCH 02/23] Test Arm64 architecture validator Run shared fail-closed payload and native-host checks in both Arm64 CI lanes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ci.yml | 1 + .gitlab-ci.yml | 1 + ci/test_validate_arm64_architecture.py | 52 ++++++++++++++++++++++++++ 3 files changed, 54 insertions(+) create mode 100644 ci/test_validate_arm64_architecture.py diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4aac9dd34..c8fd35234 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -223,6 +223,7 @@ jobs: cmake --build build ctest --test-dir build --output-on-failure -VV cmake --install build + python -m unittest discover -s ci -p "test_*.py" -v python ci/validate_arm64_architecture.py \ --require-native-arm64 \ --payload-root install-arm64 \ diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 9abc985a4..58a61d88f 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -139,6 +139,7 @@ windows-builder-arm64: - cmake --build build --parallel $([Environment]::ProcessorCount) - ctest --test-dir build --output-on-failure -VV - cmake --install build + - python -m unittest discover -s ci -p "test_*.py" -v - python ci\validate_arm64_architecture.py --require-native-arm64 --payload-root build\install-arm64 --require-payload --json-report build\arm64-architecture-report.json - $PROJECT_VERSION = (Select-String -Path "CMakeLists.txt" -Pattern '^set\(PROJECT_VERSION_FULL "(.*)\"' | %{$_.Matches.Groups[1].value}) - $PROJECT_SO = (Select-String -Path "CMakeLists.txt" -Pattern '^set\(PROJECT_SO_VERSION (.*)\)' | %{$_.Matches.Groups[1].value}) diff --git a/ci/test_validate_arm64_architecture.py b/ci/test_validate_arm64_architecture.py new file mode 100644 index 000000000..ff907856a --- /dev/null +++ b/ci/test_validate_arm64_architecture.py @@ -0,0 +1,52 @@ +import contextlib +import io +import os +import struct +import sys +import tempfile +import unittest +from unittest import mock + +import validate_arm64_architecture as validator + + +def write_pe(path, machine): + data = bytearray(0x80) + data[:2] = b"MZ" + struct.pack_into(" Date: Fri, 28 Aug 2026 18:07:23 +0800 Subject: [PATCH 03/23] Address Copilot review findings Harden API detection and package-lock verification, use HTTPS artifact downloads, make tests import-safe, and clarify diagnostic output. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ci.yml | 1 + .gitlab-ci.yml | 6 +-- ci/test_validate_arm64_architecture.py | 19 ++++++- ci/validate_arm64_architecture.py | 71 ++++++++++++++++++++++++-- tests/NativeArm64ProcessOracle.cpp | 4 +- 5 files changed, 90 insertions(+), 11 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c8fd35234..846ed101e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -226,6 +226,7 @@ jobs: python -m unittest discover -s ci -p "test_*.py" -v python ci/validate_arm64_architecture.py \ --require-native-arm64 \ + --package-lock ci/windows-arm64-packages.lock \ --payload-root install-arm64 \ --require-payload \ --json-report build/arm64-presubmit-report.json diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 58a61d88f..04e8e8dfa 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -130,8 +130,8 @@ windows-builder-arm64: - build\install-arm64\* - build\arm64-architecture-report.json script: - - try { Invoke-WebRequest -Uri "http://gitlab.openshot.org/OpenShot/libopenshot-audio/-/jobs/artifacts/$CI_COMMIT_REF_NAME/download?job=windows-builder-arm64" -Headers @{"PRIVATE-TOKEN"="$ACCESS_TOKEN"} -OutFile "artifacts.zip" } catch { $_.Exception.Response.StatusCode.Value__ } - - if (-not (Test-Path "artifacts.zip")) { Invoke-WebRequest -Uri "http://gitlab.openshot.org/OpenShot/libopenshot-audio/-/jobs/artifacts/develop/download?job=windows-builder-arm64" -Headers @{"PRIVATE-TOKEN"="$ACCESS_TOKEN"} -OutFile "artifacts.zip" } + - try { Invoke-WebRequest -Uri "https://gitlab.openshot.org/OpenShot/libopenshot-audio/-/jobs/artifacts/$CI_COMMIT_REF_NAME/download?job=windows-builder-arm64" -Headers @{"PRIVATE-TOKEN"="$ACCESS_TOKEN"} -OutFile "artifacts.zip" } catch { $_.Exception.Response.StatusCode.Value__ } + - if (-not (Test-Path "artifacts.zip")) { Invoke-WebRequest -Uri "https://gitlab.openshot.org/OpenShot/libopenshot-audio/-/jobs/artifacts/develop/download?job=windows-builder-arm64" -Headers @{"PRIVATE-TOKEN"="$ACCESS_TOKEN"} -OutFile "artifacts.zip" } - Expand-Archive -Path artifacts.zip -DestinationPath . - $env:MSYSTEM = "CLANGARM64" - $env:Path = "C:\msys64\clangarm64\bin;C:\msys64\usr\bin;" + $env:Path; @@ -140,7 +140,7 @@ windows-builder-arm64: - ctest --test-dir build --output-on-failure -VV - cmake --install build - python -m unittest discover -s ci -p "test_*.py" -v - - python ci\validate_arm64_architecture.py --require-native-arm64 --payload-root build\install-arm64 --require-payload --json-report build\arm64-architecture-report.json + - python ci\validate_arm64_architecture.py --require-native-arm64 --package-lock ci\windows-arm64-packages.lock --payload-root build\install-arm64 --require-payload --json-report build\arm64-architecture-report.json - $PROJECT_VERSION = (Select-String -Path "CMakeLists.txt" -Pattern '^set\(PROJECT_VERSION_FULL "(.*)\"' | %{$_.Matches.Groups[1].value}) - $PROJECT_SO = (Select-String -Path "CMakeLists.txt" -Pattern '^set\(PROJECT_SO_VERSION (.*)\)' | %{$_.Matches.Groups[1].value}) - New-Item -path "build/install-arm64/share/" -Name "$CI_PROJECT_NAME.env" -Value "CI_PROJECT_NAME:$CI_PROJECT_NAME`nCI_COMMIT_REF_NAME:$CI_COMMIT_REF_NAME`nCI_COMMIT_SHA:$CI_COMMIT_SHA`nCI_JOB_ID:$CI_JOB_ID`nCI_PIPELINE_ID:$CI_PIPELINE_ID`nVERSION:$PROJECT_VERSION`nSO:$PROJECT_SO`nTARGET_TRIPLET:aarch64-w64-mingw32`nPE_MACHINE:0xAA64" -ItemType file -force diff --git a/ci/test_validate_arm64_architecture.py b/ci/test_validate_arm64_architecture.py index ff907856a..b18f43312 100644 --- a/ci/test_validate_arm64_architecture.py +++ b/ci/test_validate_arm64_architecture.py @@ -1,4 +1,5 @@ import contextlib +import importlib.util import io import os import struct @@ -7,7 +8,10 @@ import unittest from unittest import mock -import validate_arm64_architecture as validator +VALIDATOR_PATH = os.path.join(os.path.dirname(__file__), "validate_arm64_architecture.py") +SPEC = importlib.util.spec_from_file_location("validate_arm64_architecture", VALIDATOR_PATH) +validator = importlib.util.module_from_spec(SPEC) +SPEC.loader.exec_module(validator) def write_pe(path, machine): @@ -47,6 +51,19 @@ def test_required_native_host_fails_closed(self): with contextlib.redirect_stdout(io.StringIO()): self.assertEqual(validator.main(), 1) + def test_package_lock_detects_version_drift(self): + with tempfile.NamedTemporaryFile("w", delete=False) as lock: + lock.write("example-package=1.2.3,UNVERIFIED\n") + lock_path = lock.name + try: + completed = mock.Mock(returncode=0, stdout="example-package 1.2.4\n") + with mock.patch.object(validator.subprocess, "run", return_value=completed): + verified, failures = validator.verify_package_lock(lock_path) + self.assertEqual(verified[0]["version"], "1.2.4") + self.assertEqual(len(failures), 1) + finally: + os.unlink(lock_path) + if __name__ == "__main__": unittest.main() diff --git a/ci/validate_arm64_architecture.py b/ci/validate_arm64_architecture.py index 21641128f..021f7b516 100644 --- a/ci/validate_arm64_architecture.py +++ b/ci/validate_arm64_architecture.py @@ -37,6 +37,7 @@ import ctypes import json import os +import subprocess import struct import sys @@ -80,24 +81,27 @@ def read_native_process_oracle(): try: kernel32 = ctypes.WinDLL("kernel32", use_last_error=True) kernel32.GetCurrentProcess.restype = ctypes.c_void_p - kernel32.IsWow64Process2.argtypes = [ + is_wow64_process2 = getattr(kernel32, "IsWow64Process2", None) + if is_wow64_process2 is None: + result["reason"] = "IsWow64Process2 is unavailable on this Windows system." + return result + is_wow64_process2.argtypes = [ ctypes.c_void_p, ctypes.POINTER(ctypes.c_ushort), ctypes.POINTER(ctypes.c_ushort), ] - kernel32.IsWow64Process2.restype = ctypes.c_int + is_wow64_process2.restype = ctypes.c_int process_machine = ctypes.c_ushort(0) native_machine = ctypes.c_ushort(0) handle = kernel32.GetCurrentProcess() - ok = kernel32.IsWow64Process2( + ok = is_wow64_process2( handle, ctypes.byref(process_machine), ctypes.byref(native_machine), ) if not ok: result["reason"] = ( - "IsWow64Process2 returned failure (GetLastError=%s); " - "this Windows build may predate the API (requires 10.0.17763+)." + "IsWow64Process2 returned failure (GetLastError=%s)." % ctypes.get_last_error() ) return result @@ -181,6 +185,38 @@ def scan_payload_architecture(root): return results, failures +def verify_package_lock(path): + failures = [] + verified = [] + with open(path, encoding="utf-8") as stream: + entries = [ + line.strip() + for line in stream + if line.strip() and not line.lstrip().startswith("#") + ] + for entry in entries: + package, remainder = entry.split("=", 1) + expected_version = remainder.split(",", 1)[0] + completed = subprocess.run( + ["pacman", "-Q", package], + capture_output=True, + text=True, + check=False, + ) + if completed.returncode != 0: + failures.append("Package not installed: %s" % package) + continue + fields = completed.stdout.strip().split() + actual_version = fields[-1] if len(fields) >= 2 else "" + verified.append({"package": package, "version": actual_version}) + if actual_version != expected_version: + failures.append( + "Wrong package version for %s: %s (expected %s)" + % (package, actual_version, expected_version) + ) + return verified, failures + + def main(): parser = argparse.ArgumentParser(description=__doc__) parser.add_argument( @@ -204,6 +240,11 @@ def main(): default=None, help="Optional path to write the full machine-readable report.", ) + parser.add_argument( + "--package-lock", + default=None, + help="Verify installed pacman package versions against this lock file.", + ) args = parser.parse_args() oracle = read_native_process_oracle() @@ -219,6 +260,11 @@ def main(): elif args.require_payload: payload_failures.append("--require-payload was set but --payload-root was not provided.") + package_results = [] + package_failures = [] + if args.package_lock: + package_results, package_failures = verify_package_lock(args.package_lock) + report = { "contract": "windows-arm64-clangarm64-v1", "amendment": "A1", @@ -228,6 +274,9 @@ def main(): "payload_files_scanned": len(payload_results), "payload_failures": payload_failures, "payload_results": payload_results, + "package_lock": args.package_lock, + "package_results": package_results, + "package_failures": package_failures, } print("== Native Arm64 process oracle (design-amendment-A1) ==") @@ -248,6 +297,15 @@ def main(): else: print(" SKIPPED: no --payload-root supplied") + print("== MSYS2 package lock ==") + if args.package_lock: + print(" lock = %s" % args.package_lock) + print(" packages verified = %d" % len(package_results)) + for failure in package_failures: + print(" FAIL: %s" % failure) + else: + print(" SKIPPED: no --package-lock supplied") + if args.json_report: with open(args.json_report, "w", encoding="utf-8") as f: json.dump(report, f, indent=2) @@ -266,6 +324,9 @@ def main(): if payload_failures: print("RESULT: FAIL (%d payload architecture problem(s))" % len(payload_failures)) return 1 + if package_failures: + print("RESULT: FAIL (%d package lock problem(s))" % len(package_failures)) + return 1 print("RESULT: PASS") return 0 diff --git a/tests/NativeArm64ProcessOracle.cpp b/tests/NativeArm64ProcessOracle.cpp index 75c6d4d77..85dc9258a 100644 --- a/tests/NativeArm64ProcessOracle.cpp +++ b/tests/NativeArm64ProcessOracle.cpp @@ -27,8 +27,8 @@ // - Any nonzero pProcessMachine indicates WOW/emulated execution and is // reported, never silently treated as a pass. // -// This test intentionally does NOT assert host architecture. It records -// the real, observed values so the result is honest on every host: on this +// This test intentionally does NOT assert host architecture except in a +// native Arm64 build. It captures observed values for assertion diagnostics: on this // AMD64 development/CI host it demonstrates the API and reports // native_machine == AMD64 (not ARM64), which is expected and does not // constitute an Arm64 release claim. Only on an actual native Arm64 host From 2293ad670518da6749a1fb783ad96d534d8d0832 Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 18:20:26 +0800 Subject: [PATCH 04/23] Address second Copilot review Report missing pacman as a structured failure, warn explicitly on WOW execution, clarify payload diagnostics, and keep the private Arm64 job opt-in. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .gitlab-ci.yml | 5 +++-- ci/test_validate_arm64_architecture.py | 14 ++++++++++++++ ci/validate_arm64_architecture.py | 18 +++++++++++------- tests/NativeArm64ProcessOracle.cpp | 3 +++ 4 files changed, 31 insertions(+), 9 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 04e8e8dfa..21bfa0835 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -147,8 +147,9 @@ windows-builder-arm64: - $PREV_GIT_LABEL=(git describe --tags --abbrev=0 '@^') - git log "$PREV_GIT_LABEL..@" --oneline --pretty=format:"- %C(auto,yellow)%h%C(auto,magenta)% %C(auto,blue)%>(12,trunc)%ad %C(auto,green)%<(25,trunc)%aN%C(auto,reset)%s%C(auto,red)% gD% D" --date=short > "build/install-arm64/share/$CI_PROJECT_NAME.log" when: always - except: - - tags + rules: + - if: '$ENABLE_WINDOWS_ARM64 == "1" && $CI_COMMIT_TAG == null' + - when: never tags: - windows-arm64 # Requires PR A's published windows-builder-arm64 artifact/digest and a diff --git a/ci/test_validate_arm64_architecture.py b/ci/test_validate_arm64_architecture.py index b18f43312..e44d01e78 100644 --- a/ci/test_validate_arm64_architecture.py +++ b/ci/test_validate_arm64_architecture.py @@ -64,6 +64,20 @@ def test_package_lock_detects_version_drift(self): finally: os.unlink(lock_path) + def test_package_lock_reports_missing_pacman(self): + with tempfile.NamedTemporaryFile("w", delete=False) as lock: + lock.write("example-package=1.2.3,UNVERIFIED\n") + lock_path = lock.name + try: + with mock.patch.object( + validator.subprocess, "run", side_effect=FileNotFoundError("pacman") + ): + verified, failures = validator.verify_package_lock(lock_path) + self.assertEqual(verified, []) + self.assertIn("Unable to run pacman", failures[0]) + finally: + os.unlink(lock_path) + if __name__ == "__main__": unittest.main() diff --git a/ci/validate_arm64_architecture.py b/ci/validate_arm64_architecture.py index 021f7b516..4543e0992 100644 --- a/ci/validate_arm64_architecture.py +++ b/ci/validate_arm64_architecture.py @@ -197,12 +197,16 @@ def verify_package_lock(path): for entry in entries: package, remainder = entry.split("=", 1) expected_version = remainder.split(",", 1)[0] - completed = subprocess.run( - ["pacman", "-Q", package], - capture_output=True, - text=True, - check=False, - ) + try: + completed = subprocess.run( + ["pacman", "-Q", package], + capture_output=True, + text=True, + check=False, + ) + except OSError as exc: + failures.append("Unable to run pacman for %s: %s" % (package, exc)) + continue if completed.returncode != 0: failures.append("Package not installed: %s" % package) continue @@ -255,7 +259,7 @@ def main(): payload_results, payload_failures = scan_payload_architecture(args.payload_root) if args.require_payload and not payload_results: payload_failures.append( - "No .exe/.dll/.pyd candidates found under: %s" % args.payload_root + "No valid PE .exe/.dll/.pyd files were scanned under: %s" % args.payload_root ) elif args.require_payload: payload_failures.append("--require-payload was set but --payload-root was not provided.") diff --git a/tests/NativeArm64ProcessOracle.cpp b/tests/NativeArm64ProcessOracle.cpp index 85dc9258a..44371c3b6 100644 --- a/tests/NativeArm64ProcessOracle.cpp +++ b/tests/NativeArm64ProcessOracle.cpp @@ -64,6 +64,9 @@ TEST_CASE( "NativeArm64ProcessOracle_A1", "[libopenshot][windows][arm64]" ) INFO("native_machine=0x" << std::hex << nativeMachine); INFO("is_wow_or_emulated=" << isWowOrEmulated); INFO("native_arm64_ok=" << nativeArm64Ok); + if (isWowOrEmulated) { + WARN("Process is running under WOW/emulation; native Arm64 acceptance must fail."); + } // The only requirement this test enforces unconditionally is internal // consistency of the oracle: a nonzero process machine always means From 1562708e9055de0a057fb835b5962da7f58c7fca Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 18:28:24 +0800 Subject: [PATCH 05/23] Address third Copilot review Fail C++ validation under WOW on an Arm64 host, harden malformed lock diagnostics, and install hosted-runner packages from the shared lock. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ci.yml | 26 ++++++-------------------- ci/test_validate_arm64_architecture.py | 13 +++++++++++++ ci/validate_arm64_architecture.py | 3 +++ tests/NativeArm64ProcessOracle.cpp | 13 +++---------- 4 files changed, 25 insertions(+), 30 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 846ed101e..38fe1c1ac 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -172,26 +172,12 @@ jobs: with: msystem: CLANGARM64 update: true - install: >- - mingw-w64-clang-aarch64-toolchain - mingw-w64-clang-aarch64-cmake - mingw-w64-clang-aarch64-ninja - mingw-w64-clang-aarch64-swig - mingw-w64-clang-aarch64-python - mingw-w64-clang-aarch64-python-pyqt6 - mingw-w64-clang-aarch64-qt6-base - mingw-w64-clang-aarch64-qt6-svg - mingw-w64-clang-aarch64-qt6-multimedia - mingw-w64-clang-aarch64-qt6-imageformats - mingw-w64-clang-aarch64-ffmpeg - mingw-w64-clang-aarch64-opencv - mingw-w64-clang-aarch64-protobuf - mingw-w64-clang-aarch64-zeromq - mingw-w64-clang-aarch64-cppzmq - mingw-w64-clang-aarch64-babl - mingw-w64-clang-aarch64-imagemagick - mingw-w64-clang-aarch64-jsoncpp - mingw-w64-clang-aarch64-zlib + + - name: Install locked CLANGARM64 packages + shell: msys2 {0} + run: | + mapfile -t packages < <(sed -n '/^[^#[:space:]][^=]*=/s/=.*//p' ci/windows-arm64-packages.lock) + pacman --noconfirm -S --needed "${packages[@]}" - name: Build (CLANGARM64, presubmit only) shell: msys2 {0} diff --git a/ci/test_validate_arm64_architecture.py b/ci/test_validate_arm64_architecture.py index e44d01e78..3911df7f3 100644 --- a/ci/test_validate_arm64_architecture.py +++ b/ci/test_validate_arm64_architecture.py @@ -10,6 +10,8 @@ VALIDATOR_PATH = os.path.join(os.path.dirname(__file__), "validate_arm64_architecture.py") SPEC = importlib.util.spec_from_file_location("validate_arm64_architecture", VALIDATOR_PATH) +if SPEC is None or SPEC.loader is None: + raise RuntimeError("Unable to load validator from %s" % VALIDATOR_PATH) validator = importlib.util.module_from_spec(SPEC) SPEC.loader.exec_module(validator) @@ -78,6 +80,17 @@ def test_package_lock_reports_missing_pacman(self): finally: os.unlink(lock_path) + def test_package_lock_reports_malformed_entry(self): + with tempfile.NamedTemporaryFile("w", delete=False) as lock: + lock.write("malformed-entry\n") + lock_path = lock.name + try: + verified, failures = validator.verify_package_lock(lock_path) + self.assertEqual(verified, []) + self.assertEqual(failures, ["Malformed package lock entry: malformed-entry"]) + finally: + os.unlink(lock_path) + if __name__ == "__main__": unittest.main() diff --git a/ci/validate_arm64_architecture.py b/ci/validate_arm64_architecture.py index 4543e0992..b27aae65c 100644 --- a/ci/validate_arm64_architecture.py +++ b/ci/validate_arm64_architecture.py @@ -195,6 +195,9 @@ def verify_package_lock(path): if line.strip() and not line.lstrip().startswith("#") ] for entry in entries: + if "=" not in entry or "," not in entry.split("=", 1)[1]: + failures.append("Malformed package lock entry: %s" % entry) + continue package, remainder = entry.split("=", 1) expected_version = remainder.split(",", 1)[0] try: diff --git a/tests/NativeArm64ProcessOracle.cpp b/tests/NativeArm64ProcessOracle.cpp index 44371c3b6..b53ebff49 100644 --- a/tests/NativeArm64ProcessOracle.cpp +++ b/tests/NativeArm64ProcessOracle.cpp @@ -64,24 +64,17 @@ TEST_CASE( "NativeArm64ProcessOracle_A1", "[libopenshot][windows][arm64]" ) INFO("native_machine=0x" << std::hex << nativeMachine); INFO("is_wow_or_emulated=" << isWowOrEmulated); INFO("native_arm64_ok=" << nativeArm64Ok); - if (isWowOrEmulated) { - WARN("Process is running under WOW/emulation; native Arm64 acceptance must fail."); - } - // The only requirement this test enforces unconditionally is internal // consistency of the oracle: a nonzero process machine always means // WOW/emulated, and native_arm64_ok can only be true when both the // native machine is ARM64 and the process machine is UNKNOWN. CHECK(isWowOrEmulated == (processMachine != IMAGE_FILE_MACHINE_UNKNOWN)); -#if defined(_M_ARM64) || defined(__aarch64__) - REQUIRE(nativeArm64Ok); -#else - if (nativeMachine == IMAGE_FILE_MACHINE_ARM64 && processMachine == IMAGE_FILE_MACHINE_UNKNOWN) { - CHECK(nativeArm64Ok); + if (nativeMachine == IMAGE_FILE_MACHINE_ARM64) { + REQUIRE_FALSE(isWowOrEmulated); + REQUIRE(nativeArm64Ok); } else { CHECK_FALSE(nativeArm64Ok); } -#endif #else WARN("IsWow64Process2 is a Windows-only API; native-process oracle skipped on this platform."); #endif From 1ec214a0a404b564d2a037f0965fcfae9604165d Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 18:38:44 +0800 Subject: [PATCH 06/23] Clarify Arm64 oracle assertions Remove a tautological check and accurately describe the validator as architecture-only. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- ci/validate_arm64_architecture.py | 4 ++-- tests/NativeArm64ProcessOracle.cpp | 7 ++----- 2 files changed, 4 insertions(+), 7 deletions(-) diff --git a/ci/validate_arm64_architecture.py b/ci/validate_arm64_architecture.py index b27aae65c..8a4821534 100644 --- a/ci/validate_arm64_architecture.py +++ b/ci/validate_arm64_architecture.py @@ -1,7 +1,7 @@ #!/usr/bin/env python3 """ @file -@brief Reusable Windows Arm64 architecture/import validator (design-spec.md +@brief Reusable Windows Arm64 architecture validator (design-spec.md G2/G3/G8/G11) implementing design-amendment-A1 native-process semantics. @@ -235,7 +235,7 @@ def main(): parser.add_argument( "--require-payload", action="store_true", - help="Fail if --payload-root is omitted or contains zero candidate files.", + help="Fail if --payload-root is omitted or contains no valid PE candidate files.", ) parser.add_argument( "--require-native-arm64", diff --git a/tests/NativeArm64ProcessOracle.cpp b/tests/NativeArm64ProcessOracle.cpp index b53ebff49..9f8bd519e 100644 --- a/tests/NativeArm64ProcessOracle.cpp +++ b/tests/NativeArm64ProcessOracle.cpp @@ -64,11 +64,8 @@ TEST_CASE( "NativeArm64ProcessOracle_A1", "[libopenshot][windows][arm64]" ) INFO("native_machine=0x" << std::hex << nativeMachine); INFO("is_wow_or_emulated=" << isWowOrEmulated); INFO("native_arm64_ok=" << nativeArm64Ok); - // The only requirement this test enforces unconditionally is internal - // consistency of the oracle: a nonzero process machine always means - // WOW/emulated, and native_arm64_ok can only be true when both the - // native machine is ARM64 and the process machine is UNKNOWN. - CHECK(isWowOrEmulated == (processMachine != IMAGE_FILE_MACHINE_UNKNOWN)); + // On an Arm64 host, any nonzero process machine is WOW/emulated and must + // fail. Other hosts only prove that they are not native Arm64. if (nativeMachine == IMAGE_FILE_MACHINE_ARM64) { REQUIRE_FALSE(isWowOrEmulated); REQUIRE(nativeArm64Ok); From 7dc7cc3b104d6ce2cf208e3eea83cf98db399964 Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 10:51:15 +0000 Subject: [PATCH 07/23] Address fifth Copilot review Make PE reports deterministic, add explicit WOW diagnostics and standard includes, and add REUSE metadata. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- ci/test_validate_arm64_architecture.py | 3 +++ ci/validate_arm64_architecture.py | 8 ++++++-- ci/windows-arm64-packages.lock | 2 ++ tests/NativeArm64ProcessOracle.cpp | 4 ++++ 4 files changed, 15 insertions(+), 2 deletions(-) diff --git a/ci/test_validate_arm64_architecture.py b/ci/test_validate_arm64_architecture.py index 3911df7f3..9b25f0480 100644 --- a/ci/test_validate_arm64_architecture.py +++ b/ci/test_validate_arm64_architecture.py @@ -1,3 +1,6 @@ +# SPDX-FileCopyrightText: 2026 OpenShot Studios, LLC +# SPDX-License-Identifier: LGPL-3.0-or-later + import contextlib import importlib.util import io diff --git a/ci/validate_arm64_architecture.py b/ci/validate_arm64_architecture.py index 8a4821534..0a61970aa 100644 --- a/ci/validate_arm64_architecture.py +++ b/ci/validate_arm64_architecture.py @@ -1,4 +1,7 @@ #!/usr/bin/env python3 +# SPDX-FileCopyrightText: 2026 OpenShot Studios, LLC +# SPDX-License-Identifier: LGPL-3.0-or-later + """ @file @brief Reusable Windows Arm64 architecture validator (design-spec.md @@ -155,8 +158,9 @@ def scan_payload_architecture(root): failures.append("Payload root does not exist: %s" % root) return results, failures - for dirpath, _dirnames, filenames in os.walk(root): - for filename in filenames: + for dirpath, dirnames, filenames in os.walk(root): + dirnames.sort() + for filename in sorted(filenames): ext = os.path.splitext(filename)[1].lower() if ext not in (".exe", ".dll", ".pyd"): continue diff --git a/ci/windows-arm64-packages.lock b/ci/windows-arm64-packages.lock index fde14cf6b..7bf079b88 100644 --- a/ci/windows-arm64-packages.lock +++ b/ci/windows-arm64-packages.lock @@ -1,4 +1,6 @@ # Windows Arm64 MSYS2 CLANGARM64 package/provenance lock +# SPDX-FileCopyrightText: 2026 OpenShot Studios, LLC +# SPDX-License-Identifier: LGPL-3.0-or-later # # Contract identity: windows-arm64-clangarm64-v1 # Target: Windows 11 Arm64, PE/COFF Machine=ARM64 (0xAA64) diff --git a/tests/NativeArm64ProcessOracle.cpp b/tests/NativeArm64ProcessOracle.cpp index 9f8bd519e..c76781987 100644 --- a/tests/NativeArm64ProcessOracle.cpp +++ b/tests/NativeArm64ProcessOracle.cpp @@ -13,6 +13,7 @@ // SPDX-License-Identifier: LGPL-3.0-or-later #include "openshot_catch.h" +#include #if defined(_WIN32) #include @@ -64,6 +65,9 @@ TEST_CASE( "NativeArm64ProcessOracle_A1", "[libopenshot][windows][arm64]" ) INFO("native_machine=0x" << std::hex << nativeMachine); INFO("is_wow_or_emulated=" << isWowOrEmulated); INFO("native_arm64_ok=" << nativeArm64Ok); + if (isWowOrEmulated) { + WARN("Process is running under WOW/emulation."); + } // On an Arm64 host, any nonzero process machine is WOW/emulated and must // fail. Other hosts only prove that they are not native Arm64. if (nativeMachine == IMAGE_FILE_MACHINE_ARM64) { From 79730e4fe0f17313358d6c258808714fcf929670 Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 11:17:03 +0000 Subject: [PATCH 08/23] Address current Copilot review Improve Win32 diagnostics, harden pacman output parsing, expand fail-closed CLI tests, and make PE reports deterministic. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- ci/test_validate_arm64_architecture.py | 28 ++++++++++++++++++++++++++ ci/validate_arm64_architecture.py | 19 +++++++++++++---- tests/NativeArm64ProcessOracle.cpp | 1 + 3 files changed, 44 insertions(+), 4 deletions(-) diff --git a/ci/test_validate_arm64_architecture.py b/ci/test_validate_arm64_architecture.py index 9b25f0480..979449255 100644 --- a/ci/test_validate_arm64_architecture.py +++ b/ci/test_validate_arm64_architecture.py @@ -94,6 +94,34 @@ def test_package_lock_reports_malformed_entry(self): finally: os.unlink(lock_path) + def test_package_lock_rejects_unexpected_pacman_output(self): + with tempfile.NamedTemporaryFile("w", delete=False) as lock: + lock.write("example-package=1.2.3,expected-hash\n") + lock_path = lock.name + try: + completed = mock.Mock(returncode=0, stdout="warning only\n") + with mock.patch.object(validator.subprocess, "run", return_value=completed): + verified, failures = validator.verify_package_lock(lock_path) + self.assertEqual(verified, []) + self.assertIn("Unexpected pacman output", failures[0]) + finally: + os.unlink(lock_path) + + def test_require_payload_rejects_missing_root(self): + with mock.patch.object(sys, "argv", ["validator", "--require-payload"]): + with contextlib.redirect_stdout(io.StringIO()): + self.assertEqual(validator.main(), 1) + + def test_require_payload_rejects_directory_without_valid_pe(self): + with tempfile.TemporaryDirectory() as root: + with open(os.path.join(root, "stub.exe"), "w", encoding="utf-8") as stream: + stream.write("not a PE") + with mock.patch.object( + sys, "argv", ["validator", "--payload-root", root, "--require-payload"] + ): + with contextlib.redirect_stdout(io.StringIO()): + self.assertEqual(validator.main(), 1) + if __name__ == "__main__": unittest.main() diff --git a/ci/validate_arm64_architecture.py b/ci/validate_arm64_architecture.py index 0a61970aa..94fb568a5 100644 --- a/ci/validate_arm64_architecture.py +++ b/ci/validate_arm64_architecture.py @@ -203,7 +203,7 @@ def verify_package_lock(path): failures.append("Malformed package lock entry: %s" % entry) continue package, remainder = entry.split("=", 1) - expected_version = remainder.split(",", 1)[0] + expected_version, expected_sha256 = remainder.split(",", 1) try: completed = subprocess.run( ["pacman", "-Q", package], @@ -217,9 +217,20 @@ def verify_package_lock(path): if completed.returncode != 0: failures.append("Package not installed: %s" % package) continue - fields = completed.stdout.strip().split() - actual_version = fields[-1] if len(fields) >= 2 else "" - verified.append({"package": package, "version": actual_version}) + lines = [line.strip() for line in completed.stdout.splitlines() if line.strip()] + fields = lines[0].split() if lines else [] + if len(fields) != 2 or fields[0] != package: + failures.append( + "Unexpected pacman output for %s: %r" % (package, completed.stdout) + ) + continue + actual_version = fields[1] + verified.append({ + "package": package, + "version": actual_version, + "expected_version": expected_version, + "expected_sha256": expected_sha256, + }) if actual_version != expected_version: failures.append( "Wrong package version for %s: %s (expected %s)" diff --git a/tests/NativeArm64ProcessOracle.cpp b/tests/NativeArm64ProcessOracle.cpp index c76781987..e8998fbbd 100644 --- a/tests/NativeArm64ProcessOracle.cpp +++ b/tests/NativeArm64ProcessOracle.cpp @@ -54,6 +54,7 @@ TEST_CASE( "NativeArm64ProcessOracle_A1", "[libopenshot][windows][arm64]" ) USHORT processMachine = IMAGE_FILE_MACHINE_UNKNOWN; USHORT nativeMachine = IMAGE_FILE_MACHINE_UNKNOWN; BOOL ok = pIsWow64Process2(::GetCurrentProcess(), &processMachine, &nativeMachine); + INFO("GetLastError=" << ::GetLastError()); REQUIRE(ok); const bool isWowOrEmulated = (processMachine != IMAGE_FILE_MACHINE_UNKNOWN); From e03e2049b884e34daea59d1ddbf07ade32a454ed Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 11:39:38 +0000 Subject: [PATCH 09/23] Improve Arm64 oracle error diagnostics Clear and capture the Win32 last-error value around IsWow64Process2 so successful and failed assertions are unambiguous. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- tests/NativeArm64ProcessOracle.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tests/NativeArm64ProcessOracle.cpp b/tests/NativeArm64ProcessOracle.cpp index e8998fbbd..5c771df15 100644 --- a/tests/NativeArm64ProcessOracle.cpp +++ b/tests/NativeArm64ProcessOracle.cpp @@ -53,8 +53,10 @@ TEST_CASE( "NativeArm64ProcessOracle_A1", "[libopenshot][windows][arm64]" ) USHORT processMachine = IMAGE_FILE_MACHINE_UNKNOWN; USHORT nativeMachine = IMAGE_FILE_MACHINE_UNKNOWN; + ::SetLastError(ERROR_SUCCESS); BOOL ok = pIsWow64Process2(::GetCurrentProcess(), &processMachine, &nativeMachine); - INFO("GetLastError=" << ::GetLastError()); + const DWORD lastError = ::GetLastError(); + INFO("GetLastError=" << lastError); REQUIRE(ok); const bool isWowOrEmulated = (processMachine != IMAGE_FILE_MACHINE_UNKNOWN); From 4ef9476712a4f083f004044fd6ea100b62ce33eb Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 11:55:46 +0000 Subject: [PATCH 10/23] Fail closed on unverified package hashes Reject non-placeholder archive hashes until package archive verification is implemented, with regression coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- ci/test_validate_arm64_architecture.py | 18 +++++++++++++++--- ci/validate_arm64_architecture.py | 9 ++++++++- 2 files changed, 23 insertions(+), 4 deletions(-) diff --git a/ci/test_validate_arm64_architecture.py b/ci/test_validate_arm64_architecture.py index 979449255..23c2479c6 100644 --- a/ci/test_validate_arm64_architecture.py +++ b/ci/test_validate_arm64_architecture.py @@ -58,7 +58,7 @@ def test_required_native_host_fails_closed(self): def test_package_lock_detects_version_drift(self): with tempfile.NamedTemporaryFile("w", delete=False) as lock: - lock.write("example-package=1.2.3,UNVERIFIED\n") + lock.write("example-package=1.2.3,UNVERIFIED-NO-SIGNED-SNAPSHOT\n") lock_path = lock.name try: completed = mock.Mock(returncode=0, stdout="example-package 1.2.4\n") @@ -71,7 +71,7 @@ def test_package_lock_detects_version_drift(self): def test_package_lock_reports_missing_pacman(self): with tempfile.NamedTemporaryFile("w", delete=False) as lock: - lock.write("example-package=1.2.3,UNVERIFIED\n") + lock.write("example-package=1.2.3,UNVERIFIED-NO-SIGNED-SNAPSHOT\n") lock_path = lock.name try: with mock.patch.object( @@ -96,7 +96,7 @@ def test_package_lock_reports_malformed_entry(self): def test_package_lock_rejects_unexpected_pacman_output(self): with tempfile.NamedTemporaryFile("w", delete=False) as lock: - lock.write("example-package=1.2.3,expected-hash\n") + lock.write("example-package=1.2.3,UNVERIFIED-NO-SIGNED-SNAPSHOT\n") lock_path = lock.name try: completed = mock.Mock(returncode=0, stdout="warning only\n") @@ -107,6 +107,18 @@ def test_package_lock_rejects_unexpected_pacman_output(self): finally: os.unlink(lock_path) + def test_package_lock_rejects_unverified_real_hash(self): + with tempfile.NamedTemporaryFile("w", delete=False) as lock: + lock.write("example-package=1.2.3,abc123\n") + lock_path = lock.name + try: + completed = mock.Mock(returncode=0, stdout="example-package 1.2.3\n") + with mock.patch.object(validator.subprocess, "run", return_value=completed): + _verified, failures = validator.verify_package_lock(lock_path) + self.assertIn("hash verification is not implemented", failures[0]) + finally: + os.unlink(lock_path) + def test_require_payload_rejects_missing_root(self): with mock.patch.object(sys, "argv", ["validator", "--require-payload"]): with contextlib.redirect_stdout(io.StringIO()): diff --git a/ci/validate_arm64_architecture.py b/ci/validate_arm64_architecture.py index 94fb568a5..2c1c989bf 100644 --- a/ci/validate_arm64_architecture.py +++ b/ci/validate_arm64_architecture.py @@ -203,7 +203,14 @@ def verify_package_lock(path): failures.append("Malformed package lock entry: %s" % entry) continue package, remainder = entry.split("=", 1) - expected_version, expected_sha256 = remainder.split(",", 1) + expected_version, expected_sha256 = ( + value.strip() for value in remainder.split(",", 1) + ) + if expected_sha256 != "UNVERIFIED-NO-SIGNED-SNAPSHOT": + failures.append( + "Package archive hash verification is not implemented for %s: %s" + % (package, expected_sha256) + ) try: completed = subprocess.run( ["pacman", "-Q", package], From 5035d8d1bd5c0e8a55a4077612ed375f06ccbdd1 Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 12:04:56 +0000 Subject: [PATCH 11/23] Harden Arm64 package inputs Install exact package versions from the lock and reject unsafe package names before invoking pacman. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ci.yml | 6 +++--- ci/test_validate_arm64_architecture.py | 11 +++++++++++ ci/validate_arm64_architecture.py | 6 +++++- 3 files changed, 19 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 38fe1c1ac..ec9efff61 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -173,11 +173,11 @@ jobs: msystem: CLANGARM64 update: true - - name: Install locked CLANGARM64 packages + - name: Install exact CLANGARM64 package versions shell: msys2 {0} run: | - mapfile -t packages < <(sed -n '/^[^#[:space:]][^=]*=/s/=.*//p' ci/windows-arm64-packages.lock) - pacman --noconfirm -S --needed "${packages[@]}" + mapfile -t packages < <(sed -n '/^[^#[:space:]][^=]*=/s/,[^,]*$//p' ci/windows-arm64-packages.lock) + pacman --noconfirm -S --needed -- "${packages[@]}" - name: Build (CLANGARM64, presubmit only) shell: msys2 {0} diff --git a/ci/test_validate_arm64_architecture.py b/ci/test_validate_arm64_architecture.py index 23c2479c6..3eacab5ff 100644 --- a/ci/test_validate_arm64_architecture.py +++ b/ci/test_validate_arm64_architecture.py @@ -94,6 +94,17 @@ def test_package_lock_reports_malformed_entry(self): finally: os.unlink(lock_path) + def test_package_lock_rejects_unsafe_package_name(self): + with tempfile.NamedTemporaryFile("w", delete=False) as lock: + lock.write("-unsafe=1.2.3,UNVERIFIED-NO-SIGNED-SNAPSHOT\n") + lock_path = lock.name + try: + verified, failures = validator.verify_package_lock(lock_path) + self.assertEqual(verified, []) + self.assertEqual(failures, ["Invalid package name in lock: '-unsafe'"]) + finally: + os.unlink(lock_path) + def test_package_lock_rejects_unexpected_pacman_output(self): with tempfile.NamedTemporaryFile("w", delete=False) as lock: lock.write("example-package=1.2.3,UNVERIFIED-NO-SIGNED-SNAPSHOT\n") diff --git a/ci/validate_arm64_architecture.py b/ci/validate_arm64_architecture.py index 2c1c989bf..ba856cee1 100644 --- a/ci/validate_arm64_architecture.py +++ b/ci/validate_arm64_architecture.py @@ -40,6 +40,7 @@ import ctypes import json import os +import re import subprocess import struct import sys @@ -203,6 +204,9 @@ def verify_package_lock(path): failures.append("Malformed package lock entry: %s" % entry) continue package, remainder = entry.split("=", 1) + if not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9@._+:-]*", package): + failures.append("Invalid package name in lock: %r" % package) + continue expected_version, expected_sha256 = ( value.strip() for value in remainder.split(",", 1) ) @@ -213,7 +217,7 @@ def verify_package_lock(path): ) try: completed = subprocess.run( - ["pacman", "-Q", package], + ["pacman", "-Q", "--", package], capture_output=True, text=True, check=False, From a26673e530c669cd75c7f6d37e420c464ceb312c Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 12:22:36 +0000 Subject: [PATCH 12/23] Test against the matching audio PR branch Resolve the OpenShotAudio checkout from the pull-request head owner and ref so the Arm64 pipeline consumes PR A before it is merged, while preserving owner/ref fallback after merge. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ci.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ec9efff61..8cd0f11aa 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -158,7 +158,8 @@ jobs: - name: Checkout OpenShotAudio uses: actions/checkout@v4 with: - repository: OpenShot/libopenshot-audio + repository: ${{ github.event.pull_request.head.repo.owner.login || github.repository_owner }}/libopenshot-audio + ref: ${{ github.event.pull_request.head.ref || github.ref_name }} path: audio - name: Checkout Catch2 From 0fd940a42ec31a5866ef2ee912843b306fbd4f4d Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 12:39:08 +0000 Subject: [PATCH 13/23] Capture Arm64 Ninja parse context Print the bounded generated Ninja region only when the native libopenshot build fails, enabling diagnosis without changing normal builds. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ci.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8cd0f11aa..ebd64c881 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -207,7 +207,12 @@ jobs: -DCMAKE_INSTALL_PREFIX="$PWD/install-arm64" \ -DCMAKE_BUILD_TYPE=Release \ -DENABLE_LIB_DOCS=OFF - cmake --build build + if ! cmake --build build; then + echo "::group::Generated Ninja context around parse failure" + nl -ba build/build.ninja | sed -n '880,905p' + echo "::endgroup::" + exit 1 + fi ctest --test-dir build --output-on-failure -VV cmake --install build python -m unittest discover -s ci -p "test_*.py" -v From 27c8396f886a7f580f59bfa797ecd26e06252bfc Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 12:49:03 +0000 Subject: [PATCH 14/23] Fix per-test coverage targets for Ninja Mark ctest label commands VERBATIM so the regex end anchor is escaped correctly in generated Ninja files on Windows Arm64. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ci.yml | 7 +------ CMakeLists.txt | 1 + 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ebd64c881..8cd0f11aa 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -207,12 +207,7 @@ jobs: -DCMAKE_INSTALL_PREFIX="$PWD/install-arm64" \ -DCMAKE_BUILD_TYPE=Release \ -DENABLE_LIB_DOCS=OFF - if ! cmake --build build; then - echo "::group::Generated Ninja context around parse failure" - nl -ba build/build.ninja | sed -n '880,905p' - echo "::endgroup::" - exit 1 - fi + cmake --build build ctest --test-dir build --output-on-failure -VV cmake --install build python -m unittest discover -s ci -p "test_*.py" -v diff --git a/CMakeLists.txt b/CMakeLists.txt index 634784791..7a260acdf 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -291,6 +291,7 @@ if(DEFINED UNIT_TEST_TARGETS AND NOT TARGET coverage) DEPENDS openshot openshot-${_t}-test WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR} COMMENT "Running unit tests for ${_t} class (coverage disabled)" + VERBATIM ) endforeach() endif() From ab3365d14978658e9286826f27a45e6489741d8c Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 13:01:18 +0000 Subject: [PATCH 15/23] Support FFmpeg 8 and 9 codec capability queries Use avcodec_get_supported_config for modern libavcodec while preserving legacy fields, and correct channel-layout equality handling. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/FFmpegWriter.cpp | 62 +++++++++++++++++++++++++++++++++++--------- 1 file changed, 50 insertions(+), 12 deletions(-) diff --git a/src/FFmpegWriter.cpp b/src/FFmpegWriter.cpp index 4ae40ec50..34077e5db 100644 --- a/src/FFmpegWriter.cpp +++ b/src/FFmpegWriter.cpp @@ -1142,15 +1142,24 @@ AVStream *FFmpegWriter::add_audio_stream() { #endif // Set valid sample rate (or throw error) - if (codec->supported_samplerates) { + const int *supported_samplerates = nullptr; +#if LIBAVCODEC_VERSION_MAJOR >= 62 + const void *supported_samplerates_config = nullptr; + avcodec_get_supported_config(c, codec, AV_CODEC_CONFIG_SAMPLE_RATE, 0, + &supported_samplerates_config, nullptr); + supported_samplerates = static_cast(supported_samplerates_config); +#else + supported_samplerates = codec->supported_samplerates; +#endif + if (supported_samplerates) { int i; - for (i = 0; codec->supported_samplerates[i] != 0; i++) - if (info.sample_rate == codec->supported_samplerates[i]) { + for (i = 0; supported_samplerates[i] != 0; i++) + if (info.sample_rate == supported_samplerates[i]) { // Set the valid sample rate c->sample_rate = info.sample_rate; break; } - if (codec->supported_samplerates[i] == 0) + if (supported_samplerates[i] == 0) throw InvalidSampleRate("An invalid sample rate was detected for this codec.", path); } else // Set sample rate @@ -1164,15 +1173,25 @@ AVStream *FFmpegWriter::add_audio_stream() { // Set a valid number of channels (or throw error) AVChannelLayout ch_layout; av_channel_layout_from_mask(&ch_layout, info.channel_layout); - if (codec->ch_layouts) { + const AVChannelLayout *supported_channel_layouts = nullptr; +#if LIBAVCODEC_VERSION_MAJOR >= 62 + const void *supported_channel_layouts_config = nullptr; + avcodec_get_supported_config(c, codec, AV_CODEC_CONFIG_CHANNEL_LAYOUT, 0, + &supported_channel_layouts_config, nullptr); + supported_channel_layouts = + static_cast(supported_channel_layouts_config); +#else + supported_channel_layouts = codec->ch_layouts; +#endif + if (supported_channel_layouts) { int i; - for (i = 0; av_channel_layout_check(&codec->ch_layouts[i]); i++) - if (av_channel_layout_compare(&ch_layout, &codec->ch_layouts[i])) { + for (i = 0; av_channel_layout_check(&supported_channel_layouts[i]); i++) + if (av_channel_layout_compare(&ch_layout, &supported_channel_layouts[i]) == 0) { // Set valid channel layout av_channel_layout_copy(&c->ch_layout, &ch_layout); break; } - if (!av_channel_layout_check(&codec->ch_layouts[i])) + if (!av_channel_layout_check(&supported_channel_layouts[i])) throw InvalidChannels("An invalid channel layout was detected (i.e. MONO / STEREO).", path); } else // Set valid channel layout @@ -1195,10 +1214,20 @@ AVStream *FFmpegWriter::add_audio_stream() { #endif // Choose a valid sample_fmt - if (codec->sample_fmts) { - for (int i = 0; codec->sample_fmts[i] != AV_SAMPLE_FMT_NONE; i++) { + const AVSampleFormat *supported_sample_formats = nullptr; +#if LIBAVCODEC_VERSION_MAJOR >= 62 + const void *supported_sample_formats_config = nullptr; + avcodec_get_supported_config(c, codec, AV_CODEC_CONFIG_SAMPLE_FORMAT, 0, + &supported_sample_formats_config, nullptr); + supported_sample_formats = + static_cast(supported_sample_formats_config); +#else + supported_sample_formats = codec->sample_fmts; +#endif + if (supported_sample_formats) { + for (int i = 0; supported_sample_formats[i] != AV_SAMPLE_FMT_NONE; i++) { // Set sample format to 1st valid format (and then exit loop) - c->sample_fmt = codec->sample_fmts[i]; + c->sample_fmt = supported_sample_formats[i]; break; } } @@ -1401,7 +1430,16 @@ AVStream *FFmpegWriter::add_video_stream() { #endif // Find all supported pixel formats for this codec - const PixelFormat *supported_pixel_formats = codec->pix_fmts; + const PixelFormat *supported_pixel_formats = nullptr; +#if LIBAVCODEC_VERSION_MAJOR >= 62 + const void *supported_pixel_formats_config = nullptr; + avcodec_get_supported_config(c, codec, AV_CODEC_CONFIG_PIX_FORMAT, 0, + &supported_pixel_formats_config, nullptr); + supported_pixel_formats = + static_cast(supported_pixel_formats_config); +#else + supported_pixel_formats = codec->pix_fmts; +#endif while (supported_pixel_formats != NULL && *supported_pixel_formats != PIX_FMT_NONE) { // Assign the 1st valid pixel format (if one is missing) if (c->pix_fmt == PIX_FMT_NONE) From 042f77b15305a1c1cafd2dc2aea34f4376ced22a Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 13:12:41 +0000 Subject: [PATCH 16/23] Fix Windows Arm64 dependency linkage Build tracked-object support independently of OpenCV, accept OpenCV 5, link MagickCore explicitly, and keep test media paths CMake-style for Windows compiler definitions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/CMakeLists.txt | 7 +++++-- tests/CMakeLists.txt | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index 331ae405c..0ddb7d82e 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -92,6 +92,7 @@ set(OPENSHOT_SOURCES TimelineBase.cpp Timeline.cpp TrackedObjectBase.cpp + TrackedObjectBBox.cpp ZmqLogger.cpp ) @@ -117,7 +118,6 @@ set(OPENSHOT_CV_SOURCES ClipProcessingJobs.cpp CVObjectDetection.cpp CVObjectMask.cpp - TrackedObjectBBox.cpp effects/Stabilizer.cpp effects/Tracker.cpp effects/ObjectDetection.cpp @@ -281,6 +281,9 @@ if (ENABLE_MAGICK) # Link with ImageMagick library target_link_libraries(openshot PUBLIC ImageMagick::Magick++) + if(TARGET ImageMagick::MagickCore) + target_link_libraries(openshot PUBLIC ImageMagick::MagickCore) + endif() set(HAVE_IMAGEMAGICK TRUE CACHE BOOL "Building with ImageMagick support" FORCE) mark_as_advanced(HAVE_IMAGEMAGICK) @@ -541,7 +544,7 @@ endif () ################## OPENCV ################### if(ENABLE_OPENCV) - find_package(OpenCV 4) + find_package(OpenCV) if(NOT OpenCV_FOUND) set(ENABLE_OPENCV FALSE CACHE BOOL "Build with OpenCV algorithms (requires Protobuf 3)" FORCE) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 51a7cc860..7b365d64f 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -14,7 +14,7 @@ if(POLICY CMP0110) endif() # Test media path, used by unit tests for input data -file(TO_NATIVE_PATH "${PROJECT_SOURCE_DIR}/examples/" TEST_MEDIA_PATH) +file(TO_CMAKE_PATH "${PROJECT_SOURCE_DIR}/examples/" TEST_MEDIA_PATH) # Benchmark executable add_executable(openshot-benchmark Benchmark.cpp BenchmarkOptions.cpp) From 283d613e8f498157d12044b114e99f0b10fcdc97 Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 13:39:45 +0000 Subject: [PATCH 17/23] Add explicit OpenCV 5 module includes Include calib3d and imgproc where their APIs are used instead of relying on transitive headers removed by OpenCV 5. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/CVObjectMask.cpp | 1 + src/CVStabilization.cpp | 1 + src/effects/Stabilizer.cpp | 1 + 3 files changed, 3 insertions(+) diff --git a/src/CVObjectMask.cpp b/src/CVObjectMask.cpp index d977ec4fd..cf0c0323c 100644 --- a/src/CVObjectMask.cpp +++ b/src/CVObjectMask.cpp @@ -19,6 +19,7 @@ #define int64 int64_t #define uint64 uint64_t #include +#include #undef uint64 #undef int64 diff --git a/src/CVStabilization.cpp b/src/CVStabilization.cpp index 79a4890df..33676f1a1 100644 --- a/src/CVStabilization.cpp +++ b/src/CVStabilization.cpp @@ -20,6 +20,7 @@ #include "stabilizedata.pb.h" #include +#include using namespace std; using namespace openshot; diff --git a/src/effects/Stabilizer.cpp b/src/effects/Stabilizer.cpp index 998730fb7..90669a4e6 100644 --- a/src/effects/Stabilizer.cpp +++ b/src/effects/Stabilizer.cpp @@ -20,6 +20,7 @@ #include "stabilizedata.pb.h" #include +#include using namespace std; using namespace openshot; From 0c85a95ed70d9272fdadc48b275f418ee37b3b52 Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 21:52:38 +0800 Subject: [PATCH 18/23] Support OpenCV 5 geometry headers Use version-specific geometry module headers while preserving the existing OpenCV integer typedef workaround and OpenCV 4 compatibility. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/CVObjectMask.cpp | 4 ++++ src/CVStabilization.cpp | 9 +++++++++ src/effects/Stabilizer.cpp | 9 +++++++++ 3 files changed, 22 insertions(+) diff --git a/src/CVObjectMask.cpp b/src/CVObjectMask.cpp index cf0c0323c..896e9875c 100644 --- a/src/CVObjectMask.cpp +++ b/src/CVObjectMask.cpp @@ -19,7 +19,11 @@ #define int64 int64_t #define uint64 uint64_t #include +#if CV_VERSION_MAJOR >= 5 +#include +#else #include +#endif #undef uint64 #undef int64 diff --git a/src/CVStabilization.cpp b/src/CVStabilization.cpp index 33676f1a1..548035adc 100644 --- a/src/CVStabilization.cpp +++ b/src/CVStabilization.cpp @@ -20,7 +20,16 @@ #include "stabilizedata.pb.h" #include + +#if CV_VERSION_MAJOR >= 5 +#define int64 opencv_broken_int +#define uint64 opencv_broken_uint +#include +#undef uint64 +#undef int64 +#else #include +#endif using namespace std; using namespace openshot; diff --git a/src/effects/Stabilizer.cpp b/src/effects/Stabilizer.cpp index 90669a4e6..3a1de1977 100644 --- a/src/effects/Stabilizer.cpp +++ b/src/effects/Stabilizer.cpp @@ -20,7 +20,16 @@ #include "stabilizedata.pb.h" #include + +#if CV_VERSION_MAJOR >= 5 +#define int64 opencv_broken_int +#define uint64 opencv_broken_uint +#include +#undef uint64 +#undef int64 +#else #include +#endif using namespace std; using namespace openshot; From a9d05c87f53792f2a06a4d3c14f38052917ee5e1 Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 22:04:26 +0800 Subject: [PATCH 19/23] Use lean Windows headers in Arm64 oracle test Avoid COM IStream name collisions between the full Windows SDK surface and Catch2. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- tests/NativeArm64ProcessOracle.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tests/NativeArm64ProcessOracle.cpp b/tests/NativeArm64ProcessOracle.cpp index 5c771df15..f18bffc88 100644 --- a/tests/NativeArm64ProcessOracle.cpp +++ b/tests/NativeArm64ProcessOracle.cpp @@ -16,6 +16,12 @@ #include #if defined(_WIN32) +#ifndef WIN32_LEAN_AND_MEAN +#define WIN32_LEAN_AND_MEAN +#endif +#ifndef NOMINMAX +#define NOMINMAX +#endif #include #endif From cc21ce1e04c9b1ad297e669f822680e52a51aeee Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 14:21:54 +0000 Subject: [PATCH 20/23] Preserve the test media path separator Keep a forward trailing slash after Windows path normalization so tests that append fixture names resolve the examples directory correctly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- tests/CMakeLists.txt | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 7b365d64f..77255eb89 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -15,6 +15,9 @@ endif() # Test media path, used by unit tests for input data file(TO_CMAKE_PATH "${PROJECT_SOURCE_DIR}/examples/" TEST_MEDIA_PATH) +if(NOT TEST_MEDIA_PATH MATCHES "/$") + string(APPEND TEST_MEDIA_PATH "/") +endif() # Benchmark executable add_executable(openshot-benchmark Benchmark.cpp BenchmarkOptions.cpp) From 1db53a17c43e716c1b3fc131be694706a3cb5124 Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 14:42:02 +0000 Subject: [PATCH 21/23] Use a portable ObjectMask test path Replace the Unix-only mkstemp helper with the C++17 temporary directory API for Windows Arm64 test execution. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- tests/ObjectMask.cpp | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/tests/ObjectMask.cpp b/tests/ObjectMask.cpp index 8b6432e5a..20acf0d2c 100644 --- a/tests/ObjectMask.cpp +++ b/tests/ObjectMask.cpp @@ -23,11 +23,12 @@ #include #include +#include #include #include +#include #include #include -#include using namespace openshot; @@ -38,12 +39,10 @@ static std::shared_ptr make_object_mask_frame(int64_t number, int width, } static std::string temp_object_mask_path() { - char path[] = "/tmp/libopenshot_object_mask_XXXXXX"; - int fd = mkstemp(path); - REQUIRE(fd != -1); - close(fd); - std::remove(path); - return std::string(path) + ".data"; + auto unique = std::chrono::steady_clock::now().time_since_epoch().count(); + auto path = std::filesystem::temp_directory_path() + / ("libopenshot_object_mask_" + std::to_string(unique) + ".data"); + return path.string(); } static void append_varint(std::string& output, uint64_t value) { From 25eddad4f3c9d1b9e02e89266cd7ebaf04df7c8c Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 14:49:35 +0000 Subject: [PATCH 22/23] Harden OpenCV selection and test temp paths Support OpenCV 5 with a 4.3 minimum fallback and generate collision-resistant ObjectMask test paths portably. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/CMakeLists.txt | 5 ++++- tests/ObjectMask.cpp | 15 ++++++++++----- 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index 0ddb7d82e..3605d3f77 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -544,7 +544,10 @@ endif () ################## OPENCV ################### if(ENABLE_OPENCV) - find_package(OpenCV) + find_package(OpenCV 5 QUIET) + if(NOT OpenCV_FOUND) + find_package(OpenCV 4.3) + endif() if(NOT OpenCV_FOUND) set(ENABLE_OPENCV FALSE CACHE BOOL "Build with OpenCV algorithms (requires Protobuf 3)" FORCE) diff --git a/tests/ObjectMask.cpp b/tests/ObjectMask.cpp index 20acf0d2c..1b4f593ba 100644 --- a/tests/ObjectMask.cpp +++ b/tests/ObjectMask.cpp @@ -23,12 +23,13 @@ #include #include -#include #include #include #include #include #include +#include +#include using namespace openshot; @@ -39,10 +40,14 @@ static std::shared_ptr make_object_mask_frame(int64_t number, int width, } static std::string temp_object_mask_path() { - auto unique = std::chrono::steady_clock::now().time_since_epoch().count(); - auto path = std::filesystem::temp_directory_path() - / ("libopenshot_object_mask_" + std::to_string(unique) + ".data"); - return path.string(); + std::random_device random; + for (int attempt = 0; attempt < 16; ++attempt) { + auto path = std::filesystem::temp_directory_path() + / ("libopenshot_object_mask_" + std::to_string(random()) + ".data"); + if (!std::filesystem::exists(path)) + return path.string(); + } + throw std::runtime_error("Unable to allocate a unique ObjectMask test path"); } static void append_varint(std::string& output, uint64_t value) { From 29e8bedfbdb600792b114676bb42681b35876adc Mon Sep 17 00:00:00 2001 From: "Gordon Lam (SH) (from Dev Box)" Date: Fri, 28 Aug 2026 15:07:25 +0000 Subject: [PATCH 23/23] Use bounded FFmpeg capability arrays Honor avcodec_get_supported_config counts on FFmpeg 8/9 and reserve ObjectMask temporary files atomically with QTemporaryFile. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/FFmpegWriter.cpp | 53 +++++++++++++++++++++++++++----------------- tests/ObjectMask.cpp | 20 ++++++++--------- 2 files changed, 43 insertions(+), 30 deletions(-) diff --git a/src/FFmpegWriter.cpp b/src/FFmpegWriter.cpp index 34077e5db..64c3800ec 100644 --- a/src/FFmpegWriter.cpp +++ b/src/FFmpegWriter.cpp @@ -1143,23 +1143,28 @@ AVStream *FFmpegWriter::add_audio_stream() { // Set valid sample rate (or throw error) const int *supported_samplerates = nullptr; + int supported_samplerate_count = 0; #if LIBAVCODEC_VERSION_MAJOR >= 62 const void *supported_samplerates_config = nullptr; avcodec_get_supported_config(c, codec, AV_CODEC_CONFIG_SAMPLE_RATE, 0, - &supported_samplerates_config, nullptr); + &supported_samplerates_config, &supported_samplerate_count); supported_samplerates = static_cast(supported_samplerates_config); #else supported_samplerates = codec->supported_samplerates; + if (supported_samplerates) + while (supported_samplerates[supported_samplerate_count] != 0) + ++supported_samplerate_count; #endif if (supported_samplerates) { - int i; - for (i = 0; supported_samplerates[i] != 0; i++) + bool sample_rate_supported = false; + for (int i = 0; i < supported_samplerate_count; ++i) if (info.sample_rate == supported_samplerates[i]) { // Set the valid sample rate c->sample_rate = info.sample_rate; + sample_rate_supported = true; break; } - if (supported_samplerates[i] == 0) + if (!sample_rate_supported) throw InvalidSampleRate("An invalid sample rate was detected for this codec.", path); } else // Set sample rate @@ -1174,24 +1179,30 @@ AVStream *FFmpegWriter::add_audio_stream() { AVChannelLayout ch_layout; av_channel_layout_from_mask(&ch_layout, info.channel_layout); const AVChannelLayout *supported_channel_layouts = nullptr; + int supported_channel_layout_count = 0; #if LIBAVCODEC_VERSION_MAJOR >= 62 const void *supported_channel_layouts_config = nullptr; avcodec_get_supported_config(c, codec, AV_CODEC_CONFIG_CHANNEL_LAYOUT, 0, - &supported_channel_layouts_config, nullptr); + &supported_channel_layouts_config, &supported_channel_layout_count); supported_channel_layouts = static_cast(supported_channel_layouts_config); #else supported_channel_layouts = codec->ch_layouts; + if (supported_channel_layouts) + while (av_channel_layout_check( + &supported_channel_layouts[supported_channel_layout_count])) + ++supported_channel_layout_count; #endif if (supported_channel_layouts) { - int i; - for (i = 0; av_channel_layout_check(&supported_channel_layouts[i]); i++) + bool channel_layout_supported = false; + for (int i = 0; i < supported_channel_layout_count; ++i) if (av_channel_layout_compare(&ch_layout, &supported_channel_layouts[i]) == 0) { // Set valid channel layout av_channel_layout_copy(&c->ch_layout, &ch_layout); + channel_layout_supported = true; break; } - if (!av_channel_layout_check(&supported_channel_layouts[i])) + if (!channel_layout_supported) throw InvalidChannels("An invalid channel layout was detected (i.e. MONO / STEREO).", path); } else // Set valid channel layout @@ -1215,22 +1226,21 @@ AVStream *FFmpegWriter::add_audio_stream() { // Choose a valid sample_fmt const AVSampleFormat *supported_sample_formats = nullptr; + int supported_sample_format_count = 0; #if LIBAVCODEC_VERSION_MAJOR >= 62 const void *supported_sample_formats_config = nullptr; avcodec_get_supported_config(c, codec, AV_CODEC_CONFIG_SAMPLE_FORMAT, 0, - &supported_sample_formats_config, nullptr); + &supported_sample_formats_config, &supported_sample_format_count); supported_sample_formats = static_cast(supported_sample_formats_config); #else supported_sample_formats = codec->sample_fmts; + if (supported_sample_formats) + while (supported_sample_formats[supported_sample_format_count] != AV_SAMPLE_FMT_NONE) + ++supported_sample_format_count; #endif - if (supported_sample_formats) { - for (int i = 0; supported_sample_formats[i] != AV_SAMPLE_FMT_NONE; i++) { - // Set sample format to 1st valid format (and then exit loop) - c->sample_fmt = supported_sample_formats[i]; - break; - } - } + if (supported_sample_formats && supported_sample_format_count > 0) + c->sample_fmt = supported_sample_formats[0]; if (c->sample_fmt == AV_SAMPLE_FMT_NONE) { // Default if no sample formats found c->sample_fmt = AV_SAMPLE_FMT_S16; @@ -1431,20 +1441,23 @@ AVStream *FFmpegWriter::add_video_stream() { // Find all supported pixel formats for this codec const PixelFormat *supported_pixel_formats = nullptr; + int supported_pixel_format_count = 0; #if LIBAVCODEC_VERSION_MAJOR >= 62 const void *supported_pixel_formats_config = nullptr; avcodec_get_supported_config(c, codec, AV_CODEC_CONFIG_PIX_FORMAT, 0, - &supported_pixel_formats_config, nullptr); + &supported_pixel_formats_config, &supported_pixel_format_count); supported_pixel_formats = static_cast(supported_pixel_formats_config); #else supported_pixel_formats = codec->pix_fmts; + if (supported_pixel_formats) + while (supported_pixel_formats[supported_pixel_format_count] != PIX_FMT_NONE) + ++supported_pixel_format_count; #endif - while (supported_pixel_formats != NULL && *supported_pixel_formats != PIX_FMT_NONE) { + for (int i = 0; supported_pixel_formats && i < supported_pixel_format_count; ++i) { // Assign the 1st valid pixel format (if one is missing) if (c->pix_fmt == PIX_FMT_NONE) - c->pix_fmt = *supported_pixel_formats; - ++supported_pixel_formats; + c->pix_fmt = supported_pixel_formats[i]; } // Codec doesn't have any pix formats? diff --git a/tests/ObjectMask.cpp b/tests/ObjectMask.cpp index 1b4f593ba..b7a277b4e 100644 --- a/tests/ObjectMask.cpp +++ b/tests/ObjectMask.cpp @@ -25,12 +25,13 @@ #include #include -#include #include #include -#include #include +#include +#include + using namespace openshot; static std::shared_ptr make_object_mask_frame(int64_t number, int width, int height) { @@ -40,14 +41,13 @@ static std::shared_ptr make_object_mask_frame(int64_t number, int width, } static std::string temp_object_mask_path() { - std::random_device random; - for (int attempt = 0; attempt < 16; ++attempt) { - auto path = std::filesystem::temp_directory_path() - / ("libopenshot_object_mask_" + std::to_string(random()) + ".data"); - if (!std::filesystem::exists(path)) - return path.string(); - } - throw std::runtime_error("Unable to allocate a unique ObjectMask test path"); + QTemporaryFile file(QDir::tempPath() + "/libopenshot_object_mask_XXXXXX.data"); + file.setAutoRemove(false); + if (!file.open()) + throw std::runtime_error("Unable to reserve a unique ObjectMask test path"); + const std::string path = file.fileName().toStdString(); + file.close(); + return path; } static void append_varint(std::string& output, uint64_t value) {