Skip to content

Commit f7ec675

Browse files
miguel-heygenmiguel-heygen
committed
fix(aws-lambda): link GnuTLS dynamically in the arm64 ffmpeg build
With --static pkg-config flags, gnutls.pc names a libgmp.a from its own RPM build tree and configure rejected GnuTLS. The codec libraries exist only as static archives, so they still link statically. The recipe moves to image/, which will also hold the video function image stage.
1 parent 6f55484 commit f7ec675

5 files changed

Lines changed: 12 additions & 10 deletions

File tree

‎.github/workflows/lambda-ffmpeg.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ permissions:
88
on:
99
pull_request:
1010
paths:
11-
- "packages/aws-lambda/ffmpeg/**"
11+
- "packages/aws-lambda/image/**"
1212
- ".github/workflows/lambda-ffmpeg.yml"
1313
workflow_dispatch:
1414

@@ -29,7 +29,7 @@ jobs:
2929
- name: Build and check
3030
run: >-
3131
docker buildx build --progress=plain --platform linux/arm64 --target artifact
32-
--output type=local,dest=out packages/aws-lambda/ffmpeg
32+
--output type=local,dest=out packages/aws-lambda/image
3333
- run: cat out/hf-media-check.txt && sha256sum out/*.tar.gz
3434
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
3535
with:

packages/aws-lambda/ffmpeg/Dockerfile renamed to packages/aws-lambda/image/Dockerfile

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
# Native ffmpeg for the Lambda video function, built on the Lambda Node 22 base it runs on:
2-
# docker buildx build --platform linux/arm64 --target artifact --output type=local,dest=out packages/aws-lambda/ffmpeg
1+
# The arm64 Lambda video function's native ffmpeg, built on the Lambda Node 22 base it runs on:
2+
# docker buildx build --platform linux/arm64 --target artifact --output type=local,dest=out packages/aws-lambda/image
33
# The artifact stage depends on the check stage, so no tarball comes out of a build whose codecs fail.
44
ARG BASE=public.ecr.aws/lambda/nodejs:22@sha256:d138eff445f6ea04c51091d8e6cbb064d5663e850cddfa62396061586f98b126
55

@@ -10,8 +10,8 @@ RUN rpm -qa --qf '%{NAME}\n' | sort >/build-base-rpms.txt && \
1010
gcc gcc-c++ make cmake meson ninja-build autoconf automake libtool pkgconf-pkg-config diffutils \
1111
git xz bzip2 tar gzip which patchelf gnutls-devel zlib-devel $([ "$(uname -m)" = x86_64 ] && echo nasm) && \
1212
microdnf clean all && mkdir /build && mv /build-base-rpms.txt /build/base-rpms.txt
13-
COPY sources.txt build.sh /build/
14-
RUN bash /build/build.sh
13+
COPY sources.txt build-ffmpeg.sh /build/
14+
RUN bash /build/build-ffmpeg.sh
1515

1616
FROM ${BASE} AS certs
1717
# certtool, not openssl: the base's openssl-libs cannot run the repo's openssl CLI.
@@ -26,8 +26,8 @@ RUN microdnf install -y --nodocs --releasever=2023.12.20260914 gnutls-utils && m
2626
FROM ${BASE} AS check
2727
COPY --from=build /opt/hf-media /opt/hf-media
2828
COPY --from=certs /certs /certs
29-
COPY check.sh /check.sh
30-
RUN cp /certs/ca.crt /etc/pki/ca-trust/source/anchors/ && update-ca-trust && bash /check.sh >/check.txt
29+
COPY check-ffmpeg.sh /check-ffmpeg.sh
30+
RUN cp /certs/ca.crt /etc/pki/ca-trust/source/anchors/ && update-ca-trust && bash /check-ffmpeg.sh >/check.txt
3131

3232
FROM scratch AS artifact
3333
COPY --from=build /out/ /

packages/aws-lambda/ffmpeg/build.sh renamed to packages/aws-lambda/image/build-ffmpeg.sh

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -58,8 +58,10 @@ ninja -C "$SRC/dav1d-build" install
5858
license dav1d "$SRC/dav1d-1.5.1/COPYING"
5959

6060
fetch ffmpeg-7.0.2.tar.xz
61-
(cd "$SRC/ffmpeg-7.0.2" && ./configure --prefix="$PREFIX" --pkg-config-flags=--static \
62-
--extra-cflags="-I$DEPS/include" --extra-ldflags="-L$DEPS/lib" --extra-libs="-lstdc++ -lpthread -lm" \
61+
# No --static pkg-config: gnutls.pc then names a libgmp.a from its own RPM build tree. The deps above
62+
# exist only as .a, so they link statically anyway; --extra-libs carries their private libraries.
63+
(cd "$SRC/ffmpeg-7.0.2" && ./configure --prefix="$PREFIX" \
64+
--extra-cflags="-I$DEPS/include" --extra-ldflags="-L$DEPS/lib" --extra-libs="-lstdc++ -lpthread -lm -ldl" \
6365
--enable-gpl --enable-version3 --disable-debug --disable-doc --disable-ffplay --disable-autodetect \
6466
--enable-gnutls --enable-zlib --enable-libx264 --enable-libx265 --enable-libvpx --enable-libopus \
6567
--enable-libzimg --enable-libdav1d && make -j"$JOBS" && make install)

packages/aws-lambda/ffmpeg/check.sh renamed to packages/aws-lambda/image/check-ffmpeg.sh

File renamed without changes.

packages/aws-lambda/ffmpeg/sources.txt renamed to packages/aws-lambda/image/sources.txt

File renamed without changes.

0 commit comments

Comments
 (0)