fix(windows): 固定可复现的 FFmpeg 发布源

1) 目标与背景：修复 Windows Release 因 BtbN 每日构建资产被清理而返回 404、无法打包的问题。
2) 文件与行为：将 FFmpeg 运行时切换到固定版本 DevEnvy LGPL NuGet 包，更新下载、解包、清单、运行时身份、发布校验、许可证说明和打包契约。
3) 影响与兼容性：仅影响 Windows x64 内置 FFmpeg 的来源与受控文件哈希；继续提供 ffmpeg/ffprobe 和同名共享库，不改变应用调用边界。
4) 验证结果：Windows governance、traceability、CI contract、packaging contract、credential scanner 全部通过；PowerShell 真机下载与安装包构建交由 GitHub Windows runner 继续验证。

Co-authored-by: OpenAI Codex <codex@openai.com>

Author: xingbofeng

VoxFlow.Windows/THIRD-PARTY-NOTICES.md

@@ -9,7 +9,7 @@ Windows installer.
 | Component | Source | License | Distribution rule |
 | --- | --- | --- | --- |
 | antirez/qwen-asr | https://github.com/antirez/qwen-asr | MIT | Pin an audited revision, preserve its copyright and MIT license, and record local patches in `native/qwen-asr/UPSTREAM.md`. |
-| FFmpeg `n8.1.2-22-g94138f6973-20260710` | https://github.com/BtbN/FFmpeg-Builds/releases/tag/autobuild-2026-07-10-13-44 and https://github.com/FFmpeg/FFmpeg/commit/94138f6973 | LGPL-3.0-or-later build | Ship the reviewed `win64-lgpl-shared-8.1` executables and shared libraries together, preserve `LICENSE.txt`, publish the corresponding FFmpeg source, build configuration, file sizes, and SHA-256 values, and never replace the package with a GPL/nonfree variant or a PATH executable. |
+| DevEnvy FFmpeg `8.0.1.4` | https://www.nuget.org/packages/DevEnvy.FFmpeg.Binaries.LGPL/8.0.1.4 | LGPL-2.1-or-later build | Ship only the reviewed Windows x64 CLI executables and shared libraries, preserve `THIRD_PARTY_NOTICES.md`, retain the immutable NuGet package URL, file sizes, and SHA-256 values, and never replace the package with a GPL/nonfree variant or a PATH executable. |
 | VoxFlow Agent sidecar | This repository, `agent-cli/` | MIT component within the GPL-3.0-or-later VoxFlow distribution | Preserve the crate's declared MIT terms and the project GPL license. Build only the locked `builtin-agent` feature for `x86_64-pc-windows-msvc` with static CRT; stage it at `runtime/agent/`, record source revision/size/SHA-256, and never discover a replacement through PATH. |
 | Tesseract `5.5.2` | https://github.com/tesseract-ocr/tesseract/tree/5.5.2 | Apache-2.0 | Build only from the reviewed source on Windows x64/MSVC with vcpkg baseline `03e366fb91e38b9432ebd5f8cc79f7c8f55e96ab` and triplet `x64-windows-static`; preserve the 11,358-byte Apache license and stage only a hash-verified `runtime/ocr/` payload. |
 | tessdata_fast `87416418657359cb625c412a48b6e1d6d41c29bd` | https://github.com/tesseract-ocr/tessdata_fast/tree/87416418657359cb625c412a48b6e1d6d41c29bd | Apache-2.0 | Ship only `eng`, `chi_sim`, `chi_tra`, `jpn`, and `kor`, each with the fixed size/SHA-256 in `TESSERACT_RUNTIME_MANIFEST.json`; do not locate additional system data or models through PATH. |
@@ -49,15 +49,12 @@ license. The release gate requires the exact dependency names, versions,
 source URLs, license expressions, notice paths, file sizes, and SHA-256 values;
 an added, removed, or modified native input fails packaging.
 
-The FFmpeg archive is
-`ffmpeg-n8.1.2-22-g94138f6973-win64-lgpl-shared-8.1.zip`, GitHub asset
-`472524907`, with SHA-256
-`cd39114d50ad2d17d892571d896f67fbe8b25333958682430f095eeffbb58598`.
-It is built for `x86_64-w64-mingw32` with `--enable-shared`,
-`--disable-static`, `--disable-libx264`, `--disable-libx265`,
-`--disable-libxvid`, and without `--enable-gpl` or `--enable-nonfree`.
-The package reports GNU Lesser General Public License version 3. The exact
-runtime inventory and build provenance are in `runtime/ffmpeg/`.
+The FFmpeg archive is the immutable NuGet package
+`devenvy.ffmpeg.binaries.lgpl.8.0.1.4.nupkg`, with SHA-256
+`d80010128975b46e1b2b74505c464250a3413e23681cc331c6943a9cf1046fda`.
+The package declares LGPL-2.1-or-later and documents `--disable-gpl`,
+`--disable-nonfree`, `--enable-shared`, and `--disable-static`. The exact
+Windows x64 runtime inventory and build provenance are in `runtime/ffmpeg/`.
 
 ## Agent sidecar Cargo runtime inventory
 

VoxFlow.Windows/runtime/ffmpeg/FFMPEG_RUNTIME_MANIFEST.json

@@ -1,29 +1,30 @@
 {
   "schemaVersion": 1,
-  "runtimeId": "ffmpeg-n8.1.2-22-g94138f6973-20260710-win64-lgpl-shared",
+  "runtimeId": "devenvy-ffmpeg-lgpl-8.0.1.4-win-x64",
   "architecture": "x64",
-  "license": "LGPL-3.0-or-later",
+  "license": "LGPL-2.1-or-later",
   "licenseFile": {
-    "path": "LICENSE.txt",
-    "size": 7651,
-    "sha256": "da7eabb7bafdf7d3ae5e9f223aa5bdc1eece45ac569dc21b3b037520b4464768"
+    "path": "THIRD_PARTY_NOTICES.md",
+    "size": 2174,
+    "sha256": "39d65c5952106502f000d66c41c3bd23d2c0550a8c3270bb224c7642b3cccf9e"
   },
   "archive": {
-    "fileName": "ffmpeg-n8.1.2-22-g94138f6973-win64-lgpl-shared-8.1.zip",
-    "size": 70508421,
-    "sha256": "cd39114d50ad2d17d892571d896f67fbe8b25333958682430f095eeffbb58598",
-    "assetId": 472524907,
-    "releaseTag": "autobuild-2026-07-10-13-44"
+    "fileName": "devenvy.ffmpeg.binaries.lgpl.8.0.1.4.nupkg",
+    "size": 195504127,
+    "sha256": "d80010128975b46e1b2b74505c464250a3413e23681cc331c6943a9cf1046fda",
+    "downloadUrl": "https://api.nuget.org/v3-flatcontainer/devenvy.ffmpeg.binaries.lgpl/8.0.1.4/devenvy.ffmpeg.binaries.lgpl.8.0.1.4.nupkg",
+    "runtimePath": "ffmpeg/win-x64",
+    "noticePath": "THIRD_PARTY_NOTICES.md"
   },
   "files": [
-    { "path": "avcodec-62.dll", "size": 70881792, "sha256": "06f15c16294f59d6ae63279443f59c32c11c682975b4c90fccc09295a37b295f" },
-    { "path": "avdevice-62.dll", "size": 3699712, "sha256": "93e150e2e8e8107deb5c17e652691da65d5ab5a56740edc957485ca029ce11f0" },
-    { "path": "avfilter-11.dll", "size": 29816320, "sha256": "5086c95910729913ebb0c812d63ace8060c99513e644dfaa09c46675ddf57180" },
-    { "path": "avformat-62.dll", "size": 22070784, "sha256": "3d61acda2f552e40cbb706e32c0d2bbf3bd4e71cd98677f1ed33a90e23c9be00" },
-    { "path": "avutil-60.dll", "size": 2937856, "sha256": "efe39d566fe0dcaab6edc3921efbefb582000ccb65ad32ee4ad10b07839ed3e9" },
-    { "path": "ffmpeg.exe", "size": 542208, "sha256": "150a59fcec879bc7b4c084afa51657e0dec29257a81cc01fd3595b6fe917367a" },
-    { "path": "ffprobe.exe", "size": 227840, "sha256": "86427747d48175c22485950dbfee4e883912df583f0986e0070ac7cff9c9f823" },
-    { "path": "swresample-6.dll", "size": 723968, "sha256": "8d03a589f26f038585ffc2cf3fb4f1f2aa88f024584029c5aa1f4c94d8fe250d" },
-    { "path": "swscale-9.dll", "size": 12570624, "sha256": "6c3a0f0b2b7fbe5e1ac293856c03cd20dd2bbc0946542f4a53945c0aec556d16" }
+    { "path": "avcodec-62.dll", "size": 19073024, "sha256": "2329808efd0bc8e9a0503ccf6bb49a18d8f0f082e83db85dee664ea6a49feca0" },
+    { "path": "avdevice-62.dll", "size": 138240, "sha256": "22a273ce8fc48ba3a6ea3f7b1684c1072bb9a982022954a2989ba82ed7a40887" },
+    { "path": "avfilter-11.dll", "size": 5422592, "sha256": "2810c397ee3be9ca91b071eadeed1f7b34a7020e19287df976240b65268bfd7b" },
+    { "path": "avformat-62.dll", "size": 2689024, "sha256": "2473b92a50499f391a77f4fd3bad46510b39a90c5d84c77dd5693ee8707a9263" },
+    { "path": "avutil-60.dll", "size": 1583104, "sha256": "f449c41dafeaa9d79b9b79802addcd4a8c1ea7d98153b1731b8ecf290a507003" },
+    { "path": "ffmpeg.exe", "size": 448000, "sha256": "a485d921008bea1eb3923c17b64c16f9ac2231d57b41c49dc479a953fecfa867" },
+    { "path": "ffprobe.exe", "size": 209920, "sha256": "266a5b7da88ed1b81822c18888a3cc00bc372815982e056575f5a43ced55fd02" },
+    { "path": "swresample-6.dll", "size": 140288, "sha256": "97d61a29afa853e79418a39fb50ec9808732e066f06cea3daf9da8d58199603b" },
+    { "path": "swscale-9.dll", "size": 1750016, "sha256": "d5ee6dd71c6a6cc49140a0fbf6ffdaba33fed5dc9a8276ff3f6d792a905dccbc" }
   ]
 }

VoxFlow.Windows/runtime/ffmpeg/README.md

@@ -1,19 +1,17 @@
 # FFmpeg runtime provenance
 
-VoxFlow Windows locks FFmpeg to the BtbN release
-`autobuild-2026-07-10-13-44`, asset `472524907`:
+VoxFlow Windows locks FFmpeg to the immutable NuGet package
+`DevEnvy.FFmpeg.Binaries.LGPL` version `8.0.1.4`:
 
-- package: `ffmpeg-n8.1.2-22-g94138f6973-win64-lgpl-shared-8.1.zip`
-- FFmpeg version: `n8.1.2-22-g94138f6973-20260710`
-- FFmpeg source revision: `94138f6973`
-- target: `x86_64-w64-mingw32`
-- license reported by the package: LGPL version 3
+- package: `devenvy.ffmpeg.binaries.lgpl.8.0.1.4.nupkg`
+- FFmpeg version: `8.0.1`
+- target: Windows x64
+- license declared by the package: LGPL-2.1-or-later
 - package mode: shared libraries, not static linking
 
 Upstream URLs:
 
-- https://github.com/BtbN/FFmpeg-Builds/releases/tag/autobuild-2026-07-10-13-44
-- https://github.com/FFmpeg/FFmpeg/commit/94138f6973
+- https://www.nuget.org/packages/DevEnvy.FFmpeg.Binaries.LGPL/8.0.1.4
 - https://ffmpeg.org/legal.html
 
 The reviewed configuration enables shared libraries and disables static
@@ -23,7 +21,7 @@ codec integrations including libx264, libx265, and libxvid are disabled.
 startup and by release checks. `ffplay.exe` is intentionally excluded because
 VoxFlow uses NAudio for playback.
 
-Release packaging must include the package's unmodified `LICENSE.txt`, the
-corresponding FFmpeg source archive and build configuration link, and all nine
-manifested runtime files. The application may only resolve this directory; it
-must not search `PATH` or download a replacement.
+Release packaging must include the package's unmodified
+`THIRD_PARTY_NOTICES.md` and all nine manifested runtime files. The application
+may only resolve this directory; it must not search `PATH` or download a
+replacement.

VoxFlow.Windows/scripts/check-release-layout.ps1

@@ -317,25 +317,27 @@ $reviewedFfmpegManifestPath = Join-Path $windowsRoot 'runtime/ffmpeg/FFMPEG_RUNT
 $reviewedFfmpegManifestHash = (Get-FileHash -LiteralPath $reviewedFfmpegManifestPath -Algorithm SHA256).Hash.ToLowerInvariant()
 $publishedFfmpegManifestHash = (Get-FileHash -LiteralPath $ffmpegManifestPath -Algorithm SHA256).Hash.ToLowerInvariant()
 if ($reviewedFfmpegManifestHash -ne
-        '957ee658b3acbc8683c40131db499147c48e4d11cff745b15e332443798e1038' -or
+        'edcea9157fcb9789645879111299739d9da1bb1e4656bba1c0352740d84f5110' -or
     $publishedFfmpegManifestHash -ne $reviewedFfmpegManifestHash) {
     Fail 'The published FFmpeg manifest does not match the reviewed source manifest.'
 }
 $ffmpegManifest = Get-Content -LiteralPath $ffmpegManifestPath -Raw | ConvertFrom-Json
 if ($ffmpegManifest.schemaVersion -ne 1 -or
-    $ffmpegManifest.runtimeId -ne 'ffmpeg-n8.1.2-22-g94138f6973-20260710-win64-lgpl-shared' -or
+    $ffmpegManifest.runtimeId -ne 'devenvy-ffmpeg-lgpl-8.0.1.4-win-x64' -or
     $ffmpegManifest.architecture -ne 'x64' -or
-    $ffmpegManifest.license -ne 'LGPL-3.0-or-later' -or
-    $ffmpegManifest.archive.fileName -ne 'ffmpeg-n8.1.2-22-g94138f6973-win64-lgpl-shared-8.1.zip' -or
-    [long]$ffmpegManifest.archive.size -ne 70508421 -or
+    $ffmpegManifest.license -ne 'LGPL-2.1-or-later' -or
+    $ffmpegManifest.archive.fileName -ne 'devenvy.ffmpeg.binaries.lgpl.8.0.1.4.nupkg' -or
+    [long]$ffmpegManifest.archive.size -ne 195504127 -or
     $ffmpegManifest.archive.sha256 -ne
-        'cd39114d50ad2d17d892571d896f67fbe8b25333958682430f095eeffbb58598' -or
-    [long]$ffmpegManifest.archive.assetId -ne 472524907 -or
-    $ffmpegManifest.archive.releaseTag -ne 'autobuild-2026-07-10-13-44' -or
-    $ffmpegManifest.licenseFile.path -ne 'LICENSE.txt' -or
-    [long]$ffmpegManifest.licenseFile.size -ne 7651 -or
+        'd80010128975b46e1b2b74505c464250a3413e23681cc331c6943a9cf1046fda' -or
+    $ffmpegManifest.archive.downloadUrl -ne
+        'https://api.nuget.org/v3-flatcontainer/devenvy.ffmpeg.binaries.lgpl/8.0.1.4/devenvy.ffmpeg.binaries.lgpl.8.0.1.4.nupkg' -or
+    $ffmpegManifest.archive.runtimePath -ne 'ffmpeg/win-x64' -or
+    $ffmpegManifest.archive.noticePath -ne 'THIRD_PARTY_NOTICES.md' -or
+    $ffmpegManifest.licenseFile.path -ne 'THIRD_PARTY_NOTICES.md' -or
+    [long]$ffmpegManifest.licenseFile.size -ne 2174 -or
     $ffmpegManifest.licenseFile.sha256 -ne
-        'da7eabb7bafdf7d3ae5e9f223aa5bdc1eece45ac569dc21b3b037520b4464768') {
+        '39d65c5952106502f000d66c41c3bd23d2c0550a8c3270bb224c7642b3cccf9e') {
     Fail 'The published FFmpeg runtime identity or architecture changed.'
 }
 $reviewedFfmpegFilePaths = @(

VoxFlow.Windows/scripts/stage-ffmpeg-runtime.ps1

@@ -45,8 +45,7 @@ New-Item -ItemType Directory -Path $temporaryRoot -Force | Out-Null
 try {
     if ([string]::IsNullOrWhiteSpace($ArchivePath)) {
         $ArchivePath = Join-Path $temporaryRoot $manifest.archive.fileName
-        $url = "https://github.com/BtbN/FFmpeg-Builds/releases/download/$($manifest.archive.releaseTag)/$($manifest.archive.fileName)"
-        Invoke-WebRequest -Uri $url -OutFile $ArchivePath -UseBasicParsing -TimeoutSec 1800
+        Invoke-WebRequest -Uri $manifest.archive.downloadUrl -OutFile $ArchivePath -UseBasicParsing -TimeoutSec 1800
     }
     $resolvedArchive = (Resolve-Path -LiteralPath $ArchivePath).Path
     $archiveInfo = Get-Item -LiteralPath $resolvedArchive
@@ -59,13 +58,11 @@ try {
     }
 
     $expanded = Join-Path $temporaryRoot 'expanded'
-    Expand-Archive -LiteralPath $resolvedArchive -DestinationPath $expanded
-    $bin = Get-ChildItem -LiteralPath $expanded -Directory |
-        Select-Object -First 1 |
-        ForEach-Object { Join-Path $_.FullName 'bin' }
-    $license = Get-ChildItem -LiteralPath $expanded -Directory |
-        Select-Object -First 1 |
-        ForEach-Object { Join-Path $_.FullName 'LICENSE.txt' }
+    $expandableArchive = Join-Path $temporaryRoot 'ffmpeg-package.zip'
+    Copy-Item -LiteralPath $resolvedArchive -Destination $expandableArchive -Force
+    Expand-Archive -LiteralPath $expandableArchive -DestinationPath $expanded
+    $bin = Join-Path $expanded $manifest.archive.runtimePath
+    $license = Join-Path $expanded $manifest.archive.noticePath
     if (-not (Test-Path -LiteralPath $bin -PathType Container) -or
         -not (Test-Path -LiteralPath $license -PathType Leaf)) {
         throw 'The reviewed FFmpeg archive layout changed.'

VoxFlow.Windows/src/VoxFlow.Windows.Infrastructure/Media/FfmpegRuntimeVerifier.cs

@@ -45,7 +45,7 @@ public sealed class FfmpegRuntimeVerifier : IFfmpegRuntimeVerifier
 {
     public const string ManifestFileName = "FFMPEG_RUNTIME_MANIFEST.json";
     public const string ExpectedRuntimeId =
-        "ffmpeg-n8.1.2-22-g94138f6973-20260710-win64-lgpl-shared";
+        "devenvy-ffmpeg-lgpl-8.0.1.4-win-x64";
 
     private static readonly JsonSerializerOptions SerializerOptions = new()
     {

VoxFlow.Windows/tests/packaging-contract.test.sh

@@ -202,9 +202,10 @@ if grep -R -Fq --include='*.ps1' 'Start-Process' "${windows_root}/scripts"; then
   printf '%s\n' 'Release and governance scripts must not use unbounded Start-Process.' >&2
   exit 1
 fi
-grep -Fq 'cd39114d50ad2d17d892571d896f67fbe8b25333958682430f095eeffbb58598' \
+grep -Fq 'https://api.nuget.org/v3-flatcontainer/devenvy.ffmpeg.binaries.lgpl/' \
   "${windows_root}/runtime/ffmpeg/FFMPEG_RUNTIME_MANIFEST.json"
-ffmpeg_manifest_hash='957ee658b3acbc8683c40131db499147c48e4d11cff745b15e332443798e1038'
+grep -Fq '8.0.1.4' "${windows_root}/runtime/ffmpeg/FFMPEG_RUNTIME_MANIFEST.json"
+ffmpeg_manifest_hash='edcea9157fcb9789645879111299739d9da1bb1e4656bba1c0352740d84f5110'
 test "$(sha256sum "${windows_root}/runtime/ffmpeg/FFMPEG_RUNTIME_MANIFEST.json" | awk '{print $1}')" = \
   "${ffmpeg_manifest_hash}"
 grep -Fq "${ffmpeg_manifest_hash}" "${layout_check}"
@@ -218,7 +219,7 @@ for lf_path in \
   'scripts/patches/*.patch'; do
   grep -Fq "${lf_path} text eol=lf" "${windows_root}/.gitattributes"
 done
-grep -Fq 'da7eabb7bafdf7d3ae5e9f223aa5bdc1eece45ac569dc21b3b037520b4464768' \
+grep -Fq '39d65c5952106502f000d66c41c3bd23d2c0550a8c3270bb224c7642b3cccf9e' \
   "${windows_root}/runtime/ffmpeg/FFMPEG_RUNTIME_MANIFEST.json"
 
 printf '%s\n' 'PASS: Windows packaging source contract is per-user, x64-only, self-contained, license-complete, and has explicit data deletion.'