Fewer and sturdier downloads

[Dummgelaufen007]

This PR makes the download chain survive transient server errors and stops the default build from fetching fdk-aac, which it does not link. Three small fixes come along: a failed checksum names its file, cd no longer depends on how a glob sorts, and versions.json lists libfdk-aac only when it is linked. ffmpeg stays the same; the build just no longer does more than it is asked to.

Retries and timeouts

WGET_OPTS (L67) already retries host errors and some HTTP status codes. Two cases still end the build at once or stall it:

• A refused connection is fatal to wget unless --retry-connrefused is given.
• wget has no connect timeout by default: a server that does not accept the connection holds the step until the system gives up.

ARG WGET_OPTS="--tries=10 --connect-timeout=10 --retry-connrefused --retry-on-host-error --retry-on-http-error=429,500,502,503,504"

--connect-timeout=10 retries such a server after 10 s; --tries=10 bounds the attempts (wget's default is 20); 504 joins the retried status codes. See the wget download options.

The read timeout stays at wget's 900 s on purpose. wget runs the TLS handshake under it (openssl.c#n856), and a handshake that times out ends as "Unable to establish SSL connection", which wget treats as fatal and does not retry (http.c#n4484). A connect timeout is retried (http.c#n4432).

A failed checksum names its file

Six recipes run sha256sum --status -c - (glib L105, harfbuzz L124, cairo L139, pango L162, librsvg L179, vvenc L1062). With --status a mismatch prints nothing and the step just exits 1. Without it, coreutils sha256sum prints

glib.tar.xz: FAILED
sha256sum: WARNING: 1 computed checksum did NOT match

as all other recipes already do. libmodplug (L397) gets the - the others have; sha256sum -c reads stdin either way.

cd into the directory, not the archive

The RUN steps run in busybox ash. cd ffmpeg* (L1090) matches both ffmpeg-9.0.2 and ffmpeg.tar.bz2, cd libssh* (L664) both libssh-0.12.2 and libssh.tar.gz. ash takes the first match, which is the directory only because - sorts before .. ffmpeg-* and libssh-* match the directory alone; shine* (L599) becomes shine-* to follow the same pattern.

theora over https

THEORA_URL (L732) moves from http to https; the server delivers the same file, the checksum is unchanged. The archive is a .tar.gz and is now saved under that name instead of libtheora.tar.bz2; tar detected the format either way.

cairo from GitLab

CAIRO_URL (L135) points to cairographics.org, which has been failing since 2026-10-14: the TLS handshake is reset or never completes, so wget ends with "Unable to establish SSL connection", a fatal error it does not retry. Every CI run of this PR stopped there (run). The recipe now fetches the tag archive from the project's GitLab, where the bump line already points. Unpacked, it is identical to the release tarball (same 4949 files, diff -r empty); the archive is a .tar.gz, so it is saved as cairo.tar.gz and has a new checksum.

rav1e builds with its own Cargo.lock

The rav1e release archive ships a Cargo.lock. Without --locked, cargo may resolve and update it during the build, so the crates fetched can drift from the ones rav1e released with. With --locked (L556) cargo uses the lock file as it is and stops if it would have to change it (cargo --locked, passed through by cargo-c). All 85 crates the build downloads already carry the versions of the lock file, so the result is the same.

fdk-aac only when it is linked

ffmpeg links fdk-aac only with ENABLE_FDKAAC set (L1091), but the recipe (L320-L335) downloads and builds it in every build. The default build thus depends on one more GitHub archive download it does not use, and versions.json lists libfdk-aac for a binary that does not contain it.

• ARG ENABLE_FDKAAC= moves from the ffmpeg section (L1081) to the fdk-aac recipe; it stays in scope for the ffmpeg step.
• The fdk-aac RUN is wrapped in if [[ -n "$ENABLE_FDKAAC" ]]; then … fi, the same test the ffmpeg step uses.
• versions.json drops libfdk-aac when ENABLE_FDKAAC is empty.

With ENABLE_FDKAAC set, the build is unchanged.

Changes

Where	Change
WGET_OPTS	--tries=10 --connect-timeout=10 --retry-connrefused, status 504
glib, harfbuzz, cairo, pango, librsvg, vvenc	sha256sum --status -c - becomes sha256sum -c -
libmodplug	sha256sum -c becomes sha256sum -c -
ffmpeg, libssh, shine	cd ffmpeg*, libssh*, shine* become ffmpeg-*, libssh-*, shine-*
theora	https URL, saved as libtheora.tar.gz
cairo	GitLab tag archive, saved as cairo.tar.gz, new checksum
rav1e	cargo cinstall --release --locked
fdk-aac	built only with ENABLE_FDKAAC; ARG ENABLE_FDKAAC= moved to its recipe
versions.json	libfdk-aac only with ENABLE_FDKAAC

Checked

In alpine:3.24.2:

• theora fetched over https with the new WGET_OPTS passes the existing checksum.
• A 504 (Gateway Timeout) is retried.
• cd ffmpeg* and cd libssh* next to the archive enter the directory; sha256sum --status -c - prints nothing on a mismatch, sha256sum -c - prints the lines above.
• The cairo 1.18.6 GitLab archive gives the same checksum on two downloads (fetched with curl outside the container).
• The rav1e 0.8.1 archive contains rav1e-0.8.1/Cargo.lock.

Research and wording by Claude (Anthropic), directed and reviewed by me.

[wader]

cairographics.org still having problems

[wader]

Thanks!