From b7c8dab0194f748638423074b43953d58225d7b9 Mon Sep 17 00:00:00 2001
From: Hampus <hampus@fluxer.app>
Date: Fri, 4 Sep 2026 02:06:02 +0200
Subject: [PATCH] fix(media-proxy): pin builder libheif, fix the image build
 (#2441)

---
 fluxer_media_proxy/Dockerfile                   |  6 +++++-
 fluxer_media_proxy/src/tests/native_stack.rs    | 11 ++++++-----
 fluxer_media_proxy/src/tests/provisioning.rs    | 15 +++++++++++++--
 fluxer_media_proxy/tools/install-native-deps.sh |  2 +-
 4 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/fluxer_media_proxy/Dockerfile b/fluxer_media_proxy/Dockerfile
index e8e0be203..ff350ccae 100644
--- a/fluxer_media_proxy/Dockerfile
+++ b/fluxer_media_proxy/Dockerfile
@@ -33,7 +33,11 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
         ca-certificates pkg-config build-essential \
         libcurl4-openssl-dev libvips-dev libwebp-dev \
         liblcms2-dev libyuv-dev libde265-dev libdav1d-dev libaom-dev \
-    && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/* \
+    && rm -f /usr/lib/*/libheif.so.1* \
+    && ldconfig \
+    && [ "$(ldconfig -p | grep -c 'libheif\.so\.1 ')" -eq 1 ] \
+    && ldconfig -p | grep -q 'libheif\.so\.1 .* => /usr/local/lib/libheif\.so\.1$'
 
 COPY . .
 
diff --git a/fluxer_media_proxy/src/tests/native_stack.rs b/fluxer_media_proxy/src/tests/native_stack.rs
index 2875ea494..89b9e6875 100644
--- a/fluxer_media_proxy/src/tests/native_stack.rs
+++ b/fluxer_media_proxy/src/tests/native_stack.rs
@@ -3,7 +3,7 @@
 use std::collections::HashSet;
 
 use super::provisioning::{
-    dockerfile_stage, installs_package, linux_region, repository_file, shell_function,
+    ci_workflow, dockerfile_stage, installs_package, linux_region, repository_file, shell_function,
     shell_variable, workflow_step,
 };
 
@@ -217,10 +217,11 @@ fn every_command_the_linux_installer_runs_is_installed_before_it_runs() {
         "fetch_source downloads every pinned tarball with curl"
     );
     let native = dockerfile_stage(&repository_file("Dockerfile"), "native");
-    let step = workflow_step(
-        &repository_file("../.github/workflows/tests.yaml"),
-        "Install native dependencies",
-    );
+    let Some(workflow) = ci_workflow() else {
+        eprintln!("skipping: the CI workflow is outside this build context");
+        return;
+    };
+    let step = workflow_step(&workflow, "Install native dependencies");
     let devcontainer = repository_file("../.devcontainer/Dockerfile");
     for command in commands {
         let package = LINUX_INSTALLER_COMMAND_PACKAGES
diff --git a/fluxer_media_proxy/src/tests/provisioning.rs b/fluxer_media_proxy/src/tests/provisioning.rs
index f41e093ee..f290e92bd 100644
--- a/fluxer_media_proxy/src/tests/provisioning.rs
+++ b/fluxer_media_proxy/src/tests/provisioning.rs
@@ -19,6 +19,11 @@ pub(super) fn repository_file(relative: &str) -> String {
     fs::read_to_string(&path).unwrap_or_else(|_| panic!("{} is readable", path.display()))
 }
 
+pub(super) fn ci_workflow() -> Option<String> {
+    let path = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../.github/workflows/tests.yaml");
+    fs::read_to_string(&path).ok()
+}
+
 pub(super) fn dockerfile_stage(dockerfile: &str, stage: &str) -> String {
     let header = format!("AS {stage}");
     let mut collecting = false;
@@ -288,7 +293,10 @@ fn every_package_the_linux_gate_needs_is_installed_before_the_installer_runs() {
         "the Linux gate names the development packages it needs: {packages:?}"
     );
     let native = dockerfile_stage(&repository_file("Dockerfile"), "native");
-    let workflow = repository_file("../.github/workflows/tests.yaml");
+    let Some(workflow) = ci_workflow() else {
+        eprintln!("skipping: the CI workflow is outside this build context");
+        return;
+    };
     let step = workflow_step(&workflow, "Install native dependencies");
     let devcontainer = repository_file("../.devcontainer/Dockerfile");
     for package in packages {
@@ -490,7 +498,10 @@ fn cache_keys(step: &str) -> (String, Vec<String>) {
 
 #[test]
 fn the_cargo_cache_is_keyed_on_the_native_dependency_installer() {
-    let workflow = repository_file("../.github/workflows/tests.yaml");
+    let Some(workflow) = ci_workflow() else {
+        eprintln!("skipping: the CI workflow is outside this build context");
+        return;
+    };
     let (native_key, _) = cache_keys(&workflow_step(&workflow, "Cache native media dependencies"));
     assert!(
         native_key.contains(NATIVE_INSTALLER_HASH),
diff --git a/fluxer_media_proxy/tools/install-native-deps.sh b/fluxer_media_proxy/tools/install-native-deps.sh
index 9d7088494..894074bf7 100755
--- a/fluxer_media_proxy/tools/install-native-deps.sh
+++ b/fluxer_media_proxy/tools/install-native-deps.sh
@@ -217,7 +217,7 @@ ffmpeg_listing() {
 require_listed() {
     local listing="$1" kind="$2" names="$3" name
     for name in $names; do
-        printf '%s\n' "$listing" | grep -qE "^[[:space:]]*[A-Z.]+[[:space:]]+${name}([[:space:]]|\$)" \
+        grep -qE "^[[:space:]]*[A-Z.]+[[:space:]]+${name}([[:space:]]|\$)" <<<"$listing" \
             || die "FFmpeg ${FFMPEG_VERSION} under ${PREFIX} is missing the ${name} ${kind}"
     done
 }