From d6487e237f583387be4bf04086929152366f23b6 Mon Sep 17 00:00:00 2001 From: Eric Hayes <56524199+ehayes2000@users.noreply.github.com> Date: Fri, 30 Oct 2026 17:36:05 -0400 Subject: [PATCH 1/3] fix(ci): build cefclient so the CEF archive includes the macOS framework --- .github/workflows/build_cef_codecs.yml | 11 ++++++++++- .../src/workflows/build_cef_codecs/test.rs | 2 ++ .../src/workflows/scripts/build_cef_codecs.sh | 11 ++++++++++- 3 files changed, 22 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build_cef_codecs.yml b/.github/workflows/build_cef_codecs.yml index cfc6fe31f5a..520fb376a89 100644 --- a/.github/workflows/build_cef_codecs.yml +++ b/.github/workflows/build_cef_codecs.yml @@ -68,6 +68,8 @@ jobs: export GN_DEFINES="is_official_build=true proprietary_codecs=true ffmpeg_branding=Chrome chrome_pgo_phase=0 symbol_level=0" export CEF_ARCHIVE_FORMAT=tar.bz2 + # make_distrib copies the macOS framework out of cefclient.app, so building + # only cefsimple yields an archive with headers but no framework. python3 "$work/automate-git.py" \ --download-dir="$work/code" \ --depot-tools-dir="$work/depot_tools" \ @@ -78,7 +80,7 @@ jobs: --minimal-distrib-only \ --no-distrib-docs \ --no-chromium-history \ - --build-target=cefsimple + --build-target=cefclient distrib="$work/code/chromium/src/cef/binary_distrib" built="$distrib/cef_binary_${cef_version}_macosarm64_minimal.tar.bz2" @@ -98,6 +100,13 @@ jobs: fi done + framework="Release/Chromium Embedded Framework.framework/Chromium Embedded Framework" + listing=$(tar -tjf "$built") + if ! grep -qF "/$framework" <<<"$listing"; then + echo "$built has no $framework" >&2 + exit 1 + fi + mkdir -p "$RUNNER_TEMP/out" cp "$built" "$RUNNER_TEMP/out/$asset" sha256=$(shasum -a 256 "$RUNNER_TEMP/out/$asset" | awk '{print $1}') diff --git a/tooling/xtask/crates/xtask_workflows/src/workflows/build_cef_codecs/test.rs b/tooling/xtask/crates/xtask_workflows/src/workflows/build_cef_codecs/test.rs index cfec4570bd2..5f6d1f84d26 100644 --- a/tooling/xtask/crates/xtask_workflows/src/workflows/build_cef_codecs/test.rs +++ b/tooling/xtask/crates/xtask_workflows/src/workflows/build_cef_codecs/test.rs @@ -19,5 +19,7 @@ fn builds_with_proprietary_codecs() { let yaml = rendered(); assert!(yaml.contains("proprietary_codecs=true"), "{yaml}"); assert!(yaml.contains("ffmpeg_branding=Chrome"), "{yaml}"); + // make_distrib takes the macOS framework from cefclient.app. + assert!(yaml.contains("--build-target=cefclient"), "{yaml}"); assert!(yaml.contains("--prerelease --latest=false"), "{yaml}"); } diff --git a/tooling/xtask/crates/xtask_workflows/src/workflows/scripts/build_cef_codecs.sh b/tooling/xtask/crates/xtask_workflows/src/workflows/scripts/build_cef_codecs.sh index b6e968e2f9f..6feaa4e6cd9 100644 --- a/tooling/xtask/crates/xtask_workflows/src/workflows/scripts/build_cef_codecs.sh +++ b/tooling/xtask/crates/xtask_workflows/src/workflows/scripts/build_cef_codecs.sh @@ -40,6 +40,8 @@ curl -fsSL --retry 5 \ export GN_DEFINES="is_official_build=true proprietary_codecs=true ffmpeg_branding=Chrome chrome_pgo_phase=0 symbol_level=0" export CEF_ARCHIVE_FORMAT=tar.bz2 +# make_distrib copies the macOS framework out of cefclient.app, so building +# only cefsimple yields an archive with headers but no framework. python3 "$work/automate-git.py" \ --download-dir="$work/code" \ --depot-tools-dir="$work/depot_tools" \ @@ -50,7 +52,7 @@ python3 "$work/automate-git.py" \ --minimal-distrib-only \ --no-distrib-docs \ --no-chromium-history \ - --build-target=cefsimple + --build-target=cefclient distrib="$work/code/chromium/src/cef/binary_distrib" built="$distrib/cef_binary_${cef_version}_macosarm64_minimal.tar.bz2" @@ -70,6 +72,13 @@ for arg in 'proprietary_codecs *= *true' 'ffmpeg_branding *= *"Chrome"'; do fi done +framework="Release/Chromium Embedded Framework.framework/Chromium Embedded Framework" +listing=$(tar -tjf "$built") +if ! grep -qF "/$framework" <<<"$listing"; then + echo "$built has no $framework" >&2 + exit 1 +fi + mkdir -p "$RUNNER_TEMP/out" cp "$built" "$RUNNER_TEMP/out/$asset" sha256=$(shasum -a 256 "$RUNNER_TEMP/out/$asset" | awk '{print $1}') From 2828a1152701f8d45c7ac12904fd35943a0d1879 Mon Sep 17 00:00:00 2001 From: Eric Hayes <56524199+ehayes2000@users.noreply.github.com> Date: Fri, 30 Oct 2026 17:37:50 -0400 Subject: [PATCH 2/3] fix(desktop): build with the CDN CEF until the codec build is pinned Main pins cef-codecs.json without a sha256, so evaluating the macOS app failed and tagged desktop releases would not build. Warn and fall back to the CDN CEF instead; the codec build is used once the hash is set. --- apps/web/tauri/desktop-cef/AGENTS.md | 3 ++- nix/tauri-desktop.nix | 19 +++++++++++++------ 2 files changed, 15 insertions(+), 7 deletions(-) diff --git a/apps/web/tauri/desktop-cef/AGENTS.md b/apps/web/tauri/desktop-cef/AGENTS.md index 1b02a7f59dc..afdc0f17b09 100644 --- a/apps/web/tauri/desktop-cef/AGENTS.md +++ b/apps/web/tauri/desktop-cef/AGENTS.md @@ -53,7 +53,8 @@ thin binary over `../src-tauri` (`app_lib::run_with`) that selects `CEF_PATH` to an extracted codec distribution (below) to test media. - Releases embed CEF built with proprietary codecs, pinned in `cef-codecs.json` and laid out by `nix/tauri-desktop.nix`; Nix evaluation fails if that pin - doesn't match the `cef` crate in `Cargo.lock`. To bump the `cef` crate, put + doesn't match the `cef` crate in `Cargo.lock`. While `sha256` is empty, Nix + warns and builds with the codec-less CDN CEF. To bump the `cef` crate, put the new CDN version (`cefVersion`, its `g` as `cefCommit`, the Chromium branch) and a new `releaseTag`/`asset` in the manifest with an empty `sha256` on a PR. The `Build CEF with codecs` workflow then builds and publishes it diff --git a/nix/tauri-desktop.nix b/nix/tauri-desktop.nix index d4fa1825c09..26be7e20449 100644 --- a/nix/tauri-desktop.nix +++ b/nix/tauri-desktop.nix @@ -970,14 +970,17 @@ cef = lib.findFirst (p: p.name == "cef") null lock.package; in lib.last (lib.splitString "+" cef.version); + # An empty sha256 means the codec build for a new CEF version is still + # pending; build with the CDN CEF meanwhile rather than block releases. + cefCodecsPinned = + assert lib.assertMsg (cefCodecsVersion == cefCrateVersion) + "desktop-cef loads CEF ${cefCrateVersion} but cef-codecs.json pins ${cefCodecsVersion}; update the manifest and rebuild"; + lib.warnIf (cefCodecs.sha256 == "") + "apps/web/tauri/desktop-cef/cef-codecs.json has no sha256; building with the CDN CEF, which cannot play H.264, HEVC, or AAC" + (cefCodecs.sha256 != ""); cefCodecsArchive = pkgs.fetchurl { url = "https://github.com/macro-inc/macro/releases/download/${cefCodecs.releaseTag}/${cefCodecs.asset}"; - sha256 = - assert lib.assertMsg (cefCodecsVersion == cefCrateVersion) - "desktop-cef loads CEF ${cefCrateVersion} but cef-codecs.json pins ${cefCodecsVersion}; update the manifest and rebuild"; - assert lib.assertMsg (cefCodecs.sha256 != "") - "apps/web/tauri/desktop-cef/cef-codecs.json has no sha256; run the `Build CEF with codecs` workflow and pin its output"; - cefCodecs.sha256; + inherit (cefCodecs) sha256; }; cefCodecsDistribution = pkgs.runCommand "cef-codecs-${cefCodecsVersion}" { } '' tar -xjf ${cefCodecsArchive} @@ -1017,9 +1020,13 @@ preBuild = '' export PATH="$PATH:/usr/bin:/bin:/usr/sbin:/sbin" export CEF_PATH="$TMPDIR/tauri-cef" + '' + + lib.optionalString cefCodecsPinned '' mkdir -p "$CEF_PATH" cp -R ${cefCodecsDistribution}/. "$CEF_PATH/" chmod -R u+w "$CEF_PATH" + '' + + '' cp ${../apps/web/package.json} apps/web/package.json rm -rf apps/web/dist cp -r ${frontend} apps/web/dist From 62bfe340a388a1cf150b6496c98d2dec76f7d2b5 Mon Sep 17 00:00:00 2001 From: Eric Hayes <56524199+ehayes2000@users.noreply.github.com> Date: Fri, 30 Oct 2026 19:39:39 -0400 Subject: [PATCH 3/3] fix(desktop): pin the codec-enabled CEF 151.3.24 build --- apps/web/tauri/desktop-cef/cef-codecs.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/web/tauri/desktop-cef/cef-codecs.json b/apps/web/tauri/desktop-cef/cef-codecs.json index dfbdc0d56e9..b6eb44e2f60 100644 --- a/apps/web/tauri/desktop-cef/cef-codecs.json +++ b/apps/web/tauri/desktop-cef/cef-codecs.json @@ -4,5 +4,5 @@ "chromiumBranch": "7922", "releaseTag": "cef-codecs-151.3.24-g2384915", "asset": "cef_binary_151.3.24_macosarm64_codecs_minimal.tar.bz2", - "sha256": "" + "sha256": "d5605e50a736b8e107a58ea900d63e6893d4a66d00dda580976378f4de5d52d2" }