Update external deps and improve download script.

Now we make sure to use commit hashes. This is much better than just
pointing at branches or tags when cloning a repository.

Author: H-M-H

deps/download.sh

@@ -2,18 +2,35 @@
 
 set -ex
 
-test -d x264 || git clone --depth 1 -b stable https://code.videolan.org/videolan/x264.git x264
-test -d ffmpeg || git clone --depth 1 -b n8.0 https://git.ffmpeg.org/ffmpeg.git ffmpeg
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/refs.sh"
+source "$SCRIPT_DIR/hashes.sh"
+
+clone_at_commit() {
+    local url="$1" dir="$2" commit="$3"
+    if [ ! -d "$dir" ]; then
+        git clone --filter=blob:none "$url" "$dir"
+        git -C "$dir" checkout "$commit"
+    fi
+}
+
+clone_at_commit "$X264_URL" x264 "$X264_COMMIT"
+clone_at_commit "$FFMPEG_URL" ffmpeg "$FFMPEG_COMMIT"
+
 if [ "$TARGET_OS" == "linux" ]; then
-    test -d nv-codec-headers || git clone --depth 1 https://git.videolan.org/git/ffmpeg/nv-codec-headers.git
-    test -d libva || git clone --depth 1 -b 2.22.0 https://github.com/intel/libva
+    clone_at_commit "$NV_CODEC_URL" nv-codec-headers "$NV_CODEC_COMMIT"
+    clone_at_commit "$LIBVA_URL" libva "$LIBVA_COMMIT"
 fi
 if [ "$TARGET_OS" == "windows" ]; then
-    test -d nv-codec-headers || git clone --depth 1 https://git.videolan.org/git/ffmpeg/nv-codec-headers.git
+    clone_at_commit "$NV_CODEC_URL" nv-codec-headers "$NV_CODEC_COMMIT"
 fi
 
 if [ "$TARGET_OS" == "windows" ] && [ "$HOST_OS" == "windows" ]; then
     cd ffmpeg
     git apply ../command_limit.patch
     git apply ../awk.patch
 fi
+
+
+
+

deps/hashes.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+# Generated by update_hashes.sh — do not edit manually.
+# Run ./update_hashes.sh to regenerate.
+
+X264_COMMIT="b35605ace3ddf7c1a5d67a2eb553f034aef41d55"  # refs/heads/stable
+FFMPEG_COMMIT="a4044e04486d1136022498891088a90baf5b2775"  # refs/tags/n8.0
+NV_CODEC_COMMIT="876af32a202d0de83bd1d36fe74ee0f7fcf86b0d"  # HEAD
+LIBVA_COMMIT="e85b1569b738fd8866cb9fa2452319f7148d663f"  # refs/tags/2.23.0

deps/refs.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+# Dependency URLs and the branch/tag/ref to pin.
+# After editing, run ./update_hashes.sh to regenerate hashes.sh.
+
+X264_URL="https://code.videolan.org/videolan/x264.git"
+X264_REF="refs/heads/stable"
+
+FFMPEG_URL="https://code.ffmpeg.org/FFmpeg/FFmpeg.git"
+FFMPEG_REF="refs/tags/n8.0"
+
+NV_CODEC_URL="https://git.videolan.org/git/ffmpeg/nv-codec-headers.git"
+NV_CODEC_REF="HEAD"
+
+LIBVA_URL="https://github.com/intel/libva"
+LIBVA_REF="refs/tags/2.23.0"

deps/update_hashes.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+
+# Resolves each ref in refs.sh to a commit hash and writes hashes.sh.
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/refs.sh"
+
+resolve() {
+    local name="$1" url="$2" ref="$3"
+    local hash
+    hash=$(git ls-remote "$url" "$ref" | awk 'END { print $1 }')
+    if [ -z "$hash" ]; then
+        echo "ERROR: could not resolve $name $ref from $url" >&2
+        exit 1
+    fi
+    echo "${name}_COMMIT=\"${hash}\"  # ${ref}"
+}
+
+cat > "$SCRIPT_DIR/hashes.sh" <<EOF
+#!/usr/bin/env bash
+
+# Generated by update_hashes.sh — do not edit manually.
+# Run ./update_hashes.sh to regenerate.
+
+$(resolve X264      "$X264_URL"     "$X264_REF")
+$(resolve FFMPEG    "$FFMPEG_URL"   "$FFMPEG_REF")
+$(resolve NV_CODEC  "$NV_CODEC_URL" "$NV_CODEC_REF")
+$(resolve LIBVA     "$LIBVA_URL"    "$LIBVA_REF")
+EOF
+
+echo "hashes.sh updated."