From 5048e2f55483b8f81938662bd0c4b535e1bc0407 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Sat, 31 Oct 2026 15:40:54 -0700 Subject: [PATCH 1/3] chore(quest): claim quest/m1/vendor-sync/vaapi.md Quest-Claim: efd5ceeeb62132c9 From ac68e4c11655ba32bfd5ae58e458723a629f2a4c Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Sat, 31 Oct 2026 15:45:09 -0700 Subject: [PATCH 2/3] chore(quest): record VA-API upstream audit and release dependency Co-Authored-By: GPT-6.1 Sol --- quest/m1/vendor-sync/vaapi.md | 57 +++++++++++++++++++++++++---------- 1 file changed, 41 insertions(+), 16 deletions(-) diff --git a/quest/m1/vendor-sync/vaapi.md b/quest/m1/vendor-sync/vaapi.md index c9914261d86..f51d2351dc6 100644 --- a/quest/m1/vendor-sync/vaapi.md +++ b/quest/m1/vendor-sync/vaapi.md @@ -1,29 +1,54 @@ -# [XS] moq-vaapi has every cros-codecs fix it needs +# [XS] Release the audited moq-vaapi fix and consume it ## Goal -[moq-dev/vaapi](https://github.com/moq-dev/vaapi) carries every fix that -[chromeos/cros-libva](https://github.com/chromeos/cros-libva) and -[chromeos/cros-codecs](https://github.com/chromeos/cros-codecs) have landed -since the last check, for the code it vendors, each ported with its test or -recorded as not applying, and released to crates.io if anything changed. +Release [moq-dev/vaapi](https://github.com/moq-dev/vaapi)'s audited upstream +logging fix to crates.io, then update MoQ's `moq-vaapi` dependency and lockfile +to that release. The source audit is recorded below; this cycle is unfinished +until MoQ consumes the released fix. ## Plan Recurring child of the [vendor sync](/quest/m1/vendor-sync/README.md), which says how each run works and recurs. moq-vaapi lives in its own repository and -ships from crates.io for build reasons, but is vendored code all the same. Port -fixes there and bump moq's `moq-vaapi` version in the same cycle. +ships from crates.io for build reasons. Carry these checked heads and +dispositions into the next cycle when the parent re-creates this child. moq-vaapi vendors Discord's forks: cros-libva tag `discord-0.0.13` ([`896a248e`](https://github.com/discord/cros-libva/commit/896a248e003caae7a7120812f7eaa423c93a920d), 2026-03-13) and cros-codecs tag `discord-0.0.5` ([`9cdecb19`](https://github.com/discord/cros-codecs/commit/9cdecb192ee3682950d02bd80a7f106163531b76), -2026-06-15). Discord tagged nothing newer by 2026-10-30, so the chromeos -upstreams are the ones to track. - -Last checked: nothing beyond those tags. On 2026-10-30 chromeos/cros-libva was -at `59384456`, five commits ahead, of which `59384456` (a VP9 struct field for -libva 2.23+) is the only fix and moq-vaapi is H.264-only, and -chromeos/cros-codecs was at `a050c6cd`, one commit ahead. Record the commits -checked in moq-dev/vaapi's README, and copy them here for the next run. +2026-06-15). Track the ChromeOS default branches against these diverged fork +baselines, without undoing Discord's additions. + +Checked 2026-10-31: + +- cros-libva + [`59384456ac2ae78c0c3e5515f41ef1efd9b802cf`](https://github.com/chromeos/cros-libva/commit/59384456ac2ae78c0c3e5515f41ef1efd9b802cf): + all five commits absent from the vendor baseline inspected. Explicit image + lifetimes and packed headers are already present. The retained VP9 wrapper + already zero-fills the libva 2.23 fields with `..Default::default()`; there + is no VP9 codec driver needing segmentation control. Protected-content + headers have no consumer. Borrowed input buffers are an optional optimization, + not a correctness fix; retain the existing owned-buffer API. +- cros-codecs + [`a050c6cde530e563197ee9e3e72ab01f48a0c41f`](https://github.com/chromeos/cros-codecs/commit/a050c6cde530e563197ee9e3e72ab01f48a0c41f): + the only commit absent from the vendor baseline removes + `log/release_max_level_debug`, which conflicts with a downstream application's + release log level. Ported in + [`6d38f3d0`](https://github.com/moq-dev/vaapi/commit/6d38f3d02e2709962789ad73698a27b548fd582e), + with a feature-unification compilation check in `just ci`. That check failed + before the fix and passes after it. VA-API's README records every disposition + and both full checked heads. +- GitHub's published advisory endpoints for both ChromeOS repositories and + both Discord forks returned empty lists, as did the global Rust advisory + queries for `cros-libva` and `cros-codecs`. This does not cover undisclosed + vulnerabilities. + +Remaining: finish local review and merge the VA-API source fix, publish a new +`moq-vaapi` release, then bump MoQ from `0.1.0` and run the affected checks. +No crate was published and no version was guessed during this audit. +VA-API's pinned Nix `just ci` passed; the Claude local review attempt was +quota-blocked (reported reset: 2026-11-02 02:00 America/Los_Angeles), so the +source fix still needs that review before it is ready. Public API and wire +formats are unchanged; applications retain control of their release log level. From 575aa61b56f2ade2e2d22c6dbf893fe0781aa840 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Sat, 31 Oct 2026 22:47:28 -0700 Subject: [PATCH 3/3] chore(quest): keep the recurring VA-API goal and drop transient review status The parent re-creates each child with its Goal, so restore the recurring Goal (now naming the dependency bump) and keep the remaining release work in Plan. Drop the quota-reset note, which belongs in the PR body. Co-Authored-By: Claude Opus 5.5 --- quest/m1/vendor-sync/vaapi.md | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/quest/m1/vendor-sync/vaapi.md b/quest/m1/vendor-sync/vaapi.md index f51d2351dc6..7bf49d90aa2 100644 --- a/quest/m1/vendor-sync/vaapi.md +++ b/quest/m1/vendor-sync/vaapi.md @@ -1,11 +1,13 @@ -# [XS] Release the audited moq-vaapi fix and consume it +# [XS] moq-vaapi has every cros-codecs fix it needs ## Goal -Release [moq-dev/vaapi](https://github.com/moq-dev/vaapi)'s audited upstream -logging fix to crates.io, then update MoQ's `moq-vaapi` dependency and lockfile -to that release. The source audit is recorded below; this cycle is unfinished -until MoQ consumes the released fix. +[moq-dev/vaapi](https://github.com/moq-dev/vaapi) carries every fix that +[chromeos/cros-libva](https://github.com/chromeos/cros-libva) and +[chromeos/cros-codecs](https://github.com/chromeos/cros-codecs) have landed +since the last check, for the code it vendors, each ported with its test or +recorded as not applying, and released to crates.io if anything changed, with +moq's `moq-vaapi` dependency bumped to that release. ## Plan @@ -45,10 +47,8 @@ Checked 2026-10-31: queries for `cros-libva` and `cros-codecs`. This does not cover undisclosed vulnerabilities. -Remaining: finish local review and merge the VA-API source fix, publish a new -`moq-vaapi` release, then bump MoQ from `0.1.0` and run the affected checks. -No crate was published and no version was guessed during this audit. -VA-API's pinned Nix `just ci` passed; the Claude local review attempt was -quota-blocked (reported reset: 2026-11-02 02:00 America/Los_Angeles), so the -source fix still needs that review before it is ready. Public API and wire -formats are unchanged; applications retain control of their release log level. +Remaining this cycle: merge the ported fix, +[moq-dev/vaapi#5](https://github.com/moq-dev/vaapi/pull/5), publish a new +`moq-vaapi` release to crates.io, then bump moq's workspace `moq-vaapi = "0.1.0"` +and lockfile to it and run the affected checks. Public API and wire formats are +unchanged; applications regain control of their release log level.