Option for an LGPL-2.1+ FFmpeg build: drop gmp/--enable-version3, allow securetransport for TLS #87

Activity

1. goozakdev commented on Nov 3, 2026

   

   goozakdev

   on Nov 3, 2026

   Author

   More actions

   Update: a working LGPL-2.1+ build with Secure Transport TLS. It needs a small FFmpeg patch for iOS/tvOS.

   We built 1.0.0 (FFmpeg n8.1.2, mpv v0.41.0) in a fork with an opt-in option. It skips gmp/nettle/gnutls, drops --enable-version3, and adds --enable-securetransport. Default builds are unchanged. Here is what we found, so nobody has to repeat it.

   1. Plain Secure Transport builds, but HTTPS fails when a CA file is set.

   • On iOS/tvOS, --enable-securetransport builds fine, and every FFmpeg library reports LGPL version 2.1 or later.
   • But libavformat/tls_securetransport.c loads ca_file through SecItemImport, which is macOS-only. Configure sets HAVE_SECITEMIMPORT 0 for iOS/tvOS, so import_pem() returns AVERROR_PATCHWELCOME, and any https open with mpv's tls-ca-file set fails.
   • With no CA file, Secure Transport should use system trust. We read that in the source but didn't test it.

   2. OpenSSL is not a clean way around it.

   • --enable-openssl with OpenSSL 3.x does configure as LGPL 2.1, because configure only demands --enable-version3 for OpenSSL ≥ 3 when --enable-gpl is on.
   • But FFmpeg's own LICENSE.md says Apache-2.0 libraries are incompatible with LGPL v2.1 and need --enable-version3. OpenSSL 3 is Apache-2.0.
   • Separately, OpenSSL rejected a trusted leaf certificate from a private CA unless partial-chain verification was on. gnutls and Secure Transport accept it.
   • We dropped this route.

   3. Fix: patch tls_securetransport.c to parse the PEM bundle itself when !HAVE_SECITEMIMPORT.

   • It reads each CERTIFICATE block, base64-decodes it with av_base64_decode, and creates the cert with SecCertificateCreateWithData. Other block types are skipped, and a malformed block is an error.
   • Gotcha: the CA file must be opened with a whitelist of just "file". Otherwise it inherits the stream's protocol whitelist, and mpv's is http,https,tls,rtp,tcp,udp,crypto,httpproxy, which gives Protocol 'file' not on whitelist and the same failure. The gnutls and OpenSSL backends read the CA file directly from disk, so they never hit this. The macOS import_pem() has the same latent problem, and the patch fixes it too.
   • The patch applies cleanly to both n8.1.2 and n9.0.2.

   Verified on the iOS simulator against a local HTTPS server, through mpv with tls-verify=yes and tls-ca-file set:

   • a self-signed server cert added to the CA file plays;
   • a private-CA leaf added to the CA file plays;
   • a cert that isn't in the CA file is rejected with -9807 (errSSLXCertChainInvalid).

   The patch's PEM parser was run separately under ASan/UBSan and leaks: the Mozilla bundle parses 119/119, CRLF input works, and the malformed cases are rejected. tvOS builds, but we haven't run it.

   Manifest changes the option needs:

   • remove gmp/nettle/hogweed/gnutls from _FFmpeg;
   • add .linkedFramework("Security");
   • drop the GPL product and targets, since an LGPL-2.1 build can't produce them;
   • the unused Libsmbclient (GPLv3) binary target can go too.

   The fork branch is goozakdev/MPVKit lgpl21-securetransport-1.0.0. The patch is in Sources/BuildScripts/patch/FFmpeg/. We're happy to open a PR against main if you'd like this upstream.