PR #25852 opened by Jun Zhao (mypopydev) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25852 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25852.patch
These two commits make FFmpeg's reliance on Apple's deprecated Secure Transport explicit rather than silent. The first adds a configure warning when Secure Transport is autodetected (it is deprecated and cannot negotiate TLS 1.3), recommends --enable-gnutls or --enable-openssl, and lets an explicit --enable-securetransport acknowledge the deprecation so --fatal-warnings builds still work; it also corrects the https/tls/dtls fallback hint in avio.c. The second documents build-time backend selection and the warning in doc/protocols.texi, states which backends provide DTLS, and adds a Changelog entry. No TLS behaviour changes: Secure Transport remains the autodetected default on macOS, so this improves diagnostics and documentation, not connectivity. >From 9d813467b261ba505078824aa27680ea41d2e4d9 Mon Sep 17 00:00:00 2001 From: Jun Zhao <[email protected]> Date: Sun, 8 Nov 2026 07:37:49 +0800 Subject: [PATCH 1/2] configure: warn when autodetecting deprecated Secure Transport Apple deprecated Secure Transport on macOS 10.15 / iOS 13 in favour of Network.framework, and it cannot negotiate TLS 1.3. configure still enables it silently whenever no other TLS backend is requested, so HTTPS to servers requiring TLS 1.3 fails. Warn only for the autodetected case. A user who passes --enable-securetransport has already made that choice, and the distinction also gives --fatal-warnings builds an escape hatch: any warn() makes configure exit 1, so such builds must add --enable-gnutls or --enable-openssl, or pass --enable-securetransport explicitly to acknowledge the deprecation. Autodetected builds still fail under --fatal-warnings, which is the flag's intended effect. Also update the https/tls/dtls "protocol not found" hint in avio.c: list only the four backends common to tls_protocol_deps_any and dtls_protocol_deps_any (libtls and securetransport are TLS-only and cannot provide the dtls protocol), say Apple deprecated Secure Transport on all its platforms rather than only macOS, and name all three URL schemes that reach the hint. This addresses the diagnostic part of the report, not a full fix. See: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21686 Signed-off-by: Jun Zhao <[email protected]> --- configure | 3 +++ libavformat/avio.c | 5 +++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/configure b/configure index 3a0ee5ddfb3..8afe1a0b334 100755 --- a/configure +++ b/configure @@ -8136,6 +8136,9 @@ check_deps $CONFIG_LIST \ $HAVE_LIST \ $ALL_COMPONENTS \ +enabled securetransport && ! requested securetransport && warn \ + "Secure Transport is deprecated by Apple and does not support TLS 1.3.\nConsider configuring with --enable-gnutls or --enable-openssl instead." + enabled threads || warn \ "Threading support was disabled or is not available on the target platform." \ "This means that not only is this build not multi-threaded, but also" \ diff --git a/libavformat/avio.c b/libavformat/avio.c index b0d2e067e4d..f60bc0eae3a 100644 --- a/libavformat/avio.c +++ b/libavformat/avio.c @@ -353,8 +353,9 @@ static const struct URLProtocol *url_find_protocol(const char *filename) av_freep(&protocols); if (av_strstart(filename, "https:", NULL) || av_strstart(filename, "tls:", NULL) || av_strstart(filename, "dtls:", NULL)) - av_log(NULL, AV_LOG_WARNING, "https or dtls protocol not found, recompile FFmpeg with " - "openssl, gnutls or securetransport enabled.\n"); + av_log(NULL, AV_LOG_WARNING, "https, tls or dtls protocol not found, recompile FFmpeg with " + "openssl, gnutls, mbedtls or schannel enabled " + "(securetransport is deprecated by Apple and lacks TLS 1.3).\n"); return NULL; } -- 2.54.0 >From 0c387453da55ff53e2d8c609fbf14abe6f7c09b1 Mon Sep 17 00:00:00 2001 From: Jun Zhao <[email protected]> Date: Sun, 8 Nov 2026 08:21:19 +0800 Subject: [PATCH 2/2] doc/protocols, Changelog: document the Secure Transport warning Document how the TLS backend is selected at build time, the warning configure now emits when it autodetects the deprecated Secure Transport backend, and the --fatal-warnings interaction. Also state which backends provide DTLS, matching the corrected "protocol not found" hint in avio.c, and add a Changelog entry. Follow-up to the preceding commit. Signed-off-by: Jun Zhao <[email protected]> --- Changelog | 1 + doc/protocols.texi | 17 +++++++++++++++++ 2 files changed, 18 insertions(+) diff --git a/Changelog b/Changelog index 4c5e631d0ad..b051537e3d4 100644 --- a/Changelog +++ b/Changelog @@ -5,6 +5,7 @@ version <next>: - DTS:X height channels in the DCA decoder - LCEVC raw demuxer and muxer - AVS+ (AVS1-P16, Broadcasting profile) support in the Chinese AVS decoder +- Warn when configure autodetects the deprecated Secure Transport TLS backend version 9.1: - ASTC image encoding and decoding via libastcenc, with .astc and KTX 1.0 muxers and demuxers diff --git a/doc/protocols.texi b/doc/protocols.texi index 031e257d3f5..ab2ec92d808 100644 --- a/doc/protocols.texi +++ b/doc/protocols.texi @@ -2309,6 +2309,20 @@ space) can be used to escape keys and values. Options can also can be specified via command line options (or in code via @code{AVOption}s). +The TLS backend is selected at build time. The available backends are GnuTLS, +OpenSSL, mbedTLS, libtls, SChannel (Windows) and Secure Transport (Apple +platforms). Only one backend can be linked into a build. + +On Apple platforms, configure autodetects Secure Transport when no other TLS +library is enabled. Apple has deprecated Secure Transport in favor of +Network.framework and it does not support TLS 1.3, so such a build cannot +connect to servers that require TLS 1.3. configure therefore emits a warning +when it selects Secure Transport automatically; building with +@code{--enable-gnutls} or @code{--enable-openssl} is recommended instead. +Passing @code{--enable-securetransport} explicitly marks the backend as +requested and suppresses the warning. This is also needed with +@code{--fatal-warnings}, since any warning makes configure fail. + The list of supported options follows. @table @option @@ -2374,6 +2388,9 @@ ffplay tls://@var{hostname}:@var{port} Datagram Transport Layer Security (DTLS) +DTLS requires one of the OpenSSL, GnuTLS, mbedTLS or SChannel backends; +libtls and Secure Transport provide TLS only. + The required syntax for a DTLS URL is: @example dtls://@var{hostname}:@var{port}[?@var{options}] -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
