Move the libwebrtc download helper to zip 9

Merged
JS
2d ago
+655-19

The cargo-audit gate started failing on main (run 38983426671) because zip 0.6.6 picked up RUSTSEC-2026-0367, 0368 and 0369, all fixed only in zip 9. The only user is LiveKit's build helper webrtc-sys-build 0.3.19, which unpacks the prebuilt libwebrtc archive; no release of it takes zip 9 yet and upstream still pins 0.6, so a newer livekit does not help. This vendors the crate under vendor/webrtc-sys-build with src/lib.rs byte-identical to the registry copy, changes only its zip requirement (9.0, with just the zlib-rs Deflate decoder, since the helper only extracts), and wires it in through [patch.crates-io]. The pre-commit lanes skip vendor/ as they already skip web/vendor/, so the upstream source is not reformatted. An audit ignore was the alternative, and it would have kept the vulnerable extractor in every build.

Verified locally: cargo audit --file Cargo.lock reports no vulnerabilities, and cargo build --locked passes. With the cached libwebrtc moved aside, a fresh download extracted by zip 9 produced a tree identical to the old cache, file modes included. scripts/test.sh passes every gate except 16 tests/browser/interviewer-voice.test.js cases that time out on this machine and fail the same way on an untouched checkout of main; they passed in the CI run above.

The patch should be removed once upstream releases a webrtc-sys-build on zip 9; vendor/webrtc-sys-build/README.md says so.

Summary by cubic

Vendors LiveKit's webrtc-sys-build 0.3.19 with only its zip dependency bumped from 0.6 to 9, fixing the cargo-audit gate failures on the vulnerable zip 0.6.6 (RUSTSEC-2026-0367, 0368, 0369). The patched crate is wired in through [patch.crates-io]; its Rust source stays byte-identical to upstream, and pre-commit lanes now skip vendor/ so formatting isn't applied.

  • zip 9 only enables the zlib-rs Deflate decoder since the helper only extracts archives.
  • A fresh libwebrtc download extracted with zip 9 matches the previous cache, including file modes.
  • Remove vendor/webrtc-sys-build/ and the Cargo patch once upstream releases a build helper on zip 9.