Pin LAME downloads to SHA-256, with a reviewed pin list that follows upstream

.github/workflows/lame_pins.yml

@@ -0,0 +1,56 @@
+name: LAME Pin Update
+
+# Keeps assets/lame-pins.json in step with upstream LAME packages. The app reads
+# that file from master, so merging the pull request this opens is what updates
+# installed copies. It is never merged automatically: a changed hash is exactly
+# what a tampered upstream would look like, so a person confirms it first.
+
+on:
+  schedule:
+    - cron: "0 5 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update-pins:
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: master
+
+      - name: Refresh pins
+        run: python3 tools/update_lame_pins.py | tee pin-changes.txt
+
+      - name: Open pull request
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if git diff --quiet -- assets/lame-pins.json; then
+            echo "Pins are current."
+            exit 0
+          fi
+          branch=chore/lame-pins
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git switch -C "$branch"
+          git add assets/lame-pins.json
+          git commit -m "chore(util): refresh LAME download pins"
+          git push --force origin "$branch"
+          {
+            echo "Upstream LAME packages changed. Merging this updates the pins every installed copy uses."
+            echo
+            echo "Check each change against its source before merging. Windows (zip) changes have no independent confirmation."
+            echo
+            echo '```'
+            cat pin-changes.txt
+            echo '```'
+          } > pr-body.md
+          gh pr view "$branch" --json state -q .state 2>/dev/null | grep -q OPEN \
+            && gh pr edit "$branch" --body-file pr-body.md \
+            || gh pr create --base master --head "$branch" --title "chore(util): refresh LAME download pins" --body-file pr-body.md

CMakeLists.txt

@@ -553,6 +553,7 @@ if(BUILD_TESTING)
     tests/unit/ControlDeckTests.cpp
     tests/unit/UiDecisionTests.cpp
     tests/unit/SessionSerializationTests.cpp
+    tests/unit/LameDownloaderTests.cpp
     src/app/ui/SessionManager.cpp
     tests/unit/AudioIoTests.cpp
     tests/unit/AnalysisTests.cpp

assets/lame-pins.json

@@ -0,0 +1,41 @@
+{
+  "schema": 1,
+  "sources": [
+    {
+      "platform": "linux-arm",
+      "type": "deb",
+      "url": "https://deb.debian.org/debian/pool/main/l/lame/lame_3.100-6+b3_armhf.deb",
+      "sha256": "b7c5a96b803db07f67b74b7611240979797fb6eab0b4705e23eb0ce639b9078e"
+    },
+    {
+      "platform": "linux-arm64",
+      "type": "deb",
+      "url": "https://deb.debian.org/debian/pool/main/l/lame/lame_3.100-6+b3_arm64.deb",
+      "sha256": "4c6c6ee693633c846de685902641dbda18ef98f73a136ebef7c09cf6ee683bcd"
+    },
+    {
+      "platform": "linux-x64",
+      "type": "deb",
+      "url": "https://deb.debian.org/debian/pool/main/l/lame/lame_3.100-6+b3_amd64.deb",
+      "sha256": "feceeb296f9df9340f6e2ce48decce73c9cd6c70e7fe959495eb89ee59bc8d47"
+    },
+    {
+      "platform": "win32-arm64",
+      "type": "zip",
+      "url": "https://www.rarewares.org/files/mp3/lame3.100.1-x64.zip",
+      "sha256": "9a9c815203316e5203847e93100c6acf0d5d7a5be7744c9018825ded037052e7"
+    },
+    {
+      "platform": "win32-ia32",
+      "type": "zip",
+      "url": "https://www.rarewares.org/files/mp3/lame3.100.1-win32.zip",
+      "sha256": "2518e1138953c235fb2bfcefbc38883dd04538d6ae0a19692562576ba37bafec"
+    },
+    {
+      "platform": "win32-x64",
+      "type": "zip",
+      "url": "https://www.rarewares.org/files/mp3/lame3.100.1-x64.zip",
+      "sha256": "9a9c815203316e5203847e93100c6acf0d5d7a5be7744c9018825ded037052e7"
+    }
+  ]
+}