Jellyfin: Update to v10.8.10

[mreid-tt]

Description

This PR includes the following:

1. Update jellyfin to 10.8.10 (Stable hotfix release for 10.8.z release branch)
2. Update dotnet to 6.0.16 (Security patch)
3. Fix dotnet dependencies for DSM 7.2

Fixes #

Checklist

• Build rule all-supported completed successfully
• New installation of package completed successfully
• Package upgrade completed successfully (Manually install the package again)
• Package functionality was tested
• Any needed documentation is updated/created

Type of change

• Package update

[mreid-tt]

@th0ma7, I was looking at #5620 and tried to install this build on DSM 7.2 beta with ffmpeg 6 however in the service log I only see:

[INF] [1] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Found ffmpeg version 4.4.3

Now in the Makefile we have:

spksrc/spk/jellyfin/Makefile

Line 24 in cd787a6

SPK_DEPENDS = "ffmpeg>=4.2"

And as far as I know there isn't a way to configure packages to have a logical OR for packages dependencies. Was it the intent to change this or should Jellyfin be able to access the new ffmpeg versions if installed?

[th0ma7]

I was looking at #5620 and tried to install this build on DSM 7.2 beta with ffmpeg 6 however in the service log I only see:

[INF] [1] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Found ffmpeg version 4.4.3

I'm presuming this is due to jellyfin using a hardcoded path pointing to /var/packages/ffmpeg/target/bin/ffmpeg. One way to alleviate this would be using /usr/local/bin/ffmpeg symlink and therefore always point to the latest version installed (and as I don't plan for another v4.x update that should stick to v5 or v6).

Now in the Makefile we have:

spksrc/spk/jellyfin/Makefile

Line 24 in cd787a6

SPK_DEPENDS = "ffmpeg>=4.2"

And as far as I know there isn't a way to configure packages to have a logical OR for packages dependencies. Was it the intent to change this or should Jellyfin be able to access the new ffmpeg versions if installed?

Yes, no, maybie? I mean if the code is fixed to the v4 version there is nothing we can do about it. On the other hand, newer ffmpeg packages are now called ffmpeg5 and ffmpeg6 respectively, which means they could be added to the SPK_DEPENDS variable to offer multiple versions, hence being ready when jellyfin code changes (unless I'm wrong on the hardcoded path).

@nyanmisaka any thoughts on this?

[mreid-tt]

This tests well with DSM 7.2 beta for media playback. However a similar test in DSM 6.2 fails. The service log shows the following:

[19:24:38] [ERR] [13] Jellyfin.Api.Helpers.TranscodingJobHelper: FFmpeg exited with code 1
[19:24:38] [ERR] [25] Jellyfin.Server.Middleware.ExceptionMiddleware: Error processing request. URL GET /videos/b2316185-4e85-b991-8357-548394a0935b/hls1/main/0.ts.
MediaBrowser.Common.FfmpegException: FFmpeg exited with code 1
   at Jellyfin.Api.Helpers.TranscodingJobHelper.StartFfMpeg(StreamState state, String outputPath, String commandLineArguments, HttpRequest request, TranscodingJobType transcodingJobType, CancellationTokenSource cancellationTokenSource, String workingDirectory)
   at Jellyfin.Api.Controllers.DynamicHlsController.GetDynamicSegment(StreamingRequestDto streamingRequest, Int32 segmentId)
   at Jellyfin.Api.Controllers.DynamicHlsController.GetHlsVideoSegment(Guid itemId, String playlistId, Int32 segmentId, String container, Int64 runtimeTicks, Int64 actualSegmentLengthTicks, Nullable`1 static, String params, String tag, String deviceProfileId, String playSessionId, String segmentContainer, Nullable`1 segmentLength, Nullable`1 minSegments, String mediaSourceId, String deviceId, String audioCodec, Nullable`1 enableAutoStreamCopy, Nullable`1 allowVideoStreamCopy, Nullable`1 allowAudioStreamCopy, Nullable`1 breakOnNonKeyFrames, Nullable`1 audioSampleRate, Nullable`1 maxAudioBitDepth, Nullable`1 audioBitRate, Nullable`1 audioChannels, Nullable`1 maxAudioChannels, String profile, String level, Nullable`1 framerate, Nullable`1 maxFramerate, Nullable`1 copyTimestamps, Nullable`1 startTimeTicks, Nullable`1 width, Nullable`1 height, Nullable`1 maxWidth, Nullable`1 maxHeight, Nullable`1 videoBitRate, Nullable`1 subtitleStreamIndex, Nullable`1 subtitleMethod, Nullable`1 maxRefFrames, Nullable`1 maxVideoBitDepth, Nullable`1 requireAvc, Nullable`1 deInterlace, Nullable`1 requireNonAnamorphic, Nullable`1 transcodingMaxAudioChannels, Nullable`1 cpuCoreLimit, String liveStreamId, Nullable`1 enableMpegtsM2TsMode, String videoCodec, String subtitleCodec, String transcodeReasons, Nullable`1 audioStreamIndex, Nullable`1 videoStreamIndex, Nullable`1 context, Dictionary`2 streamOptions)
   at lambda_method1454(Closure , Object )
   at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.TaskOfActionResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeActionMethodAsync>g__Awaited|12_0(ControllerActionInvoker invoker, ValueTask`1 actionResultValueTask)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeNextActionFilterAsync>g__Awaited|10_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeInnerFilterAsync>g__Awaited|13_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeNextResourceFilter>g__Awaited|25_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Rethrow(ResourceExecutedContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeFilterPipelineAsync>g__Awaited|20_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope)
   at Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)
   at Jellyfin.Server.Middleware.ServerStartupMessageMiddleware.Invoke(HttpContext httpContext, IServerApplicationHost serverApplicationHost, ILocalizationManager localizationManager)
   at Jellyfin.Server.Middleware.WebSocketHandlerMiddleware.Invoke(HttpContext httpContext, IWebSocketManager webSocketManager)
   at Jellyfin.Server.Middleware.IpBasedAccessValidationMiddleware.Invoke(HttpContext httpContext, INetworkManager networkManager)
   at Jellyfin.Server.Middleware.LanFilteringMiddleware.Invoke(HttpContext httpContext, INetworkManager networkManager, IServerConfigurationManager serverConfigurationManager)
   at Microsoft.AspNetCore.Authorization.Policy.AuthorizationMiddlewareResultHandler.HandleAsync(RequestDelegate next, HttpContext context, AuthorizationPolicy policy, PolicyAuthorizationResult authorizeResult)
   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
   at Jellyfin.Server.Middleware.QueryStringDecodingMiddleware.Invoke(HttpContext httpContext)
   at Swashbuckle.AspNetCore.ReDoc.ReDocMiddleware.Invoke(HttpContext httpContext)
   at Swashbuckle.AspNetCore.SwaggerUI.SwaggerUIMiddleware.Invoke(HttpContext httpContext)
   at Swashbuckle.AspNetCore.Swagger.SwaggerMiddleware.Invoke(HttpContext httpContext, ISwaggerProvider swaggerProvider)
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at Jellyfin.Server.Middleware.RobotsRedirectionMiddleware.Invoke(HttpContext httpContext)
   at Jellyfin.Server.Middleware.LegacyEmbyRouteRewriteMiddleware.Invoke(HttpContext httpContext)
   at Microsoft.AspNetCore.ResponseCompression.ResponseCompressionMiddleware.InvokeCore(HttpContext context)
   at Jellyfin.Server.Middleware.ResponseTimeMiddleware.Invoke(HttpContext context, IServerConfigurationManager serverConfigurationManager)
   at Jellyfin.Server.Middleware.ExceptionMiddleware.Invoke(HttpContext context)

Any thoughts on this @th0ma7 ?

[th0ma7]

This is weird... and I see a correlation with AlexPresso/VideoStation-FFMPEG-Patcher#66

[mreid-tt]

I'm presuming this is due to jellyfin using a hardcoded path pointing to /var/packages/ffmpeg/target/bin/ffmpeg. One way to alleviate this would be using /usr/local/bin/ffmpeg symlink and therefore always point to the latest version installed (and as I don't plan for another v4.x update that should stick to v5 or v6).

Interestingly enough, as you brought up a hardcoded path, I saw the path listed under FFmpeg path under [Dashboard] > [Playback]. Changing this entry to /var/packages/ffmpeg6/target/bin/ffmpeg and saving allows me to see in the log:

[INF] [12] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Found ffmpeg version 6.0

Yes, no, maybie? I mean if the code is fixed to the v4 version there is nothing we can do about it. On the other hand, newer ffmpeg packages are now called ffmpeg5 and ffmpeg6 respectively, which means they could be added to the SPK_DEPENDS variable to offer multiple versions, hence being ready when jellyfin code changes (unless I'm wrong on the hardcoded path).

As far as I know if you add packages to the SPK_DEPENDS variable they will be listed as a logical AND and will require the user to install all of them. I feel like the best option would be to stick with v4 and if the user wishes to change to a newer version, they can manually update the app settings (as above).

EDIT: I can confirm that despite the hardcoding (below), once the ffmpeg binary path is changed to v6, the configuration survives both an app and DSM restart.

spksrc/spk/jellyfin/src/service-setup.sh

Line 11 in 1e90b5f

--ffmpeg /var/packages/ffmpeg/target/bin/ffmpeg"

[mreid-tt]

This is weird... and I see a correlation with AlexPresso/VideoStation-FFMPEG-Patcher#66

Interestingly enough, on switching the FFmpeg path to the v6 binary, I was able to playback video with no problem. So whatever it is seems to be ffmpeg version 4 specific.

EDIT: I also tested with ffmpeg v5 and the video played successfully.

[INF] [58] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Found ffmpeg version 5.1.2

[mreid-tt]

Interestingly enough, on switching the FFmpeg path to the v6 binary, I was able to playback video with no problem. So whatever it is seems to be ffmpeg version 4 specific.

@th0ma7, I've found the cause of the playback issue with ffmpeg v4. Looking at the logs in [Dashboard] -> [Logs] there are a number of FFmpeg.DirectStream-* files. Selecting the one at the time of the failure shows the following:

file:/volume1/video/TV Series/Obi-Wan Kenobi/Season 01/Obi-Wan Kenobi - 1x01 - Part I.mkv: Permission denied

So, I gave permissions to sc-ffmpeg to the 'video' share and tried again. The next error was:

[hls @ 0x2229380] Failed to open file '/volume1/@appstore/jellyfin/var/data/transcodes/b46e5a714f6a6f394b119975c45f9d2b0.ts'
av_interleaved_write_frame(): Permission denied

So I then took a look and compared the binary files:

$ ls -all  /var/packages/ffmpeg/target/bin/ffmpeg
-rwsr-xr-x 1 sc-ffmpeg ffmpeg 270104 Mar 28 23:14 /var/packages/ffmpeg/target/bin/ffmpeg
$ ls -all  /var/packages/ffmpeg6/target/bin/ffmpeg
-rwxr-xr-x 1 sc-ffmpeg6 ffmpeg6 295256 Mar 29 07:24 /var/packages/ffmpeg6/target/bin/ffmpeg

I noted that the user had the permissions rws rather than rwx. Checking the service setup script I saw the following:

spksrc/spk/ffmpeg4/src/service-setup.sh

Lines 25 to 26 in 8a7f712

	chmod u+s /var/packages/ffmpeg/target/bin/ffmpeg
	chmod u+s /var/packages/ffmpeg/target/bin/vainfo

spksrc/spk/ffmpeg6/src/service-setup.sh

Lines 25 to 26 in 8a7f712

	chmod u+s /var/packages/ffmpeg/target/bin/ffmpeg
	chmod u+s /var/packages/ffmpeg/target/bin/vainfo

The first was the line which set the permission. The second is the same line in the ffmpeg6 package which was not correctly updated to set this same permission (since it was still pointing to the older ffmpeg4 path). To test this I issued the following:

$ sudo chmod u-s+x /var/packages/ffmpeg/target/bin/ffmpeg
$ sudo chmod u-s+x /var/packages/ffmpeg/target/bin/vainfo

Once this was done, the video played correctly in DSM 6.

These service setup script commands only run in DSM 6 and I wonder if the note which says "setuid for proper vaapi access", is still valid. If not, then these should be removed from ffmpeg v4, v5 and v6. Based on some research this command has the following meaning:

The s in rws stands for setuid meaning set user ID. This is a special permission bit that allows the program, when run by any user, to be run with the effective UID of the owner.

The problem with this approach is that the folders it has to interact with do not allow the user sc-ffmpeg to write to it as shown in the following:

$ sudo -u sc-ffmpeg touch /volume1/@appstore/jellyfin/var/data/transcodes/test
touch: cannot touch ‘/volume1/@appstore/jellyfin/var/data/transcodes/test’: Permission denied

[th0ma7]

If i recall on older dsm regular users could not have access to the gpu device file as such ffmpeg4 was installed as root with set-uid-bit (unsecure but functional).

On dsm7 there is now a videodriver group which solves things whereas long as the user is in that group he's then good to go.

What i may have change is switching ffmpeg on dsm6 now belonging to user sc-ffmpeg which blew things up.

I'll have to reconvene and fix this. AFK currently, would you mind opening up an issue and linking opened items? I'll look at it later this week. Thnx.

[mreid-tt]

If i recall on older dsm regular users could not have access to the gpu device file as such ffmpeg4 was installed as root with set-uid-bit (unsecure but functional).

On dsm7 there is now a videodriver group which solves things whereas long as the user is in that group he's then good to go.

Hmm, not familiar with this one. It does seem that the ffmpeg binary is installed with the file owner sc-ffmpeg currently and not root. It seems to work without root.

What i may have change is switching ffmpeg on dsm6 now belonging to user sc-ffmpeg which blew things up.

I'll have to reconvene and fix this. AFK currently, would you mind opening up an issue and linking opened items? I'll look at it later this week. Thnx.

Sure, check out #5710 for the issue as requested.

[publicarray]

IIRC As a user I gave both jellyfin an ffmpeg permisions to my media files and both ffmpeg an jellyfin had the videodriver worker / group, Not sure if the last one is nessessary anymore but it allowed jellyfin access to ffmpeg back when DSM7 was in beta.