Refactor Docker build workflows (#1221)

* Initial implementation * Multiple fixes and improvemens * Better `curl` retries timing * Remove unused `TARGETOS` and `TARGETVARIANT` vars; add the version fetch fallback code to the build scripts * Move the fallback code before the var usage * Use double braces to make the code compatible with the `set -u` --------- Co-authored-by: Konstantin Koval
2026-08-03 19:39:19 +00:00 · 2025-06-26 11:58:50 +03:00
parent 73ae3e8132
commit a8edb30ae4
13 changed files with 371 additions and 144 deletions
--- a/dependencies/Dockerfile
+++ b/dependencies/Dockerfile
@@ -1,26 +1,60 @@
-FROM --platform=${BUILDPLATFORM:-linux/amd64} debian:bookworm-slim AS build
+FROM --platform=${BUILDPLATFORM:-linux/amd64} debian:bookworm-slim AS base-prep
 ARG TARGETPLATFORM
-
-# See for details: https://github.com/hadolint/hadolint/wiki/DL4006
 SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
+COPY --chmod=0755 prepare.sh /tmp/
+RUN /tmp/prepare.sh \
+    && mkdir -p /output/bin /output/lib /output/include /output/pkgconfig /output/etc /output/deb

-RUN mkdir -p /tmp/build
-WORKDIR /tmp/build
+FROM base-prep AS build-libraw
+ARG LIBRAW_VERSION
+ARG TARGETARCH
+ENV BUILD_CACHE_DIR=/build-cache
+WORKDIR /tmp/build-libraw
+COPY --chmod=0755 build_libraw.sh .
+RUN --mount=type=cache,target=${BUILD_CACHE_DIR},id=libraw-${TARGETARCH}-${LIBRAW_VERSION} \
+    --mount=type=secret,id=github_token \
+    export GITHUB_TOKEN=$(cat /run/secrets/github_token) \
+    && export $(cat /env) && ./build_libraw.sh

-COPY prepare.sh /tmp/build/
-RUN ./prepare.sh
+FROM base-prep AS build-libheif
+ARG LIBHEIF_VERSION
+ARG TARGETARCH
+ENV BUILD_CACHE_DIR=/build-cache
+WORKDIR /tmp/build-libheif
+COPY --chmod=0755 build_libheif.sh .
+RUN --mount=type=cache,target=${BUILD_CACHE_DIR},id=libheif-${TARGETARCH}-${LIBHEIF_VERSION} \
+    --mount=type=secret,id=github_token \
+    export GITHUB_TOKEN=$(cat /run/secrets/github_token) \
+    && export $(cat /env) && ./build_libheif.sh

-COPY build_libraw.sh /tmp/build/
-RUN export $(cat /env) && ./build_libraw.sh
-COPY build_libheif.sh /tmp/build/
-RUN export $(cat /env) && ./build_libheif.sh
-COPY build_imagemagick.sh /tmp/build/
-RUN export $(cat /env) && ./build_imagemagick.sh
-COPY download_jellyfin-ffmpeg.sh /tmp/build/
-RUN export $(cat /env) && ./download_jellyfin-ffmpeg.sh
+FROM base-prep AS build-imagemagick
+ARG IMAGEMAGICK_VERSION
+ARG TARGETARCH
+ENV BUILD_CACHE_DIR=/build-cache
+WORKDIR /tmp/build-imagemagick
+COPY --chmod=0755 build_imagemagick.sh .
+RUN --mount=type=cache,target=${BUILD_CACHE_DIR},id=imagemagick-${TARGETARCH}-${IMAGEMAGICK_VERSION} \
+    --mount=type=secret,id=github_token \
+    export GITHUB_TOKEN=$(cat /run/secrets/github_token) \
+    && export $(cat /env) && ./build_imagemagick.sh

-COPY output.sh /
+FROM base-prep AS download-jellyfin-ffmpeg
+ARG JELLYFIN_FFMPEG_VERSION
+ARG TARGETARCH
+ENV BUILD_CACHE_DIR=/build-cache
+WORKDIR /tmp/download-ffmpeg
+COPY --chmod=0755 download_jellyfin-ffmpeg.sh .
+RUN --mount=type=cache,target=${BUILD_CACHE_DIR},id=ffmpeg-${TARGETARCH}-${JELLYFIN_FFMPEG_VERSION} \
+    export $(cat /env) && ./download_jellyfin-ffmpeg.sh
+
+FROM base-prep AS final-assembly
+COPY --from=build-libraw /output/ /output/
+COPY --from=build-libheif /output/ /output/
+COPY --from=build-imagemagick /output/ /output/
+COPY --from=download-jellyfin-ffmpeg /output/ /output/
+COPY --chmod=0755 output.sh /
 RUN /output.sh

-FROM debian:bookworm-slim AS release
-COPY --from=build /artifacts.tar.gz /
+FROM scratch AS release
+COPY --from=final-assembly /artifacts.tar.gz /
+USER nobody
--- a/dependencies/README.md
+++ b/dependencies/README.md
@@ -1,2 +1,3 @@
 # Dependencies
-This is used to build and store 3rd-party dependencies for Photoview products
+
+This directory contains scripts and Dockerfile to build third-party dependencies for Photoview. It is not intended for end-users or runtime execution.
--- a/dependencies/build_imagemagick.sh
+++ b/dependencies/build_imagemagick.sh
@@ -1,15 +1,52 @@
 #!/bin/bash
 set -euo pipefail

-: ${DEB_HOST_MULTIARCH=`uname -m`-linux-gnu}
-: ${DEB_HOST_ARCH=`dpkg --print-architecture`}
+# Fallback to the latest version if IMAGEMAGICK_VERSION is not set
+if [[ -z "$IMAGEMAGICK_VERSION" ]]; then
+  echo "WARN: ImageMagick version is empty, most likely the script runs not on CI."
+  echo "Fetching the latest version from ImageMagick repo..."
+  IMAGEMAGICK_VERSION=$(curl -fsSL --retry 2 --retry-delay 5 --retry-max-time 60 \
+    "https://api.github.com/repos/ImageMagick/ImageMagick/releases/latest" | jq -r '.tag_name')
+fi

-echo Compiler: ${DEB_HOST_MULTIARCH} Arch: ${DEB_HOST_ARCH}
+: "${DEB_HOST_MULTIARCH:=$(uname -m)-linux-gnu}"
+: "${DEB_HOST_ARCH:=$(dpkg --print-architecture)}"
+CACHE_DIR="${BUILD_CACHE_DIR:-/build-cache}/ImageMagick-${IMAGEMAGICK_VERSION}"
+CACHE_MARKER="${CACHE_DIR}/ImageMagick-${IMAGEMAGICK_VERSION}-complete"

-apt-get install -y libjxl-dev:${DEB_HOST_ARCH} liblcms2-dev:${DEB_HOST_ARCH} liblqr-1-0-dev:${DEB_HOST_ARCH} libdjvulibre-dev:${DEB_HOST_ARCH} libjpeg62-turbo-dev:${DEB_HOST_ARCH} libopenjp2-7-dev:${DEB_HOST_ARCH} libopenexr-dev:${DEB_HOST_ARCH} libpng-dev:${DEB_HOST_ARCH} libtiff-dev:${DEB_HOST_ARCH} libwebp-dev:${DEB_HOST_ARCH} libxml2-dev:${DEB_HOST_ARCH} libfftw3-dev:${DEB_HOST_ARCH} zlib1g-dev:${DEB_HOST_ARCH} liblzma-dev:${DEB_HOST_ARCH} libbz2-dev:${DEB_HOST_ARCH}
-URL=$(curl -s https://api.github.com/repos/ImageMagick/ImageMagick/releases/latest | grep "tarball_url" | cut -d : -f 2,3 | tr -d ' ,"')
-echo download ImageMagick from $URL
-curl -L -o ./magick.tar.gz "$URL"
+# Check if this specific version is already built and cached
+if [[ -f "$CACHE_MARKER" ]] && [[ -d "${CACHE_DIR}/output" ]]; then
+  echo "ImageMagick ${IMAGEMAGICK_VERSION} found in cache, reusing..."
+  mkdir -p /output
+  cp -ra "${CACHE_DIR}/output/"* /output/
+  exit 0
+fi
+
+echo "Building ImageMagick ${IMAGEMAGICK_VERSION} (cache miss)..."
+
+echo Compiler: "${DEB_HOST_MULTIARCH}" Arch: "${DEB_HOST_ARCH}"
+
+apt-get install -y --no-install-recommends \
+  libjxl-dev:"${DEB_HOST_ARCH}" \
+  liblcms2-dev:"${DEB_HOST_ARCH}" \
+  liblqr-1-0-dev:"${DEB_HOST_ARCH}" \
+  libdjvulibre-dev:"${DEB_HOST_ARCH}" \
+  libjpeg62-turbo-dev:"${DEB_HOST_ARCH}" \
+  libopenjp2-7-dev:"${DEB_HOST_ARCH}" \
+  libopenexr-dev:"${DEB_HOST_ARCH}" \
+  libpng-dev:"${DEB_HOST_ARCH}" \
+  libtiff-dev:"${DEB_HOST_ARCH}" \
+  libwebp-dev:"${DEB_HOST_ARCH}" \
+  libxml2-dev:"${DEB_HOST_ARCH}" \
+  libfftw3-dev:"${DEB_HOST_ARCH}" \
+  zlib1g-dev:"${DEB_HOST_ARCH}" \
+  liblzma-dev:"${DEB_HOST_ARCH}" \
+  libbz2-dev:"${DEB_HOST_ARCH}"
+
+URL="https://api.github.com/repos/ImageMagick/ImageMagick/tarball/${IMAGEMAGICK_VERSION}"
+echo download ImageMagick from "$URL"
+curl -fsSL --retry 2 --retry-delay 5 --retry-max-time 60 -o ./magick.tar.gz \
+  ${GITHUB_TOKEN:+-H "Authorization: Bearer ${GITHUB_TOKEN}"} "$URL"

 tar xfv ./magick.tar.gz
 cd ImageMagick-*
@@ -20,13 +57,13 @@ cd ImageMagick-*
  --with-raw --with-tiff --with-webp \
  --without-x --without-magick-plus-plus \
  --without-perl --disable-doc \
-  --host=${DEB_HOST_MULTIARCH}
+  --host="${DEB_HOST_MULTIARCH}"
 make
 make install
 cd ..

 mkdir -p /output/bin /output/etc /output/lib /output/include /output/pkgconfig
-cp /usr/local/bin/magick /output/bin/
+cp -a /usr/local/bin/magick /output/bin/
 cp -a /usr/local/etc/ImageMagick-7 /output/etc/
 cp -a /usr/local/lib/ImageMagick-* /output/lib/
 cp -a /usr/local/lib/libMagickCore-* /output/lib/
@@ -36,3 +73,11 @@ cp -a /usr/local/lib/pkgconfig/ImageMagick*.pc /output/pkgconfig/
 cp -a /usr/local/lib/pkgconfig/MagickCore*.pc /output/pkgconfig/
 cp -a /usr/local/lib/pkgconfig/MagickWand*.pc /output/pkgconfig/
 file /output/bin/magick
+
+# After successful build, cache the results
+echo "Caching ImageMagick ${IMAGEMAGICK_VERSION} build results..."
+mkdir -p "${CACHE_DIR}/output"
+cp -ra /output/* "${CACHE_DIR}/output/"
+touch "$CACHE_MARKER"
+
+echo "ImageMagick ${IMAGEMAGICK_VERSION} build complete and cached"
--- a/dependencies/build_libheif.sh
+++ b/dependencies/build_libheif.sh
@@ -1,19 +1,56 @@
 #!/bin/bash
 set -euo pipefail

-: ${DEB_HOST_MULTIARCH=`uname -m`-linux-gnu}
-: ${DEB_HOST_ARCH=`dpkg --print-architecture`}
+# Fallback to the latest version if LIBHEIF_VERSION is not set
+if [[ -z "$LIBHEIF_VERSION" ]]; then
+  echo "WARN: libheif version is empty, most likely the script runs not on CI."
+  echo "Fetching the latest version from libheif repo..."
+  LIBHEIF_VERSION=$(curl -fsSL --retry 2 --retry-delay 5 --retry-max-time 60 \
+    "https://api.github.com/repos/strukturag/libheif/releases/latest" | jq -r '.tag_name')
+fi

-echo Compiler: ${DEB_HOST_MULTIARCH} Arch: ${DEB_HOST_ARCH}
+: "${DEB_HOST_MULTIARCH:=$(uname -m)-linux-gnu}"
+: "${DEB_HOST_ARCH:=$(dpkg --print-architecture)}"
+CACHE_DIR="${BUILD_CACHE_DIR:-/build-cache}/libheif-${LIBHEIF_VERSION}"
+CACHE_MARKER="${CACHE_DIR}/libheif-${LIBHEIF_VERSION}-complete"

-apt-get install -y libdav1d-dev:${DEB_HOST_ARCH} libde265-dev:${DEB_HOST_ARCH} libjpeg62-turbo-dev:${DEB_HOST_ARCH} libopenh264-dev:${DEB_HOST_ARCH} libpng-dev:${DEB_HOST_ARCH} libnuma-dev:${DEB_HOST_ARCH} zlib1g-dev:${DEB_HOST_ARCH}
-URL=$(curl -s https://api.github.com/repos/strukturag/libheif/releases/latest | grep "tarball_url" | cut -d : -f 2,3 | tr -d ' ,"')
-echo download libraw from $URL
-curl -L -o ./libheif.tar.gz "$URL"
+# Check if this specific version is already built and cached
+if [[ -f "$CACHE_MARKER" ]] && [[ -d "${CACHE_DIR}/output" ]]; then
+  echo "libheif ${LIBHEIF_VERSION} found in cache, reusing..."
+  mkdir -p /output
+  cp -ra "${CACHE_DIR}/output/"* /output/
+  exit 0
+fi
+
+echo "Building libheif ${LIBHEIF_VERSION} (cache miss)..."
+
+echo Compiler: "${DEB_HOST_MULTIARCH}" Arch: "${DEB_HOST_ARCH}"
+
+apt-get install -y --no-install-recommends \
+  libdav1d-dev:"${DEB_HOST_ARCH}" \
+  libde265-dev:"${DEB_HOST_ARCH}" \
+  libjpeg62-turbo-dev:"${DEB_HOST_ARCH}" \
+  libopenh264-dev:"${DEB_HOST_ARCH}" \
+  libpng-dev:"${DEB_HOST_ARCH}" \
+  libnuma-dev:"${DEB_HOST_ARCH}" \
+  zlib1g-dev:"${DEB_HOST_ARCH}"
+
+URL="https://api.github.com/repos/strukturag/libheif/tarball/${LIBHEIF_VERSION}"
+echo download libheif from "$URL"
+curl -fsSL --retry 2 --retry-delay 5 --retry-max-time 60 -o ./libheif.tar.gz \
+  ${GITHUB_TOKEN:+-H "Authorization: Bearer ${GITHUB_TOKEN}"} "$URL"

 tar xfv ./libheif.tar.gz
-cd *-libheif-*
-cmake --preset=release -DCMAKE_SYSTEM_PROCESSOR=${DEB_HOST_ARCH} -DCMAKE_C_COMPILER=${DEB_HOST_MULTIARCH}-gcc -DCMAKE_CXX_COMPILER=${DEB_HOST_MULTIARCH}-g++ -DPKG_CONFIG_EXECUTABLE=${DEB_HOST_MULTIARCH}-pkg-config -DCMAKE_LIBRARY_ARCHITECTURE=${DEB_HOST_MULTIARCH} -DENABLE_PLUGIN_LOADING=OFF -DWITH_GDK_PIXBUF=OFF .
+cd ./*-libheif-*
+cmake \
+  --preset=release \
+  -DCMAKE_SYSTEM_PROCESSOR="${DEB_HOST_ARCH}" \
+  -DCMAKE_C_COMPILER="${DEB_HOST_MULTIARCH}"-gcc \
+  -DCMAKE_CXX_COMPILER="${DEB_HOST_MULTIARCH}"-g++ \
+  -DPKG_CONFIG_EXECUTABLE="${DEB_HOST_MULTIARCH}"-pkg-config \
+  -DCMAKE_LIBRARY_ARCHITECTURE="${DEB_HOST_MULTIARCH}" \
+  -DENABLE_PLUGIN_LOADING=OFF \
+  -DWITH_GDK_PIXBUF=OFF .
 make
 make install
 cd ..
@@ -24,3 +61,11 @@ cp -a /usr/local/lib/libheif* /output/lib/
 cp -a /usr/local/lib/pkgconfig/libheif* /output/pkgconfig/
 cp -a /usr/local/include/libheif /output/include/
 file /usr/local/lib/libheif.so*
+
+# After successful build, cache the results
+echo "Caching libheif ${LIBHEIF_VERSION} build results..."
+mkdir -p "${CACHE_DIR}/output"
+cp -ra /output/* "${CACHE_DIR}/output/"
+touch "$CACHE_MARKER"
+
+echo "libheif ${LIBHEIF_VERSION} build complete and cached"
--- a/dependencies/build_libraw.sh
+++ b/dependencies/build_libraw.sh
@@ -1,20 +1,50 @@
 #!/bin/bash
 set -euo pipefail

-: ${DEB_HOST_MULTIARCH=`uname -m`-linux-gnu}
-: ${DEB_HOST_ARCH=`dpkg --print-architecture`}
+# Fallback to the latest version if LIBRAW_VERSION is not set
+if [[ -z "$LIBRAW_VERSION" ]]; then
+  echo "WARN: LibRaw version is empty, most likely the script runs not on CI."
+  echo "Fetching the latest version from LibRaw repo..."
+  LIBRAW_VERSION=$(curl -fsSL --retry 2 --retry-delay 5 --retry-max-time 60 \
+    "https://api.github.com/repos/LibRaw/LibRaw/releases/latest" | jq -r '.tag_name')
+fi

-echo Compiler: ${DEB_HOST_MULTIARCH} Arch: ${DEB_HOST_ARCH}
+: "${DEB_HOST_MULTIARCH:=$(uname -m)-linux-gnu}"
+: "${DEB_HOST_ARCH:=$(dpkg --print-architecture)}"
+CACHE_DIR="${BUILD_CACHE_DIR:-/build-cache}/LibRaw-${LIBRAW_VERSION}"
+CACHE_MARKER="${CACHE_DIR}/LibRaw-${LIBRAW_VERSION}-complete"

-apt-get install -y libjpeg62-turbo-dev:${DEB_HOST_ARCH} liblcms2-dev:${DEB_HOST_ARCH} zlib1g-dev:${DEB_HOST_ARCH}
-URL=$(curl -s https://api.github.com/repos/LibRaw/LibRaw/releases/latest | grep "tarball_url" | cut -d : -f 2,3 | tr -d ' ,"')
-echo download libraw from $URL
-curl -L -o ./libraw.tar.gz "$URL"
+# Check if this specific version is already built and cached
+if [[ -f "$CACHE_MARKER" ]] && [[ -d "${CACHE_DIR}/output" ]]; then
+  echo "LibRaw ${LIBRAW_VERSION} found in cache, reusing..."
+  mkdir -p /output
+  cp -ra "${CACHE_DIR}/output/"* /output/
+  exit 0
+fi
+
+echo "Building LibRaw ${LIBRAW_VERSION} (cache miss)..."
+
+echo Compiler: "${DEB_HOST_MULTIARCH}" Arch: "${DEB_HOST_ARCH}"
+
+apt-get install -y --no-install-recommends \
+  libjpeg62-turbo-dev:"${DEB_HOST_ARCH}" \
+  liblcms2-dev:"${DEB_HOST_ARCH}" \
+  zlib1g-dev:"${DEB_HOST_ARCH}"
+
+URL="https://api.github.com/repos/LibRaw/LibRaw/tarball/${LIBRAW_VERSION}"
+echo download libraw from "$URL"
+curl -fsSL --retry 2 --retry-delay 5 --retry-max-time 60 -o ./libraw.tar.gz \
+  ${GITHUB_TOKEN:+-H "Authorization: Bearer ${GITHUB_TOKEN}"} "$URL"

 tar xfv ./libraw.tar.gz
 cd LibRaw-*
 autoreconf --install
-./configure --disable-option-checking --disable-silent-rules --disable-maintainer-mode --disable-dependency-tracking --host=${DEB_HOST_MULTIARCH}
+./configure \
+  --disable-option-checking \
+  --disable-silent-rules \
+  --disable-maintainer-mode \
+  --disable-dependency-tracking \
+  --host="${DEB_HOST_MULTIARCH}"
 make
 make install
 cd ..
@@ -25,3 +55,11 @@ cp -a /usr/local/lib/libraw_r* /output/lib/
 cp -a /usr/local/lib/pkgconfig/libraw* /output/pkgconfig/
 cp -a /usr/local/include/libraw /output/include/
 file /usr/local/lib/libraw_r.so*
+
+# After successful build, cache the results
+echo "Caching LibRaw ${LIBRAW_VERSION} build results..."
+mkdir -p "${CACHE_DIR}/output"
+cp -ra /output/* "${CACHE_DIR}/output/"
+touch "$CACHE_MARKER"
+
+echo "LibRaw ${LIBRAW_VERSION} build complete and cached"
--- a/dependencies/download_jellyfin-ffmpeg.sh
+++ b/dependencies/download_jellyfin-ffmpeg.sh
@@ -1,14 +1,42 @@
 #!/bin/bash
 set -euo pipefail

-: ${DEB_HOST_MULTIARCH=x86_64-linux-gnu}
-: ${DEB_HOST_ARCH=amd64}
+# Fallback to the latest version if JELLYFIN_FFMPEG_VERSION is not set
+if [[ -z "$JELLYFIN_FFMPEG_VERSION" ]]; then
+  echo "WARN: jellyfin-ffmpeg version is empty, most likely the script runs not on CI."
+  echo "Fetching the latest version from jellyfin-ffmpeg repo..."
+  JELLYFIN_FFMPEG_VERSION=$(curl -fsSL --retry 2 --retry-delay 5 --retry-max-time 60 \
+    "https://api.github.com/repos/jellyfin/jellyfin-ffmpeg/releases/latest" | jq -r '.tag_name')
+fi

-echo Compiler: ${DEB_HOST_MULTIARCH} Arch: ${DEB_HOST_ARCH}
+: "${DEB_HOST_MULTIARCH:=$(uname -m)-linux-gnu}"
+: "${DEB_HOST_ARCH:=$(dpkg --print-architecture)}"
+CACHE_DIR="${BUILD_CACHE_DIR:-/build-cache}/jellyfin-ffmpeg-${JELLYFIN_FFMPEG_VERSION}"
+CACHE_MARKER="${CACHE_DIR}/jellyfin-ffmpeg-${JELLYFIN_FFMPEG_VERSION}-complete"

-URL=$(curl -s https://api.github.com/repos/jellyfin/jellyfin-ffmpeg/releases/latest | grep \"browser_download_url\".*bookworm_${DEB_HOST_ARCH} | cut -d : -f 2,3 | tr -d ' ,"')
-echo download jellyfin-ffmpeg from $URL
-curl -L -o ./jellyfin-ffmpeg.deb "$URL"
+# Check if this specific version is already downloaded and cached
+if [[ -f "$CACHE_MARKER" ]] && [[ -d "${CACHE_DIR}/output" ]]; then
+  echo "jellyfin-ffmpeg ${JELLYFIN_FFMPEG_VERSION} found in cache, reusing..."
+  mkdir -p /output
+  cp -ra "${CACHE_DIR}/output/"* /output/
+  exit 0
+fi

+echo "Downloading jellyfin-ffmpeg ${JELLYFIN_FFMPEG_VERSION} (cache miss)..."
+
+echo Compiler: "${DEB_HOST_MULTIARCH}" Arch: "${DEB_HOST_ARCH}"
+
+VER="${JELLYFIN_FFMPEG_VERSION#v}"
+MAJOR_VER=$(echo "${VER}" | cut -d. -f1)
+URL="https://github.com/jellyfin/jellyfin-ffmpeg/releases/download/${JELLYFIN_FFMPEG_VERSION}/jellyfin-ffmpeg${MAJOR_VER}_${VER}-bookworm_${DEB_HOST_ARCH}.deb"
+echo download jellyfin-ffmpeg from "$URL"
 mkdir -p /output/deb
-cp ./jellyfin-ffmpeg.deb /output/deb/
+curl -fsSL --retry 2 --retry-delay 5 --retry-max-time 60 -o /output/deb/jellyfin-ffmpeg.deb "$URL"
+
+# After successful download, cache the results
+echo "Caching jellyfin-ffmpeg ${JELLYFIN_FFMPEG_VERSION} build results..."
+mkdir -p "${CACHE_DIR}/output"
+cp -ra /output/* "${CACHE_DIR}/output/"
+touch "$CACHE_MARKER"
+
+echo "jellyfin-ffmpeg ${JELLYFIN_FFMPEG_VERSION} downloaded and cached"
--- a/dependencies/output.sh
+++ b/dependencies/output.sh
@@ -2,4 +2,4 @@
 set -euo pipefail

 cd /output
-tar czfv /artifacts.tar.gz *
+tar czfv /artifacts.tar.gz ./*
--- a/dependencies/prepare.sh
+++ b/dependencies/prepare.sh
@@ -1,27 +1,32 @@
 #!/bin/bash
 set -euo pipefail

-: ${TARGETPLATFORM=linux/`dpkg --print-architecture`}
+: "${TARGETPLATFORM:=linux/$(dpkg --print-architecture)}"
+: "${DEB_HOST_MULTIARCH:=$(uname -m)-linux-gnu}"

-TARGETOS="$(echo $TARGETPLATFORM | cut -d"/" -f1)"
-TARGETARCH="$(echo $TARGETPLATFORM | cut -d"/" -f2)"
-TARGETVARIANT="$(echo $TARGETPLATFORM | cut -d"/" -f3)"
+TARGETARCH="$(echo "$TARGETPLATFORM" | cut -d"/" -f2)"

 DEBIAN_ARCH=$TARGETARCH
-if [ "$TARGETARCH" = "arm" ]
-then
+if [ "$TARGETARCH" = "arm" ]; then
  DEBIAN_ARCH=armel
-  if [ "$TARGETVARIANT" = "v7" ]
-  then
-    DEBIAN_ARCH=armhf
-  fi
 fi

-dpkg --add-architecture $DEBIAN_ARCH
+dpkg --add-architecture "$DEBIAN_ARCH"
 apt-get update
-apt-get install -y curl crossbuild-essential-${DEBIAN_ARCH} libc-dev:${DEBIAN_ARCH} autoconf automake libtool m4 pkg-config cmake
+apt-get install -y --no-install-recommends \
+  curl \
+  ca-certificates \
+  crossbuild-essential-"${DEBIAN_ARCH}" \
+  libc-dev:"${DEBIAN_ARCH}" \
+  autoconf \
+  automake \
+  libtool \
+  m4 \
+  pkg-config \
+  cmake

-dpkg-architecture -a $DEBIAN_ARCH >/env
+dpkg-architecture -a "$DEBIAN_ARCH" >/env
+echo "PKG_CONFIG_PATH=/usr/lib/${DEB_HOST_MULTIARCH}/pkgconfig" >>/env
+# shellcheck disable=SC2046
 export $(cat /env)
-echo PKG_CONFIG_PATH=/usr/lib/${DEB_HOST_MULTIARCH}/pkgconfig >>/env
 cat /env