Transcode demo box

Runtime: native — no interpreter at all; the binary is the command line.

---

This is the case the native runtime exists for: a large compiled program where "just install it" means a different version on every machine, and a different answer from each.

The box pins one ffmpeg, carries the ninety-odd libraries it links against, and is signed — so the transcode a user runs is the transcode that was tested.

$ scrollcase run box/*.release.json -- -i clip.mov clip.mp4

Everything after -- is ffmpeg's own command line, so anything you already know how to ask it for still works. Nothing is installed to make that run: 121 MB archived, 391 MB extracted, and no compiler anywhere near it.

Try the demo

Build it yourself

The demo repository is almost empty on purpose: you package ffmpeg yourself, and its README is the walkthrough. Install the CLI, initialise the workspace, create the scroll, declare the dependency, lock, commit, sign and build.

Open in GitHub Codespaces

Builds the Linux x86_64 CPU box using your GitHub Codespaces account.

Download the prebuilt box

You can find the box's GitHub release here.

macOS (Metal)	Linux (CPU)	Windows (CPU)
macos-aarch64-metal	linux-x86_64-cpu	windows-x86_64-cpu

The trust key is deliberately not inside the archive — a signature proves nothing if the key travels with what it signs:

unzip transcode-demo-1.0.0-<target>.zip -d transcode-demo && cd transcode-demo
mkdir keys && curl -o keys/example-signing-public.json \
  https://raw.githubusercontent.com/suffro/scrollcase/main/examples/keys/example-signing-public.json

npm install -g scrollcase
scrollcase verify box/*.release.json --public-key keys/example-signing-public.json
scrollcase run    box/*.release.json --public-key keys/example-signing-public.json -- -version

Everything after -- goes to ffmpeg. The box always passes -hide_banner first, because that is its declared defaultArgs.

The self-test runs a real encode

Its probes do not check a version string. They synthesise a test pattern through lavfi, encode it with libx264 and discard the result — so a box whose codecs did not load fails the build, before anything is signed.

A third probe declares expectExitCode: 254, which is the point rather than a curiosity: ffmpeg reports the negative C error number for a missing input, ENOENT is 2, and an exit status is one byte. The value was measured against the built payload, not assumed — a self-test asserts the binary's real contract, not a convention.

That probe is declared in the macOS and Linux scrolls rather than in the base the three share, because the one-byte exit status it depends on is a POSIX fact: the format caps expectExitCode at 255, and Windows exit codes are 32-bit. It is a probe the Windows box does not run, rather than one it runs weakly — and a good illustration of why a split scroll keeps per-target facts per target.

What redistributing it costs

Twenty-one of the ninety packages are GPL-family — ffmpeg itself, and x264 and x265 at GPL-2.0-or-later. That is a fact about handing this box to somebody else rather than about running it, and it is the demo where a licence inventory stops being paperwork: scrollcase audit derives the full list from the lock, and the build refuses to sign a box whose inventory no longer matches what the lock resolved.

What a native box will not do for you

Scrollcase does not repair a binary's library paths. A program that finds its libraries through an absolute path recorded at compile time will not find them inside a box, and the self-test catches that at build time rather than shipping it. The first native example written here failed on conda-forge's own ncurses, which carries an unrewritten build-machine path to libtinfo.

The other shapes

dataset-demo is the second native box, and codon-demo is the node one.