9.0.4

Builds FFmpeg 9.0. Four new libraries, two new options, and one fix that affects every
default build on Linux.

Default builds on Linux had no TLS at all

build_gnutls built the whole gmp/nettle/gnutls chain and then never passed
--enable-gnutls — the line had been commented out. Neither gnutls nor openssl is in
FFmpeg's EXTERNAL_AUTODETECT_LIBRARY_LIST, so nothing filled the gap: an LGPL build could
not open an https:// URL. macOS was unaffected, because FFmpeg autodetects
SecureTransport there. Fixed, and the TLS backend is now a choice
(#178):

./build-ffmpeg --build --tls=gnutls     # default without --enable-gpl-and-non-free
./build-ffmpeg --build --tls=openssl    # default with it

FFmpeg refuses both at once, so exactly one is built. Under --tls=gnutls, libssh and libsrt
are skipped and the script says so before the build starts: libssh has no GnuTLS backend, and
libsrt's uses nettle's struct aes_ctx, removed in nettle 4.0.

GnuTLS also builds on Apple Silicon again — the skip dated from 3.6.16 and the pinned 3.8.13
builds fine.

New libraries

• libvvenc — H.266/VVC encoding
  (#179). FFmpeg's native VVC
  decoder was already there; this adds the encoder. Encoder name libvvenc.

• whisper.cpp — speech recognition through the af_whisper filter
  (#251). Opt-in, because
  exactly one ggml backend is compiled into a static binary and it has to match the machine
  that runs it:

  ./build-ffmpeg --build --whisper=cpu      # portable
  ./build-ffmpeg --build --whisper=metal    # macOS
  ./build-ffmpeg --build --whisper=cuda     # Linux, needs nvcc
  ./build-ffmpeg --build --whisper=vulkan   # Linux, needs glslc and a Vulkan loader

  No models are shipped; af_whisper takes model=/path at runtime. The cuda and
  vulkan backends have not been built or linked by anyone yet — reports welcome.

• libmysofa — the sofalizer filter, for binaural rendering
  (#219).

Leaving libraries out

--disable-lv2 and SKIPRAV1E=yes are gone, replaced by one option that takes any package
name --list-packages prints:

./build-ffmpeg --build --disable=rav1e,x265
./build-ffmpeg --build --disable=lv2 --disable=vulkan

lv2, vulkan, opencl and bluray stand for the whole cluster behind them. Disabling a
package also disables what cannot build without it and says so, so --disable=libogg takes
libvorbis and libtheora with it. Build tools and the TLS stack cannot be disabled; they are
marked always built in --list-packages. Names are checked before anything is built.

CUDA on RTX 50xx

CUDA_COMPUTE_CAPABILITY defaulted to a fixed 75 or 52, below Blackwell's 120, so an RTX 50xx
could not use its AV1 decoder
(#252). The capability is now
read from the installed GPU with nvidia-smi and checked against the CUDA toolkit by
compiling for it; the old defaults remain the fallback. Setting the variable yourself still
wins. Raising the default instead was not an option — FFmpeg cannot produce a
multi-architecture CUDA build, so one fixed value always breaks somebody.

Other changes

• --update replaces the script in place with the latest release. It refuses to run in a
  git checkout, verifies the archive before deleting anything, and leaves packages/ and
  workspace/ alone, so only packages whose version moved are rebuilt.
• --latest is removed. Its only reader was the branch that skipped an outdated package;
  passing it now fails as an unknown option instead of being silently ignored.
• A package whose pinned version changed is always rebuilt. Previously that needed
  --latest, so the default was to keep linking FFmpeg against a library the script no longer
  pinned.
• Every version pin and checksum is back in one table, src/10-versions.sh.
• CI checks that the option list in the README still matches --help.

Upgrading

--disable-lv2 → --disable=lv2, SKIPRAV1E=yes → --disable=rav1e, and --latest should
be dropped. Everything else is compatible.