Securing Dependencies for Rails 5.2 Active Storage

Summary

Supporting Rails 5.2 Active Storage on Heroku required handling media files for PDF and video previews while addressing FFmpeg’s security and packaging constraints. Ubuntu Trusty’s lack of FFmpeg support, Xenial’s community-maintained package and missing vulnerability backports, and concerns about Libav led the team to build its own binary. Using a fork of sffmpeg and modified CMake configuration, the team created a static FFmpeg build that removed non-free software and unused components such as RTMP and xvid, reducing dependencies and attack surface. Docker-based CircleCI automation compiles the binary, packages it as a Debian archive, uploads it to AWS S3, and lets the buildpack install it without root access. The resulting package is about 30MB instead of roughly 200MB and can be updated in around 20 minutes after upstream security releases.

Takeaways

1. 1

   The reduced static build is about 30MB, compared with roughly 200MB for FFmpeg and its default dependencies.

2. 2

   Removing unused components such as RTMP stream support and xvid reduces dependencies that would require security monitoring and could introduce vulnerabilities.

3. 3

   The automated CI build and upload process takes around 20 minutes, enabling rapid distribution of patches after upstream security releases.