Bundle libopus instead of linking the system copy

[Turbootzz]

Closes #201.

opus 0.4 replaces the unmaintained audiopus_sys (RUSTSEC-2026-0150) with opusic-sys 0.7 (BSD-3, libopus 1.6.1, MSRV 1.82). The opus API is byte-identical between 0.3.1 and 0.4.0 apart from the extern crate line, so the encoder code does not move.

opus pulls opusic-sys with default features on, so bundled cannot be turned off through feature unification: every platform now builds libopus from source with CMake and links it statically. That is a trade we want — cmake at build time, libopus nowhere at runtime.

Changes

• opus = "0.4" in the workspace manifest, plus the refreshed libopus note.
• Linux CI/release deps swap libopus-dev for cmake (one edit in the shared composite covers CI and the ubuntu:22.04 release container, whose cmake 3.22 clears the bundled opus' 3.16 floor). Windows and macOS runners already ship cmake; their comments now name the right crate.
• AUR: cmake in makedepends, opus out of depends (the static link removes the runtime dependency), .SRCINFO regenerated.
• Dropped the CMAKE_POLICY_VERSION_MINIMUM override in .cargo/config.toml — it existed only because audiopus_sys' vendored CMakeLists declared a pre-3.5 minimum that CMake 4 refuses. The bundled libopus 1.6.1 asks for 3.16, so the file is gone entirely.
• Dropped the RUSTSEC-2026-0150 ignore from deny.toml. opusic-sys' BSD-3 was already on the license allowlist.
• README build requirements and ADR 0004 (decision 2 + consequences) updated.

Verified locally

• cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings, cargo build --workspace --all-targets, cargo test --workspace (all green, including the 6 Opus encoder tests), cargo deny check → advisories ok, bans ok, licenses ok, sources ok.
• Bundled build works under the dev box's CMake 4.4.3 with no policy override, in both the dev and release profiles.
• ldd target/debug/rewynd-recorder lists no libopus.so, and opus_encoder_create is in the binary: the static link is real, so the AppImage stops leaning on the host copy.

Summary by CodeRabbit

• Build & Packaging

  • Updated audio encoding support to build libopus from source and link it statically.
  • Added CMake as a build requirement across supported platforms and packages.
  • Removed the need for a separately installed libopus runtime dependency.

• Dependencies

  • Updated the Opus integration to version 0.4.
  • Updated security advisory tracking for the previous Opus integration.

• Documentation

  • Updated build instructions and architecture documentation to reflect the new CMake and libopus requirements.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 4754f78a-c00d-46c2-9fca-95380dda42e1

📥 Commits

Reviewing files that changed from the base of the PR and between 47b5e2f and 1ff7732.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (9)

• .cargo/config.toml
• .github/actions/linux-build-deps/action.yml
• .github/workflows/ci.yml
• Cargo.toml
• README.md
• deny.toml
• docs/adr/0004-av-mux-sync.md
• packaging/aur/.SRCINFO
• packaging/aur/PKGBUILD

💤 Files with no reviewable changes (2)

• deny.toml
• .cargo/config.toml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The project upgrades to opus 0.4 and replaces system libopus linkage with a statically bundled libopus build through opusic-sys and CMake. CI, documentation, advisory configuration, and AUR packaging now reflect the updated build and runtime dependencies.

Changes

Bundled libopus migration

Layer / File(s)	Summary
Opus dependency and build contract Cargo.toml, .cargo/config.toml, deny.toml, docs/adr/0004-av-mux-sync.md	The workspace upgrades to opus 0.4. The project removes the obsolete advisory ignore and CMake policy override. The ADR records static bundled libopus builds through opusic-sys.
Build environment updates .github/actions/linux-build-deps/action.yml, .github/workflows/ci.yml, README.md	Linux CI installs cmake instead of libopus-dev. Build requirements and platform comments describe the bundled libopus build.
AUR packaging updates packaging/aur/PKGBUILD, packaging/aur/.SRCINFO	AUR metadata adds cmake as a build dependency and removes opus as a runtime dependency.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~15 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 1ff77

The bundled libopus migration is consistent across build and packaging paths, with no merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: bundling libopus instead of linking the system copy.
Linked Issues check	✅ Passed	The PR meets the coding requirements in [#201]. It upgrades the workspace to opus = "0.4", uses opusic-sys with bundled libopus 1.6.1, and removes the obsolete audiopus_sys advisory. It adds CMa…
Out of Scope Changes check	✅ Passed	The changed files stay within [#201]. The manifest, build configuration, CI configuration, packaging metadata, advisory configuration, documentation, and ADR changes support the dependency migration a…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 201-opus-04

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Turbootzz]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.