Drop ffmpeg-python dependency and call ffmpeg directly.

[petterreinholdtsen]

The last ffmpeg-python module release was in 2019[1], upstream seem to be unavailable[2] and the project development seem to have stagnated[3]. As the features it provide is trivial to replace using the Python native subprocess module, drop the dependency.

[1] <URL: https://github.com/kkroening/ffmpeg-python/tags >
[2] <URL: kkroening/ffmpeg-python#760 >
[3] <URL: https://openhub.net/p/ffmpeg-python >

[glangford]

Good idea, but should this use run() rather than Popen()?

The recommended approach to invoking subprocesses is to use the run() function for all use cases it can handle. For more advanced use cases, the underlying Popen interface can be used directly.

[petterreinholdtsen]

[Glenn Langford]

Good idea, but should this use `run()` rather than `Popen()`?

I went with Popen because I need the pipe and knew how to use it. What would be the advantage of using run()?

…

-- Happy hacking Petter Reinholdtsen

[petterreinholdtsen]

I added a commit to switch from Popen() to run(). Feel free to use the approach you like.

[szelenka]

We're running into some issues with ffmpeg-python when running on FIPS environment, it'd be good to have the ffmpeg-python removed. Any word on when this PR can be merged?

[petterreinholdtsen]

[szelenka]

We're running into some issues with ffmpeg-python when running on FIPS environment, it'd be good to have the ffmpeg-python removed. Any word on when this PR can be merged?

I have not heard anything about it. I do not know the evaluation process used by this project, so no idea who could make any reliable statement about it. I've included the patch in the Debian packages I am working on, to avoid introducing and depending on what appear to be unmaintained software into Debian.

…

-- Happy hacking Petter Reinholdtsen

[szelenka]

@petterreinholdtsen do we have any method to contact the maintainers of openai/whisper to merge this PR?

@glangford is this PR good to go now?

[petterreinholdtsen]

[szelenka]

@petterreinholdtsen do we have any method to contact the maintainers of openai/whisper to merge this PR?

Not besides nagging here, no.

…

-- Happy hacking Petter Reinholdtsen

[jongwook]

Thanks! Other than tidying up the dependencies, did you have any missing features or security concerns from ffmpeg-python?

[petterreinholdtsen]

[Jong Wook Kim]

Thanks! Other than tidying up the dependencies, did you have any missing features or security concerns from ffmpeg-python?

My concern were mostly from a maintenance point of view. There seem to be no active maintainer nor any active maintenance of the library, so depending on it seem like a fairly high risk for no gain. I wanted to get Whisper into Debian and did not feel like introducing an upstream orphaned ffmpeg-python as a package in Debian, were one is expected to keep it working well for 3-4 years. How do the Whisper developers evaluate ffmpeg-python sustainability?

…

-- Happy hacking Petter Reinholdtsen

[szelenka]

@jongwook ffmpeg-python is not a FIPS compatible library, due to it's use of md5 without the usedforsecurity parameter introduced in Python 3.9, which means you cannot run it (or whisper) on FIPS hardware.

It'd be an easy fix to ffmpeg-python, but as @petterreinholdtsen mentioned, this is an abandoned project .. so nobody can merge the PRs there.