Merge pull request #725 from streamplace/eli/determinism-rebooted

determinism rebooted

Cargo.lock

···
 ]
 
 [[package]]
+name = "c2pa"
+version = "0.58.0"
+source = "git+https://github.com/streamplace/c2pa-rs.git?rev=544825abfaf9e588813e18dba70c8d5afd039d46#544825abfaf9e588813e18dba70c8d5afd039d46"
+dependencies = [
+ "asn1-rs",
+ "async-generic",
+ "async-recursion",
+ "async-trait",
+ "atree",
+ "base64 0.22.1",
+ "bcder",
+ "byteorder",
+ "byteordered",
+ "bytes",
+ "chrono",
+ "ciborium",
+ "config",
+ "console_log",
+ "const-hex",
+ "const-oid 0.9.6",
+ "conv",
+ "coset",
+ "der 0.7.10",
+ "ed25519-dalek 2.2.0",
+ "env_logger",
+ "extfmt",
+ "getrandom 0.2.16",
+ "hex",
+ "hex-literal",
+ "http",
+ "id3",
+ "img-parts",
+ "iref",
+ "jfifdump",
+ "js-sys",
+ "lazy_static",
+ "log",
+ "memchr",
+ "mp4",
+ "nom",
+ "non-empty-string",
+ "nonempty-collections",
+ "num-bigint-dig",
+ "openssl",
+ "pem",
+ "pkcs1",
+ "pkcs8 0.10.2",
+ "png_pong",
+ "quick-xml",
+ "rand 0.8.5",
+ "rand_chacha 0.3.1",
+ "rand_core 0.9.3",
+ "range-set",
+ "rasn",
+ "rasn-cms",
+ "rasn-ocsp",
+ "rasn-pkix",
+ "regex",
+ "reqwest",
+ "riff",
+ "ring",
+ "rsa",
+ "serde",
+ "serde-transcode",
+ "serde-wasm-bindgen",
+ "serde_bytes",
+ "serde_cbor",
+ "serde_derive",
+ "serde_json",
+ "serde_with",
+ "sha1",
+ "sha2 0.10.9",
+ "spki 0.7.3",
+ "static-iref",
+ "tempfile",
+ "thiserror 2.0.16",
+ "toml 0.8.23",
+ "treeline",
+ "ureq",
+ "url",
+ "uuid",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "web-time",
+ "windows-core",
+ "wstd",
+ "x509-certificate",
+ "x509-parser",
+ "zeroize",
+ "zip",
+]
+
+[[package]]
 name = "camino"
 version = "1.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 version = "0.0.0"
 dependencies = [
  "anyhow",
- "c2pa",
+ "c2pa 0.58.0 (git+https://github.com/hyphacoop/c2pa-rs.git?rev=1b84d40219b27340a30fc309250e774e8a7b7761)",
  "schemars 0.8.22",
  "serde",
  "serde_json",
···
 dependencies = [
  "anyhow",
  "async-trait",
+ "base64 0.22.1",
  "bytes",
- "c2pa",
+ "c2pa 0.58.0 (git+https://github.com/streamplace/c2pa-rs.git?rev=544825abfaf9e588813e18dba70c8d5afd039d46)",
  "hex",
  "iroh",
  "iroh-base",

go.mod

···
 require (
 	firebase.google.com/go/v4 v4.14.1
 	github.com/99designs/gqlgen v0.17.64
+	github.com/Eyevinn/mp4ff v0.50.0
 	github.com/NYTimes/gziphandler v1.1.1
 	github.com/ThalesGroup/crypto11 v0.0.0-00010101000000-000000000000
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
···
 	go.opentelemetry.io/otel v1.36.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0
 	go.opentelemetry.io/otel/sdk v1.36.0
-	go.opentelemetry.io/otel/trace v1.36.0
 	go.uber.org/goleak v1.3.0
 	golang.org/x/image v0.30.0
 	golang.org/x/net v0.43.0
···
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 // indirect
 	go.opentelemetry.io/otel/metric v1.36.0 // indirect
+	go.opentelemetry.io/otel/trace v1.36.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	go.uber.org/automaxprocs v1.6.0 // indirect

go.sum

···
 github.com/DataDog/zstd v1.4.5/go.mod h1:1jcaCB/ufaK+sKp1NBhlGmpz41jOoPQ35bpF36t7BBo=
 github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24 h1:sHglBQTwgx+rWPdisA5ynNEsoARbiCBOyGcJM4/OzsM=
 github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24/go.mod h1:4UJr5HIiMZrwgkSPdsjy2uOQExX/WEILpIrO9UPGuXs=
+github.com/Eyevinn/mp4ff v0.50.0 h1:vFlsvpQh5Jfz++cuaeTI90vbID5dAabebvvN/l9lom0=
+github.com/Eyevinn/mp4ff v0.50.0/go.mod h1:hJNUUqOBryLAzUW9wpCJyw2HaI+TCd2rUPhafoS5lgg=
 github.com/GaijinEntertainment/go-exhaustruct/v3 v3.3.1 h1:Sz1JIXEcSfhz7fUi7xHnhpIE0thVASYjvosApmHuD2k=
 github.com/GaijinEntertainment/go-exhaustruct/v3 v3.3.1/go.mod h1:n/LSCXNuIYqVfBlVXyHfMQkZDdp1/mmxfSjADd3z1Zg=
 github.com/Kagami/go-avif v0.1.0 h1:8GHAGLxCdFfhpd4Zg8j1EqO7rtcQNenxIDerC/uu68w=
···
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
-github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
-github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/go-test/deep v1.1.0 h1:WOcxcdHcvdgThNXjw0t76K42FXTU7HpNQWHpA2HHNlg=
+github.com/go-test/deep v1.1.0/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/go-text/typesetting v0.3.0 h1:OWCgYpp8njoxSRpwrdd1bQOxdjOXDj9Rqart9ML4iF4=
 github.com/go-text/typesetting v0.3.0/go.mod h1:qjZLkhRgOEYMhU9eHBr3AR4sfnGJvOXNLt8yRAySFuY=
 github.com/go-text/typesetting-utils v0.0.0-20241103174707-87a29e9e6066 h1:qCuYC+94v2xrb1PoS4NIDe7DGYtLnU2wWiQe9a1B1c0=

hack/compare-hash.sh

···
+#!/bin/bash
+
+set -euo pipefail
+
+ONE="$(realpath "$1")"
+TWO="$(realpath "$2")"
+BASE_ONE="$(basename "$ONE")"
+BASE_TWO="$(basename "$TWO")"
+
+if [[ -d "$ONE" && -d "$TWO" ]]; then
+  FILES_ONE=$(find "$ONE" -maxdepth 1 -mindepth 1 -type f -name '*.mp4' | xargs -L 1 basename | sort)
+  FILES_TWO=$(find "$TWO" -maxdepth 1 -mindepth 1 -type f -name '*.mp4' | xargs -L 1 basename | sort)
+
+  NUM_FILES_ONE=$(echo "$FILES_ONE" | wc -l)
+  NUM_FILES_TWO=$(echo "$FILES_TWO" | wc -l)
+
+  if [[ "$NUM_FILES_ONE" -ne "$NUM_FILES_TWO" ]]; then
+    echo "Directory contents differ: different number of files"
+    comm -3 <(echo "$FILES_ONE") <(echo "$FILES_TWO")
+    exit 1
+  fi
+
+  # Compare files by their order in the sorted lists, regardless of filenames
+  paste <(echo "$FILES_ONE") <(echo "$FILES_TWO") | while read -r file_one file_two; do
+    # skip if either file entry is empty (may only occur if line counts mismatched, but that's handled above)
+    [ -n "$file_one" ] && [ -n "$file_two" ] || continue
+    echo "Comparing $file_one <=> $file_two"
+    set +e
+    "$0" "$ONE/$file_one" "$TWO/$file_two"
+    set -e
+  done
+  exit 0
+fi
+
+
+cd "$(mktemp -d)"
+HASH_ONE=$(openssl sha256 "$ONE" | awk '{print $2}')
+HASH_TWO=$(openssl sha256 "$TWO" | awk '{print $2}')
+if [ "$HASH_ONE" = "$HASH_TWO" ]; then
+  echo "Identical: $BASE_ONE $BASE_TWO $(pwd)"
+  exit 0
+fi
+pwd
+echo "Hash for $ONE: $HASH_ONE"
+echo "Hash for $TWO: $HASH_TWO"
+
+xxd "$ONE" > "1.xxd"
+xxd "$TWO" > "2.xxd"
+(diff --color=always "1.xxd" "2.xxd" || true) | head -n 5
+
+ffmpeg -y -loglevel fatal -i "$ONE" -c copy -f framemd5 "1.md5"
+ffmpeg -y -loglevel fatal -i "$TWO" -c copy -f framemd5 "2.md5"
+(diff --color=always "1.md5" "2.md5" || true) | head -n 5
+
+ffprobe -loglevel fatal -show_frames "$ONE" > "1.frames"
+ffprobe -loglevel fatal -show_frames "$TWO" > "2.frames"
+(diff --color=always "1.frames" "2.frames" || true) | head -n 5
+
+set +e
+echo -e "\033[0m"
+video_frames_one="$(cat 1.frames | grep media_type=video | wc -l | xargs)"
+video_frames_two="$(cat 2.frames | grep media_type=video | wc -l | xargs)"
+if [[ "$video_frames_one" -ne "$video_frames_two" ]]; then
+  echo "Video frame count mismatch: $video_frames_one -> $video_frames_two"
+fi
+set -e
+
+audio_frames_one="$(cat 1.frames | grep media_type=audio | wc -l | xargs)"
+audio_frames_two="$(cat 2.frames | grep media_type=audio | wc -l | xargs)"
+if [[ "$audio_frames_one" -ne "$audio_frames_two" ]]; then
+  echo "Audio frame count mismatch: $audio_frames_one -> $audio_frames_two"
+fi
+
+# ffmpeg -y -loglevel fatal -i "$ONE" -frames:v 1 -c copy -an 1frame.h264
+# ffmpeg -y -loglevel fatal -i "$TWO" -frames:v 1 -c copy -an 2frame.h264
+
+bash -c "ffmpeg -y -bsf:v trace_headers -i \"$ONE\" -c copy -f null /dev/null 2>&1" | sed 's/\[trace_headers @ 0x[0-9a-f]*\]//' > 1.trace_headers
+bash -c "ffmpeg -y -bsf:v trace_headers -i \"$TWO\" -c copy -f null /dev/null 2>&1" | sed 's/\[trace_headers @ 0x[0-9a-f]*\]//' > 2.trace_headers
+(diff --color=always "1.trace_headers" "2.trace_headers" || true) | head -n 5
+
+go install github.com/Eyevinn/mp4ff/cmd/mp4ff-info@latest || true
+mp4ff-info "$ONE" > 1.mp4ff-info
+mp4ff-info "$TWO" > 2.mp4ff-info
+(diff --color=always "1.mp4ff-info" "2.mp4ff-info" || true) | head -n 5
+
+# ffmpeg -y -loglevel fatal -i "$ONE" -c copy 1tweaked.mp4
+# ffmpeg -y -loglevel fatal -i "$TWO" -c copy 2tweaked.mp4
+
+# ffmpeg -y -bsf:v trace_headers -i 1tweaked.mp4 -c copy -f null /dev/null 2>&1 | sed 's/.*\]//' > 1.trace_headers
+# ffmpeg -y -bsf:v trace_headers -i 2tweaked.mp4 -c copy -f null /dev/null 2>&1 | sed 's/.*\]//' > 2.trace_headers
+
+# diff --color=always "1.trace_headers" "2.trace_headers" || true
+
+# ffmpeg -y -loglevel fatal -bsf:v  h264_redundant_pps -i "$ONE" -c copy 1tweaked.mp4
+# ffmpeg -y -loglevel fatal -bsf:v  h264_redundant_pps -i "$TWO" -c copy 2tweaked.mp4
+
+# ffmpeg -y -loglevel fatal -i 1tweaked.mp4 -c copy -f framemd5 "1tweaked.mp4.md5"
+# ffmpeg -y -loglevel fatal -i 2tweaked.mp4 -c copy -f framemd5 "2tweaked.mp4.md5"
+# (diff --color=always "1tweaked.mp4.md5" "2tweaked.mp4.md5" || true)
+
+# (diff --color=always "1.trace_headers" "2.trace_headers" || true)
+
+# ffmpeg -y -loglevel fatal -i "$ONE" -c:v copy -bsf:v h264_mp4toannexb -an 1.ts
+# ffmpeg -y -loglevel fatal -i "$TWO" -c:v copy -bsf:v h264_mp4toannexb -an 2.ts
+# ffmpeg -y -loglevel fatal -i 1.ts -c copy -f framemd5 "1.ts.md5"
+# ffmpeg -y -loglevel fatal -i 2.ts -c copy -f framemd5 "2.ts.md5"
+# (diff --color=always "1.ts.md5" "2.ts.md5" || true)
+
+echo -e "\033[0m"
+echo "Useful commands:"
+echo "Compare ffprobe -show_frames data:"
+echo "  meld $(realpath 1.frames) $(realpath 2.frames)"
+echo "Compare frame headers:"
+echo "  meld $(realpath 1.trace_headers) $(realpath 2.trace_headers)"
+echo "Compare hex hashes:"
+echo "  meld $(realpath 1.xxd) $(realpath 2.xxd)"
+echo "Compare framemd5 hashes:"
+echo "  meld $(realpath 1.md5) $(realpath 2.md5)"
+echo "Compare mp4ff-info data:"
+echo "  meld $(realpath 1.mp4ff-info) $(realpath 2.mp4ff-info)"
+exit 1

hack/compare-oneshot.sh

···
+#!/bin/bash
+
+# Test that we can combine then split segments and get the same files
+
+set -euo pipefail
+
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+# Detect platform/arch for correct build dir
+UNAME_S=$(uname -s | tr '[:upper:]' '[:lower:]')
+UNAME_M=$(uname -m)
+if [[ "$UNAME_S" == "darwin" && "$UNAME_M" == "arm64" ]]; then
+  BUILD_DIR="build-darwin-arm64"
+elif [[ "$UNAME_S" == "linux" && "$UNAME_M" == "x86_64" ]]; then
+  BUILD_DIR="build-linux-amd64"
+else
+  echo "Unsupported platform: $UNAME_S/$UNAME_M"
+  exit 1
+fi
+
+DEBUG_DIR="$(mktemp -d)"
+mkdir -p "$DEBUG_DIR/segments"
+set +e
+$SCRIPT_DIR/../$BUILD_DIR/streamplace combine --debug-dir="$DEBUG_DIR/segments-1" "$DEBUG_DIR/combined.mp4" $(find "$@" -name '*.mp4' | sort)
+EXIT_CODE=$?
+set -e
+if [ $EXIT_CODE -ne 0 ]; then
+  $SCRIPT_DIR/compare-hash.sh "$@" "$DEBUG_DIR/segments-1"
+  exit $EXIT_CODE
+fi
+echo "Success"

hack/compare-roundtrip.sh

···
+#!/bin/bash
+
+# Test that we can combine then split segments and get the same files
+
+set -euo pipefail
+
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+# Detect platform/arch for correct build dir
+UNAME_S=$(uname -s | tr '[:upper:]' '[:lower:]')
+UNAME_M=$(uname -m)
+if [[ "$UNAME_S" == "darwin" && "$UNAME_M" == "arm64" ]]; then
+  BUILD_DIR="build-darwin-arm64"
+elif [[ "$UNAME_S" == "linux" && "$UNAME_M" == "x86_64" ]]; then
+  BUILD_DIR="build-linux-amd64"
+else
+  echo "Unsupported platform: $UNAME_S/$UNAME_M"
+  exit 1
+fi
+
+DEBUG_DIR="$(mktemp -d)"
+set +e
+$SCRIPT_DIR/../$BUILD_DIR/streamplace combine --debug-dir="$DEBUG_DIR/segments-1" "$DEBUG_DIR/combined.mp4" $(find "$@" -name '*.mp4' | sort)
+$SCRIPT_DIR/../$BUILD_DIR/streamplace combine --debug-dir="$DEBUG_DIR/segments-2" "$DEBUG_DIR/combined2.mp4" $(find "$DEBUG_DIR/segments-1" -name '*.mp4' | sort)
+EXIT_CODE=$?
+set -e
+if [ $EXIT_CODE -ne 0 ]; then
+  $SCRIPT_DIR/compare-hash.sh "$DEBUG_DIR/segments-1" "$DEBUG_DIR/segments-2"
+  exit $EXIT_CODE
+fi
+echo "Success"

hack/deterministic-mux.sh

···
+#!/bin/bash
+
+set -euo pipefail
+
+TMPDIR=$(mktemp -d)
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+$SCRIPT_DIR/../build-linux-amd64/streamplace clip --out "$TMPDIR/combined1.mp4" "$@"
+sleep 2
+$SCRIPT_DIR/../build-linux-amd64/streamplace clip --out "$TMPDIR/combined2.mp4" "$@"
+xxd "$TMPDIR/combined1.mp4" > "$TMPDIR/combined1.mp4.xxd"
+xxd "$TMPDIR/combined2.mp4" > "$TMPDIR/combined2.mp4.xxd"
+diff --color=always "$TMPDIR/combined1.mp4.xxd" "$TMPDIR/combined2.mp4.xxd"

pkg/api/api.go

···
 	mu            sync.RWMutex
 }
 
-func MakeStreamplaceAPI(cli *config.CLI, mod model.Model, statefulDB *statedb.StatefulDB, signer *eip712.EIP712Signer, noter notifications.FirebaseNotifier, mm *media.MediaManager, ms media.MediaSigner, bus *bus.Bus, atsync *atproto.ATProtoSynchronizer, d *director.Director, op *oatproxy.OATProxy) (*StreamplaceAPI, error) {
+func MakeStreamplaceAPI(cli *config.CLI, mod model.Model, statefulDB *statedb.StatefulDB, noter notifications.FirebaseNotifier, mm *media.MediaManager, ms media.MediaSigner, bus *bus.Bus, atsync *atproto.ATProtoSynchronizer, d *director.Director, op *oatproxy.OATProxy) (*StreamplaceAPI, error) {
 	updater, err := PrepareUpdater(cli)
 	if err != nil {
 		return nil, err
···
 		Model:            mod,
 		StatefulDB:       statefulDB,
 		Updater:          updater,
-		Signer:           signer,
 		FirebaseNotifier: noter,
 		MediaManager:     mm,
 		MediaSigner:      ms,

pkg/api/api_internal.go

···
 		w.WriteHeader(204)
 	})
 
-	router.GET("/settings", func(w http.ResponseWriter, r *http.Request, p httprouter.Params) {
-		w.Header().Set("Access-Control-Allow-Origin", "*")
-		w.Header().Set("Access-Control-Allow-Methods", "GET")
-		w.Header().Set("Access-Control-Allow-Headers", "Content-Type")
-
-		id := a.Signer.Hex()
-
-		ident, err := a.Model.GetIdentity(id)
-		if err != nil {
-			errors.WriteHTTPInternalServerError(w, "unable to get settings", err)
-			return
-		}
-
-		bs, err := json.Marshal(ident)
-		if err != nil {
-			errors.WriteHTTPInternalServerError(w, "unable to marshal json", err)
-			return
-		}
-		if _, err := w.Write(bs); err != nil {
-			log.Error(ctx, "error writing response", "error", err)
-		}
-	})
-
 	router.GET("/followers/:user", func(w http.ResponseWriter, r *http.Request, p httprouter.Params) {
 		user := p.ByName("user")
 		if user == "" {
···
 			errors.WriteHTTPInternalServerError(w, "unable to create replay peer connection", err)
 			return
 		}
-		answer, err := a.MediaManager.WebRTCIngest(ctx, &webrtc.SessionDescription{SDP: "placeholder"}, mediaSigner, pc, make(chan struct{}))
+		answer, err := a.MediaManager.WebRTCIngest(ctx, &webrtc.SessionDescription{SDP: "placeholder"}, mediaSigner, pc, make(chan error, 1))
 		if err != nil {
 			errors.WriteHTTPInternalServerError(w, "unable to ingest web rtc", err)
 			return

pkg/api/playback.go

···
 			errors.WriteHTTPInternalServerError(w, "unable to create peer connection", err)
 			return
 		}
-		answer, err := a.MediaManager.WebRTCIngest(ctx, &offer, mediaSigner, pc, make(chan struct{}))
+		answer, err := a.MediaManager.WebRTCIngest(ctx, &offer, mediaSigner, pc, make(chan error, 1))
 		if err != nil {
 			errors.WriteHTTPInternalServerError(w, "error playing back", err)
 			return

pkg/api/stream_key.go

···
 		return nil, err
 	}
 
-	var mediaSigner media.MediaSigner
-	if a.CLI.ExternalSigning {
-		mediaSigner, err = media.MakeMediaSignerExt(ctx, a.CLI, did, addrBytes, a.Model)
-	} else {
-		mediaSigner, err = media.MakeMediaSigner(ctx, a.CLI, did, signer, a.Model)
-	}
+	mediaSigner, err := media.MakeMediaSigner(ctx, a.CLI, did, signer, a.Model)
 	if err != nil {
 		return nil, fmt.Errorf("invalid authorization key (not valid secp256k1): %w", err)
 	}

pkg/aqio/aqio.go

···
 	"github.com/johncgriffin/overflow"
 )
 
+func NewReadWriteSeeker(buf []byte) *ReadWriteSeeker {
+	return &ReadWriteSeeker{buf: buf, pos: 0}
+}
+
 // ReadWriteSeeker is an in-memory io.ReadWriteSeeker implementation
 type ReadWriteSeeker struct {
 	buf []byte
···
 }
 
 // Write implements the io.Writer interface
+// TODO: This would probably be better as a linked list for writing; the read
+// requirements are minimal so doing a bit more math is okay
 func (rws *ReadWriteSeeker) Write(p []byte) (n int, err error) {
+	// fmt.Printf("Write: pos=%d len(p)=%d\n", rws.pos, len(p))
 	minCap := overflow.Addp(rws.pos, len(p))
 	if minCap > cap(rws.buf) { // Make sure buf has enough capacity:
-		buf2 := make([]byte, len(rws.buf), overflow.Addp(minCap, len(p))) // add some extra
+		// fmt.Printf("Write: pos=%d len(p)=%d minCap=%d\n", rws.pos, len(p), minCap)
+		newCap := cap(rws.buf) * 2
+		if newCap == 0 {
+			newCap = 128
+		} else if newCap < minCap {
+			newCap = minCap * 2
+		}
+		buf2 := make([]byte, len(rws.buf), newCap) // double
 		copy(buf2, rws.buf)
 		rws.buf = buf2
 	}

pkg/c2patypes/stream_adapter.go

···
+package c2patypes
+
+import (
+	"errors"
+	"fmt"
+	"io"
+
+	"stream.place/streamplace/pkg/iroh/generated/iroh_streamplace"
+)
+
+// type Stream interface {
+// 	// Read a stream of bytes from the stream
+// 	ReadStream(length uint64) ([]byte, error)
+// 	// Seek to a position in the stream
+// 	SeekStream(pos int64, mode uint64) (uint64, error)
+// 	// Write a stream of bytes to the stream
+// 	WriteStream(data []byte) (uint64, error)
+// }
+
+//	pub enum SeekMode {
+//	    Start = 0,
+//	    End = 1,
+//	    Current = 2,
+//	}
+
+const (
+	SeekModeStart   uint64 = 0
+	SeekModeEnd     uint64 = 1
+	SeekModeCurrent uint64 = 2
+)
+
+func NewReader(rs io.ReadSeeker) *C2PAStreamReader {
+	return &C2PAStreamReader{ReadSeeker: rs}
+}
+
+func NewWriter(rws io.ReadWriteSeeker) *C2PAStreamWriter {
+	return &C2PAStreamWriter{ReadWriteSeeker: rws}
+}
+
+// Wrapped io.ReadSeeker for passing to Rust. Doesn't write.
+type C2PAStreamReader struct {
+	io.ReadSeeker
+}
+
+func (s *C2PAStreamReader) ReadStream(length uint64) ([]byte, error) {
+	return readStream(s.ReadSeeker, length)
+}
+
+func (s *C2PAStreamReader) SeekStream(pos int64, mode uint64) (uint64, error) {
+	return seekStream(s.ReadSeeker, pos, mode)
+}
+
+func (s *C2PAStreamReader) WriteStream(data []byte) (uint64, error) {
+	return 0, fmt.Errorf("Writing is not implemented for C2PAStreamReader")
+}
+
+// Wrapped io.Writer for passing to Rust.
+type C2PAStreamWriter struct {
+	io.ReadWriteSeeker
+}
+
+func (s *C2PAStreamWriter) ReadStream(length uint64) ([]byte, error) {
+	return readStream(s.ReadWriteSeeker, length)
+}
+
+func (s *C2PAStreamWriter) SeekStream(pos int64, mode uint64) (uint64, error) {
+	return seekStream(s.ReadWriteSeeker, pos, mode)
+}
+
+func (s *C2PAStreamWriter) WriteStream(data []byte) (uint64, error) {
+	return writeStream(s.ReadWriteSeeker, data)
+}
+
+func readStream(r io.ReadSeeker, length uint64) ([]byte, error) {
+	// fmt.Printf("read length=%d\n", length)
+	bs := make([]byte, length)
+	read, err := r.Read(bs)
+	if err != nil {
+		if errors.Is(err, io.EOF) {
+			if read == 0 {
+				// fmt.Printf("read EOF read=%d returning empty?", read)
+				return []byte{}, nil
+			}
+			// partial := bs[read:]
+			// return partial, nil
+		}
+		// fmt.Printf("io error=%s\n", err)
+		return []byte{}, err
+	}
+	if uint64(read) < length {
+		partial := bs[:read]
+		// fmt.Printf("read returning partial read=%d len=%d\n", read, len(partial))
+		return partial, nil
+	}
+	// fmt.Printf("read returning full read=%d len=%d\n", read, len(bs))
+	return bs, nil
+}
+
+func seekStream(r io.ReadSeeker, pos int64, mode uint64) (uint64, error) {
+	// fmt.Printf("seek pos=%d\n", pos)
+	var seekMode int
+	if mode == SeekModeCurrent {
+		seekMode = io.SeekCurrent
+	} else if mode == SeekModeStart {
+		seekMode = io.SeekStart
+	} else if mode == SeekModeEnd {
+		seekMode = io.SeekEnd
+	} else {
+		// fmt.Printf("seek mode unsupported mode=%d\n", mode)
+		return 0, fmt.Errorf("unknown seek mode: %d", mode)
+	}
+	newPos, err := r.Seek(pos, seekMode)
+	if err != nil {
+		return 0, err
+	}
+	return uint64(newPos), nil
+}
+
+func writeStream(w io.ReadWriteSeeker, data []byte) (uint64, error) {
+	wrote, err := w.Write(data)
+	if err != nil {
+		return uint64(wrote), err
+	}
+	return uint64(wrote), nil
+}
+
+type ManyStreams struct {
+	Streams []io.ReadSeeker
+	index   int
+}
+
+func NewManyStreams() *ManyStreams {
+	return &ManyStreams{Streams: []io.ReadSeeker{}, index: 0}
+}
+
+func (m *ManyStreams) AddStream(stream io.ReadSeeker) {
+	m.Streams = append(m.Streams, stream)
+}
+
+func (m *ManyStreams) Next() *iroh_streamplace.Stream {
+	if m.index >= len(m.Streams) {
+		return nil
+	}
+	stream := m.Streams[m.index]
+	m.index++
+	var r iroh_streamplace.Stream
+	if rws, ok := stream.(io.ReadWriteSeeker); ok {
+		r = NewWriter(rws)
+	} else {
+		r = NewReader(stream)
+	}
+	return &r
+}

pkg/cmd/clip.go

···
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"os"
-
-	"stream.place/streamplace/pkg/gstinit"
-	"stream.place/streamplace/pkg/log"
-	"stream.place/streamplace/pkg/media"
-)
-
-func Clip(ctx context.Context, args []string, out string) error {
-	if out == "" {
-		return fmt.Errorf("out is required")
-	}
-	log.Log(ctx, "clip", "out", out)
-	gstinit.InitGST()
-	fd, err := os.Create(out)
-	if err != nil {
-		return err
-	}
-	defer fd.Close()
-	err = media.Clip(ctx, args, fd)
-	if err != nil {
-		return err
-	}
-	return nil
-}

pkg/cmd/combine.go

···
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+
+	"stream.place/streamplace/pkg/aqio"
+	"stream.place/streamplace/pkg/config"
+	"stream.place/streamplace/pkg/gstinit"
+	"stream.place/streamplace/pkg/log"
+	"stream.place/streamplace/pkg/media"
+)
+
+func Combine(ctx context.Context, build *config.BuildFlags, allArgs []string) error {
+	gstinit.InitGST()
+	cli := &config.CLI{Build: build}
+	fs := cli.NewFlagSet("streamplace combine")
+	debugDir := fs.String("debug-dir", "", "directory to write debug files to")
+
+	err := cli.Parse(fs, allArgs)
+	if err != nil {
+		return err
+	}
+	if *debugDir != "" {
+		err := os.MkdirAll(*debugDir, 0755)
+		if err != nil {
+			return fmt.Errorf("failed to create debug directory: %w", err)
+		}
+	}
+	log.Debug(context.Background(), "combine command: starting", "args", fs.Args())
+	ctx = log.WithDebugValue(ctx, cli.Debug)
+	cryptoSigner, err := createSigner(ctx, cli)
+	if err != nil {
+		return err
+	}
+	ms, err := media.MakeMediaSigner(ctx, cli, "combine", cryptoSigner, nil)
+	if err != nil {
+		return err
+	}
+	args := fs.Args()
+	outFile := args[0]
+	inputs := args[1:]
+	log.Log(ctx, "combining segments", "outFile", outFile, "inputs", inputs)
+	outFd, err := os.Create(outFile)
+	if err != nil {
+		return err
+	}
+	defer outFd.Close()
+	inputFds := make([]io.ReadSeeker, len(inputs))
+	for i, input := range inputs {
+		fd, err := os.Open(input)
+		if err != nil {
+			return err
+		}
+		defer fd.Close()
+		inputFds[i] = fd
+	}
+	err = media.CombineSegments(ctx, inputFds, ms, outFd)
+	if err != nil {
+		return err
+	}
+	err = CheckCombined(ctx, cli, outFd, *debugDir)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func CheckCombined(ctx context.Context, cli *config.CLI, inFD io.ReadWriteSeeker, debugDir string) error {
+	_, err := inFD.Seek(0, io.SeekStart)
+	if err != nil {
+		return err
+	}
+	err = media.SplitSegments(ctx, cli, inFD, func(fname string) media.ReadWriteSeekCloser {
+		if debugDir == "" {
+			return aqio.NewReadWriteSeeker([]byte{})
+		}
+		fd, err := os.Create(filepath.Join(debugDir, fname))
+		if err != nil {
+			panic(fmt.Errorf("failed to create debug file: %w", err))
+		}
+		log.Log(ctx, "created debug file", "path", filepath.Join(debugDir, fname))
+		return fd
+	})
+	if err != nil {
+		return err
+	}
+	return nil
+}

pkg/cmd/signer.go

···
+package cmd
+
+import (
+	"context"
+	"crypto"
+	"fmt"
+	"os"
+	"strconv"
+
+	"github.com/ThalesGroup/crypto11"
+	"golang.org/x/term"
+	"stream.place/streamplace/pkg/config"
+	"stream.place/streamplace/pkg/crypto/signers"
+	v0 "stream.place/streamplace/pkg/schema/v0"
+
+	"stream.place/streamplace/pkg/crypto/signers/eip712"
+	"stream.place/streamplace/pkg/log"
+)
+
+func createSigner(ctx context.Context, cli *config.CLI) (crypto.Signer, error) {
+	schema, err := v0.MakeV0Schema()
+	if err != nil {
+		return nil, err
+	}
+	eip712signer, err := eip712.MakeEIP712Signer(ctx, &eip712.EIP712SignerOptions{
+		Schema:              schema,
+		EthKeystorePath:     cli.EthKeystorePath,
+		EthAccountAddr:      cli.EthAccountAddr,
+		EthKeystorePassword: cli.EthPassword,
+	})
+	if err != nil {
+		return nil, err
+	}
+	var signer crypto.Signer = eip712signer
+	if cli.PKCS11ModulePath != "" {
+		conf := &crypto11.Config{
+			Path: cli.PKCS11ModulePath,
+		}
+		count := 0
+		for _, val := range []string{cli.PKCS11TokenSlot, cli.PKCS11TokenLabel, cli.PKCS11TokenSerial} {
+			if val != "" {
+				count += 1
+			}
+		}
+		if count != 1 {
+			return nil, fmt.Errorf("need exactly one of pkcs11-token-slot, pkcs11-token-label, or pkcs11-token-serial (got %d)", count)
+		}
+		if cli.PKCS11TokenSlot != "" {
+			num, err := strconv.ParseInt(cli.PKCS11TokenSlot, 10, 16)
+			if err != nil {
+				return nil, fmt.Errorf("error parsing pkcs11-slot: %w", err)
+			}
+			numint := int(num)
+			// why does crypto11 want this as a reference? odd.
+			conf.SlotNumber = &numint
+		}
+		if cli.PKCS11TokenLabel != "" {
+			conf.TokenLabel = cli.PKCS11TokenLabel
+		}
+		if cli.PKCS11TokenSerial != "" {
+			conf.TokenSerial = cli.PKCS11TokenSerial
+		}
+		pin := cli.PKCS11Pin
+		if pin == "" {
+			fmt.Printf("Please enter PKCS11 PIN: ")
+			password, err := term.ReadPassword(int(os.Stdin.Fd()))
+			fmt.Println("")
+			if err != nil {
+				return nil, fmt.Errorf("error reading PKCS11 password: %w", err)
+			}
+			pin = string(password)
+		}
+		conf.Pin = pin
+
+		sc, err := crypto11.Configure(conf)
+		if err != nil {
+			return nil, fmt.Errorf("error initalizing PKCS11 HSM: %w", err)
+		}
+		var id []byte = nil
+		var label []byte = nil
+		if cli.PKCS11KeypairID != "" {
+			num, err := strconv.ParseInt(cli.PKCS11KeypairID, 10, 8)
+			if err != nil {
+				return nil, fmt.Errorf("error parsing pkcs11-keypair-id: %w", err)
+			}
+			id = []byte{byte(num)}
+		}
+		if cli.PKCS11KeypairLabel != "" {
+			label = []byte(cli.PKCS11KeypairLabel)
+		}
+		hwsigner, err := sc.FindKeyPair(id, label)
+		if err != nil {
+			return nil, fmt.Errorf("error finding keypair on PKCS11 token: %w", err)
+		}
+		if hwsigner == nil {
+			return nil, fmt.Errorf("keypair on token not found (tried id='%s' label='%s')", cli.PKCS11KeypairID, cli.PKCS11KeypairLabel)
+		}
+		addr, err := signers.HexAddrFromSigner(hwsigner)
+		if err != nil {
+			return nil, fmt.Errorf("error getting ethereum address for hardware keypair: %w", err)
+		}
+		log.Log(ctx, "successfully initialized hardware signer", "address", addr)
+		signer = hwsigner
+	}
+	return signer, nil
+}

pkg/cmd/split.go

···
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+
+	"stream.place/streamplace/pkg/config"
+	"stream.place/streamplace/pkg/log"
+	"stream.place/streamplace/pkg/media"
+)
+
+func Split(ctx context.Context, inFile, outDir string) error {
+	inFD, err := os.Open(inFile)
+	if err != nil {
+		return err
+	}
+	defer inFD.Close()
+	err = os.MkdirAll(outDir, 0755)
+	if err != nil {
+		return err
+	}
+
+	names := []string{}
+
+	err = media.SplitSegments(ctx, &config.CLI{}, inFD, func(fname string) media.ReadWriteSeekCloser {
+		fullPath := filepath.Join(outDir, fname)
+		names = append(names, fullPath)
+		log.Log(ctx, "creating segment file", "path", fullPath)
+		fd, err := os.Create(fullPath)
+		if err != nil {
+			log.Error(ctx, "failed to open segment file", "error", err)
+			return nil
+		}
+		return fd
+	})
+	if err != nil {
+		return fmt.Errorf("failed to split segments: %w", err)
+	}
+
+	for _, name := range names {
+		fd, err := os.Open(name)
+		if err != nil {
+			return fmt.Errorf("failed to open segment file: %w", err)
+		}
+		defer fd.Close()
+		bs, err := io.ReadAll(fd)
+		if err != nil {
+			return fmt.Errorf("failed to read segment file: %w", err)
+		}
+		_, err = media.ValidateMP4Media(ctx, bs)
+		if err != nil {
+			return fmt.Errorf("failed to validate segment file: %w", err)
+		}
+		log.Log(ctx, "validated segment file", "path", name)
+	}
+
+	return nil
+}

pkg/cmd/streamplace.go

···
 import (
 	"bytes"
 	"context"
-	"crypto"
 	"crypto/rand"
 	"errors"
 	"flag"
···
 	"net/url"
 	"os"
 	"os/signal"
-	"path/filepath"
 	"runtime"
 	"runtime/pprof"
 	"slices"
···
 	"github.com/livepeer/go-livepeer/cmd/livepeer/starter"
 	"github.com/peterbourgon/ff/v3"
 	"github.com/streamplace/oatproxy/pkg/oatproxy"
-	"golang.org/x/term"
 	"stream.place/streamplace/pkg/aqhttp"
 	"stream.place/streamplace/pkg/atproto"
 	"stream.place/streamplace/pkg/bus"
-	"stream.place/streamplace/pkg/crypto/signers"
-	"stream.place/streamplace/pkg/crypto/signers/eip712"
 	"stream.place/streamplace/pkg/director"
+	"stream.place/streamplace/pkg/gstinit"
 	"stream.place/streamplace/pkg/iroh/generated/iroh_streamplace"
 	"stream.place/streamplace/pkg/log"
 	"stream.place/streamplace/pkg/media"
···
 	"stream.place/streamplace/pkg/replication/iroh_replicator"
 	"stream.place/streamplace/pkg/replication/websocketrep"
 	"stream.place/streamplace/pkg/rtmps"
-	v0 "stream.place/streamplace/pkg/schema/v0"
 	"stream.place/streamplace/pkg/spmetrics"
 	"stream.place/streamplace/pkg/statedb"
 	"stream.place/streamplace/pkg/storage"
 
-	"github.com/ThalesGroup/crypto11"
 	_ "github.com/go-gst/go-glib/glib"
 	_ "github.com/go-gst/go-gst/gst"
 	"stream.place/streamplace/pkg/api"
···
 		return WHIP(os.Args[2:])
 	}
 
-	if len(os.Args) > 1 && os.Args[1] == "clip" {
+	if len(os.Args) > 1 && os.Args[1] == "combine" {
+		return Combine(context.Background(), build, os.Args[2:])
+	}
+
+	if len(os.Args) > 1 && os.Args[1] == "split" {
 		cli := config.CLI{Build: build}
-		fs := cli.NewFlagSet("streamplace clip")
-		out := fs.String("out", "", "output file")
+		fs := cli.NewFlagSet("streamplace split")
 
 		err := cli.Parse(fs, os.Args[2:])
 		if err != nil {
···
 		}
 		ctx := context.Background()
 		ctx = log.WithDebugValue(ctx, cli.Debug)
-		return Clip(ctx, fs.Args(), *out)
+		if len(fs.Args()) != 2 {
+			fmt.Println("usage: streamplace split [flags] [input file] [output directory]")
+			os.Exit(1)
+		}
+		gstinit.InitGST()
+		return Split(ctx, fs.Args()[0], fs.Args()[1])
 	}
 
 	if len(os.Args) > 1 && os.Args[1] == "self-test" {
···
 	if *version {
 		return nil
 	}
+	signer, err := createSigner(ctx, &cli)
+	if err != nil {
+		return err
+	}
 
 	if len(os.Args) > 1 && os.Args[1] == "migrate" {
 		return statedb.Migrate(&cli)
···
 	if err != nil {
 		return fmt.Errorf("error creating streamplace dir at %s:%w", cli.DataDir, err)
 	}
-	schema, err := v0.MakeV0Schema()
-	if err != nil {
-		return err
-	}
-	eip712signer, err := eip712.MakeEIP712Signer(ctx, &eip712.EIP712SignerOptions{
-		Schema:              schema,
-		EthKeystorePath:     cli.EthKeystorePath,
-		EthAccountAddr:      cli.EthAccountAddr,
-		EthKeystorePassword: cli.EthPassword,
-	})
-	if err != nil {
-		return err
-	}
-	var signer crypto.Signer = eip712signer
-	if cli.PKCS11ModulePath != "" {
-		conf := &crypto11.Config{
-			Path: cli.PKCS11ModulePath,
-		}
-		count := 0
-		for _, val := range []string{cli.PKCS11TokenSlot, cli.PKCS11TokenLabel, cli.PKCS11TokenSerial} {
-			if val != "" {
-				count += 1
-			}
-		}
-		if count != 1 {
-			return fmt.Errorf("need exactly one of pkcs11-token-slot, pkcs11-token-label, or pkcs11-token-serial (got %d)", count)
-		}
-		if cli.PKCS11TokenSlot != "" {
-			num, err := strconv.ParseInt(cli.PKCS11TokenSlot, 10, 16)
-			if err != nil {
-				return fmt.Errorf("error parsing pkcs11-slot: %w", err)
-			}
-			numint := int(num)
-			// why does crypto11 want this as a reference? odd.
-			conf.SlotNumber = &numint
-		}
-		if cli.PKCS11TokenLabel != "" {
-			conf.TokenLabel = cli.PKCS11TokenLabel
-		}
-		if cli.PKCS11TokenSerial != "" {
-			conf.TokenSerial = cli.PKCS11TokenSerial
-		}
-		pin := cli.PKCS11Pin
-		if pin == "" {
-			fmt.Printf("Please enter PKCS11 PIN: ")
-			password, err := term.ReadPassword(int(os.Stdin.Fd()))
-			fmt.Println("")
-			if err != nil {
-				return fmt.Errorf("error reading PKCS11 password: %w", err)
-			}
-			pin = string(password)
-		}
-		conf.Pin = pin
-
-		sc, err := crypto11.Configure(conf)
-		if err != nil {
-			return fmt.Errorf("error initalizing PKCS11 HSM: %w", err)
-		}
-		var id []byte = nil
-		var label []byte = nil
-		if cli.PKCS11KeypairID != "" {
-			num, err := strconv.ParseInt(cli.PKCS11KeypairID, 10, 8)
-			if err != nil {
-				return fmt.Errorf("error parsing pkcs11-keypair-id: %w", err)
-			}
-			id = []byte{byte(num)}
-		}
-		if cli.PKCS11KeypairLabel != "" {
-			label = []byte(cli.PKCS11KeypairLabel)
-		}
-		hwsigner, err := sc.FindKeyPair(id, label)
-		if err != nil {
-			return fmt.Errorf("error finding keypair on PKCS11 token: %w", err)
-		}
-		if hwsigner == nil {
-			return fmt.Errorf("keypair on token not found (tried id='%s' label='%s')", cli.PKCS11KeypairID, cli.PKCS11KeypairLabel)
-		}
-		addr, err := signers.HexAddrFromSigner(hwsigner)
-		if err != nil {
-			return fmt.Errorf("error getting ethereum address for hardware keypair: %w", err)
-		}
-		log.Log(ctx, "successfully initialized hardware signer", "address", addr)
-		signer = hwsigner
-	}
 
 	mod, err := model.MakeDB(cli.DataFilePath([]string{"index"}))
 	if err != nil {
···
 		Public:             cli.PublicOAuth,
 	})
 	d := director.NewDirector(mm, mod, &cli, b, op, state, replicator)
-	a, err := api.MakeStreamplaceAPI(&cli, mod, state, eip712signer, noter, mm, ms, b, atsync, d, op)
+	a, err := api.MakeStreamplaceAPI(&cli, mod, state, noter, mm, ms, b, atsync, d, op)
 	if err != nil {
 		return err
 	}
···
 	})
 
 	if cli.TestStream {
-		// regular stream self-test
-		testSigner, err := eip712.MakeEIP712Signer(ctx, &eip712.EIP712SignerOptions{
-			Schema:          schema,
-			EthKeystorePath: filepath.Join(cli.DataDir, "test-signer"),
-		})
-		if err != nil {
-			return err
-		}
 		atkey, err := atproto.ParsePubKey(signer.Public())
 		if err != nil {
 			return err
 		}
 		did := atkey.DIDKey()
-		testMediaSigner, err := media.MakeMediaSigner(ctx, &cli, did, testSigner, mod)
+		testMediaSigner, err := media.MakeMediaSigner(ctx, &cli, did, signer, mod)
 		if err != nil {
 			return err
 		}
···
 		})
 
 		// Start a test stream that will run intermittently
-		intermittentSigner, err := eip712.MakeEIP712Signer(ctx, &eip712.EIP712SignerOptions{
-			Schema:          schema,
-			EthKeystorePath: filepath.Join(cli.DataDir, "intermittent-signer"),
-		})
 		if err != nil {
 			return err
 		}
-		atkey2, err := atproto.ParsePubKey(intermittentSigner.Public())
+		atkey2, err := atproto.ParsePubKey(signer.Public())
 		if err != nil {
 			return err
 		}
 		did2 := atkey2.DIDKey()
-		intermittentMediaSigner, err := media.MakeMediaSigner(ctx, &cli, did2, intermittentSigner, mod)
+		intermittentMediaSigner, err := media.MakeMediaSigner(ctx, &cli, did2, signer, mod)
 		if err != nil {
 			return err
 		}

pkg/config/config.go

···
 	Replicators                []string
 	WebsocketURL               string
 	BehindHTTPSProxy           bool
+	SegmentDebugDir            string
 }
 
 // ContentFilters represents the content filtering configuration
···
 	fs.BoolVar(&cli.PrintChat, "print-chat", false, "print chat messages to stdout")
 	fs.StringVar(&cli.WHIPTest, "whip-test", "", "run a WHIP self-test with the given parameters")
 	fs.StringVar(&cli.RelayHost, "relay-host", "wss://bsky.network", "websocket url for relay firehose")
-	fs.Bool("insecure", false, "DEPRECATED, does nothing.")
 	fs.StringVar(&cli.Color, "color", "", "'true' to enable colorized logging, 'false' to disable")
 	fs.StringVar(&cli.BroadcasterHost, "broadcaster-host", "", "public host for the broadcaster group that this node is a part of (excluding https:// e.g. stream.place)")
 	fs.StringVar(&cli.XXDeprecatedPublicHost, "public-host", "", "deprecated, use broadcaster-host or server-host instead as appropriate")
 	fs.StringVar(&cli.ServerHost, "server-host", "", "public host for this particular physical streamplace node. defaults to broadcaster-host and only must be set for multi-node broadcasters")
 	fs.BoolVar(&cli.Thumbnail, "thumbnail", true, "enable thumbnail generation")
 	fs.BoolVar(&cli.SmearAudio, "smear-audio", false, "enable audio smearing to create 'perfect' segment timestamps")
-	fs.BoolVar(&cli.ExternalSigning, "external-signing", false, "enable external signing via exec (prevents potential memory leak)")
 	fs.StringVar(&cli.TracingEndpoint, "tracing-endpoint", "", "gRPC endpoint to send traces to")
 	fs.IntVar(&cli.RateLimitPerSecond, "rate-limit-per-second", 0, "rate limit for requests per second per ip")
 	fs.IntVar(&cli.RateLimitBurst, "rate-limit-burst", 0, "rate limit burst for requests per ip")
···
 	fs.BoolVar(&cli.SQLLogging, "sql-logging", false, "enable sql logging")
 	fs.StringVar(&cli.SentryDSN, "sentry-dsn", "", "sentry dsn for error reporting")
 	fs.BoolVar(&cli.LivepeerDebug, "livepeer-debug", false, "log livepeer segments to $SP_DATA_DIR/livepeer-debug")
+	fs.StringVar(&cli.SegmentDebugDir, "segment-debug-dir", "", "directory to log segment validation to")
 	cli.StringSliceFlag(fs, &cli.Tickets, "tickets", []string{}, "tickets to join the swarm with")
 	fs.StringVar(&cli.IrohTopic, "iroh-topic", "", "topic to use for the iroh swarm (must be 32 bytes in hex)")
 	fs.BoolVar(&cli.DisableIrohRelay, "disable-iroh-relay", false, "disable the iroh relay")
···
 	cli.StringSliceFlag(fs, &cli.Replicators, "replicators", []string{ReplicatorWebsocket}, "list of replication protocols to use (http, iroh)")
 	fs.StringVar(&cli.WebsocketURL, "websocket-url", "", "override the websocket (ws:// or wss://) url to use for replication (normally not necessary, used for testing)")
 	fs.BoolVar(&cli.BehindHTTPSProxy, "behind-https-proxy", false, "set to true if this node is behind an https proxy and we should report https URLs even though the node isn't serving HTTPS")
+
+	fs.Bool("external-signing", true, "DEPRECATED, does nothing.")
+	fs.Bool("insecure", false, "DEPRECATED, does nothing.")
 
 	lpFlags := flag.NewFlagSet("livepeer", flag.ContinueOnError)
 	_ = starter.NewLivepeerConfig(lpFlags)
···
 func (cli *CLI) HasHTTPS() bool {
 	return cli.Secure || cli.BehindHTTPSProxy
 }
+
+func (cli *CLI) DumpDebugSegment(ctx context.Context, name string, r io.Reader) {
+	if cli.SegmentDebugDir == "" {
+		return
+	}
+	go func() {
+		err := os.MkdirAll(cli.SegmentDebugDir, 0755)
+		if err != nil {
+			log.Error(ctx, "failed to create debug directory", "error", err)
+			return
+		}
+		now := aqtime.FromTime(time.Now())
+		outFile := filepath.Join(cli.SegmentDebugDir, fmt.Sprintf("%s-%s", now.FileSafeString(), strings.ReplaceAll(name, ":", "-")))
+		fd, err := os.Create(outFile)
+		if err != nil {
+			log.Error(ctx, "failed to create debug file", "error", err)
+			return
+		}
+		defer fd.Close()
+		_, err = io.Copy(fd, r)
+		if err != nil {
+			log.Error(ctx, "failed to copy debug file", "error", err)
+			return
+		}
+		log.Log(ctx, "wrote debug file", "path", outFile)
+	}()
+}

pkg/globalerror/globalerror.go

···
-package globalerror
-
-import (
-	"fmt"
-	"path/filepath"
-	"runtime"
-	"sync"
-)
-
-var GlobalErrors []error
-var mut sync.Mutex
-
-func GlobalError(err error) {
-	if GlobalErrors == nil {
-		return
-	}
-	_, file, line, _ := runtime.Caller(1)
-
-	go func() {
-		mut.Lock()
-		defer mut.Unlock()
-		_, myfile, _, _ := runtime.Caller(0)
-		// This assumes that the root directory of streamplace is two levels above this folder.
-		// If that changes, please update this rootDir resolution.
-		rootDir := filepath.Join(filepath.Dir(myfile), "..", "..")
-		rel, _ := filepath.Rel(rootDir, file)
-		GlobalErrors = append(GlobalErrors, fmt.Errorf("%s:%d: %w", rel, line, err))
-	}()
-}

pkg/iroh/generated/iroh_streamplace/iroh_streamplace.go

···
 
 	FfiConverterDataHandlerINSTANCE.register()
 	FfiConverterGoSignerINSTANCE.register()
+	FfiConverterManySegmentsToSignINSTANCE.register()
+	FfiConverterManyStreamsINSTANCE.register()
+	FfiConverterSegmentToSignINSTANCE.register()
+	FfiConverterStreamINSTANCE.register()
 	uniffiCheckChecksums()
 }
 
···
 		checksum := rustCall(func(_uniffiStatus *C.RustCallStatus) C.uint16_t {
 			return C.uniffi_iroh_streamplace_checksum_func_get_manifest_and_cert()
 		})
-		if checksum != 17550 {
+		if checksum != 36028 {
 			// If this happens try cleaning and rebuilding your project
 			panic("iroh_streamplace: uniffi_iroh_streamplace_checksum_func_get_manifest_and_cert: UniFFI API checksum mismatch")
 		}
 	}
 	{
 		checksum := rustCall(func(_uniffiStatus *C.RustCallStatus) C.uint16_t {
+			return C.uniffi_iroh_streamplace_checksum_func_get_manifests()
+		})
+		if checksum != 2548 {
+			// If this happens try cleaning and rebuilding your project
+			panic("iroh_streamplace: uniffi_iroh_streamplace_checksum_func_get_manifests: UniFFI API checksum mismatch")
+		}
+	}
+	{
+		checksum := rustCall(func(_uniffiStatus *C.RustCallStatus) C.uint16_t {
 			return C.uniffi_iroh_streamplace_checksum_func_init_logging()
 		})
 		if checksum != 40911 {
···
 	}
 	{
 		checksum := rustCall(func(_uniffiStatus *C.RustCallStatus) C.uint16_t {
+			return C.uniffi_iroh_streamplace_checksum_func_resign()
+		})
+		if checksum != 34597 {
+			// If this happens try cleaning and rebuilding your project
+			panic("iroh_streamplace: uniffi_iroh_streamplace_checksum_func_resign: UniFFI API checksum mismatch")
+		}
+	}
+	{
+		checksum := rustCall(func(_uniffiStatus *C.RustCallStatus) C.uint16_t {
 			return C.uniffi_iroh_streamplace_checksum_func_sign()
 		})
-		if checksum != 23786 {
+		if checksum != 41179 {
 			// If this happens try cleaning and rebuilding your project
 			panic("iroh_streamplace: uniffi_iroh_streamplace_checksum_func_sign: UniFFI API checksum mismatch")
+		}
+	}
+	{
+		checksum := rustCall(func(_uniffiStatus *C.RustCallStatus) C.uint16_t {
+			return C.uniffi_iroh_streamplace_checksum_func_sign_with_ingredients()
+		})
+		if checksum != 15411 {
+			// If this happens try cleaning and rebuilding your project
+			panic("iroh_streamplace: uniffi_iroh_streamplace_checksum_func_sign_with_ingredients: UniFFI API checksum mismatch")
 		}
 	}
 	{
···
 	}
 	{
 		checksum := rustCall(func(_uniffiStatus *C.RustCallStatus) C.uint16_t {
+			return C.uniffi_iroh_streamplace_checksum_method_manysegmentstosign_next()
+		})
+		if checksum != 53885 {
+			// If this happens try cleaning and rebuilding your project
+			panic("iroh_streamplace: uniffi_iroh_streamplace_checksum_method_manysegmentstosign_next: UniFFI API checksum mismatch")
+		}
+	}
+	{
+		checksum := rustCall(func(_uniffiStatus *C.RustCallStatus) C.uint16_t {
+			return C.uniffi_iroh_streamplace_checksum_method_manystreams_next()
+		})
+		if checksum != 50757 {
+			// If this happens try cleaning and rebuilding your project
+			panic("iroh_streamplace: uniffi_iroh_streamplace_checksum_method_manystreams_next: UniFFI API checksum mismatch")
+		}
+	}
+	{
+		checksum := rustCall(func(_uniffiStatus *C.RustCallStatus) C.uint16_t {
 			return C.uniffi_iroh_streamplace_checksum_method_node_add_tickets()
 		})
 		if checksum != 8701 {
···
 	}
 	{
 		checksum := rustCall(func(_uniffiStatus *C.RustCallStatus) C.uint16_t {
+			return C.uniffi_iroh_streamplace_checksum_method_segmenttosign_unsigned_seg_stream()
+		})
+		if checksum != 25252 {
+			// If this happens try cleaning and rebuilding your project
+			panic("iroh_streamplace: uniffi_iroh_streamplace_checksum_method_segmenttosign_unsigned_seg_stream: UniFFI API checksum mismatch")
+		}
+	}
+	{
+		checksum := rustCall(func(_uniffiStatus *C.RustCallStatus) C.uint16_t {
+			return C.uniffi_iroh_streamplace_checksum_method_segmenttosign_manifest_id()
+		})
+		if checksum != 60736 {
+			// If this happens try cleaning and rebuilding your project
+			panic("iroh_streamplace: uniffi_iroh_streamplace_checksum_method_segmenttosign_manifest_id: UniFFI API checksum mismatch")
+		}
+	}
+	{
+		checksum := rustCall(func(_uniffiStatus *C.RustCallStatus) C.uint16_t {
+			return C.uniffi_iroh_streamplace_checksum_method_segmenttosign_cert()
+		})
+		if checksum != 51060 {
+			// If this happens try cleaning and rebuilding your project
+			panic("iroh_streamplace: uniffi_iroh_streamplace_checksum_method_segmenttosign_cert: UniFFI API checksum mismatch")
+		}
+	}
+	{
+		checksum := rustCall(func(_uniffiStatus *C.RustCallStatus) C.uint16_t {
+			return C.uniffi_iroh_streamplace_checksum_method_segmenttosign_output_seg_stream()
+		})
+		if checksum != 6113 {
+			// If this happens try cleaning and rebuilding your project
+			panic("iroh_streamplace: uniffi_iroh_streamplace_checksum_method_segmenttosign_output_seg_stream: UniFFI API checksum mismatch")
+		}
+	}
+	{
+		checksum := rustCall(func(_uniffiStatus *C.RustCallStatus) C.uint16_t {
+			return C.uniffi_iroh_streamplace_checksum_method_segmenttosign_close()
+		})
+		if checksum != 39185 {
+			// If this happens try cleaning and rebuilding your project
+			panic("iroh_streamplace: uniffi_iroh_streamplace_checksum_method_segmenttosign_close: UniFFI API checksum mismatch")
+		}
+	}
+	{
+		checksum := rustCall(func(_uniffiStatus *C.RustCallStatus) C.uint16_t {
+			return C.uniffi_iroh_streamplace_checksum_method_stream_read_stream()
+		})
+		if checksum != 62815 {
+			// If this happens try cleaning and rebuilding your project
+			panic("iroh_streamplace: uniffi_iroh_streamplace_checksum_method_stream_read_stream: UniFFI API checksum mismatch")
+		}
+	}
+	{
+		checksum := rustCall(func(_uniffiStatus *C.RustCallStatus) C.uint16_t {
+			return C.uniffi_iroh_streamplace_checksum_method_stream_seek_stream()
+		})
+		if checksum != 56397 {
+			// If this happens try cleaning and rebuilding your project
+			panic("iroh_streamplace: uniffi_iroh_streamplace_checksum_method_stream_seek_stream: UniFFI API checksum mismatch")
+		}
+	}
+	{
+		checksum := rustCall(func(_uniffiStatus *C.RustCallStatus) C.uint16_t {
+			return C.uniffi_iroh_streamplace_checksum_method_stream_write_stream()
+		})
+		if checksum != 59847 {
+			// If this happens try cleaning and rebuilding your project
+			panic("iroh_streamplace: uniffi_iroh_streamplace_checksum_method_stream_write_stream: UniFFI API checksum mismatch")
+		}
+	}
+	{
+		checksum := rustCall(func(_uniffiStatus *C.RustCallStatus) C.uint16_t {
 			return C.uniffi_iroh_streamplace_checksum_method_subscriberesponse_next_raw()
 		})
 		if checksum != 55650 {
···
 type FfiDestroyerUint64 struct{}
 
 func (FfiDestroyerUint64) Destroy(_ uint64) {}
+
+type FfiConverterInt64 struct{}
+
+var FfiConverterInt64INSTANCE = FfiConverterInt64{}
+
+func (FfiConverterInt64) Lower(value int64) C.int64_t {
+	return C.int64_t(value)
+}
+
+func (FfiConverterInt64) Write(writer io.Writer, value int64) {
+	writeInt64(writer, value)
+}
+
+func (FfiConverterInt64) Lift(value C.int64_t) int64 {
+	return int64(value)
+}
+
+func (FfiConverterInt64) Read(reader io.Reader) int64 {
+	return readInt64(reader)
+}
+
+type FfiDestroyerInt64 struct{}
+
+func (FfiDestroyerInt64) Destroy(_ int64) {}
 
 type FfiConverterBool struct{}
 
···
 	C.uniffi_iroh_streamplace_fn_init_callback_vtable_gosigner(&UniffiVTableCallbackInterfaceGoSignerINSTANCE)
 }
 
+type ManySegmentsToSign interface {
+	Next() *SegmentToSign
+}
+type ManySegmentsToSignImpl struct {
+	ffiObject FfiObject
+}
+
+func (_self *ManySegmentsToSignImpl) Next() *SegmentToSign {
+	_pointer := _self.ffiObject.incrementPointer("ManySegmentsToSign")
+	defer _self.ffiObject.decrementPointer()
+	return FfiConverterOptionalSegmentToSignINSTANCE.Lift(rustCall(func(_uniffiStatus *C.RustCallStatus) RustBufferI {
+		return GoRustBuffer{
+			inner: C.uniffi_iroh_streamplace_fn_method_manysegmentstosign_next(
+				_pointer, _uniffiStatus),
+		}
+	}))
+}
+func (object *ManySegmentsToSignImpl) Destroy() {
+	runtime.SetFinalizer(object, nil)
+	object.ffiObject.destroy()
+}
+
+type FfiConverterManySegmentsToSign struct {
+	handleMap *concurrentHandleMap[ManySegmentsToSign]
+}
+
+var FfiConverterManySegmentsToSignINSTANCE = FfiConverterManySegmentsToSign{
+	handleMap: newConcurrentHandleMap[ManySegmentsToSign](),
+}
+
+func (c FfiConverterManySegmentsToSign) Lift(pointer unsafe.Pointer) ManySegmentsToSign {
+	result := &ManySegmentsToSignImpl{
+		newFfiObject(
+			pointer,
+			func(pointer unsafe.Pointer, status *C.RustCallStatus) unsafe.Pointer {
+				return C.uniffi_iroh_streamplace_fn_clone_manysegmentstosign(pointer, status)
+			},
+			func(pointer unsafe.Pointer, status *C.RustCallStatus) {
+				C.uniffi_iroh_streamplace_fn_free_manysegmentstosign(pointer, status)
+			},
+		),
+	}
+	runtime.SetFinalizer(result, (*ManySegmentsToSignImpl).Destroy)
+	return result
+}
+
+func (c FfiConverterManySegmentsToSign) Read(reader io.Reader) ManySegmentsToSign {
+	return c.Lift(unsafe.Pointer(uintptr(readUint64(reader))))
+}
+
+func (c FfiConverterManySegmentsToSign) Lower(value ManySegmentsToSign) unsafe.Pointer {
+	// TODO: this is bad - all synchronization from ObjectRuntime.go is discarded here,
+	// because the pointer will be decremented immediately after this function returns,
+	// and someone will be left holding onto a non-locked pointer.
+	pointer := unsafe.Pointer(uintptr(c.handleMap.insert(value)))
+	return pointer
+
+}
+
+func (c FfiConverterManySegmentsToSign) Write(writer io.Writer, value ManySegmentsToSign) {
+	writeUint64(writer, uint64(uintptr(c.Lower(value))))
+}
+
+type FfiDestroyerManySegmentsToSign struct{}
+
+func (_ FfiDestroyerManySegmentsToSign) Destroy(value ManySegmentsToSign) {
+	if val, ok := value.(*ManySegmentsToSignImpl); ok {
+		val.Destroy()
+	} else {
+		panic("Expected *ManySegmentsToSignImpl")
+	}
+}
+
+//export iroh_streamplace_cgo_dispatchCallbackInterfaceManySegmentsToSignMethod0
+func iroh_streamplace_cgo_dispatchCallbackInterfaceManySegmentsToSignMethod0(uniffiHandle C.uint64_t, uniffiOutReturn *C.RustBuffer, callStatus *C.RustCallStatus) {
+	handle := uint64(uniffiHandle)
+	uniffiObj, ok := FfiConverterManySegmentsToSignINSTANCE.handleMap.tryGet(handle)
+	if !ok {
+		panic(fmt.Errorf("no callback in handle map: %d", handle))
+	}
+
+	res :=
+		uniffiObj.Next()
+
+	*uniffiOutReturn = FfiConverterOptionalSegmentToSignINSTANCE.Lower(res)
+}
+
+var UniffiVTableCallbackInterfaceManySegmentsToSignINSTANCE = C.UniffiVTableCallbackInterfaceManySegmentsToSign{
+	next: (C.UniffiCallbackInterfaceManySegmentsToSignMethod0)(C.iroh_streamplace_cgo_dispatchCallbackInterfaceManySegmentsToSignMethod0),
+
+	uniffiFree: (C.UniffiCallbackInterfaceFree)(C.iroh_streamplace_cgo_dispatchCallbackInterfaceManySegmentsToSignFree),
+}
+
+//export iroh_streamplace_cgo_dispatchCallbackInterfaceManySegmentsToSignFree
+func iroh_streamplace_cgo_dispatchCallbackInterfaceManySegmentsToSignFree(handle C.uint64_t) {
+	FfiConverterManySegmentsToSignINSTANCE.handleMap.remove(uint64(handle))
+}
+
+func (c FfiConverterManySegmentsToSign) register() {
+	C.uniffi_iroh_streamplace_fn_init_callback_vtable_manysegmentstosign(&UniffiVTableCallbackInterfaceManySegmentsToSignINSTANCE)
+}
+
+type ManyStreams interface {
+	// Get the next stream from the many streams
+	Next() *Stream
+}
+type ManyStreamsImpl struct {
+	ffiObject FfiObject
+}
+
+// Get the next stream from the many streams
+func (_self *ManyStreamsImpl) Next() *Stream {
+	_pointer := _self.ffiObject.incrementPointer("ManyStreams")
+	defer _self.ffiObject.decrementPointer()
+	return FfiConverterOptionalStreamINSTANCE.Lift(rustCall(func(_uniffiStatus *C.RustCallStatus) RustBufferI {
+		return GoRustBuffer{
+			inner: C.uniffi_iroh_streamplace_fn_method_manystreams_next(
+				_pointer, _uniffiStatus),
+		}
+	}))
+}
+func (object *ManyStreamsImpl) Destroy() {
+	runtime.SetFinalizer(object, nil)
+	object.ffiObject.destroy()
+}
+
+type FfiConverterManyStreams struct {
+	handleMap *concurrentHandleMap[ManyStreams]
+}
+
+var FfiConverterManyStreamsINSTANCE = FfiConverterManyStreams{
+	handleMap: newConcurrentHandleMap[ManyStreams](),
+}
+
+func (c FfiConverterManyStreams) Lift(pointer unsafe.Pointer) ManyStreams {
+	result := &ManyStreamsImpl{
+		newFfiObject(
+			pointer,
+			func(pointer unsafe.Pointer, status *C.RustCallStatus) unsafe.Pointer {
+				return C.uniffi_iroh_streamplace_fn_clone_manystreams(pointer, status)
+			},
+			func(pointer unsafe.Pointer, status *C.RustCallStatus) {
+				C.uniffi_iroh_streamplace_fn_free_manystreams(pointer, status)
+			},
+		),
+	}
+	runtime.SetFinalizer(result, (*ManyStreamsImpl).Destroy)
+	return result
+}
+
+func (c FfiConverterManyStreams) Read(reader io.Reader) ManyStreams {
+	return c.Lift(unsafe.Pointer(uintptr(readUint64(reader))))
+}
+
+func (c FfiConverterManyStreams) Lower(value ManyStreams) unsafe.Pointer {
+	// TODO: this is bad - all synchronization from ObjectRuntime.go is discarded here,
+	// because the pointer will be decremented immediately after this function returns,
+	// and someone will be left holding onto a non-locked pointer.
+	pointer := unsafe.Pointer(uintptr(c.handleMap.insert(value)))
+	return pointer
+
+}
+
+func (c FfiConverterManyStreams) Write(writer io.Writer, value ManyStreams) {
+	writeUint64(writer, uint64(uintptr(c.Lower(value))))
+}
+
+type FfiDestroyerManyStreams struct{}
+
+func (_ FfiDestroyerManyStreams) Destroy(value ManyStreams) {
+	if val, ok := value.(*ManyStreamsImpl); ok {
+		val.Destroy()
+	} else {
+		panic("Expected *ManyStreamsImpl")
+	}
+}
+
+//export iroh_streamplace_cgo_dispatchCallbackInterfaceManyStreamsMethod0
+func iroh_streamplace_cgo_dispatchCallbackInterfaceManyStreamsMethod0(uniffiHandle C.uint64_t, uniffiOutReturn *C.RustBuffer, callStatus *C.RustCallStatus) {
+	handle := uint64(uniffiHandle)
+	uniffiObj, ok := FfiConverterManyStreamsINSTANCE.handleMap.tryGet(handle)
+	if !ok {
+		panic(fmt.Errorf("no callback in handle map: %d", handle))
+	}
+
+	res :=
+		uniffiObj.Next()
+
+	*uniffiOutReturn = FfiConverterOptionalStreamINSTANCE.Lower(res)
+}
+
+var UniffiVTableCallbackInterfaceManyStreamsINSTANCE = C.UniffiVTableCallbackInterfaceManyStreams{
+	next: (C.UniffiCallbackInterfaceManyStreamsMethod0)(C.iroh_streamplace_cgo_dispatchCallbackInterfaceManyStreamsMethod0),
+
+	uniffiFree: (C.UniffiCallbackInterfaceFree)(C.iroh_streamplace_cgo_dispatchCallbackInterfaceManyStreamsFree),
+}
+
+//export iroh_streamplace_cgo_dispatchCallbackInterfaceManyStreamsFree
+func iroh_streamplace_cgo_dispatchCallbackInterfaceManyStreamsFree(handle C.uint64_t) {
+	FfiConverterManyStreamsINSTANCE.handleMap.remove(uint64(handle))
+}
+
+func (c FfiConverterManyStreams) register() {
+	C.uniffi_iroh_streamplace_fn_init_callback_vtable_manystreams(&UniffiVTableCallbackInterfaceManyStreamsINSTANCE)
+}
+
 // Iroh-streamplace node that can send, forward or receive stream segments.
 type NodeInterface interface {
 	// Add tickets for remote peers
···
 	value.Destroy()
 }
 
+type SegmentToSign interface {
+	UnsignedSegStream() Stream
+	ManifestId() string
+	Cert() []byte
+	OutputSegStream() Stream
+	Close()
+}
+type SegmentToSignImpl struct {
+	ffiObject FfiObject
+}
+
+func (_self *SegmentToSignImpl) UnsignedSegStream() Stream {
+	_pointer := _self.ffiObject.incrementPointer("SegmentToSign")
+	defer _self.ffiObject.decrementPointer()
+	return FfiConverterStreamINSTANCE.Lift(rustCall(func(_uniffiStatus *C.RustCallStatus) unsafe.Pointer {
+		return C.uniffi_iroh_streamplace_fn_method_segmenttosign_unsigned_seg_stream(
+			_pointer, _uniffiStatus)
+	}))
+}
+
+func (_self *SegmentToSignImpl) ManifestId() string {
+	_pointer := _self.ffiObject.incrementPointer("SegmentToSign")
+	defer _self.ffiObject.decrementPointer()
+	return FfiConverterStringINSTANCE.Lift(rustCall(func(_uniffiStatus *C.RustCallStatus) RustBufferI {
+		return GoRustBuffer{
+			inner: C.uniffi_iroh_streamplace_fn_method_segmenttosign_manifest_id(
+				_pointer, _uniffiStatus),
+		}
+	}))
+}
+
+func (_self *SegmentToSignImpl) Cert() []byte {
+	_pointer := _self.ffiObject.incrementPointer("SegmentToSign")
+	defer _self.ffiObject.decrementPointer()
+	return FfiConverterBytesINSTANCE.Lift(rustCall(func(_uniffiStatus *C.RustCallStatus) RustBufferI {
+		return GoRustBuffer{
+			inner: C.uniffi_iroh_streamplace_fn_method_segmenttosign_cert(
+				_pointer, _uniffiStatus),
+		}
+	}))
+}
+
+func (_self *SegmentToSignImpl) OutputSegStream() Stream {
+	_pointer := _self.ffiObject.incrementPointer("SegmentToSign")
+	defer _self.ffiObject.decrementPointer()
+	return FfiConverterStreamINSTANCE.Lift(rustCall(func(_uniffiStatus *C.RustCallStatus) unsafe.Pointer {
+		return C.uniffi_iroh_streamplace_fn_method_segmenttosign_output_seg_stream(
+			_pointer, _uniffiStatus)
+	}))
+}
+
+func (_self *SegmentToSignImpl) Close() {
+	_pointer := _self.ffiObject.incrementPointer("SegmentToSign")
+	defer _self.ffiObject.decrementPointer()
+	rustCall(func(_uniffiStatus *C.RustCallStatus) bool {
+		C.uniffi_iroh_streamplace_fn_method_segmenttosign_close(
+			_pointer, _uniffiStatus)
+		return false
+	})
+}
+func (object *SegmentToSignImpl) Destroy() {
+	runtime.SetFinalizer(object, nil)
+	object.ffiObject.destroy()
+}
+
+type FfiConverterSegmentToSign struct {
+	handleMap *concurrentHandleMap[SegmentToSign]
+}
+
+var FfiConverterSegmentToSignINSTANCE = FfiConverterSegmentToSign{
+	handleMap: newConcurrentHandleMap[SegmentToSign](),
+}
+
+func (c FfiConverterSegmentToSign) Lift(pointer unsafe.Pointer) SegmentToSign {
+	result := &SegmentToSignImpl{
+		newFfiObject(
+			pointer,
+			func(pointer unsafe.Pointer, status *C.RustCallStatus) unsafe.Pointer {
+				return C.uniffi_iroh_streamplace_fn_clone_segmenttosign(pointer, status)
+			},
+			func(pointer unsafe.Pointer, status *C.RustCallStatus) {
+				C.uniffi_iroh_streamplace_fn_free_segmenttosign(pointer, status)
+			},
+		),
+	}
+	runtime.SetFinalizer(result, (*SegmentToSignImpl).Destroy)
+	return result
+}
+
+func (c FfiConverterSegmentToSign) Read(reader io.Reader) SegmentToSign {
+	return c.Lift(unsafe.Pointer(uintptr(readUint64(reader))))
+}
+
+func (c FfiConverterSegmentToSign) Lower(value SegmentToSign) unsafe.Pointer {
+	// TODO: this is bad - all synchronization from ObjectRuntime.go is discarded here,
+	// because the pointer will be decremented immediately after this function returns,
+	// and someone will be left holding onto a non-locked pointer.
+	pointer := unsafe.Pointer(uintptr(c.handleMap.insert(value)))
+	return pointer
+
+}
+
+func (c FfiConverterSegmentToSign) Write(writer io.Writer, value SegmentToSign) {
+	writeUint64(writer, uint64(uintptr(c.Lower(value))))
+}
+
+type FfiDestroyerSegmentToSign struct{}
+
+func (_ FfiDestroyerSegmentToSign) Destroy(value SegmentToSign) {
+	if val, ok := value.(*SegmentToSignImpl); ok {
+		val.Destroy()
+	} else {
+		panic("Expected *SegmentToSignImpl")
+	}
+}
+
+//export iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignMethod0
+func iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignMethod0(uniffiHandle C.uint64_t, uniffiOutReturn *unsafe.Pointer, callStatus *C.RustCallStatus) {
+	handle := uint64(uniffiHandle)
+	uniffiObj, ok := FfiConverterSegmentToSignINSTANCE.handleMap.tryGet(handle)
+	if !ok {
+		panic(fmt.Errorf("no callback in handle map: %d", handle))
+	}
+
+	res :=
+		uniffiObj.UnsignedSegStream()
+
+	*uniffiOutReturn = FfiConverterStreamINSTANCE.Lower(res)
+}
+
+//export iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignMethod1
+func iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignMethod1(uniffiHandle C.uint64_t, uniffiOutReturn *C.RustBuffer, callStatus *C.RustCallStatus) {
+	handle := uint64(uniffiHandle)
+	uniffiObj, ok := FfiConverterSegmentToSignINSTANCE.handleMap.tryGet(handle)
+	if !ok {
+		panic(fmt.Errorf("no callback in handle map: %d", handle))
+	}
+
+	res :=
+		uniffiObj.ManifestId()
+
+	*uniffiOutReturn = FfiConverterStringINSTANCE.Lower(res)
+}
+
+//export iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignMethod2
+func iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignMethod2(uniffiHandle C.uint64_t, uniffiOutReturn *C.RustBuffer, callStatus *C.RustCallStatus) {
+	handle := uint64(uniffiHandle)
+	uniffiObj, ok := FfiConverterSegmentToSignINSTANCE.handleMap.tryGet(handle)
+	if !ok {
+		panic(fmt.Errorf("no callback in handle map: %d", handle))
+	}
+
+	res :=
+		uniffiObj.Cert()
+
+	*uniffiOutReturn = FfiConverterBytesINSTANCE.Lower(res)
+}
+
+//export iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignMethod3
+func iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignMethod3(uniffiHandle C.uint64_t, uniffiOutReturn *unsafe.Pointer, callStatus *C.RustCallStatus) {
+	handle := uint64(uniffiHandle)
+	uniffiObj, ok := FfiConverterSegmentToSignINSTANCE.handleMap.tryGet(handle)
+	if !ok {
+		panic(fmt.Errorf("no callback in handle map: %d", handle))
+	}
+
+	res :=
+		uniffiObj.OutputSegStream()
+
+	*uniffiOutReturn = FfiConverterStreamINSTANCE.Lower(res)
+}
+
+//export iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignMethod4
+func iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignMethod4(uniffiHandle C.uint64_t, uniffiOutReturn *C.void, callStatus *C.RustCallStatus) {
+	handle := uint64(uniffiHandle)
+	uniffiObj, ok := FfiConverterSegmentToSignINSTANCE.handleMap.tryGet(handle)
+	if !ok {
+		panic(fmt.Errorf("no callback in handle map: %d", handle))
+	}
+
+	uniffiObj.Close()
+
+}
+
+var UniffiVTableCallbackInterfaceSegmentToSignINSTANCE = C.UniffiVTableCallbackInterfaceSegmentToSign{
+	unsignedSegStream: (C.UniffiCallbackInterfaceSegmentToSignMethod0)(C.iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignMethod0),
+	manifestId:        (C.UniffiCallbackInterfaceSegmentToSignMethod1)(C.iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignMethod1),
+	cert:              (C.UniffiCallbackInterfaceSegmentToSignMethod2)(C.iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignMethod2),
+	outputSegStream:   (C.UniffiCallbackInterfaceSegmentToSignMethod3)(C.iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignMethod3),
+	close:             (C.UniffiCallbackInterfaceSegmentToSignMethod4)(C.iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignMethod4),
+
+	uniffiFree: (C.UniffiCallbackInterfaceFree)(C.iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignFree),
+}
+
+//export iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignFree
+func iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignFree(handle C.uint64_t) {
+	FfiConverterSegmentToSignINSTANCE.handleMap.remove(uint64(handle))
+}
+
+func (c FfiConverterSegmentToSign) register() {
+	C.uniffi_iroh_streamplace_fn_init_callback_vtable_segmenttosign(&UniffiVTableCallbackInterfaceSegmentToSignINSTANCE)
+}
+
+// This allows for a callback stream over the Uniffi interface.
+// Implement these stream functions in the foreign language
+// and this will provide Rust Stream trait implementations
+// This is necessary since the Rust traits cannot be implemented directly
+// as uniffi callbacks
+type Stream interface {
+	// Read a stream of bytes from the stream
+	ReadStream(length uint64) ([]byte, error)
+	// Seek to a position in the stream
+	SeekStream(pos int64, mode uint64) (uint64, error)
+	// Write a stream of bytes to the stream
+	WriteStream(data []byte) (uint64, error)
+}
+
+// This allows for a callback stream over the Uniffi interface.
+// Implement these stream functions in the foreign language
+// and this will provide Rust Stream trait implementations
+// This is necessary since the Rust traits cannot be implemented directly
+// as uniffi callbacks
+type StreamImpl struct {
+	ffiObject FfiObject
+}
+
+// Read a stream of bytes from the stream
+func (_self *StreamImpl) ReadStream(length uint64) ([]byte, error) {
+	_pointer := _self.ffiObject.incrementPointer("Stream")
+	defer _self.ffiObject.decrementPointer()
+	_uniffiRV, _uniffiErr := rustCallWithError[SpError](FfiConverterSpError{}, func(_uniffiStatus *C.RustCallStatus) RustBufferI {
+		return GoRustBuffer{
+			inner: C.uniffi_iroh_streamplace_fn_method_stream_read_stream(
+				_pointer, FfiConverterUint64INSTANCE.Lower(length), _uniffiStatus),
+		}
+	})
+	if _uniffiErr != nil {
+		var _uniffiDefaultValue []byte
+		return _uniffiDefaultValue, _uniffiErr
+	} else {
+		return FfiConverterBytesINSTANCE.Lift(_uniffiRV), nil
+	}
+}
+
+// Seek to a position in the stream
+func (_self *StreamImpl) SeekStream(pos int64, mode uint64) (uint64, error) {
+	_pointer := _self.ffiObject.incrementPointer("Stream")
+	defer _self.ffiObject.decrementPointer()
+	_uniffiRV, _uniffiErr := rustCallWithError[SpError](FfiConverterSpError{}, func(_uniffiStatus *C.RustCallStatus) C.uint64_t {
+		return C.uniffi_iroh_streamplace_fn_method_stream_seek_stream(
+			_pointer, FfiConverterInt64INSTANCE.Lower(pos), FfiConverterUint64INSTANCE.Lower(mode), _uniffiStatus)
+	})
+	if _uniffiErr != nil {
+		var _uniffiDefaultValue uint64
+		return _uniffiDefaultValue, _uniffiErr
+	} else {
+		return FfiConverterUint64INSTANCE.Lift(_uniffiRV), nil
+	}
+}
+
+// Write a stream of bytes to the stream
+func (_self *StreamImpl) WriteStream(data []byte) (uint64, error) {
+	_pointer := _self.ffiObject.incrementPointer("Stream")
+	defer _self.ffiObject.decrementPointer()
+	_uniffiRV, _uniffiErr := rustCallWithError[SpError](FfiConverterSpError{}, func(_uniffiStatus *C.RustCallStatus) C.uint64_t {
+		return C.uniffi_iroh_streamplace_fn_method_stream_write_stream(
+			_pointer, FfiConverterBytesINSTANCE.Lower(data), _uniffiStatus)
+	})
+	if _uniffiErr != nil {
+		var _uniffiDefaultValue uint64
+		return _uniffiDefaultValue, _uniffiErr
+	} else {
+		return FfiConverterUint64INSTANCE.Lift(_uniffiRV), nil
+	}
+}
+func (object *StreamImpl) Destroy() {
+	runtime.SetFinalizer(object, nil)
+	object.ffiObject.destroy()
+}
+
+type FfiConverterStream struct {
+	handleMap *concurrentHandleMap[Stream]
+}
+
+var FfiConverterStreamINSTANCE = FfiConverterStream{
+	handleMap: newConcurrentHandleMap[Stream](),
+}
+
+func (c FfiConverterStream) Lift(pointer unsafe.Pointer) Stream {
+	result := &StreamImpl{
+		newFfiObject(
+			pointer,
+			func(pointer unsafe.Pointer, status *C.RustCallStatus) unsafe.Pointer {
+				return C.uniffi_iroh_streamplace_fn_clone_stream(pointer, status)
+			},
+			func(pointer unsafe.Pointer, status *C.RustCallStatus) {
+				C.uniffi_iroh_streamplace_fn_free_stream(pointer, status)
+			},
+		),
+	}
+	runtime.SetFinalizer(result, (*StreamImpl).Destroy)
+	return result
+}
+
+func (c FfiConverterStream) Read(reader io.Reader) Stream {
+	return c.Lift(unsafe.Pointer(uintptr(readUint64(reader))))
+}
+
+func (c FfiConverterStream) Lower(value Stream) unsafe.Pointer {
+	// TODO: this is bad - all synchronization from ObjectRuntime.go is discarded here,
+	// because the pointer will be decremented immediately after this function returns,
+	// and someone will be left holding onto a non-locked pointer.
+	pointer := unsafe.Pointer(uintptr(c.handleMap.insert(value)))
+	return pointer
+
+}
+
+func (c FfiConverterStream) Write(writer io.Writer, value Stream) {
+	writeUint64(writer, uint64(uintptr(c.Lower(value))))
+}
+
+type FfiDestroyerStream struct{}
+
+func (_ FfiDestroyerStream) Destroy(value Stream) {
+	if val, ok := value.(*StreamImpl); ok {
+		val.Destroy()
+	} else {
+		panic("Expected *StreamImpl")
+	}
+}
+
+//export iroh_streamplace_cgo_dispatchCallbackInterfaceStreamMethod0
+func iroh_streamplace_cgo_dispatchCallbackInterfaceStreamMethod0(uniffiHandle C.uint64_t, length C.uint64_t, uniffiOutReturn *C.RustBuffer, callStatus *C.RustCallStatus) {
+	handle := uint64(uniffiHandle)
+	uniffiObj, ok := FfiConverterStreamINSTANCE.handleMap.tryGet(handle)
+	if !ok {
+		panic(fmt.Errorf("no callback in handle map: %d", handle))
+	}
+
+	res, err :=
+		uniffiObj.ReadStream(
+			FfiConverterUint64INSTANCE.Lift(length),
+		)
+
+	if err != nil {
+		var actualError *SpError
+		if errors.As(err, &actualError) {
+			*callStatus = C.RustCallStatus{
+				code:     C.int8_t(uniffiCallbackResultError),
+				errorBuf: FfiConverterSpErrorINSTANCE.Lower(actualError),
+			}
+		} else {
+			*callStatus = C.RustCallStatus{
+				code: C.int8_t(uniffiCallbackUnexpectedResultError),
+			}
+		}
+		return
+	}
+
+	*uniffiOutReturn = FfiConverterBytesINSTANCE.Lower(res)
+}
+
+//export iroh_streamplace_cgo_dispatchCallbackInterfaceStreamMethod1
+func iroh_streamplace_cgo_dispatchCallbackInterfaceStreamMethod1(uniffiHandle C.uint64_t, pos C.int64_t, mode C.uint64_t, uniffiOutReturn *C.uint64_t, callStatus *C.RustCallStatus) {
+	handle := uint64(uniffiHandle)
+	uniffiObj, ok := FfiConverterStreamINSTANCE.handleMap.tryGet(handle)
+	if !ok {
+		panic(fmt.Errorf("no callback in handle map: %d", handle))
+	}
+
+	res, err :=
+		uniffiObj.SeekStream(
+			FfiConverterInt64INSTANCE.Lift(pos),
+			FfiConverterUint64INSTANCE.Lift(mode),
+		)
+
+	if err != nil {
+		var actualError *SpError
+		if errors.As(err, &actualError) {
+			*callStatus = C.RustCallStatus{
+				code:     C.int8_t(uniffiCallbackResultError),
+				errorBuf: FfiConverterSpErrorINSTANCE.Lower(actualError),
+			}
+		} else {
+			*callStatus = C.RustCallStatus{
+				code: C.int8_t(uniffiCallbackUnexpectedResultError),
+			}
+		}
+		return
+	}
+
+	*uniffiOutReturn = FfiConverterUint64INSTANCE.Lower(res)
+}
+
+//export iroh_streamplace_cgo_dispatchCallbackInterfaceStreamMethod2
+func iroh_streamplace_cgo_dispatchCallbackInterfaceStreamMethod2(uniffiHandle C.uint64_t, data C.RustBuffer, uniffiOutReturn *C.uint64_t, callStatus *C.RustCallStatus) {
+	handle := uint64(uniffiHandle)
+	uniffiObj, ok := FfiConverterStreamINSTANCE.handleMap.tryGet(handle)
+	if !ok {
+		panic(fmt.Errorf("no callback in handle map: %d", handle))
+	}
+
+	res, err :=
+		uniffiObj.WriteStream(
+			FfiConverterBytesINSTANCE.Lift(GoRustBuffer{
+				inner: data,
+			}),
+		)
+
+	if err != nil {
+		var actualError *SpError
+		if errors.As(err, &actualError) {
+			*callStatus = C.RustCallStatus{
+				code:     C.int8_t(uniffiCallbackResultError),
+				errorBuf: FfiConverterSpErrorINSTANCE.Lower(actualError),
+			}
+		} else {
+			*callStatus = C.RustCallStatus{
+				code: C.int8_t(uniffiCallbackUnexpectedResultError),
+			}
+		}
+		return
+	}
+
+	*uniffiOutReturn = FfiConverterUint64INSTANCE.Lower(res)
+}
+
+var UniffiVTableCallbackInterfaceStreamINSTANCE = C.UniffiVTableCallbackInterfaceStream{
+	readStream:  (C.UniffiCallbackInterfaceStreamMethod0)(C.iroh_streamplace_cgo_dispatchCallbackInterfaceStreamMethod0),
+	seekStream:  (C.UniffiCallbackInterfaceStreamMethod1)(C.iroh_streamplace_cgo_dispatchCallbackInterfaceStreamMethod1),
+	writeStream: (C.UniffiCallbackInterfaceStreamMethod2)(C.iroh_streamplace_cgo_dispatchCallbackInterfaceStreamMethod2),
+
+	uniffiFree: (C.UniffiCallbackInterfaceFree)(C.iroh_streamplace_cgo_dispatchCallbackInterfaceStreamFree),
+}
+
+//export iroh_streamplace_cgo_dispatchCallbackInterfaceStreamFree
+func iroh_streamplace_cgo_dispatchCallbackInterfaceStreamFree(handle C.uint64_t) {
+	FfiConverterStreamINSTANCE.handleMap.remove(uint64(handle))
+}
+
+func (c FfiConverterStream) register() {
+	C.uniffi_iroh_streamplace_fn_init_callback_vtable_stream(&UniffiVTableCallbackInterfaceStreamINSTANCE)
+}
+
 // A response to a subscribe request.
 //
 // This can be used as a stream of [`SubscribeItem`]s.
···
 // Err* are used for checking error type with `errors.Is`
 var ErrSpErrorNoCertificateChainFound = fmt.Errorf("SpErrorNoCertificateChainFound")
 var ErrSpErrorC2paError = fmt.Errorf("SpErrorC2paError")
+var ErrSpErrorIoError = fmt.Errorf("SpErrorIoError")
 
 // Variant structs
 type SpErrorNoCertificateChainFound struct {
···
 	return target == ErrSpErrorC2paError
 }
 
+type SpErrorIoError struct {
+	message string
+}
+
+func NewSpErrorIoError() *SpError {
+	return &SpError{err: &SpErrorIoError{}}
+}
+
+func (e SpErrorIoError) destroy() {
+}
+
+func (err SpErrorIoError) Error() string {
+	return fmt.Sprintf("IoError: %s", err.message)
+}
+
+func (self SpErrorIoError) Is(target error) bool {
+	return target == ErrSpErrorIoError
+}
+
 type FfiConverterSpError struct{}
 
 var FfiConverterSpErrorINSTANCE = FfiConverterSpError{}
···
 		return &SpError{&SpErrorNoCertificateChainFound{message}}
 	case 2:
 		return &SpError{&SpErrorC2paError{message}}
+	case 3:
+		return &SpError{&SpErrorIoError{message}}
 	default:
 		panic(fmt.Sprintf("Unknown error code %d in FfiConverterSpError.Read()", errorID))
 	}
···
 		writeInt32(writer, 1)
 	case *SpErrorC2paError:
 		writeInt32(writer, 2)
+	case *SpErrorIoError:
+		writeInt32(writer, 3)
 	default:
 		_ = variantValue
 		panic(fmt.Sprintf("invalid error value `%v` in FfiConverterSpError.Write", value))
···
 	case SpErrorNoCertificateChainFound:
 		variantValue.destroy()
 	case SpErrorC2paError:
+		variantValue.destroy()
+	case SpErrorIoError:
 		variantValue.destroy()
 	default:
 		_ = variantValue
···
 	}
 }
 
+type FfiConverterOptionalSegmentToSign struct{}
+
+var FfiConverterOptionalSegmentToSignINSTANCE = FfiConverterOptionalSegmentToSign{}
+
+func (c FfiConverterOptionalSegmentToSign) Lift(rb RustBufferI) *SegmentToSign {
+	return LiftFromRustBuffer[*SegmentToSign](c, rb)
+}
+
+func (_ FfiConverterOptionalSegmentToSign) Read(reader io.Reader) *SegmentToSign {
+	if readInt8(reader) == 0 {
+		return nil
+	}
+	temp := FfiConverterSegmentToSignINSTANCE.Read(reader)
+	return &temp
+}
+
+func (c FfiConverterOptionalSegmentToSign) Lower(value *SegmentToSign) C.RustBuffer {
+	return LowerIntoRustBuffer[*SegmentToSign](c, value)
+}
+
+func (_ FfiConverterOptionalSegmentToSign) Write(writer io.Writer, value *SegmentToSign) {
+	if value == nil {
+		writeInt8(writer, 0)
+	} else {
+		writeInt8(writer, 1)
+		FfiConverterSegmentToSignINSTANCE.Write(writer, *value)
+	}
+}
+
+type FfiDestroyerOptionalSegmentToSign struct{}
+
+func (_ FfiDestroyerOptionalSegmentToSign) Destroy(value *SegmentToSign) {
+	if value != nil {
+		FfiDestroyerSegmentToSign{}.Destroy(*value)
+	}
+}
+
+type FfiConverterOptionalStream struct{}
+
+var FfiConverterOptionalStreamINSTANCE = FfiConverterOptionalStream{}
+
+func (c FfiConverterOptionalStream) Lift(rb RustBufferI) *Stream {
+	return LiftFromRustBuffer[*Stream](c, rb)
+}
+
+func (_ FfiConverterOptionalStream) Read(reader io.Reader) *Stream {
+	if readInt8(reader) == 0 {
+		return nil
+	}
+	temp := FfiConverterStreamINSTANCE.Read(reader)
+	return &temp
+}
+
+func (c FfiConverterOptionalStream) Lower(value *Stream) C.RustBuffer {
+	return LowerIntoRustBuffer[*Stream](c, value)
+}
+
+func (_ FfiConverterOptionalStream) Write(writer io.Writer, value *Stream) {
+	if value == nil {
+		writeInt8(writer, 0)
+	} else {
+		writeInt8(writer, 1)
+		FfiConverterStreamINSTANCE.Write(writer, *value)
+	}
+}
+
+type FfiDestroyerOptionalStream struct{}
+
+func (_ FfiDestroyerOptionalStream) Destroy(value *Stream) {
+	if value != nil {
+		FfiDestroyerStream{}.Destroy(*value)
+	}
+}
+
 type FfiConverterOptionalSubscribeItem struct{}
 
 var FfiConverterOptionalSubscribeItemINSTANCE = FfiConverterOptionalSubscribeItem{}
···
 	guard <- struct{}{}
 }
 
-func GetManifestAndCert(data []byte) (string, error) {
+func GetManifestAndCert(data Stream) (string, error) {
 	_uniffiRV, _uniffiErr := rustCallWithError[SpError](FfiConverterSpError{}, func(_uniffiStatus *C.RustCallStatus) RustBufferI {
 		return GoRustBuffer{
-			inner: C.uniffi_iroh_streamplace_fn_func_get_manifest_and_cert(FfiConverterBytesINSTANCE.Lower(data), _uniffiStatus),
+			inner: C.uniffi_iroh_streamplace_fn_func_get_manifest_and_cert(FfiConverterStreamINSTANCE.Lower(data), _uniffiStatus),
+		}
+	})
+	if _uniffiErr != nil {
+		var _uniffiDefaultValue string
+		return _uniffiDefaultValue, _uniffiErr
+	} else {
+		return FfiConverterStringINSTANCE.Lift(_uniffiRV), nil
+	}
+}
+
+func GetManifests(data Stream) (string, error) {
+	_uniffiRV, _uniffiErr := rustCallWithError[SpError](FfiConverterSpError{}, func(_uniffiStatus *C.RustCallStatus) RustBufferI {
+		return GoRustBuffer{
+			inner: C.uniffi_iroh_streamplace_fn_func_get_manifests(FfiConverterStreamINSTANCE.Lower(data), _uniffiStatus),
 		}
 	})
 	if _uniffiErr != nil {
···
 	}
 }
 
-func Sign(manifest string, data []byte, certs []byte, gosigner GoSigner) ([]byte, error) {
+func Resign(segsToSign ManySegmentsToSign, signedConcatData Stream) error {
+	_, _uniffiErr := rustCallWithError[SpError](FfiConverterSpError{}, func(_uniffiStatus *C.RustCallStatus) bool {
+		C.uniffi_iroh_streamplace_fn_func_resign(FfiConverterManySegmentsToSignINSTANCE.Lower(segsToSign), FfiConverterStreamINSTANCE.Lower(signedConcatData), _uniffiStatus)
+		return false
+	})
+	return _uniffiErr.AsError()
+}
+
+func Sign(manifest string, data Stream, certsStr string, gosigner GoSigner) ([]byte, error) {
 	_uniffiRV, _uniffiErr := rustCallWithError[SpError](FfiConverterSpError{}, func(_uniffiStatus *C.RustCallStatus) RustBufferI {
 		return GoRustBuffer{
-			inner: C.uniffi_iroh_streamplace_fn_func_sign(FfiConverterStringINSTANCE.Lower(manifest), FfiConverterBytesINSTANCE.Lower(data), FfiConverterBytesINSTANCE.Lower(certs), FfiConverterGoSignerINSTANCE.Lower(gosigner), _uniffiStatus),
+			inner: C.uniffi_iroh_streamplace_fn_func_sign(FfiConverterStringINSTANCE.Lower(manifest), FfiConverterStreamINSTANCE.Lower(data), FfiConverterStringINSTANCE.Lower(certsStr), FfiConverterGoSignerINSTANCE.Lower(gosigner), _uniffiStatus),
 		}
 	})
 	if _uniffiErr != nil {
···
 	} else {
 		return FfiConverterBytesINSTANCE.Lift(_uniffiRV), nil
 	}
+}
+
+func SignWithIngredients(manifest string, data Stream, certsStr string, ingredients ManyStreams, gosigner GoSigner, output Stream) error {
+	_, _uniffiErr := rustCallWithError[SpError](FfiConverterSpError{}, func(_uniffiStatus *C.RustCallStatus) bool {
+		C.uniffi_iroh_streamplace_fn_func_sign_with_ingredients(FfiConverterStringINSTANCE.Lower(manifest), FfiConverterStreamINSTANCE.Lower(data), FfiConverterStringINSTANCE.Lower(certsStr), FfiConverterManyStreamsINSTANCE.Lower(ingredients), FfiConverterGoSignerINSTANCE.Lower(gosigner), FfiConverterStreamINSTANCE.Lower(output), _uniffiStatus)
+		return false
+	})
+	return _uniffiErr.AsError()
 }
 
 func SubscribeItemDebug(item SubscribeItem) string {

pkg/iroh/generated/iroh_streamplace/iroh_streamplace.h

···
 
 
 #endif
+#ifndef UNIFFI_FFIDEF_CALLBACK_INTERFACE_MANY_SEGMENTS_TO_SIGN_METHOD0
+#define UNIFFI_FFIDEF_CALLBACK_INTERFACE_MANY_SEGMENTS_TO_SIGN_METHOD0
+typedef void (*UniffiCallbackInterfaceManySegmentsToSignMethod0)(uint64_t uniffi_handle, RustBuffer* uniffi_out_return, RustCallStatus* callStatus );
+
+// Making function static works arround:
+// https://github.com/golang/go/issues/11263
+static void call_UniffiCallbackInterfaceManySegmentsToSignMethod0(
+				UniffiCallbackInterfaceManySegmentsToSignMethod0 cb, uint64_t uniffi_handle, RustBuffer* uniffi_out_return, RustCallStatus* callStatus )
+{
+	return cb(uniffi_handle, uniffi_out_return, callStatus );
+}
+
+
+#endif
+#ifndef UNIFFI_FFIDEF_CALLBACK_INTERFACE_MANY_STREAMS_METHOD0
+#define UNIFFI_FFIDEF_CALLBACK_INTERFACE_MANY_STREAMS_METHOD0
+typedef void (*UniffiCallbackInterfaceManyStreamsMethod0)(uint64_t uniffi_handle, RustBuffer* uniffi_out_return, RustCallStatus* callStatus );
+
+// Making function static works arround:
+// https://github.com/golang/go/issues/11263
+static void call_UniffiCallbackInterfaceManyStreamsMethod0(
+				UniffiCallbackInterfaceManyStreamsMethod0 cb, uint64_t uniffi_handle, RustBuffer* uniffi_out_return, RustCallStatus* callStatus )
+{
+	return cb(uniffi_handle, uniffi_out_return, callStatus );
+}
+
+
+#endif
+#ifndef UNIFFI_FFIDEF_CALLBACK_INTERFACE_SEGMENT_TO_SIGN_METHOD0
+#define UNIFFI_FFIDEF_CALLBACK_INTERFACE_SEGMENT_TO_SIGN_METHOD0
+typedef void (*UniffiCallbackInterfaceSegmentToSignMethod0)(uint64_t uniffi_handle, void** uniffi_out_return, RustCallStatus* callStatus );
+
+// Making function static works arround:
+// https://github.com/golang/go/issues/11263
+static void call_UniffiCallbackInterfaceSegmentToSignMethod0(
+				UniffiCallbackInterfaceSegmentToSignMethod0 cb, uint64_t uniffi_handle, void** uniffi_out_return, RustCallStatus* callStatus )
+{
+	return cb(uniffi_handle, uniffi_out_return, callStatus );
+}
+
+
+#endif
+#ifndef UNIFFI_FFIDEF_CALLBACK_INTERFACE_SEGMENT_TO_SIGN_METHOD1
+#define UNIFFI_FFIDEF_CALLBACK_INTERFACE_SEGMENT_TO_SIGN_METHOD1
+typedef void (*UniffiCallbackInterfaceSegmentToSignMethod1)(uint64_t uniffi_handle, RustBuffer* uniffi_out_return, RustCallStatus* callStatus );
+
+// Making function static works arround:
+// https://github.com/golang/go/issues/11263
+static void call_UniffiCallbackInterfaceSegmentToSignMethod1(
+				UniffiCallbackInterfaceSegmentToSignMethod1 cb, uint64_t uniffi_handle, RustBuffer* uniffi_out_return, RustCallStatus* callStatus )
+{
+	return cb(uniffi_handle, uniffi_out_return, callStatus );
+}
+
+
+#endif
+#ifndef UNIFFI_FFIDEF_CALLBACK_INTERFACE_SEGMENT_TO_SIGN_METHOD2
+#define UNIFFI_FFIDEF_CALLBACK_INTERFACE_SEGMENT_TO_SIGN_METHOD2
+typedef void (*UniffiCallbackInterfaceSegmentToSignMethod2)(uint64_t uniffi_handle, RustBuffer* uniffi_out_return, RustCallStatus* callStatus );
+
+// Making function static works arround:
+// https://github.com/golang/go/issues/11263
+static void call_UniffiCallbackInterfaceSegmentToSignMethod2(
+				UniffiCallbackInterfaceSegmentToSignMethod2 cb, uint64_t uniffi_handle, RustBuffer* uniffi_out_return, RustCallStatus* callStatus )
+{
+	return cb(uniffi_handle, uniffi_out_return, callStatus );
+}
+
+
+#endif
+#ifndef UNIFFI_FFIDEF_CALLBACK_INTERFACE_SEGMENT_TO_SIGN_METHOD3
+#define UNIFFI_FFIDEF_CALLBACK_INTERFACE_SEGMENT_TO_SIGN_METHOD3
+typedef void (*UniffiCallbackInterfaceSegmentToSignMethod3)(uint64_t uniffi_handle, void** uniffi_out_return, RustCallStatus* callStatus );
+
+// Making function static works arround:
+// https://github.com/golang/go/issues/11263
+static void call_UniffiCallbackInterfaceSegmentToSignMethod3(
+				UniffiCallbackInterfaceSegmentToSignMethod3 cb, uint64_t uniffi_handle, void** uniffi_out_return, RustCallStatus* callStatus )
+{
+	return cb(uniffi_handle, uniffi_out_return, callStatus );
+}
+
+
+#endif
+#ifndef UNIFFI_FFIDEF_CALLBACK_INTERFACE_SEGMENT_TO_SIGN_METHOD4
+#define UNIFFI_FFIDEF_CALLBACK_INTERFACE_SEGMENT_TO_SIGN_METHOD4
+typedef void (*UniffiCallbackInterfaceSegmentToSignMethod4)(uint64_t uniffi_handle, void* uniffi_out_return, RustCallStatus* callStatus );
+
+// Making function static works arround:
+// https://github.com/golang/go/issues/11263
+static void call_UniffiCallbackInterfaceSegmentToSignMethod4(
+				UniffiCallbackInterfaceSegmentToSignMethod4 cb, uint64_t uniffi_handle, void* uniffi_out_return, RustCallStatus* callStatus )
+{
+	return cb(uniffi_handle, uniffi_out_return, callStatus );
+}
+
+
+#endif
+#ifndef UNIFFI_FFIDEF_CALLBACK_INTERFACE_STREAM_METHOD0
+#define UNIFFI_FFIDEF_CALLBACK_INTERFACE_STREAM_METHOD0
+typedef void (*UniffiCallbackInterfaceStreamMethod0)(uint64_t uniffi_handle, uint64_t length, RustBuffer* uniffi_out_return, RustCallStatus* callStatus );
+
+// Making function static works arround:
+// https://github.com/golang/go/issues/11263
+static void call_UniffiCallbackInterfaceStreamMethod0(
+				UniffiCallbackInterfaceStreamMethod0 cb, uint64_t uniffi_handle, uint64_t length, RustBuffer* uniffi_out_return, RustCallStatus* callStatus )
+{
+	return cb(uniffi_handle, length, uniffi_out_return, callStatus );
+}
+
+
+#endif
+#ifndef UNIFFI_FFIDEF_CALLBACK_INTERFACE_STREAM_METHOD1
+#define UNIFFI_FFIDEF_CALLBACK_INTERFACE_STREAM_METHOD1
+typedef void (*UniffiCallbackInterfaceStreamMethod1)(uint64_t uniffi_handle, int64_t pos, uint64_t mode, uint64_t* uniffi_out_return, RustCallStatus* callStatus );
+
+// Making function static works arround:
+// https://github.com/golang/go/issues/11263
+static void call_UniffiCallbackInterfaceStreamMethod1(
+				UniffiCallbackInterfaceStreamMethod1 cb, uint64_t uniffi_handle, int64_t pos, uint64_t mode, uint64_t* uniffi_out_return, RustCallStatus* callStatus )
+{
+	return cb(uniffi_handle, pos, mode, uniffi_out_return, callStatus );
+}
+
+
+#endif
+#ifndef UNIFFI_FFIDEF_CALLBACK_INTERFACE_STREAM_METHOD2
+#define UNIFFI_FFIDEF_CALLBACK_INTERFACE_STREAM_METHOD2
+typedef void (*UniffiCallbackInterfaceStreamMethod2)(uint64_t uniffi_handle, RustBuffer data, uint64_t* uniffi_out_return, RustCallStatus* callStatus );
+
+// Making function static works arround:
+// https://github.com/golang/go/issues/11263
+static void call_UniffiCallbackInterfaceStreamMethod2(
+				UniffiCallbackInterfaceStreamMethod2 cb, uint64_t uniffi_handle, RustBuffer data, uint64_t* uniffi_out_return, RustCallStatus* callStatus )
+{
+	return cb(uniffi_handle, data, uniffi_out_return, callStatus );
+}
+
+
+#endif
 #ifndef UNIFFI_FFIDEF_V_TABLE_CALLBACK_INTERFACE_DATA_HANDLER
 #define UNIFFI_FFIDEF_V_TABLE_CALLBACK_INTERFACE_DATA_HANDLER
 typedef struct UniffiVTableCallbackInterfaceDataHandler {
···
     UniffiCallbackInterfaceGoSignerMethod0 sign;
     UniffiCallbackInterfaceFree uniffiFree;
 } UniffiVTableCallbackInterfaceGoSigner;
+
+#endif
+#ifndef UNIFFI_FFIDEF_V_TABLE_CALLBACK_INTERFACE_MANY_SEGMENTS_TO_SIGN
+#define UNIFFI_FFIDEF_V_TABLE_CALLBACK_INTERFACE_MANY_SEGMENTS_TO_SIGN
+typedef struct UniffiVTableCallbackInterfaceManySegmentsToSign {
+    UniffiCallbackInterfaceManySegmentsToSignMethod0 next;
+    UniffiCallbackInterfaceFree uniffiFree;
+} UniffiVTableCallbackInterfaceManySegmentsToSign;
+
+#endif
+#ifndef UNIFFI_FFIDEF_V_TABLE_CALLBACK_INTERFACE_MANY_STREAMS
+#define UNIFFI_FFIDEF_V_TABLE_CALLBACK_INTERFACE_MANY_STREAMS
+typedef struct UniffiVTableCallbackInterfaceManyStreams {
+    UniffiCallbackInterfaceManyStreamsMethod0 next;
+    UniffiCallbackInterfaceFree uniffiFree;
+} UniffiVTableCallbackInterfaceManyStreams;
+
+#endif
+#ifndef UNIFFI_FFIDEF_V_TABLE_CALLBACK_INTERFACE_SEGMENT_TO_SIGN
+#define UNIFFI_FFIDEF_V_TABLE_CALLBACK_INTERFACE_SEGMENT_TO_SIGN
+typedef struct UniffiVTableCallbackInterfaceSegmentToSign {
+    UniffiCallbackInterfaceSegmentToSignMethod0 unsignedSegStream;
+    UniffiCallbackInterfaceSegmentToSignMethod1 manifestId;
+    UniffiCallbackInterfaceSegmentToSignMethod2 cert;
+    UniffiCallbackInterfaceSegmentToSignMethod3 outputSegStream;
+    UniffiCallbackInterfaceSegmentToSignMethod4 close;
+    UniffiCallbackInterfaceFree uniffiFree;
+} UniffiVTableCallbackInterfaceSegmentToSign;
+
+#endif
+#ifndef UNIFFI_FFIDEF_V_TABLE_CALLBACK_INTERFACE_STREAM
+#define UNIFFI_FFIDEF_V_TABLE_CALLBACK_INTERFACE_STREAM
+typedef struct UniffiVTableCallbackInterfaceStream {
+    UniffiCallbackInterfaceStreamMethod0 readStream;
+    UniffiCallbackInterfaceStreamMethod1 seekStream;
+    UniffiCallbackInterfaceStreamMethod2 writeStream;
+    UniffiCallbackInterfaceFree uniffiFree;
+} UniffiVTableCallbackInterfaceStream;
 
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_CLONE_DATAHANDLER
···
 RustBuffer uniffi_iroh_streamplace_fn_method_gosigner_sign(void* ptr, RustBuffer data, RustCallStatus *out_status
 );
 #endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_CLONE_MANYSEGMENTSTOSIGN
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_CLONE_MANYSEGMENTSTOSIGN
+void* uniffi_iroh_streamplace_fn_clone_manysegmentstosign(void* ptr, RustCallStatus *out_status
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FREE_MANYSEGMENTSTOSIGN
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FREE_MANYSEGMENTSTOSIGN
+void uniffi_iroh_streamplace_fn_free_manysegmentstosign(void* ptr, RustCallStatus *out_status
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_INIT_CALLBACK_VTABLE_MANYSEGMENTSTOSIGN
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_INIT_CALLBACK_VTABLE_MANYSEGMENTSTOSIGN
+void uniffi_iroh_streamplace_fn_init_callback_vtable_manysegmentstosign(UniffiVTableCallbackInterfaceManySegmentsToSign* vtable
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_METHOD_MANYSEGMENTSTOSIGN_NEXT
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_METHOD_MANYSEGMENTSTOSIGN_NEXT
+RustBuffer uniffi_iroh_streamplace_fn_method_manysegmentstosign_next(void* ptr, RustCallStatus *out_status
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_CLONE_MANYSTREAMS
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_CLONE_MANYSTREAMS
+void* uniffi_iroh_streamplace_fn_clone_manystreams(void* ptr, RustCallStatus *out_status
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FREE_MANYSTREAMS
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FREE_MANYSTREAMS
+void uniffi_iroh_streamplace_fn_free_manystreams(void* ptr, RustCallStatus *out_status
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_INIT_CALLBACK_VTABLE_MANYSTREAMS
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_INIT_CALLBACK_VTABLE_MANYSTREAMS
+void uniffi_iroh_streamplace_fn_init_callback_vtable_manystreams(UniffiVTableCallbackInterfaceManyStreams* vtable
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_METHOD_MANYSTREAMS_NEXT
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_METHOD_MANYSTREAMS_NEXT
+RustBuffer uniffi_iroh_streamplace_fn_method_manystreams_next(void* ptr, RustCallStatus *out_status
+);
+#endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_CLONE_NODE
 #define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_CLONE_NODE
 void* uniffi_iroh_streamplace_fn_clone_node(void* ptr, RustCallStatus *out_status
···
 RustBuffer uniffi_iroh_streamplace_fn_method_publickey_uniffi_trait_display(void* ptr, RustCallStatus *out_status
 );
 #endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_CLONE_SEGMENTTOSIGN
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_CLONE_SEGMENTTOSIGN
+void* uniffi_iroh_streamplace_fn_clone_segmenttosign(void* ptr, RustCallStatus *out_status
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FREE_SEGMENTTOSIGN
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FREE_SEGMENTTOSIGN
+void uniffi_iroh_streamplace_fn_free_segmenttosign(void* ptr, RustCallStatus *out_status
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_INIT_CALLBACK_VTABLE_SEGMENTTOSIGN
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_INIT_CALLBACK_VTABLE_SEGMENTTOSIGN
+void uniffi_iroh_streamplace_fn_init_callback_vtable_segmenttosign(UniffiVTableCallbackInterfaceSegmentToSign* vtable
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_METHOD_SEGMENTTOSIGN_UNSIGNED_SEG_STREAM
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_METHOD_SEGMENTTOSIGN_UNSIGNED_SEG_STREAM
+void* uniffi_iroh_streamplace_fn_method_segmenttosign_unsigned_seg_stream(void* ptr, RustCallStatus *out_status
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_METHOD_SEGMENTTOSIGN_MANIFEST_ID
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_METHOD_SEGMENTTOSIGN_MANIFEST_ID
+RustBuffer uniffi_iroh_streamplace_fn_method_segmenttosign_manifest_id(void* ptr, RustCallStatus *out_status
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_METHOD_SEGMENTTOSIGN_CERT
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_METHOD_SEGMENTTOSIGN_CERT
+RustBuffer uniffi_iroh_streamplace_fn_method_segmenttosign_cert(void* ptr, RustCallStatus *out_status
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_METHOD_SEGMENTTOSIGN_OUTPUT_SEG_STREAM
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_METHOD_SEGMENTTOSIGN_OUTPUT_SEG_STREAM
+void* uniffi_iroh_streamplace_fn_method_segmenttosign_output_seg_stream(void* ptr, RustCallStatus *out_status
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_METHOD_SEGMENTTOSIGN_CLOSE
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_METHOD_SEGMENTTOSIGN_CLOSE
+void uniffi_iroh_streamplace_fn_method_segmenttosign_close(void* ptr, RustCallStatus *out_status
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_CLONE_STREAM
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_CLONE_STREAM
+void* uniffi_iroh_streamplace_fn_clone_stream(void* ptr, RustCallStatus *out_status
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FREE_STREAM
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FREE_STREAM
+void uniffi_iroh_streamplace_fn_free_stream(void* ptr, RustCallStatus *out_status
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_INIT_CALLBACK_VTABLE_STREAM
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_INIT_CALLBACK_VTABLE_STREAM
+void uniffi_iroh_streamplace_fn_init_callback_vtable_stream(UniffiVTableCallbackInterfaceStream* vtable
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_METHOD_STREAM_READ_STREAM
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_METHOD_STREAM_READ_STREAM
+RustBuffer uniffi_iroh_streamplace_fn_method_stream_read_stream(void* ptr, uint64_t length, RustCallStatus *out_status
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_METHOD_STREAM_SEEK_STREAM
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_METHOD_STREAM_SEEK_STREAM
+uint64_t uniffi_iroh_streamplace_fn_method_stream_seek_stream(void* ptr, int64_t pos, uint64_t mode, RustCallStatus *out_status
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_METHOD_STREAM_WRITE_STREAM
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_METHOD_STREAM_WRITE_STREAM
+uint64_t uniffi_iroh_streamplace_fn_method_stream_write_stream(void* ptr, RustBuffer data, RustCallStatus *out_status
+);
+#endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_CLONE_SUBSCRIBERESPONSE
 #define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_CLONE_SUBSCRIBERESPONSE
 void* uniffi_iroh_streamplace_fn_clone_subscriberesponse(void* ptr, RustCallStatus *out_status
···
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FUNC_GET_MANIFEST_AND_CERT
 #define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FUNC_GET_MANIFEST_AND_CERT
-RustBuffer uniffi_iroh_streamplace_fn_func_get_manifest_and_cert(RustBuffer data, RustCallStatus *out_status
+RustBuffer uniffi_iroh_streamplace_fn_func_get_manifest_and_cert(void* data, RustCallStatus *out_status
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FUNC_GET_MANIFESTS
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FUNC_GET_MANIFESTS
+RustBuffer uniffi_iroh_streamplace_fn_func_get_manifests(void* data, RustCallStatus *out_status
 );
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FUNC_INIT_LOGGING
···
 #ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FUNC_NODE_ID_FROM_TICKET
 #define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FUNC_NODE_ID_FROM_TICKET
 void* uniffi_iroh_streamplace_fn_func_node_id_from_ticket(RustBuffer ticket_str, RustCallStatus *out_status
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FUNC_RESIGN
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FUNC_RESIGN
+void uniffi_iroh_streamplace_fn_func_resign(void* segs_to_sign, void* signed_concat_data, RustCallStatus *out_status
 );
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FUNC_SIGN
 #define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FUNC_SIGN
-RustBuffer uniffi_iroh_streamplace_fn_func_sign(RustBuffer manifest, RustBuffer data, RustBuffer certs, void* gosigner, RustCallStatus *out_status
+RustBuffer uniffi_iroh_streamplace_fn_func_sign(RustBuffer manifest, void* data, RustBuffer certs_str, void* gosigner, RustCallStatus *out_status
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FUNC_SIGN_WITH_INGREDIENTS
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FUNC_SIGN_WITH_INGREDIENTS
+void uniffi_iroh_streamplace_fn_func_sign_with_ingredients(RustBuffer manifest, void* data, RustBuffer certs_str, void* ingredients, void* gosigner, void* output, RustCallStatus *out_status
 );
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_FN_FUNC_SUBSCRIBE_ITEM_DEBUG
···
     
 );
 #endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_FUNC_GET_MANIFESTS
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_FUNC_GET_MANIFESTS
+uint16_t uniffi_iroh_streamplace_checksum_func_get_manifests(void
+    
+);
+#endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_FUNC_INIT_LOGGING
 #define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_FUNC_INIT_LOGGING
 uint16_t uniffi_iroh_streamplace_checksum_func_init_logging(void
···
     
 );
 #endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_FUNC_RESIGN
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_FUNC_RESIGN
+uint16_t uniffi_iroh_streamplace_checksum_func_resign(void
+    
+);
+#endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_FUNC_SIGN
 #define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_FUNC_SIGN
 uint16_t uniffi_iroh_streamplace_checksum_func_sign(void
+    
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_FUNC_SIGN_WITH_INGREDIENTS
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_FUNC_SIGN_WITH_INGREDIENTS
+uint16_t uniffi_iroh_streamplace_checksum_func_sign_with_ingredients(void
     
 );
 #endif
···
     
 );
 #endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_MANYSEGMENTSTOSIGN_NEXT
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_MANYSEGMENTSTOSIGN_NEXT
+uint16_t uniffi_iroh_streamplace_checksum_method_manysegmentstosign_next(void
+    
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_MANYSTREAMS_NEXT
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_MANYSTREAMS_NEXT
+uint16_t uniffi_iroh_streamplace_checksum_method_manystreams_next(void
+    
+);
+#endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_NODE_ADD_TICKETS
 #define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_NODE_ADD_TICKETS
 uint16_t uniffi_iroh_streamplace_checksum_method_node_add_tickets(void
···
     
 );
 #endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_SEGMENTTOSIGN_UNSIGNED_SEG_STREAM
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_SEGMENTTOSIGN_UNSIGNED_SEG_STREAM
+uint16_t uniffi_iroh_streamplace_checksum_method_segmenttosign_unsigned_seg_stream(void
+    
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_SEGMENTTOSIGN_MANIFEST_ID
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_SEGMENTTOSIGN_MANIFEST_ID
+uint16_t uniffi_iroh_streamplace_checksum_method_segmenttosign_manifest_id(void
+    
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_SEGMENTTOSIGN_CERT
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_SEGMENTTOSIGN_CERT
+uint16_t uniffi_iroh_streamplace_checksum_method_segmenttosign_cert(void
+    
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_SEGMENTTOSIGN_OUTPUT_SEG_STREAM
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_SEGMENTTOSIGN_OUTPUT_SEG_STREAM
+uint16_t uniffi_iroh_streamplace_checksum_method_segmenttosign_output_seg_stream(void
+    
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_SEGMENTTOSIGN_CLOSE
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_SEGMENTTOSIGN_CLOSE
+uint16_t uniffi_iroh_streamplace_checksum_method_segmenttosign_close(void
+    
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_STREAM_READ_STREAM
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_STREAM_READ_STREAM
+uint16_t uniffi_iroh_streamplace_checksum_method_stream_read_stream(void
+    
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_STREAM_SEEK_STREAM
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_STREAM_SEEK_STREAM
+uint16_t uniffi_iroh_streamplace_checksum_method_stream_seek_stream(void
+    
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_STREAM_WRITE_STREAM
+#define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_STREAM_WRITE_STREAM
+uint16_t uniffi_iroh_streamplace_checksum_method_stream_write_stream(void
+    
+);
+#endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_SUBSCRIBERESPONSE_NEXT_RAW
 #define UNIFFI_FFIDEF_UNIFFI_IROH_STREAMPLACE_CHECKSUM_METHOD_SUBSCRIBERESPONSE_NEXT_RAW
 uint16_t uniffi_iroh_streamplace_checksum_method_subscriberesponse_next_raw(void
···
  void iroh_streamplace_cgo_dispatchCallbackInterfaceDataHandlerFree(uint64_t handle);
  void iroh_streamplace_cgo_dispatchCallbackInterfaceGoSignerMethod0(uint64_t uniffi_handle, RustBuffer data, RustBuffer* uniffi_out_return, RustCallStatus* callStatus );
  void iroh_streamplace_cgo_dispatchCallbackInterfaceGoSignerFree(uint64_t handle);
+ void iroh_streamplace_cgo_dispatchCallbackInterfaceManySegmentsToSignMethod0(uint64_t uniffi_handle, RustBuffer* uniffi_out_return, RustCallStatus* callStatus );
+ void iroh_streamplace_cgo_dispatchCallbackInterfaceManySegmentsToSignFree(uint64_t handle);
+ void iroh_streamplace_cgo_dispatchCallbackInterfaceManyStreamsMethod0(uint64_t uniffi_handle, RustBuffer* uniffi_out_return, RustCallStatus* callStatus );
+ void iroh_streamplace_cgo_dispatchCallbackInterfaceManyStreamsFree(uint64_t handle);
+ void iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignMethod0(uint64_t uniffi_handle, void** uniffi_out_return, RustCallStatus* callStatus );
+ void iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignMethod1(uint64_t uniffi_handle, RustBuffer* uniffi_out_return, RustCallStatus* callStatus );
+ void iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignMethod2(uint64_t uniffi_handle, RustBuffer* uniffi_out_return, RustCallStatus* callStatus );
+ void iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignMethod3(uint64_t uniffi_handle, void** uniffi_out_return, RustCallStatus* callStatus );
+ void iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignMethod4(uint64_t uniffi_handle, void* uniffi_out_return, RustCallStatus* callStatus );
+ void iroh_streamplace_cgo_dispatchCallbackInterfaceSegmentToSignFree(uint64_t handle);
+ void iroh_streamplace_cgo_dispatchCallbackInterfaceStreamMethod0(uint64_t uniffi_handle, uint64_t length, RustBuffer* uniffi_out_return, RustCallStatus* callStatus );
+ void iroh_streamplace_cgo_dispatchCallbackInterfaceStreamMethod1(uint64_t uniffi_handle, int64_t pos, uint64_t mode, uint64_t* uniffi_out_return, RustCallStatus* callStatus );
+ void iroh_streamplace_cgo_dispatchCallbackInterfaceStreamMethod2(uint64_t uniffi_handle, RustBuffer data, uint64_t* uniffi_out_return, RustCallStatus* callStatus );
+ void iroh_streamplace_cgo_dispatchCallbackInterfaceStreamFree(uint64_t handle);
 
 void iroh_streamplace_uniffiFutureContinuationCallback(uint64_t, int8_t);
 void iroh_streamplace_uniffiFreeGorutine(uint64_t);

pkg/log/log.go

···
 }
 
 func Debug(ctx context.Context, message string, args ...any) {
-	V(debugLogLevel).log(ctx, message, slog.Debug, args...)
+	V(debugLogLevel).log(ctx, message, slog.Info, args...)
 }
 
 func Trace(ctx context.Context, message string, args ...any) {
-	V(traceLogLevel).log(ctx, message, slog.Debug, args...)
+	V(traceLogLevel).log(ctx, message, slog.Info, args...)
 }
 
 // returns true if we are at least the given level

pkg/media/audio_smear.go

···
 	"context"
 	"fmt"
 	"io"
-	"os"
 	"strings"
 	"time"
 
 	"github.com/go-gst/go-gst/gst"
 	"github.com/go-gst/go-gst/gst/app"
 	"github.com/google/uuid"
+	"stream.place/streamplace/pkg/config"
 	"stream.place/streamplace/pkg/log"
 )
 
···
 	VideoCaps string
 }
 
-func SmearAudioTimestamps(ctx context.Context, input io.Reader, output io.Writer) error {
+func RewriteAudioTimestamps(ctx context.Context, cli *config.CLI, input io.Reader, output io.Writer, doSmear bool) error {
 	bs, err := io.ReadAll(input)
 	if err != nil {
 		return err
 	}
 	seg, err := ToBuffers(ctx, bytes.NewReader(bs))
 	if err != nil {
-		// Write the input bytes to a file for debugging
-		debugFile := fmt.Sprintf("audio_smear_debug_%s.mp4", uuid.New().String())
-		err = os.WriteFile(debugFile, bs, 0644)
-		if err != nil {
-			log.Log(ctx, "failed to write debug file", "error", err, "path", debugFile)
-		} else {
-			log.Log(ctx, "wrote debug file", "path", debugFile)
-		}
+		cli.DumpDebugSegment(ctx, "audio_smear_input", bytes.NewReader(bs))
 		return err
 	}
 
-	err = seg.Normalize(ctx)
-	if err != nil {
-		return err
+	if doSmear {
+		err = seg.Normalize(ctx)
+		if err != nil {
+			return err
+		}
 	}
 
 	return JoinAudioVideo(ctx, seg, output)
···
 }
 
 func ToBuffers(ctx context.Context, input io.Reader) (*SegmentData, error) {
+
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
 	ctx = log.WithLogValues(ctx, "func", "SplitAudioVideo")
 
 	pipelineSlice := []string{
 		"appsrc name=mp4src ! qtdemux name=demux",
-		"demux.video_0 ! queue ! h264parse name=videoparse disable-passthrough=true config-interval=-1 ! appsink sync=false name=videoappsink",
+		"demux.video_0 ! queue ! appsink sync=false name=videoappsink",
 		"demux.audio_0 ! queue ! opusparse name=audioparse ! appsink sync=false name=audioappsink",
 	}
 
-	ctx, cancel := context.WithCancel(ctx)
-	defer cancel()
-
 	pipeline, err := gst.NewPipelineFromString(strings.Join(pipelineSlice, "\n"))
 	if err != nil {
 		return nil, fmt.Errorf("failed to create GStreamer pipeline: %w", err)
 	}
-
-	errCh := make(chan error)
-	go func() {
-		err := HandleBusMessages(ctx, pipeline)
-		cancel()
-		errCh <- err
-		close(errCh)
-	}()
-
-	defer func() {
-		err := <-errCh
-		if err != nil {
-			log.Error(ctx, "bus handler error", "error", err)
-		}
-		err = pipeline.BlockSetState(gst.StateNull)
-		if err != nil {
-			log.Error(ctx, "failed to set pipeline to null state", "error", err)
-		}
-	}()
 
 	mp4src, err := pipeline.GetElementByName("mp4src")
 	if err != nil {
···
 			return gst.FlowOK
 		},
 	})
+	errCh := make(chan error)
+	go func() {
+		err := HandleBusMessages(ctx, pipeline)
+		errCh <- err
+	}()
+
+	defer func() {
+		if err != nil {
+			log.Error(ctx, "bus handler error", "error", err)
+		}
+		err = pipeline.SetState(gst.StateNull)
+		if err != nil {
+			log.Error(ctx, "failed to set pipeline to null state", "error", err)
+		}
+	}()
 
 	if err := pipeline.SetState(gst.StatePlaying); err != nil {
 		return nil, fmt.Errorf("failed to set pipeline state: %w", err)
 	}
 
-	<-ctx.Done()
+	pipelineErr := <-errCh
 
-	return &seg, <-errCh
+	if pipelineErr != nil {
+		return nil, fmt.Errorf("pipeline error: %w", pipelineErr)
+	}
+
+	if len(seg.Video) == 0 {
+		return nil, fmt.Errorf("no video segments when rewriting audio")
+	}
+	if len(seg.Audio) == 0 {
+		return nil, fmt.Errorf("no audio segments when rewriting audio")
+	}
+
+	return &seg, nil
 }
 
 func JoinAudioVideo(ctx context.Context, seg *SegmentData, output io.Writer) error {
···
 	errCh := make(chan error)
 	go func() {
 		err := HandleBusMessages(ctx, pipeline)
-		cancel()
 		errCh <- err
-		close(errCh)
-	}()
-
-	defer func() {
-		err := <-errCh
-		if err != nil {
-			log.Error(ctx, "bus handler error", "error", err)
-		}
-		err = pipeline.BlockSetState(gst.StateNull)
-		if err != nil {
-			log.Error(ctx, "failed to set pipeline to null state", "error", err)
-		}
 	}()
 
 	videoSrcElem, err := pipeline.GetElementByName("videosrc")
···
 		NewSampleFunc: WriterNewSample(ctx, output),
 	})
 
+	defer func() {
+		err = pipeline.SetState(gst.StateNull)
+		if err != nil {
+			log.Error(ctx, "failed to set pipeline to null state", "error", err)
+		}
+	}()
+
 	if err := pipeline.SetState(gst.StatePlaying); err != nil {
 		return fmt.Errorf("failed to set pipeline state: %w", err)
 	}
-
-	<-ctx.Done()
 
 	return <-errCh
 }

pkg/media/audio_smear_test.go

···
 		return err
 	}
 
-	require.Equal(t, 1191255, buf.Len())
+	require.Equal(t, 1191212, buf.Len())
 
 	// // Write audio and video buffers to temporary files for further analysis
 	// tempDir := t.TempDir()

pkg/media/clip.go pkg/media/segment_combine.go

···
 package media
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"io"
-	"os"
 	"strings"
 
 	"github.com/go-gst/go-gst/gst"
 	"github.com/go-gst/go-gst/gst/app"
-	"github.com/google/uuid"
+	"stream.place/streamplace/pkg/aqio"
 	"stream.place/streamplace/pkg/bus"
 	"stream.place/streamplace/pkg/log"
 )
 
-func readFile(ctx context.Context, source string) (*bus.Seg, error) {
-	fd, err := os.Open(source)
+// CombineSegments combines a list of segments into a single segment that maintains all of the manifests
+func CombineSegments(ctx context.Context, inputFds []io.ReadSeeker, ms MediaSigner, output io.ReadWriteSeeker) error {
+	rws := aqio.NewReadWriteSeeker([]byte{})
+	err := CombineSegmentsUnsigned(ctx, inputFds, rws, true)
 	if err != nil {
-		return nil, fmt.Errorf("failed to open source file: %w", err)
+		return err
+	}
+	// rewind all the inputs for the signer
+	for _, fd := range inputFds {
+		_, err := fd.Seek(0, io.SeekStart)
+		if err != nil {
+			return err
+		}
 	}
-	defer fd.Close()
-	bs, err := io.ReadAll(fd)
+	bs, err := rws.Bytes()
 	if err != nil {
-		return nil, fmt.Errorf("failed to read source file: %w", err)
+		return err
 	}
-	seg := &bus.Seg{
-		Filepath: source,
-		Data:     bs,
+	err = ms.SignConcatMP4(context.Background(), bytes.NewReader(bs), inputFds, output)
+	if err != nil {
+		return err
 	}
-	return seg, nil
+	return nil
 }
 
-// This function remains in scope for the duration of a single users' playback
-func Clip(ctx context.Context, sources []string, w io.Writer) error {
-	uu, err := uuid.NewV7()
-	if err != nil {
-		return err
-	}
-	ctx = log.WithLogValues(ctx, "webrtcID", uu.String())
-	ctx = log.WithLogValues(ctx, "mediafunc", "Clip")
+func CombineSegmentsUnsigned(ctx context.Context, sources []io.ReadSeeker, w io.Writer, doH264Parse bool) error {
+	ctx = log.WithLogValues(ctx, "mediafunc", "CombineSegmentsUnsigned")
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 
 	pipelineSlice := []string{
-		"mp4mux faststart=true name=muxer ! appsink sync=false name=mp4sink",
-		"h264parse name=videoparse ! h264timestamper ! muxer.video_0",
-		"opusparse name=audioparse ! muxer.audio_0",
+		fmt.Sprintf("mp4mux name=muxer faststart=true interleave-bytes=%d interleave-time=%d movie-timescale=60000 trak-timescale=60000 ! appsink sync=false name=mp4sink", InterleaveBytes, InterleaveTime),
+		"capsfilter caps=video/x-h264,parsed=true name=videoqueue ! queue ! muxer.",
+		"capsfilter caps=audio/x-opus,framed=true name=audioparse ! queue ! muxer.",
 	}
 
 	pipeline, err := gst.NewPipelineFromString(strings.Join(pipelineSlice, "\n"))
···
 	segCh := make(chan *bus.Seg)
 	go func() {
 		for _, source := range sources {
-			log.Log(ctx, "reading file", "source", source)
-			seg, err := readFile(ctx, source)
+			bs, err := io.ReadAll(source)
 			if err != nil {
 				err = fmt.Errorf("failed to read file: %w", err)
 				pipeline.Error(err.Error(), err)
 				return
 			}
-
-			segCh <- seg
+			segCh <- &bus.Seg{
+				Filepath: "ignored",
+				Data:     bs,
+			}
 		}
 		close(segCh)
 	}()
 
-	concatBin, err := ConcatBin(ctx, segCh)
+	concatBin, err := ConcatBin(ctx, segCh, doH264Parse)
 	if err != nil {
 		return fmt.Errorf("failed to create concat bin: %w", err)
 	}
···
 	}
 
 	// Get the videoparse and audioparse elements from the pipeline
-	videoParse, err := pipeline.GetElementByName("videoparse")
+	videoQueue, err := pipeline.GetElementByName("videoqueue")
 	if err != nil {
 		return fmt.Errorf("failed to get video parse element: %w", err)
 	}
···
 	}
 
 	// Link the concat bin pads to the parse element sink pads
-	linked := videoPad.Link(videoParse.GetStaticPad("sink"))
+	linked := videoPad.Link(videoQueue.GetStaticPad("sink"))
 	if linked != gst.PadLinkOK {
 		return fmt.Errorf("failed to link video pad to video parse element: %v", linked)
 	}
···
 		return fmt.Errorf("failed to get mp4sink element: %w", err)
 	}
 
-	eos := make(chan struct{})
-
 	appSink := app.SinkFromElement(mp4Sink)
 	appSink.SetCallbacks(&app.SinkCallbacks{
 		NewSampleFunc: WriterNewSample(ctx, w),
-		EOSFunc: func(sink *app.Sink) {
-			close(eos)
-		},
 	})
 
 	// Start the pipeline
···
 
 	// Handle bus messages
 	err = HandleBusMessages(ctx, pipeline)
-
-	<-eos
+	if err != nil {
+		return fmt.Errorf("failed to handle bus messages: %w", err)
+	}
 
 	if err != nil {
 		return fmt.Errorf("pipeline error: %w", err)

pkg/media/clip_test.go

···
-package media
-
-import (
-	"bytes"
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"golang.org/x/sync/errgroup"
-)
-
-func TestClip(t *testing.T) {
-	withNoGSTLeaks(t, func() {
-		g, _ := errgroup.WithContext(context.Background())
-		for range streamplaceTestCount {
-			g.Go(func() error {
-				return innerTestClip(t)
-			})
-		}
-		err := g.Wait()
-		require.NoError(t, err)
-	})
-}
-
-func innerTestClip(t *testing.T) error {
-	fName := getFixture("sample-segment.mp4")
-	inputFiles := []string{fName, fName, fName}
-	buf := bytes.NewBuffer(nil)
-	err := Clip(context.Background(), inputFiles, buf)
-	require.NoError(t, err)
-	require.Greater(t, buf.Len(), 2900000)
-	require.Less(t, buf.Len(), 3100000)
-	return nil
-}

pkg/media/clip_user.go

···
 	"context"
 	"fmt"
 	"io"
+	"os"
 	"sort"
 	"time"
 
···
 	sort.Slice(segments, func(i, j int) bool {
 		return segments[i].StartTime.Before(segments[j].StartTime)
 	})
-	segmentFiles := []string{}
+	segmentFiles := []io.ReadSeeker{}
 	for _, segment := range segments {
 		aqt := aqtime.FromTime(segment.StartTime)
 		fpath, err := cli.SegmentFilePath(user, fmt.Sprintf("%s.%s", aqt.FileSafeString(), "mp4"))
 		if err != nil {
 			return fmt.Errorf("unable to get segment file path: %w", err)
 		}
-		segmentFiles = append(segmentFiles, fpath)
+		fd, err := os.Open(fpath)
+		if err != nil {
+			return fmt.Errorf("unable to open segment file: %w", err)
+		}
+		defer fd.Close()
+		segmentFiles = append(segmentFiles, fd)
 	}
-	err = Clip(ctx, segmentFiles, writer)
+	err = CombineSegmentsUnsigned(ctx, segmentFiles, writer, false)
 	if err != nil {
 		return fmt.Errorf("unable to clip segments: %w", err)
 	}

pkg/media/concat2.go

···
 
 var ErrConcatDone = errors.New("concat done")
 
-func ConcatBin(ctx context.Context, segCh <-chan *bus.Seg) (*gst.Bin, error) {
+func ConcatBin(ctx context.Context, segCh <-chan *bus.Seg, doH264Parse bool) (*gst.Bin, error) {
 	ctx = log.WithLogValues(ctx, "func", "ConcatBin")
 	bin := gst.NewBin("concat-bin")
 
···
 		return nil, fmt.Errorf("failed to add multiqueue to bin: %w", err)
 	}
 
+	// 10x default multiqueue size
+	err = mq.SetProperty("max-size-time", uint64(200000000000))
+	if err != nil {
+		return nil, fmt.Errorf("failed to set max-size-time: %w", err)
+	}
+	err = mq.SetProperty("max-size-bytes", uint(1048576000))
+	if err != nil {
+		return nil, fmt.Errorf("failed to set max-size-bytes: %w", err)
+	}
+	err = mq.SetProperty("max-size-buffers", uint(500))
+	if err != nil {
+		return nil, fmt.Errorf("failed to set max-size-buffers: %w", err)
+	}
+
 	mqVideoSink := mq.GetRequestPad("sink_%u")
 	if mqVideoSink == nil {
 		return nil, fmt.Errorf("video sink pad not found")
···
 			select {
 			case seg := <-segCh:
 				if seg == nil {
+
 					ok := syncPadVideoSrc.PushEvent(gst.NewEOSEvent())
 					if !ok {
 						log.Error(ctx, "failed to post EOS message", "error", ok)
···
 						log.Error(ctx, "failed to post EOS message", "error", ok)
 					}
 					log.Debug(ctx, "concat completed")
+
 					return
 				}
-				err := addConcatDemuxer(ctx, bin, seg, syncPadVideoSink, syncPadAudioSink)
+				err := addConcatDemuxer(ctx, bin, seg, syncPadVideoSink, syncPadAudioSink, doH264Parse)
 				if err != nil {
 					log.Error(ctx, "failed to add concat demuxer", "error", err)
 					bin.Error(err.Error(), err)
···
 	return bin, nil
 }
 
-func addConcatDemuxer(ctx context.Context, bin *gst.Bin, seg *bus.Seg, syncPadVideoSink *gst.Pad, syncPadAudioSink *gst.Pad) error {
+func addConcatDemuxer(ctx context.Context, bin *gst.Bin, seg *bus.Seg, syncPadVideoSink *gst.Pad, syncPadAudioSink *gst.Pad, doH264Parse bool) error {
 	var cancel context.CancelFunc
 	ctx, cancel = context.WithCancel(ctx)
 	defer cancel()
+	ctx = log.WithLogValues(ctx, "func", "ConcatBin")
 
 	log.Debug(ctx, "adding concat demuxer", "seg", seg.Filepath)
-	demuxBin, err := ConcatDemuxBin(ctx, seg)
+	demuxBin, err := ConcatDemuxBin(ctx, seg, doH264Parse)
 	if err != nil {
 		return fmt.Errorf("failed to create demux bin: %w", err)
 	}

pkg/media/concat2_test.go

···
 		close(segCh)
 	}()
 
-	concatBin, err := ConcatBin(ctx, segCh)
+	concatBin, err := ConcatBin(ctx, segCh, true)
 	if err != nil {
 		return fmt.Errorf("failed to create concat bin: %w", err)
 	}
···
 	<-padIdleCh
 	<-padIdleCh
 
-	require.Equal(t, 4936240, videoBuf.Len(), fmt.Sprintf("uuid: %s", uuidStr))
+	require.Equal(t, 4936455, videoBuf.Len(), fmt.Sprintf("uuid: %s", uuidStr))
 	require.Equal(t, 32200, audioBuf.Len(), fmt.Sprintf("uuid: %s", uuidStr))
 
 	return <-errCh

pkg/media/concat_demux.go

···
 // Function for demuxing a single segment. Needs to be handled very carefully.
 // In particular: users of this MUST cancel the passed context when they're
 // done with the bin.
-func ConcatDemuxBin(ctx context.Context, seg *bus.Seg) (*gst.Bin, error) {
-	ctx = log.WithLogValues(ctx, "func", "SegDemuxBin")
+func ConcatDemuxBin(ctx context.Context, seg *bus.Seg, doH264Parse bool) (*gst.Bin, error) {
+	ctx = log.WithLogValues(ctx, "func", "ConcatDemuxBin")
 	bin := gst.NewBin("seg-demux-bin")
 
 	appSrc, err := gst.NewElementWithProperties("appsrc", map[string]interface{}{
···
 
 	mq, err := gst.NewElementWithProperties("multiqueue", map[string]interface{}{
 		"name": "concat-demux-multiqueue",
+		// "max-size-time":    uint(0), // default: 2000000000, 2 seconds
+		// "max-size-bytes":   uint(0), // default: 10485760, 10MiB
+		// "max-size-buffers": uint(0), // default: 5, 5 buffers
 	})
 	if err != nil {
 		return nil, fmt.Errorf("failed to create multiqueue element: %w", err)
···
 	if err != nil {
 		return nil, fmt.Errorf("failed to add multiqueue to bin: %w", err)
 	}
+	// err = mq.SetProperty("max-size-time", uint64(200000000000))
+	// if err != nil {
+	// 	return nil, fmt.Errorf("failed to set max-size-time: %w", err)
+	// }
+	// err = mq.SetProperty("max-size-bytes", uint(1048576000))
+	// if err != nil {
+	// 	return nil, fmt.Errorf("failed to set max-size-bytes: %w", err)
+	// }
+	// err = mq.SetProperty("max-size-buffers", uint(500))
+	// if err != nil {
+	// 	return nil, fmt.Errorf("failed to set max-size-buffers: %w", err)
+	// }
+
+	opusparse, err := gst.NewElementWithProperties("opusparse", map[string]interface{}{
+		"name":                "concat-demux-opusparse",
+		"disable-passthrough": true,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to create opusparse element: %w", err)
+	}
+	err = bin.Add(opusparse)
+	if err != nil {
+		return nil, fmt.Errorf("failed to add opusparse to bin: %w", err)
+	}
+	opusparseSinkPad := opusparse.GetStaticPad("sink")
+	if opusparseSinkPad == nil {
+		return nil, fmt.Errorf("failed to get opusparse sink pad")
+	}
+	opusparseSrcPad := opusparse.GetStaticPad("src")
+	if opusparseSrcPad == nil {
+		return nil, fmt.Errorf("failed to get opusparse source pad")
+	}
 
 	mqVideoSink := mq.GetRequestPad("sink_%u")
 	if mqVideoSink == nil {
···
 		return nil, fmt.Errorf("audio source pad not found")
 	}
 
-	videoGhost := gst.NewGhostPad("video_0", mqVideoSrc)
-	if videoGhost == nil {
-		return nil, fmt.Errorf("failed to create video ghost pad")
+	linked := mqAudioSrc.Link(opusparseSinkPad)
+	if linked != gst.PadLinkOK {
+		return nil, fmt.Errorf("failed to link opusparse sink pad to mq audio sink pad")
+	}
+
+	var videoGhost *gst.GhostPad
+	if doH264Parse {
+		h264parse, err := gst.NewElementWithProperties("h264parse", map[string]interface{}{
+			"name":                "concat-demux-h264parse",
+			"config-interval":     -1,
+			"disable-passthrough": true,
+		})
+		if err != nil {
+			return nil, fmt.Errorf("failed to create h264parse element: %w", err)
+		}
+		err = bin.Add(h264parse)
+		if err != nil {
+			return nil, fmt.Errorf("failed to add h264parse to bin: %w", err)
+		}
+		h264parseSinkPad := h264parse.GetStaticPad("sink")
+		if h264parseSinkPad == nil {
+			return nil, fmt.Errorf("failed to get h264parse sink pad")
+		}
+		h264parseSrcPad := h264parse.GetStaticPad("src")
+		if h264parseSrcPad == nil {
+			return nil, fmt.Errorf("failed to get h264parse source pad")
+		}
+		linked := mqVideoSrc.Link(h264parseSinkPad)
+		if linked != gst.PadLinkOK {
+			return nil, fmt.Errorf("failed to link h264parse sink pad to mq video sink pad")
+		}
+
+		videoGhost = gst.NewGhostPad("video_0", h264parseSrcPad)
+		if videoGhost == nil {
+			return nil, fmt.Errorf("failed to create video ghost pad")
+		}
+	} else {
+		videoGhost = gst.NewGhostPad("video_0", mqVideoSrc)
+		if videoGhost == nil {
+			return nil, fmt.Errorf("failed to create video ghost pad")
+		}
 	}
 
-	audioGhost := gst.NewGhostPad("audio_0", mqAudioSrc)
+	audioGhost := gst.NewGhostPad("audio_0", opusparseSrcPad)
 	if audioGhost == nil {
 		return nil, fmt.Errorf("failed to create audio ghost pad")
 	}

pkg/media/concat_demux_test.go

···
 	})
 }
 
-// This function remains in scope for the duration of a single users' playback
 func innerTestConcatDemuxBin(t *testing.T) error {
 	ctx := log.WithDebugValue(context.Background(), map[string]map[string]int{"func": {"ConcatStream": 9, "TestConcat2": 9, "SegDemuxBin": 9}})
 	ctx = log.WithLogValues(ctx, "func", "TestConcat2")
···
 		Filepath: filename,
 	}
 
-	concatBin, err := ConcatDemuxBin(ctx, testSeg)
+	concatBin, err := ConcatDemuxBin(ctx, testSeg, true)
 	if err != nil {
 		return fmt.Errorf("failed to create concat bin: %w", err)
 	}
···
 		if err != nil {
 			t.Errorf("failed to set pipeline to null state: %v", err)
 		}
-		require.Equal(t, 987248, videoBuf.Len())
+		require.Equal(t, 987291, videoBuf.Len())
 		require.Equal(t, 6440, audioBuf.Len())
 	}()
 

pkg/media/constants.go

···
+package media
+
+var InterleaveBytes = uint64(0)
+var InterleaveTime = uint64(0)

pkg/media/media.go

···
 	Livestream            *streamplace.Livestream
 }
 
+var ErrMissingMetadata = errors.New("missing segment metadata")
 var ErrInvalidMetadata = errors.New("invalid segment metadata")
 
 func ParseSegmentAssertions(ctx context.Context, mani *c2patypes.Manifest) (*SegmentMetadata, error) {
···
 		}
 	}
 	if ass == nil {
-		return nil, fmt.Errorf("couldn't find %s assertions", StreamplaceMetadata)
+		return nil, ErrMissingMetadata
 	}
 	proc := ld.NewJsonLdProcessor()
 	options := ld.NewJsonLdOptions("")

pkg/media/media_data_parser.go

···
 	"stream.place/streamplace/pkg/model"
 )
 
+func padProbeEmpty(_ *gst.Pad, _ *gst.PadProbeInfo) gst.PadProbeReturn {
+	return gst.PadProbeOK
+}
+
 func ParseSegmentMediaData(ctx context.Context, mp4bs []byte) (*model.SegmentMediaData, error) {
 	ctx, span := otel.Tracer("signer").Start(ctx, "ParseSegmentMediaData")
 	defer span.End()
···
 	defer cancel()
 	pipelineSlice := []string{
 		"appsrc name=appsrc ! qtdemux name=demux",
-		"demux.video_0 ! queue ! h264parse name=videoparse disable-passthrough=true config-interval=-1 ! h2642json ! appsink sync=false name=jsonappsink",
-		"demux.audio_0 ! queue ! opusparse name=audioparse ! fakesink sync=false",
+		"demux.video_0 ! queue ! tee name=videotee",
+		"videotee. ! queue ! h2642json ! appsink sync=false name=jsonappsink",
+		"videotee. ! queue ! appsink sync=false name=videoappsink",
+		"demux.audio_0 ! queue ! opusparse name=audioparse ! appsink sync=false name=audioappsink",
 	}
 
 	pipeline, err := gst.NewPipelineFromString(strings.Join(pipelineSlice, "\n"))
···
 
 	src := app.SrcFromElement(appsrc)
 	src.SetCallbacks(&app.SourceCallbacks{
-		NeedDataFunc: ReaderNeedData(ctx, bytes.NewReader(mp4bs)),
+		NeedDataFunc: ReaderNeedDataIncremental(ctx, bytes.NewReader(mp4bs)),
+	})
+
+	foundSomeAudio := false
+	audioSinkElem, err := pipeline.GetElementByName("audioappsink")
+	if err != nil {
+		return nil, fmt.Errorf("error creating SegmentMetadata pipeline: %w", err)
+	}
+	audioSink := app.SinkFromElement(audioSinkElem)
+	if audioSink == nil {
+		return nil, fmt.Errorf("error creating SegmentMetadata pipeline: %w", err)
+	}
+	audioSink.SetCallbacks(&app.SinkCallbacks{
+		NewSampleFunc: ParseSegmentMediaDataSinkNewSampleFunc(ctx, &foundSomeAudio),
+	})
+
+	foundSomeVideo := false
+	videoSinkElem, err := pipeline.GetElementByName("videoappsink")
+	if err != nil {
+		return nil, fmt.Errorf("error creating SegmentMetadata pipeline: %w", err)
+	}
+	videoSink := app.SinkFromElement(videoSinkElem)
+	if videoSink == nil {
+		return nil, fmt.Errorf("error creating SegmentMetadata pipeline: %w", err)
+	}
+	videoSink.SetCallbacks(&app.SinkCallbacks{
+		NewSampleFunc: ParseSegmentMediaDataSinkNewSampleFunc(ctx, &foundSomeVideo),
 	})
+	padsAdded := 0
+
+	var padProbe func(pad *gst.Pad, info *gst.PadProbeInfo) gst.PadProbeReturn
+	padProbe = func(pad *gst.Pad, info *gst.PadProbeInfo) gst.PadProbeReturn {
+		if info.GetEvent().Type() != gst.EventTypeEOS {
+			return gst.PadProbeOK
+		}
+		if padsAdded != 2 {
+			err := fmt.Errorf("expected 2 tracks in input, got %d", padsAdded)
+			pipeline.Error(err.Error(), err)
+		}
+		padProbe = padProbeEmpty
+		return gst.PadProbeRemove
+	}
+
+	outerPadProbe := func(pad *gst.Pad, info *gst.PadProbeInfo) gst.PadProbeReturn {
+		return padProbe(pad, info)
+	}
 
 	onPadAdded := func(element *gst.Element, pad *gst.Pad) {
+		padsAdded += 1
 		caps := pad.GetCurrentCaps()
 		if caps == nil {
 			log.Warn(ctx, "Unable to get pad caps")
 			cancel()
 			return
 		}
+
+		pad.AddProbe(gst.PadProbeTypeEventBoth, outerPadProbe)
 
 		structure := caps.GetStructureAt(0)
 		if structure == nil {
···
 		return nil, fmt.Errorf("error decoding JSON object: %w", err)
 	}
 
-	if videoMetadata == nil {
-		return nil, fmt.Errorf("no video metadata")
+	if videoMetadata == nil || !foundSomeVideo {
+		return nil, fmt.Errorf("no video in segment")
 	}
-	if audioMetadata == nil {
-		return nil, fmt.Errorf("no audio metadata")
+	if audioMetadata == nil || !foundSomeAudio {
+		return nil, fmt.Errorf("no audio in segment")
 	}
 
 	videoMetadata.BFrames = hasBFrames
···
 
 	return meta, nil
 }
+
+func ParseSegmentMediaDataSinkNewSampleFunc(ctx context.Context, foundThisTrack *bool) func(sink *app.Sink) gst.FlowReturn {
+	return func(sink *app.Sink) gst.FlowReturn {
+		sample := sink.PullSample()
+		if sample == nil {
+			return gst.FlowOK
+		}
+		buf := sample.GetBuffer()
+		if buf == nil {
+			return gst.FlowError
+		}
+		dur := buf.Duration().AsDuration()
+		if dur != nil && *dur > 0 {
+			*foundThisTrack = true
+		} else {
+			log.Warn(ctx, "no duration found for track", "track", sink.GetName())
+		}
+		return gst.FlowOK
+	}
+}

pkg/media/media_data_parser_test.go

···
 	segmentsWithoutBFrames := []string{
 		remote.RemoteFixture("d63d26050db9a60c0944b4c2e2b1d052c4350a2a8a877324c7b0b7e7a0c1ae27/bframe-false-positive.mp4"),
 		getFixture("sample-segment.mp4"),
+		remote.RemoteFixture("604bebf51c97f27aa07a8952462ac9885dd963f7a88375154217f59db32e1573/2025-11-18T01-10-56-292Z-signed-segment.mp4"),
 	}
 	withNoGSTLeaks(t, func() {
 		for _, segment := range segmentsWithoutBFrames {
···
 		require.Greater(t, mediaData.Duration, int64(0), "Video duration should not be empty")
 	})
 }
+
+func TestMediaDataParserVideoHeaderWithNoVideo(t *testing.T) {
+	withNoGSTLeaks(t, func() {
+		inputFile, err := os.Open(remote.RemoteFixture("0aa38ed08bb6b6b0ae5f4891a97244717e2c952d5ca878e34450729770f7ca53/2025-11-16T23-05-04-512Z-converge-segment-did-key-zQ3shkzEYN8UrJoRAGS6pgPodXjdg8kF2fXQNGfJhpg3x4KJT.mp4"))
+		require.NoError(t, err)
+		defer inputFile.Close()
+		bs, err := io.ReadAll(inputFile)
+		require.NoError(t, err)
+
+		ctx := log.WithDebugValue(context.Background(), map[string]map[string]int{"GStreamerFunc": {"ParseSegmentMediaData": 9}})
+		mediaData, err := ParseSegmentMediaData(ctx, bs)
+		require.ErrorContains(t, err, "no video in segment")
+		require.Nil(t, mediaData)
+	})
+}

pkg/media/media_signer.go

···
 	"crypto/ecdsa"
 	"crypto/rand"
 	"crypto/sha256"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io"
 	"time"
 
 	"go.opentelemetry.io/otel"
+	"stream.place/streamplace/pkg/aqio"
 	"stream.place/streamplace/pkg/aqtime"
 	"stream.place/streamplace/pkg/atproto"
 	c2patypes "stream.place/streamplace/pkg/c2patypes"
···
 	Pub() aqpub.Pub
 	Streamer() string
 	DID() string
+	SignConcatMP4(ctx context.Context, input io.ReadSeeker, ingredients []io.ReadSeeker, output io.ReadWriteSeeker) error
 }
 
+var DoReplay = false
+
 type MediaSignerLocal struct {
 	StreamerName     string
 	Signer           crypto.Signer
···
 	did              string
 	manifestBuilder  *ManifestBuilder
 	PrebuiltManifest []byte // Optional: use this manifest instead of building one
+	sigs             [][]byte
 }
 
 func prepareCert(ctx context.Context, cli *config.CLI, signer crypto.Signer) ([]byte, error) {
···
 	rustCallbackSigner := &RustCallbackSigner{
 		Signer: ms.Signer,
 	}
-	bs, err = iroh_streamplace.Sign(string(manifestBs), bs, ms.Cert, rustCallbackSigner)
+	bs, err = iroh_streamplace.Sign(string(manifestBs), c2patypes.NewReader(aqio.NewReadWriteSeeker(bs)), base64.StdEncoding.EncodeToString(ms.Cert), rustCallbackSigner)
 	if err != nil {
 		return nil, err
 	}
···
 	spmetrics.SigningDuration.WithLabelValues(ms.StreamerName).Observe(float64(time.Since(startTime).Milliseconds()))
 	return bs, nil
 }
+
+func (ms *MediaSignerLocal) SignConcatMP4(ctx context.Context, input io.ReadSeeker, ingredients []io.ReadSeeker, output io.ReadWriteSeeker) error {
+	startTime := time.Now()
+	ctx, span := otel.Tracer("signer").Start(ctx, "SignMP4")
+	defer span.End()
+	// for _, ingredient := range ingredients {
+	// 	_, err := iroh_streamplace.GetManifestAndCert(c2patypes.NewReader(aqio.NewReadWriteSeeker(ingredient)))
+	// 	if err != nil {
+	// 		return nil, err
+	// 	}
+	// }
+	// title := "livestream"
+	mani := obj{
+		"title": "Livestream Clip",
+		// "assertions": []obj{
+		// 	{
+		// 		"label": "c2pa.actions",
+		// 		"data": obj{
+		// 			"actions": []obj{
+		// 				{"action": "c2pa.created"},
+		// 				{"action": "c2pa.published"},
+		// 			},
+		// 		},
+		// 	},
+		// 	{
+		// 		"label": StreamplaceMetadata,
+		// 		"data": obj{
+		// 			"@context": obj{
+		// 				"dc": "http://purl.org/dc/elements/1.1/",
+		// 			},
+		// 			"dc:creator": ms.StreamerName,
+		// 			"dc:title":   []string{title},
+		// 			"dc:date":    []string{aqtime.FromMillis(start).String()},
+		// 		},
+		// 	},
+		// },
+	}
+	ctx, span = otel.Tracer("signer").Start(ctx, "SignMP4_MarshalManifest")
+	manifestBs, err := json.Marshal(mani)
+	if err != nil {
+		return fmt.Errorf("failed to marshal manifest: %w", err)
+	}
+	var manifest c2patypes.ManifestDefinition
+	err = json.Unmarshal(manifestBs, &manifest)
+	if err != nil {
+		return fmt.Errorf("failed to unmarshal manifest: %w", err)
+	}
+	span.End()
+
+	ctx, span = otel.Tracer("signer").Start(ctx, "SignMP4_Sign")
+	rustCallbackSigner := &RustCallbackSigner{
+		Signer: ms.Signer,
+	}
+	many := c2patypes.NewManyStreams()
+	for _, ingredient := range ingredients {
+		many.AddStream(ingredient)
+	}
+	err = iroh_streamplace.SignWithIngredients(string(manifestBs), c2patypes.NewReader(input), base64.StdEncoding.EncodeToString(ms.Cert), many, rustCallbackSigner, c2patypes.NewWriter(output))
+	if err != nil {
+		return err
+	}
+	span.End()
+
+	ctx, span = otel.Tracer("signer").Start(ctx, "SignMP4_OutputBytes")
+	defer ctx.Done()
+	if err != nil {
+		return fmt.Errorf("failed to get output bytes: %w", err)
+	}
+	span.End()
+	spmetrics.SigningDuration.WithLabelValues(ms.StreamerName).Observe(float64(time.Since(startTime).Milliseconds()))
+	return nil
+}
+
+// don't call externally! this is used as a callback for the rust library
 
 func (ms *MediaSignerLocal) Pub() aqpub.Pub {
 	return ms.AQPub

pkg/media/media_signer_ext.go

···
-package media
-
-import (
-	"bytes"
-	"context"
-	"crypto"
-	"crypto/ecdsa"
-	"fmt"
-	"io"
-	"os"
-	"os/exec"
-	"time"
-
-	"github.com/decred/dcrd/dcrec/secp256k1"
-	"github.com/mr-tron/base58"
-	"go.opentelemetry.io/otel"
-	"stream.place/streamplace/pkg/atproto"
-	"stream.place/streamplace/pkg/config"
-	"stream.place/streamplace/pkg/crypto/aqpub"
-	"stream.place/streamplace/pkg/log"
-	"stream.place/streamplace/pkg/model"
-	"stream.place/streamplace/pkg/spmetrics"
-)
-
-type MediaSignerExt struct {
-	cli             *config.CLI
-	signer          crypto.Signer
-	pub             aqpub.Pub
-	certPath        string
-	streamer        string
-	keyBs           []byte
-	taURL           string
-	did             string
-	manifestBuilder *ManifestBuilder
-}
-
-func MakeMediaSignerExt(ctx context.Context, cli *config.CLI, streamer string, keyBs []byte, model model.Model) (MediaSigner, error) {
-	key, _ := secp256k1.PrivKeyFromBytes(keyBs)
-	if key == nil {
-		return nil, fmt.Errorf("invalid authorization key (not valid secp256k1)")
-	}
-	var signer crypto.Signer = key.ToECDSA()
-	certBs, err := prepareCert(ctx, cli, signer)
-	if err != nil {
-		return nil, err
-	}
-	// Write certificate to a temporary file
-	certFile, err := os.CreateTemp("", "cert-*.pem")
-	if err != nil {
-		return nil, fmt.Errorf("failed to create temp cert file: %w", err)
-	}
-	defer certFile.Close()
-
-	if _, err := certFile.Write(certBs); err != nil {
-		return nil, fmt.Errorf("failed to write cert to temp file: %w", err)
-	}
-
-	certPath := certFile.Name()
-	pub, err := aqpub.FromPublicKey(signer.Public().(*ecdsa.PublicKey))
-	if err != nil {
-		return nil, err
-	}
-	did, err := atproto.ParsePubKey(signer.Public().(*ecdsa.PublicKey))
-	if err != nil {
-		return nil, err
-	}
-	return &MediaSignerExt{
-		signer:          signer,
-		certPath:        certPath,
-		streamer:        streamer,
-		pub:             pub,
-		keyBs:           keyBs,
-		taURL:           cli.TAURL,
-		did:             did.DIDKey(),
-		manifestBuilder: NewManifestBuilder(model),
-	}, nil
-}
-
-func (ms *MediaSignerExt) SignMP4(ctx context.Context, input io.ReadSeeker, start int64) ([]byte, error) {
-	startTime := time.Now()
-	_, span := otel.Tracer("signer").Start(ctx, "SignMP4_Ext")
-	defer span.End()
-
-	// Build manifest with metadata from database
-	manifestBs, err := ms.manifestBuilder.BuildManifest(ctx, ms.streamer, start)
-	if err != nil {
-		log.Error(ctx, "MediaSignerExt: failed to build manifest", "error", err)
-		return nil, fmt.Errorf("failed to build manifest: %w", err)
-	}
-
-	// Get the path to the current executable
-	execPath, err := os.Executable()
-	if err != nil {
-		return nil, fmt.Errorf("failed to get executable path: %w", err)
-	}
-
-	enc := base58.Encode(ms.keyBs)
-
-	// Prepare command with manifest JSON
-	cmd := exec.Command(execPath, "sign",
-		"--key", enc,
-		"--cert", ms.certPath,
-		"--ta-url", ms.taURL,
-		"--streamer", ms.streamer,
-		"--start-time", fmt.Sprintf("%d", start),
-		"--manifest", string(manifestBs))
-
-	// overwrite so that our subprocesses don't do their own leak checking
-	cmd.Env = append(os.Environ(), "LD_PRELOAD=")
-
-	// Set up pipes for stdin and stdout
-	stdin, err := cmd.StdinPipe()
-	if err != nil {
-		return nil, fmt.Errorf("failed to create stdin pipe: %w", err)
-	}
-
-	stdout := &bytes.Buffer{}
-	cmd.Stdout = stdout
-	stderr := &bytes.Buffer{}
-	cmd.Stderr = stderr
-
-	// Start the command
-	if err := cmd.Start(); err != nil {
-		return nil, fmt.Errorf("failed to start command: %w", err)
-	}
-
-	// Copy input to stdin
-	_, err = io.Copy(stdin, input)
-	if err != nil {
-		return nil, fmt.Errorf("failed to write to stdin: %w stderr=%s", err, stderr.String())
-	}
-	stdin.Close()
-
-	// Wait for the command to complete
-	if err := cmd.Wait(); err != nil {
-		log.Error(ctx, "MediaSignerExt: subprocess failed", "error", err, "stderr", stderr.String())
-		return nil, fmt.Errorf("command failed: %w, stderr: %s", err, stderr.String())
-	}
-
-	spmetrics.SigningDuration.WithLabelValues(ms.streamer).Observe(float64(time.Since(startTime).Milliseconds()))
-	return stdout.Bytes(), nil
-}
-
-func (ms *MediaSignerExt) Pub() aqpub.Pub {
-	return ms.pub
-}
-
-func (ms *MediaSignerExt) Streamer() string {
-	return ms.streamer
-}
-
-func (ms *MediaSignerExt) DID() string {
-	return ms.did
-}

pkg/media/media_test.go

···
 
 import (
 	"context"
-	"os"
 	"path/filepath"
 	"runtime"
 	"testing"
···
 	// require.NoError(t, err)
 	return mm, nil
 }
-
-// func mp4(t *testing.T) []byte {
-// 	f, err := os.Open(getFixture("video.mpegts"))
-// 	require.NoError(t, err)
-// 	defer f.Close()
-// 	buf := bytes.Buffer{}
-// 	w := bufio.NewWriter(&buf)
-// 	err = MuxToMP4(context.Background(), f, w)
-// 	require.NoError(t, err)
-// 	return buf.Bytes()
-// }
-
-// func TestMuxToMP4(t *testing.T) {
-// 	bs := mp4(t)
-// 	require.Greater(t, len(bs), 0)
-// }
-
-// func TestSignMP4(t *testing.T) {
-// 	mp4bs := mp4(t)
-// 	r := bytes.NewReader(mp4bs)
-// 	_, ms := getStaticTestMediaManager(t)
-// 	millis := time.Now().UnixMilli()
-// 	bs, err := ms.SignMP4(context.Background(), r, millis)
-// 	require.NoError(t, err)
-// 	require.Greater(t, len(bs), 0)
-// }
-
-// func TestSignMP4WithWallet(t *testing.T) {
-// 	eip712test.WithTestSigner(func(signer *eip712.EIP712Signer) {
-// 		cli := ct.CLI(t, &config.CLI{
-// 			TAURL:          "http://timestamp.digicert.com",
-// 			AllowedStreams: []aqpub.Pub{},
-// 		})
-// 		ms, err := MakeMediaSigner(context.Background(), cli, "test person", signer)
-// 		require.NoError(t, err)
-// 		mp4bs := mp4(t)
-// 		r := bytes.NewReader(mp4bs)
-// 		millis := time.Now().UnixMilli()
-// 		bs, err := ms.SignMP4(context.Background(), r, millis)
-// 		require.NoError(t, err)
-// 		require.Greater(t, len(bs), 0)
-// 	})
-// }
-
-// TODO: Would be good to have this tested with SoftHSM
-// func TestSignMP4WithHSM(t *testing.T) {
-// 	one := 1
-// 	sc, err := crypto11.Configure(&crypto11.Config{
-// 		// TokenLabel: "C2PA Signer",
-// 		Path:       "/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so",
-// 		Pin:        "123456",
-// 		SlotNumber: &one,
-// 	})
-// 	require.NoError(t, err)
-
-// 	allsigners, err := sc.FindAllKeyPairs()
-// 	require.NoError(t, err)
-// 	signer := allsigners[0]
-// 	certBs, err := signers.GenerateES256KCert(signer)
-// 	mm := MediaManager{
-// 		cli: &config.CLI{
-// 			TAURL: "http://timestamp.digicert.com",
-// 		},
-// 		signer: signer,
-// 		cert:   certBs,
-// 		user:   "testuser",
-// 	}
-// 	mp4bs := mp4(t)
-// 	r := bytes.NewReader(mp4bs)
-// 	f, err := os.CreateTemp("", "*.mp4")
-// 	require.NoError(t, err)
-// 	ms := time.Now().UnixMilli()
-// 	err = mm.SignMP4(context.Background(), r, f, ms)
-// 	require.NoError(t, err)
-// }
-
-func TestVerifyMP4(t *testing.T) {
-	f, err := os.Open(getFixture("sample-segment.mp4"))
-	require.NoError(t, err)
-	mm, _ := getStaticTestMediaManager(t)
-	err = mm.ValidateMP4(context.Background(), f, true)
-	require.NoError(t, err)
-}

pkg/media/packetize.go

···
 		return nil, fmt.Errorf("failed to create GStreamer pipeline: %w", err) //nolint:all
 	}
 
-	demuxBin, err := ConcatDemuxBin(ctx, seg)
+	demuxBin, err := ConcatDemuxBin(ctx, seg, true)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create concat bin: %w", err)
 	}

pkg/media/rtcrec_test.go

···
 
 import (
 	"context"
-	"fmt"
 	"os"
 	"testing"
 
+	"github.com/cenkalti/backoff/v5"
 	"github.com/pion/webrtc/v4"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/goleak"
 	"stream.place/streamplace/pkg/config"
 	"stream.place/streamplace/pkg/crypto/spkey"
-	"stream.place/streamplace/pkg/globalerror"
 	"stream.place/streamplace/pkg/rtcrec"
+	"stream.place/streamplace/test/remote"
 )
 
+var RTCRecTestCases = []struct {
+	name                string
+	fatalErrors         bool
+	fixture             string
+	expectedSegmentsMin int
+	expectedSegmentsMax int
+}{
+	{
+		name:                "IntermittentTracks",
+		fatalErrors:         false,
+		fixture:             getFixture("intermittent-tracks.cbor"),
+		expectedSegmentsMin: 10,
+		expectedSegmentsMax: 15,
+	},
+	{
+		name:                "SegmentConvergenceIssues",
+		fatalErrors:         true,
+		fixture:             remote.RemoteFixture("6a1fb84e3c23405fc53161f59d5b837839c4889fc1a96533c82fb44fafc51d27/2025-11-14T22-41-20-399Z.cbor"),
+		expectedSegmentsMin: 1,
+		expectedSegmentsMax: 10,
+	},
+}
+
 func TestRTCRecording(t *testing.T) {
-	withNoGSTLeaks(t, func() {
-		globalerror.GlobalErrors = []error{}
-		ctx := context.Background()
-		dir, err := os.MkdirTemp("", "rtcrec-test-*")
-		require.NoError(t, err)
-		defer os.RemoveAll(dir)
-		cli := &config.CLI{}
-		fs := cli.NewFlagSet("rtcrec-test")
-		err = cli.Parse(fs, []string{"--data-dir", dir, "-wide-open=true"})
-		require.NoError(t, err)
-		mm, err := MakeMediaManager(context.Background(), cli, nil, nil, nil, nil)
-		require.NoError(t, err)
-		priv, pub, err := spkey.GenerateStreamKey()
-		require.NoError(t, err)
-		signer, err := spkey.KeyToSigner(priv)
-		require.NoError(t, err)
-		mediaSigner, err := MakeMediaSigner(ctx, cli, pub.DIDKey(), signer, nil)
-		require.NoError(t, err)
-		// ctx := context.Background()
-		// mm, ms := getStaticTestMediaManager(t)
-		fd, err := os.Open(getFixture("intermittent-tracks.cbor"))
-		require.NoError(t, err)
-		defer fd.Close()
-		pc, err := rtcrec.NewReplayPeerConnection(ctx, fd)
-		require.NoError(t, err)
-		done := make(chan struct{})
-		answer, err := mm.WebRTCIngest(ctx, &webrtc.SessionDescription{SDP: "placeholder"}, mediaSigner, pc, done)
-		require.NoError(t, err)
-		fmt.Println(answer.SDP)
-		<-done
-		for _, err := range globalerror.GlobalErrors {
-			fmt.Printf("got error, non-fatal for now: %v\n", err)
-		}
-	})
+
+	previous := FatalSegmentationErrors
+	defer func() {
+		FatalSegmentationErrors = previous
+	}()
+	// ctx := context.Background()
+	// mm, ms := getStaticTestMediaManager(t)
+	for _, testCase := range RTCRecTestCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			withNoGSTLeaks(t, func() {
+				ctx := context.Background()
+				dir, err := os.MkdirTemp("", "rtcrec-test-*")
+				require.NoError(t, err)
+				defer os.RemoveAll(dir)
+				cli := &config.CLI{}
+				fs := cli.NewFlagSet("rtcrec-test")
+				err = cli.Parse(fs, []string{
+					"--data-dir", dir,
+					"-wide-open=true",
+				})
+				require.NoError(t, err)
+				mm, err := MakeMediaManager(context.Background(), cli, nil, nil, nil, nil)
+				require.NoError(t, err)
+				priv, pub, err := spkey.GenerateStreamKey()
+				require.NoError(t, err)
+				signer, err := spkey.KeyToSigner(priv)
+				require.NoError(t, err)
+				mediaSigner, err := MakeMediaSigner(ctx, cli, pub.DIDKey(), signer, nil)
+				require.NoError(t, err)
+
+				segsub := mm.NewSegment()
+				segCount := 0
+				go func() {
+					for range segsub {
+						segCount++
+					}
+				}()
+
+				cur := goleak.IgnoreCurrent()
+				defer goleak.VerifyNone(t, cur)
+
+				FatalSegmentationErrors = testCase.fatalErrors
+				fd, err := os.Open(testCase.fixture)
+				require.NoError(t, err)
+				defer fd.Close()
+				pc, err := rtcrec.NewReplayPeerConnection(ctx, fd)
+				require.NoError(t, err)
+				done := make(chan error)
+				_, err = mm.WebRTCIngest(ctx, &webrtc.SessionDescription{SDP: "placeholder"}, mediaSigner, pc, done)
+				require.NoError(t, err)
+				// fmt.Println(answer.SDP)
+				<-done
+
+				// the segment getting ingested is ever so slightly after the done, which doesn't matter except in tests, just do a backoff for checking
+				ticker := backoff.NewTicker(backoff.NewExponentialBackOff())
+				defer ticker.Stop()
+				for i := 0; i < 10; i++ {
+					if segCount >= testCase.expectedSegmentsMin {
+						break
+					}
+					if i < 9 {
+						<-ticker.C
+					}
+				}
+				require.GreaterOrEqual(t, segCount, testCase.expectedSegmentsMin)
+				require.LessOrEqual(t, segCount, testCase.expectedSegmentsMax)
+			})
+		})
+	}
+
 }

pkg/media/segment_combine_test.go

···
+package media
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sync/errgroup"
+	"stream.place/streamplace/pkg/aqio"
+	"stream.place/streamplace/pkg/log"
+	"stream.place/streamplace/test/remote"
+)
+
+func TestCombineSegmentsUnsigned(t *testing.T) {
+	withNoGSTLeaks(t, func() {
+		g, _ := errgroup.WithContext(context.Background())
+		for range streamplaceTestCount {
+			g.Go(func() error {
+				return innerTestClip(t)
+			})
+		}
+		err := g.Wait()
+		require.NoError(t, err)
+	})
+}
+
+func innerTestClip(t *testing.T) error {
+	ctx := log.WithDebugValue(context.Background(), map[string]map[string]int{"func": {"ConcatDemuxBin": 9, "ConcatBin": 9}})
+	dirname := remote.RemoteArchive("c21e9352e72ca0729c66af2fcabec1b8997b509601241e8d38d5728f9687386b/threesegs.tar.gz")
+	inputFiles := []string{
+		fmt.Sprintf("%s/2025-11-15T21-05-00-399Z.mp4", dirname),
+		fmt.Sprintf("%s/2025-11-15T21-05-01-385Z.mp4", dirname),
+		fmt.Sprintf("%s/2025-11-15T21-05-02-393Z.mp4", dirname),
+	}
+	inputFds := make([]io.ReadSeeker, len(inputFiles))
+	for i, fName := range inputFiles {
+		fd, err := os.Open(fName)
+		if err != nil {
+			return fmt.Errorf("unable to open segment file: %w", err)
+		}
+		inputFds[i] = fd
+	}
+	buf := aqio.NewReadWriteSeeker([]byte{})
+	err := CombineSegmentsUnsigned(ctx, inputFds, buf, true)
+	require.NoError(t, err)
+	slice, err := buf.Bytes()
+	require.NoError(t, err)
+	require.Equal(t, 4725181, len(slice))
+	return nil
+}

pkg/media/segment_conv.go

···
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 
-	// Handle bus messages in a separate goroutine
-	g, ctx := errgroup.WithContext(ctx)
-	g.Go(func() error {
-		if err := HandleBusMessages(ctx, pipeline); err != nil {
-			log.Log(ctx, "pipeline error", "error", err)
-		}
-		cancel()
-		return nil
-	})
+	busErr := make(chan error)
+	go func() {
+		err := HandleBusMessages(ctx, pipeline)
+		busErr <- err
+	}()
 
-	// Start the pipeline
 	err = pipeline.SetState(gst.StatePlaying)
 	if err != nil {
 		return fmt.Errorf("failed to set pipeline state to playing: %w", err)
 	}
 
-	// Wait for the pipeline to finish or context to be canceled
-	<-ctx.Done()
-
-	// durOk, dur := pipeline.QueryDuration(gst.FormatTime)
-	// if !durOk {
-	// 	return fmt.Errorf("failed to query duration")
-	// }
-
-	// Clean up
-	err = pipeline.SetState(gst.StateNull)
-	if err != nil {
-		return fmt.Errorf("failed to set pipeline state to null: %w", err)
-	}
+	defer func() {
+		err = pipeline.SetState(gst.StateNull)
+		if err != nil {
+			log.Error(ctx, "failed to set pipeline state to null", "error", err)
+		}
+	}()
 
-	return nil
+	return <-busErr
 }
 
 // Splits out video into MPEG-TS and audio into MP4 (to be recombined after transcoding)

pkg/media/segment_converge.go

···
+package media
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"slices"
+
+	"github.com/Eyevinn/mp4ff/mp4"
+	"stream.place/streamplace/pkg/aqtime"
+	"stream.place/streamplace/pkg/config"
+	"stream.place/streamplace/pkg/log"
+)
+
+var MaxSegmentTries = 10
+
+// run this segment through the segmenter/splitter until it comes out the
+// same, meaning we can cleanly get it in and out of a concatenated mp4 file
+func ConvergeSegment(ctx context.Context, cli *config.CLI, bs []byte, now int64, streamer string, doH264Parse bool) ([]byte, error) {
+	cli.DumpDebugSegment(ctx, fmt.Sprintf("converge-segment-%s.mp4", streamer), bytes.NewReader(bs))
+
+	log.Debug(ctx, "parsing segment media data", "size", len(bs))
+	_, err := ParseSegmentMediaData(ctx, bs)
+	if err != nil {
+		return nil, fmt.Errorf("error parsing segment media data: %w", err)
+	}
+	// rewrite segmented audio timestamps to work around bug where the last
+	// audio segment gets no duration and then gets dropped upon rewrite
+	smearedBuf := &bytes.Buffer{}
+	log.Debug(ctx, "rewriting audio timestamps", "size", len(bs))
+	err = RewriteAudioTimestamps(ctx, cli, bytes.NewReader(bs), smearedBuf, false)
+	if err != nil {
+		return nil, fmt.Errorf("error rewriting audio timestamps: %w", err)
+	}
+	bs = smearedBuf.Bytes()
+	log.Debug(ctx, "converging segment", "size", len(bs))
+
+	previousBs := []byte{}
+	currentBs := bs
+	i := 0
+	for i = 0; i <= MaxSegmentTries; i++ {
+		if slices.Compare(previousBs, currentBs) == 0 {
+			break
+		}
+		if cli.SegmentDebugDir != "" {
+			mydir := filepath.Join(cli.SegmentDebugDir, streamer)
+			err := os.MkdirAll(mydir, 0755)
+			if err != nil {
+				return nil, fmt.Errorf("failed to create debug directory: %w", err)
+			}
+			aqt := aqtime.FromMillis(now)
+			outFile := filepath.Join(cli.SegmentDebugDir, fmt.Sprintf("%s-attempt-%03d.mp4", aqt.FileSafeString(), i))
+			err = os.WriteFile(outFile, currentBs, 0644)
+			if err != nil {
+				return nil, fmt.Errorf("failed to write debug file: %w", err)
+			}
+			log.Log(ctx, "wrote debug file", "path", outFile)
+		}
+		buf := bytes.Buffer{}
+		err := CombineSegmentsUnsigned(ctx, []io.ReadSeeker{bytes.NewReader(currentBs)}, &buf, doH264Parse)
+		if err != nil {
+			return nil, fmt.Errorf("failed to attempt segment convergence: %w", err)
+		}
+		previousBs = currentBs
+		currentBs = buf.Bytes()
+		mp4file, err := mp4.DecodeFile(bytes.NewReader(currentBs))
+		if err != nil {
+			return nil, fmt.Errorf("failed to decode segment: %w", err)
+		}
+		btrt := mp4file.Moov.Trak.Mdia.Minf.Stbl.Stsd.AvcX.Btrt
+		btrt.AvgBitrate = 0
+		btrt.MaxBitrate = 0
+		// log.Log(ctx, "btrt", "average bitrate", btrt.AvgBitrate, "max bitrate", btrt.MaxBitrate)
+		encodedBuf := bytes.Buffer{}
+		err = mp4file.Encode(&encodedBuf)
+		if err != nil {
+			return nil, fmt.Errorf("failed to encode segment: %w", err)
+		}
+		currentBs = encodedBuf.Bytes()
+	}
+	if slices.Compare(previousBs, currentBs) != 0 {
+		return nil, fmt.Errorf("failed to converge segment after %d tries", MaxSegmentTries)
+	}
+	bs = currentBs
+	log.Debug(ctx, "converged segments", "tries", i, "size", len(bs))
+	return currentBs, nil
+}

pkg/media/segment_converge_test.go

···
+package media
+
+import (
+	"context"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"stream.place/streamplace/pkg/config"
+	"stream.place/streamplace/pkg/log"
+	"stream.place/streamplace/test/remote"
+)
+
+type ConvergeCase struct {
+	Name        string
+	File        string
+	Success     bool
+	DoH264Parse bool
+}
+
+var ConvergeCases = []ConvergeCase{
+	{
+		Name:        "Good",
+		File:        remote.RemoteFixture("dbce5682132f9f1a8d92e1dcd66da99e4ae6eefd7429e4b168ed05d721a80379/2025-11-14T21-10-51-750Z-attempt-000.mp4"),
+		Success:     true,
+		DoH264Parse: true,
+	},
+	{
+		Name:        "Evil",
+		File:        remote.RemoteFixture("d81395168f8b2f3361d8e6d3443eeb678285a1973dc0b31e966cb81f5916db48/2025-11-14T21-10-57-754Z-attempt-000.mp4"),
+		Success:     true,
+		DoH264Parse: true,
+	},
+	{
+		Name:        "Stuck",
+		File:        remote.RemoteFixture("77e32825eaa9dfb8f6c7bbe3cb21213ffa01c1dc0d041f8e3e9cc4d107c95f16/2025-11-17T01-08-56-070Z-converge-segment-did-key-zQ3shX7nQpEqXEp3XFSPkS7mtUjQ3S1MNvxrEP2HeiwyPqmoz.mp4"),
+		Success:     true,
+		DoH264Parse: false,
+	},
+	{
+		Name:        "CouldNotMultiplex",
+		File:        remote.RemoteFixture("c12696bde28c5ab3ffd7040fd7da2ca6d871bb73b40fc2310dece0f6a082ee8a/2025-11-20T18-02-37-957Z-attempt-000.mp4"),
+		Success:     true,
+		DoH264Parse: false,
+	},
+	// {
+	// 	Name: "CrashedPipeline",
+	// 	File: "/Users/iameli/testvids/stuck-converge/2025-11-17T01-08-56-070Z-converge-segment-did-key-zQ3shX7nQpEqXEp3XFSPkS7mtUjQ3S1MNvxrEP2HeiwyPqmoz.mp4",
+	// },
+}
+
+func TestConvergeSegment(t *testing.T) {
+	ctx := log.WithDebugValue(context.Background(), map[string]map[string]int{"func": {"ConcatDemuxBin": 9, "ConcatBin": 9}})
+	for _, tc := range ConvergeCases {
+		tc := tc // capture for parallel tests if ever used
+		t.Run(tc.Name, func(t *testing.T) {
+			withNoGSTLeaks(t, func() {
+				t.Log("--------------")
+				t.Logf("test case: %s", tc.File)
+				bs, err := os.ReadFile(tc.File)
+				require.NoError(t, err)
+				bs, err = ConvergeSegment(ctx, &config.CLI{}, bs, 0, "test-streamer", tc.DoH264Parse)
+				if tc.Success {
+					require.NoError(t, err)
+					require.Greater(t, len(bs), 0)
+				} else {
+					require.Error(t, err)
+				}
+			})
+		})
+	}
+}

pkg/media/segment_roundtrip_test.go

···
+package media
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"reflect"
+	"sort"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"stream.place/streamplace/pkg/aqio"
+	"stream.place/streamplace/pkg/config"
+	ct "stream.place/streamplace/pkg/config/configtesting"
+	"stream.place/streamplace/pkg/crypto/spkey"
+	"stream.place/streamplace/test/remote"
+)
+
+var testTimestamp = "2025-01-01T00:00:00.000Z"
+
+func makeServerMediaSigner(t *testing.T) *MediaSignerLocal {
+	priv, _, err := spkey.GenerateStreamKey()
+	require.NoError(t, err)
+	require.NoError(t, err)
+	signer, err := spkey.KeyToSigner(priv)
+	require.NoError(t, err)
+	cli := ct.CLI(t, &config.CLI{
+		TAURL:    "http://timestamp.digicert.com",
+		WideOpen: true,
+	})
+	msInterface, err := MakeMediaSigner(context.Background(), cli, "test-person", signer, nil)
+	require.NoError(t, err)
+	ms := msInterface.(*MediaSignerLocal)
+	return ms
+}
+
+func TestSegmentRoundtrip(t *testing.T) {
+	testCases := []struct {
+		name    string
+		fixture string
+	}{
+		{
+			name:    "OneMinute",
+			fixture: remote.RemoteArchive("4563c7b48c0ca02c3fc87bbe6f1e63a743656e465a82bec0af75ef7eead04a23/1-minute-of-signed-segments.tar.gz"),
+		},
+		{
+			name:    "ThreeSegs",
+			fixture: remote.RemoteArchive("c21e9352e72ca0729c66af2fcabec1b8997b509601241e8d38d5728f9687386b/threesegs.tar.gz"),
+		},
+	}
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			withNoGSTLeaks(t, func() {
+				tempDir, err := os.MkdirTemp("", "ingredient_test")
+				require.NoError(t, err)
+				getTestVids := func() []io.ReadSeeker {
+					testVids := []io.ReadSeeker{}
+					segEntries, err := os.ReadDir(testCase.fixture)
+					require.NoError(t, err)
+					for _, segEntry := range segEntries {
+						if segEntry.Type().IsRegular() {
+							if !strings.HasSuffix(segEntry.Name(), ".mp4") {
+								continue
+							}
+							fd, err := os.Open(filepath.Join(testCase.fixture, segEntry.Name()))
+							require.NoError(t, err)
+							testVids = append(testVids, fd)
+						}
+					}
+					return testVids
+				}
+
+				firstReport, err := makeSegDirReport(t, testCase.fixture)
+				require.NoError(t, err)
+				ms := makeServerMediaSigner(t)
+				rws := aqio.NewReadWriteSeeker([]byte{})
+				err = CombineSegments(context.Background(), getTestVids(), ms, rws)
+				require.NoError(t, err)
+
+				_, err = rws.Seek(0, io.SeekStart)
+				require.NoError(t, err)
+
+				signedSplitSegDir := makeTestSubdir(t, tempDir, "signed-split-segments")
+				cli := &config.CLI{}
+				fs := cli.NewFlagSet("rtcrec-test")
+				err = cli.Parse(fs, []string{})
+				require.NoError(t, err)
+				err = SplitSegments(context.Background(), cli, rws, func(fname string) ReadWriteSeekCloser {
+					fd, err := os.Create(filepath.Join(signedSplitSegDir, fname))
+					require.NoError(t, err)
+					return fd
+				})
+				require.NoError(t, err)
+				secondReport, err := makeSegDirReport(t, signedSplitSegDir)
+				require.NoError(t, err)
+				require.NoError(t, firstReport.CheckEquals(secondReport), "signed split segments are not equal to original segments")
+			})
+		})
+	}
+}
+
+func makeTestSubdir(t *testing.T, tempDir, subdir string) string {
+	subDir := filepath.Join(tempDir, subdir)
+	err := os.MkdirAll(subDir, 0755)
+	require.NoError(t, err)
+	return subDir
+}
+
+type SegDirReport struct {
+	Dir    string
+	Segs   []string
+	Hashes []string
+}
+
+func makeSegDirReport(t *testing.T, segDir string) (*SegDirReport, error) {
+	segs := []string{}
+	segEntries, err := os.ReadDir(segDir)
+	require.NoError(t, err)
+	for _, segEntry := range segEntries {
+		if segEntry.Type().IsRegular() {
+			segPath := filepath.Join(segDir, segEntry.Name())
+			segs = append(segs, segPath)
+		}
+	}
+	sort.Strings(segs)
+	hashes := make([]string, len(segs))
+	for i, segPath := range segs {
+		hash, err := hashFile(segPath)
+		if err != nil {
+			return nil, err
+		}
+		hashes[i] = hash
+	}
+
+	return &SegDirReport{
+		Dir:    segDir,
+		Segs:   segs,
+		Hashes: hashes,
+	}, nil
+}
+
+func (s *SegDirReport) Equals(other *SegDirReport) bool {
+	if len(s.Segs) != len(other.Segs) {
+		return false
+	}
+	if len(s.Hashes) != len(other.Hashes) {
+		return false
+	}
+	return reflect.DeepEqual(s.Hashes, other.Hashes)
+}
+
+func hashFile(path string) (string, error) {
+	bs, err := os.ReadFile(path)
+	if err != nil {
+		return "", err
+	}
+	hash := sha256.Sum256(bs)
+	return fmt.Sprintf("%x", hash), nil
+}
+
+func (s *SegDirReport) CheckEquals(other *SegDirReport) error {
+	if !s.Equals(other) {
+		str1 := s.ToString()
+		str2 := other.ToString()
+		return fmt.Errorf("files should be equal: %s\n%s", str1, str2)
+	}
+	return nil
+}
+
+func (s *SegDirReport) ToString() string {
+	bs, err := json.MarshalIndent(s, "", "  ")
+	if err != nil {
+		panic(err)
+	}
+	return string(bs)
+}

pkg/media/segment_split.go

···
+package media
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"sort"
+
+	"golang.org/x/sync/errgroup"
+	"stream.place/streamplace/pkg/aqio"
+	c2patypes "stream.place/streamplace/pkg/c2patypes"
+	"stream.place/streamplace/pkg/config"
+	"stream.place/streamplace/pkg/iroh/generated/iroh_streamplace"
+	"stream.place/streamplace/pkg/log"
+)
+
+type SplitSegment struct {
+	Filename string
+	Data     []byte
+}
+
+type ManifestResult struct {
+	Manifests map[string]c2patypes.Manifest `json:"manifests"`
+	Certs     map[string]string             `json:"certs"`
+}
+
+type ManifestAndMetadata struct {
+	Manifest        c2patypes.Manifest
+	SegmentMetadata *SegmentMetadata
+}
+
+type ReadWriteSeekCloser interface {
+	io.ReadWriteSeeker
+	io.Closer
+}
+
+type SegmentToSign struct {
+	unsignedSeg io.ReadSeeker
+	manifestId  string
+	cert        []byte
+	outputSeg   io.ReadWriteSeeker
+	closeCh     chan struct{}
+}
+
+func NewSegmentToSign(unsignedSeg io.ReadSeeker, manifestId string, cert []byte, outputSeg io.ReadWriteSeeker) *SegmentToSign {
+	return &SegmentToSign{
+		unsignedSeg: unsignedSeg,
+		manifestId:  manifestId,
+		cert:        cert,
+		outputSeg:   outputSeg,
+		closeCh:     make(chan struct{}),
+	}
+}
+
+func (s *SegmentToSign) UnsignedSegStream() iroh_streamplace.Stream {
+	return c2patypes.NewReader(s.unsignedSeg)
+}
+
+func (s *SegmentToSign) ManifestId() string {
+	return s.manifestId
+}
+
+func (s *SegmentToSign) Cert() []byte {
+	return s.cert
+}
+
+func (s *SegmentToSign) OutputSegStream() iroh_streamplace.Stream {
+	return c2patypes.NewWriter(s.outputSeg)
+}
+
+func (s *SegmentToSign) Close() {
+	close(s.closeCh)
+}
+
+func (s *SegmentToSign) Done() {
+	<-s.closeCh
+}
+
+type ManySegmentsToSign struct {
+	segmentCh chan iroh_streamplace.SegmentToSign
+	readyCh   chan struct{}
+}
+
+func (m *ManySegmentsToSign) Next() *iroh_streamplace.SegmentToSign {
+	if m.readyCh != nil {
+		close(m.readyCh)
+		m.readyCh = nil
+	}
+	seg := <-m.segmentCh
+	if seg == nil {
+		return nil
+	}
+	return &seg
+}
+
+// split a signed concatenated mp4 into its constituent signed segments
+func SplitSegments(ctx context.Context, cli *config.CLI, input io.ReadSeeker, cb func(fname string) ReadWriteSeekCloser) error {
+	manifestsStr, err := iroh_streamplace.GetManifests(c2patypes.NewReader(input))
+	if err != nil {
+		return fmt.Errorf("failed to get manifests: %w", err)
+	}
+	_, err = input.Seek(0, io.SeekStart)
+	if err != nil {
+		return fmt.Errorf("failed to seek to start: %w", err)
+	}
+	var manifests ManifestResult
+	err = json.Unmarshal([]byte(manifestsStr), &manifests)
+	if err != nil {
+		return fmt.Errorf("failed to unmarshal manifests: %w", err)
+	}
+	manifestList := []ManifestAndMetadata{}
+	for _, manifest := range manifests.Manifests {
+		metadata, err := ParseSegmentAssertions(context.Background(), &manifest)
+		if errors.Is(err, ErrMissingMetadata) {
+			log.Error(ctx, "missing metadata", "manifest", manifest.Label)
+			continue
+		}
+		if err != nil {
+			return fmt.Errorf("failed to parse segment assertions: %w", err)
+		}
+		manifestList = append(manifestList, ManifestAndMetadata{
+			Manifest:        manifest,
+			SegmentMetadata: metadata,
+		})
+	}
+	sort.Slice(manifestList, func(i, j int) bool {
+		m1 := manifestList[i]
+		m2 := manifestList[j]
+		return m1.SegmentMetadata.StartTime.Time().Before(m2.SegmentMetadata.StartTime.Time())
+	})
+	certList := [][]byte{}
+	for _, manifest := range manifestList {
+		certList = append(certList, []byte(manifests.Certs[*manifest.Manifest.Label]))
+	}
+
+	segmentCh := make(chan iroh_streamplace.SegmentToSign)
+	readyCh := make(chan struct{})
+	mss := &ManySegmentsToSign{
+		segmentCh: segmentCh,
+		readyCh:   readyCh,
+	}
+	g, ctx := errgroup.WithContext(ctx)
+	unsignedCh := make(chan *SplitSegment)
+	streamer := manifestList[0].SegmentMetadata.Creator
+
+	// note: we're passing the input to two places here and need to make sure
+	// they're not running into problems with concurrent seeking. so we use
+	// this readyCh as a hack - it only fires after Rust is done with the input
+
+	g.Go(func() error {
+		err := iroh_streamplace.Resign(mss, c2patypes.NewReader(input))
+		if err != nil {
+			return fmt.Errorf("failed to resign segments: %w", err)
+		}
+		return nil
+	})
+	g.Go(func() error {
+		defer close(unsignedCh)
+		<-readyCh
+		// rust is done with the input, rewind and start segmenting
+		_, err := input.Seek(0, io.SeekStart)
+		if err != nil {
+			return fmt.Errorf("failed to seek to start: %w", err)
+		}
+		err = SegmentUnsigned(ctx, cli, streamer, input, true, unsignedCh)
+		if err != nil {
+			return fmt.Errorf("failed to segment file: %w", err)
+		}
+		return nil
+	})
+	validationErrors := []error{}
+	g.Go(func() error {
+		defer close(segmentCh)
+		i := 0
+		for unsignedSeg := range unsignedCh {
+			meta := manifestList[i].SegmentMetadata
+			fname := fmt.Sprintf("%s.mp4", meta.StartTime.FileSafeString())
+			rwsc := cb(fname)
+			rws := aqio.NewReadWriteSeeker(unsignedSeg.Data)
+			ss := NewSegmentToSign(c2patypes.NewReader(rws), *manifestList[i].Manifest.Label, certList[i], rwsc)
+			i += 1
+			segmentCh <- ss
+			ss.Done()
+			_, err := rwsc.Seek(0, io.SeekStart)
+			if err != nil {
+				return fmt.Errorf("failed to seek to start: %w", err)
+			}
+			bs, err := io.ReadAll(rwsc)
+			if err != nil {
+				return fmt.Errorf("failed to read segment file: %w", err)
+			}
+			_, validationError := ValidateMP4Media(ctx, bs)
+			if validationError != nil {
+				validationErrors = append(validationErrors, validationError)
+				cli.DumpDebugSegment(ctx, fmt.Sprintf("%s-invalid.mp4", fname), bytes.NewReader(bs))
+			}
+			log.Log(ctx, "validated segment file", "path", fname)
+			err = rwsc.Close()
+			if err != nil {
+				return fmt.Errorf("failed to close segment file: %w", err)
+			}
+		}
+		return nil
+	})
+
+	err = g.Wait()
+	if err != nil {
+		return fmt.Errorf("failed to split segments: %w", err)
+	}
+	if len(validationErrors) > 0 {
+		return fmt.Errorf("%d errors validating segments; first error: %w", len(validationErrors), validationErrors[0])
+	}
+	return nil
+}

pkg/media/segmenter.go

···
 	"bytes"
 	"context"
 	"fmt"
+	"io"
+	"os"
+	"strings"
 	"time"
 
 	"github.com/go-gst/go-gst/gst"
 	"github.com/go-gst/go-gst/gst/app"
-	"go.opentelemetry.io/otel"
-	"go.opentelemetry.io/otel/attribute"
-	"go.opentelemetry.io/otel/trace"
-	"stream.place/streamplace/pkg/globalerror"
+	"stream.place/streamplace/pkg/config"
 	"stream.place/streamplace/pkg/log"
 )
 
+// For testing. Normally,  We don't want to stop the pipeline upon a
+// segmentation error because we want to keep the stream alive. Lots
+// of weird invalid data coming in from WebRTC connections on phones.
+// Better we drop one weird segment than force the stream to restart.
+// But for tests, we want (sometimes) to know if there's a problem.
+var FatalSegmentationErrors = false
+
 // element that takes the input stream, muxes to mp4, and signs the result
-func (mm *MediaManager) SegmentAndSignElem(ctx context.Context, ms MediaSigner) (*gst.Element, error) {
+func SegmentElem(ctx context.Context, cli *config.CLI, streamer string, doH264Parse bool, cb func(ctx context.Context, buf []byte, now int64) error) (*gst.Element, error) {
 	// elem, err := gst.NewElement("splitmuxsink name=splitter async-finalize=true sink-factory=appsink muxer-factory=matroskamux max-size-bytes=1")
 	elem, err := gst.NewElementWithProperties("splitmuxsink", map[string]any{
 		"name":           "signer",
···
 		}
 	}()
 
+	// we didn't need faststart but i'm leaving this commented here in case
+	// you want to change any other muxer properties in the future
+
+	_, err = elem.Connect("muxer-added", func(split, muxEle *gst.Element) {
+		err := muxEle.SetProperty("presentation-time", false)
+		if err != nil {
+			panic("error setting presentation-time to false: " + err.Error())
+		}
+		err = muxEle.SetProperty("interleave-bytes", InterleaveBytes)
+		if err != nil {
+			panic("error setting interleave-bytes" + err.Error())
+		}
+		err = muxEle.SetProperty("interleave-time", InterleaveTime)
+		if err != nil {
+			panic("error setting interleave-time" + err.Error())
+		}
+		err = muxEle.SetProperty("faststart", true)
+		if err != nil {
+			panic("error setting faststart" + err.Error())
+		}
+		err = muxEle.SetProperty("movie-timescale", uint(60000))
+		if err != nil {
+			panic("error setting movie-timescale" + err.Error())
+		}
+		err = muxEle.SetProperty("trak-timescale", uint(60000))
+		if err != nil {
+			panic("error setting trak-timescale" + err.Error())
+		}
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to connect muxer-added handler: %w", err)
+	}
+
+	// channel to make sure data is emitted in order
+	var ch chan struct{}
+
 	_, err = elem.Connect("sink-added", func(split, sinkEle *gst.Element) {
+		previousSegCh := ch
+		mySegCh := make(chan struct{}, 1)
+		ch = mySegCh
 		buf := &bytes.Buffer{}
+		err := sinkEle.SetProperty("sync", false)
+		if err != nil {
+			panic("error setting sync to false: " + err.Error())
+		}
 		appsink := app.SinkFromElement(sinkEle)
 		if appsink == nil {
 			panic("appsink should not be nil")
···
 		appsink.SetCallbacks(&app.SinkCallbacks{
 			NewSampleFunc: WriterNewSample(ctx, buf),
 			EOSFunc: func(sink *app.Sink) {
-				ctx, span := otel.Tracer("signer").Start(ctx, "SegmentAndSignElem", trace.WithAttributes(
-					attribute.String("streamer", ms.Streamer()),
-				))
-				defer span.End()
-				resetTimer <- struct{}{}
+				// ctx, span := otel.Tracer("signer").Start(ctx, "SegmentAndSignElem", trace.WithAttributes(
+				// 	attribute.String("streamer", ms.Streamer()),
+				// ))
+				// defer span.End()
 				now := time.Now().UnixMilli()
+				resetTimer <- struct{}{}
 				bs := buf.Bytes()
-				if mm.cli.SmearAudio {
-					smearedBuf := &bytes.Buffer{}
-					err := SmearAudioTimestamps(ctx, bytes.NewReader(buf.Bytes()), smearedBuf)
+
+				if previousSegCh != nil {
+					<-previousSegCh
+				}
+				err := func() error {
+					bs, err := ConvergeSegment(ctx, cli, bs, now, streamer, doH264Parse)
 					if err != nil {
-						log.Error(ctx, "error smearing audio timestamps", "error", err)
-						return
+						return fmt.Errorf("error converging segment: %w", err)
 					}
-					bs = smearedBuf.Bytes()
-				}
-				bs, err := ms.SignMP4(ctx, bytes.NewReader(bs), now)
-				if err != nil {
-					log.Error(ctx, "error signing segment", "error", err)
-					return
-				}
-
-				err = mm.ValidateMP4(ctx, bytes.NewReader(bs), true)
+					log.Debug(ctx, "signing segment", "size", len(bs))
+					err = cb(ctx, bs, now)
+					if err != nil {
+						return fmt.Errorf("error signing segment: %w", err)
+					}
+					return nil
+				}()
+				close(mySegCh)
 				if err != nil {
-					log.Error(ctx, "error validating segment", "error", err)
-					globalerror.GlobalError(err)
-					// We don't want to stop the pipeline here because we want to keep the stream
-					// alive. Lots of weird invalid data coming in from WebRTC connections on
-					// phones. Better we drop one weird segment than force the stream to restart
-					return
+					log.Error(ctx, "error in segmenter", "error", err)
+					if FatalSegmentationErrors {
+						sink.ErrorMessage(gst.DomainCore, gst.CoreErrorFailed, "error in segmenter", err.Error())
+						return
+					}
 				}
 			},
 		})
···
 
 	return elem, nil
 }
+
+func (mm *MediaManager) SegmentAndSignElem(ctx context.Context, ms MediaSigner) (*gst.Element, error) {
+	return SegmentElem(ctx, mm.cli, ms.Streamer(), false, func(ctx context.Context, bs []byte, now int64) error {
+		if mm.cli.SmearAudio {
+			smearedBuf := &bytes.Buffer{}
+			err := RewriteAudioTimestamps(ctx, mm.cli, bytes.NewReader(bs), smearedBuf, true)
+			if err != nil {
+				return fmt.Errorf("error smearing audio timestamps: %w", err)
+			}
+			bs = smearedBuf.Bytes()
+		}
+		signedBs, err := ms.SignMP4(ctx, bytes.NewReader(bs), now)
+		if err != nil {
+			return fmt.Errorf("error calling SignMP4: %w", err)
+		}
+		log.Debug(ctx, "signed segment", "size", len(signedBs))
+		err = mm.ValidateMP4(ctx, bytes.NewReader(signedBs), true)
+		if err != nil {
+			mm.cli.DumpDebugSegment(ctx, "just-signed-segment.mp4", bytes.NewReader(signedBs))
+			return fmt.Errorf("error validating just-signed segment: %w", err)
+		}
+		return nil
+	})
+}
+
+func SegmentFileUnsigned(ctx context.Context, cli *config.CLI, streamer string, input string, ch chan *SplitSegment) error {
+	fd, err := os.OpenFile(input, os.O_RDONLY, 0644)
+	log.Log(ctx, "reading file", "file", input)
+	if err != nil {
+		return fmt.Errorf("failed to read file: %w", err)
+	}
+	defer fd.Close()
+	return SegmentUnsigned(ctx, cli, streamer, fd, false, ch)
+}
+
+func SegmentUnsigned(ctx context.Context, cli *config.CLI, streamer string, input io.Reader, doH264Parse bool, ch chan *SplitSegment) error {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	pipelineSlice := []string{
+		"appsrc name=appsrc ! qtdemux name=demux",
+		"demux. ! queue ! h264parse name=videoparse disable-passthrough=true config-interval=0",
+		"demux. ! queue ! opusparse name=audioparse",
+	}
+	pipeline, err := gst.NewPipelineFromString(strings.Join(pipelineSlice, "\n"))
+	if err != nil {
+		return fmt.Errorf("error creating MKVIngest pipeline: %w", err)
+	}
+
+	srcele, err := pipeline.GetElementByName("appsrc")
+	if err != nil {
+		return err
+	}
+	src := app.SrcFromElement(srcele)
+	src.SetCallbacks(&app.SourceCallbacks{
+		NeedDataFunc: ReaderNeedDataIncremental(ctx, input),
+	})
+	videoParseEle, err := pipeline.GetElementByName("videoparse")
+	if err != nil {
+		return err
+	}
+
+	segmenter, err := SegmentElem(ctx, cli, streamer, doH264Parse, func(ctx context.Context, buf []byte, now int64) error {
+		ch <- &SplitSegment{
+			Filename: fmt.Sprintf("%d.mp4", now),
+			Data:     buf,
+		}
+		return nil
+	})
+	if err != nil {
+		return err
+	}
+
+	err = pipeline.Add(segmenter)
+	if err != nil {
+		return err
+	}
+	err = videoParseEle.Link(segmenter)
+	if err != nil {
+		return err
+	}
+	audioparse, err := pipeline.GetElementByName("audioparse")
+	if err != nil {
+		return err
+	}
+	err = audioparse.Link(segmenter)
+	if err != nil {
+		return err
+	}
+
+	busErr := make(chan error)
+	go func() {
+		err := HandleBusMessages(ctx, pipeline)
+		cancel()
+		busErr <- err
+	}()
+
+	err = pipeline.SetState(gst.StatePlaying)
+	if err != nil {
+		return err
+	}
+
+	defer func() {
+		err := pipeline.SetState(gst.StateNull)
+		if err != nil {
+			log.Error(ctx, "error setting pipeline to null state", "error", err)
+		}
+	}()
+
+	err = <-busErr
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

pkg/media/validate.go

···
 	"strings"
 	"time"
 
+	"github.com/bluesky-social/indigo/atproto/crypto"
 	"go.opentelemetry.io/otel"
+	"stream.place/streamplace/pkg/aqio"
 	"stream.place/streamplace/pkg/aqtime"
 	c2patypes "stream.place/streamplace/pkg/c2patypes"
 	"stream.place/streamplace/pkg/constants"
···
 )
 
 type ManifestAndCert struct {
-	Manifest c2patypes.Manifest `json:"manifest"`
-	Cert     string             `json:"cert"`
+	Manifest          c2patypes.Manifest          `json:"manifest"`
+	Cert              string                      `json:"cert"`
+	ValidationResults c2patypes.ValidationResults `json:"validation_results"`
 }
 
 func (mm *MediaManager) ValidateMP4(ctx context.Context, input io.Reader, local bool) error {
···
 	defer span.End()
 	buf, err := io.ReadAll(input)
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to read input: %w", err)
 	}
-	var maniCert ManifestAndCert
-	maniStr, err := iroh_streamplace.GetManifestAndCert(buf)
+
+	valid, err := ValidateMP4Media(ctx, buf)
 	if err != nil {
-		return err
-	}
-	err = json.Unmarshal([]byte(maniStr), &maniCert)
-	if err != nil {
-		return err
+		return fmt.Errorf("failed to validate MP4 media: %w", err)
 	}
-	label := maniCert.Manifest.Label
+	meta := valid.Meta
+	pub := valid.Pub
+	mediaData := valid.MediaData
+	manifest := valid.Manifest
+
+	label := manifest.Label
 	if label != nil && mm.model != nil {
 		oldSeg, err := mm.model.GetSegment(*label)
 		if err != nil {
-			return err
+			return fmt.Errorf("failed to get old segment: %w", err)
 		}
 		if oldSeg != nil {
 			log.Warn(ctx, "segment already exists, skipping", "segmentID", *label)
 			return nil
 		}
 	}
-	pub, err := signers.ParseES256KCert([]byte(maniCert.Cert))
-	if err != nil {
-		return err
-	}
-	meta, err := ParseSegmentAssertions(ctx, &maniCert.Manifest)
-	if err != nil {
-		return err
-	}
+
 	if meta.MetadataConfiguration != nil {
 		if meta.MetadataConfiguration.DistributionPolicy != nil {
 			allowedBroadcasters := meta.MetadataConfiguration.DistributionPolicy.AllowedBroadcasters
···
 			}
 		}
 	}
-	mediaData, err := ParseSegmentMediaData(ctx, buf)
-	if err != nil {
-		return err
-	}
-	// special case for test signers that are only signed with a key
+
 	var repoDID string
 	var signingKeyDID string
+	// special case for test signers that are only signed with a key
 	if strings.HasPrefix(meta.Creator, constants.DID_KEY_PREFIX) {
 		signingKeyDID = meta.Creator
 		repoDID = meta.Creator
···
 		deleteAfter = meta.DistributionPolicy.ExpiresAt
 	}
 	seg := &model.Segment{
-		ID:                 *maniCert.Manifest.Label,
+		ID:                 *label,
 		SigningKeyDID:      signingKeyDID,
 		RepoDID:            repoDID,
 		StartTime:          meta.StartTime.Time(),
···
 			case <-ctx.Done():
 				return
 			case <-time.After(1 * time.Minute):
-				log.Warn(ctx, "failed to send segment to channel, timing out", "streamer", repoDID, "signingKey", signingKeyDID, "segmentID", *maniCert.Manifest.Label)
+				log.Warn(ctx, "failed to send segment to channel, timing out", "streamer", repoDID, "signingKey", signingKeyDID, "segmentID", *label)
 				return
 			}
 		}()
 	}
 	aqt := aqtime.FromTime(meta.StartTime.Time())
-	log.Log(ctx, "successfully ingested segment", "user", repoDID, "signingKey", signingKeyDID, "timestamp", aqt.FileSafeString(), "segmentID", *maniCert.Manifest.Label)
+	log.Log(ctx, "successfully ingested segment", "user", repoDID, "signingKey", signingKeyDID, "timestamp", aqt.FileSafeString(), "segmentID", *label)
 	return nil
 }
 
···
 	}
 	return false
 }
+
+type ValidationResult struct {
+	Pub       *crypto.PublicKeyK256
+	Meta      *SegmentMetadata
+	MediaData *model.SegmentMediaData
+	Manifest  *c2patypes.Manifest
+	Cert      string
+}
+
+// validate a signed mp4 file unto itself, ignoring whether this user is allowed and whatnot
+func ValidateMP4Media(ctx context.Context, buf []byte) (*ValidationResult, error) {
+	var maniCert ManifestAndCert
+	maniStr, err := iroh_streamplace.GetManifestAndCert(c2patypes.NewReader(aqio.NewReadWriteSeeker(buf)))
+	if err != nil {
+		return nil, err
+	}
+	err = json.Unmarshal([]byte(maniStr), &maniCert)
+	if err != nil {
+		return nil, fmt.Errorf("failed to unmarshal manifest and cert: %w", err)
+	}
+	activeManifest := maniCert.ValidationResults.ActiveManifest
+	if activeManifest != nil {
+		if activeManifest.Failure == nil {
+			return nil, fmt.Errorf("active manifest failure array not found?!")
+		}
+		if len(activeManifest.Failure) > 0 {
+			bs, _ := json.Marshal(activeManifest.Failure)
+			return nil, fmt.Errorf("active manifest has failures: %s", string(bs))
+		}
+	}
+	pub, err := signers.ParseES256KCert([]byte(maniCert.Cert))
+	if err != nil {
+		return nil, err
+	}
+	meta, err := ParseSegmentAssertions(ctx, &maniCert.Manifest)
+	if err != nil {
+		return nil, err
+	}
+	mediaData, err := ParseSegmentMediaData(ctx, buf)
+	if err != nil {
+		return nil, err
+	}
+	return &ValidationResult{
+		Pub:       pub,
+		Meta:      meta,
+		MediaData: mediaData,
+		Manifest:  &maniCert.Manifest,
+		Cert:      maniCert.Cert,
+	}, nil
+}

pkg/media/webrtc_ingest.go

···
 )
 
 // This function remains in scope for the duration of a single users' playback
-func (mm *MediaManager) WebRTCIngest(ctx context.Context, offer *webrtc.SessionDescription, signer MediaSigner, peerConnection rtcrec.PeerConnection, done chan struct{}) (*webrtc.SessionDescription, error) {
+func (mm *MediaManager) WebRTCIngest(ctx context.Context, offer *webrtc.SessionDescription, signer MediaSigner, peerConnection rtcrec.PeerConnection, done chan error) (*webrtc.SessionDescription, error) {
 	uu, err := uuid.NewV7()
 	if err != nil {
 		return nil, err
···
 
 	// Setup complete! Now we boot up streaming in the background while returning the SDP offer to the user.
 	go func() {
+		busErrorChan := make(chan error)
+		go func() {
+			err := HandleBusMessages(ctx, pipeline)
+			if err != nil {
+				log.Log(ctx, "pipeline error", "error", err)
+			}
+			cancel()
+			busErrorChan <- err
+		}()
+
 		defer cancel()
-		defer func() { close(done) }()
+		defer func() { done <- <-busErrorChan }()
 
 		go func() {
 			ticker := time.NewTicker(time.Second * 1)
···
 			}
 		}()
 
-		go func() {
-			if err := HandleBusMessages(ctx, pipeline); err != nil {
-				log.Log(ctx, "pipeline error", "error", err)
-			}
-			cancel()
-		}()
-
 		// subscription to bus messages for key revocation
 		go mm.HandleKeyRevocation(ctx, signer, pipeline)
 
···
 					i, _, readErr := track.Read(buf)
 					if readErr != nil {
 						log.Log(ctx, "failed to read track", "error", readErr)
-						cancel()
-						return
-					}
-					if ctx.Err() != nil {
+						videoSrc.EndStream()
 						return
 					}
+					// if ctx.Err() != nil {
+					// 	return
+					// }
 					if !videoFirst {
 						videoFirst = true
 						log.Debug(ctx, "got video data", "len", len(buf[:i]))
···
 					i, _, readErr := track.Read(buf)
 					if readErr != nil {
 						log.Log(ctx, "failed to read track", "error", readErr)
-						cancel()
-						return
-					}
-					if ctx.Err() != nil {
+						audioSrc.EndStream()
 						return
 					}
+					// if ctx.Err() != nil {
+					// 	return
+					// }
 					if !audioFirst {
 						audioFirst = true
 						log.Debug(ctx, "got audio data", "len", len(buf[:i]))

pkg/media/webrtc_playback.go

···
 		}
 	}()
 
-	concatBin, err := ConcatBin(ctx, segCh)
+	concatBin, err := ConcatBin(ctx, segCh, true)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create concat bin: %w", err)
 	}

pkg/rtcrec/cmd/rtcrec.go

···
 }
 
 func Start() error {
+	if len(os.Args) == 1 {
+		return fmt.Errorf("usage: rtcrec [decode|trim]")
+	}
 	if len(os.Args) > 1 && os.Args[1] == "decode" {
 		return Decode()
 	}
···
 		startCutoff = &time.Time{}
 	}
 	if endDuration == 0 {
-		t := time.Unix(math.MaxInt64, 0)
+		t := time.Unix(math.MaxInt64/2, 0) // i had it set to max but there were rollover issues
 		endCutoff = &t
 	}
 	included := 0
···
 			}
 			continue
 		}
-		if ev.Time.Before(*startCutoff) || ev.Time.After(*endCutoff) {
-			// fmt.Printf("dropped: %s < %s\n", ev.Time.Format(time.RFC3339Nano), cutoff.Format(time.RFC3339Nano))
+		// fmt.Printf("ev.Time: %+v, startCutoff: %+v, endCutoff: %+v\n", ev.Time, *startCutoff, *endCutoff)
+		if ev.Time.Before(*startCutoff) {
 			dropped++
 			continue
 		}
···
 func Decode() error {
 	var path string
 	flag.StringVar(&path, "path", "", "path to the file to decode")
-	flag.Parse()
+	err := flag.CommandLine.Parse(os.Args[2:])
+	if err != nil {
+		return err
+	}
 	if path == "" {
 		return fmt.Errorf("path is required")
 	}

rust/iroh-streamplace/Cargo.toml

···
 postcard = { version = "1.1.3", features = ["use-std"] }
 irpc = "0.9.0"
 irpc-iroh = "0.9.0"
-c2pa = { git = "https://github.com/hyphacoop/c2pa-rs.git", rev = "1b84d40219b27340a30fc309250e774e8a7b7761", features = [
+c2pa = { git = "https://github.com/streamplace/c2pa-rs.git", rev = "544825abfaf9e588813e18dba70c8d5afd039d46", features = [
   "openssl",
   "file_io",
 ] }
···
 iroh-gossip = "0.93.1"
 ref-cast = "1.0.25"
 rand = "0.9"
+base64 = "0.22.1"
 
 [dev-dependencies]
 testresult = "0.4.1"

rust/iroh-streamplace/src/c2pa.rs

···
 use std::{io::Cursor, sync::Arc};
 
-use c2pa::{Builder, CallbackSigner, Reader, settings::Settings};
-use serde_json;
+use c2pa::Builder;
+use c2pa::CallbackSigner;
+use c2pa::Reader;
+use c2pa::settings::Settings;
 
-#[derive(Debug, thiserror::Error, uniffi::Error)]
-#[uniffi(flat_error)]
-pub enum SPError {
-    #[error("No certificate chain found")]
-    NoCertificateChainFound,
-    #[error("C2PA error: {0}")]
-    C2paError(String),
-}
+use c2pa::Ingredient;
+use c2pa::jumbf_io;
+use c2pa::status_tracker::StatusTracker;
+use c2pa::store::Store;
 
+use crate::streams::ManyStreams;
+use crate::streams::Stream;
+use crate::streams::StreamAdapter;
+use serde_json;
+
+use crate::error::SPError;
+use base64::{Engine as _, engine::general_purpose::STANDARD};
 #[uniffi::export]
-pub fn get_manifest_and_cert(data: Vec<u8>) -> Result<String, SPError> {
-    let reader = Reader::from_stream("video/mp4", Cursor::new(data))
+pub fn get_manifest_and_cert(data: &dyn Stream) -> Result<String, SPError> {
+    let reader = Reader::from_stream("video/mp4", StreamAdapter::from(data))
         .map_err(|e| SPError::C2paError(e.to_string()))?;
+
     if let Some(manifest) = reader.active_manifest() {
         let cert_chain = if let Some(si) = manifest.signature_info() {
             si.cert_chain()
···
 
         let result = serde_json::json!({
             "manifest": manifest,
-            "cert": cert_chain
+            "cert": cert_chain,
+            "validation_results": reader.validation_results(),
+            "validation_state": reader.validation_state(),
         });
 
         return Ok(result.to_string());
···
 #[uniffi::export]
 pub fn sign(
     manifest: String,
-    data: Vec<u8>,
-    certs: Vec<u8>,
+    data: &dyn Stream,
+    certs_str: String,
     gosigner: Arc<dyn GoSigner>,
 ) -> Result<Vec<u8>, SPError> {
     Settings::from_toml(TOML_SETTINGS).map_err(|e| SPError::C2paError(e.to_string()))?;
+    let certs = STANDARD
+        .decode(certs_str)
+        .map_err(|e| SPError::C2paError(e.to_string()))?;
     let callback_signer = CallbackSigner::new(
         move |_context: *const (), data: &[u8]| {
-            gosigner
+            let signature = gosigner
                 .sign(data.to_vec())
-                .map_err(|e| c2pa::Error::BadParam(e.to_string()))
+                .map_err(|e| c2pa::Error::BadParam(e.to_string()))?;
+            Ok(signature)
         },
         c2pa::SigningAlg::Es256K,
         certs,
···
     let mut builder =
         Builder::from_json(&manifest).map_err(|e| SPError::C2paError(e.to_string()))?;
     let mut output = Vec::new();
-    let mut input_cursor = Cursor::new(data);
+    let mut input_cursor = StreamAdapter::from(data);
     let mut output_cursor = Cursor::new(&mut output);
     builder
         .sign(
···
         .map_err(|e| SPError::C2paError(e.to_string()))?;
     Ok(output)
 }
+
+#[uniffi::export]
+pub fn get_manifests(data: &dyn Stream) -> Result<String, SPError> {
+    let store = Reader::from_stream("video/mp4", StreamAdapter::from(data))
+        .map_err(|e| SPError::C2paError(e.to_string()))?;
+    let mut certs: std::collections::HashMap<String, String> = std::collections::HashMap::new();
+    for (label, manifest) in store.manifests() {
+        let cert_chain = manifest
+            .signature_info()
+            .ok_or(SPError::C2paError(format!(
+                "No signature info for manifest: {}",
+                label
+            )))?
+            .cert_chain();
+        certs.insert(label.clone(), cert_chain.to_string());
+    }
+    let result = serde_json::json!({
+        "manifests": store.manifests(),
+        "certs": certs
+    });
+    Ok(result.to_string())
+}
+
+#[uniffi::export(with_foreign)]
+pub trait SegmentToSign: Send + Sync {
+    fn unsigned_seg_stream(&self) -> Arc<dyn Stream>;
+    fn manifest_id(&self) -> String;
+    fn cert(&self) -> Vec<u8>;
+    fn output_seg_stream(&self) -> Arc<dyn Stream>;
+    fn close(&self);
+}
+
+#[uniffi::export(with_foreign)]
+pub trait ManySegmentsToSign: Send + Sync {
+    fn next(&self) -> Option<Arc<dyn SegmentToSign>>;
+}
+
+#[uniffi::export]
+pub fn resign(
+    segs_to_sign: &dyn ManySegmentsToSign,
+    signed_concat_data: &dyn Stream,
+) -> Result<(), SPError> {
+    let mut validation_log = StatusTracker::default();
+
+    let combined_store = Store::from_stream(
+        "video/mp4",
+        StreamAdapter::from(signed_concat_data),
+        true,
+        &mut validation_log,
+    )
+    .map_err(|e| SPError::C2paError(format!("from_stream failed: {}", e)))?;
+
+    while let Some(seg) = segs_to_sign.next() {
+        let unsigned_seg_data_stream = seg.unsigned_seg_stream();
+        let manifest_id = seg.manifest_id();
+        let cert = seg.cert();
+        let output_stream = seg.output_seg_stream();
+        let mut input_cursor = StreamAdapter::from(&*unsigned_seg_data_stream);
+        let mut output_cursor = StreamAdapter::from(&*output_stream);
+
+        // let mut output = Vec::<u8>::new();
+        let seg_claim =
+            combined_store
+                .get_claim(manifest_id.as_str())
+                .ok_or(SPError::C2paError(format!(
+                    "Segment claim not found: {}",
+                    manifest_id
+                )))?;
+        let signature_val = seg_claim.signature_val().clone();
+
+        let callback_signer = CallbackSigner::new(
+            move |_context: *const (), _data: &[u8]| Ok(signature_val.clone()),
+            c2pa::SigningAlg::Es256K,
+            cert,
+        );
+
+        let mut seg_store = Store::new();
+        let _provenance = seg_store
+            .commit_claim(seg_claim.clone())
+            .map_err(|e| SPError::C2paError(format!("commit_claim failed: {}", e)))?;
+
+        let jumbf_bytes = seg_store
+            .to_jumbf(&callback_signer)
+            .map_err(|e| SPError::C2paError(format!("to_jumbf failed: {}", e)))?;
+
+        jumbf_io::save_jumbf_to_stream(
+            "video/mp4",
+            &mut input_cursor,
+            &mut output_cursor,
+            &jumbf_bytes,
+        )
+        .map_err(|e| SPError::C2paError(format!("save_jumbf_to_stream failed: {}", e)))?;
+        seg.close();
+    }
+
+    Ok(())
+}
+
+#[uniffi::export]
+pub fn sign_with_ingredients(
+    manifest: String,
+    data: &dyn Stream,
+    certs_str: String,
+    ingredients: &dyn ManyStreams,
+    gosigner: Arc<dyn GoSigner>,
+    output: &dyn Stream,
+) -> Result<(), SPError> {
+    let certs = STANDARD
+        .decode(certs_str)
+        .map_err(|e| SPError::C2paError(e.to_string()))?;
+    Settings::from_toml(TOML_SETTINGS).map_err(|e| SPError::C2paError(e.to_string()))?;
+    let callback_signer = CallbackSigner::new(
+        move |_context: *const (), data: &[u8]| {
+            gosigner
+                .sign(data.to_vec())
+                .map_err(|e| c2pa::Error::BadParam(e.to_string()))
+        },
+        c2pa::SigningAlg::Es256K,
+        certs,
+    );
+    let mut builder =
+        Builder::from_json(&manifest).map_err(|e| SPError::C2paError(e.to_string()))?;
+    while let Some(ingredient) = ingredients.next() {
+        let mut cursor = StreamAdapter::from(&*ingredient);
+        let ingredient = Ingredient::from_stream("video/mp4", &mut cursor)
+            .map_err(|e| SPError::C2paError(e.to_string()))?;
+        builder.add_ingredient(ingredient);
+    }
+    let mut input_cursor = StreamAdapter::from(data);
+    let mut output_cursor = StreamAdapter::from(output);
+    builder
+        .sign(
+            &callback_signer,
+            "video/mp4",
+            &mut input_cursor,
+            &mut output_cursor,
+        )
+        .map_err(|e| SPError::C2paError(e.to_string()))?;
+    Ok(())
+}

rust/iroh-streamplace/src/error.rs

···
+#[derive(Debug, thiserror::Error, uniffi::Error)]
+#[uniffi(flat_error)]
+pub enum SPError {
+    #[error("No certificate chain found")]
+    NoCertificateChainFound,
+    #[error("C2PA error: {0}")]
+    C2paError(String),
+    #[error("IO Error: {0}")]
+    IOError(String),
+}

rust/iroh-streamplace/src/lib.rs

···
 uniffi::setup_scaffolding!();
 
 pub mod c2pa;
+pub mod error;
 pub mod node_addr;
 pub mod public_key;
+pub mod streams;
 
 use std::sync::{LazyLock, Once};
 
···
 pub use db::*;
 #[cfg(test)]
 mod tests;
+
+#[cfg(test)]
+mod test_stream;
 
 /// Lazily initialized Tokio runtime for use in uniffi methods that need a runtime.
 static RUNTIME: LazyLock<tokio::runtime::Runtime> =

rust/iroh-streamplace/src/streams.rs

···
+// Copyright 2023 Adobe. All rights reserved.
+// This file is licensed to you under the Apache License,
+// Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
+// or the MIT license (http://opensource.org/licenses/MIT),
+// at your option.
+
+// Unless required by applicable law or agreed to in writing,
+// this software is distributed on an "AS IS" BASIS, WITHOUT
+// WARRANTIES OR REPRESENTATIONS OF ANY KIND, either express or
+// implied. See the LICENSE-MIT and LICENSE-APACHE files for the
+// specific language governing permissions and limitations under
+// each license.
+
+use crate::error::SPError;
+use std::io::{Read, Seek, SeekFrom, Write};
+use std::sync::Arc;
+
+// #[repr(C)]
+// #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+// pub enum SeekMode {
+//     Start = 0,
+//     End = 1,
+//     Current = 2,
+// }
+
+/// This allows for a callback stream over the Uniffi interface.
+/// Implement these stream functions in the foreign language
+/// and this will provide Rust Stream trait implementations
+/// This is necessary since the Rust traits cannot be implemented directly
+/// as uniffi callbacks
+#[uniffi::export(with_foreign)]
+pub trait Stream: Send + Sync {
+    /// Read a stream of bytes from the stream
+    fn read_stream(&self, length: u64) -> Result<Vec<u8>, SPError>;
+    /// Seek to a position in the stream
+    fn seek_stream(&self, pos: i64, mode: u64) -> Result<u64, SPError>;
+    /// Write a stream of bytes to the stream
+    fn write_stream(&self, data: Vec<u8>) -> Result<u64, SPError>;
+}
+
+impl Stream for Arc<dyn Stream> {
+    fn read_stream(&self, length: u64) -> Result<Vec<u8>, SPError> {
+        (**self).read_stream(length)
+    }
+
+    fn seek_stream(&self, pos: i64, mode: u64) -> Result<u64, SPError> {
+        (**self).seek_stream(pos, mode)
+    }
+
+    fn write_stream(&self, data: Vec<u8>) -> Result<u64, SPError> {
+        (**self).write_stream(data)
+    }
+}
+
+impl AsMut<dyn Stream> for dyn Stream {
+    fn as_mut(&mut self) -> &mut Self {
+        self
+    }
+}
+
+pub struct StreamAdapter<'a> {
+    pub stream: &'a dyn Stream,
+}
+
+impl<'a> StreamAdapter<'a> {
+    pub fn from_stream_mut(stream: &'a mut dyn Stream) -> Self {
+        Self { stream }
+    }
+}
+
+impl<'a> From<&'a dyn Stream> for StreamAdapter<'a> {
+    fn from(stream: &'a dyn Stream) -> Self {
+        Self { stream }
+    }
+}
+
+impl<'a> Read for StreamAdapter<'a> {
+    fn read(&mut self, buf: &mut [u8]) -> std::io::Result<usize> {
+        let mut bytes = self
+            .stream
+            .read_stream(buf.len() as u64)
+            .map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, e))?;
+        let len = bytes.len();
+        buf.iter_mut().zip(bytes.drain(..)).for_each(|(dest, src)| {
+            *dest = src;
+        });
+        //println!("read: {:?}", len);
+        Ok(len)
+    }
+}
+
+impl<'a> Seek for StreamAdapter<'a> {
+    fn seek(&mut self, pos: std::io::SeekFrom) -> std::io::Result<u64> {
+        let (pos, mode) = match pos {
+            SeekFrom::Current(pos) => (pos, 2),
+            SeekFrom::Start(pos) => (pos as i64, 0),
+            SeekFrom::End(pos) => (pos, 1),
+        };
+        //println!("Stream Seek {}", pos);
+        self.stream
+            .seek_stream(pos, mode)
+            .map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, e))
+    }
+}
+
+impl<'a> Write for StreamAdapter<'a> {
+    fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
+        let len = self
+            .stream
+            .write_stream(buf.to_vec())
+            .map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, e))?;
+        Ok(len as usize)
+    }
+
+    fn flush(&mut self) -> std::io::Result<()> {
+        Ok(())
+    }
+}
+
+#[uniffi::export(with_foreign)]
+pub trait ManyStreams: Send + Sync {
+    /// Get the next stream from the many streams
+    fn next(&self) -> Option<Arc<dyn Stream>>;
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    use crate::test_stream::TestStream;
+
+    #[test]
+    fn test_stream_read() {
+        let mut test = TestStream::from_memory(vec![0, 1, 2, 3, 4, 5, 6, 7, 8, 9]);
+        let mut stream = StreamAdapter::from_stream_mut(&mut test);
+        let mut buf = [0u8; 5];
+        let len = stream.read(&mut buf).unwrap();
+        assert_eq!(len, 5);
+        assert_eq!(buf, [0, 1, 2, 3, 4]);
+    }
+
+    #[test]
+    fn test_stream_seek() {
+        let mut test = TestStream::from_memory(vec![0, 1, 2, 3, 4, 5, 6, 7, 8, 9]);
+        let mut stream = StreamAdapter { stream: &mut test };
+        let pos = stream.seek(SeekFrom::Start(5)).unwrap();
+        assert_eq!(pos, 5);
+        let mut buf = [0u8; 5];
+        let len = stream.read(&mut buf).unwrap();
+        assert_eq!(len, 5);
+        assert_eq!(buf, [5, 6, 7, 8, 9]);
+    }
+
+    #[test]
+    fn test_stream_write() {
+        let mut test = TestStream::new();
+        let mut stream = StreamAdapter { stream: &mut test };
+        let len = stream.write(&[0, 1, 2, 3, 4]).unwrap();
+        assert_eq!(len, 5);
+        stream.seek(SeekFrom::Start(0)).unwrap();
+        let mut buf = [0u8; 5];
+        let len = stream.read(&mut buf).unwrap();
+        assert_eq!(len, 5);
+        assert_eq!(buf, [0, 1, 2, 3, 4]);
+    }
+}

rust/iroh-streamplace/src/test_stream.rs

···
+// Copyright 2023 Adobe. All rights reserved.
+// This file is licensed to you under the Apache License,
+// Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
+// or the MIT license (http://opensource.org/licenses/MIT),
+// at your option.
+
+// Unless required by applicable law or agreed to in writing,
+// this software is distributed on an "AS IS" BASIS, WITHOUT
+// WARRANTIES OR REPRESENTATIONS OF ANY KIND, either express or
+// implied. See the LICENSE-MIT and LICENSE-APACHE files for the
+// specific language governing permissions and limitations under
+// each license.
+
+use std::io::{Read, Seek, SeekFrom, Write};
+use std::sync::RwLock;
+
+use crate::error::SPError;
+use crate::streams::Stream;
+use std::io::Cursor;
+
+pub struct TestStream {
+    stream: RwLock<Cursor<Vec<u8>>>,
+}
+
+impl TestStream {
+    pub fn new() -> Self {
+        Self {
+            stream: RwLock::new(Cursor::new(Vec::new())),
+        }
+    }
+    pub fn from_memory(data: Vec<u8>) -> Self {
+        Self {
+            stream: RwLock::new(Cursor::new(data)),
+        }
+    }
+}
+
+impl Stream for TestStream {
+    fn read_stream(&self, length: u64) -> Result<Vec<u8>, SPError> {
+        if let Ok(mut stream) = RwLock::write(&self.stream) {
+            let mut data = vec![0u8; length as usize];
+            let bytes_read = stream
+                .read(&mut data)
+                .map_err(|e| SPError::IOError(e.to_string()))?;
+            data.truncate(bytes_read);
+            //println!("read_stream: {:?}, pos {:?}", data.len(), (*stream).position());
+            Ok(data)
+        } else {
+            Err(SPError::IOError("RwLock".to_string()))?
+        }
+    }
+
+    fn seek_stream(&self, pos: i64, mode: u64) -> Result<u64, SPError> {
+        if let Ok(mut stream) = RwLock::write(&self.stream) {
+            //stream.seek(SeekFrom::Start(pos as u64)).map_err(|e| StreamError::Io{ reason: e.to_string()})?;
+            let whence = match mode {
+                0 => SeekFrom::Start(pos as u64),
+                1 => SeekFrom::End(pos as i64),
+                2 => SeekFrom::Current(pos as i64),
+                3_u64..=u64::MAX => unimplemented!(),
+            };
+            Ok(stream
+                .seek(whence)
+                .map_err(|e| SPError::IOError(e.to_string()))?)
+        } else {
+            Err(SPError::IOError("RwLock".to_string()))
+        }
+    }
+
+    fn write_stream(&self, data: Vec<u8>) -> Result<u64, SPError> {
+        if let Ok(mut stream) = RwLock::write(&self.stream) {
+            let len = stream
+                .write(&data)
+                .map_err(|e| SPError::IOError(e.to_string()))?;
+            Ok(len as u64)
+        } else {
+            Err(SPError::IOError("RwLock".to_string()))?
+        }
+    }
+}

subprojects/gstreamer-full.wrap

···
 [wrap-git]
 url = https://gitlab.freedesktop.org/iameli/gstreamer.git
-revision = 5c372f9595b7024d1074e45ee50b68b7a9a3f5e3
+revision = 587f2f9d8678df804515dac40aaac0a732c32c00
 depth = 1

test/remote/remote-fixtures.go

···
 package remote
 
 import (
+	"archive/tar"
+	"compress/gzip"
 	"crypto/sha256"
 	"encoding/hex"
 	"fmt"
···
 
 	return finalPath
 }
+
+// takes a tarball, returns a directory with the contents
+func RemoteArchive(name string) string {
+	fpath := RemoteFixture(name)
+
+	// Create extracted directory adjacent to the archive file
+	dir := filepath.Dir(fpath)
+	extractedDir := filepath.Join(dir, "extracted")
+
+	if err := os.MkdirAll(extractedDir, 0755); err != nil {
+		panic(err)
+	}
+
+	// Extract the tarball contents into the directory
+	file, err := os.Open(fpath)
+	if err != nil {
+		panic(err)
+	}
+	defer file.Close()
+
+	// Create gzip reader
+	gzr, err := gzip.NewReader(file)
+	if err != nil {
+		panic(err)
+	}
+	defer gzr.Close()
+
+	tr := tar.NewReader(gzr)
+	for {
+		header, err := tr.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			panic(err)
+		}
+
+		target := filepath.Join(extractedDir, header.Name)
+
+		switch header.Typeflag {
+		case tar.TypeDir:
+			if err := os.MkdirAll(target, 0755); err != nil {
+				panic(err)
+			}
+		case tar.TypeReg:
+			// Create parent directories if needed
+			if err := os.MkdirAll(filepath.Dir(target), 0755); err != nil {
+				panic(err)
+			}
+
+			outFile, err := os.Create(target)
+			if err != nil {
+				panic(err)
+			}
+
+			if _, err := io.Copy(outFile, tr); err != nil {
+				outFile.Close()
+				panic(err)
+			}
+			outFile.Close()
+		}
+	}
+
+	return extractedDir
+}