Enable the network half of the HF cache resolver. whisper_hf_resolve_model
now (unless HF_HUB_OFFLINE is set) lists the repo over the HF API, picks the
primary file (exact --hf-file, else first ggml-*.bin), downloads it into the
blobs/<oid> + snapshots/<commit> layout via a slim hf_cache::download_file,
and falls back to the Phase 1 on-disk cache scan on empty listing or network
failure. HF_TOKEN is honored for the Authorization: Bearer header.
HTTPS is gated behind a new WHISPER_OPENSSL CMake option (find_package OpenSSL,
CPPHTTPLIB_OPENSSL_SUPPORT, link OpenSSL::SSL/Crypto); an https attempt in a
non-SSL build prints the rebuild hint.
download_file follows redirects manually and disables httplib url-encoding:
cpp-httplib 0.20 (whisper's vendored version) both mishandles cross-host
redirects and re-encodes the already-encoded signed xet CDN URL, corrupting
the presigned query string into a 403. The bearer token is dropped on
cross-host (CDN) redirects.
tests/test-hf-resolve.sh gains an offline fall-back case (HF_HUB_OFFLINE=1),
a WHISPER_CLI override, and an optional no-OpenSSL rebuild-hint check.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Port llama.cpp's HuggingFace hub-cache subsystem (http.h, hf-cache.{h,cpp})
into whisper.cpp's shared common library and wire -hf/--hf-repo +
-hff/--hf-file into whisper-cli. Phase 1 is cache-only: whisper_hf_resolve_model
scans the on-disk HF hub cache (get_cached_files + finalize_file) and maps
org/repo (+ optional file) to a concrete snapshot path, so a model already
pulled by the hf CLI resolves with no -m path. An explicit -m still wins and
the no-args default stays models/ggml-base.en.bin.
The network download path is compiled but unused this phase (enabled in
Phase 2). Adds tests/test-hf-resolve.sh covering cache hit, missing-file
error (exit 3), -m regression, and the default path.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Dominic Dones