Enable the network half of the HF cache resolver. whisper_hf_resolve_model
now (unless HF_HUB_OFFLINE is set) lists the repo over the HF API, picks the
primary file (exact --hf-file, else first ggml-*.bin), downloads it into the
blobs/<oid> + snapshots/<commit> layout via a slim hf_cache::download_file,
and falls back to the Phase 1 on-disk cache scan on empty listing or network
failure. HF_TOKEN is honored for the Authorization: Bearer header.
HTTPS is gated behind a new WHISPER_OPENSSL CMake option (find_package OpenSSL,
CPPHTTPLIB_OPENSSL_SUPPORT, link OpenSSL::SSL/Crypto); an https attempt in a
non-SSL build prints the rebuild hint.
download_file follows redirects manually and disables httplib url-encoding:
cpp-httplib 0.20 (whisper's vendored version) both mishandles cross-host
redirects and re-encodes the already-encoded signed xet CDN URL, corrupting
the presigned query string into a 403. The bearer token is dropped on
cross-host (CDN) redirects.
tests/test-hf-resolve.sh gains an offline fall-back case (HF_HUB_OFFLINE=1),
a WHISPER_CLI override, and an optional no-OpenSSL rebuild-hint check.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
4d4aa7bc46