libvips built without JPEG2000 support

[LionelArn2]

Hello :)

I'm trying to export Jp2k images using .Tiffsave but I get a libvips built without JPEG2000 support error. I'm using the NetVips 2.0.1 NuGet package and tried both NetVips.Native 8.11.3.1 and NetVips.Native.win-x64 8.11.3.1.

Could it be that some dependencies are missing in the build provided by the NuGet package?

[kleisauke]

Saving TIFF images with JP2K compression requires libvips to be compiled against OpenJPEG. For security reasons, the pre-compiled binaries released on NuGet do not include OpenJPEG. See for example CVE-2021-3575, which is still not fixed.

The pre-compiled binaries distributed on NuGet are intended to get people up and running as quickly as possible with the most popular web-based formats. You can always roll your own combination of libvips' dependencies, NetVips will look for a global installation if the NetVips.Native NuGet package isn't installed.

On Linux or macOS it's easy to compile against OpenJPEG. On Windows, you can download the -all variant from here:
https://github.com/libvips/build-win64-mxe/releases

Note that the libvips binary vips-dev-w64-all-x.y.z.zip contains ALL the file format loaders that libvips supports, including some very minor ones, and a complete copy of ImageMagick. It can process many different file types, but it is also rather vulnerable to hacking. It also contains GPL licensed libraries, so it's slightly problematic to distribute binaries that uses this variant.

[LionelArn2]

Thank you for the detailed explanation, I could make it work using the Windows builds you mentioned (and after removing the NetVips.Native NuGet packages) !

The vulnerabilities of OpenJPEG are indeed a potential issue, thanks for bringing it up.

[LionelArn2]

I noticed on https://access.redhat.com/errata/RHSA-2021:4251 that the recent OpenJPEG 2.4.0 release includes a bunch of security fixes. Are you planning to include OpenJPEG in the pre-compiled NuGet binaries in the future? Or is jpeg2000 not popular enough?

[kleisauke]

Those fixes are not present in any released version of OpenJPEG. I'm not aware of any plans to include OpenJPEG by default in the pre-compiled libvips binaries. Issue libvips/build-win64-mxe#40 might also be relevant here.

[kleisauke]

I'll close this as "won't fix". In my opinion, JPEG2000 has no real benefits; it primarily serves as a compatibility solution for legacy software that still uses it.