Thank you for maintaining this until now :)

[dzuelke]

Hi @brandoncc.

Thank you for maintaining this buildpack up to this point.

All Heroku stacks now have libvips runtime libraries as well as the various Poppler utils available: https://devcenter.heroku.com/changelog-items/2549

Maybe it would be possible to archive this repository and place a note at the top of README?

Ideally, bin/compile could also be changed to a no-op, or print a message to notify users.

[jrochkind]

@dzuelke just noticed this. As a vips user, what would it take to get the vips CLI tools installed on heroku, in the presence of libvips? Or should it already be there?? I would love to have this without a third-party build-pack.

[jrochkind]

@dzuelke deleted my last comment... I think I got confused, at present I do not seem to have access to vips command line on either heroku-20 or heroku-22, without this buildpack.

~ $ vips -l
bash: vips: command not found

So just making this buildpack a no-op would leave anyone who wants vips command-line utilities out of luck. Perhaps libvips is installed, but vips command line utilities is a separate package? This buildpack does leave you with vips command-line utilities.

If you can provide any info about the "right" way to get vips CLI on heroku-20 or heroku-22, in light of the changelog you mention, it would be helpful!

[jrochkind]

@dzuelke OK, more info....

While the libvips package is now installed on heroku-*, we actually need the libvips-tools package to get vips and vipsthumbnail CLIs -- that this buildpack would install. https://github.com/libvips/libvips/wiki/Build-for-Ubuntu

I also use the heroku-community/apt buildpack -- which I've been told is not officially supported, but popular. In the past, before https://devcenter.heroku.com/changelog-items/2549, I had not been succesful at using that mechanism to get vips installed. Which is what brought me to this buildpack.

But now, with https://devcenter.heroku.com/changelog-items/2549 -- can I list libvips-tools in Aptfile, with heroku-community/apt, and get vips command line?

It appears successful. I'll need a bit more testing to be sure.

• On both heroku-20 and heroku-22, vips appears to have PDF support via poppler, which is great!
• On heroku-22, we have jpeg2000 support via OpenJPEG, but not on heroku-20. This seems to matche what this buildpack found even using this buildpack. heroku-22 log includes "JPEG2000 load/save with libopenjp2: yes", heroku-20 log does not.

I need JPEG2000 support via OpenJPEG. I originally came to this repo to troubleshoot that, and found this ticket.

Apparently I can get what I need on heroku-22 -- and without this buildpack.

There is still no supported way to get vips CLI -- if the apt buildpack is not officially supported -- but it can now be done with libvips-tools in the Aptfile and the unsupported apt buildpack.

(I would love it if heroku would make the popular Aptfile buildpack officially supported, and improve it by resolving long-running bug which prevents loading from non-default apt repos).

[brandoncc]

Thank you for letting us know about this @dzuelke

While I'm intrigued by the idea of using a built-in library instead of maintaining this buildpack, I'm concerned that we will lose the ability to update the vips library. Can you share any information about how often, if at all, we can expect vips to be updated?

I'm also concerned about the loss of the CLI tool, as others have expressed.

[dzuelke]

It's the libvips versions from upstream, so https://packages.ubuntu.com/jammy/libvips42 for heroku-22 and https://packages.ubuntu.com/focal/libvips42 for heroku-20.

They'll only get critical security fixes backported, not normal version updates, as is customary with LTS operating system releases.

The CLI tools, for folks who need them, can indeed be installed using the Apt buildpack, although that will pull in 187 MB of unneeded cruft as the package not only recommends nip2, but for some bizarre reason also suggests libvips-dev.

[jrochkind]

So with heroku-22 without this buildpack but with libvips-tools (@dzuelke can you think of any better way to get command-line tools?), today gives me a vips -v of vips-8.12.1-Wed Feb 2 14:43:28 UTC 2022

Heroku-22 with this buildpack, today, gives me a vips -v of 8.13.0

Here's the thing -- I came here to try to investigate getting a vips that could write .jp2, which either of these paths on heroku-22 can do -- but both of them are producing weird/bad output for some of my test data....

...Which I cannot reproduce on my MacOS machine with vips (view brew, so I can't really choose the version) 8.14.2.

So I don't really know that the vips version is the problem -- maybe it's the version of the OpenJPEG library that ends up linked on heroku-22 (but not heroku-20) somehow? But I would be curious to see if latest vips 8.14.2 on heroku fixed the matter.... if it did that would add strength to the concern over being able to get a more recent vips version.

my problem is related to colors, and I do see some color profile related issues in CHANGELOG since 8.13.0, the one that is most suspicious to me is fix thumbnail of non-sRGB images with an export profile [kleisauke] (8.13.3), as that does seem to describe my test case, actually.

@brandoncc , ...any interest in updating to vips 8.14.2? :)

Also, this is the only third-party heroku buildpack I have encountered among things relevant to me, that is actually maintained, like quickly updated to work with heroku-22 and have README say that, etc. So THANK YOU. And if you plan to keep maintaining this, to allow access to more recent vips than ubuntu/heroku (bugfixes do happen), that would be amazing... but also my experience with abandoned third-party buildpacks is also what makes me interested in a way to get vips command line without one... but currently both paths are giving me a vips that is producing bad output for me compared to my MacOS install.

[jrochkind]

So, jcupitt vips author suspects my use case has run into a problem when running vips 8.13.0 and previous, that is fixed in vips 8.14.0.

(It's actually a problem with the OpenJPEG library for jpeg2000, that vips works around in more recent versions).

So... it's just a coincidence that working with Jpeg2000 is what brought me to the repo to notice this ticket and restart discussion on it.... and which also seems to have brought me to a demonstration of why it is in some cases necessary to install more recent versions of vips than the heroku stack ubuntu has. :(

I am working on compiling libvips 8.14.0 in my own fork to test it out, but not very familiar with the process, and not sure if I can do it on a Mac or not. Either way, @dzuelke , any interest in updating to a more recent vips in this repo?

[jrochkind]

(Sorry for so many messages, I have discovered a workaround with older versions of vips, but point probably stands!)

[brandoncc]

@brandoncc , ...any interest in updating to vips 8.14.2? :)

Also, this is the only third-party heroku buildpack I have encountered among things relevant to me, that is actually maintained, like quickly updated to work with heroku-22 and have README say that, etc. So THANK YOU. And if you plan to keep maintaining this, to allow access to more recent vips than ubuntu/heroku (bugfixes do happen), that would be amazing... but also my experience with abandoned third-party buildpacks is also what makes me interested in a way to get vips command line without one... but currently both paths are giving me a vips that is producing bad output for me compared to my MacOS install.

Thank you for the kind words.

So, jcupitt vips author suspects my use case has run into a problem when running vips 8.13.0 and previous, that is fixed in vips 8.14.0.

@jcupitt is so helpful, he is definitely in my top five favorite open source contributors!

So... it's just a coincidence that working with Jpeg2000 is what brought me to the repo to notice this ticket and restart discussion on it.... and which also seems to have brought me to a demonstration of why it is in some cases necessary to install more recent versions of vips than the heroku stack ubuntu has. :(

I am working on compiling libvips 8.14.0 in my own fork to test it out, but not very familiar with the process, and not sure if I can do it on a Mac or not. Either way, @dzuelke , any interest in updating to a more recent vips in this repo?

If you have docker installed, it should be very simple to compile 8.14.2. The instructions below reference 8.14.3 though, because it was released 52 minutes ago.

1. Fork the repo
2. Clone your fork
3. git checkout -b 8.14.3-update
4. VIPS_VERSION=8.14.3 ./build.sh
5. git add .
6. git commit -m "Update to 8.14.3"
7. Push your branch to your fork
8. Open a PR for the branch against this repo

Note
If you have a computer with Apple Silicon, it takes ~1 hour to run the build script. If you have an older Intel-based Mac, the process goes much faster if I remember correctly.

(Sorry for so many messages, I have discovered a workaround with older versions of vips, but point probably stands!)

No problem, this is a healthy discussion and very useful for others who might search for the issue you are having!

---

In order to have a healthier update cycle, I am going to continue maintaining the buildpack for the foreseeable future. If the time comes when I do not need the buildpack myself anymore, I will re-evaluate that decision and possibly deprecate or hand it off to someone else to maintain. I will add a comment to the README mentioning that the buildpack is not strictly needed anymore, so that those who don't need it are aware.

If I don't see a PR for this update by this weekend, I will look for some time to update it myself. If I do see a PR, I will very happily merge it.

Thank you all for your contributions to this discussion.

[jcupitt]

Sorry, I'm a bit late to this interesting discussion.

The CLI tools, for folks who need them, can indeed be installed using the Apt buildpack, although that will pull in 187 MB of unneeded cruft as the package not only recommends nip2, but for some bizarre reason also suggests libvips-dev.

Yes, this can be very annoying! The Debian maintainer swears this is now finally fixed, but for older Deb-derived package lists you can use apt install libvips-tools --no-install-recommends.

Another issue is that the Deb package includes every possible loader, including several which are extremely vulnerable to exploitation. If you give untrusted internet files to Debian libvips, you can be trivially 0wned. Now that heroku bundle an insecure libvips as the default image handler for rails, that's a lot of very vulnerable sites, and a lot of customers about to be very angry.

(having said that, if something upstream of libvips is sniffing data and reliably blocking anything that doesn't look like one of the trusted formats, it's probably OK)

We've added a feature in 8.13 to address this: if you set the VIPS_BLOCK_UNTRUSTED env var, then libvips will disable any unfuzzed loaders at runtime. This makes you reasonably secure, no matter how the libvips binary was built.

Sadly, 8.13 is still too recent to be in heroku-22 and we'll have to wait for heroku-24. So I think this buildpack is still the best way to install libvips on heroku, at least until then.

[jcupitt]

Here's the dep list for the libvips in 22.04:

https://packages.ubuntu.com/jammy/libvips-dev

You can see there are a number of very ill-advised packages in there which you would certainly not want to give untrusted data to.

[brandoncc]

Thank you for this information, John. This reinforces my decision to continue maintaining the buildpack, and is also full of information I didn't know about.

[brandoncc]

I finally have a PR for the 8.14.3 update. I will probably merge it tomorrow. One thing to be aware of is that the build now uses pdfium instead of poppler.