Dependency on libwebp: How do you configure or build Pillow without libwebp support?

[chandanbn]

Hello,

For our use case, we don't really need libwebp, but it got pulled in as a dependency.
What is the best approach to eliminate this dependency without forking Pillow code?

Thank you!

[homm]

pulled in as a dependency where?

[chandanbn]

For eg here: https://centos.pkgs.org/8-stream/centos-appstream-x86_64/python3-pillow-5.1.1-16.el8.x86_64.rpm.html says libwebp is a dependency.

[homm]

The Pillow team doesn't issue rpm packages, so this is question about rpm.

However, you can install install Pillow (and this is a recommended way) through pip. In this case, libwebp will also be installed, but not via system package manager.

[chandanbn]

Regardless pip or rpm, what do you need to do remove the dependency on libwebp altogether? or tell Pillow to not support webp images?

Is it a hard dependency (i.e Pillow doesn't work without it) or a soft dependency (i.e Pillow will work fine, but fail gracefully when handling webp images)?

Asking this because of the recent critical CVE libwebp - and we want to minimize our dependencies. i.e remove libwebp from the system - because we are never going to deal with webp images.

[homm]

it's a soft dependency. You can remove it from the default list of formats:

from PIL import Image
Image.init()  # This is required
Image.ID.remove('WEBP')
Image.open('space.webp')
>>> UnidentifiedImageError: cannot identify image file 'space.webp'

[ipmincubus1369]

Hi Homm,

Python-Pillow is installed as a dependency from reportlab, we don't have control to their code. If we simply remove libwebp from spec file, would it work?

[radarhere]

If libwebp isn't installed, Pillow will continue to work with other images. It is an optional dependency.

An alternative method to disable WebP use in Pillow would be

from PIL import Image, WebPImagePlugin
WebPImagePlugin.SUPPORTED = False
im = Image.open("Tests/images/hopper.webp")

As per #2309 this will raise a warning if Pillow encounters a WebP file.