Disable most gdk-pixbuf loaders

[hadess]

There should be no gdk-pixbuf loaders in the base system apart from: JPEG, PNG and SVG (through librsvg's gdk-pixbuf module) after https://bugzilla.gnome.org/show_bug.cgi?id=786035 has been committed.

The idea is that those are the 3 basic image types necessary to run applications. Applications that require other loaders would install them as part of their application, in a separate directory, and with a separate loaders.cache file, and then call gdk_pixbuf_init_modules() on that directory.

This will greatly reduce application's attack surface.

[alexlarsson]

I think GIF is common enough to be important too, so that should be supported. Otherwise I think that makes sense.

gdk-pixbuf is part of the freedesktop.org runtime which has a longer lifecycle than the gnome runtime though, so we'll have to keep the current setup until fd.o 1.8. That said, we could perhaps delete some of the plugins in the derived gnome runtime.

[pwithnall]

I think GIF is common enough to be important too, so that should be supported. Otherwise I think that makes sense.

Applications ship GIF images in their resources? The idea here is that almost all icons and other application resources are PNG or SVG, so there’s no point in having the code for other image formats available for all applications to run, since they should never need them. Applications which load images from the internet or need to display user-provided images can (and should) specifically bundle and load more gdk-pixbuf loaders. That’s the intention, right, @hadess?

[hadess]

Exactly right. eog would ship with everything added, corebird would add GIF support, Photos apps would add support for TIFF and RAW images...

[alexlarsson]

I don't think that is necessarily the right approach. A lot of apps would have to bundle gif support, which might then not get timely updates, no?

[pwithnall]

What apps need GIF support apart from chat apps?

[hadess]

What apps need GIF support apart from chat apps?

And even then. I'm fairly certain that corebird is being served videos by Twitter, and chat apps would use a web view which would have its own GIF loader.

Even so, if a loader is particularly used, I'd be up for being told that, and making sure that those loaders are great loaders in gdk-pixbuf. Right now, everything but the ones I mentioned are of pretty poor quality.

[alexlarsson]

Apparently twitter can still return gif files as avatars at least, so corebird is an example of something that would have to bundle the gif loader.

[hadess]

As discussed on IRC, we'll probably put this in place when we have a GIF loader that can be maintained. The current version is just horrible to support.

[hadess]

I'd like to add that, apart from the exclusion of GIF in my initial request, we agreed on the premise of this issue.

[hadess]

See https://bugzilla.gnome.org/show_bug.cgi?id=739202