noir.photos — rebuilding, relinking and replacing libheif ========================================================== Scope ----- This release puts the LGPL-covered HEIF decoder in the lazily loaded /assets/heic.worker-*.js file. That file is a statically combined work: it contains the noir.photos worker wrapper, libheif, libde265 and the WebAssembly binary as embedded data. There is no separate libheif-bundle file. The decoder is not present in the initial application module. This arrangement avoids a Firefox interoperability failure when a module worker dynamically imports the 1.46 MB decoder module. The dedicated worker keeps HEIF code off the initial path, preserves a narrow message interface and can be rebuilt and replaced as one asset. The following section provides the LGPL-3.0 section 4(d)(0) relinking path for that actual shipped arrangement. The exact corresponding-source archives and SHA-256 checksums are listed in /THIRD_PARTY_NOTICES.txt and shipped under /sources/. The relevant versions are libheif-js 1.19.8, libheif-emscripten 1.19.8, libheif 1.19.8 and libde265 1.0.15. The shipped libheif-emscripten workflow pins Ubuntu 22.04 and Emscripten 3.1.61 in .github/workflows/emscripten.yml. Build a modified decoder module ------------------------------- 1. Verify the archive hashes against /THIRD_PARTY_NOTICES.txt and extract all four archives into one work directory. 2. Put the extracted (and, if desired, modified) libheif 1.19.8 tree at libheif-emscripten-1.19.8/libheif. Keep libde265 1.0.15 available where the libheif scripts expect it. Use Ubuntu 22.04 with Emscripten 3.1.61 and run the commands recorded by the shipped workflow: cd libheif-emscripten-1.19.8/libheif ./scripts/install-ci-linux.sh ./scripts/prepare-ci.sh sed 's/USE_WASM=0/USE_WASM=1 USE_UNSAFE_EVAL=0/g' \ ./scripts/run-ci.sh > ./scripts/run-ci-wasm.sh chmod +x ./scripts/run-ci-wasm.sh ./scripts/run-ci-wasm.sh cd .. ./dist-prep.sh wasm This produces dist/libheif.js, dist/libheif.wasm and dist/libheif.d.ts. 3. Extract libheif-js 1.19.8, install its declared development dependencies, and place the three files from step 2 in its libheif-wasm/ directory. Its shipped scripts/bundle.js is the entry point used by scripts/install.js to combine libheif.js and libheif.wasm into libheif-bundle.mjs. Run the same ESM esbuild job defined in scripts/install.js (target es2019, bundle and minify enabled, .wasm loader "binary", platform "neutral", format "esm", and the shipped node-modules polyfill plugin). The resulting file must be: libheif-js-1.19.8/libheif-wasm/libheif-bundle.mjs Relink noir.photos from source ------------------------------ 1. Use Node.js 22.12 or newer. Obtain the noir.photos application source that corresponds to this release and run "npm ci". 2. Replace this installed file with the modified module from the build above: node_modules/libheif-js/libheif-wasm/libheif-bundle.mjs 3. Run "npm run build". Vite statically combines the modified module with src/engine/heic.worker.ts and emits a new dist/assets/heic.worker-.js. The embedded WASM data is part of this worker file. Run "npm run unit" and the Firefox HEIF browser test before use. Direct replacement in an already built distribution ---------------------------------------------------- 1. Complete the rebuild above. Locate the sole newly emitted dist/assets/heic.worker-.js. It implements the same message protocol as the original worker: a decode request with an ArrayBuffer and progress, success or error responses. 2. In an existing built distribution, either copy the rebuilt worker over the original dist/assets/heic.worker-.js while preserving the old filename, or deploy it under the new filename together with the rebuilt application modules that reference it. No signature or integrity check prevents either replacement. 3. Serve the modified files and verify that a HEIF image decodes. Purge or update immutable cache metadata whenever bytes change, even if the old filename was preserved.