README

   1 libera te tutemet ex inferis
   2
   3 == Overview ==
   4
   5 This package builds a GDK Pixbuf Loader for the SVG format that uses
   6 libsvgtiny:
   7
   8   https://www.netsurf-browser.org/projects/libsvgtiny/
   9
  10 Why? I'm glad you asked!
  11
  12 GTK (https://www.gtk.org/) is a toolkit that powers many modern
  13 desktop environments and applications. GTK uses an abstraction called
  14 a GdkPixbuf for all of its images. When GTK wants to display an icon,
  15 it first loads that icon into a GdkPixbuf before displaying the result
  16 on the screen. GTK itself knows how to import many common formats like
  17 PNG and JPEG into a GdkPixbuf and can handle those formats
  18 out-of-the-box. The programs that handle the importing of the various
  19 formats are called "pixbuf loaders."
  20
  21 Problem: GTK doesn't know the size of your screen, but it needs to
  22 display icons and images at an appropriate size. How big is that? Good
  23 question: nobody knows. For that reason, GTK makes heavy use of
  24 Scalable Vector Graphics (SVGs). It's much wiser to store one SVG and
  25 scale it to the desired size -- once you know what that is -- than it
  26 would be to store multiple copies of a non-scalable image at each of
  27 the sizes you might need. But, as you may have guessed, GTK itself
  28 doesn't know how to import an SVG into a GdkPixbuf. It doesn't come
  29 with the corresponding pixbuf loader.
  30
  31 The blessed solution to this problem is to use librsvg:
  32
  33   https://wiki.gnome.org/Projects/LibRsvg
  34
  35 That package builds a pixbuf loader that can be plugged into GTK,
  36 allowing it to import SVG files into a GdkPixbuf, and everything is
  37 great. Or was, until January 3rd, 2017. On that day, librsvg-2.41.0
  38 became the only dependency of GTK that requires Rust, which in turn
  39 requires LLVM. The rest of GTK (and its dependencies) are written in C
  40 or C++. This has several downsides:
  41
  42   * Rust is big and slow to compile
  43   * LLVM is big and slow to compile
  44   * Rust is far less portable than C; it doesn't run on as many CPUs
  45   * The Rust ecosystem ironically burdens you with easily-avoidable
  46     security vulnerabilities [0].
  47
  48 It's not feasible to keep the old librsvg around forever, because that
  49 will ALSO result in security vulnerabilities. Which brings us to...
  50
  51 == Why ==
  52
  53 Because if you have a problem with any of the bullet points above,
  54 then you need to replace librsvg if you want to keep using GTK. And,
  55
  56   * libsvgtiny is written in portable C
  57   * libsvgtiny is still maintained; there are no open security
  58     issues
  59   * libsvgtiny is already packaged on a few distributions as part of
  60     the netsurf browser
  61
  62 == Caveats ==
  63
  64 The main downside is that libsvgtiny isn't as robust as librsvg. It
  65 renders some things wrong, or a bit uglier than its counterpart. These
  66 are in theory all fixable upstream however, and you will help the
  67 netsurf browser by doing so.
  68
  69 One especially relevant shortcoming is that libsvgtiny doesn't handle
  70 <style> elements within SVG files, and it therefore doesn't encode
  71 GTK's "symbolic SVGs" correctly. Instead of the bright-green layered
  72 abomination that GTK is expecting, we just get the original image
  73 back. This will probably cause problems in corner cases, but it's
  74 still better than nothing.
  75
  76 == Components ==
  77
  78 This package builds three things:
  79
  80  1. The pixbuf loader, libpixbufloader-libsvgtiny.so. It's a shared
  81     library that should probably be installed in the directory where
  82     all your other pixbuf loaders go. This is system-specific, but the
  83     command
  84
  85       pkg-config --variable gdk_pixbuf_moduledir gdk-pixbuf-2.0
  86
  87     should tell you what it is. Afterwards, you have to run
  88     "gdk-pixbuf-query-loaders --update-cache" to tell GTK about it.
  89     The man page for gdk-pixbuf-query-loaders mentions some
  90     environment variables that can be used for more complicated
  91     installations.
  92
  93   2. A GTK thumbnailer entry, libsvgtiny.thumbnailer, that tells GTK
  94      how to create thumbnails of SVG images. (Spoiler: we just run
  95      gdk-pixbuf-thumbnailer.)
  96
  97   3. A test program, svg2png, that converts an SVG to a PNG. It does
  98      this by loading an SVG into a pixbuf, and then saving that pixbuf
  99      as a PNG. Unless you override GDK_PIXBUF_MODULE_FILE, it will use
 100      the pixbuf loaders from the system location, so you probably have
 101      to install libpixbufloader-libsvgtiny.so and update the loader
 102      cache before svg2png will use it.
 103
 104 == References ==
 105
 106   [0] https://blogs.gentoo.org/mgorny/2021/02/19/the-modern-packagers-security-nightmare/