# libwebp, vendored

Curatory's one bundled dependency. It exists for a single reason: **no native macOS API
encodes WebP.** ImageIO decodes it (verified on macOS 26.5.2), and `CGImageDestinationCopyTypeIdentifiers()`
still lists no WebP destination. WebP is the Slack target, so the gap has to be filled.

## Provenance

| | |
|---|---|
| Version | 1.6.0 |
| Source | <https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.6.0.tar.gz> |
| SHA-256 | `e4ab7009bf0629fd11982d4c2aa83964cf244cffba7347ecd39019a9e38c4564` |
| License | BSD-3-Clause (`COPYING`), plus `PATENTS` |

Unmodified Google source. Anything that ever changes in here shows up as a diff in Curatory's
own history, which is the entire reason it is vendored rather than pulled from a package — see
decision 13 in `restoration-plan.md`. It buys **auditability, not a smaller attack surface**:
the same C compiles into the app either way.

## What's here, and what isn't

Kept: `src/{dec,dsp,enc,mux,utils,webp}` and `sharpyuv/`.

Dropped: `demux/` (we never read a WebP — ImageIO does), plus the build system, `examples/`,
`extras/`, `imageio/`, `tests/`, `swig/`, docs, and man pages.

**The decoder is not optional.** `src/mux/anim_encode.c` includes `src/webp/decode.h` and calls
`WebPDecode`: the animated encoder decodes frames it just encoded in order to diff them.
libwebp's own makefile agrees, putting the decoder objects inside its *encode* library. There
is no encode-only build, and pretending otherwise was an early plan assumption that the source
disproved.

## Updating it

libwebp ships a release or two a year. To update: download the new tarball from the URL above,
verify its checksum, replace `src/` and `sharpyuv/`, update this file, and read the diff.

**This is a real obligation, not housekeeping.** Custom emoji are files downloaded from
strangers, so the encoder is fed pixel values and dimensions that an attacker chose. It never
*parses* their file — ImageIO does that, and Apple patches ImageIO, which keeps the
container-parsing bugs (CVE-2023-4863 and relatives) out of reach. But encoder bugs driven by
content and dimensions are a real class. Mitigations that are already in place: `WebPEncoder`
caps the long edge at 1024 before encoding, and the app is sandboxed, which is the actual
containment.
