girder/large_image

Review signals: 72 known vulnerability.

OSV reports a known vulnerability in this dependency version. pip 18 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Convert images to tiled pyramidal tiffs: Real input produced the expected result: Created <guest-path>,

  Source: Convert to tiled Cloud Optimized (Geo)Tiffs (also known as pyramidal tiffs)

  Input: <guest-path>

  Expected: tiled pyramidal tiff written at the destination

  Command: <guest-path> --verbose --tile 64 <guest-path> <guest-path>

  Observed: Created <guest-path>, 31894 bytes, 2.4 s

• Single-image non-geospatial files become pyramidal tiff via pyvips: Real input produced the expected result: Created <guest-path>,

  Source: Single-image non-geospatial files are converted into pyramidal tiff files via pyvips.

  Input: <guest-path>

  Expected: pyramidal tiff written at the destination

  Command: <guest-path> --verbose --tile 64 <guest-path> <guest-path>

  Observed: Created <guest-path>, 31894 bytes, 2.6 s

Examples

• Quickstart: convert an image to a tiled tiff given the source and an output path: command completed successfully

  Source: utilities/converter/README.rst

  Input: <guest-path>

  Expected: tiled tiff written silently at the output path with the image size in its metadata

  Command: <guest-path> <guest-path> <guest-path>

  Observed: �6���b`��y��␀�1�.5�)j�8C�N�@�0�EB�T␀����E[�>� Y� ��;␀�A`�a�-��Q��SI��歋�cX���{ ���-&/Cn�U␀@�8
  8! -1�Sچ�܂��j��l^�ln�l~�l��l��l��l��l��l��l��l��m�m�m.�m>�mN�m^�mn�m~�m��m��m��m��m��m��m��m��n�n�n.�n>�nN�n^�nn�n~�n��n��n��n��n��n��n��n��o�o�o.�o>�oN�o^�on�o~�o��o��o��o��o��o��o��o�␀p
  pp/p?pOp_popp� p� p�p�p� p�p�p��
  ␀
  ␀
  ␀
  ␀␀␀
  ␀
  ␀␀␀�␀␀␀
  
  ␀
  ␀␀␀�␀␀␀
  ␀␀␀␀␀␀␀
  ␀
  ␀␀␀␀␀␀
  ␀
  ␀␀␀␀␀␀
  ␀�
  ␀␀␀␀␀
  ␀
  ␀␀␀
  ␀␀␀
  ␀
  ␀␀␀␀␀␀
  ␀
  ␀␀␀�
  ␀␀
  ␀
  ␀␀␀�
  ␀␀
  ␀
  ␀␀␀
  ␀␀␀(
  ␀
  ␀␀␀␀␀␀=
  ␀
  ␀␀␀␀␀␀B
  ␀
  ␀␀␀␀
  ␀␀C
  ␀
  ␀␀␀␀
  ␀␀D
  ␀
  ␀␀␀�
  ␀␀E
  ␀
  ␀␀␀p'␀␀R
  ␀
  ␀␀␀␀␀␀S
  ␀␀␀␀*)␀␀␀␀␀␀

• Python convert() API from the converter README: The README gives only a Python snippet (from large_image_converter import convert; convert(<source path>)), which is agent-written code and not a documented command-line entry point. Ran the documented command-line form instead, in the example above.

  Source: utilities/converter/README.rst

  Expected: documented command completes successfully

  Observed: The README gives only a Python snippet (from large_image_converter import convert; convert(<source path>)), which is agent-written code and not a documented command-line entry point. Ran the documented command-line form instead, in the example above.

Local or hosted: local

Convert a PNG image into a tiled pyramidal TIFF with the large_image_converter command and read the result back through large_image (3 levels, 64px tiles, 200x200 size).

cd <guest-path> && pwd && ls -la && id -u && python3 --version && (git -C . rev-parse HEAD 2>&1 | head -1) && ls /inputs 2>&1 | head
cd <guest-path> && wc -c README* 2>/dev/null; head -c 6000 README.md 2>/dev/null
cd <guest-path> && cat README.rst
cd <guest-path> && ls -la .coldpass; grep -n -i "python_requires\|requires-python" setup.py pyproject.toml; ls large_image; sed -n 1,40p large_image/cli.py 2>/dev/null | head -5; ls large_image/tilesource | head -3; ls utilities examples | head -40
cd /tmp && (python3 -m venv --help >/dev/null 2>&1 && echo venv_ok || (sudo -n apt-get -o DPkg::Lock::Timeout=300 install -y python3-venv >/tmp/venv_install.log 2>&1; echo "apt rc=$?"; tail -3 /tmp/venv_install.log)); python3 -m venv <guest-path> && <guest-path> --version && <guest-path> --version
cd /tmp && timeout 7000 <guest-path> install "large-image[common]" > <guest-path> 2>&1; echo rc=$?; tail -15 <guest-path>
cd <guest-path> && grep -rn "entry_points\|console_scripts" -A6 setup.py | head -30; ls utilities/converter; grep -n "def main\|argparse\|add_argument('--" utilities/converter/large_image_converter/__init__.py 2>/dev/null | head -20; ls <guest-path> | grep -i "large\|convert"
cd <guest-path> && grep -rn "scripts\|entry" utilities/converter/setup.py utilities/converter/pyproject.toml | head; ls utilities/converter/large_image_converter; grep -n "add_argument" utilities/converter/large_image_converter/__main__.py 2>/dev/null | head -5; grep -n "\-\-" utilities/converter/README.rst | head -40
cd <guest-path> && sed -n 1,80p utilities/converter/README.rst
cd /tmp && timeout 7000 <guest-path> install "large-image[converter]" "large-image-converter" > <guest-path> 2>&1; echo rc=$?; tail -4 <guest-path> | cut -c1-600; ls <guest-path> | grep -i convert; which vips gdal_translate; <guest-path> -c "import pyvips" 2>&1 | tail -1
sudo -n apt-get -o DPkg::Lock::Timeout=300 update > <guest-path> 2>&1; echo upd=$?; sudo -n apt-get -o DPkg::Lock::Timeout=300 install -y libvips42t64 libvips-tools > <guest-path> 2>&1; echo inst=$?; tail -3 <guest-path>; <guest-path> -c "import pyvips; print('pyvips ok', pyvips.version(0))" 2>&1 | tail -1
cd /tmp && <guest-path> --help 2>&1 | head -60; find <guest-path> -iname "*.png" -o -iname "*.jpg" -o -iname "*.tif*" -o -iname "*.svs" 2>/dev/null | head
mkdir -p <guest-path> <guest-path> && cp <guest-path> <guest-path> && cd <guest-path> && <guest-path> <guest-path> <guest-path>; echo rc=$?; ls -la <guest-path>
cd <guest-path> && <guest-path> --verbose <guest-path> <guest-path>; echo rc=$?; ls <guest-path>; <guest-path> -c "
import large_image
ts = large_image.open('<guest-path>')
m = ts.getMetadata()
print('levels', m['levels'], 'tile', m['tileWidth'], m['tileHeight'], 'size', m['sizeX'], m['sizeY'])
" 2>&1 | tail -3
ls <guest-path> 2>&1; grep -n "expected_text" <guest-path> | head -20; grep -n "stderr" <guest-path> | head -10
sed -n 750,800p <guest-path>
grep -n "README\|source_file" <guest-path> | head -30
cd <guest-path> && grep -nF "Convert to tiled Cloud Optimized (Geo)Tiffs (also known as pyramidal tiffs)" README.rst; grep -nF "Single-image non-geospatial files are converted into pyramidal tiff files via pyvips." utilities/converter/README.rst; grep -nF "Convert a variety of images into the most efficient format for Large Image." utilities/converter/README.rst; file docs/static/K.png test/test_files/geotiff_9_89_207_py3.png; ls -la docs/static/K.png; python3 -c "
import struct
for p in ['docs/static/K.png','test/test_files/geotiff_9_89_207_py3.png','test/test_files/test_RGBA_8.png']:
    d=open(p,'rb').read(32); print(p, struct.unpack('>II', d[16:24]))"
rm -f <guest-path> <guest-path> && cp <guest-path> <guest-path> && cd <guest-path> && <guest-path> --verbose --tile 64 <guest-path> <guest-path>; echo rc=$?; <guest-path> -c "
import large_image
ts = large_image.open('<guest-path>')
m = ts.getMetadata()
print('levels', m['levels'], 'tile', m['tileWidth'], m['tileHeight'], 'size', m['sizeX'], m['sizeY'])
print('thumb', ts.getThumbnail(width=50, encoding='PNG')[0][:4])
" 2>&1 | tail -3
rm -f <guest-path> && cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","--verbose","--tile","64","<guest-path>","<guest-path>"],"cwd":"<guest-path>","expected_text":"Created <guest-path>,"}
EOF
cat > claims.json <<'EOF'
[{"kind":"claim","claim":"Convert images to tiled pyramidal tiffs","source":"Convert to tiled Cloud Optimized (Geo)Tiffs (also known as pyramidal tiffs)","source_file":"README.rst","input":"<guest-path>","expected":"tiled pyramidal tiff written at the destination","probe_kind":"cli","argv":["<guest-path>","--verbose","--tile","64","<guest-path>","<guest-path>"],"cwd":"<guest-path>","expected_text":"Created <guest-path>,"},
{"kind":"claim","claim":"Single-image non-geospatial files become pyramidal tiff via pyvips","source":"Single-image non-geospatial files are converted into pyramidal tiff files via pyvips.","source_file":"utilities/converter/README.rst","input":"<guest-path>","expected":"pyramidal tiff written at the destination","probe_kind":"cli","argv":["<guest-path>","--verbose","--tile","64","<guest-path>","<guest-path>"],"cwd":"<guest-path>","expected_text":"Created <guest-path>,"}]
EOF
python3 -m json.tool probe.json >/dev/null && python3 -m json.tool claims.json >/dev/null && echo json_ok; ls -la <guest-path>
cd <guest-path> && ls examples docs | head -40; grep -rln -i "cron\|--once\|scheduler\|webhook" --include=*.py --include=*.rst --include=*.md . 2>/dev/null | grep -v test/ | head; sed -n 1,30p examples/average_color.py
cd <guest-path> && grep -n "large_image_converter\|::$" docs/image_conversion.rst | head -20; grep -n "large_image_converter" -A3 docs/*.rst | head -40
mkdir -p <guest-path> && cp <guest-path> <guest-path> && cd <guest-path> && <guest-path> <guest-path>; echo rc=$?; ls -la <guest-path>
cd <guest-path> && strings -n 6 K.tiff | head -30; python3 -c "
d=open('K.tiff','rb').read(); import re
print(len(d)); print([m.group(0)[:80] for m in re.finditer(rb'[ -~]{12,}', d)][:10])"
rm -f <guest-path> && cd <guest-path> && cat > examples.json <<'EOF'
[{"kind":"example","claim":"Quickstart: convert an image with the default output next to the source","source":"utilities/converter/README.rst","input":"<guest-path>","expected":"K.tiff written next to the source with the image size in its metadata","argv":["<guest-path>","<guest-path>"],"cwd":"<guest-path>","expected_file":"<guest-path>","expected_text":"\"sizeX\":200,\"sizeY\":200"},
{"kind":"example","claim":"Python convert() API from the converter README","source":"utilities/converter/README.rst","reason":"The README gives only a Python snippet (from large_image_converter import convert; convert(<source path>)), which is agent-written code and not a documented command-line entry point. Ran the documented command-line quickstart instead, in the example above."}]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README.rst and utilities/converter/README.rst and the converter entry point (large_image_converter = large_image_converter.__main__:main). No cron, scheduler, polling loop, webhook, --once or --now behavior is documented; the converter runs once per invocation and exits.","checks":[]}
EOF
python3 -m json.tool examples.json >/dev/null && python3 -m json.tool cycles.json >/dev/null && echo ok; ls <guest-path> <guest-path>
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; tail -c 5000 <guest-path>
cd <guest-path> && cat > examples.json <<'EOF'
[{"kind":"example","claim":"Quickstart: convert an image to a tiled tiff given the source and an output path","source":"utilities/converter/README.rst","input":"<guest-path>","expected":"tiled tiff written silently at the output path with the image size in its metadata","argv":["<guest-path>","<guest-path>","<guest-path>"],"cwd":"<guest-path>","expected_file":"<guest-path>","expected_text":"\"sizeX\":200,\"sizeY\":200"},
{"kind":"example","claim":"Python convert() API from the converter README","source":"utilities/converter/README.rst","reason":"The README gives only a Python snippet (from large_image_converter import convert; convert(<source path>)), which is agent-written code and not a documented command-line entry point. Ran the documented command-line form instead, in the example above."}]
EOF
python3 -m json.tool examples.json >/dev/null && echo ok; cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; python3 -c "
import json;d=json.loads(open('<guest-path>').read().split('\n',1)[1]) if False else None" ; tail -c 1800 <guest-path>
cd <guest-path> && python3 -c "
import json
t=open('<guest-path>').read()
i=t.index('{')
d=json.loads(json.loads('\"'+'')) if False else None
import re
print(t[:600])
" ; grep -o '"valid": [a-z]*' <guest-path>; grep -o '"problems": \[[^]]*\]' <guest-path> | head -c 1500; echo; grep -o '"status": "[A-Z]*"' <guest-path>
rm -f <guest-path> <guest-path> <guest-path> <guest-path> && ls -la <guest-path> <guest-path> && cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; grep -o '"valid": [a-z]*' <guest-path>; grep -o '"problems": \[[^]]*\]' <guest-path> | head -c 800; echo; grep -o '"status": "[A-Z]*"' <guest-path>; grep -o '"verdict": "[a-z]*"' <guest-path>
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Convert a PNG image into a tiled pyramidal TIFF with the large_image_converter command and read the result back through large_image (3 levels, 64px tiles, 200x200 size).","operation_scope":"Linux guest, Python 3.12.3 in <guest-path>, large-image 1.35.6 and large-image-converter 1.35.6 from PyPI, libvips 8.15 system library (for pyvips); GDAL not installed (only needed for geospatial inputs). Probe, claims and example all use the documented large_image_converter CLI; claims cover the README.rst highlight and utilities/converter/README.rst pyvips sentence.","steps":["pip install \"large-image[common]\" (README.rst Installation > Pip; Python 3.12.3 meets python_requires>=3.10)","pip install \"large-image[converter]\" \"large-image-converter\" (README.rst Modules > converter extra; utilities/converter/README.rst Installation)","sudo apt-get -o DPkg::Lock::Timeout=300 install -y libvips42t64 libvips-tools (required by pyvips; import failed with missing libvips.so.42)","large_image_converter --help (setup only)","large_image_converter --verbose --tile 64 docs/static/K.png <fresh output>.tiff (probe and claims)","large_image_converter <source> <dest> (quickstart example, silent, expected file checked for sizeX/sizeY metadata)"],"deviations":["Installed the PyPI releases of large-image and large-image-converter (1.35.6) using the README's documented pip commands instead of building the pinned commit c76b5a3000b2a2780dfc090e53b1b680fbada7f5 from the workspace; the workspace is not a git repository, so the git init/fetch/reset pin step was not run.","Installed libvips42t64 and libvips-tools with apt-get, which the README does not list explicitly; the converter could not load pyvips without them.","The README's Python snippet convert(<source path>) was not run as it is not a command-line entry point; the documented CLI was used instead (recorded as a reason-only example).","Converter uses no GDAL here (warning 'Cannot import GDAL.' printed); this only affects geospatial inputs, which were not tested.","Validation used <guest-path> because /inputs/coldpass-preflight.py does not exist in this guest.","Validation was rerun once after removing the outputs of the first replay, because the converter refuses to overwrite an existing output file (replay needs fresh paths)."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
python3 -m json.tool report.json >/dev/null && echo report_ok; ls <guest-path> <guest-path>
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; grep -o '"valid": [a-z]*' <guest-path>; grep -o '"status": "[A-Z]*"' <guest-path>; rm -f <guest-path> <guest-path> ; ls -la <guest-path> <guest-path>; ls -la <guest-path>; ls <guest-path> | grep -i report
cd <guest-path> && ls <guest-path> <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; grep -o '"valid": [a-z]*' <guest-path>; grep -o '"status": "[A-Z]*"' <guest-path>; rm -f <guest-path> <guest-path> ; ls <guest-path> <guest-path>