Remove libjpeg-turbo, libtiff, openjpeg dependencies

[jantonguirao]

Summary

• DALI removed its legacy image decoder, so libjpeg-turbo, libtiff, and openjpeg are no longer needed as standalone third-party dependencies of DALI_deps.
• OpenCV's imgcodecs module is only used by DALI's test suite now; production DALI does not depend on it.
• OpenCV switches to its bundled image-format libraries (BUILD_JPEG=ON, BUILD_TIFF=ON, BUILD_OPENJPEG=ON, BUILD_PNG=ON, BUILD_WEBP=ON), which is sufficient for the tests.
• zstd is retained — it's still needed by other deps in this repo.

Changes

• Drop submodules third_party/libjpeg-turbo, third_party/libtiff, third_party/openjpeg.
• Delete build_scripts/build_libjpeg-turbo.sh, build_libtiff.sh, build_openjpeg.sh.
• Delete patches/libtiff-CVE-2026-4775.patch (no longer needed).
• Update build_scripts/build_deps.sh PACKAGE_LIST.
• Update build_scripts/build_opencv.sh to use bundled image-format libs and document why.
• Update README.rst table.

Test plan

• bash -ex build_scripts/build_deps.sh completes successfully
• OpenCV build links against its own bundled libjpeg/libtiff/openjpeg
• Downstream DALI build (and tests) still succeed against the resulting prefix

[Copilot]

Pull request overview

This PR removes the standalone libjpeg-turbo, libtiff, and openjpeg third-party dependencies from DALI_deps since DALI dropped its legacy image decoder. OpenCV (still needed for DALI's test suite) is switched to use its bundled image-format libraries.

Changes:

• Drop the three submodules, their build scripts, and the libtiff CVE patch; remove them from PACKAGE_LIST and the README dependency table.
• Update build_opencv.sh to enable bundled BUILD_JPEG/TIFF/OPENJPEG/PNG/WEBP instead of relying on system-installed libs, with an explanatory comment.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
README.rst	Removes openjpeg, libtiff, and libjpeg-turbo rows from the dependencies table.
.gitmodules	Removes submodule entries for the three dropped dependencies.
build_scripts/build_deps.sh	Removes the three packages from PACKAGE_LIST.
build_scripts/build_opencv.sh	Switches OpenCV to bundled JPEG/TIFF/OpenJPEG image libs and adds rationale comment.
build_scripts/build_libjpeg-turbo.sh	Deleted (no longer needed).
build_scripts/build_libtiff.sh	Deleted (no longer needed).
build_scripts/build_openjpeg.sh	Deleted (no longer needed).
patches/libtiff-CVE-2026-4775.patch	Deleted along with libtiff.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[greptile-apps]

Greptile Summary

This PR removes libjpeg-turbo, libtiff, and openjpeg as standalone third-party submodules now that DALI's legacy image decoder is gone, and switches OpenCV's build to use its own bundled copies of those libraries instead.

• Deletes three submodules (third_party/libjpeg-turbo, third_party/libtiff, third_party/openjpeg), their build scripts, and the libtiff CVE patch, with matching removals from build_deps.sh and README.rst.
• Updates build_opencv.sh to replace BUILD_JPEG=OFF/WITH_JPEG=ON and BUILD_TIFF=OFF/WITH_TIFF=ON with BUILD_JPEG=ON, BUILD_TIFF=ON, BUILD_OPENJPEG=ON, and BUILD_WEBP=ON (replacing the former WITH_WEBP=ON), so all image-format support is self-contained inside OpenCV.
• zstd and all other dependencies are retained and unchanged.

Confidence Score: 4/5

Safe to merge once the team confirms OpenCV 4.13.0's bundled libtiff includes the CVE-2026-4775 heap-overflow fix; all other changes are clean removals.

The structural changes (submodule removal, build-script deletion, CMake flag updates) are correct and consistent. The one uncertainty is whether OpenCV 4.13.0's in-tree libtiff already contains the heap-overflow fix that was previously applied via libtiff-CVE-2026-4775.patch. If it does not, the vulnerability travels into the test-suite binaries unchanged.

build_scripts/build_opencv.sh — verify that OpenCV 4.13.0's bundled libtiff incorporates the CVE-2026-4775 fix before dropping the patch entirely.

Security Review

• CVE-2026-4775 (libtiff heap overflow) — build_scripts/build_opencv.sh line 38: The patches/libtiff-CVE-2026-4775.patch that fixed an integer-overflow-leading-to-heap-overflow in TIFFReadRGBAImage() was applied to the standalone libtiff build. That patch is now deleted alongside the submodule. OpenCV 4.13.0's in-tree libtiff may or may not include this fix; if it predates the patch and DALI tests decode externally-sourced TIFF files, the vulnerability is still present in the resulting binaries.

Important Files Changed

Filename	Overview
build_scripts/build_opencv.sh	Switches OpenCV from external libjpeg/libtiff/openjpeg/WebP to bundled builds; WITH_JPEG and WITH_TIFF correctly dropped; CVE-2026-4775 heap-overflow patch no longer applied to the now-bundled libtiff.
build_scripts/build_deps.sh	Removes libjpeg-turbo, openjpeg, and libtiff from the ordered PACKAGE_LIST; zstd and all other deps retained correctly.
.gitmodules	Removes submodule entries for openjpeg, libtiff, and libjpeg-turbo; remaining submodules untouched.
README.rst	Removes the three dependency rows from the table; all other entries correctly preserved.
patches/libtiff-CVE-2026-4775.patch	Deleted alongside the standalone libtiff submodule; the same heap-overflow fix is no longer applied to OpenCV's bundled libtiff.
build_scripts/build_libjpeg-turbo.sh	Deleted; no longer needed as OpenCV bundles its own libjpeg.
build_scripts/build_libtiff.sh	Deleted; no longer needed as OpenCV bundles its own libtiff.
build_scripts/build_openjpeg.sh	Deleted; no longer needed as OpenCV bundles its own openjpeg.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[build_deps.sh] --> B[build_zlib.sh]
    A --> C[build_protobuf.sh]
    A --> D[build_lmdb.sh]
    A --> E[build_zstd.sh]
    A --> F[build_opencv.sh]
    A --> G[build_ffmpeg.sh ...]

    F --> OCV[OpenCV 4.13.0 bundled build]
    OCV --> J[libjpeg — BUILD_JPEG=ON]
    OCV --> T[libtiff — BUILD_TIFF=ON]
    OCV --> OP[openjpeg — BUILD_OPENJPEG=ON]
    OCV --> P[libpng — BUILD_PNG=ON]
    OCV --> W[libwebp — BUILD_WEBP=ON]

    REMOVED1([third_party/libjpeg-turbo REMOVED]):::removed
    REMOVED2([third_party/libtiff REMOVED]):::removed
    REMOVED3([third_party/openjpeg REMOVED]):::removed

    classDef removed fill:#fdd,stroke:#d00,color:#700,stroke-dasharray:4

Loading

_{Reviews (1): Last reviewed commit: "Remove libjpeg-turbo, libtiff, openjpeg ..." | Re-trigger Greptile}