LibTiff Vulnerabilities and Dependencies about pyproj

[djhoese]

Could you please provide the information for how you actually installed pyproj? And if you have the PROJ C/C++ library installed separately?

As far as I can tell pyproj does not depend on libtiff directly at all, but our PROJ C/C++ library dependency does depend on libtiff:

https://github.com/OSGeo/PROJ

The traceback from python reaching into C/C++ code (the _network.pyx and the binary .so version of it) are hiding the fact that this symbol not being found is part of a different dependence. At least I think so.

[nfairbank]

It's a little complicated because I'm trying to build everything on Alpine for a production environment.

It's extremely possible that the error comes from PROJ, and I only see it when I try "import pyproj" and it starts the traceback.

It's a multistage build but essentially I install all the build time dependencies, the pip install all the python packages (including pyproj) into a virtual environment. Then I install runtime dependencies (including proj 9.2.1) in a new image, and copy over the venv.

So it sounds like the issues is tiff 4.6 breaks proj 9.2.1 breaks pyproj. I'm trying proj 9.3.0 to see if that repairs the chain, but having issues getting it to install over other dependencies. Honestly might just have to mitigate the vulnerabilities at the application level and wait for the dependency graph to catch up.

[djhoese]

When you install the build dependencies and runtime dependencies how are you doing that? Are you building them from source? Or installing from a package manager? I would assume that running proj or similar command line tool from PROJ would trigger a similar error. That would at least cut out the pyproj part of the equation.

For building pyproj, are you pip installing from source or from PyPI? If PyPI, is it using a wheel on PyPI or is it downloading the .tar.gz source tarball and building from that?

[nfairbank]

I think you are correct that this is not a pyproj issue- think that it likely lies at the alpine level, ensuring that the dependency graph is well-coordinated. Going to close this issue.