Use case is running pngcheck as a first step on ingesting an unknown file (e.g. on a server, or in a script).
We want to validate it's not malicious and is indeed a reasonable png formatted image. Extra detailed checks of metadata (beyond safety/ security) may not be desired.
Feature Request:
Provide an option to skip checking non-breaking / ancillary chunks. This may be slightly faster, but also helps us accept files with trivial defects.
Real world example:
From PngSuite by Willem van Schaik, file: cm7n0g04.png fails verification, as the tIME chunk has the year set to 1970.
(I confirmed with the author this was an accidental mistake... and I was the first to report it since 1996!!)
From the source of pngcheck, a year before 1995 is considered as invalid. Reading the spec, it seems 1970 cannot be valid since:
tIME chunk gives the time of the last image modification...
so cannot be prior to the existence of the png format. (I imagine pngcheck is trying to catch dates wrongly encoded as YY vs YYYY).
Anyway, IMO we should either be able to skip these (pedantic?) checks... or consider different error levels to indicate whether the only fault was trivial or important.
Use case is running
pngcheckas a first step on ingesting an unknown file (e.g. on a server, or in a script).We want to validate it's not malicious and is indeed a reasonable png formatted image. Extra detailed checks of metadata (beyond safety/ security) may not be desired.
Feature Request:
Provide an option to skip checking non-breaking / ancillary chunks. This may be slightly faster, but also helps us accept files with trivial defects.
Real world example:
From PngSuite by Willem van Schaik, file:
cm7n0g04.pngfails verification, as thetIMEchunk has the year set to 1970.(I confirmed with the author this was an accidental mistake... and I was the first to report it since 1996!!)
From the source of pngcheck, a year before 1995 is considered as invalid. Reading the spec, it seems 1970 cannot be valid since:
so cannot be prior to the existence of the png format. (I imagine pngcheck is trying to catch dates wrongly encoded as YY vs YYYY).
Anyway, IMO we should either be able to skip these (pedantic?) checks... or consider different error levels to indicate whether the only fault was trivial or important.