Overview

At the moment, skia-python includes several dynamic library dependencies in its manylinux wheel:

libbz2-a273e504.so.1.0.6
libfontconfig-42c558d2.so.1.11.1
libfreetype-c0e61f0c.so.6.14.0
libpng15-ce838cd1.so.15.13.0
libuuid-f64cda11.so.1.3.0

This is convenient since it reduces the number of system packages that a user needs to install, but it has some serious drawbacks:

1. These libraries are significantly out of date compared to versions on modern systems (see table below), they likely contain bugs, vulnerabilities (see Vulnerable shared libraries might make skia-python vulnerable. Can you help upgrade to patch versions? #175), or compatibility issues with Skia.
2. Skia explicitly recommends against static linking or bundling dynamic libraries for production builds.
3. This can cause issues with libraries like libfontconfig that depend on configuration files found in the system. For example, modern Debian installs a config file at /usr/share/fontconfig/conf.avail/05-reset-dirs-sample.conf that is incompatible with the older version of libfontconfig bundled with skia-python, causing a warning:

Fontconfig warning: "/usr/share/fontconfig/conf.avail/05-reset-dirs-sample.conf", line 6: unknown element "reset-dirs"

How these get bundled

The present build system for skia-python causes this through two location. First, Skia is told not to use system packages when being built:

https://github.com/kyamagu/skia-python/blob/db7d7fcc84dc5e59ea8a925457f2d319a57052df/scripts/build_Linux.sh#L71-L76

Second, cibuildwheel will run auditwheel on any manylinux wheel. This where these dependencies get grafted into the wheel.

Possible solutions

1. Do nothing, possibly document that manylinux wheels will use outdated versions of these libraries.
2. Drop manylinux2014 in favor of a newer PEP600 version based on glibc, possibly manylinux_2_36 (which covers contemporary distros like Debian 12). This would result in newer version being bundled, but wouldn't completely resolve the issue.
3. Change the configuration to dynamically link to system versions of these libraries. This would require users to ensure these packages are installed (which is already done in the docs). This would lead to some users running into issues if they blindly install skia-python without the necessary packages.

Version comparison