detect() does not know GIF, and unsupported-format-fails-the-build is the documented design (no fixed-length fallback). That is correct behavior, but it means animated GIFs must be hand-excluded from the include globs and ship as fully openable files — in one consumer that leaves a ~1.9 MB animated GIF as the largest unprotected image in the shipped build.
Feasibility: the GIF87a/GIF89a signature is constant and therefore cannot be part of the fragment (no key strength). But the Logical Screen Descriptor — canvas width/height, packed fields (global color table flag/size), background color index — and the first Image Descriptor vary per file, which satisfies the key rule: cut what a decoder cannot guess, store that, regenerate the constant bytes on restore.
Proposal: add a GIF parser to detect()/locate() that cuts the LSD (+ first Image Descriptor), consistent with how PNG (IHDR body) and JPEG (SOF body) are handled.
detect()does not know GIF, and unsupported-format-fails-the-build is the documented design (no fixed-length fallback). That is correct behavior, but it means animated GIFs must be hand-excluded from the include globs and ship as fully openable files — in one consumer that leaves a ~1.9 MB animated GIF as the largest unprotected image in the shipped build.Feasibility: the
GIF87a/GIF89asignature is constant and therefore cannot be part of the fragment (no key strength). But the Logical Screen Descriptor — canvas width/height, packed fields (global color table flag/size), background color index — and the first Image Descriptor vary per file, which satisfies the key rule: cut what a decoder cannot guess, store that, regenerate the constant bytes on restore.Proposal: add a GIF parser to
detect()/locate()that cuts the LSD (+ first Image Descriptor), consistent with how PNG (IHDR body) and JPEG (SOF body) are handled.