Rebase to 3.21, swap imagemagick for vips, enable sbom/provenance

[thespad]

---

• I have read the contributing guideline and understand that I have made the correct modifications

---

Description:

Benefits of this PR and context:

How Has This Been Tested?

Source / References:

[LinuxServer-CI]

I am a bot, here is the pushed image/manifest for this PR:

ghcr.io/linuxserver/lspipepr-mastodon:v4.3.8-pkg-b9324fce-dev-f47502ce3819bd297649e9a923e964cc37343b60-pr-115

[jyggen]

The imagemagick -> vips change breaks image attachments in latest Mastodon release (4.3.8) with the following error:

[2025-06-09T23:35:50.593497 #364] ERROR -- : [84865026-94e8-433a-9224-a4af26e8ce7e]
[84865026-94e8-433a-9224-a4af26e8ce7e] Terrapin::CommandNotFoundError (Terrapin::CommandNotFoundError):
[84865026-94e8-433a-9224-a4af26e8ce7e]
[84865026-94e8-433a-9224-a4af26e8ce7e] lib/paperclip/blurhash_transcoder.rb:26:in `blurhash_params'
[84865026-94e8-433a-9224-a4af26e8ce7e] lib/paperclip/blurhash_transcoder.rb:8:in `make'
[84865026-94e8-433a-9224-a4af26e8ce7e] lib/paperclip/attachment_extensions.rb:21:in `block in post_process_style'
[84865026-94e8-433a-9224-a4af26e8ce7e] lib/paperclip/attachment_extensions.rb:20:in `each'
[84865026-94e8-433a-9224-a4af26e8ce7e] lib/paperclip/attachment_extensions.rb:20:in `inject'
[84865026-94e8-433a-9224-a4af26e8ce7e] lib/paperclip/attachment_extensions.rb:20:in `post_process_style'
[84865026-94e8-433a-9224-a4af26e8ce7e] app/models/concerns/remotable.rb:27:in `public_send'
[84865026-94e8-433a-9224-a4af26e8ce7e] app/models/concerns/remotable.rb:27:in `block (2 levels) in remotable_attachment'
[84865026-94e8-433a-9224-a4af26e8ce7e] app/lib/request.rb:129:in `perform'
[84865026-94e8-433a-9224-a4af26e8ce7e] app/models/concerns/remotable.rb:24:in `block in remotable_attachment'
[84865026-94e8-433a-9224-a4af26e8ce7e] app/controllers/media_proxy_controller.rb:31:in `redownload!'
[84865026-94e8-433a-9224-a4af26e8ce7e] app/controllers/media_proxy_controller.rb:22:in `block in show'
[84865026-94e8-433a-9224-a4af26e8ce7e] app/models/concerns/lockable.rb:12:in `block (2 levels) in with_redis_lock'
[84865026-94e8-433a-9224-a4af26e8ce7e] app/models/concerns/lockable.rb:10:in `block in with_redis_lock'
[84865026-94e8-433a-9224-a4af26e8ce7e] app/lib/redis_connection.rb:10:in `with'
[84865026-94e8-433a-9224-a4af26e8ce7e] app/models/concerns/redisable.rb:9:in `with_redis'
[84865026-94e8-433a-9224-a4af26e8ce7e] app/models/concerns/lockable.rb:9:in `with_redis_lock'
[84865026-94e8-433a-9224-a4af26e8ce7e] app/controllers/media_proxy_controller.rb:19:in `show'
[84865026-94e8-433a-9224-a4af26e8ce7e] app/controllers/concerns/localized.rb:11:in `set_locale'
[84865026-94e8-433a-9224-a4af26e8ce7e] lib/mastodon/rack_middleware.rb:9:in `call'

Probably because imagemagick isn't deprecated until Mastodon 4.4.0, which is not yet released. Setting the environment variable MASTODON_USE_LIBVIPS to true fixes it in 4.3.8 for me.

[thespad]

Thanks, I'll get a fix pushed today.

[thespad]

@jyggen would you mind testing ghcr.io/linuxserver/lspipepr-mastodon:v4.3.8-pkg-44b35b30-dev-a847b65e253501446d95614a76cd15488d05d81d-pr-117 and seeing if it fixes the issue (without you setting the env, obviously).

[jyggen]

I'm running that version now. Seems OK at a first glance, but will know for sure once someone from another server posts something with an image attachment since that's when I noticed the issue in the first place. I'll get back again once that happens.

[jyggen]

Yep, working as expected. Thanks!