Review: freeimage 4.2.1+ds-1~exp1
Package Information
| Description | Support library for graphics image formats (development files) FreeImageRe is a maintained fork of FreeImage, an Open Source C/C++ library project for developers who would like to support popular graphics image formats like PNG, BMP, JPEG, TIFF, WebP, HEIF and others as needed by today's multimedia applications. This package contains the headers and static libraries needed to develop programs using FreeImage. |
|---|---|
| Maintainer | Debian Science Maintainers <debian-science-maintainers@lists.alioth.debian.org> |
| Changed By | Anton Gladky <gladk@debian.org> |
| Sponsor | gladk@debian.org |
| Distribution | experimental |
| Architecture | any |
| VCS | git: https://salsa.debian.org/science-team/freeimage.git (browse) |
| Closes | #1055305, #1059152, #1060691, #1060862, #1068718, #1082375, #1121912, #1138102 |
| Popcon Installs | 10632 |
| Binary NEW | Yes (new binary packages of a source already in sid) |
| Tracker | https://tracker.debian.org/pkg/freeimage |
| Uploaded | 21 days ago |
New Package Report
.changes
| Distribution | experimental |
|---|---|
| Date | Sat, 17 Oct 2026 19:26:24 +0200 |
| Source | freeimage |
| Version | 4.2.1+ds-1~exp1 |
| Changed-By | Anton Gladky <gladk@debian.org> |
| Architecture | source amd64 |
Changelog
freeimage (4.2.1+ds-1~exp1) experimental; urgency=medium
.
* New upstream release: switch to FreeImageRe 4.2.1, a maintained fork
(Closes: #1121912). FreeImage itself is dead upstream with open
security issues; FreeImageRe carries CVE fixes and active
maintenance.
* CMake-based build, replacing the old Makefile-based one.
* SONAME bump (libfreeimage3 -> libfreeimage4, libfreeimageplus3 ->
libfreeimageplus4): abidiff against the previous upload found a
removed function and a changed signature.
* FreeImagePlus ported forward from FreeImage 3.18 (upstream dropped
it), with the changes listed in Wrapper/FreeImagePlus/PORTING.txt.
fipImage::getHistogram() keeps the FreeImage 3.18 implementation.
* Vendor a pinned Yato copy (a header-only FreeImageRe dependency with
no Debian package).
* Build against the system jxrlib; the embedded copy is removed from
the orig tarball.
* Load libheif by its SONAME, so HEIF/AVIF support works without
libheif-dev installed, and recommend libheif1.
* Build the library with the colour order the installed header uses on
the host architecture (BGR on little-endian, RGB on big-endian).
* Drop libfreeimageplus-doc for now (doxygen config not ported yet).
* debian/copyright, debian/patches: rewritten for the new source.
Upstream-Contact now points to the FreeImageRe project.
(Closes: #1082375)
* The switch to FreeImageRe supersedes packaging FreeImage r1909.
(Closes: #1068718)
* autopkgtest: enable the per-format upstream tests and add a
FreeImagePlus test.
* debian/watch: convert to version 5 and track upstream releases.
* Security fixes included in FreeImageRe:
- CVE-2020-24292: ICO load() buffer overflow.
- CVE-2020-24293, CVE-2020-24294, CVE-2020-24295: PSD plugin
buffer overflows. (Closes: #1059152)
- CVE-2021-40266: TIFF ReadPalette NULL pointer dereference.
(Closes: #1055305)
- CVE-2023-47992: _MemoryReadProc integer overflow.
- CVE-2023-47993: Exif ReadInt32 out-of-bounds read.
- CVE-2023-47994: BMP LoadPixelDataRLE4 integer overflow.
- CVE-2023-47996: Exif jpeg_read_exif_dir integer overflow.
- CVE-2023-47997: FreeImage_AllocateBitmap infinite loop.
(Closes: #1060691)
- CVE-2023-47995: FreeImage_AllocateBitmap excessive allocation.
(Closes: #1060862)
- CVE-2024-28579, CVE-2024-28582: HDR plugin memory errors.
* Remove Ghislain Antony Vaillant from Uploaders. (Closes: #1138102).dsc
| Component | main |
|---|---|
| Package-List | libfreeimage-dev deb libdevel optional arch=any libfreeimage4 deb libs optional arch=any libfreeimageplus-dev deb libdevel optional arch=any libfreeimageplus4 deb libs optional arch=any |
| Section | libdevel |
| Priority | optional |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: freeimage
Upstream-Contact: https://github.com/agruzdev/FreeImageRe
Source: https://github.com/agruzdev/FreeImageRe
Comment:
This package switched upstream from the unmaintained FreeImage 3.18
(freeimage.sourceforge.net) to its maintained fork FreeImageRe, per
https://bugs.debian.org/1121912. The orig tarball is the FreeImageRe
4.2.1 release with the files below removed, plus two additions made at
packaging time and documented below: a pinned, header-only copy of Yato
(a FreeImageRe dependency with no Debian package of its own) and the
FreeImagePlus C++ wrapper ported forward from FreeImage 3.18 (upstream
FreeImageRe dropped it).
.
Removed: JPEGTransform.cpp needs private libjpeg headers that are not
usable with Debian's libjpeg; 3rdParty/LibJXR is an embedded copy of
jxrlib, which is built against libjxr-dev instead.
Files-Excluded: Source/FreeImageToolkit/JPEGTransform.cpp
3rdParty/LibJXR
Files: *
Copyright: 2003-2007 FreeImage Group
2020-2026 Alexey Gruzdev and FreeImageRe contributors
License: GPL-2.0 or GPL-3.0 or FIPL-1.0
Files: 3rdParty/Yato/*
Copyright: 2016-2020 Alexey Gruzdev
License: Apache-2.0
Comment:
Vendored at packaging time (pinned commit
246c83a29912db50535b3e0737d32f8cdf39165e of
https://github.com/agruzdev/Yato, include/ subdirectory only) since
FreeImageRe's CMake build otherwise fetches it from the network at
build time and Yato has no Debian package of its own. See
debian/patches/vendor-yato.patch.
Files: Wrapper/FreeImagePlus/*
Copyright: 2003-2007 FreeImage Group
2007-2026 Debian FreeImage packagers
License: GPL-2.0 or GPL-3.0 or FIPL-1.0
Comment:
Ported forward from FreeImage 3.18's Wrapper/FreeImagePlus at packaging
time (upstream FreeImageRe dropped this wrapper). The changes are
listed in Wrapper/FreeImagePlus/PORTING.txt; see also
debian/patches/build-freeimageplus.patch.
Files: Source/Plugins/PluginPICT.cpp
Copyright: 1996-2002 Ulrich von Zadow and other contributors
2003-2007 FreeImage Group
License: Paintlib
Comment:
PICT loader by Amir Ebrahimi, based on paintlib code.
Files: Source/FreeImage/NNQuantizer.cpp
Copyright: 1994 Anthony Dekker
2001-2004 Herve Drolon
License: NeuQuant
Comment:
NeuQuant neural-net quantization algorithm, adapted for FreeImage.
Files: cmake/libjpeg/*
Copyright: 1991-1994 Thomas G. Lane
2009-2013 Guido Vollbeding
License: IJG
Comment:
Configuration header for the bundled libjpeg build. Only used when
FreeImageRe downloads and builds its own libjpeg, which the Debian build
never does.
Files: Source/Plugins/PSDParser.cpp
Source/Plugins/PSDParser.h
Source/Plugins/PluginPSD.cpp
Copyright: 2003-2007 FreeImage Group
2020-2026 Alexey Gruzdev and FreeImageRe contributors
License: GPL-2.0 or GPL-3.0 or FIPL-1.0
Comment:
These files state that they are "based on LGPL code created and
published by http://sourceforge.net/projects/elynx/" (eLynx Image
Processing SDK). The LGPL version is not given; the GPL-2.0 and GPL-3.0
options cover the combination.
Files: debian/*
Copyright: 2007 Federico Di Gregorio
2015 Ghislain Antony Vaillant
2026 Anton Gladky
License: GPL-2.0
License: FIPL-1.0
FreeImage Public License - Version 1.0
---------------------------------------------
.
1. Definitions.
.
1.1. "Contributor" means each entity that creates or contributes to the creation of Modifications.
.
1.2. "Contributor Version" means the combination of the Original Code, prior Modifications used by a Contributor, and the Modifications made by that particular Contributor.
.
1.3. "Covered Code" means the Original Code or Modifications or the combination of the Original Code and Modifications, in each case including portions thereof.
.
1.4. "Electronic Distribution Mechanism" means a mechanism generally accepted in the software development community for the electronic transfer of data.
.
1.5. "Executable" means Covered Code in any form other than Source Code.
.
1.6. "Initial Developer" means the individual or entity identified as the Initial Developer in the Source Code notice required by Exhibit A.
.
1.7. "Larger Work" means a work which combines Covered Code or portions thereof with code not governed by the terms of this License.
.
1.8. "License" means this document.
.
1.9. "Modifications" means any addition to or deletion from the substance or structure of either the Original Code or any previous Modifications. When Covered Code is released as a series of files, a
Modification is:
.
A. Any addition to or deletion from the contents of a file containing Original Code or previous Modifications.
.
B. Any new file that contains any part of the Original Code or previous Modifications.
.
1.10. "Original Code" means Source Code of computer software code which is described in the Source Code notice required by Exhibit A as Original Code, and which, at the time of its release under this License is not already Covered Code governed by this License.
.
1.11. "Source Code" means the preferred form of the Covered Code for making modifications to it, including all modules it contains, plus any associated interface definition files, scripts used to control
compilation and installation of an Executable, or a list of source code differential comparisons against either the Original Code or another well known, available Covered Code of the Contributor's choice. The Source Code can be in a compressed or archival form, provided the appropriate decompression or de-archiving software is widely available for no charge.
.
1.12. "You" means an individual or a legal entity exercising rights under, and complying with all of the terms of, this License or a future version of this License issued under Section 6.1. For legal entities, "You" includes any entity which controls, is controlled by, or is under common control with You. For purposes of this definition, "control" means (a) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or otherwise, or (b) ownership of fifty percent (50%) or more of the outstanding shares or beneficial ownership of such entity.
.
2. Source Code License.
.
2.1. The Initial Developer Grant.
The Initial Developer hereby grants You a world-wide, royalty-free, non-exclusive license, subject to third party intellectual property claims:
.
(a) to use, reproduce, modify, display, perform, sublicense and distribute the Original Code (or portions thereof) with or without Modifications, or as part of a Larger Work; and
.
(b) under patents now or hereafter owned or controlled by Initial Developer, to make, have made, use and sell ("Utilize") the Original Code (or portions thereof), but solely to the extent that
any such patent is reasonably necessary to enable You to Utilize the Original Code (or portions thereof) and not to any greater extent that may be necessary to Utilize further Modifications or
combinations.
.
2.2. Contributor Grant.
Each Contributor hereby grants You a world-wide, royalty-free, non-exclusive license, subject to third party intellectual property claims:
.
(a) to use, reproduce, modify, display, perform, sublicense and distribute the Modifications created by such Contributor (or portions thereof) either on an unmodified basis, with other Modifications, as Covered Code or as part of a Larger Work; and
.
(b) under patents now or hereafter owned or controlled by Contributor, to Utilize the Contributor Version (or portions thereof), but solely to the extent that any such patent is reasonably necessary to enable You to Utilize the Contributor Version (or portions thereof), and not to any greater extent that
may be necessary to Utilize further Modifications or combinations.
.
3. Distribution Obligations.
.
3.1. Application of License.
The Modifications which You create or to which You contribute are governed by the terms of this License, including without limitation Section 2.2. The Source Code version of Covered Code may be distributed only under the terms of this License or a future version of this License released under Section 6.1, and You must include a copy of this License with every copy of the Source Code You distribute. You may not offer or impose any terms on any Source Code version that alters or
restricts the applicable version of this License or the recipients' rights hereunder. However, You may include an additional document offering the additional rights described in Section 3.5.
.
3.2. Availability of Source Code.
Any Modification which You create or to which You contribute must be made available in Source Code form under the terms of this License either on the same media as an Executable version or via an accepted Electronic Distribution Mechanism to anyone to whom you made an Executable version available; and if made available via Electronic Distribution Mechanism, must remain available for at least twelve (12) months after the date it initially became available, or at least six (6) months after a subsequent version of that particular Modification has been made available to such recipients. You are responsible for ensuring that the Source Code version remains available even if the Electronic Distribution Mechanism is maintained by a third party.
.
3.3. Description of Modifications.
You must cause all Covered Code to which you contribute to contain a file documenting the changes You made to create that Covered Code and the date of any change. You must include a prominent statement that the Modification is derived, directly or indirectly, from Original Code provided by the Initial Developer and including the name of the Initial Developer in (a) the Source Code, and (b) in any notice in an Executable version or related documentation in which You describe the origin or ownership of the Covered Code.
.
3.4. Intellectual Property Matters
.
(a) Third Party Claims.
If You have knowledge that a party claims an intellectual property right in particular functionality or code (or its utilization under this License), you must include a text file with the source code distribution titled "LEGAL" which describes the claim and the party making the claim in sufficient detail that a recipient will know whom to contact. If you obtain such knowledge after You make Your Modification available as described in Section 3.2, You shall promptly modify the LEGAL file in all copies You make
available thereafter and shall take other steps (such as notifying appropriate mailing lists or newsgroups) reasonably calculated to inform those who received the Covered Code that new knowledge has been obtained.
.
(b) Contributor APIs.
If Your Modification is an application programming interface and You own or control patents which are reasonably necessary to implement that API, you must also include this information in the LEGAL file.
.
3.5. Required Notices.
You must duplicate the notice in Exhibit A in each file of the Source Code, and this License in any documentation for the Source Code, where You describe recipients' rights relating to Covered Code. If You created one or more Modification(s), You may add your name as a Contributor to the notice described in Exhibit A. If it is not possible to put such notice in a particular Source Code file due to its
structure, then you must include such notice in a location (such as a relevant directory file) where a user would be likely to look for such a notice. You may choose to offer, and to charge a fee for, warranty, support, indemnity or liability obligations to one or more recipients of Covered Code. However, You may do so only on Your own behalf, and not on behalf of the Initial Developer or any Contributor. You must make it absolutely clear than any such warranty, support, indemnity or
liability obligation is offered by You alone, and You hereby agree to indemnify the Initial Developer and every Contributor for any liability incurred by the Initial Developer or such Contributor as a result of
warranty, support, indemnity or liability terms You offer.
.
3.6. Distribution of Executable Versions.
You may distribute Covered Code in Executable form only if the requirements of Section 3.1-3.5 have been met for that Covered Code, and if You include a notice stating that the Source Code version of the Covered Code is available under the terms of this License, including a description of how and where You have fulfilled the obligations of Section 3.2. The notice must be conspicuously included in any notice in an Executable version, related documentation or collateral in which You
describe recipients' rights relating to the Covered Code. You may distribute the Executable version of Covered Code under a license of Your choice, which may contain terms different from this License,
provided that You are in compliance with the terms of this License and that the license for the Executable version does not attempt to limit or alter the recipient's rights in the Source Code version from the rights set forth in this License. If You distribute the Executable version under a different license You must make it absolutely clear that any terms which differ from this License are offered by You alone, not by the Initial Developer or any Contributor. You hereby agree to indemnify the Initial Developer and every Contributor for any liability incurred by the Initial Developer or such Contributor as a result of any such terms You offer.
.
3.7. Larger Works.
You may create a Larger Work by combining Covered Code with other code not governed by the terms of this License and distribute the Larger Work as a single product. In such a case, You must make sure the requirements of this License are fulfilled for the Covered Code.
.
4. Inability to Comply Due to Statute or Regulation.
.
If it is impossible for You to comply with any of the terms of this License with respect to some or all of the Covered Code due to statute or regulation then You must: (a) comply with the terms of this License to the maximum extent possible; and (b) describe the limitations and the code they affect. Such description must be included in the LEGAL file described in Section 3.4 and must be included with all distributions of the Source Code. Except to the extent prohibited by statute or regulation, such description must be sufficiently detailed for a recipient of ordinary skill to be able to understand it.
.
5. Application of this License.
.
This License applies to code to which the Initial Developer has attached the notice in Exhibit A, and to related Covered Code.
.
6. Versions of the License.
.
6.1. New Versions.
Floris van den Berg may publish revised and/or new versions of the License from time to time. Each version will be given a distinguishing version number.
.
6.2. Effect of New Versions.
Once Covered Code has been published under a particular version of the License, You may always continue to use it under the terms of that version. You may also choose to use such Covered Code under the terms of any subsequent version of the License published by Floris van den Berg
No one other than Floris van den Berg has the right to modify the terms applicable to Covered Code created under this License.
.
6.3. Derivative Works.
If you create or use a modified version of this License (which you may only do in order to apply it to code which is not already Covered Code governed by this License), you must (a) rename Your license so that the phrases "FreeImage", `FreeImage Public License", "FIPL", or any confusingly similar phrase do not appear anywhere in your license and (b) otherwise make it clear that your version of the license contains terms which differ from the FreeImage Public License. (Filling in the name of the Initial Developer, Original Code or Contributor in the notice described in Exhibit A shall not of themselves be deemed to be modifications of this License.)
.
7. DISCLAIMER OF WARRANTY.
.
COVERED CODE IS PROVIDED UNDER THIS LICENSE ON AN "AS IS" BASIS, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, WARRANTIES THAT THE COVERED CODE IS FREE OF DEFECTS, MERCHANTABLE, FIT FOR A PARTICULAR PURPOSE OR NON-INFRINGING. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE COVERED CODE IS WITH YOU. SHOULD ANY COVERED CODE PROVE DEFECTIVE IN ANY RESPECT, YOU (NOT THE INITIAL DEVELOPER OR ANY OTHER CONTRIBUTOR) ASSUME THE COST OF ANY NECESSARY SERVICING, REPAIR OR CORRECTION. THIS DISCLAIMER OF WARRANTY CONSTITUTES AN ESSENTIAL PART OF THIS LICENSE. NO USE OF ANY COVERED CODE IS AUTHORIZED HEREUNDER EXCEPT UNDER THIS DISCLAIMER.
.
8. TERMINATION.
.
This License and the rights granted hereunder will terminate automatically if You fail to comply with terms herein and fail to cure such breach within 30 days of becoming aware of the breach. All sublicenses to the Covered Code which are properly granted shall survive any termination of this License. Provisions which, by their nature, must remain in effect beyond the termination of this License shall survive.
.
9. LIMITATION OF LIABILITY.
.
UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY, WHETHER TORT (INCLUDING NEGLIGENCE), CONTRACT, OR OTHERWISE, SHALL THE INITIAL DEVELOPER, ANY OTHER CONTRIBUTOR, OR ANY DISTRIBUTOR OF COVERED CODE, OR ANY SUPPLIER OF ANY OF SUCH PARTIES, BE LIABLE TO YOU OR ANY OTHER PERSON FOR ANY INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF GOODWILL, WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, OR ANY AND ALL OTHER COMMERCIAL DAMAGES OR LOSSES, EVEN IF SUCH PARTY SHALL HAVE BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGES. THIS LIMITATION OF LIABILITY SHALL NOT APPLY TO LIABILITY FOR DEATH OR PERSONAL INJURY RESULTING FROM SUCH PARTY'S NEGLIGENCE TO THE EXTENT APPLICABLE LAW PROHIBITS SUCH LIMITATION. SOME JURISDICTIONS DO NOT ALLOW THE
EXCLUSION OR LIMITATION OF INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THAT EXCLUSION AND LIMITATION MAY NOT APPLY TO YOU.
.
10. U.S. GOVERNMENT END USERS.
.
The Covered Code is a "commercial item," as that term is defined in 48 C.F.R. 2.101 (Oct. 1995), consisting of "commercial computer software" and "commercial computer software documentation," as such terms are used in 48 C.F.R. 12.212 (Sept. 1995). Consistent with 48 C.F.R. 12.212 and 48 C.F.R. 227.7202-1 through 227.7202-4 (June 1995), all U.S. Government End Users acquire Covered Code with only those rights set forth herein.
.
11. MISCELLANEOUS.
.
This License represents the complete agreement concerning subject matter hereof. If any provision of this License is held to be unenforceable, such provision shall be reformed only to the extent necessary to make it enforceable. This License shall be governed by Dutch law provisions (except to the extent applicable law, if any, provides otherwise), excluding its conflict-of-law provisions. With respect to disputes in which at least one party is a citizen of, or an entity chartered or registered to do business in, the The Netherlands: (a) unless otherwise agreed in writing, all disputes relating to this License (excepting any dispute relating to intellectual property rights) shall be subject to final and binding arbitration, with the losing party paying all costs of arbitration; (b) any arbitration relating to this Agreement shall be held in Almelo, The Netherlands; and (c) any litigation relating to this Agreement shall be subject to the jurisdiction of the court of Almelo, The Netherlands with the losing party responsible for costs, including without limitation, court costs and reasonable attorneys fees and expenses. Any law or regulation which provides that the language of a contract shall be construed against the drafter shall not apply to this License.
.
12. RESPONSIBILITY FOR CLAIMS.
.
Except in cases where another Contributor has failed to comply with Section 3.4, You are responsible for damages arising, directly or indirectly, out of Your utilization of rights under this License, based
on the number of copies of Covered Code you made available, the revenues you received from utilizing such rights, and other relevant factors. You agree to work with affected parties to distribute
responsibility on an equitable basis.
.
EXHIBIT A.
.
"The contents of this file are subject to the FreeImage Public License Version 1.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://home.wxs.nl/~flvdberg/freeimage-license.txt
.
Software distributed under the License is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for the specific language governing rights and limitations under the License.
License: GPL-2.0
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; version 2 dated June, 1991.
.
On Debian systems, the complete text of version 2 of the GNU General
Public License can be found in '/usr/share/common-licenses/GPL-2'.
License: GPL-3.0
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; version 3 dated June, 2007.
.
On Debian systems, the complete text of version 3 of the GNU General
Public License can be found in '/usr/share/common-licenses/GPL-3'.
License: Apache-2.0
On Debian systems, the complete text of the Apache License, Version 2.0
can be found in '/usr/share/common-licenses/Apache-2.0'.
License: Paintlib
The paintlib source code and all documentation are copyright (c) 1996-2002
Ulrich von Zadow and other contributors.
.
The paintlib source code is supplied "AS IS". Ulrich von Zadow and other
contributors disclaim all warranties, expressed or implied, including,
without limitation, the warranties of merchantability and of fitness for
any purpose. The authors assume no liability for direct, indirect,
incidental, special, exemplary, or consequential damages, which may
result from the use of paintlib, even if advised of the possibility of
such damage.
.
Permission is hereby granted to use, copy, modify, and distribute this
source code, or portions hereof, for any purpose, without fee, subject to
the following restrictions:
.
1. The origin of this source code must not be misrepresented.
2. Altered versions must be plainly marked as such and must not be
misrepresented as being the original source.
3. This Copyright notice may not be removed or altered from any source or
altered source distribution.
4. Executables containing paintlib or parts of it must state that the
software "contains paintlib code. paintlib is copyright (c) 1996-2002
Ulrich von Zadow and other contributors.". This notice must be
displayed in at least one place where the copyright for the software
itself is displayed. The documentation must also contain this notice.
License: NeuQuant
Any party obtaining a copy of these files from the author, directly or
indirectly, is granted, free of charge, a full and unrestricted
irrevocable, world-wide, paid up, royalty-free, nonexclusive right and
license to deal in this software and documentation files (the
"Software"), including without limitation the rights to use, copy,
modify, merge, publish, distribute, sublicense, and/or sell copies of the
Software, and to permit persons who receive copies from any such party to
do so, with the only requirement being that this copyright notice remain
intact.
License: IJG
The authors make NO WARRANTY or representation, either express or implied,
with respect to this software, its quality, accuracy, merchantability, or
fitness for a particular purpose. This software is provided "AS IS", and
you, its user, assume the entire risk as to its quality and accuracy.
.
This software is copyright (C) 1991-2013, Thomas G. Lane, Guido Vollbeding.
All Rights Reserved except as specified below.
.
Permission is hereby granted to use, copy, modify, and distribute this
software (or portions thereof) for any purpose, without fee, subject to
these conditions:
(1) If any part of the source code for this software is distributed, then
this README file must be included, with this copyright and no-warranty
notice unaltered; and any additions, deletions, or changes to the original
files must be clearly indicated in accompanying documentation.
(2) If only executable code is distributed, then the accompanying
documentation must state that "this software is based in part on the work
of the Independent JPEG Group".
(3) Permission for use of this software is granted only if the user
accepts full responsibility for any undesirable consequences; the authors
accept NO LIABILITY for damages of any kind.
.
These conditions apply to any software derived from or based on the IJG
code, not just to the unmodified library. If you use our work, you ought
to acknowledge us.
.
Permission is NOT granted for the use of any IJG author's name or company
name in advertising or publicity relating to this software or products
derived from it. This software may be referred to only as "the
Independent JPEG Group's software".
.
We specifically permit and encourage the use of this software as the
basis of commercial products, provided that all warranty or liability
claims are assumed by the product vendor.
DFSG Assistant LLM REVIEW 0 blocker, 1 important, 0 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 21 days ago.
Report
DFSG NEW review for freeimage version 4.2.1+ds-1~exp1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: No
- Issues: 0 blocker, 1 important, 0 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: 6 found
Licensing
debian/copyright is DEP-5 and matches the tree: the FreeImage/FreeImageRe code is offered as GPL-2.0 or GPL-3.0 or FIPL-1.0, and the files with other terms have their own stanzas (Apache-2.0 for the vendored Yato, Paintlib for PluginPICT.cpp, NeuQuant for NNQuantizer.cpp, IJG for cmake/libjpeg/*, and the eLynx/LGPL provenance of the PSD files is explained). FIPL-1.0 is non-free per the DFSG licence database because of its choice-of-venue clause, but it is only an alternative and the GPL-2.0/GPL-3.0 options (the project's original dual licence) make the source DFSG-free. Full texts of all licences not in /usr/share/common-licenses are present, and no file is left without a licence.
Packaging
The packaging is mostly careful (DEP-3 patches, autopkgtests, hardening, Multi-Arch: same, a justified SONAME bump, correct split and dependencies), but it cannot build on six of Debian's release architectures: the vendored Yato header only recognises x86, x86_64 and aarch64 and hits #error "Unknown architecture!" elsewhere, while all four binary packages are Architecture: any. The package would therefore fail to build on armel, armhf, mips64el, ppc64el, riscv64 and s390x.
Issues
important packaging 1. Vendored Yato rejects every architecture except x86, x86_64 and aarch64, so the Architecture: any package fails to build on six release architectures ◂
- Files:
3rdParty/Yato/include/yato/prerequisites.h:18-23,3rdParty/Yato/include/yato/finally.h:14,Source/Plugins/PluginHEIF.cpp:26,debian/control:25,40,55,71 - Basis: checked, in the package or with a reference tool
- Evidence:
#if defined(__x86_64__) || defined(_M_X64) || defined(__aarch64__) || defined(_M_ARM64) || defined(_M_ARM64EC)...#elif defined(__i386) || defined(_M_IX86) || defined(__ANDROID__)...#else/#error "Unknown architecture!" - Problem:
Source/CMakeLists.txtalways addsPlugins/PluginHEIF.cpp(theFREEIMAGE_WITH_LIBHEIFdefault is ON;debian/rulesonly setsUSE_SYSTEM_LIBHEIF), and that file includesyato/finally.h, which includesprerequisites.hunconditionally. On armel/armhf (__arm__), mips64el, ppc64el, riscv64, s390x and loong64 none of the tested macros is defined, so the preprocessor stops with#errorand the build fails, although all four packages declareArchitecture: any. This is not a test failure: the compilation of the library itself cannot start on those architectures. - Fix: Patch
3rdParty/Yato/include/yato/prerequisites.hto classify the missing architectures (or derive YATO_X64/YATO_X86 from pointer width), or update the vendored Yato copy to a version that supports them; then test-build on at least armhf, ppc64el and s390x.
Verified ◂
debian/copyrightis in machine-readable format and covers the whole tree:Files: *plus later stanzas for3rdParty/Yato/*,Wrapper/FreeImagePlus/*,Source/Plugins/PluginPICT.cpp,Source/FreeImage/NNQuantizer.cpp,cmake/libjpeg/*, the PSD files anddebian/*.Files-Excludednames onlySource/FreeImageToolkit/JPEGTransform.cppand3rdParty/LibJXR, both absent from the tree, and the leftoverFreeImage_JPEGTransformdeclarations are disabled inSource/FreeImage.h.- Prescan binary files:
TestAPI/exif.jxris a JPEG XR fixture loaded atTestAPI/MainTestSuite.cpp:142;TestAPI/exif.jxl,TestAPI/exif_599.jxlandTestAPI/exif_rgba.jxlare JPEG XL fixtures loaded atTestAPI/MainTestSuite.cpp:151-153. They are test data, are not built into the library, and need no source. I did not open them (binary), but they are identified by the test code that reads them. - Prescan licence
FIPL-1.0(debian/copyright:24,88): the DFSG licence database rejects it for its §11 choice-of-venue clause, but the same stanza also offers GPL-2.0 and GPL-3.0, the upstream project states the original dual licence (Readme.md:Same to the original FreeImage dual license) and shipslicense-gplv2.txtandlicense-gplv3.txt. Debian can therefore distribute under the GPL;license-fi.txtis only the FIPL text itself, which is quoted in full indebian/copyright. - Prescan wording at
debian/copyright:317(Permission is NOT granted for the use of any IJG author's name ...): this is the standard IJG licence, which is free (it restricts only the use of IJG names in advertising). The only IJG-licensed file,cmake/libjpeg/jconfig.h, is not compiled by the Debian build, which uses-DUSE_SYSTEM_LIBJPEG=ON. - Prescan author
Ulrich von Zadowis present in theFiles: Source/Plugins/PluginPICT.cppstanza (debian/copyright:48) and in the standalone Paintlib licence text; the author check is a false positive. 3rdParty/Yatois genuinely not in Debian (apt-cachefinds neitherlibyato-devnoryato), so vendoring the pinned copy is justified; itsCopyright: 2016-2020 Alexey Gruzdev/License: Apache-2.0stanza matches3rdParty/Yato/LICENSEand every header.- Apache-2.0 (Yato) is incompatible with GPL-2.0 but compatible with GPL-3.0, which the FreeImage files also offer, so the combined library has a free licence; the Paintlib conditions (attribution only) do not make
PluginPICT.cppnon-free. - Read all of
debian/(control, rules, changelog, install files, tests, lrc/gbp/salsa configuration), all twelve patch headers, and the copyright/licence headers and licence greps ofSource/,Wrapper/,cmake/,TestAPI/and3rdParty/Yato/; source bodies were sampled and grepped rather than read line by line. Standards-Version: 4.7.2is current enough against Policy 4.7.4.1 (first two components match).Build-Dependsnames exist:cmake4.4.3,libjxr-dev1.2,libheif-dev1.23.6;pkgconfprovidespkg-config.- The four
.installfiles match whatinstall(TARGETS FreeImage)andinstall(TARGETS FreeImagePlus)produce with dh_auto_configure's-DCMAKE_INSTALL_LIBDIR=lib/<multiarch>: the versioned libraries in thelibfreeimage4/libfreeimageplus4packages and the headers plus linker symlinks in the-devpackages; compat 13'sdh_missing --fail-missingwould catch any other installed file. - uscan found the packaged version as the newest upstream release (upstream
4.2.1, packaged4.2.1+ds). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0,GPL-2,GPL-3).
Not confirmed ◂
Source/CMakeLists.txt:166becomesinstall(FILES TYPE RENAME)whenUSE_SYSTEM_LIBHEIF=ON, becausecmake/dependency.heif.cmakereturns before definingLibHEIF_INSTALL_LIBRARY/TYPE/NAME; whether CMake accepts that argument list could not be tested here (no build possible), and the changelog's abidiff results suggest the package did build.- Several upstream headers carry provenance notes that could imply further notices:
Source/Plugins/PluginXBM.cpp:6(part of the code adapted from the netPBM package (xbmtopbm.c)),Source/Plugins/PluginPCD.cpp:7(Pascal code by Alex Kwak) andSource/Plugins/PluginJPEG.cpp:3(IJG code); the originals are not in the package, so I could not judge whether their licences require notices thatdebian/copyrightlacks.PluginXBM.cpp'sreadXBMFile/hex_tablecode does resemble netpbm's.
Proposed changes ◂
None.
Review Information
accepted — allocated to awm 20 days ago, started 20 days ago, completed 20 days ago.
Final Comment
Hi,
Still one issue identified by the LLM, but I'll leave you to resolve that one on your next upload.
Thanks!
Other Reviews of this Package
| Version | Hash | Allocated | Completed | Reviewer | Status | Details |
|---|---|---|---|---|---|---|
| 4.2.1~git20260701.97e3a99+ds1-1~exp1 | fb7702ab… | 2026-10-16 03:19 | 2026-10-16 03:23 | awm | rejected | VIEW |
Public Notes
Missed Author Check
Command: dfsg-author-check -markdown
Exit code: 1
Author check: freeimage-4.2.1+ds
Scanned 225 files. Authors declared in debian/copyright: 11.
Not named in debian/copyright (1):
- Ulrich von Zadow
Source/Plugins/PluginPICT.cpp:30
Possibly named in debian/copyright under a similar name (1):
- Thomas G. Lane. Modified 2009-2013 by Guido Vollbeding (might be Guido Vollbeding; Thomas G. Lane)
cmake/libjpeg/jconfig.h:4
Result: 1 holder not named in debian/copyright, and 1 possibly named under a similar name
To name them, add to the end of debian/copyright:
Files: Source/Plugins/PluginPICT.cpp
Copyright: 1996-2002 Ulrich von Zadow
License: Paintlib
Each paragraph names every holder found in its files, with the years their copyright lines give, and has the License of the paragraph that covers them now, which it takes the place of for them. Check the License, and whether the files' holders are all there: one a file names only in prose, or in a form the check passes over, is not.
License Check
Command: dnq license-check -prepare
Exit code: 0
License check [main]:
Found 7 unique license identifier(s) in debian/copyright:
COMPATIBLE (3):
Apache-2.0 [Note: not compatible with GPL-2]
GPL-2.0
GPL-3.0
INCOMPATIBLE WITH DFSG (1):
FIPL-1.0 [FreeImage Public License v1.0; choice-of-venue clause discriminates by jurisdiction]
The FreeImage Public License version 1.0 is a derivative of the Mozilla
Public License 1.0, written for the FreeImage image-decoding library by
Floris van den Berg. Most of its terms (the source-availability obligation,
the LEGAL file requirement, the per-file Exhibit A notice and the
file-based copyleft) mirror the MPL and are not in themselves a DFSG
problem. It is considered incompatible because of its dispute-resolution
terms:
1. Choice of Venue
Section 11 provides that any litigation relating to the license is subject
to the jurisdiction of the court of Almelo, The Netherlands, with the
losing party responsible for costs, and that disputes involving a Dutch
party are subject to binding arbitration held in Almelo. As with the
Amsterdam choice-of-venue clause in the QPL, Debian treats a mandatory
foreign venue as an unfair restriction that discriminates against
individuals or groups who lack the financial means, legal capability or
travel access to defend themselves in that specific jurisdiction.
2. Fee-shifting
The same clause makes the losing party liable for the other side's court
costs and reasonable attorneys' fees. Coupling distribution rights to a
one-sided fee-shifting term further discourages exercising the freedoms the
license otherwise grants.
The license is OSI-listed by SPDX identifier but is not OSI-approved, and
is not on the FSF's list of free software licenses.
UNKNOWN (not in DFSG license database):
IJG (manually verify DFSG compatibility)
NeuQuant (manually verify DFSG compatibility)
Paintlib (manually verify DFSG compatibility)
Result: ATTENTION REQUIRED
- 1 DFSG-incompatible license(s) found
- 3 unrecognized license(s) require manual review