DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: freeimage 4.2.1+ds-1~exp1

Package Information

DescriptionSupport library for graphics image formats (development files)

FreeImageRe is a maintained fork of FreeImage, an Open Source C/C++ library project for developers who would like to support popular graphics image formats like PNG, BMP, JPEG, TIFF, WebP, HEIF and others as needed by today's multimedia applications.

This package contains the headers and static libraries needed to develop programs using FreeImage.

MaintainerDebian Science Maintainers <debian-science-maintainers@lists.alioth.debian.org>
Changed ByAnton Gladky <gladk@debian.org>
Sponsorgladk@debian.org
Distributionexperimental
Architectureany
VCSgit: https://salsa.debian.org/science-team/freeimage.git (browse)
Closes#1055305, #1059152, #1060691, #1060862, #1068718, #1082375, #1121912, #1138102
Popcon Installs10632
Binary NEWYes (new binary packages of a source already in sid)
Trackerhttps://tracker.debian.org/pkg/freeimage
Uploaded21 days ago

New Package Report

.changes◂
DateSat, 17 Oct 2026 19:26:24 +0200
Sourcefreeimage
Version4.2.1+ds-1~exp1
Changed-ByAnton Gladky <gladk@debian.org>
Architecturesource amd64
Distributionexperimental
Changelog◂
freeimage (4.2.1+ds-1~exp1) experimental; urgency=medium
 .
   * New upstream release: switch to FreeImageRe 4.2.1, a maintained fork
     (Closes: #1121912). FreeImage itself is dead upstream with open
     security issues; FreeImageRe carries CVE fixes and active
     maintenance.
   * CMake-based build, replacing the old Makefile-based one.
   * SONAME bump (libfreeimage3 -> libfreeimage4, libfreeimageplus3 ->
     libfreeimageplus4): abidiff against the previous upload found a
     removed function and a changed signature.
   * FreeImagePlus ported forward from FreeImage 3.18 (upstream dropped
     it), with the changes listed in Wrapper/FreeImagePlus/PORTING.txt.
     fipImage::getHistogram() keeps the FreeImage 3.18 implementation.
   * Vendor a pinned Yato copy (a header-only FreeImageRe dependency with
     no Debian package).
   * Build against the system jxrlib; the embedded copy is removed from
     the orig tarball.
   * Load libheif by its SONAME, so HEIF/AVIF support works without
     libheif-dev installed, and recommend libheif1.
   * Build the library with the colour order the installed header uses on
     the host architecture (BGR on little-endian, RGB on big-endian).
   * Drop libfreeimageplus-doc for now (doxygen config not ported yet).
   * debian/copyright, debian/patches: rewritten for the new source.
     Upstream-Contact now points to the FreeImageRe project.
     (Closes: #1082375)
   * The switch to FreeImageRe supersedes packaging FreeImage r1909.
     (Closes: #1068718)
   * autopkgtest: enable the per-format upstream tests and add a
     FreeImagePlus test.
   * debian/watch: convert to version 5 and track upstream releases.
   * Security fixes included in FreeImageRe:
     - CVE-2020-24292: ICO load() buffer overflow.
     - CVE-2020-24293, CVE-2020-24294, CVE-2020-24295: PSD plugin
       buffer overflows. (Closes: #1059152)
     - CVE-2021-40266: TIFF ReadPalette NULL pointer dereference.
       (Closes: #1055305)
     - CVE-2023-47992: _MemoryReadProc integer overflow.
     - CVE-2023-47993: Exif ReadInt32 out-of-bounds read.
     - CVE-2023-47994: BMP LoadPixelDataRLE4 integer overflow.
     - CVE-2023-47996: Exif jpeg_read_exif_dir integer overflow.
     - CVE-2023-47997: FreeImage_AllocateBitmap infinite loop.
       (Closes: #1060691)
     - CVE-2023-47995: FreeImage_AllocateBitmap excessive allocation.
       (Closes: #1060862)
     - CVE-2024-28579, CVE-2024-28582: HDR plugin memory errors.
   * Remove Ghislain Antony Vaillant from Uploaders. (Closes: #1138102)
.dsc◂
Sectionlibdevel
Priorityoptional
Componentmain
Package-Listlibfreeimage-dev deb libdevel optional arch=any
libfreeimage4 deb libs optional arch=any
libfreeimageplus-dev deb libdevel optional arch=any
libfreeimageplus4 deb libs optional arch=any
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: freeimage
Upstream-Contact: https://github.com/agruzdev/FreeImageRe
Source: https://github.com/agruzdev/FreeImageRe
Comment:
 This package switched upstream from the unmaintained FreeImage 3.18
 (freeimage.sourceforge.net) to its maintained fork FreeImageRe, per
 https://bugs.debian.org/1121912. The orig tarball is the FreeImageRe
 4.2.1 release with the files below removed, plus two additions made at
 packaging time and documented below: a pinned, header-only copy of Yato
 (a FreeImageRe dependency with no Debian package of its own) and the
 FreeImagePlus C++ wrapper ported forward from FreeImage 3.18 (upstream
 FreeImageRe dropped it).
 .
 Removed: JPEGTransform.cpp needs private libjpeg headers that are not
 usable with Debian's libjpeg; 3rdParty/LibJXR is an embedded copy of
 jxrlib, which is built against libjxr-dev instead.
Files-Excluded: Source/FreeImageToolkit/JPEGTransform.cpp
                3rdParty/LibJXR

Files: *
Copyright: 2003-2007 FreeImage Group
           2020-2026 Alexey Gruzdev and FreeImageRe contributors
License: GPL-2.0 or GPL-3.0 or FIPL-1.0

Files: 3rdParty/Yato/*
Copyright: 2016-2020 Alexey Gruzdev
License: Apache-2.0
Comment:
 Vendored at packaging time (pinned commit
 246c83a29912db50535b3e0737d32f8cdf39165e of
 https://github.com/agruzdev/Yato, include/ subdirectory only) since
 FreeImageRe's CMake build otherwise fetches it from the network at
 build time and Yato has no Debian package of its own. See
 debian/patches/vendor-yato.patch.

Files: Wrapper/FreeImagePlus/*
Copyright: 2003-2007 FreeImage Group
           2007-2026 Debian FreeImage packagers
License: GPL-2.0 or GPL-3.0 or FIPL-1.0
Comment:
 Ported forward from FreeImage 3.18's Wrapper/FreeImagePlus at packaging
 time (upstream FreeImageRe dropped this wrapper). The changes are
 listed in Wrapper/FreeImagePlus/PORTING.txt; see also
 debian/patches/build-freeimageplus.patch.

Files: Source/Plugins/PluginPICT.cpp
Copyright: 1996-2002 Ulrich von Zadow and other contributors
           2003-2007 FreeImage Group
License: Paintlib
Comment:
 PICT loader by Amir Ebrahimi, based on paintlib code.

Files: Source/FreeImage/NNQuantizer.cpp
Copyright: 1994 Anthony Dekker
           2001-2004 Herve Drolon
License: NeuQuant
Comment:
 NeuQuant neural-net quantization algorithm, adapted for FreeImage.

Files: cmake/libjpeg/*
Copyright: 1991-1994 Thomas G. Lane
           2009-2013 Guido Vollbeding
License: IJG
Comment:
 Configuration header for the bundled libjpeg build. Only used when
 FreeImageRe downloads and builds its own libjpeg, which the Debian build
 never does.

Files: Source/Plugins/PSDParser.cpp
       Source/Plugins/PSDParser.h
       Source/Plugins/PluginPSD.cpp
Copyright: 2003-2007 FreeImage Group
           2020-2026 Alexey Gruzdev and FreeImageRe contributors
License: GPL-2.0 or GPL-3.0 or FIPL-1.0
Comment:
 These files state that they are "based on LGPL code created and
 published by http://sourceforge.net/projects/elynx/" (eLynx Image
 Processing SDK). The LGPL version is not given; the GPL-2.0 and GPL-3.0
 options cover the combination.

Files: debian/*
Copyright: 2007 Federico Di Gregorio
           2015 Ghislain Antony Vaillant
           2026 Anton Gladky
License: GPL-2.0

License: FIPL-1.0
 FreeImage Public License - Version 1.0
 ---------------------------------------------
 .
 1. Definitions.
 .
 1.1. "Contributor" means each entity that creates or contributes to the creation of Modifications.
 .
 1.2. "Contributor Version" means the combination of the Original Code, prior Modifications used by a Contributor, and the Modifications made by that particular Contributor.
 .
 1.3. "Covered Code" means the Original Code or Modifications or the combination of the Original Code and Modifications, in each case including portions thereof.
 .
 1.4. "Electronic Distribution Mechanism" means a mechanism generally accepted in the software development community for the electronic transfer of data.
 .
 1.5. "Executable" means Covered Code in any form other than Source Code.
 .
 1.6. "Initial Developer" means the individual or entity identified as the Initial Developer in the Source Code notice required by Exhibit A.
 .
 1.7. "Larger Work" means a work which combines Covered Code or portions thereof with code not governed by the terms of this License.
 .
 1.8. "License" means this document.
 .
 1.9. "Modifications" means any addition to or deletion from the substance or structure of either the Original Code or any previous Modifications. When Covered Code is released as a series of files, a
 Modification is:
 .
 A. Any addition to or deletion from the contents of a file containing Original Code or previous Modifications.
 .
 B. Any new file that contains any part of the Original Code or previous Modifications.
 .
 1.10. "Original Code" means Source Code of computer software code which is described in the Source Code notice required by Exhibit A as Original Code, and which, at the time of its release under this License is not already Covered Code governed by this License.
 .
 1.11. "Source Code" means the preferred form of the Covered Code for making modifications to it, including all modules it contains, plus any associated interface definition files, scripts used to control
 compilation and installation of an Executable, or a list of source code differential comparisons against either the Original Code or another well known, available Covered Code of the Contributor's choice. The Source Code can be in a compressed or archival form, provided the appropriate decompression or de-archiving software is widely available for no charge.
 .
 1.12. "You" means an individual or a legal entity exercising rights under, and complying with all of the terms of, this License or a future version of this License issued under Section 6.1. For legal entities, "You" includes any entity which controls, is controlled by, or is under common control with You. For purposes of this definition, "control" means (a) the power, direct or indirect, to cause the
 direction or management of such entity, whether by contract or otherwise, or (b) ownership of fifty percent (50%) or more of the outstanding shares or beneficial ownership of such entity.
 .
 2. Source Code License.
 .
 2.1. The Initial Developer Grant.
 The Initial Developer hereby grants You a world-wide, royalty-free, non-exclusive license, subject to third party intellectual property claims:
 .
 (a) to use, reproduce, modify, display, perform, sublicense and distribute the Original Code (or portions thereof) with or without Modifications, or as part of a Larger Work; and
 .
 (b) under patents now or hereafter owned or controlled by Initial Developer, to make, have made, use and sell ("Utilize") the Original Code (or portions thereof), but solely to the extent that
 any such patent is reasonably necessary to enable You to Utilize the Original Code (or portions thereof) and not to any greater extent that may be necessary to Utilize further Modifications or
 combinations.
 .
 2.2. Contributor Grant.
 Each Contributor hereby grants You a world-wide, royalty-free, non-exclusive license, subject to third party intellectual property claims:
 .
 (a) to use, reproduce, modify, display, perform, sublicense and distribute the Modifications created by such Contributor (or portions thereof) either on an unmodified basis, with other Modifications, as Covered Code or as part of a Larger Work; and
 .
 (b) under patents now or hereafter owned or controlled by Contributor, to Utilize the Contributor Version (or portions thereof), but solely to the extent that any such patent is reasonably necessary to enable You to Utilize the Contributor Version (or portions thereof), and not to any greater extent that
 may be necessary to Utilize further Modifications or combinations.
 .
 3. Distribution Obligations.
 .
 3.1. Application of License.
 The Modifications which You create or to which You contribute are governed by the terms of this License, including without limitation Section 2.2. The Source Code version of Covered Code may be distributed only under the terms of this License or a future version of this License released under Section 6.1, and You must include a copy of this License with every copy of the Source Code You distribute. You may not offer or impose any terms on any Source Code version that alters or
 restricts the applicable version of this License or the recipients' rights hereunder. However, You may include an additional document offering the additional rights described in Section 3.5.
 .
 3.2. Availability of Source Code.
 Any Modification which You create or to which You contribute must be made available in Source Code form under the terms of this License either on the same media as an Executable version or via an accepted Electronic Distribution Mechanism to anyone to whom you made an Executable version available; and if made available via Electronic Distribution Mechanism, must remain available for at least twelve (12) months after the date it initially became available, or at least six (6) months after a subsequent version of that particular Modification has been made available to such recipients. You are responsible for ensuring that the Source Code version remains available even if the Electronic Distribution Mechanism is maintained by a third party.
 .
 3.3. Description of Modifications.
 You must cause all Covered Code to which you contribute to contain a file documenting the changes You made to create that Covered Code and the date of any change. You must include a prominent statement that the Modification is derived, directly or indirectly, from Original Code provided by the Initial Developer and including the name of the Initial Developer in (a) the Source Code, and (b) in any notice in an Executable version or related documentation in which You describe the origin or ownership of the Covered Code.
 .
 3.4. Intellectual Property Matters
 .
 (a) Third Party Claims.
 If You have knowledge that a party claims an intellectual property right in particular functionality or code (or its utilization under this License), you must include a text file with the source code distribution titled "LEGAL" which describes the claim and the party making the claim in sufficient detail that a recipient will know whom to contact. If you obtain such knowledge after You make Your Modification available as described in Section 3.2, You shall promptly modify the LEGAL file in all copies You make
 available thereafter and shall take other steps (such as notifying appropriate mailing lists or newsgroups) reasonably calculated to inform those who received the Covered Code that new knowledge has been obtained.
 .
 (b) Contributor APIs.
 If Your Modification is an application programming interface and You own or control patents which are reasonably necessary to implement that API, you must also include this information in the LEGAL file.
 .
 3.5. Required Notices.
 You must duplicate the notice in Exhibit A in each file of the Source Code, and this License in any documentation for the Source Code, where You describe recipients' rights relating to Covered Code. If You created one or more Modification(s), You may add your name as a Contributor to the notice described in Exhibit A. If it is not possible to put such notice in a particular Source Code file due to its
 structure, then you must include such notice in a location (such as a relevant directory file) where a user would be likely to look for such a notice. You may choose to offer, and to charge a fee for, warranty, support, indemnity or liability obligations to one or more recipients of Covered Code. However, You may do so only on Your own behalf, and not on behalf of the Initial Developer or any Contributor. You must make it absolutely clear than any such warranty, support, indemnity or
 liability obligation is offered by You alone, and You hereby agree to indemnify the Initial Developer and every Contributor for any liability incurred by the Initial Developer or such Contributor as a result of
 warranty, support, indemnity or liability terms You offer.
 .
 3.6. Distribution of Executable Versions.
 You may distribute Covered Code in Executable form only if the requirements of Section 3.1-3.5 have been met for that Covered Code, and if You include a notice stating that the Source Code version of the Covered Code is available under the terms of this License, including a description of how and where You have fulfilled the obligations of Section 3.2. The notice must be conspicuously included in any notice in an Executable version, related documentation or collateral in which You
 describe recipients' rights relating to the Covered Code. You may distribute the Executable version of Covered Code under a license of Your choice, which may contain terms different from this License,
 provided that You are in compliance with the terms of this License and that the license for the Executable version does not attempt to limit or alter the recipient's rights in the Source Code version from the rights set forth in this License. If You distribute the Executable version under a different license You must make it absolutely clear that any terms which differ from this License are offered by You alone, not by the Initial Developer or any Contributor. You hereby agree to indemnify the Initial Developer and every Contributor for any liability incurred by the Initial Developer or such Contributor as a result of any such terms You offer.
 .
 3.7. Larger Works.
 You may create a Larger Work by combining Covered Code with other code not governed by the terms of this License and distribute the Larger Work as a single product. In such a case, You must make sure the requirements of this License are fulfilled for the Covered Code.
 .
 4. Inability to Comply Due to Statute or Regulation.
 .
 If it is impossible for You to comply with any of the terms of this License with respect to some or all of the Covered Code due to statute or regulation then You must: (a) comply with the terms of this License to the maximum extent possible; and (b) describe the limitations and the code they affect. Such description must be included in the LEGAL file described in Section 3.4 and must be included with all distributions of the Source Code. Except to the extent prohibited by statute or regulation, such description must be sufficiently detailed for a recipient of ordinary skill to be able to understand it.
 .
 5. Application of this License.
 .
 This License applies to code to which the Initial Developer has attached the notice in Exhibit A, and to related Covered Code.
 .
 6. Versions of the License.
 .
 6.1. New Versions.
 Floris van den Berg may publish revised and/or new versions of the License from time to time. Each version will be given a distinguishing version number.
 .
 6.2. Effect of New Versions.
 Once Covered Code has been published under a particular version of the License, You may always continue to use it under the terms of that version. You may also choose to use such Covered Code under the terms of any subsequent version of the License published by Floris van den Berg
 No one other than Floris van den Berg has the right to modify the terms applicable to Covered Code created under this License.
 .
 6.3. Derivative Works.
 If you create or use a modified version of this License (which you may only do in order to apply it to code which is not already Covered Code governed by this License), you must (a) rename Your license so that the phrases "FreeImage", `FreeImage Public License", "FIPL", or any confusingly similar phrase do not appear anywhere in your license and (b) otherwise make it clear that your version of the license contains terms which differ from the FreeImage Public License. (Filling in the name of the Initial Developer, Original Code or Contributor in the notice described in Exhibit A shall not of themselves be deemed to be modifications of this License.)
 .
 7. DISCLAIMER OF WARRANTY.
 .
 COVERED CODE IS PROVIDED UNDER THIS LICENSE ON AN "AS IS" BASIS, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, WARRANTIES THAT THE COVERED CODE IS FREE OF DEFECTS, MERCHANTABLE, FIT FOR A PARTICULAR PURPOSE OR NON-INFRINGING. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE COVERED CODE IS WITH YOU. SHOULD ANY COVERED CODE PROVE DEFECTIVE IN ANY RESPECT, YOU (NOT THE INITIAL DEVELOPER OR ANY OTHER CONTRIBUTOR) ASSUME THE COST OF ANY NECESSARY SERVICING, REPAIR OR CORRECTION. THIS DISCLAIMER OF WARRANTY CONSTITUTES AN ESSENTIAL PART OF THIS LICENSE. NO USE OF ANY COVERED CODE IS AUTHORIZED HEREUNDER EXCEPT UNDER THIS DISCLAIMER.
 .
 8. TERMINATION.
 .
 This License and the rights granted hereunder will terminate automatically if You fail to comply with terms herein and fail to cure such breach within 30 days of becoming aware of the breach. All sublicenses to the Covered Code which are properly granted shall survive any termination of this License. Provisions which, by their nature, must remain in effect beyond the termination of this License shall survive.
 .
 9. LIMITATION OF LIABILITY.
 .
 UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY, WHETHER TORT (INCLUDING NEGLIGENCE), CONTRACT, OR OTHERWISE, SHALL THE INITIAL DEVELOPER, ANY OTHER CONTRIBUTOR, OR ANY DISTRIBUTOR OF COVERED CODE, OR ANY SUPPLIER OF ANY OF SUCH PARTIES, BE LIABLE TO YOU OR ANY OTHER PERSON FOR ANY INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF GOODWILL, WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, OR ANY AND ALL OTHER COMMERCIAL DAMAGES OR LOSSES, EVEN IF SUCH PARTY SHALL HAVE BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGES. THIS LIMITATION OF LIABILITY SHALL NOT APPLY TO LIABILITY FOR DEATH OR PERSONAL INJURY RESULTING FROM SUCH PARTY'S NEGLIGENCE TO THE EXTENT APPLICABLE LAW PROHIBITS SUCH LIMITATION. SOME JURISDICTIONS DO NOT ALLOW THE
 EXCLUSION OR LIMITATION OF INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THAT EXCLUSION AND LIMITATION MAY NOT APPLY TO YOU.
 .
 10. U.S. GOVERNMENT END USERS.
 .
 The Covered Code is a "commercial item," as that term is defined in 48 C.F.R. 2.101 (Oct. 1995), consisting of "commercial computer software" and "commercial computer software documentation," as such terms are used in 48 C.F.R. 12.212 (Sept. 1995). Consistent with 48 C.F.R. 12.212 and 48 C.F.R. 227.7202-1 through 227.7202-4 (June 1995), all U.S. Government End Users acquire Covered Code with only those rights set forth herein.
 .
 11. MISCELLANEOUS.
 .
 This License represents the complete agreement concerning subject matter hereof. If any provision of this License is held to be unenforceable, such provision shall be reformed only to the extent necessary to make it enforceable. This License shall be governed by Dutch law provisions (except to the extent applicable law, if any, provides otherwise), excluding its conflict-of-law provisions. With respect to disputes in which at least one party is a citizen of, or an entity chartered or registered to do business in, the The Netherlands: (a) unless otherwise agreed in writing, all disputes relating to this License (excepting any dispute relating to intellectual property rights) shall be subject to final and binding arbitration, with the losing party paying all costs of arbitration; (b) any arbitration relating to this Agreement shall be held in Almelo, The Netherlands; and (c) any litigation relating to this Agreement shall be subject to the jurisdiction of the court of Almelo, The Netherlands with the losing party responsible for costs, including without limitation, court costs and reasonable attorneys fees and expenses. Any law or regulation which provides that the language of a contract shall be construed against the drafter shall not apply to this License.
 .
 12. RESPONSIBILITY FOR CLAIMS.
 .
 Except in cases where another Contributor has failed to comply with Section 3.4, You are responsible for damages arising, directly or indirectly, out of Your utilization of rights under this License, based
 on the number of copies of Covered Code you made available, the revenues you received from utilizing such rights, and other relevant factors. You agree to work with affected parties to distribute
 responsibility on an equitable basis.
 .
 EXHIBIT A.
 .
 "The contents of this file are subject to the FreeImage Public License Version 1.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://home.wxs.nl/~flvdberg/freeimage-license.txt
 .
 Software distributed under the License is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for the specific language governing rights and limitations under the License.

License: GPL-2.0
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; version 2 dated June, 1991.
 .
 On Debian systems, the complete text of version 2 of the GNU General
 Public License can be found in '/usr/share/common-licenses/GPL-2'.

License: GPL-3.0
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; version 3 dated June, 2007.
 .
 On Debian systems, the complete text of version 3 of the GNU General
 Public License can be found in '/usr/share/common-licenses/GPL-3'.

License: Apache-2.0
 On Debian systems, the complete text of the Apache License, Version 2.0
 can be found in '/usr/share/common-licenses/Apache-2.0'.

License: Paintlib
 The paintlib source code and all documentation are copyright (c) 1996-2002
 Ulrich von Zadow and other contributors.
 .
 The paintlib source code is supplied "AS IS". Ulrich von Zadow and other
 contributors disclaim all warranties, expressed or implied, including,
 without limitation, the warranties of merchantability and of fitness for
 any purpose. The authors assume no liability for direct, indirect,
 incidental, special, exemplary, or consequential damages, which may
 result from the use of paintlib, even if advised of the possibility of
 such damage.
 .
 Permission is hereby granted to use, copy, modify, and distribute this
 source code, or portions hereof, for any purpose, without fee, subject to
 the following restrictions:
 .
 1. The origin of this source code must not be misrepresented.
 2. Altered versions must be plainly marked as such and must not be
    misrepresented as being the original source.
 3. This Copyright notice may not be removed or altered from any source or
    altered source distribution.
 4. Executables containing paintlib or parts of it must state that the
    software "contains paintlib code. paintlib is copyright (c) 1996-2002
    Ulrich von Zadow and other contributors.". This notice must be
    displayed in at least one place where the copyright for the software
    itself is displayed. The documentation must also contain this notice.

License: NeuQuant
 Any party obtaining a copy of these files from the author, directly or
 indirectly, is granted, free of charge, a full and unrestricted
 irrevocable, world-wide, paid up, royalty-free, nonexclusive right and
 license to deal in this software and documentation files (the
 "Software"), including without limitation the rights to use, copy,
 modify, merge, publish, distribute, sublicense, and/or sell copies of the
 Software, and to permit persons who receive copies from any such party to
 do so, with the only requirement being that this copyright notice remain
 intact.

License: IJG
 The authors make NO WARRANTY or representation, either express or implied,
 with respect to this software, its quality, accuracy, merchantability, or
 fitness for a particular purpose.  This software is provided "AS IS", and
 you, its user, assume the entire risk as to its quality and accuracy.
 .
 This software is copyright (C) 1991-2013, Thomas G. Lane, Guido Vollbeding.
 All Rights Reserved except as specified below.
 .
 Permission is hereby granted to use, copy, modify, and distribute this
 software (or portions thereof) for any purpose, without fee, subject to
 these conditions:
 (1) If any part of the source code for this software is distributed, then
 this README file must be included, with this copyright and no-warranty
 notice unaltered; and any additions, deletions, or changes to the original
 files must be clearly indicated in accompanying documentation.
 (2) If only executable code is distributed, then the accompanying
 documentation must state that "this software is based in part on the work
 of the Independent JPEG Group".
 (3) Permission for use of this software is granted only if the user
 accepts full responsibility for any undesirable consequences; the authors
 accept NO LIABILITY for damages of any kind.
 .
 These conditions apply to any software derived from or based on the IJG
 code, not just to the unmodified library.  If you use our work, you ought
 to acknowledge us.
 .
 Permission is NOT granted for the use of any IJG author's name or company
 name in advertising or publicity relating to this software or products
 derived from it.  This software may be referred to only as "the
 Independent JPEG Group's software".
 .
 We specifically permit and encourage the use of this software as the
 basis of commercial products, provided that all warranty or liability
 claims are assumed by the product vendor.

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 21 days ago.

Report◂

DFSG NEW review for freeimage version 4.2.1+ds-1~exp1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: Yes
  • Packaging is of good quality: No
  • Issues: 0 blocker, 1 important, 0 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: 6 found

Licensing

debian/copyright is DEP-5 and matches the tree: the FreeImage/FreeImageRe code is offered as GPL-2.0 or GPL-3.0 or FIPL-1.0, and the files with other terms have their own stanzas (Apache-2.0 for the vendored Yato, Paintlib for PluginPICT.cpp, NeuQuant for NNQuantizer.cpp, IJG for cmake/libjpeg/*, and the eLynx/LGPL provenance of the PSD files is explained). FIPL-1.0 is non-free per the DFSG licence database because of its choice-of-venue clause, but it is only an alternative and the GPL-2.0/GPL-3.0 options (the project's original dual licence) make the source DFSG-free. Full texts of all licences not in /usr/share/common-licenses are present, and no file is left without a licence.

Packaging

The packaging is mostly careful (DEP-3 patches, autopkgtests, hardening, Multi-Arch: same, a justified SONAME bump, correct split and dependencies), but it cannot build on six of Debian's release architectures: the vendored Yato header only recognises x86, x86_64 and aarch64 and hits #error "Unknown architecture!" elsewhere, while all four binary packages are Architecture: any. The package would therefore fail to build on armel, armhf, mips64el, ppc64el, riscv64 and s390x.

Issues

important packaging 1. Vendored Yato rejects every architecture except x86, x86_64 and aarch64, so the Architecture: any package fails to build on six release architectures ◂
  • Files: 3rdParty/Yato/include/yato/prerequisites.h:18-23, 3rdParty/Yato/include/yato/finally.h:14, Source/Plugins/PluginHEIF.cpp:26, debian/control:25,40,55,71
  • Basis: checked, in the package or with a reference tool
  • Evidence: #if defined(__x86_64__) || defined(_M_X64) || defined(__aarch64__) || defined(_M_ARM64) || defined(_M_ARM64EC) ... #elif defined(__i386) || defined(_M_IX86) || defined(__ANDROID__) ... #else / #error "Unknown architecture!"
  • Problem: Source/CMakeLists.txt always adds Plugins/PluginHEIF.cpp (the FREEIMAGE_WITH_LIBHEIF default is ON; debian/rules only sets USE_SYSTEM_LIBHEIF), and that file includes yato/finally.h, which includes prerequisites.h unconditionally. On armel/armhf (__arm__), mips64el, ppc64el, riscv64, s390x and loong64 none of the tested macros is defined, so the preprocessor stops with #error and the build fails, although all four packages declare Architecture: any. This is not a test failure: the compilation of the library itself cannot start on those architectures.
  • Fix: Patch 3rdParty/Yato/include/yato/prerequisites.h to classify the missing architectures (or derive YATO_X64/YATO_X86 from pointer width), or update the vendored Yato copy to a version that supports them; then test-build on at least armhf, ppc64el and s390x.
Verified ◂
  • debian/copyright is in machine-readable format and covers the whole tree: Files: * plus later stanzas for 3rdParty/Yato/*, Wrapper/FreeImagePlus/*, Source/Plugins/PluginPICT.cpp, Source/FreeImage/NNQuantizer.cpp, cmake/libjpeg/*, the PSD files and debian/*. Files-Excluded names only Source/FreeImageToolkit/JPEGTransform.cpp and 3rdParty/LibJXR, both absent from the tree, and the leftover FreeImage_JPEGTransform declarations are disabled in Source/FreeImage.h.
  • Prescan binary files: TestAPI/exif.jxr is a JPEG XR fixture loaded at TestAPI/MainTestSuite.cpp:142; TestAPI/exif.jxl, TestAPI/exif_599.jxl and TestAPI/exif_rgba.jxl are JPEG XL fixtures loaded at TestAPI/MainTestSuite.cpp:151-153. They are test data, are not built into the library, and need no source. I did not open them (binary), but they are identified by the test code that reads them.
  • Prescan licence FIPL-1.0 (debian/copyright:24,88): the DFSG licence database rejects it for its §11 choice-of-venue clause, but the same stanza also offers GPL-2.0 and GPL-3.0, the upstream project states the original dual licence (Readme.md: Same to the original FreeImage dual license) and ships license-gplv2.txt and license-gplv3.txt. Debian can therefore distribute under the GPL; license-fi.txt is only the FIPL text itself, which is quoted in full in debian/copyright.
  • Prescan wording at debian/copyright:317 (Permission is NOT granted for the use of any IJG author's name ...): this is the standard IJG licence, which is free (it restricts only the use of IJG names in advertising). The only IJG-licensed file, cmake/libjpeg/jconfig.h, is not compiled by the Debian build, which uses -DUSE_SYSTEM_LIBJPEG=ON.
  • Prescan author Ulrich von Zadow is present in the Files: Source/Plugins/PluginPICT.cpp stanza (debian/copyright:48) and in the standalone Paintlib licence text; the author check is a false positive.
  • 3rdParty/Yato is genuinely not in Debian (apt-cache finds neither libyato-dev nor yato), so vendoring the pinned copy is justified; its Copyright: 2016-2020 Alexey Gruzdev / License: Apache-2.0 stanza matches 3rdParty/Yato/LICENSE and every header.
  • Apache-2.0 (Yato) is incompatible with GPL-2.0 but compatible with GPL-3.0, which the FreeImage files also offer, so the combined library has a free licence; the Paintlib conditions (attribution only) do not make PluginPICT.cpp non-free.
  • Read all of debian/ (control, rules, changelog, install files, tests, lrc/gbp/salsa configuration), all twelve patch headers, and the copyright/licence headers and licence greps of Source/, Wrapper/, cmake/, TestAPI/ and 3rdParty/Yato/; source bodies were sampled and grepped rather than read line by line.
  • Standards-Version: 4.7.2 is current enough against Policy 4.7.4.1 (first two components match). Build-Depends names exist: cmake 4.4.3, libjxr-dev 1.2, libheif-dev 1.23.6; pkgconf provides pkg-config.
  • The four .install files match what install(TARGETS FreeImage) and install(TARGETS FreeImagePlus) produce with dh_auto_configure's -DCMAKE_INSTALL_LIBDIR=lib/<multiarch>: the versioned libraries in the libfreeimage4/libfreeimageplus4 packages and the headers plus linker symlinks in the -dev packages; compat 13's dh_missing --fail-missing would catch any other installed file.
  • uscan found the packaged version as the newest upstream release (upstream 4.2.1, packaged 4.2.1+ds).
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0, GPL-2, GPL-3).
Not confirmed ◂
  • Source/CMakeLists.txt:166 becomes install(FILES TYPE RENAME) when USE_SYSTEM_LIBHEIF=ON, because cmake/dependency.heif.cmake returns before defining LibHEIF_INSTALL_LIBRARY/TYPE/NAME; whether CMake accepts that argument list could not be tested here (no build possible), and the changelog's abidiff results suggest the package did build.
  • Several upstream headers carry provenance notes that could imply further notices: Source/Plugins/PluginXBM.cpp:6 (part of the code adapted from the netPBM package (xbmtopbm.c)), Source/Plugins/PluginPCD.cpp:7 (Pascal code by Alex Kwak) and Source/Plugins/PluginJPEG.cpp:3 (IJG code); the originals are not in the package, so I could not judge whether their licences require notices that debian/copyright lacks. PluginXBM.cpp's readXBMFile/hex_table code does resemble netpbm's.
Proposed changes ◂

None.

Review Information

accepted — allocated to awm 20 days ago, started 20 days ago, completed 20 days ago.

Final Comment

Hi,

Still one issue identified by the LLM, but I'll leave you to resolve that one on your next upload.

Thanks!

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
4.2.1~git20260701.97e3a99+ds1-1~exp1 fb7702ab… 2026-10-16 03:19 2026-10-16 03:23 awm rejected VIEW

Public Notes

20 days ago ● public

Missed Author Check

Command: dfsg-author-check -markdown
Exit code: 1

Author check: freeimage-4.2.1+ds

Scanned 225 files. Authors declared in debian/copyright: 11.

Not named in debian/copyright (1):

  • Ulrich von Zadow
    • Source/Plugins/PluginPICT.cpp:30

Possibly named in debian/copyright under a similar name (1):

  • Thomas G. Lane. Modified 2009-2013 by Guido Vollbeding (might be Guido Vollbeding; Thomas G. Lane)
    • cmake/libjpeg/jconfig.h:4

Result: 1 holder not named in debian/copyright, and 1 possibly named under a similar name

To name them, add to the end of debian/copyright:

Files: Source/Plugins/PluginPICT.cpp
Copyright: 1996-2002 Ulrich von Zadow
License: Paintlib

Each paragraph names every holder found in its files, with the years their copyright lines give, and has the License of the paragraph that covers them now, which it takes the place of for them. Check the License, and whether the files' holders are all there: one a file names only in prose, or in a form the check passes over, is not.

20 days ago ● public

License Check

Command: dnq license-check -prepare
Exit code: 0

License check [main]:

Found 7 unique license identifier(s) in debian/copyright:

COMPATIBLE (3):
  Apache-2.0                          [Note: not compatible with GPL-2]
  GPL-2.0
  GPL-3.0

INCOMPATIBLE WITH DFSG (1):
  FIPL-1.0                            [FreeImage Public License v1.0; choice-of-venue clause discriminates by jurisdiction]

    The FreeImage Public License version 1.0 is a derivative of the Mozilla
    Public License 1.0, written for the FreeImage image-decoding library by
    Floris van den Berg. Most of its terms (the source-availability obligation,
    the LEGAL file requirement, the per-file Exhibit A notice and the
    file-based copyleft) mirror the MPL and are not in themselves a DFSG
    problem. It is considered incompatible because of its dispute-resolution
    terms:
    
    1. Choice of Venue
    Section 11 provides that any litigation relating to the license is subject
    to the jurisdiction of the court of Almelo, The Netherlands, with the
    losing party responsible for costs, and that disputes involving a Dutch
    party are subject to binding arbitration held in Almelo. As with the
    Amsterdam choice-of-venue clause in the QPL, Debian treats a mandatory
    foreign venue as an unfair restriction that discriminates against
    individuals or groups who lack the financial means, legal capability or
    travel access to defend themselves in that specific jurisdiction.
    
    2. Fee-shifting
    The same clause makes the losing party liable for the other side's court
    costs and reasonable attorneys' fees. Coupling distribution rights to a
    one-sided fee-shifting term further discourages exercising the freedoms the
    license otherwise grants.
    
    The license is OSI-listed by SPDX identifier but is not OSI-approved, and
    is not on the FSF's list of free software licenses.

UNKNOWN (not in DFSG license database):
  IJG                                 (manually verify DFSG compatibility)
  NeuQuant                            (manually verify DFSG compatibility)
  Paintlib                            (manually verify DFSG compatibility)

Result: ATTENTION REQUIRED
  - 1 DFSG-incompatible license(s) found
  - 3 unrecognized license(s) require manual review

Back to Dashboard | View all reviews for this package