Review: imagewmark 0.6.0-1

Package Information

Description	resilient invisible digital watermarking tool for images Imagewmark embeds and extracts encrypted, invisible digital watermarks in image files. Using a key-based cryptographic scheme, the embedded watermark can be reconstructed from cropped, scaled, or compressed variants of the watermarked image without requiring access to the original source image (blind decoding). The watermark embedding and detection algorithms are resilient against local geometric distortions and lossy compression formats.
Maintainer	Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
Changed By	Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
Sponsor	paulliu@debian.org
Distribution	unstable
Architecture	any
Closes	#1148246
Tracker	https://tracker.debian.org/pkg/imagewmark
Uploaded	1 month, 19 days ago

New Package Report

.changes◂

Changed-By	Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
Architecture	source amd64
Distribution	unstable
Date	Fri, 18 Sep 2026 13:42:21 +0100
Source	imagewmark
Version	0.6.0-1

Changelog◂

imagewmark (0.6.0-1) unstable; urgency=low
 .
   * Initial release. (Closes: #1148246)

.dsc◂

Section	graphics
Priority	optional
Component	main
Package-List	imagewmark deb graphics optional arch=any

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/tim-janik/imagewmark
Upstream-Name: imagewmark
Upstream-Contact: Tim Janik <timj@gnu.org>

Files:
 *
Copyright:
 2026 Tim Janik <timj@gnu.org>
 2026 Stefan Westerfeld <stefan@space.twc.de>
License: GPL-3.0+

Files: doc/imagewmark.1.md
Copyright: 2023-Present The Imagewmark Development Team.
License: GPL-3.0+

Files: src/version.sh
       cxx/minsearch.hh
       contrib/shuffled-pics.py
Copyright:
 2026 Tim Janik <timj@gnu.org>
 2026 Stefan Westerfeld <stefan@space.twc.de>
License: MPL-2.0

Files: cxx/3rdparty/CLI11/CLI11.hpp
Copyright:
 2017-2026 University of Cincinnati
License: BSD-3-clause

Files:
 debian/*
Copyright:
 2026 Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
License: GPL-3.0+

License: GPL-3.0+
 This package is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation, either version 3 of the License, or
 (at your option) any later version.
 .
 This package is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this package. If not, see <https://www.gnu.org/licenses/>.
Comment:
 On Debian systems, the complete text of the GNU General
 Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".

License: MPL-2.0
 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
 file, You can obtain one at http://mozilla.org/MPL/2.0/.
Comment:
 On Debian systems you can find the license in:
 /usr/share/common-licenses/MPL-2.0

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
 1. Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the distribution.
 3. Neither the name of the University nor the names of its contributors
    may be used to endorse or promote products derived from this software
    without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE HOLDERS OR
 CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Review Information

rejected — allocated to awm 25 days ago, started 25 days ago, completed 25 days ago.

Final Comment

Hi,

There are a number of issues which need to be resolved, but none are particularly complex and none relate to licensing.

[blocker] packaging Python code imports scipy.misc, removed in SciPy >= 1.12: program cannot start and the build’s smoke test fails

Files: src/common.py:3, src/embed.py:4, src/extract.py:11, src/imagewmark.py:19, debian/rules
Evidence: import scipy.misc, scipy.signal, cv2 (unconditional top-level import in every one of these modules).
Problem: scipy.misc was deprecated in SciPy 1.10 and removed in 1.12; Debian currently ships python3-scipy 1.17.1-5+b1, which has no scipy.misc. The imports are executed at module load, before argument parsing, so imagewmark cannot start at all, the override_dh_auto_test smoke run (./imagewmark --help) in debian/rules aborts the build, and the autopkgtest fails. Grep shows no scipy.misc.* or scipy.signal.* attribute is ever used, so the import is a latent upstream bug that only this packaging makes fatal.
Fix: Ship a Debian patch that drops the unused scipy.misc (and scipy.signal) member from those import lines, or ask upstream to do so; re-run the build and autopkgtest to confirm.

[important] packaging Upstream defaults to clang++ but clang is not in Build-Depends

Files: cxx/Makefile.mk:3, debian/control, debian/rules
Evidence: CXX ?= clang++ in cxx/Makefile.mk; debian/rules runs plain dh $@ with no compiler override and control has no clang build-dependency.
Problem: On a clean buildd the build chroot contains only Build-Depends plus build-essential (gcc/g++); clang++ is then command not found and every C++ target in make all fails. building the current Debian should not depend on clang being present accidentally.
Fix: Either add clang to Build-Depends or set the compiler in debian/rules, e.g. pass CC=$(CC) CXX=$(CXX) (from dpkg-buildflags) to dh_auto_build.

[minor] packaging Upstream CXXFLAGS assignment drops Debian hardening flags

Files: cxx/Makefile.mk:5
Evidence: CXXFLAGS := -Wall -O3 -g — a hard := override that clobbers whatever dpkg-buildflags exported.
Problem: Because the Makefile uses :=, Debian’s default CXXFLAGS hardening (-D_FORTIFY_SOURCE=2, -fstack-protector-strong, -Wformat -Werror=format-security) never reach the compiler, which would be flagged by a build-log hardening check (blhc) and weakens the shipped C++ helpers.
Fix: Pass the hardened flags through, e.g. override the build step with dh_auto_build -- CXXFLAGS="$(shell dpkg-buildflags --get CXXFLAGS) -Wall -O3 -g", preferably combined with the compiler fix above.

[minor] packaging Bundled CLI11 header instead of Debian’s libcli11-dev

Files: cxx/3rdparty/CLI11/CLI11.hpp, cxx/Makefile.mk
Evidence: Header begins CLI11: Version 2.6.2 ... generated by MakeSingleHeader.py; Debian already ships libcli11-dev 2.6.1+ds-1.
Problem: POLICY §4.13: embedding a copy of third-party code that Debian already packages as a library means security and bug fixes to CLI11 do not propagate to this package; Debian’s libcli11-dev is nearly the same release.
Fix: Build-Depend on libcli11-dev and include <CLI11/CLI11.hpp> (the package’s own Makefile comments already mention libcli11-dev); drop the vendored header or keep it only if the package cannot build against the system header, with justification.

[minor] packaging debian/watch is in the old version 4 format

Files: debian/watch
Evidence: version=4
Problem: Version 5 is the current format of debian/watch.
Fix: Convert it to version 5; a mechanical conversion is included below.

=======================================================================
Version: 5

Compulsory line, this is a version 4 file.

GitHub hosted projects.

Template: Github
Dist: https://github.com/tim-janik/imagewmark

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
0.6.0-1	88f37fad…	2026-10-16 02:39	2026-10-16 02:47	awm	accepted	VIEW

Back to Dashboard | View all reviews for this package