Review: imagewmark 0.6.0-1

Package Information

Description	resilient invisible digital watermarking tool for images Imagewmark embeds and extracts encrypted, invisible digital watermarks in image files. Using a key-based cryptographic scheme, the embedded watermark can be reconstructed from cropped, scaled, or compressed variants of the watermarked image without requiring access to the original source image (blind decoding). The watermark embedding and detection algorithms are resilient against local geometric distortions and lossy compression formats.
Maintainer	Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
Changed By	Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
Sponsor	paulliu@debian.org
Distribution	unstable
Architecture	any
Closes	#1148246
Tracker	https://tracker.debian.org/pkg/imagewmark
Uploaded	23 days ago

New Package Report

.changes◂

Date	Thu, 15 Oct 2026 12:30:28 +0100
Source	imagewmark
Version	0.6.0-1
Changed-By	Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
Architecture	source amd64
Distribution	unstable

Changelog◂

imagewmark (0.6.0-1) unstable; urgency=low
 .
   * Initial release. (Closes: #1148246)
   * debian/patches/0001_remove_scipy_misc.patch: remove scipy.{misc,signal}
   * debian/control: add clang and libcli11-dev to Build-Depends
   * debian/rules: add hardening flags
   * debian/patches/0002_use_system_libcli11.patch: use system libcli11-dev
   * debian/watch: convert to version 5

.dsc◂

Package-List	imagewmark deb graphics optional arch=any
Section	graphics
Priority	optional
Component	main

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/tim-janik/imagewmark
Upstream-Name: imagewmark
Upstream-Contact: Tim Janik <timj@gnu.org>

Files:
 *
Copyright:
 2026 Tim Janik <timj@gnu.org>
 2026 Stefan Westerfeld <stefan@space.twc.de>
License: GPL-3.0+

Files: doc/imagewmark.1.md
Copyright: 2023-Present The Imagewmark Development Team.
License: GPL-3.0+

Files: src/version.sh
       cxx/minsearch.hh
       contrib/shuffled-pics.py
Copyright:
 2026 Tim Janik <timj@gnu.org>
 2026 Stefan Westerfeld <stefan@space.twc.de>
License: MPL-2.0

Files: cxx/3rdparty/CLI11/CLI11.hpp
Copyright:
 2017-2026 University of Cincinnati
License: BSD-3-clause

Files:
 debian/*
Copyright:
 2026 Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
License: GPL-3.0+

License: GPL-3.0+
 This package is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation, either version 3 of the License, or
 (at your option) any later version.
 .
 This package is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this package. If not, see <https://www.gnu.org/licenses/>.
Comment:
 On Debian systems, the complete text of the GNU General
 Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".

License: MPL-2.0
 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
 file, You can obtain one at http://mozilla.org/MPL/2.0/.
Comment:
 On Debian systems you can find the license in:
 /usr/share/common-licenses/MPL-2.0

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
 1. Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the distribution.
 3. Neither the name of the University nor the names of its contributors
    may be used to endorse or promote products derived from this software
    without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE HOLDERS OR
 CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 3 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 23 days ago.

Report◂

DFSG NEW review for imagewmark version 0.6.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 3 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The source is DFSG-free and debian/copyright is in DEP-5 format and substantially accurate. It identifies the GPL-3.0+ files (src/.py, cxx/.cc/.hh, Makefiles, README, tests scripts), the three MPL-2.0 files (src/version.sh, cxx/minsearch.hh, contrib/shuffled-pics.py) and the bundled CLI11 header (BSD-3-clause) correctly, matches the copyright holders, and includes the full BSD-3-clause text while referencing /usr/share/common-licenses for GPL-3 and MPL-2.0 (both present). The only inaccuracy is the wording of the reproduced BSD-3-clause clause 3, which is minor.

Packaging

The packaging is of good quality: debhelper-compat 13 with a clean dh rules files, Rules-Requires-Root: no, dh-exec for the multiarch install/links, a single Architecture: any binary, complete Build-Depends and Depends matching the actual imports and libraries, an autopkgtest, DEP-3 patches and a sane changelog. The install layout (C++ dispatcher in /usr/bin exec'ing the Python under /usr/lib//imagewmark) is consistent. Only minor points remain: no Vcs-* fields, and an unused vendored CLI11 copy left in the source.

Issues

minor licensing 1. Reproduced BSD-3-clause text in debian/copyright differs from the shipped CLI11 notice ◂

Files: debian/copyright:70, cxx/3rdparty/CLI11/CLI11.hpp:19
Evidence: debian/copyright: 3. Neither the name of the University nor the names of its contributors and IN NO EVENT SHALL THE HOLDERS OR CONTRIBUTORS; cxx/3rdparty/CLI11/CLI11.hpp:19: 3. Neither the name of the copyright holder nor the names of its contributors / IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS.
Problem: The full licence text quoted for the BSD-3-clause stanza is not the text of the file it covers: clause 3 names "the University" (a different CLI11 wording) and several phrases differ from the header. The licence is identified by the correct short name (BSD-3-clause) and the holder is right, so this is only an inaccuracy in the reproduced text.
Fix: Reproduce the BSD-3-clause text verbatim from cxx/3rdparty/CLI11/CLI11.hpp in the License: BSD-3-clause paragraph.

minor packaging 2. Unused vendored copy of CLI11 left in the source tree ◂

Files: cxx/3rdparty/CLI11/CLI11.hpp, cxx/Makefile.mk:22-31
Evidence: Deiban patch debian/patches/0002_use_system_libcli11.patch replaces #include "3rdparty/CLI11/CLI11.hpp" with <CLI/CLI.hpp>, and cxx/Makefile.mk still carries a wget/sha256 rule that provides cxx/3rdparty/CLI11/CLI11.hpp.
Problem: The 462 KB convenience copy is neither compiled nor installed (nothing includes it after the patch; make install copies only the four binaries), while Debian already ships CLI11 as libcli11-dev, which the build now uses. Policy 4.13 says a package should not use a convenience copy of a library already in the archive.
Fix: Remove cxx/3rdparty/CLI11/CLI11.hpp and its download rule; the file cannot simply be deleted on its own because the make rule would then try to fetch it.

minor packaging 3. No Vcs-Git/Vcs-Browser fields in debian/control ◂

Files: debian/control
Evidence: debian/control has Homepage but no Vcs-* fields; debian/upstream/metadata only names the upstream repository.
Problem: Nothing says where the Debian packaging is maintained, which a sponsor will normally ask for before accepting a new package.
Fix: Add Vcs-Git and Vcs-Browser pointing at the Debian packaging repository.

Verified ◂

debian/copyright read in full: DEP-5 (correct Format URL), Files: * catch-all plus overrides for doc/imagewmark.1.md, the MPL-2.0 files, cxx/3rdparty/CLI11/CLI11.hpp and debian/*; no Files-Excluded.
Inventoried all upstream files (45 files, .pc/ excluded) and grepped the whole tree for Copyright/(C)/©/Licensed under/SPDX/GNU/LGPL/Apache/MPL/public-domain wording: every file matches a stanza.
Headers confirm the assignment: src/.py and cxx/.cc/.hh are GPL-3.0+; src/version.sh, cxx/minsearch.hh and contrib/shuffled-pics.py carry the MPL-2.0 Source Code Form notice; cxx/3rdparty/CLI11/CLI11.hpp carries the BSD-3-clause notice (CLI11 2.6.2, University of Cincinnati).
LICENSE is the GPL-3 text; /usr/share/common-licenses contains both GPL-3 and MPL-2.0, so the short notices plus comment references in debian/copyright are sufficient; the full BSD-3 text is included.
No non-free terms anywhere (non-commercial, no-modification, field-of-use, JSON 'Good, not Evil', CC-*-NC/ND): the only 'noncommercially' hit is inside the GPL-3 text in LICENSE.
No built/binary artifacts in the tree (no .o/.so/.a/.jar/.class/.pyc/.exe); no minified JS/CSS; the source is complete.
cxx/3rdparty/CLI11/CLI11.hpp is not compiled (patch 0002 uses system libcli11-dev) and not installed (make install copies only cxx/{cornersync,peaks2grid,imagewmark,wmops}); the bundled file is only referenced by the make download rule, so no network access happens at build since the file is present.
tests/example01.svg is a small synthetic test image (a few shapes and text), covered by Files: * as GPL-3.0+; tests/policy.xml is an ImageMagick security-policy config used only by the test harness (MAGICK_CONFIGURE_PATH in tests/Makefile) and is not installed.
tests/gen-tests-mk has no licence header but is covered by the Files: * GPL-3.0+ stanza; debian/patches have DEP-3 headers (Description/Origin/Author/Forwarded/Last-Update).
Packaging: debhelper-compat (= 13), Rules-Requires-Root: no, no maintainer scripts; dh-exec used for ${DEB_HOST_MULTIARCH} in imagewmark.install and imagewmark.links; debian/manpages, .docs, .doc-base (Section: Graphics is a valid doc-base section), clean, upstream/metadata and source/format all present and consistent.
Build-Depends match the build (clang for CXX, libcli11-dev for <CLI/CLI.hpp>, libopencv-dev/libopenimageio-dev/libgcrypt20-dev for the C++ links, pandoc for the man page, the python3-* modules used by the doc and runtime code); libopencv-dev pulls pkgconf, so pkg-config works. Depends match the imports in the installed Python (numpy, scipy, cv2, skimage, imageio, matplotlib) plus python3 and ${shlibs:Depends}.
debian/tests/control declares imagemagick, jq, librsvg2-bin and @ for test-readme-example, and the script uses exactly rsvg-convert, convert, jq and imagewmark; Testsuite: autopkgtest is in the .dsc.
debian/changelog: 0.6.0-1, unstable, urgency=low, closes #1148246. Standards-Version 4.7.2; current Policy is 4.7.4.1, first two components match, so no issue.
The pre-review scan found no missing copyright holder: all source authors it checked are named in debian/copyright.
uscan found the packaged version as the newest upstream release (upstream 0.6.0, packaged 0.6.0).

Not confirmed ◂

Provenance of tests/policy.xml: its text reads like ImageMagick's shipped 'open' policy file, but no ImageMagick is installed on the reviewing system to compare, so I could not confirm whether it is copied from ImageMagick (which would warrant its own attribution) or written/adapted by the upstream authors.
Build and autopkgtest success were not run; the tree contains every file debian/rules and the tests reference, and I found no missing input.
Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused: glob: " /usr/share/ImageMagick*" is not a file of the package or of the reviewing system.

Proposed changes ◂

None.

Review Information

accepted — allocated to awm 23 days ago, started 23 days ago, completed 23 days ago.

Final Comment

Hi,

Thanks for your changes. The LLM found a few minor issues this time, but they might be bogus - I'm still tuning the noise level so I'd appreciate knowing whether they are valid even if they are all minor.

Click the link for the full review details where you can read the LLM review.

Thanks!

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
0.6.0-1	5d2b686a…	2026-10-13 05:21	2026-10-13 05:32	awm	rejected	VIEW

Back to Dashboard | View all reviews for this package