DFSG NEW Queue

DFSG, Licensing & New Packages Team

jeolib-miallib 2.0.0-1~exp1

Package Information

DescriptionJRC morphological and image processing library - Development files

Miallib is a C library including image processing and mathematical morphology algorithms used by Join Research Center in their Big Data Analytics Platform, with binding for Python provided.

This package contains the files needed to develop a software that will use the Miallib (headers, static objects, configuration script).

MaintainerDebian GIS Project <pkg-grass-devel@lists.alioth.debian.org>
Changed ByBas Couwenberg <sebastic@debian.org>
Sponsorsebastic@debian.org
Distributionexperimental
Architectureany
VCSgit: https://salsa.debian.org/debian-gis-team/jeolib-miallib.git -b experimental (browse)
Popcon Installs1
Binary NEWYes (new binary packages of a source already in sid)
Trackerhttps://tracker.debian.org/pkg/jeolib-miallib
Uploaded2 hours ago

New Package Report

.changes◂
DateThu, 05 Nov 2026 14:38:53 +0100
Sourcejeolib-miallib
Version2.0.0-1~exp1
Changed-ByBas Couwenberg <sebastic@debian.org>
Architecturesource amd64
Distributionexperimental
Changelog◂
jeolib-miallib (2.0.0-1~exp1) experimental; urgency=medium
 .
   * Team upload.
   * New upstream release.
   * Rename library package for SONAME bump.
   * Drop uthash-dev build dependency.
   * Update symbols for 2.0.0.
.dsc◂
Package-Listlibmiallib-dev deb libdevel optional arch=any
libmiallib2 deb libs optional arch=any
Sectionlibdevel
Priorityoptional
Componentmain
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: jeolib-miallib
Upstream-Contact: miallib developers (https://github.com/ec-jrc/jeolib-miallib/issues)
Source: https://github.com/ec-jrc/jeolib-miallib

Files: *
Copyright: 2000, Arnold Meijster
           2000, Jos Roerdink
           2000, Michael Wilkinson
           2025, Francesco Lovergine <francesco@lovergine.com>
      2000-2026, European Union (Joint Research Centre)
License: GPL-3+

Files: cmake/modules/FindPROJ.cmake
Copyright: 2009, Mateusz Loskot <mateusz@loskot.net>
           2015, NextGIS <info@nextgis.com>
           2018, Hiroshi Miura
License: BSD-3-clause

Files: cmake/modules/FindGeoTIFF.cmake
Copyright: 2005-2019, Centre National d'Etudes Spatiales (CNES)
License: Apache-2.0

Files: core/doc/doxy2swig.py
Copyright: 2015, Michael Thon
                 Prabhu Ramachandran
License: BSD-2-clause

Files: debian/*
Copyright: 2024, Francesco Paolo Lovergine <frankie@debian.org>
License: GPL-3+

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache License can
 be found in `/usr/share/common-licenses/Apache-2.0'.

License: BSD-2-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 * Redistributions of source code must retain the above copyright notice, this
   list of conditions and the following disclaimer.
 .
 * Redistributions in binary form must reproduce the above copyright notice,
   this list of conditions and the following disclaimer in the documentation
   and/or other materials provided with the distribution.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 1) Redistributions of source code must retain the above copyright notice,
    this list of conditions and the following disclaimer.
 .
 2) Redistributions in binary form must reproduce the above copyright notice,
    this list of conditions and the following disclaimer in the documentation
    and/or other materials provided with the distribution.
 .
 3) Neither the name of the ORGANIZATION nor the names of its contributors may
    be used to endorse or promote products derived from this software without
    specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
 LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.

License: GPL-3+
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation, either version 3 of the License, or
 (at your option) any later version.
 .
 This package is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this program. If not, see <https://www.gnu.org/licenses/>.
 .
 On Debian systems, the complete text of the GNU General
 Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".

DFSG Assistant LLM REVIEW 1 blocker, 1 important, 5 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 0 hours ago.

Proposes a replacement debian/watch: debian/watch in version 5 format

Report◂

DFSG NEW review for jeolib-miallib version 2.0.0-1~exp1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: No
  • Packaging is of good quality: Yes
  • Issues: 1 blocker, 1 important, 5 minor
  • debian/watch: old format (version 4)
  • debian/copyright: machine-readable
  • Scan before the review: 1 found

Licensing

debian/copyright is DEP-5, matches the tree's notices well (GPL-3+ throughout, with BSD-3-clause for cmake/modules/FindPROJ.cmake, BSD-2-clause for core/doc/doxy2swig.py and Apache-2.0 for cmake/modules/FindGeoTIFF.cmake, and full text for each of those), and the holders it names — the EU Joint Research Centre plus the three uswilk.c authors — are the ones the files claim. Two things spoil it: swig/python/setup.py itself says its licence is 'to be defined', which no GPL-3+ claim can paper over, and core/c/convolve.c and core/c/rank.c still carry the "All rights reserved ... can only be obtained directly from its author" notices whose removal from chull.c was the point of the 1.1.5 upload. Nothing in the tree is non-free once those two are dealt with, and no file lacks its preferred form for modification.

Packaging

Competent, current packaging: debhelper 13 with a plain dh/cmake rule, hardening=+all, an SONAME-consistent library rename with a symbols file, DEP-5 copyright, gbp.conf, salsa CI and an experimental changelog matching the Vcs-Git branch. The defects are small: a handful of build dependencies nothing uses, Multi-Arch: same on the -dev package whose -dev dependencies are not co-installable, an empty Version in the installed miallib.pc, and a description promising static objects that are not shipped.

Issues

blocker licensing 1. swig/python/setup.py declares its own licence as 'to be defined', so the Files: * GPL-3+ claim does not cover it ◂
  • Files: swig/python/setup.py:112, debian/copyright (Files: * stanza)
  • Basis: checked, in the package or with a reference tool
  • Evidence: license="(c) European Commission. Exact licence to be defined", — the file carries no licence header of its own, and the only mention of a licence in the tree is the same line.
  • Problem: A distributed file whose own metadata says the licence is undetermined has no licence grant, so it is not distributable as free software, and debian/copyright's blanket License: GPL-3+ for Files: * asserts a grant the file itself denies. This is the one licence gap the tree has.
  • Fix: Get upstream to state the licence (the same copyright holder licenses the rest of the tree GPL-3+, so a header or a corrected license= value is the natural fix) and record it; if upstream will not, exclude the file from the source package and say so in debian/copyright.
important licensing 2. core/c/convolve.c and core/c/rank.c still say 'All rights reserved ... can only be obtained directly from its author' ◂
  • Files: core/c/convolve.c:1205-1206, core/c/rank.c:570-571, core/c/rank.c:689-690
  • Basis: checked, in the package or with a reference tool
  • Evidence: ** (c) by Pierre Soille. ALl rights reserved. This programme can only / ** be obtained directly from its author. — inside uc_squarevol() in convolve.c and uc_linerank()/uc_squarerank() in rank.c, both built into libmiallib2 (CMakeLists.txt SOURCES).
  • Problem: The sentence asserts a distribution restriction over code that ships in the binary, contradicting the GPL-3+ header at the top of the same files (Copyright (C) European Union (Joint Research Centre)), which is the operative grant from the same holder. The identical situation in chull.c was what made 1.1.5 necessary (changelog: 'removing of a non-free file', #1074409), so a reviewer will read these as leftover non-free terms rather than harmless comments.
  • Fix: Ask upstream to delete the stale note from both files; failing that, ship a DEP-3 patch removing the two lines with a note in debian/copyright if the copyright file is touched.
minor packaging 3. Build-Depends lists libfann-dev, libjsoncpp-dev, libssl-dev and swig, which nothing in the build uses, and libopenblas-dev only sets BLA_VENDOR ◂
  • Files: debian/control:5-19, CMakeLists.txt:456
  • Basis: checked, in the package or with a reference tool
  • Evidence: A whole-tree grep for fann|jsoncpp|json\.h|openssl|SSL_|swig finds hits only in README.md and debian/control; CMakeLists.txt calls set(BLA_VENDOR OpenBLAS) but never find_package(BLAS) and no source includes cblas.h.
  • Problem: Every build dependency must be installed for every build and on every buildd; four of them buy nothing, and libopenblas-dev is likewise carried in libmiallib-dev's Depends for a library that is never linked.
  • Fix: Drop libfann-dev, libjsoncpp-dev, libssl-dev and swig from Build-Depends (and libopenblas-dev from libmiallib-dev's Depends) unless upstream restores the code that used them.
minor packaging 4. libmiallib-dev is Multi-Arch: same but depends on libgdal-dev and libgsl-dev, which are not ◂
  • Files: debian/control:28 (libmiallib-dev stanza), debian/control:35-43
  • Basis: checked, in the package or with a reference tool
  • Evidence: Multi-Arch: same on libmiallib-dev with Depends: ... libgdal-dev, ... libgsl-dev; apt-cache show libgdal-dev and libgsl-dev lists no Multi-Arch field (5.6.34.3 requires that packages with the same name and version but different architectures 'can be installed concurrently').
  • Problem: The two -dev packages cannot be installed at the same time for two architectures, so the package cannot keep the promise 5.6.34.3 makes for Multi-Arch: same: dpkg would have to satisfy libgdal-dev and libgsl-dev for both architectures. libmiallib2 itself is fine — the runtime dependencies checked (libgdal39, libgeotiff5, libtiff6, libfftw3-double3, libgsl28, libshp4) are all Multi-Arch: same.
  • Fix: Drop Multi-Arch: same from libmiallib-dev (as other GIS -dev packages that depend on libgdal-dev do), or stop depending on the two non-co-installable -dev packages.
minor packaging 5. The installed miallib.pc gets an empty Version: field because PACKAGE_VERSION is never set ◂
  • Files: cmake.pc.in:9, CMakeLists.txt:50, CMakeLists.txt:400
  • Basis: inferred from what was read, not seen directly
  • Evidence: cmake.pc.in has Version: @PACKAGE_VERSION@, configured with configure_file ( "cmake.pc.in" "miallib.pc" @ONLY); project(miallib) has no VERSION, so only MIALLIB_VERSION_* exist, and cmake's configure_file documentation says a referenced variable 'will each be replaced with the current value of the variable, or the empty string if the variable is not defined'.
  • Problem: The -dev package ships a pkg-config file with no version, so pkg-config --modversion miallib returns nothing and a consumer's pkg_check_modules/Requires: version check against miallib cannot work, even though the file is otherwise correct.
  • Fix: Use Version: @MIALLIB_VERSION@ in cmake.pc.in (the variable CMakeLists.txt does set), or give project() a VERSION.
minor packaging 6. libmiallib-dev's description promises static objects the package does not contain ◂
  • Files: debian/control:47-48, debian/libmiallib-dev.install, CMakeLists.txt:349
  • Basis: checked, in the package or with a reference tool
  • Evidence: This package contains the files needed to develop a software that will use the Miallib (headers, static objects, configuration script). while add_library(${MIALLIB_LIB_NAME} SHARED ${SOURCES}) builds no static library and libmiallib-dev.install ships only usr/include/, usr/lib//lib*.so, usr/lib//pkgconfig/miallib.pc and usr/lib//cmake/*.
  • Problem: The description tells users they are getting a static library that does not exist, and no separate configuration script is installed either (pkg-config and CMake package files take its place).
  • Fix: Reword to 'headers, the shared library link and pkg-config/CMake configuration files'.
minor packaging 7. debian/watch is in the old version 4 format ◂
  • Files: debian/watch
  • Basis: found by the review tooling's own checks
  • Evidence: version=4
  • Problem: Version 5 is the current format of debian/watch.
  • Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.
Verified ◂
  • Read debian/control, rules, changelog, copyright, gbp.conf, source/format, source/lintian-overrides, upstream/metadata, .gitlab-ci.yml, libmiallib2.install, libmiallib-dev.install and the head of libmiallib2.symbols. There is no debian/patches, no debian/tests and no maintainer script.
  • debian/copyright is DEP-5 with the canonical Format line; every short name it uses (GPL-3+, BSD-2-clause, BSD-3-clause, Apache-2.0) has a stand-alone License paragraph, the permissive ones reproduce their notice, and GPL-3 and Apache-2.0 also point at /usr/share/common-licenses.
  • All 170 .c and .h files in core/c carry a Copyright (C) <year> European Union (Joint Research Centre) line and the GPL-3+ 'This file is part of miallib ... either version 3 ... or any later version' header; core/c/myhull.c additionally names 2025 Francesco Lovergine, which Files: * lists.
  • core/c/uswilk.c does claim Michael Wilkinson, Arnold Meijster and Jos Roerdink alongside the EU JRC; all four are named in the Files: * stanza, so the scan's 'possibly named' hit is resolved rather than an omission.
  • The scan's ced.c hit is a misparse: line 97 is ** authors: Pierre Soille (c) 1991 inside a function comment, and the 'IMAGE *ref: binary UCHAR image ...' text it read as a holder is the parameter documentation on the next line; the file's operative notice is its GPL-3+/EU JRC header, and Soille wrote the library as JRC staff, so the EU JRC as holder is right.
  • core/doc/miallib_logo.xcf is a GIMP project file, the editable source of core/doc/miallib_logo.png beside it; both sit under Files: * (GPL-3+) and account for the only binary data the scan could not classify. Not opened.
  • cmake/modules/FindPROJ.cmake is BSD-3-clause as its header says (Mateusz Loskot, NextGIS, Hiroshi Miura — exactly the stanza), FindGeoTIFF.cmake is Apache-2.0 per the CNES/Orfeo Toolbox header, FindSHAPELIB.cmake has no notice and falls under Files: . None of the three is installed (CMakeLists.txt installs only the generated miallib-.cmake), so they do not mix licences into the binary.
  • Files with no notice of their own — swig/include/.i, swig/python/packages/miallib/.py, swig/python/Makefile, swig/python/doc/source/*, core/doc/Doxyfile, .gitignore, cmake-config.h.in, cmake-config.in, cmake.pc.in, miallib-config.cmake.in — are covered by Files: * and nothing in them contradicts GPL-3+ (swig/python/setup.py is the exception, reported).
  • COPYING is the unmodified GPL-3 text, consistent with the GPL-3+ short name; there is no other COPYING/LICENCE/NOTICE/AUTHORS file anywhere in the tree, and no File-Excluded or missing file.
  • Standards-Version 4.7.4 against the reviewing system's Policy 4.7.4.1 — current; buildsystem, compat 13, hardening=+all, dh_makeshlibs -v2.0.0 and the libmiallib2/-dev split match Policy.
  • Build-Depends names exist in the archive for the ones queried (libgdal-dev, libgeotiff-dev, libgsl-dev, libfftw3-dev, libopenblas-dev, libproj-dev, libshp-dev); the remainder (cmake, debhelper-compat, libfann-dev, libjsoncpp-dev, libssl-dev, pkgconf, swig) were not queried but are ordinary archive packages.
  • libmiallib2.symbols has the libmiallib.so.2 #PACKAGE# #MINVER# header and Build-Depends-Package; most symbols keep @Base 1.1.5 from the old SONAME while a few new ones say 2.0.0. Not reported: libmiallib-dev depends on libmiallib2 (= ${binary:Version}), so the minimum versions are never used.
  • Changelog 2.0.0-1~exp1 to experimental agrees with gbp.conf's debian-branch and Vcs-Git's -b experimental; the earlier closes: #1124862 and the drop of uthash/patches match the tree (no uthash header, no patches).
  • Searched the whole tree (gitignore: false, .pc/ passed over) for non-commercial, no-modification, 'may not', 'shall not', 'only be used' and similar wording: no hits beyond the convolve.c/rank.c notices reported.
  • uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 2.0.1, packaged 2.0.0), which is not a fault of the package.
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0, GPL-3).
Not confirmed ◂
  • core/doc/doxy2swig.py has no copyright line and says only 'License: BSD style'; debian/copyright records BSD-2-clause and reproduces that text. Both BSD variants are free and GPL-3-compatible, so the answer does not turn on which it is, but the variant cannot be confirmed from the package.
  • The empty Version: in miallib.pc is inferred from cmake.pc.in and CMakeLists.txt plus cmake's documented substitution of the empty string; only a build would show the generated file.
  • Only libgdal39, libgeotiff5, libtiff6, libfftw3-double3, libgsl28 and libshp4 were checked for Multi-Arch: same as libmiallib2's runtime dependencies; the rest of ${shlibs:Depends} was not queried one by one.
Proposed: debian/watch in version 5 format ◂

debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.

Version: 5

Template: Github
Dist: https://github.com/ec-jrc/jeolib-miallib

Uploader's response to the LLM review

Waiting for the uploader's response until , because the review found serious issues.

Back to Dashboard | View all reviews for this package