jpeg-xl 0.12.0-1~exp1

Package Information

Description	JPEG XL Image Coding System - "JXL" (command line utility) The JPEG XL Image Coding System (ISO/IEC 18181) is a lossy and lossless image compression format. It has a rich feature set and is particularly optimized for responsive web environments, so that content renders well on a wide range of devices. Moreover, it includes several features that help transition from the legacy JPEG format. This package installs the command line utilities.
Maintainer	Debian PhotoTools Maintainers <pkg-phototools-devel@lists.alioth.debian.org>
Changed By	xiao sheng wen <atzlinux@debian.org>
Sponsor	atzlinux@debian.org
Distribution	experimental
Architecture	any all
VCS	git: https://salsa.debian.org/debian-phototools-team/libjxl.git (browse)
Closes	#1147977, #1148352
Popcon Installs	113345
Binary NEW	Yes (new binary packages of a source already in sid)
Tracker	https://tracker.debian.org/pkg/jpeg-xl
Uploaded	1 hour ago

New Package Report

.changes◂

Date	Sun, 08 Nov 2026 17:58:57 +0800
Source	jpeg-xl
Version	0.12.0-1~exp1
Changed-By	xiao sheng wen <atzlinux@debian.org>
Architecture	source all loong64
Distribution	experimental

Changelog◂

jpeg-xl (0.12.0-1~exp1) experimental; urgency=medium
 .
   * Team upload.
   * Bump debhelper-compat 14
   * add d/gbp.conf
   * d/watch: add Pgp-Mode: none
   * New upstream version 0.12.0, Closes: #1148352
   * Refresh patches
   * d/control:
       - Build-Depends remove package version number
       - Build-Depends remove architecture list
       - Build-Depends libjxl-testdata set version number
         >= .0~git20250513.73695d3-5, as new upstream version 0.12 check
         usr/share/libjxl-testdata/README.md in CMakeLists.txt
       - Package: libjpegxl-java remove the Multi-Arch: same field,
         Closes: #1147977
   * d/rules: update override_dh_install-indep,
     set path obj-*/html --> obj-*/doc/html
   * d/libjxl-devtools.install: add install usr/bin/jxltran
   * libjxl-devtools package add new manpages: jxltran.1
   * Bump SOVERSION to 0.12
   * d/libjxl0.12.symbols: update to SOVERSION 0.12

.dsc◂

Package-List	jpeg-xl-doc deb doc optional arch=all libjpegxl-java deb java optional arch=amd64,arm64,armel,armhf,i386,mips64el,ppc64el,riscv64,s390x,loong64,alpha,ia64,m68k,powerpc,ppc64,sh4,sparc64,x32 profile=!nojava profile:v1=!nojava libjxl-dev deb libdevel optional arch=any libjxl-devtools deb utils optional arch=any libjxl-gdk-pixbuf deb libs optional arch=any libjxl-tools deb utils optional arch=any libjxl0.12 deb libs optional arch=any
Section	doc
Priority	optional
Component	main

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: jpeg-xl
Source: https://github.com/libjxl/libjxl

Files: *
Copyright: 2020 the JPEG XL Project
License: BSD-3-clause-Google

Files: tools/ssimulacra.cc
Copyright: 2005, Rabah Mehdi <mehdi.rabah@gmail.com>,
 2009, Philipp Klaus Krause <philipp@colecovision.eu>
License: ISC-License
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
 copyright notice and this permission notice appear in all copies.
 .
 THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

License: BSD-3-clause-Google
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
 .
 * Redistributions of source code must retain the above copyright
 notice, this list of conditions and the following disclaimer.
 * Redistributions in binary form must reproduce the above
 copyright notice, this list of conditions and the following disclaimer
 in the documentation and/or other materials provided with the
 distribution.
 * Neither the name of Google Inc. nor the names of its
 contributors may be used to endorse or promote products derived from
 this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Files: debian/*
Copyright: 2021 Mathieu Malaterre <malat@debian.org>
           2026 xiao sheng wen <atzlinux@debian.org>
License: BSD-3-clause-Google
 Same as above

DFSG Assistant LLM REVIEW 4 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 0 hours ago.

Report◂

DFSG NEW review for jpeg-xl version 0.12.0-1~exp1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 4 blocker, 0 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 3 found

Licensing

Every licence found in the tree is DFSG-free (BSD-3-Clause, Apache-2.0, MIT, zlib, ISC), so nothing here is non-free and the licences are mutually compatible. debian/copyright, however, describes the whole tree except tools/ssimulacra.cc as BSD-3-clause-Google under Files: *, and that is inaccurate: it leaves out the zlib-licensed APNG code, the Apache-2.0 and MIT files in third_party/, the ITU/ISO/IEC BSD-3 file under third_party/HEVCSoftware/, and it points the ISC stanza at the wrong file. The zlib and MIT notices it should reproduce are not in /usr/share/common-licenses, so their texts must be added.

Packaging

The packaging is largely in good shape: debhelper compat 14 with a clean dh rules file, correct build-dependency split, a maintained symbols file naming the new 0.12 sonames, a doc package built only in indep builds, working help2man generation ordered after dh_install, an autopkgtest that uses only installed files, and Standards-Version 4.7.4 against Policy 4.7.4.1. The only defects found are minor: a stale debian/control.in and a dead rule that regenerates debian/control from it, and a ${java:Depends} substvar that nothing sets.

Issues

blocker licensing 1. Files: * claims the zlib-licensed APNG files are BSD-3-clause-Google and omits Max Stepin's copyright ◂

Files: debian/copyright:5-7, lib/extras/dec/apng.cc:13-33, lib/extras/enc/apng.cc:13-33, lib/extras/LICENSE.apngdis:7-22
Basis: checked, in the package or with a reference tool
Evidence: lib/extras/dec/apng.cc:13 * Copyright (c) 2010-2015 Max Stepin, :16 * zlib license; lib/extras/LICENSE.apngdis:7 Copyright (c) 2010-2015 Max Stepin, :10 zlib license. debian/copyright has only Files: * ... License: BSD-3-clause-Google and a stanza for tools/ssimulacra.cc.
Problem: The two apng.cc files (parts taken from APNG Disassembler) and the standalone lib/extras/LICENSE.apngdis are zlib-licensed and carry Max Stepin's copyright, but Files: * declares them BSD-3-clause-Google. Their copyright holder is not named, and the zlib licence text is not reproduced; zlib is not one of the licences in /usr/share/common-licenses, so DEP-5 requires its text (copyright-format 1.0 section 5.3/6.7).
Fix: Add a Files stanza for lib/extras/README.md's siblings (lib/extras/LICENSE.apngdis lib/extras/dec/apng.cc lib/extras/enc/apng.cc) with Copyright: 2010-2015 Max Stepin and a stand-alone License: Zlib paragraph carrying the notice from lib/extras/LICENSE.apngdis. The files' own headers should keep their upstream BSD-3 statement, so License: BSD-3-clause-Google AND Zlib is also acceptable if the BSD text is kept in the Files stanza.

blocker licensing 2. third_party/ files are Apache-2.0 and MIT, not BSD-3-clause-Google, and Wildfire Games is not named ◂

Files: debian/copyright:5-7, third_party/CMakeLists.txt:1-3, third_party/dirent.cc:1-12,41-48, third_party/dirent.h:1-12, third_party/lcms2.cmake:1-3, third_party/sjpeg.cmake:1-3, third_party/skcms.cmake:1-3, third_party/testing.cmake:1-3
Basis: checked, in the package or with a reference tool
Evidence: third_party/dirent.cc:3 // Licensed under the Apache License, Version 2.0 (the "License");; :41 /* Copyright (C) 2010 Wildfire Games. followed by the MIT permission text. Same Apache header in third_party/dirent.h, CMakeLists.txt and the *.cmake files.
Problem: Files: * labels all of these BSD-3-clause-Google. They are Apache-2.0 (third_party/CMakeLists.txt:1 also says Copyright (c) the JPEG XL Project, but the licence is Apache-2.0), and third_party/dirent.cc additionally contains MIT-licensed code from Wildfire Games, whose copyright holder and MIT notice are missing. DEP-5 requires the copyright holders and licence of each group of files, and MIT's notice must be reproduced in full (it is not in /usr/share/common-licenses).
Fix: Add a Files stanza for third_party/dirent.cc third_party/dirent.h third_party/CMakeLists.txt third_party/*.cmake with the JPEG XL Project copyright, License: Apache-2.0 referring to /usr/share/common-licenses/Apache-2.0, and a Files stanza for third_party/dirent.cc naming Wildfire Games with the full MIT text.

blocker licensing 3. third_party/HEVCSoftware/cfg/LICENSE (BSD-3, ITU/ISO/IEC) is not described and its holder is not named ◂

Files: debian/copyright:5-7, third_party/HEVCSoftware/cfg/LICENSE:6-14, third_party/HEVCSoftware/cfg/encoder_intra_main_scc_10.cfg
Basis: checked, in the package or with a reference tool
Evidence: third_party/HEVCSoftware/cfg/LICENSE:6 Copyright (c) 2010-2017, ITU/ISO/IEC, :9 Redistribution and use in source and binary forms...; third_party/HEVCSoftware/README.md says the directory holds modified configuration files from the HEVC reference encoder.
Problem: Files: * attributes these configuration files and their licence file to 2020 the JPEG XL Project under BSD-3-clause-Google. The real holder, ITU/ISO/IEC, is not named anywhere in debian/copyright (the third clause also names ITU/ISO/IEC, so it is a distinct licence notice, not the project's).
Fix: Add a Files stanza for third_party/HEVCSoftware/* with Copyright: 2010-2017, ITU/ISO/IEC and License: BSD-3-clause reproducing the notice from that LICENSE file.

blocker licensing 4. The ISC stanza names tools/ssimulacra.cc, but the ISC notice and holders are in tools/ssimulacra.txt ◂

Files: debian/copyright:9-20, tools/ssimulacra.cc:1-4, tools/ssimulacra.txt:51-68
Basis: checked, in the package or with a reference tool
Evidence: debian/copyright:9-11 Files: tools/ssimulacra.cc ... Copyright: 2005, Rabah Mehdi ... 2009, Philipp Klaus Krause; tools/ssimulacra.cc:1-4 is // Copyright (c) the JPEG XL Project Authors. with a BSD-style license; the Mehdi/Krause notices quoted in the stanza are in tools/ssimulacra.txt:51-68.
Problem: The stanza's holders and ISC text belong to tools/ssimulacra.txt, which Files: * then declares BSD-3-clause-Google, while tools/ssimulacra.cc is the project's own BSD-3 reimplementation. debian/copyright therefore misstates the licence of both files, and the file that needs the ISC notice reproduced (tools/ssimulacra.txt) is the one not covered by it. Note also that Mehdi's text at :53 ("Feel free to use it as you want") is not the ISC permission the stanza claims; only the Krause part is.
Fix: Change the stanza's Files: to tools/ssimulacra.txt (and any other file carrying that notice), and state there what the file actually grants, with the Krause ISC text. Leave tools/ssimulacra.cc under Files: */BSD-3.

minor packaging 5. debian/control.in is stale and its regeneration rule can never work (undefined @GCC_13_ARCHS@) ◂

Files: debian/control.in:7-13,23,124, debian/rules:102-103
Basis: checked, in the package or with a reference tool
Evidence: debian/rules:102 debian/control: debian/control.in / sed -e "s/@GCC_13_ARCHS@/$(GCC_13_ARCHS)/g;...", but rules defines only TCMALLOC_ARCHS, JAVA_ARCHS and no GCC_13_ARCHS; control.in still says gcc-13 [@GCC_13_ARCHS@], debhelper-compat (= 13), Standards-Version: 4.7.0, libjxl0.11, while debian/control says compat 14, 4.7.4 and libjxl0.12.
Problem: Nothing depends on debian/control, so the sed rule is dead, and debian/control is not generated. The shipped source contains two contradicting control files, and running the rule (or debian/rules debian/control, the makefile's default goal) would silently produce a control file with empty architecture lists and the old compat level. A sponsor or future maintainer editing control.in would get a broken result.
Fix: Delete debian/control.in and the debian/control: sed rule, keeping debian/control as the single source of truth (or, if generation is intended, make debian/control depend on it and pass @GCC_13_ARCHS@ correctly).

minor packaging 6. libjpegxl-java Depends uses ${java:Depends}, which nothing in the source sets ◂

Files: debian/control:123, debian/rules:1-96
Basis: checked, in the package or with a reference tool
Evidence: debian/control:123 Depends: ${java:Depends}, ${misc:Depends}, ${shlibs:Depends}; debian/rules invokes only dh $@ --buildsystem=cmake+ninja with no javahelper (no --with javahelper, no javahelper in Build-Depends, no debian/*.jinfo).
Problem: No helper produces a java:Depends substvar here, so dpkg-gencontrol warns unknown substitution variable ${java:Depends} and writes an empty value (deb-substvars(5): 'If a variable is referred to but not defined it generates a warning and an empty value is assumed'). The field therefore creates a build warning and the java dependency the field was meant to express never materialises.
Fix: Drop ${java:Depends} from the Depends field, or add the mechanism that sets it (e.g. javahelper's jh_depends with --with javahelper) if a Java dependency is really wanted.

Verified ◂

debian/copyright is in DEP-5 format with the correct Format URL, an Upstream-Name/Source header, three Files stanzas and two stand-alone License paragraphs; there is no Files-Excluded, and none is needed.
Licence scan of the whole tree outside debian/ (grep for Copyright years, SPDX-License-Identifier, GNU/GPL/LGPL, Apache, MPL, Creative Commons, CC0, 'Permission is hereby granted/to use', 'Redistribution and use', 'zlib license'): every file is BSD-3-Clause from the JPEG XL Project except the APNG (zlib), third_party Apache-2.0/MIT, HEVCSoftware (BSD-3, ITU/ISO/IEC) and simulator tools/ssimulacra.txt (ISC) files, all of which are permissive; no GPL/AGPL, non-commercial, no-modification or field-of-use terms, so the licences are DFSG-free and mutually compatible.
All four holders the prescan listed are accounted for: ITU/ISO/IEC (third_party/HEVCSoftware/cfg/LICENSE:6, issue above), Max Stepin (lib/extras/LICENSE.apngdis:7 and the two apng.cc files, issue above), Wildfire Games (third_party/dirent.cc:41, issue above). Tools like tools/benchmark/metrics/, examples/, plugins/, doc/ and .github/* all carry the JPEG XL Project BSD-3 header; AUTHORS/CONTRIBUTORS list contributors under the project licence, not separate ones.
tools/scripts/test_cost-armhf.zip, test_cost-i386.zip and test_cost-x64.zip each contain only CTestCostData.txt: CMake/CTest test timing data produced by tools/scripts reference runs, not built code or documentation whose source is missing. No licence issue, and their generator (CTest) is not needed to modify them (plain text).
No other archives, PDFs, images, fonts, sounds or prebuilt objects in the tree (glob for those suffixes found nothing); doc/jxl.svg is a plain-text SVG logo covered by Files: *.
The third_party/ submodule directories (brotli, googletest, highway, lcms, libjpeg-turbo, libpng, sjpeg, skcms, zlib) and testdata/ are empty, so no embedded copies of third-party code are shipped; the build uses system libraries via JPEGXL_FORCE_SYSTEM_BROTLI/GTEST/HWY/LCMS2. Nothing vendored duplicates a Debian library.
Build-dependency sanity: liblcms-dev is a virtual package provided by liblcms2-dev (apt-cache), so both the liblcms-dev | liblcms2-dev Build-Depends and libjxl-dev's liblcms-dev Depends are satisfiable; libhwy-dev 1.3.x is in the archive; the JNI/test/doc build paths are guarded by BUILD_TESTING, JPEGXL_ENABLE_DOXYGEN and Gdk_FOUND, and the conformance test skips (exit 254) when numpy is absent, so no missing Build-Depends follows from them.
debhelper side confirmed with the reference tools: at compat 14 dh_missing defaults to --fail-missing, so all upstream-installed files are covered by an install file (the build is assumed to pass); the empty override_dh_auto_test-indep is harmless; help2man runs after dh_install in execute_before_dh_installman-arch so the binaries exist in debian/tmp; the stale debian/*.1 files are removed by debian/clean.
Standards-Version 4.7.4 against Policy 4.7.4.1 (reference tool) - current; debian/source/format is 3.0 (quilt), the single quilt patch 0008-Fix-conformance-test.patch has From/Date/Subject/Bug-Debian headers and is applied; debian/upstream/metadata has Bug-Database/Bug-Submit/Repository; gbp.conf only sets pristine-tar.
Symbols file names the three 0.12 sonames (libjxl.so.0.12, libjxl_cms.so.0.12, libjxl_threads.so.0.12) with Build-Depends-Package: libjxl-dev; control matches compat 14, SOVERSION 0.12 and the new libjxl0.12 package name, and ${misc:Depends}/${shlibs:Depends} are present although not required at compat 14.
uscan found the packaged version as the newest upstream release (upstream 0.12.0, packaged 0.12.0).

Not confirmed ◂

Build-Depends requires libjxl-testdata (>= 0.0~~git20250513.73695d3-5), but the archive lists only 0.0~~git20250513.73695d3-4. If the matching -5 testdata upload is not in (or accepted from) NEW, dependency resolution and the build fail; the reference tool cannot report on NEW for a package name the lists already have.

Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-09 12:15 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package