DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: libultrahdr 2.0.2-1

Package Information

Descriptionlibultrahdr HDR gain map library

libultrahdr is an image compression library that uses gain map technology to store and distribute HDR images.

MaintainerTimo Jyrinki <timo@debian.org>
Changed ByTimo Jyrinki <timo@debian.org>
Sponsortimo@debian.org
Distributionunstable
Architectureany
VCSgit: https://salsa.debian.org/debian/libultrahdr.git (browse)
Closes#1147334
Trackerhttps://tracker.debian.org/pkg/libultrahdr
Uploaded1 month, 21 days ago

New Package Report

.changes◂
DateThu, 17 Sep 2026 16:58:20 +0300
Sourcelibultrahdr
Version2.0.2-1
Changed-ByTimo Jyrinki <timo@debian.org>
Architecturesource amd64
Distributionunstable
Changelog◂
libultrahdr (2.0.2-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1147334)
.dsc◂
Package-Listlibuhdr-bin deb utils optional arch=any
libuhdr-dev deb libdevel optional arch=any
libuhdr2 deb libs optional arch=any
Sectionutils
Priorityoptional
Componentmain
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/google/libultrahdr
Upstream-Name: libultrahdr
Upstream-Contact: Dichen Zhang <dichenzhang@google.com>
                  Vincent Rabaud <vrabaud@google.com>

Files:
 *
Copyright:
 2022-2026 The Android Open Source Project
License: Apache-2.0 or MIT

Files:
 lib/include/ultrahdr/avifultrahdr.h
 lib/include/ultrahdr/heifultrahdr.h
 lib/src/avifultrahdr.cpp
 lib/src/heifultrahdr.cpp
 scripts/auto_repair.py
 scripts/report_regression_issue.py
Copyright:
 2024 The Android Open Source Project
License: Apache-2.0

License: Apache-2.0
 On Debian systems, the complete text of the Apache-2.0
 can be found in "/usr/share/common-licenses/Apache-2.0".

License: MIT
 MIT License
 .
 Copyright (c) 2022 The Android Open Source Project
 .
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

Files:
 debian/*
Copyright:
 2026 Timo Jyrinki <timo@debian.org>
License: Apache-2.0 or MIT

Files:
 debian/patches/use-system-gtest.patch
Copyright:
 topazus <topazus@outlook.com>
 Timo Jyrinki <timo@debian.org>
License: Apache-2.0 or MIT

Files:
 tests/data/*
Copyright:
 2022 The Android Open Source Project
License: CC-BY-4.0
 On Debian systems, the complete text of the Creative Commons 
 Attribution 4.0 International license can be found in 
 "/usr/share/common-licenses/CC-BY-4.0".

Files:
 third_party/image_io/*
Copyright:
 2023-2024 The Android Open Source Project
License: Apache-2.0

Files:
 third_party/image_io/src/modp_b64/*
Copyright:
 2005-2006, Nick Galbreath
 2009-2014 The Chromium Authors
 2012 The Chromium OS Authors
 2015 The Android Open Source Project
License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
 .
   Redistributions of source code must retain the above copyright
   notice, this list of conditions and the following disclaimer.
 .
   Redistributions in binary form must reproduce the above copyright
   notice, this list of conditions and the following disclaimer in the
   documentation and/or other materials provided with the distribution.
 .
   Neither the name of the modp.com nor the names of its
   contributors may be used to endorse or promote products derived from
   this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Files:
 third_party/image_io/src/modp_b64/Makefile
Copyright:
 2015 The Android Open Source Project
License: Apache-2.0

Review Information

accepted — allocated to awm 27 days ago, started 27 days ago, completed 27 days ago.

Final Comment

Hi,

A couple of issues you should fix in your next upload...

  1. [important] packaging libheif-dev not in Build-Depends: HEIF/AVIF support silently disabled

Files: debian/control (Build-Depends); CMakeLists.txt:648-744; debian/ultrahdr_app.1 (-z option)
Evidence: option_if_not_defined(UHDR_ENABLE_HEIF "Build with HEIF/AVIF support via libheif" TRUE) then find_package(libheif QUIET) … message(WARNING "libheif not found. Building without HEIF/AVIF support.") set(UHDR_ENABLE_HEIF FALSE); heifultrahdr.cpp/avifultrahdr.cpp are whole-file #ifdef UHDR_ENABLE_HEIF; docs/api_changes_v1.5_to_v2.0.md: “When disabled: libultrahdr builds as a standalone, zero-dependency JPEG-only library”. Build-Depends has no libheif-dev, so a clean sbuild gets the JPEG-only fallback.
Problem: The shipped libuhdr.so and ultrahdr_app lose HEIF/HEIC/AVIF encode/decode although the library’s man page documents .heic/.heif/.avif output selection and upstream enables this by default; callers calling HEIF/AVIF API modes will get errors at runtime. The degradation is silent and undocumented.
Fix: Add libheif-dev to Build-Depends (libheif 1.23.4 in unstable provides the ISO 21496-1 gain-map API that Findlibheif.cmake checks; the runtime shlibs:Depends on libheif1 follows automatically), and verify the build; if a deliberate JPEG-only build is intended instead, document it in debian/control, the changelog and the man page.

  1. [minor] licensing cmake/patches/libheif_pr1503.patch is libheif (LGPL-3.0-or-later) code but only covered by the Apache-2.0 or MIT catch-all

Files: debian/copyright Files: * stanza; cmake/patches/libheif_pr1503.patch
Evidence: The patch is a verbatim diff of the libheif project (paths libheif/CMakeLists.txt, libheif/api/libheif/heif.cc, heifio) adding the gain-map API; libheif is LGPL-3.0-or-later. It has no license header of its own and falls under Files: * with Copyright 2022-2026 The Android Open Source Project, License: Apache-2.0 or MIT, which misstates its provenance and licence.
Problem: debian/copyright should reflect that a file is third-party libheif content under its own licence rather than the project’s dual licence; the file is inert in the Debian build (UHDR_BUILD_DEPS is off) so this is documentation-only, not a DFSG issue.
Fix: Add a Files: cmake/patches/libheif_pr1503.patch stanza attributing it to the libheif project / its author under LGPL-3.0-or-later (with the licence text), or note the provenance in the existing catch-all.

Thanks!

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
2.0.2-1 4bbd28bc… 2026-09-12 15:05 2026-09-12 21:24 eamanu rejected VIEW

Back to Dashboard | View all reviews for this package