Review: python-imagecodecs 2026.10.10+ds1-1
Package Information
| Description | Image transformation, compression/decompression codecs Decode and/or encode functions are implemented for: Byte compressors: AEC, Blosc, Blosc2, Brotli, BZ2, CZI ZSTD1 and CHUNKED (with hilo filter), DEFLATE (zlib, isa-l, libdeflate, zlib-ng), GZIP, LZ4, LZ4F, LZ4H5, LZF, LZFSE, LZHAM, LZMA, LZO, LZW, OpenZL, PackBits, PGLZ (PostgreSQL LZ), Snappy, Szip, Zopfli, and ZStandard (ZSTD). Image formats: APNG, AVIF, BCn, BMP, DDS, EXR, GIF, HEIF, High-throughput JPEG 2000 (HTJ2K, JPH), JPEG (2 to 16-bit), JPEG 2000 (JP2, J2K), JPEG LS, JPEG XR, JPEG XS, Lossless JPEG (LJPEG, LJ92, JPEGLL), MOZJPEG, PCX, PNG, QOI, RGBE (HDR), TGA (TARGA), TIFF, Ultra HDR (JPEG_R), WebP, and WIC (Windows Imaging Component) Image compressors: CCITT (RLE, T.4 and T.6), DICOM RLE, and PixarLog; Scientific compressors: B2ND, EER, HCOMP, Jetraw, LERC, NPZ, Pcodec, PLIO, RCOMP (Rice), SPERR, SZ3, and ZFP; Filters: Bitorder reversal, CMS (color space transformations), Delta, Quantize (Scale, BitGroom, BitRound, GranularBR), and XOR Delta; Shufflers: Bitshuffle, Byteshuffle, Floating Point Predictor, Meshopt, Packed Integers (TIFF, MONO p and packed), and WavPack Type conversions: Bfloat16 (brain floating point), and Float24 (24-bit floating point); Checksums: CRC-32, Adler-32, Fletcher-32, and Jenkins lookup3. |
|---|---|
| Maintainer | Debian PaN Maintainers <debian-pan-maintainers@alioth-lists.debian.net> |
| Changed By | Roland Mas <lolando@debian.org> |
| Sponsor | lolando@debian.org |
| Distribution | unstable |
| Architecture | any |
| VCS | git: https://salsa.debian.org/python-team/packages/python-imagecodecs.git (browse) |
| Tracker | https://tracker.debian.org/pkg/python-imagecodecs |
| Uploaded | 4 days ago |
New Package Report
.changes
| Architecture | source amd64 |
|---|---|
| Distribution | unstable |
| Date | Sat, 31 Oct 2026 21:43:40 +0100 |
| Source | python-imagecodecs |
| Version | 2026.10.10+ds1-1 |
| Changed-By | Roland Mas <lolando@debian.org> |
Changelog
python-imagecodecs (2026.10.10+ds1-1) unstable; urgency=medium . * Initial packaging.
.dsc
| Priority | optional |
|---|---|
| Component | main |
| Package-List | python3-imagecodecs deb python optional arch=any |
| Section | python |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: imagecodecs
Upstream-Contact: Christoph Gohlke <cgohlke@cgohlke.com>
Source: https://github.com/cgohlke/imagecodecs
Files-Excluded:
3rdparty/liblzf
3rdparty/libspng
Files: *
Copyright: Copyright (c) 2008-2026, Christoph Gohlke
License: BSD-3-clause
Files: 3rdparty/bcdec/*
Copyright: 2022 Sergii Kudlai
License: Expat or Unlicense
Files: 3rdparty/ccitt/*
Copyright: Christoph Gohlke
License: 0BSD
Files: 3rdparty/liblj92/*
Copyright: Andrew Baldwin 2014
License: Expat
Files: 3rdparty/wic/*
Copyright: Christoph Gohlke
License: 0BSD
Files: 3rdparty/openjpeg/*
Copyright:
2002-2014, Universite catholique de Louvain (UCL), Belgium
2002-2014, Professor Benoit Macq
2001-2003, David Janssens
2002-2003, Yannick Verschueren
2003-2007, Francois-Olivier Devaux
2003-2014, Antonin Descampe
2005, Herve Drolon, FreeImage Team
License: BSD-2-Clause
Files: 3rdparty/pixarlog/*
Copyright:
1996-1997 Sam Leffler
1996 Pixar
Christoph Gohlke
License: libtiff
Comment: The file contents mention HPND-sell-variant but do not include it
Files: debian/*
Copyright: 2026 Roland Mas <lolando@debian.org>
License: BSD-3-clause
License: BSD-3-clause
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
.
1. Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
.
2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
.
3. Neither the name of the copyright holder nor the names of its
contributors may be used to endorse or promote products derived from
this software without specific prior written permission.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
License: Expat
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
.
The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
License: Unlicense
This is free and unencumbered software released into the public
domain.
.
Anyone is free to copy, modify, publish, use, compile, sell, or
distribute this software, either in source code form or as a compiled
binary, for any purpose, commercial or non-commercial, and by any
means.
.
In jurisdictions that recognize copyright laws, the author or authors
of this software dedicate any and all copyright interest in the
software to the public domain. We make this dedication for the
benefit of the public at large and to the detriment of our heirs and
successors. We intend this dedication to be an overt act of
relinquishment in perpetuity of all present and future rights to this
software under copyright law.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY
CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
License: 0BSD
Permission to use, copy, modify, and/or distribute this software for
any purpose with or without fee is hereby granted.
.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
PERFORMANCE OF THIS SOFTWARE.
License: libtiff
Permission to use, copy, modify, distribute, and sell this software
and its documentation for any purpose is hereby granted without fee,
provided that (i) the above copyright notices and this permission
notice appear in all copies of the software and related
documentation, and (ii) the names of Pixar, Sam Leffler and Silicon
Graphics may not be used in any advertising or publicity relating to
the software without the specific, prior written permission of Pixar,
Sam Leffler and Silicon Graphics.
.
THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
.
IN NO EVENT SHALL PIXAR, SAM LEFFLER OR SILICON GRAPHICS BE LIABLE
FOR ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY
KIND, OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
PROFITS, WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON
ANY THEORY OF LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE
OR PERFORMANCE OF THIS SOFTWARE.
License: BSD-2-Clause
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
.
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS `AS IS'
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
DFSG Assistant LLM REVIEW 4 blocker, 3 important, 3 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 4 days ago.
Report
DFSG NEW review for python-imagecodecs version 2026.10.10+ds1-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: No - Packaging is of good quality: No
- Issues: 4 blocker, 3 important, 3 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: 118 found (61 not listed by the scan, so not checked)
Licensing
All of the package's own code (imagecodecs/*.pyx, *.pxd, imcd.c, tests) is BSD-3-Clause by Christoph Gohlke and the stanzas for bcdec, ccitt, liblj92, wic, pixarlog and openjpeg are otherwise accurate. But debian/copyright stops after six 3rdparty directories: bitshuffle, cfitsio, hdf5, jpegsof3, netcdf-c, postgresql, qoi and rgbe fall through to the Files: * stanza, which names only Christoph Gohlke and BSD-3-Clause although they are Expat, HDF5, PostgreSQL, NASA, UCAR-BSD-3, MIT and (rgbe) unlicensed code. The 66 third-party licence texts in imagecodecs/licenses/ (shipped inside the binary package) are likewise attributed to Gohlke, and the test data from Esri is Apache-2.0 which is nowhere mentioned. The licences themselves are all DFSG-free, but the copyright file is materially inaccurate and incomplete.
Packaging
The mechanical packaging is sound: debhelper compat 14, a three-line dh rules file, DEP-3-style patches, a sane changelog, salsa Vcs fields, a current Standards-Version and an autopkgtest Testsuite. The serious defect is that setup.py's default build prunes the extension list to EXTENSIONS_CORE (and even drops jpegls and jpegxl), so the binary ships only about 22 of the ~45 codecs while debian/control's Description advertises the full upstream feature set (BCn, GIF, HEIF, QOI, RGBE, PCX, TGA, JPEG LS, JPEG XL, Snappy, Blosc2, ZFP, UltraHDR, WIC, ...). Conversely about twenty Build-Depends exist only for extensions that are never built, one of them (libzlcore-dev) is a different library altogether.
Issues
blocker licensing 1. debian/copyright does not describe 3rdparty/{bitshuffle,cfitsio,hdf5,jpegsof3,netcdf-c,postgresql,qoi}: Files: * wrongly names only Christoph Gohlke under BSD-3-Clause ◂
- Files:
debian/copyright:10-12,3rdparty/bitshuffle/LICENSE:3,3rdparty/bitshuffle/hdf5_dl.c:3,3rdparty/cfitsio/License.txt:1-8,3rdparty/hdf5/COPYING:7-10,3rdparty/jpegsof3/LICENSE:1,3rdparty/jpegsof3/jpegsof3.cpp:9-12,3rdparty/jpegsof3/jpegsof3.h:9-12,3rdparty/netcdf-c/COPYRIGHT:1,3rdparty/netcdf-c/nc4var.c:1,3rdparty/postgresql/COPYRIGHT:4-6,3rdparty/postgresql/pg_lzcompress.c:175,3rdparty/qoi/qoi.h:3-4 - Basis: checked, in the package or with a reference tool
- Evidence:
Files: */Copyright: Copyright (c) 2008-2026, Christoph Gohlke/License: BSD-3-clauseis the only stanza matching these trees. Their own files sayCopyright (c) 2014 Kiyoshi Masui(Expat),Copyright (c) 2019 European Synchrotron Radiation Facility(Expat),Copyright (Unpublished--all rights reserved ...), U.S. Government as represented by the Administrator of the National Aeronautics and Space Administration(cfitsio),Copyright 2006-2012 by The HDF GroupandCopyright 1998-2006 by the Board of Trustees of the University of Illinois(HDF5),Copyright(c) 2014 - 2016 Chris Rorden(BSD-3),Copyright 2018 Unidata/Copyright 2003-2018, University Corporation for Atmospheric Research(BSD-3),Portions Copyright (c) 1996-2021, PostgreSQL Global Development GroupandPortions Copyright (c) 1994, The Regents of the University of California(PostgreSQL licence), andCopyright (c) 2022 Dominic Szablewski/SPDX-License-Identifier: MIT(qoi). - Problem: Under copyright-format 6.9 the last matching stanza applies, so every file in these directories is attributed to a holder that does not own it and to a licence (BSD-3-Clause) that is not the one it carries. The Expat/MIT, HDF5, PostgreSQL, NASA and UCAR/CCSDS notices, which each licence requires to be reproduced, appear nowhere in debian/copyright. This is an inaccurate debian/copyright under Policy 12.5 and 12.5.1.
- Fix: Add one stanza per directory naming the holders and the correct short name, with the full text of Expat/MIT (already there), the HDF5 licence, the PostgreSQL licence and the NASA/cfitsio licence (none of these last three is in /usr/share/common-licenses), and BSD-3-Clause for jpegsof3 (Chris Rorden) and netcdf-c (Unidata/UCAR).
blocker licensing 2. 3rdparty/rgbe/rgbe.c and rgbe.h carry no licence grant at all and are attributed to Christoph Gohlke under BSD-3-Clause ◂
- Files:
3rdparty/rgbe/rgbe.c:1-3,3rdparty/rgbe/rgbe.c:19-24,3rdparty/rgbe/rgbe.h,3rdparty/rgbe/rgbe.txt,debian/copyright:10-12 - Basis: checked, in the package or with a reference tool
- Evidence: The only statement in rgbe.c is
/* THIS CODE CARRIES NO GUARANTEE OF USABILITY OR FITNESS FOR ANY PURPOSE. WHILE THE AUTHORS HAVE TRIED TO ENSURE THE PROGRAM WORKS CORRECTLY, IT IS STRICTLY USE AT YOUR OWN RISK. */, and the code is credited towritten by Bruce Walter (bjw@graphics.cornell.edu) 5/26/95 based on code written by Greg Ward; rgbe.txt adds only a usage description and the same disclaimer. Grepping the directory forlicen|permission|public domain|copyrightfinds nothing. - Problem: A warranty disclaimer is not a permission to copy, modify or distribute, so the free status of these files is unproven, and debian/copyright does not mention them except through the
Files: *BSD-3-Clause/Gohlke claim, which cannot be right: Gohlke only modified code written by others. Debian requires every file in the source to be under a free licence and described in debian/copyright (Policy 12.5). - Fix: Get a licence statement from upstream/the original authors for these files, or remove them; if they are kept under a documented free licence, add a stanza. They are not compiled by the default build (the
rgbeextension is pruned in setup.py:customize_build_default), so removing them is cheap.
blocker licensing 3. The 3rdparty/openjpeg stanza omits the holders Centre National d'Etudes Spatiales (CNES) and CS Systemes d'Information ◂
- Files:
debian/copyright:28-39,3rdparty/openjpeg/LICENSE:14-15,3rdparty/openjpeg/color.c:14-15,3rdparty/openjpeg/color.h:14-15 - Basis: checked, in the package or with a reference tool
- Evidence:
3rdparty/openjpeg/LICENSElines 14-15:Copyright (c) 2011-2012, Centre National d'Etudes Spatiales (CNES), FranceandCopyright (c) 2012, CS Systemes d'Information, France; the stanza lists the other seven holders only. - Problem: A holder present in the file is missing from debian/copyright, which therefore does not accurately describe the copyright of 3rdparty/openjpeg (Policy 12.5.1, copyright-format 5.2).
- Fix: Add both lines to the
Copyright:list of theFiles: 3rdparty/openjpeg/*stanza.
blocker licensing 4. tests/data/lerc/* is Esri's Apache-2.0 LERC test data, not mentioned anywhere in debian/copyright ◂
- Files:
tests/data/lerc/readme.txt:1-2,tests/data/lerc/world.lerc1,tests/data/lerc/california_400_400_1_float.lerc2,tests/data/lerc/bluemarble_256_256_3_byte.lerc2,tests/data/lerc/zstd.lerc2,debian/copyright:10-12 - Basis: checked, in the package or with a reference tool
- Evidence:
tests/data/lerc/readme.txt:https://github.com/Esri/lerc/tree/master/testData/Apache License - 2.0. debian/copyright has no Apache-2.0 stanza and no mention of Esri; the files fall underFiles: *(Christoph Gohlke, BSD-3-Clause). - Problem: These four files are third-party material under Apache-2.0, a licence whose text is not reproduced or referenced in debian/copyright, and the holder is misstated. Apache-2.0's section 4(c) requires the notice to be retained, and Policy 12.5 asks for Apache-2.0 packages to point at /usr/share/common-licenses/Apache-2.0.
- Fix: Add
Files: tests/data/lerc/*,Copyright: 2015-2026, Esri,License: Apache-2.0and a stand-aloneLicense: Apache-2.0paragraph referring to/usr/share/common-licenses/Apache-2.0.
important licensing 5. imagecodecs/licenses/* (66 third-party licence and patent texts shipped in the binary) are attributed to Christoph Gohlke under BSD-3-Clause ◂
- Files:
debian/copyright:10-12,imagecodecs/licenses/LICENSE-aom:1,imagecodecs/licenses/LICENSE-bcdec:33,imagecodecs/licenses/LICENSE-openjph:3-4,imagecodecs/licenses/LICENSE-libaivf:1,imagecodecs/licenses/LICENSE-zstd:5,imagecodecs/licenses/LICENSE-hdf5:7,imagecodecs/licenses/LICENSE-qoi:3,imagecodecs/licenses/PATENTS-rav1e - Basis: checked, in the package or with a reference tool
- Evidence: The files name their own parties, e.g.
Alliance for Open Media,Aous Naman,Kakadu Software Pty Ltd, Australia,Joe Drago,Facebook, Inc,The HDF Group,Dominic Szablewski(Unlicense in LICENSE-bcdec, MIT in LICENSE-qoi),the rav1e contributors, and their own licences (BSD, MIT, Apache-2.0, patents grant). They are the only statement of the licences of libaec, lerc, libjxr, wavpack etc. that are linked in, and README.rst:342 tells usersRefer to the imagecodecs/licenses folder for 3rd-party library licenses.setup.py installs them (package_data.append('licenses/*')). - Problem: The catch-all stanza declares a single holder and a single licence for all of them, so debian/copyright does not describe these files accurately; a reader cannot tell from it what licences the shipped texts represent.
- Fix: Add a
Files: imagecodecs/licenses/*stanza that states these are the licence texts of the respective third-party libraries (listing the libraries and their licences), or one stanza per licence with its short name; keep PATENTS-rav1e together with the rav1e entry.
important licensing 6. tests/data/libaec/121B2TestData/ ships CCSDS test data with only a liability disclaimer and no licence statement ◂
- Files:
tests/data/libaec/121B2TestData/README121BTest.txt:3-5,tests/data/libaec/121B2TestData/AllOptions/,tests/test_imagecodecs.py:2407-2408,debian/copyright:10-12 - Basis: checked, in the package or with a reference tool
- Evidence: README121BTest.txt begins
Disclaimer/The test data are provided as is, as a courtesy to users. In no event will the CCSDS, its member Agencies, or the provider of the data be liable ...and grants nothing; test_imagecodecs.py:2407 says# test data from libaec https://gitlab.dkrz.de/k202009/libaec/tree/master/data. debian/copyright says nothing about them andFiles: *attributes them to Christoph Gohlke under BSD-3-Clause. - Problem: The shipped README contains no permission to copy, modify or redistribute the data, so their free status is undocumented, and debian/copyright both misstates their origin and omits the terms under which libaec distributes them (libaec itself is BSD-2-Clause). Policy 12.5 requires every file's licensing to be recorded.
- Fix: Record a stanza for
tests/data/libaec/*naming the CCSDS/libaec origin and the licence under which upstream distributes the data (BSD-2-Clause for libaec, with its text, unless the CCSDS terms say otherwise); if that cannot be established, drop this test data and the tests that consume it.
important packaging 7. The package Description advertises about forty codecs that setup.py's default build removes, including JPEG LS, JPEG XL, GIF, HEIF, QOI, PCX and TGA ◂
- Files:
debian/control:52-95,setup.py:323-347,setup.py:296-322 - Basis: checked, in the package or with a reference tool
- Evidence: debian/rules is only
dh $@ --buildsystem=pybuild, so none of the environment switches in setup.py apply andcustomize_build_defaultruns:for name in tuple(extensions.keys()): if name not in EXTENSIONS_CORE: extensions.pop(name, None)andfor name in ('jpegls', 'jpegxl'): if name in extensions: extensions.pop(name, None). EXTENSIONS_CORE is onlyshared, imcd, bmp, ccitt, cms, czi, deflate, htj2k, jpeg2k, jpeg8, jpegxr, lerc, ljpeg, lz4, lzf, lzma, pixarlog, png, tiff, webp, zlib, zstd; the control file still offersAPNG, AVIF, BCn, DDS, EXR, GIF, HEIF, ... JPEG LS, JPEG XS, QOI, PCX, TGA, PGLZ, Snappy, Blosc, Blosc2, Brotli, Zopfli, ZFP, WIC, Ultra HDR, Meshopt, WavPack, Bitshuffle, AEC, Szip, HCOMP/PLIO/RCOMP, Quantize. - Problem: The installed package cannot perform most of what its Description promises, and users (tifffile and liffile depend on imagecodecs for exactly some of these, e.g. JPEG-LS in TIFF, QOI, PCX) get DelayedImportError for them. JPEG LS is pruned although libcharls-dev is a Build-Depend and JPEG LS support is the sort of thing tifffile requires. The Description must describe the binary that is produced.
- Fix: Either make the build produce the full extension set, e.g. by shipping an
imagecodecs_distributor_setup.py(setup.py imports it if present) that builds the extensions the Build-Depends support, or trim the Description and the Build-Depends to what EXTENSIONS_CORE builds.
minor packaging 8. About twenty Build-Depends are used by no built extension, and libzlcore-dev is fbreader's ZLibrary rather than the OpenZL library setup.py links ◂
- Files:
debian/control:12-44,setup.py:240-292 - Basis: checked, in the package or with a reference tool
- Evidence: Used by the pruned build only: liblcms2-dev, liblz4-dev, libzstd-dev, libdeflate-dev, libopenjph-dev, libopenjp2-7-dev, libjpeg62-turbo-dev, libjxr-dev, liblerc-dev, liblzf-dev, liblzma-dev, libtiff-dev, libwebp-dev, libpng-dev. Left over:
libaec-dev, libavif-dev, libblosc-dev, libblosc2-dev, libbrotli-dev, libbz2-dev, libcharls-dev, libgif-dev, libheif-dev, libisal-dev, libjxl-dev, libmeshoptimizer-dev, libsnappy-dev, libspng-dev, libuhdr-dev, libwavpack-dev, libzfp-dev, libzlcore-dev, plusdbus, which nothing in the tree refers to. apt-cache shows libzlcore-dev isZLibrary cross-platform development libraryfrom source fbreader, while theopenzlextension linkslibraries=['openzl']; no Debian binary providesopenzl. - Problem: Unused build dependencies hide what the package actually needs and slow every build; the ZLibrary relation is a different library with a similar name and could never satisfy the
openzlextension. Policy 7.7 asks for Build-Depends that are actually needed. - Fix: Drop the dependencies of extensions that are not built (or build those extensions, see the previous issue), and remove
dbus; if OpenZL support is intended, depend on the package that provides libopenzl, not libzlcore-dev.
minor packaging 9. 0002-Skip-some-jpeg8-alpha-tests.patch also rewrites a user-visible ValueError message in imagecodecs/_shared.pyx, unrelated to its subject ◂
- Files:
debian/patches/0002-Skip-some-jpeg8-alpha-tests.patch:12-22,debian/patches/0002-Skip-some-jpeg8-alpha-tests.patch:1-4 - Basis: checked, in the package or with a reference tool
- Evidence: The patch removes
raise ValueError('alpha channel not supported by codec')and putsf'alpha channel not supported by codec, caps={caps}, extra={extra}'in its place, an f-string that interpolates internal integer flags into an exception message, while the rest of the patch only addspytest.skip('skipping jpeg8+rgba')in two tests. The patch has only From/Date/Subject, noBug:orForwarded:. - Problem: The error-message change looks like leftover debugging, changes the public error text for all codecs, and has nothing to do with skipping tests; mixing it in makes the patch hard to review and to drop when libjpeg-turbo supports RGBA again. Skipping the tests rather than recording upstream status means nobody notices when it is fixed. Compare Policy 4.3 (patches should be minimal and documented) and the DEP-3 recommendations.
- Fix: Drop the _shared.pyx hunk (or send it upstream separately if the extra diagnostic is wanted), and add
Forwarded:/Bug:to the patch header explaining that libjpeg-turbo 3 rejects RGBA input.
minor packaging 10. The repack suffix is not removed before versions are compared ◂
- Files:
debian/watch - Basis: found by the review tooling's own checks
- Evidence: uscan compares
2026.10.10+ds1with upstream's2026.10.10(status:only older package available) - Problem: The packaged version carries a repack suffix that
debian/watchdoes not remove before comparing, so uscan compares it as it is with upstream's version and never finds them equal. - Fix: Remove the suffix for the comparison, with
Dversion-Mangle: auto(version 5) ordversionmangle=auto(version 4).
Verified ◂
- Read all of debian/: control, rules, changelog, copyright (180 lines, DEP-5), source/format (3.0 quilt), source/options, patches/series and both patches. There are no maintainer scripts, debian/tests or gbp.conf.
- Listed the whole tree and read every 3rdparty LICENSE/COPYING/COPYRIGHT/License.txt and the header of every 3rdparty source file; grepped Copyright, (C), SPDX-License-Identifier and License across 3rdparty/ and imagecodecs/.
- All imagecodecs/*.pyx, *.pxd, *.pxi, .py, imcd.c and tests/.py carry
Copyright (c) ... Christoph Gohlkewith BSD-3-Clause, matchingFiles: *; root LICENSE is the same BSD-3-Clause text. - The stanzas for 3rdparty/bcdec (Expat or Unlicense, Sergii Kudlai), 3rdparty/ccitt (0BSD), 3rdparty/liblj92 (Expat, Andrew Baldwin; lj92.c also records Gohlke's modifications), 3rdparty/wic (0BSD) and 3rdparty/pixarlog (libtiff/HPND-sell-variant, Sam Leffler/Pixar) match the files they cover.
- Each file the scan flagged for unusual licence wording is a free licence text, not a restriction:
3rdparty/bcdec/LICENSEand3rdparty/bcdec/bcdec.hand the Unlicense paragraph of debian/copyright (grant,commercial or non-commercial, plus anti-copyright waiver);imagecodecs/licenses/LICENSE-bcdec(same Unlicense);imagecodecs/licenses/LICENSE-jpeg,imagecodecs/licenses/LICENSE-libjpeg,imagecodecs/licenses/LICENSE-libjpeg-turbo,imagecodecs/licenses/LICENSE-mozjpegandimagecodecs/licenses/LICENSE-libaivf(the standard IJG/JPEG name-use and README-retention clauses, DFSG-free, the same terms Debian's libjpeg ships);3rdparty/jpegsof3/jpegsof3.cpp,3rdparty/jpegsof3/jpegsof3.handimagecodecs/licenses/LICENSE-jpg_0xc3(a normal BSD-3-Clause grant whosedeveloped for research purposes only and is not a clinical toolsentence is a disclaimer, not a field-of-use condition; the same code ships in Debian's dcm2niix);imagecodecs/licenses/LICENSE-lzham(anti-copyright/public-domain dedication). None of them restricts use, modification or redistribution. - The two compressed files are test fixtures, not build output: tests/data/lerc/zstd.lerc2 is a zstd-compressed LERC image from Esri's testData (Apache-2.0, reported above), tests/data/zstd_stream.bin is a zstd byte stream consumed by the zstd stream tests.
- All 101 unrecognised binary files are test fixtures under tests/data/ (I read the full listing of tests/data and of its lerc/, libaec/121B2TestData/, ljpeg/ and tiff/ subdirectories): encoded sample images and encoders' expected output (.bin, .jpg, .j2k, .jp2, .jls, .jxr, .jxl, .avif, .uhdr, .webp, .png, .hdr, .br, .zl, .npy, .lzp, .tif, .lerc1, .lerc2, .dat, .rz), read by tests/test_imagecodecs.py. They are not compiled or generated by the Debian build; the LERC and libaec sets are third-party and are reported above.
- tests/data/bmpsuite/ and tests/data/ccitt/ are referenced by tests/test_imagecodecs.py:4163 and :90 but are absent from the tree (upstream's MANIFEST.in does not ship them), so those parametrisations are empty or skipped; not a packaging fault.
- Build-Depends checked with apt-cache: libopenjph-dev, libuhdr-dev, libmeshoptimizer-dev, python3-lzf, python3-numcodecs all exist; libopenzl-dev does not exist anywhere (see the libzlcore-dev issue).
- Standards-Version 4.7.4 against the reviewing system's Policy 4.7.x is current; changelog distribution is unstable, the version 2026.10.10+ds1-1 matches the tarball, and Files-Excluded (3rdparty/liblzf, 3rdparty/libspng) matches what the patch replaces with liblzf-dev/libspng-dev.
Not confirmed ◂
- Provenance of tests/data/ljpeg/dng0.ljp .. dng7.ljp and 2dht.ljp/3dht.ljp: they look like Adobe DNG samples, but nothing in the tree documents their origin or licence, and I could not check outside the package; they are covered only by the
Files: *claim. - Provenance of the generated-looking fixtures in tests/data/tiff/ (e.g. rgb.tiled.jpegxl.u1.tif) and tests/data/*.npy: assumed generated by upstream's test suite, as no third-party notice exists for them.
- Whether upstream considers 3rdparty/rgbe covered by a licence that is simply not quoted in the source files; if it is, the copyright file must still record it.
Proposed changes ◂
None.
Uploader's response to the LLM review
The uploader rejected this upload in response to the review.
Review Information
rejected — allocated to dfsg-uploader 4 days ago, started 4 days ago, completed 4 days ago.
Final Comment
The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.