Debian packaging about libspng

[Tachi107]

Ok, nice to know, thanks :)

The package is ready; it's just waiting for someone to upload it in the main Debian archive (I'm haven't full privileges yet, and I can't do the first upload myself).

[randy408]

It was an unintended side effect of renaming the Meson project to "spng", the pkgconfig name changed with it. It was not spotted until much later, by that time the new name was expected in some projects.

For v1.0.0 (the version planned to include breaking changes) it will probably be changed it to the shorter version for CMake, newer libraries don't have the prefix either.

[Tachi107]

Thanks for the info :)

I forgot to mention this earlier, but if you want to follow packaging progress you can look at https://bugs.debian.org/1024643

[Tachi107]

libspng is now in Debian!

https://tracker.debian.org/news/1416587/accepted-libspng-073-1-source-amd64-all-into-unstable/

[Tachi107]

Don't worry, I've already fixed that. spng is currently in the bookworm (Debian 12) repos: https://packages.debian.org/bookworm/libspng-dev

[randy408]

I removed the debian/ directory on the master branch.

The Meson build should be considered the "official" one. It contains the unit tests, though the tests also depend on libpng, some distros have libpng as a build-depends as a result. There's some progress in decoupling some of the tests from that dependency but have no ETA on that.

There will be a new minor bugfix release soon, if some other change should be included in the next version let me know.

[Tachi107]

Having libpng-dev as a build dependency isn't an issue at all, don't worry.

Other than the removal of debian/ I have no requests. Thanks :D

[Tachi107]

Hi again :)

I'm mostly done with packaging, but I now have a few questions regarding licensing.

1. What's the license of the files under tests/crashers/ and tests/misc/? Are they part of PngTest?
2. Is there a reason why spng.h is licensed under the BSD-2-Clause AND libpng-2.0 instead of just the BSD-2-Clause or even BSD-2-Clause OR libpng-2.0? As far as I can tell, code originating from libpng is only part of spng.c, not the header file.

[randy408]

tests/misc/ should fall under the project's license.

tests/crashers/ is more complicated, the majority of it are from https://github.com/glennrp/libpng/tree/libpng16/contrib/testpngs/crashers, those fall under the libpng license according to the package's copyright. The rest (invalid_gray_alpha_sbit.png, missing_plte.png, zero_gama.png, zero_width.png) are produced by OSS-Fuzz, I'm not sure what their status is, they're only published on the chromium bug tracker.

As far as I can tell, code originating from libpng is only part of spng.c, not the header file.

That makes sense, I just haven't considered them separate before.

[randy408]

Fixed the SPDX ID for spng.h, I could reorganize tests/crashers/ so only the meson.build and a subdirectory like ossfuzz would be an exception in the copyright file.

[Tachi107]

Il giorno mar 22 nov 2022 alle 10:24:53 -08:00:00, Randy ***@***.***> ha scritto:

tests/misc/ should fall under the project's license. tests/crashers/ is more complicated, the majority of it are from https://github.com/glennrp/libpng/tree/libpng16/contrib/testpngs/crashers, those fall under the libpng license according to the package's copyright. The rest (invalid_gray_alpha_sbit.png, missing_plte.png, zero_gama.png, zero_width.png) are produced by OSS-Fuzz, I'm not sure what their status is, they're only published on the chromium bug tracker.

Thanks for the information. I don't think that not having precise copyright information for the images produced by OSS-Fuzz is an issue, they're arguably not copyrightable anyway. Il giorno mar 22 nov 2022 alle 10:43:57 -08:00:00, Randy ***@***.***> ha scritto:

Fixed the SPDX ID for spng.h, I could reorganize tests/crashers/ so only the meson.build and a subdirectory like ossfuzz would be an exception in the copyright file.

Nice. No need to reorganize test/crashers/, I can adjust the `Files:` match without problems. Thanks again for your fast responses :)

[Tachi107]

Hi, the package is now pretty much ready, but I noticed something that you might've not considered while I was writing tests for the package. The .pc file generated by Meson is named spng.pc, while the one used by CMake is named libspng.pc. I guess that the pkg-config file generated by Meson should have the "lib" prefix too, right? This would be more in line with the project name and also libpng's own .pc file.

PS: you can add filebase: 'libspng' to the pkg.generate() call to change the .pc file name

[randy408]

AFAIK they usually need a good reason to accept a new package, like another package that already depends on it. It's worth mentioning libvips, it's already in Debian and it prefers spng over libpng, it is a dependency on Mac/homebrew (https://formulae.brew.sh/formula/vips) for this reason and I believe it's also bundled with the Windows builds.

[randy408]

https://www.mail-archive.com/[email protected]/msg1893857.html

Is fixing that bug essential for shipping the library in the next version of Debian? I have a vague idea how new Debian releases are prepared, at some point they drop packages that have outstanding bugs but not sure if it applies in this case.