Bug#1094410: Debian NEW review of openimageio 3.1.18.0+dfsg-1: ACCEPTED

[awm at debian.org]

The Debian NEW review of openimageio 3.1.18.0+dfsg-1 has been completed.

Decision: ACCEPTED
Reviewer: Andrew McMillan

Review comment:

Hi,

Some issues, all in the Files: src/* … License: Apache-2.0 catch-all: 
 
1. FarmHash is MIT, not Apache-only. src/libutil/farmhash.cpp:1-21 and src/include/OpenImageIO/detail/farmhash.h:1-16 both open with the full MIT text, Copyright (c) 2014 Google, Inc. (OIIO's additions on top are Apache-2.0). Neither file has a dedicated stanza; both fall into the Apache-2.0 catch-all, so the holder "Google" and the MIT licence are absent. Note upstream's own THIRD-PARTY.md (lines 132-133) documents "FarmHash, … (c) Copyright 2014 Google, Inc., MIT license." 

Fix: add a Files: stanza for these two (and src/include/OpenImageIO/hash.h, below) with Copyright: 2014, Google, Inc. and License: Expat/Apache-2.0 and Expat. 


2. src/include/OpenImageIO/hash.h embeds fasthash under full MIT. At lines 33-63 a delimited namespace fasthash carries the complete MIT licence, Copyright (C) 2012 Zilong Tan (eric.zltan at gmail.com). The file's own header is Apache-2.0 (its farmhash/xxhash namespaces are fine under the catch-all: farmhash is Google MIT but hash.h only declares it; xxhash is BSD-2). Zilong Tan and the MIT portion are not recorded. 

Fix: same stanza as (1), or note the embedded MIT portion in the hash.h coverage. 


3. src/libutil/strutil.cpp embeds an MIT UTF-8 decoder and a Zlib base64 encoder. Lines 1585-1611: Bjoern Hoehrmann's UTF-8 decoder, Copyright (c) 2008-2009 Bjoern Hoehrmann, // SPDX-License-Identifier: MIT; lines 1664-1689: René Nyffenegger's base64, Zlib licence. Neither licence/holder appears for this file (it is swept wholesale into Apache-2.0). 

Fix: add the file to a stanza listing License: Apache-2.0 and Expat and Zlib with the two holders, or mark the embedded portions. 


4. src/libutil/SHA1.cpp is public domain, not Apache. Header (lines 1-5): "100% free public domain implementation of the SHA-1 algorithm by Dominik Reichl". No dedicated stanza — swept into the Apache catch-all. 

Fix: add Files: src/libutil/SHA1.cpp with Copyright: no copyright is claimed / License: public-domain (mirror the existing hashes.cpp/stb_sprintf.h entry). 


5. src/cmake/modules/FindLibRaw.cmake is a third-party BSD-3 file, mislabelled Apache. Header (lines 10-15): Copyright (c) 2013, Pino Toscano, Copyright (c) 2013, Gilles Caulier, "Redistribution and use is allowed according to the terms of the BSD license" (it is the CMake/KDE FindLibRaw, cf. its COPING-CMAKE-SCRIPTS reference). It has no stanza and is assigned Apache-2.0 by the catch-all. 

Fix: add a stanza with Copyright: 2013, Pino Toscano / Gilles Caulier and License: BSD-3-clause. 


6. src/include/OpenImageIO/function_view.h contains LLVM-derived code under the University of Illinois/NCSA licence. Lines 8-33 reproduce that BSD-3-style licence, Copyright (c) 2003-2018 University of Illinois at Urbana-Champaign. The file is only covered as Apache-2.0. 

Fix: add the file to a stanza noting Apache-2.0 for the OIIO part plus the UIUC/BSD-3 portion (THIRD-PARTY.md documents this too). 


7. Minor: README.md is CC-BY-4.0, not Apache. Top-level README.md:1 carries SPDX-License-Identifier: CC-BY-4.0, but the Apache stanza assigns it License: Apache-2.0 (the file is also shipped by libopenimageio-doc.docs). Both are free; this is only an accuracy nit. THIRD-PARTY.md/AGENTS.md have no SPDX header and Apache assignment is reasonable. 



Thanks!

Full review details: https://dfsg-new-queue.debian.org/reviews/openimageio