#1117167 lintian: detect PNG Apple color profile non-free copyright claims

Package:
lintian
Source:
lintian
Submitter:
Simon Josefsson
Date:
2026-04-28 16:49:01 UTC
Severity:
normal
Tags:
#1117167#5
Date:
2025-10-04 06:50:53 UTC
From:
To:
Hi!  Charles Plessy made me aware that PNG files may embed copyright
claims on the color profile:

https://salsa.debian.org/newgateway-team/reviews/-/issues/25

I didn't analyze if the copyright claim refer to any valid copyrightable
portion of the file, but assuming they do (and this appears
likely/reasonable), I think lintian should detect this and issue a
warning about this situation, just like some other license-related
warnings in lintian.

What do you think?

/Simon

#1117167#10
Date:
2025-10-06 21:39:40 UTC
From:
To:
I would agree with that.  Thanks for making everyone aware of this issue.
#1117167#15
Date:
2025-10-21 10:52:05 UTC
From:
To:
Would you be able to confirm if the copyright claim refers to valid copyrightable
portion of this file? Would it also be possible to estimate how many packages
will show up with the warning once it is added?

If this is not an actual copyright problem on a large number of accounts, I think
it will annoy a lot of package maintainers once the check is added.

#1117167#20
Date:
2025-10-21 11:53:43 UTC
From:
To:
+1.

I would suggest forwarding the issue to debian-legal@ or the ftpmaster
just to be sure these image files really offend the DFSG.

Best,
Andrius

#1117167#25
Date:
2025-10-21 16:01:03 UTC
From:
To:
I also have some reserves, especially in terms of compute power needed
for those checks. Lintian needs to stay a tool that's relatively "cheap"
to run and I would be afraid checking all the images in a package could
dramatically affect runtime.

Not only that, but libraries used for parsing images are often large and
tend to come with a lot of security updates (since they tend to have a
lot of vulnerabilities...). Not sure we really want Lintian to depend on
that :(

#1117167#30
Date:
2025-10-21 18:22:14 UTC
From:
To:
Scratch that. It seems the test would be done using exiftool, which is
provided by libimage-exiftool-perl:

$ exiftool FOO.png | grep -i -e copy -e licen

Since that's a perl library, there's probably a pure perl way to invoke
that test, instead of using the external exiftool program.

I would still want to make sure that test is "cheap" before merging it
though :)