As far as I understand, Debian packages aren't supposed to contain
duplicate copies of libraries which have been packaged independently
(isn't that a Policy violation?), but that appears to be the case here:


$ dpkg -L opencl-c-headers | grep include/CL | sort
/usr/include/CL
/usr/include/CL/cl_d3d10.h
/usr/include/CL/cl_d3d11.h
/usr/include/CL/cl_dx9_media_sharing.h
/usr/include/CL/cl_egl.h
/usr/include/CL/cl_ext.h
/usr/include/CL/cl_gl_ext.h
/usr/include/CL/cl_gl.h
/usr/include/CL/cl.h
/usr/include/CL/cl_platform.h
/usr/include/CL/opencl.h

$ dpkg -L libgegl-dev | grep include/gegl-0.3/opencl | sort
/usr/include/gegl-0.3/opencl
/usr/include/gegl-0.3/opencl/cl_d3d10.h
/usr/include/gegl-0.3/opencl/cl_ext.h
/usr/include/gegl-0.3/opencl/cl_gl_ext.h
/usr/include/gegl-0.3/opencl/cl_gl.h
/usr/include/gegl-0.3/opencl/cl.h
/usr/include/gegl-0.3/opencl/cl_platform.h
/usr/include/gegl-0.3/opencl/gegl-cl-color.h
/usr/include/gegl-0.3/opencl/gegl-cl.h
/usr/include/gegl-0.3/opencl/gegl-cl-init.h
/usr/include/gegl-0.3/opencl/gegl-cl-random.h
/usr/include/gegl-0.3/opencl/gegl-cl-types.h
/usr/include/gegl-0.3/opencl/opencl.h


The included version of openCL seems to be many years out of date:


$ diff -u /usr/include/{gegl-0.3/opencl,CL}/opencl.h
--- /usr/include/gegl-0.3/opencl/opencl.h	2016-06-26 05:02:45.000000000 -0700
+++ /usr/include/CL/opencl.h	2016-06-14 08:44:21.000000000 -0700
@@ -1,5 +1,5 @@
 /*******************************************************************************
- * Copyright (c) 2008-2010 The Khronos Group Inc.
+ * Copyright (c) 2008-2015 The Khronos Group Inc.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and/or associated documentation files (the


It appears that there may also be another independent library, under the
/usr/include/gegl-0.3/npd/ directory.

Hi!

On 2017-03-10 at 10:09 (-0800), Ian Bruce wrote:

[...]

What about these?

They're not provided by the Debian package and I'm not going to try a
'merge-on-the-fly' on headers to save a bunch of kilobytes. Sorry.

Impressed. ;)

I asked upstream about this and I got no consistent reply. So it'll keep
its position.

Cheers.

What about them?

I just pasted in the output of the "dpkg -L libgegl-dev" command. I
didn't claim that ALL the header files in that directory were duplicates
of those in the <opencl-c-headers> package. Those are the only ones that
aren't.

Saving a bunch of kilobytes is really not the issue, as I suggested when
I said "isn't that a Policy violation?". Here's a relevant quote:

    * No inclusion of third party code *

    Please do not include other code (like libraries) or data that are
    also shipped separately inside your source archive, or if you do,
    please make sure they can be reliably ignored. Instead of shipping
    third party libraries you should rather make sure your program will
    be link nicely against recent versions of these libraries. If a
    security issue is found in one of the bundled packages, it is far
    easier for the package maintainers or the Security Team to patch and
    rebuild one package than to scan the entire archive for all copies
    of this code and patch them individually (this happened for zlib,
    for example). It's also preferable for the end users to receive an
    update for just one package (e.g. OpenSSL) rather than a large
    number of applications.

https://wiki.debian.org/UpstreamGuide#No_inclusion_of_third_party_code

Here's another relevant quote:

    If your software depends on other libraries, then Debian also needs
    to make sure that your software compiles and works with the version
    of these libraries available in Debian. Debian may compile your
    software against a different version of some library than you do.
    Therefore it's not of any help for Debian if you include convenience
    copies of these dependencies in your source tarball.

https://wiki.debian.org/UpstreamGuide#Source_only_tarball

This seems to be a sub-project of GEGL:

https://github.com/GNOME/gegl/tree/master/libs/npd

If it's not packaged independently, then the considerations above may
not apply.

However, they most certainly do apply to openCL.

I was right -- it IS a Debian Policy violation:

    * 4.13 Convenience copies of code *

    Some software packages include in their distribution convenience
    copies of code from other software packages, generally so that users
    compiling from source don't have to download multiple packages.
    Debian packages should not make use of these convenience copies
    unless the included package is explicitly intended to be used in
    this way. If the included code is already in the Debian archive in
    the form of a library, the Debian packaging should ensure that
    binary packages reference the libraries already in Debian and the
    convenience copy is not used. If the included code is not already in
    Debian, it should be packaged separately as a prerequisite if
    possible.

https://www.debian.org/doc/debian-policy/ch-source.html#s-embeddedfiles

That seems to describe this situation EXACTLY.

Hi Ian.

OK. But "should" != "must".

Anyway, I'm reopening the bug report for the sake of issue tracking.

I'm very sorry but given that:

 - Debian is not my paid work,
 - I don't have time to work on this right now,
 - we are in hard freeze

I'm not able to fix this in the next future... but your patches are
always welcome. ;)

Feel free to join the maintenance, if interested.

Cheers.

We believe that the bug you reported is fixed in the latest version of
gegl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 857394@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jeremy Bícha <jbicha@ubuntu.com> (supplier of updated gegl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 12 Sep 2026 10:09:27 +0200
Source: gegl
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 1:0.4.72-1
Distribution: unstable
Urgency: high
Maintainer: Debian GNOME Extras Maintainers <pkg-gnome-extras-maintainers@lists.alioth.debian.org>
Changed-By: Jeremy Bícha <jbicha@ubuntu.com>
Closes: 857394 1145018
Changes:
 gegl (1:0.4.72-1) unstable; urgency=high
 .
   * New upstream release
     - SECURITY UPDATE: Fix HDR file parsing integer overflow
       - CVE-2026-18300 (Closes: #1145018)
   * debian/libgegl-0.4-0t64.symbols: Update
   * Remove unused Build-Depends: libavformat-dev
   * Add Build-Depends: libsdl3-dev
   * Add Build-Depends: opencl-headers (Closes: #857394)
   * Use Files-Excluded to enforce use of packaged opencl headers
   * Add patch to fix build with our use of Files-Excluded
Checksums-Sha1:
 2650b9c7c000c7b028b98ed96f70b0ac93f0a0dc 3043 gegl_0.4.72-1.dsc
 ee8f3b1ed4ded9f4628742afef46c266d44ca3fb 6238888 gegl_0.4.72.orig.tar.xz
 158f6112cb22c3d98e812f5e06dcfe861881d9b7 27548 gegl_0.4.72-1.debian.tar.xz
 0c1481f0ddf364ee360dbf87cc2f29712f5d07de 8437 gegl_0.4.72-1_source.buildinfo
Checksums-Sha256:
 75871316ca7ceb1694ceba15e52718753dec2b87b437f67e507f7fd34a83a17f 3043 gegl_0.4.72-1.dsc
 d7e407eec21f682e9939e5a8417587a1162285e46d0cf974f445b14f9a250316 6238888 gegl_0.4.72.orig.tar.xz
 33bf53a2c8754b3d1c406f03f03ea94ff6373e43156377c2342b66d43cc37ef7 27548 gegl_0.4.72-1.debian.tar.xz
 a47e6c91d228a85ad2a32544a8ffa9da1d9b493a15e53e374a7cd74caab30603 8437 gegl_0.4.72-1_source.buildinfo
Files:
 c6edc1faa5062420743f32ed71ae4d7f 3043 devel optional gegl_0.4.72-1.dsc
 2f0ac37f08ea8a2a888e7b2603a448a5 6238888 devel optional gegl_0.4.72.orig.tar.xz
 26b13a96e94429acb51263cda15ed869 27548 devel optional gegl_0.4.72-1.debian.tar.xz
 923f13df25266b152ad1a71cad20bb90 8437 devel optional gegl_0.4.72-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmqlCoQACgkQ5mx3Wuv+
bH2fOBAAo08f7SVVkJ9d80KWaTDKt1OMf4HTIGoLDt8e16oan3VloTMFTEeg0lR8
TH8zhAOgSEN0ncuqw83O/P8v4Tc17MUHQ0yTF966V2G4TtkelsAiyAhw3teBFYo+
NxQaWxXgPg/Bku1SPPjoWXAxCEKSj/EDGghn+aixq2Oih4aDXQyT/Zitle12OiAN
MJuXuFMqUOqB6VqEnipnUU1JkpsX7RbRFVQm1456F07578kF0kE5YEEPFfZtWkLu
FwcSzEVDEFCgolWHvdSO5/V+xMl7pgti2w6StD2CfAB4/flb5K9aKjkDSmXMlaDh
Sxi4bu/mwZUFbVI2tW8VT5GEEfyAmbYOUzOWcNskmrbOxN7lMvrlQySfQugzcQNk
is14ClSdug+4vs+hIC7gs13pV3l0J5UaGti0XJRTAd4m3eS908sec+iVWfM921Sf
PZdMHGV2bDomX3+CKIdLDvYF7pppkrN6UBLe/ev2zs+AyntzjzhjMlqeWubwPmHB
+rJxhZcgGEmvPzrJFDWaivy5OYVRORfjyZdcApQPQAYXxCTt1pg0yqwL/MQHvCGh
tKqHZNE72VLMfCAEieCQv0pJQbiRvg9N974lpXuUhSEG5evcR5hQGYEahk/n+KaQ
SHYxR3CyEyC0GNFM/yD+Z88krVXz6mM2zgyqrsqB0TRRAnAaw7Y=
=nfpq
-----END PGP SIGNATURE-----