[MIR] jpeg-xl

[Jeremy Bícha]

[Availability]
The package jpeg-xl is already in Ubuntu universe.
The package jpeg-xl build for the architectures it is designed to work on.
It currently builds and works for all Ubuntu architectures
Link to package https://launchpad.net/ubuntu/+source/jpeg-xl

[Rationale]
- The packages libjxl-gdk-pixbuf and libjxl0.10 are required in Ubuntu main to enable JPEG XL files to be used as a desktop wallpaper and to be viewable in GNOME-ish apps like eog and shotwell
- The package libjxl-gdk-pixbuf will generally be useful for a large part of our user base
- The binary package libjxl-gdk-pixbuf needs to be in main to achieve JPEG XL support

- It would be great and useful to community/processes to have the package jpeg-xl in Ubuntu main, but there is no definitive deadline.

[Security]
- Had multiple security issues in the past
- https://ubuntu.com/security/cve?package=jpeg-xl
- https://security-tracker.debian.org/tracker/source-package/jpeg-xl
+ Debian has marked the 2 2023 CVEs as "no-dsa (minor issue)
+ The remaining needs-triage bug in Ubuntu's tracker, CVE-2021-36691, has been marked by Debian as "negligible security impact"

- no `suid` or `sgid` binaries
- no executables in `/sbin` and `/usr/sbin`
- Packages do not install services, timers or recurring jobs
- Packages do not open privileged ports (ports < 1024).
- Packages do not expose any external endpoints
- Packages do not contain extensions to security-sensitive software (filters, scanners, plugins, UI skins, ...)

[Quality assurance - function/usage]
- The package works well right after install

[Quality assurance - maintenance]
- The package is maintained well in Debian/Ubuntu/Upstream and does not have too many, long-term & critical, open bugs
- Ubuntu https://bugs.launchpad.net/ubuntu/+source/jpeg-xl/
- Debian https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=jpeg-xl
- Upstream's bug tracker https://github.com/libjxl/libjxl/issues

- The package does not deal with exotic hardware we cannot support

[Quality assurance - testing]
- The package runs a test suite on build time, if it fails it makes the build fail, link to build log https://launchpad.net/ubuntu/+source/jpeg-xl/0.10.3-3

- The package runs an autopkgtest, and is currently passing on all architectures

https://autopkgtest.ubuntu.com/packages/jpeg-xl

- The package does have not failing autopkgtests right now

[Quality assurance - packaging]
- debian/watch is present and works
- debian/control defines a correct Maintainer field

- Lintian overrides are present, but ok because this was affected by the t64 transition

- This package does not rely on obsolete or about to be demoted packages.
- This package has no python2 or GTK2 dependencies

- The package will be installed by default, but does not ask debconf questions

- Packaging and build is easy, link to debian/rules
https://salsa.debian.org/debian-phototools-team/libjxl/-/blob/master/debian/rules

[UI standards]
- Application is not end-user facing (does not need translation or .desktop file)

[Dependencies]
- There are further dependencies that are not yet in main, MIR for them is at
- highway https://launchpad.net/bugs/2070807

[Standards compliance]
- This package correctly follows FHS and Debian Policy

[Maintenance/Owner]
- The owning team will be Ubuntu Desktop (~desktop-packages) and I have their acknowledgement for that commitment

- This does not use static builds
- This does not use vendored code
- This package is not rust based

- The package has been built within the last 3 months in the archive
- Build link on launchpad: https://launchpad.net/ubuntu/+source/jpeg-xl/0.10.3-3

[Background information]
- The Package description explains the package well
- Upstream Name is libjxl
- Links to upstream project
+ https://github.com/libjxl/libjxl
+ https://jpeg.org/jpegxl/
- Some additional binary packages have no reverse dependencies and can remain in universe:
+ libjpegxl-java
+ libjpegli-tools
+ libjxl-devtools
+ libjxl-tools

- Before version 0.9, the gdk-pixbuf loader was not enabled in Debian or Ubuntu because it required skcms which is not available in Debian or Ubuntu; with version 0.9, the loader was buildable with lcms2 which is in Ubuntu main. It is not feasible to backport this to Ubuntu 24.04 LTS which only has version 0.7.

- A gdk-pixbuf loader for an image format is required for images with that format to be used as a desktop wallpaper and to be viewable in GNOME-ish apps like eog and shotwell

- GNOME 46 (released in early 2024) switched its default desktop wallpaper to JPEG XL

[Jeremy Bícha (jbicha)]

W: libjpegxl-java: bad-jar-name [usr/share/java/org.jpeg.jpegxl.jar]
W: jpeg-xl source: newer-standards-version 4.7.0 (current is 4.6.2)
I: jpeg-xl source: debian-rules-contains-unnecessary-get-orig-source-target [debian/rules]
I: jpeg-xl-doc: file-references-package-build-path [usr/share/doc/jpeg-xl-doc/html/dir_e68e8157741866f444e17edd764ebbae.html]
I: jpeg-xl source: patch-not-forwarded-upstream [debian/patches/0008-Fix-conformance-test.patch]
I: libjxl-tools: spelling-error-in-binary reencode re-encode [usr/bin/cjxl]
I: libjxl-tools: typo-in-manual-page reencode re-encode [usr/share/man/man1/cjxl.1.gz:245]

- bad-jar-name is perhaps irrelevant to this MIR since we are explicitly wanting the -java package to stay in universe. I'll likely still followup with a Debian bug or maybe even a fix.
- lijbxl-tools is also going to stay in universe
- newer-standards-version is a false positive, waiting for a new version of lintian to recognize the latest version number of Debian Policy
- debian/rules has a comment to explain why there is a get-orig-source rule
- file-references-build-path may be a false positive. That filename has been used consistently since jpeg-xl 0.7 first landed in Debian/Ubuntu.

[Jeremy Bícha (jbicha)]

It is on our todo list to update the jpeg-xl package for Ubuntu Oracular to version 0.10.2 in July

[Jeremy Bícha (jbicha)]

jpeg-xl 0.10 is now in oracular-proposed so I have updated this bug description. jpeg-xl's autopkgtest metadata will need an expected update for the tests to show as passing; this is expected to happen in a few days.

https://bugs.debian.org/1076699