Bug 2443679 - Review Request: rust-hayro-jpeg2000 - Memory-safe, pure-Rust JPEG 2000 decoder
Summary: Review Request: rust-hayro-jpeg2000 - Memory-safe, pure-Rust JPEG 2000 decoder
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: Package Review
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Fabio Valentini
QA Contact: Fedora Extras Quality Assurance
URL: https://crates.io/crates/hayro-jpeg2000
Whiteboard:
Depends On: 2443677
Blocks: 2443680
TreeView+ depends on / blocked
 
Reported: 2026-03-01 19:39 UTC by Davide Cavalca
Modified: 2026-03-10 20:30 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2026-03-10 20:30:55 UTC
Type: ---
Embargoed:
decathorpe: fedora-review+


Attachments (Terms of Use)
The .spec file difference from Copr build 10205075 to 10205766 (1.22 KB, patch)
2026-03-10 05:00 UTC, Fedora Review Service
no flags Details | Diff

Description Davide Cavalca 2026-03-01 19:39:32 UTC
Spec URL: https://dcavalca.fedorapeople.org/review/rust-hayro-jpeg2000/rust-hayro-jpeg2000.spec
SRPM URL: https://dcavalca.fedorapeople.org/review/rust-hayro-jpeg2000/rust-hayro-jpeg2000-0.3.2-1.fc45.src.rpm
Upstream URL: https://crates.io/crates/hayro-jpeg2000

Description:
A memory-safe, pure-Rust JPEG 2000 decoder.

Fedora Account System Username: dcavalca

Comment 1 Davide Cavalca 2026-03-01 19:40:16 UTC
$ cat rust2rpm.toml 
[package]
cargo-toml-patch-comments = [
  "Bump fearless_simd to 0.4",
  "Temporarily downgrade moxcms to 0.7.5",
  "Bump indicatif to 0.18",
]
extra-patches = [
  { number = 2, file = "Upgrade-to-fearless_simd-v0.4.patch", comments = ["https://github.com/LaurenzV/hayro/pull/948"] },
]

[tests]
run = ["lib", "doc"]
comments = ["Skip tests that require external assets"]

Comment 2 Fedora Review Service 2026-03-01 19:41:26 UTC
Copr build:
https://copr.fedorainfracloud.org/coprs/build/10181346
(failed)

Build log:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2443679-rust-hayro-jpeg2000/fedora-rawhide-x86_64/10181346-rust-hayro-jpeg2000/builder-live.log.gz

Please make sure the package builds successfully at least for Fedora Rawhide.

- If the build failed for unrelated reasons (e.g. temporary network
  unavailability), please ignore it.
- If the build failed because of missing BuildRequires, please make sure they
  are listed in the "Depends On" field


---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

Comment 3 Fabio Valentini 2026-03-06 22:11:47 UTC
I "accidentally" looked into packaging this crate too (glycin added a dependency on it) and found some minor issues:

- There's a bunch of files included that should probably be excluded from published crates.
  I filed https://github.com/LaurenzV/hayro/issues/1036 for this.

- The assets/*.icc files are covered by CC0-1.0 (text included in assets/LICENSE.txt).
  I am unsure about how to best represent this in crate / package metadata.
  These ICC profiles *do* get embedded into the library when building,
  so it does affect both dependent applications *and* the license of the source code shipped in rust-hayro-jpeg2000-devel.
  As far as I can tell, we will need a patch for Cargo.toml to change the license filed to `("MIT OR Apache-2.0) AND CC0-1.0"`.

As for the other changes to Cargo.toml:

- I'll try to get moxcms updated in Fedora.
- The "indicatif" dev-dependency can be dropped and doesn't need to be bumped, it is only used in skipped tests.

Comment 4 Fabio Valentini 2026-03-08 14:48:55 UTC
Upstream released 0.3.3 with changes to drop the tests, JSON files, and Python script.
Now only adding CC0-1.0 to account for assets/*.icc is left.

Comment 6 Davide Cavalca 2026-03-09 21:24:39 UTC
$ cat rust2rpm.toml .
[package]
cargo-toml-patch-comments = [
  "Temporarily downgrade moxcms to 0.7.5",
  "Drop unused indicatif dev-dependency",
]

Comment 7 Fedora Review Service 2026-03-09 21:25:57 UTC
Copr build:
https://copr.fedorainfracloud.org/coprs/build/10205075
(failed)

Build log:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2443679-rust-hayro-jpeg2000/fedora-rawhide-x86_64/10205075-rust-hayro-jpeg2000/builder-live.log.gz

Please make sure the package builds successfully at least for Fedora Rawhide.

- If the build failed for unrelated reasons (e.g. temporary network
  unavailability), please ignore it.
- If the build failed because of missing BuildRequires, please make sure they
  are listed in the "Depends On" field


---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

Comment 8 Fabio Valentini 2026-03-09 22:18:12 UTC
Package looks mostly OK (built ok using the RPMs from the fearless_simd review), with two caveats (one bigger, one smaller):

- Looks like the package doesn't actually contain license texts for MIT and Apache-2.0.

  It appears that I completely missed this when I filed the issue about excluding the unused stuff ( :( ),
  and rust2rpm also doesn't error out because the crate *does* contain at least one license file --
  it just doesn't include all *three* of them.

  You can include the LICENSE-APACHE and LICENSE-MIT files from here for now,
  and file a PR / issue to get them included in published crates for later:

  https://github.com/LaurenzV/hayro/raw/refs/tags/hayro-jpeg2000-v0.3.3/LICENSE-APACHE
  https://github.com/LaurenzV/hayro/raw/refs/tags/hayro-jpeg2000-v0.3.3/LICENSE-MIT

- The crate license is correctly patched, but the spec file is missing a comment for *why* this happens.

  Since CC0-1.0 is actually forbidden for code now,
  documenting that CC0-1.0 only applies to *content* under assets/ would be good.

Comment 10 Davide Cavalca 2026-03-10 04:58:57 UTC
$ cat rust2rpm.toml 
[package]
cargo-toml-patch-comments = [
  "Temporarily downgrade moxcms to 0.7.5",
  "Drop unused indicatif dev-dependency",
  "Update license to document that the content under assets/ under CC0-1.0",
]
extra-sources = [
  { number = 2, file = "https://github.com/LaurenzV/hayro/raw/refs/tags/%{crate}-v%{version}/LICENSE-APACHE", comments = ["https://github.com/LaurenzV/hayro/pull/1053"] },
  { number = 3, file = "https://github.com/LaurenzV/hayro/raw/refs/tags/%{crate}-v%{version}/LICENSE-MIT", comments = ["https://github.com/LaurenzV/hayro/pull/1053"] },
]

[scripts]
prep.pre = [
  "cp -p %SOURCE2 %SOURCE3 .",
]

Comment 11 Fedora Review Service 2026-03-10 05:00:38 UTC
Created attachment 2132762 [details]
The .spec file difference from Copr build 10205075 to 10205766

Comment 12 Fedora Review Service 2026-03-10 05:00:41 UTC
Copr build:
https://copr.fedorainfracloud.org/coprs/build/10205766
(failed)

Build log:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2443679-rust-hayro-jpeg2000/fedora-rawhide-x86_64/10205766-rust-hayro-jpeg2000/builder-live.log.gz

Please make sure the package builds successfully at least for Fedora Rawhide.

- If the build failed for unrelated reasons (e.g. temporary network
  unavailability), please ignore it.
- If the build failed because of missing BuildRequires, please make sure they
  are listed in the "Depends On" field


---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

Comment 13 Fabio Valentini 2026-03-10 19:22:54 UTC
Thanks, looks good to me!

===

Package was generated with rust2rpm, simplifying the review.

✅❌❓🫤

✅ package contains only permissible content
✅ package builds and installs without errors on rawhide
✅ test suite is run and all unit tests pass
✅ latest version of the crate is packaged
✅ license matches upstream specification and is acceptable for Fedora
🫤 license files are included with %license in %files:
   license text for CC0-1.0 included in published tarball,
   license texts for MIT and Apache-2.0 included from upstream for now,
   PR to include them in the next release was already merged. 🎉
✅ package complies with Rust Packaging Guidelines

Package APPROVED.

===

Recommended post-import rust-sig tasks:

- set up package on release-monitoring.org:
  project: $crate
  homepage: https://crates.io/crates/$crate
  backend: crates.io
  version scheme: semantic
  version filter (*NOT* pre-release filter): alpha;beta;rc;pre
  distro: Fedora
  Package: rust-$crate

- set bugzilla assignee overrides to @rust-sig (optional)

===

Please add @rust-sig as co-maintainer with "commit" access, and / or request at least the f44 branch. I will also need this package for updating GNOME/glycin to v2.1.

Comment 14 Fedora Admin user for bugzilla script actions 2026-03-10 20:01:51 UTC
The Pagure repository was created at https://src.fedoraproject.org/rpms/rust-hayro-jpeg2000

Comment 15 Fedora Update System 2026-03-10 20:17:49 UTC
FEDORA-2026-9f38e7bbe1 (rust-hayro-jpeg2000-0.3.3-1.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-9f38e7bbe1

Comment 16 Fedora Update System 2026-03-10 20:30:55 UTC
FEDORA-2026-9f38e7bbe1 (rust-hayro-jpeg2000-0.3.3-1.fc45) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.