fix(docker): give the production images the Debian zimg record (issue #3242)

Dockerfile.go-server

@@ -100,6 +100,9 @@ RUN mkdir -p /dist/lib/pkgconfig /dist/bin /dist/model \
     && find /build/src -maxdepth 1 \( -name 'libvmaf.so*' -o -name 'libvmafx.so*' \) \
         \( -type f -o -type l \) -exec cp -a {} /dist/lib/ \; \
     && cp -d /usr/lib/*-linux-gnu*/libzimg.so* /dist/lib/ \
+    && mkdir -p /dist/doc/libzimg2 \
+    && cp /usr/share/doc/libzimg2/copyright /dist/doc/libzimg2/copyright \
+    && dpkg-query -W -f='${source:Package}=${source:Version}\n' libzimg2 > /dist/doc/libzimg2/SOURCE \
     && cp /build/meson-private/libvmaf.pc /dist/lib/pkgconfig/libvmaf.pc \
     && cp /build/meson-private/libvmafx.pc /dist/lib/pkgconfig/libvmafx.pc \
     && cp /build/tools/vmaf /dist/bin/ \
@@ -181,8 +184,10 @@ LABEL org.opencontainers.image.source="https://github.com/VMAFx/vmafx"
 LABEL org.opencontainers.image.licenses="EUPL-1.2 AND BSD-2-Clause-Patent AND BSD-3-Clause AND BSD-2-Clause AND ISC AND MIT AND Unlicense AND LicenseRef-LIVE-BRISQUE AND WTFPL"
 LABEL org.opencontainers.image.vendor="Lusoris"
 
-# Copy libvmaf.so* and the vmaf CLI from the vmaf-builder stage.
+# Copy libvmaf.so* and the vmaf CLI from the vmaf-builder stage, with the Debian
+# record of the libzimg2 the zimg component reads (issue #3242).
 COPY --from=vmaf-builder /dist/lib/   /usr/local/lib/
+COPY --from=vmaf-builder /dist/doc/libzimg2 /usr/share/doc/libzimg2
 COPY --from=vmaf-builder /dist/bin/   /usr/local/bin/
 COPY --from=vmaf-builder /dist/model/ /usr/local/share/vmafx/model/
 

changelog.d/fixed/production-zimg-debian-record.md

@@ -0,0 +1,12 @@
+- **The production images credit the libzimg they ship.** The `vmaf` command now links zimg by
+  default ([ADR-3396](../docs/adr/3396-zimg-on-by-default.md)), so every production image copies
+  `libzimg.so*` out of Debian's `libzimg2` package — but the `zimg` entry of
+  `tools/rc1-tester/image/licensing.json` still described upstream zimg 3.0.6 and claimed no file in
+  the image, so the six builders that copy that library had no Debian record for it (issue #3242).
+  The `zimg` entry of `production-cli-image` now reads the package's Debian record exactly as the
+  tester entry already does: each builder stages `usr/share/doc/libzimg2/copyright` plus a
+  `dpkg-query` `SOURCE` line, the runtime stages install both at `/usr/share/doc/libzimg2`, and the
+  eight production records that inherit the component follow. The image's source offer names
+  `libzimg2`'s Debian source package instead of upstream zimg 3.0.6, and
+  `tools/rc1-tester/tests/test_dockerfile_runtime_libs.py` holds all six builders and the nine
+  published runtime stages to it.

docker/AGENTS.md

@@ -143,6 +143,31 @@ stage Meson's generated `meson-private/libvmaf.pc`; never synthesize it from
 `scripts/ci/test_e2e_runtime_contract.py` pins these invariants for both
 Dockerfiles.
 
+## Debian zimg record per copying builder (issue #3242)
+
+`libzimg.so*` copied from `/usr/lib/*-linux-gnu*` = Debian `libzimg2`, never
+upstream 3.0.6 archive. So `zimg` component of `production-cli-image` reads
+`debian_source_file: usr/share/doc/libzimg2/SOURCE` and takes package copyright
+file as licence text, same as tester entry.
+
+- Every copying builder (`Dockerfile.go-server`, `docker/Dockerfile.controller`,
+  `.node`, `.production`, `.production-gpu`) and shared
+  `scripts/ci/build-oneapi-libvmaf.sh` (both oneAPI images) stage `copyright` +
+  `dpkg-query` `SOURCE` line under `/dist/doc/libzimg2`. New copying builder: same.
+- Every runtime stage publishing `libzimg.so*` installs that directory at
+  `/usr/share/doc/libzimg2`.
+- Missing record -> image `licensing.py sources` fails (source offer names no
+  Debian package without record); notice names version image does not ship.
+- `tools/rc1-tester/tests/test_dockerfile_runtime_libs.py` pins builders,
+  published runtime stages (follows each `FROM` chain) and shared script. Copy
+  sites discovered from `COPY_SOURCES`, not listed: stage starting to copy Debian
+  library fails contract by name until declared.
+- One audited build-only exception: `docker/Dockerfile.tester` `vmaf-build`.
+  `runtime` overwrites `/opt/vmafx/lib` from `python-venv` (carries record) before
+  install; test proves order.
+- macOS bundle, Windows zips, `release-native` build zimg from source; keep 3.0.6
+  archive entry.
+
 ## Fedora optional SYCL repository
 
 `dev/fedora-40.Dockerfile` writes seven literal oneAPI repository lines with

docker/Dockerfile.controller

@@ -96,6 +96,9 @@ RUN mkdir -p /dist/lib/pkgconfig /dist/bin /dist/model \
     && find /build/src -maxdepth 1 \( -name 'libvmaf.so*' -o -name 'libvmafx.so*' \) \
         \( -type f -o -type l \) -exec cp -a {} /dist/lib/ \; \
     && cp -d /usr/lib/*-linux-gnu*/libzimg.so* /dist/lib/ \
+    && mkdir -p /dist/doc/libzimg2 \
+    && cp /usr/share/doc/libzimg2/copyright /dist/doc/libzimg2/copyright \
+    && dpkg-query -W -f='${source:Package}=${source:Version}\n' libzimg2 > /dist/doc/libzimg2/SOURCE \
     && cp /build/meson-private/libvmaf.pc /dist/lib/pkgconfig/libvmaf.pc \
     && cp /build/meson-private/libvmafx.pc /dist/lib/pkgconfig/libvmafx.pc \
     && cp /build/tools/vmaf /dist/bin/ \
@@ -180,6 +183,7 @@ LABEL org.opencontainers.image.vendor="Lusoris"
 
 # Copy libvmaf.so* and the vmaf CLI from the vmaf-builder stage.
 COPY --from=vmaf-builder /dist/lib/   /usr/local/lib/
+COPY --from=vmaf-builder /dist/doc/libzimg2 /usr/share/doc/libzimg2
 COPY --from=vmaf-builder /dist/bin/   /usr/local/bin/
 COPY --from=vmaf-builder /dist/model/ /usr/local/share/vmafx/model/
 

docker/Dockerfile.node

@@ -182,6 +182,9 @@ RUN mkdir -p /dist/lib/pkgconfig /dist/bin /dist/model \
     && find /build/src -maxdepth 1 \( -name 'libvmaf.so*' -o -name 'libvmafx.so*' \) \
         \( -type f -o -type l \) -exec cp -a {} /dist/lib/ \; \
     && cp -d /usr/lib/*-linux-gnu*/libzimg.so* /dist/lib/ \
+    && mkdir -p /dist/doc/libzimg2 \
+    && cp /usr/share/doc/libzimg2/copyright /dist/doc/libzimg2/copyright \
+    && dpkg-query -W -f='${source:Package}=${source:Version}\n' libzimg2 > /dist/doc/libzimg2/SOURCE \
     && cp /build/meson-private/libvmaf.pc /dist/lib/pkgconfig/libvmaf.pc \
     && cp /build/meson-private/libvmafx.pc /dist/lib/pkgconfig/libvmafx.pc \
     && cp /build/tools/vmaf /dist/bin/ \
@@ -471,8 +474,10 @@ ENV VMAFX_MODEL_DIR="/usr/local/share/vmafx/model"
 # Canonical ffmpeg path consumed by the node binary and its encoder probe.
 ENV VMAFX_FFMPEG_BIN="/usr/local/bin/ffmpeg"
 
-# Copy libvmaf.so* and models
+# Copy libvmaf.so* and models, with the Debian record of the libzimg2 the zimg
+# component reads (issue #3242).
 COPY --from=vmaf-builder /dist/lib/    /usr/local/lib/
+COPY --from=vmaf-builder /dist/doc/libzimg2 /usr/share/doc/libzimg2
 COPY --from=vmaf-builder /dist/model/  /usr/local/share/vmafx/model/
 COPY --from=vmaf-builder /dist/bin/vmaf /usr/local/bin/vmaf
 # pkg/storage resolves s3://, gs://, rclone:// and remote:path inputs by
@@ -783,7 +788,9 @@ FROM node-assembled AS node-sycl-assembled
 # The Intel GPU user-mode stack and its dpkg records (ADR-3371)
 COPY --from=intel-gpu-runtime-libs /out/ /
 
-# The oneAPI SYCL build of libvmaf, CLI, and Intel SYCL runtime files (ADR-3371)
+# The oneAPI SYCL build of libvmaf, CLI, and Intel SYCL runtime files (ADR-3371).
+# The libzimg2 Debian record needs no copy here: node-sycl-assembled inherits
+# runtime-base, which installs it (issue #3242).
 COPY --from=builder-oneapi2026 /dist/lib/   /usr/local/lib/
 COPY --from=builder-oneapi2026 /dist/bin/vmaf /usr/local/bin/vmaf
 COPY --from=builder-oneapi2026 /stage/lib/intel/ /usr/local/lib/intel/

docker/Dockerfile.production

@@ -84,6 +84,9 @@ RUN mkdir -p /dist/lib /dist/bin /dist/model \
     && find /build/src -maxdepth 1 \( -name 'libvmaf.so*' -o -name 'libvmafx.so*' \) -not -type d \
         -exec cp {} /dist/lib/ \; \
     && cp -d /usr/lib/*-linux-gnu*/libzimg.so* /dist/lib/ \
+    && mkdir -p /dist/doc/libzimg2 \
+    && cp /usr/share/doc/libzimg2/copyright /dist/doc/libzimg2/copyright \
+    && dpkg-query -W -f='${source:Package}=${source:Version}\n' libzimg2 > /dist/doc/libzimg2/SOURCE \
     && cp /build/tools/vmaf /dist/bin/ \
     && cp -r model/. /dist/model/
 
@@ -153,6 +156,7 @@ LABEL org.opencontainers.image.vendor="Lusoris"
 
 # Copy libvmaf.so* into /usr/local/lib and set up symlinks
 COPY --from=builder /dist/lib/ /usr/local/lib/
+COPY --from=builder /dist/doc/libzimg2 /usr/share/doc/libzimg2
 COPY --from=builder /dist/model/ /usr/local/share/vmafx/model/
 
 ENV LD_LIBRARY_PATH="/usr/local/lib"
@@ -253,6 +257,7 @@ LABEL org.opencontainers.image.licenses="EUPL-1.2 AND BSD-2-Clause-Patent AND BS
 LABEL org.opencontainers.image.vendor="Lusoris"
 
 COPY --from=builder /dist/lib/ /usr/local/lib/
+COPY --from=builder /dist/doc/libzimg2 /usr/share/doc/libzimg2
 COPY --from=builder /dist/model/ /usr/local/share/vmafx/model/
 COPY --from=builder /dist/bin/vmaf /usr/local/bin/vmaf
 

docker/Dockerfile.production-gpu

@@ -128,6 +128,9 @@ RUN meson setup build core --buildtype=release --strip -Db_lto=false \
 RUN mkdir -p /dist/lib /dist/bin /dist/model /stage/licenses/nvidia /licence-inputs \
     && find build/src -maxdepth 1 \( -name 'libvmaf.so*' -o -name 'libvmafx.so*' \) -not -type d -exec cp -a {} /dist/lib/ \; \
     && cp -d /usr/lib/*-linux-gnu*/libzimg.so* /dist/lib/ \
+    && mkdir -p /dist/doc/libzimg2 \
+    && cp /usr/share/doc/libzimg2/copyright /dist/doc/libzimg2/copyright \
+    && dpkg-query -W -f='${source:Package}=${source:Version}\n' libzimg2 > /dist/doc/libzimg2/SOURCE \
     && cp build/tools/vmaf /dist/bin/ \
     && cp -r model/. /dist/model/ \
     && for binary in /dist/bin/vmaf /dist/lib/libvmaf.so.* /dist/lib/libvmafx.so.*; do \
@@ -180,6 +183,9 @@ RUN gfx_targets="$(jq -r '.dist_amdgpu_targets' /opt/rocm/share/therock/dist_inf
 RUN mkdir -p /dist/lib /dist/bin /dist/model /licence-inputs \
     && find build/src -maxdepth 1 \( -name 'libvmaf.so*' -o -name 'libvmafx.so*' \) -not -type d -exec cp -a {} /dist/lib/ \; \
     && cp -d /usr/lib/*-linux-gnu*/libzimg.so* /dist/lib/ \
+    && mkdir -p /dist/doc/libzimg2 \
+    && cp /usr/share/doc/libzimg2/copyright /dist/doc/libzimg2/copyright \
+    && dpkg-query -W -f='${source:Package}=${source:Version}\n' libzimg2 > /dist/doc/libzimg2/SOURCE \
     && cp build/tools/vmaf /dist/bin/ \
     && cp -r model/. /dist/model/ \
     && python3 tools/rc1-tester/image/prepare_build.py rocm-runtime \
@@ -277,6 +283,7 @@ ENV LD_LIBRARY_PATH="/usr/local/lib:/usr/lib/wsl/lib" \
     NVIDIA_DRIVER_CAPABILITIES=compute,utility \
     VMAF_MODEL_PATH="/usr/local/share/vmafx/model"
 COPY --from=builder-cuda13 /dist/lib/   /usr/local/lib/
+COPY --from=builder-cuda13 /dist/doc/libzimg2 /usr/share/doc/libzimg2
 COPY --from=builder-cuda13 /dist/bin/   /usr/local/bin/
 COPY --from=builder-cuda13 /dist/model/ /usr/local/share/vmafx/model/
 COPY --from=builder-cuda13 /stage/licenses/ /usr/local/share/vmafx/licenses/
@@ -385,6 +392,7 @@ LABEL org.opencontainers.image.vendor="Lusoris"
 ENV LD_LIBRARY_PATH="/usr/local/lib:/usr/local/lib/rocm" \
     VMAF_MODEL_PATH="/usr/local/share/vmafx/model"
 COPY --from=builder-rocm10 /dist/lib/   /usr/local/lib/
+COPY --from=builder-rocm10 /dist/doc/libzimg2 /usr/share/doc/libzimg2
 COPY --from=builder-rocm10 /dist/bin/   /usr/local/bin/
 COPY --from=builder-rocm10 /dist/model/ /usr/local/share/vmafx/model/
 COPY --from=builder-rocm10 /stage/lib/rocm/ /usr/local/lib/rocm/
@@ -521,6 +529,7 @@ RUN --mount=type=secret,id=github_token,env=GITHUB_TOKEN,required=false \
 ENV LD_LIBRARY_PATH="/usr/local/lib:/usr/local/lib/intel:/usr/lib/wsl/lib" \
     VMAF_MODEL_PATH="/usr/local/share/vmafx/model"
 COPY --from=builder-oneapi2026 /dist/lib/   /usr/local/lib/
+COPY --from=builder-oneapi2026 /dist/doc/libzimg2 /usr/share/doc/libzimg2
 COPY --from=builder-oneapi2026 /dist/bin/   /usr/local/bin/
 COPY --from=builder-oneapi2026 /dist/model/ /usr/local/share/vmafx/model/
 COPY --from=builder-oneapi2026 /stage/lib/intel/ /usr/local/lib/intel/

docs/state.md

@@ -1176,6 +1176,7 @@ landed fix yet._
 
 ## Recently closed
 
+| **T-PRODUCTION-ZIMG-DEBIAN-RECORD-2026-11-10** — the production licence manifest named upstream zimg 3.0.6 while every production image ships Debian's `libzimg2` 3.0.5+ds1-1+b2, so the generated notice named the wrong version and source, and six builders copied `libzimg.so*` out of `/usr/lib/*-linux-gnu*` with nothing in the image the `zimg` component could point at | **FIXED on `fix/issue-3242-zimg-debian-source` (2026-11-11).** Each of the six builder lines the maintainer named (`docker/Dockerfile.production`, `docker/Dockerfile.production-gpu` twice, `docker/Dockerfile.controller`, `Dockerfile.go-server`, `docker/Dockerfile.node`) and the shared `scripts/ci/build-oneapi-libvmaf.sh` behind the two oneAPI images stores `/usr/share/doc/libzimg2/copyright` plus a `dpkg-query` `SOURCE` record under `/dist/doc/libzimg2`; the nine published runtime stages install both at `/usr/share/doc/libzimg2`; the `zimg` entry of `production-cli-image` reads them through `debian_source_file` and an `artifact` text, and the eight production records that inherit it follow (ADR-1517). `tools/rc1-tester/tests/test_dockerfile_runtime_libs.py` now **discovers** the copy sites instead of listing them, which surfaced a seventh site the old table had never covered: `docker/Dockerfile.tester`'s `vmaf-build` copies libzimg and its `/opt/vmafx` reaches the published image through `runtime`'s `COPY --from=vmaf-build /opt/vmafx /opt/vmafx`, so a test proves `runtime` overwrites `/opt/vmafx/lib` from `python-venv` — which does carry the record — before installing it (an audited build-only exclusion, not a hole). On master 8 of 12 copy sites and 9 of 13 runtime stages fail, on the fix all pass; the macOS, Windows and `release-native` entries stay on the 3.0.6 archive, which each of those links itself. | #3242 | 2026-11-10 | closed |
 | **T-CI-PRECOMMIT-DIFF-SCOPE-HOOK-INPUT-2026-11-01** — #3237 added the hook `check-fork-python-subprocess` and its script; the Pre-Commit job ran on the pull request's diff only (`--from-ref`), so the new hook never saw the files it flags elsewhere in the tree, the pull request passed, and master `a3ea48309` went red on the whole-tree run of the push | **FIXED on `fix/precommit-scope-config-change` (#3253).** `scripts/ci/precommit_scope.py` runs the whole tree when a pull request changes a hook input: `.pre-commit-config.yaml`, any file under `scripts/ci/` (CI authority) or `scripts/lib/`, any path a hook's command names (local and remote `entry` overrides, `args`, commands inside `bash -c`, `python -m` modules, deleted scripts included) or a module those scripts import; an unreadable file list, a git timeout or an entry it cannot split also select the whole tree. Invariant page: `scripts/ci/AGENTS.d/precommit-scope.md`. | `scripts/ci/tests/test_precommit_scope.py` (21 tests); against the diff-only selector of `634e636a7` 7 of them fail, the #3237 file list among them | `fix/precommit-scope-config-change` |
 | **T-HOOKS-WINDOWS-POSIX-FIXTURES-2026-09-30** — four local fixture hooks fail on a Windows host | **FIXED in #3282 (part of #2438).** `test_lint_configured.py` normalises the public-model path via `as_posix()` and skips `ConfiguredLintTests` off POSIX with a stated reason; `test_write_compile_commands.py` skips `CompileCommandsExportTest` off POSIX with a stated reason; `test_tidy_ratchet.py` skips off POSIX with a stated reason; `test-sync-pelorus-interop.sh` skips on Windows with a stated reason. `scripts/ci/check-source-adr-citations.py --write` writes the registry with `newline="\n"`, guards against concurrent writes, cleans up temporary files on failure, and `test_check_source_adr_citations.py` verifies canonical byte rewriting. | unit test suite | #3282 | 2026-11-03 | closed |
 | **T-CI-WARNINGS-NON-MSVC-LEGS-2026-10-07** — remaining: Dev Container Build compiles third-party sources (vpl-gpu-rt -Wstringop-overflow, FFmpeg) and prints gcc's LTO "serial compilation" note | **CLOSED in #3282 (part of #2438).** Recorded the dev container image build as outside the compiler warning gate in `docs/development/ci.md` ("Builds outside the gate") per ADR-2170 and ADR-2828: external container dependencies (`vpl-gpu-rt`, `FFmpeg`) are compiled into temporary container layers during OCI image assembly rather than from repository sources; in-tree VMAFx sources are compiled and gated with `-Dwerror=true` across all CI compiler matrix legs. The Windows `icx-cl` lane was previously resolved and gated with `-Dwerror=true` in PR #2650 (ADR-2828). | `docs/development/ci.md` | #3282 | 2026-11-03 | closed |

scripts/ci/build-oneapi-libvmaf.sh

@@ -40,6 +40,12 @@ nice -n 10 ninja -C "${build_dir}" -j"${jobs}"
 mkdir -p "${dist_dir}/lib" "${dist_dir}/bin" "${dist_dir}/model" "${licence_inputs_dir}"
 find "${build_dir}/src" -maxdepth 1 \( -name 'libvmaf.so*' -o -name 'libvmafx.so*' \) -not -type d -exec cp -a {} "${dist_dir}/lib/" \;
 cp -d /usr/lib/*-linux-gnu*/libzimg.so* "${dist_dir}/lib/"
+# The Debian record of the libzimg2 those images ship (issue #3242): the zimg
+# component of licensing.json reads usr/share/doc/libzimg2/SOURCE and takes its
+# copyright file as the licence text, as the tester images already do.
+mkdir -p "${dist_dir}/doc/libzimg2"
+cp /usr/share/doc/libzimg2/copyright "${dist_dir}/doc/libzimg2/copyright"
+dpkg-query -W -f='${source:Package}=${source:Version}\n' libzimg2 >"${dist_dir}/doc/libzimg2/SOURCE"
 cp "${build_dir}/tools/vmaf" "${dist_dir}/bin/"
 cp -r model/. "${dist_dir}/model/"
 

tools/rc1-tester/image/licensing.json

@@ -2748,22 +2748,23 @@
     {
      "id": "zimg",
      "kind": "fixed",
-     "name": "zimg image scaling and colours-pace conversion library (libzimg.so.2)",
+     "name": "zimg image scaling and colours-pace conversion library (Debian libzimg2)",
      "paths": [
-      "usr/local/lib/libzimg.so*"
+      "usr/local/lib/libzimg.so*",
+      "usr/share/doc/libzimg2/**"
      ],
      "licence": "WTFPL",
      "copyright": [
-      "Copyright (c) 2014-2024, sekrit-twc"
+      "Copyright (c) 2014-2020, sekrit-twc"
      ],
-     "source": "https://github.com/sekrit-twc/zimg.git at commit f819b14e8f39d1282400b0d9543e8ef73c1b2bbd, tag release-3.0.6",
+     "debian_source_file": "usr/share/doc/libzimg2/SOURCE",
      "texts": [
       {
-       "name": "WTFPL.txt",
-       "fetched": "zimg-3.0.6-COPYING",
-       "label": "zimg 3.0.6 licence text (WTFPL v2)"
+       "artifact": "usr/share/doc/libzimg2/copyright",
+       "label": "Debian copyright file of libzimg2"
       }
-     ]
+     ],
+     "source": "the Debian source package named in usr/share/doc/libzimg2/SOURCE, in the source image"
     },
     {
      "id": "notices",