Merge branch 'AcademySoftwareFoundation:main' into R3D

Author: 1div0

.github/workflows/ci.yml

@@ -225,7 +225,7 @@ jobs:
             container: aswf/ci-oiio:2025.5
             cxx_std: 17
             build_type: Debug
-            ctest_test_timeout: "240"
+            ctest_test_timeout: "300"
             python_ver: "3.11"
             simd: "avx2,f16c"
             fmt_ver: 11.2.0

CHANGES.md

@@ -8,9 +8,21 @@ Release 3.2 (target: Sept 2026?) -- compared to 3.1
 ### ⛰️  New features and public API changes:
 * *New image file format support:*
 * *oiiotool new features and major improvements*:
+  - `oiiotool --flipdiff` computes the FLIP perceptual difference between two
+    images, prints statistics, and leaves the error map on the image stack for
+    further processing or saving. Options: `hdr=1` for HDR-FLIP, `colormap=NAME`
+    to apply a false-color map (e.g. "magma"), `ppd=N` to override pixels-per-
+    degree, `tonemapper=NAME` for HDR tonemapper ("aces", "reinhard", "hable").
 * *Command line utilities*:
   - *iv*: Flip, rotate and save image [#5003](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5003) (by Valery Angelique) (3.2.0.0, 3.1.11.0)
 * *ImageBuf/ImageBufAlgo*:
+  - `ImageBufAlgo::FLIP()` computes the FLIP (eLearning perceptual Image
+    difference Predictor) metric between two LDR or HDR images. The result is
+    a single-channel float image with per-pixel FLIP error in [0,1]. A
+    `FLIPResults` struct returns mean error, max error, and location. The
+    optional `colormap` kwarg applies a false-color map to the result.
+    `FLIP_ppd()` helper computes pixels-per-degree for a given display setup.
+    Python bindings and `oiiotool --flipdiff` are also provided.
   - *ImageBuf*: `IB::localpixels_as_[writable_]byte_image_span` [#5011](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5011) (3.2.0.0, 3.1.10.0)
 * *ImageCache/TextureSystem*:
   - *api/TS*: `IBA::make_texture()` now honors "maketx:threads" hint [#5014](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5014) (3.2.0.0, 3.1.10.0)

CMakeLists.txt

@@ -142,6 +142,12 @@ if (TEX_BATCH_SIZE)
     add_compile_definitions (OIIO_TEXTURE_SIMD_BATCH_WIDTH=${TEX_BATCH_SIZE})
 endif ()
 
+# If we're building this just for CI, define a symbol so the code can
+# tell (and reduce complexity of some tests)
+set_option (OIIO_CI "Set if this build is for our GHA CI" OFF)
+if (OIIO_CI)
+    add_compile_definitions (OIIO_CI=1)
+endif ()
 
 # Namespace settings
 #
@@ -308,7 +314,12 @@ else ()
     set (_py_dev_found Python3_Development.Module_FOUND)
 endif ()
 if (USE_PYTHON AND ${_py_dev_found} AND NOT BUILD_OIIOUTIL_ONLY)
-    add_subdirectory (src/python)
+    if (OIIO_BUILD_PYTHON_PYBIND11)
+        add_subdirectory (src/python)
+    endif ()
+    if (OIIO_BUILD_PYTHON_NANOBIND)
+        add_subdirectory (src/python-nanobind)
+    endif ()
 else ()
     message (STATUS "Not building Python bindings: USE_PYTHON=${USE_PYTHON}, Python3_Development.Module_FOUND=${Python3_Development.Module_FOUND}")
 endif ()

INSTALL.md

@@ -42,6 +42,10 @@ NEW or CHANGED MINIMUM dependencies since the last major release are **bold**.
      * Python >= 3.9 (tested through 3.13).
      * pybind11 >= 2.7 (tested through 3.0)
      * NumPy (tested through 2.4.4)
+     * If you enable the optional nanobind (WIP) backend for source/CMake
+       builds (`OIIO_PYTHON_BINDINGS_BACKEND` is `nanobind` or `both`):
+         * nanobind discoverable by CMake, or installed in the active Python
+           environment so `python -m nanobind --cmake_dir` works
  * If you want support for PNG files:
      * libPNG >= 1.6.0 (tested though 1.6.56)
  * If you want support for camera "RAW" formats:
@@ -157,6 +161,12 @@ Make wrapper (`make PkgName_ROOT=...`).
 
 `USE_PYTHON=0` : Omits building the Python bindings.
 
+`OIIO_PYTHON_BINDINGS_BACKEND=pybind11|nanobind|both` : Select which Python
+binding backend(s) to configure for source/CMake builds. `both` keeps the
+existing pybind11 module and also builds the nanobind (WIP) module. The
+Python packaging path driven by `pyproject.toml` still targets the production
+pybind11 bindings today.
+
 `OIIO_BUILD_TESTS=0` : Omits building tests (you probably don't need them
 unless you are a developer of OIIO or want to verify that your build
 passes all tests).
@@ -247,6 +257,7 @@ Additionally, a few helpful modifiers alter some build-time options:
 | make USE_QT=0 ...             |  Skip anything that needs Qt                                              |
 | make MYCC=xx MYCXX=yy ...     |  Use custom compilers                                                     |
 | make USE_PYTHON=0 ...         |  Don't build the Python binding                                           |
+| make OIIO_PYTHON_BINDINGS_BACKEND=both ... | For source/CMake builds, build the existing pybind11 bindings and the nanobind (WIP) module |
 | make BUILD_SHARED_LIBS=0      |  Build static library instead of shared                                   |
 | make IGNORE_HOMEBREWED_DEPS=1 |  Ignore homebrew-managed dependencies                                     |
 | make LINKSTATIC=1 ...         |  Link with static external libraries when possible                        |

Makefile

@@ -159,7 +159,7 @@ MY_CMAKE_FLAGS += -DTEX_BATCH_SIZE:STRING="${TEX_BATCH_SIZE}"
 endif
 
 ifneq (${TEST},)
-TEST_FLAGS += -R ${TEST}
+TEST_FLAGS += -R '${TEST}'
 endif
 
 ifneq (${USE_CCACHE},)

README.md

@@ -123,11 +123,15 @@ it and potentially be able to answer your question quickly (more so than a GH
 "issue"). For quick questions, you could also try the [ASWF
 Slack](https://slack.aswf.io) `#openimageio` channel.
 
-Bugs, build problems, and discovered vulnerabilities that you are relatively
-certain is a legit problem in the code, and **for which you can give clear
-instructions for how to reproduce**, should be [reported as
+A bug or build problem that you are relatively certain is a legit problem in
+the code, and **for which you can give clear instructions for how to
+reproduce**, should be [reported as
 issues](https://github.com/AcademySoftwareFoundation/OpenImageIO/issues).
 
+To report a security vulnerability that is serious enough that it should not
+be discussed publicly until a patch is ready, please file a GitHub [security
+advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/new).
+
 If confidentiality precludes a public question or issue, you may contact us
 privately at [info@openimageio.org](info@openimageio.org), or for
 security-related issues [security@openimageio.org](security@openimageio.org).

SECURITY.md

@@ -16,14 +16,18 @@ security vulnerabilities.
 ## Reporting a Vulnerability
 
 If you think you've found a potential vulnerability in OpenImageIO, please
-report it by emailing security@openimageio.org. Only the project administrators
-have access to these messages. Include detailed steps to reproduce the issue,
-and any other information that could aid an investigation. Our policy is to
-respond to vulnerability reports within 14 days.
+report it to the maintainers. Include detailed steps to reproduce the issue,
+and any other information that could aid an investigation.
 
-Our policy is to address critical security vulnerabilities rapidly and post
-patches as quickly as possible.
+The best way to report a vulnerability is to file a GitHub [security
+advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/new).
+If that is not possible, it is also fine to email your report to
+security@openimageio.org. Only the project administrators have access to these
+reports.
 
+Our policy is to respond to vulnerability reports within 14 days, and to
+address critical security vulnerabilities rapidly and post patches as quickly
+as possible.
 
 ## Other security features
 
@@ -44,7 +48,7 @@ None known
 
 ## History of CVE Fixes
 
-Most recent fixes listed first, more or less
+Most recent fixes listed first, more or less:
 
 - CVE-2024-40630: Fixed incorrect image size for certain HEIC files.
   [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-jjm9-9m4m-c8p2) (Fixed in 2.5.13.1)

src/bmp.imageio/bmpinput.cpp

@@ -395,13 +395,28 @@ BmpInput::read_native_scanline(int subimage, int miplevel, int y, int /*z*/,
     if ((m_dib_header.compression == RLE4_COMPRESSION
          || m_dib_header.compression == RLE8_COMPRESSION)
         && m_colortable.size()) {
-        for (int x = 0; x < m_spec.width; ++x) {
-            int p = m_uncompressed[int64_t(m_spec.height - 1 - y) * m_spec.width
-                                   + x];
-            auto& c              = colortable(p);
-            mscanline[3 * x]     = c.r;
-            mscanline[3 * x + 1] = c.g;
-            mscanline[3 * x + 2] = c.b;
+        if (m_spec.nchannels == 1) {
+            OIIO_CONTRACT_ASSERT(m_allgray);
+            for (int x = 0; x < m_spec.width; ++x) {
+                int p
+                    = m_uncompressed[int64_t(m_spec.height - 1 - y) * m_spec.width
+                                     + x];
+                auto& c      = colortable(p);
+                mscanline[x] = c.r;
+                // For the "all gray" case, rgb are equal and we're filling in
+                // a 1-channel data buffer.
+            }
+        } else {
+            OIIO_CONTRACT_ASSERT(m_spec.nchannels == 3);
+            for (int x = 0; x < m_spec.width; ++x) {
+                int p
+                    = m_uncompressed[int64_t(m_spec.height - 1 - y) * m_spec.width
+                                     + x];
+                auto& c              = colortable(p);
+                mscanline[3 * x]     = c.r;
+                mscanline[3 * x + 1] = c.g;
+                mscanline[3 * x + 2] = c.b;
+            }
         }
         return true;
     }

src/build-scripts/ci-startup.bash

@@ -36,7 +36,7 @@ export PYTHONPATH=$OpenImageIO_ROOT/lib/python${PYTHON_VERSION}/site-packages:$P
 export COMPILER=${COMPILER:=gcc}
 export CC=${CC:=gcc}
 export CXX=${CXX:=g++}
-export OpenImageIO_CI=true
+export OpenImageIO_CI=1
 export USE_NINJA=${USE_NINJA:=1}
 export CMAKE_GENERATOR=${CMAKE_GENERATOR:=Ninja}
 export CMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE:=Release}

src/cmake/externalpackages.cmake

@@ -118,9 +118,13 @@ endif()
 if (USE_PYTHON)
     find_python()
 endif ()
-if (USE_PYTHON)
+if (USE_PYTHON AND OIIO_BUILD_PYTHON_PYBIND11)
     checked_find_package (pybind11 REQUIRED VERSION_MIN 2.7)
 endif ()
+if (USE_PYTHON AND OIIO_BUILD_PYTHON_NANOBIND)
+    discover_nanobind_cmake_dir()
+    checked_find_package (nanobind CONFIG REQUIRED)
+endif ()
 
 
 ###########################################################################