GPLv3 ffmpeg is redistributed in the MIT-licensed Docker image

[lstein]

Surfaced by the adversarial review of #355. Attribution has been added to THIRD_PARTY_LICENSES.txt in that PR as a good-faith first step, but the underlying distribution question is a project-level decision and is left here.

Facts

• imageio-ffmpeg (added in chore: split the media-type taxonomy and add the ffmpeg dependency #355, used from feat: extract and cache a still frame from video files #356) ships a pre-built static FFmpeg inside its platform wheels. The installed Linux binary is 79,826,272 bytes.

• That build is GPL, verified by running it:

  ffmpeg version 7.0.2-static https://johnvansickle.com/ffmpeg/
  configuration: --enable-gpl --enable-version3 ...
  

  --enable-gpl --enable-version3 means GPLv3, not FFmpeg's default LGPL.

• pyproject.toml:13 declares license = { text = "MIT" }.

• docker/Dockerfile line 11 is a plain pip install ., so the binary lands in the image layer, and .github/workflows/deploy-dockerhub.yml pushes that as photomapai:<version> and :latest.

• Before chore: split the media-type taxonomy and add the ffmpeg dependency #355, THIRD_PARTY_LICENSES.txt listed only the CLIP weights.

So the published image redistributes a GPLv3 binary, from a project declaring MIT, previously with no notice and no source offer.

What #355 already does

Adds an FFmpeg section to THIRD_PARTY_LICENSES.txt: the GPLv3 statement, links to the license text, FFmpeg source and the build scripts, a note that FFmpeg is invoked as a separate program via subprocess rather than linked, and a route to request corresponding source.

Open questions

• Is the attribution sufficient, or should the image carry the full GPLv3 text and a written offer for the corresponding source of that exact build?
• Should the Docker image bundle ffmpeg at all, or install a distro LGPL build (apt-get install ffmpeg) and set IMAGEIO_FFMPEG_EXE? That avoids the GPL-only components and drops ~80 MB from the layer.
• Should PyPI users get the binary by default, or should imageio-ffmpeg move to an optional [video] extra so a plain pip install photomapai stays lean and GPL-free?
• Does the launcher's first-run install path need the same treatment?

Note on scale

The binary is paid for by every pip install photomapai, the Docker image, the launcher's first-run install, and 7 uncached CI legs (run_tests.yml's 3×2 matrix plus lint.yml — neither sets cache: 'pip').