Switch wgrib2 to OpenJPEG flag to match upstream CI matrix

Last attempt (-DUSE_PNG=ON -DUSE_AEC=ON on wgrib2) reached 100 %
linking libwgrib2.so and then died with "make: Error 2" on the
parallel wgrib2_exe link. wgrib2's own CI workflow
(.github/workflows/Linux_options.yml) never tests USE_PNG alone —
its matrix uses -DUSE_OPENJPEG=ON, and its NCEPLIBS-g2c is built
with -DUSE_OpenJPEG=ON -DUSE_Jasper=OFF. Copying that known-good
combination:

  * g2c now builds with USE_PNG + USE_AEC + USE_OpenJPEG (Jasper
    still disabled — libjasper is out of Debian anyway).
  * wgrib2 flips to -DUSE_OPENJPEG=ON -DUSE_AEC=ON.
  * libopenjp2-7-dev added to the builder apt list, libopenjp2-7
    added to the runtime apt list so libg2c.so + wgrib2 can
    resolve OpenJPEG symbols at exec time.

wgrib2 delegates actual GRIB2 decompression to g2c, which is
built with PNG support, so DRT 5.41 (MRMS PrecipRate) still
decodes through this link — wgrib2's own USE_PNG knob isn't
required for decoding, only for encoding we don't do.

Dockerfile

@@ -27,15 +27,16 @@ ARG G2C_VERSION=1.9.0
 RUN apt-get update \
   && apt-get install -y --no-install-recommends \
      build-essential gfortran cmake wget ca-certificates pkg-config \
-     zlib1g-dev libaec-dev libpng-dev \
+     zlib1g-dev libaec-dev libpng-dev libopenjp2-7-dev \
   && rm -rf /var/lib/apt/lists/*
 
-# NCEPLIBS-g2c: wgrib2 >= 3.x requires this via find_package whenever
-# PNG / JPEG2000 decoders are enabled (wgrib2 CMakeLists:94). We only
-# need PNG (MRMS PrecipRate / native HRRR) + AEC — Jasper/OpenJPEG
-# default to ON in g2c and must be explicitly disabled since libjasper
-# isn't installed in this stage and would pull another runtime dep
-# into the debian-slim runner.
+# NCEPLIBS-g2c: wgrib2 >= 3.x delegates GRIB2 decompression to this
+# library via find_package whenever any of JASPER / OPENJPEG / PNG
+# is enabled (wgrib2 CMakeLists:94). Build g2c with all the
+# decoders we care about — PNG (MRMS PrecipRate / HRRR native),
+# OpenJPEG (modern JPEG2000 replacement for the CVE-riddled Jasper),
+# and AEC (CCSDS) — and disable Jasper so we don't need libjasper,
+# which Debian dropped years ago.
 WORKDIR /tmp/g2c
 RUN wget -q --content-disposition "https://github.com/NOAA-EMC/NCEPLIBS-g2c/archive/refs/tags/v${G2C_VERSION}.tar.gz" \
       -O g2c.tar.gz \
@@ -46,21 +47,31 @@ RUN wget -q --content-disposition "https://github.com/NOAA-EMC/NCEPLIBS-g2c/arch
               -DCMAKE_BUILD_TYPE=Release \
               -DUSE_PNG=ON \
               -DUSE_AEC=ON \
+              -DUSE_OpenJPEG=ON \
               -DUSE_Jasper=OFF \
-              -DUSE_OpenJPEG=OFF \
-              -DBUILD_G2C=OFF \
   && make -j$(nproc) \
   && make install
 
 WORKDIR /tmp/wgrib2
 
+# wgrib2 flag notes:
+#   * USE_OPENJPEG is what wgrib2's own CI (Linux_options.yml) tests
+#     — it triggers the g2c linkage and is known to build cleanly. An
+#     earlier attempt with -DUSE_PNG=ON alone got all the way to
+#     linking libwgrib2.so and then died with Error 2 on the wgrib2_exe
+#     link step (wgrib2 doesn't gate every jpeg_pk.c path properly
+#     when USE_PNG is set without USE_JASPER/USE_OPENJPEG).
+#   * wgrib2 delegates actual decompression to g2c, and g2c above was
+#     built with USE_PNG=ON, so PNG-packed GRIB2 (DRT 5.41, e.g. MRMS
+#     PrecipRate) still decodes correctly through this link even
+#     though wgrib2's own USE_PNG knob stays off.
 RUN wget -q --content-disposition "https://github.com/NOAA-EMC/wgrib2/archive/refs/tags/v${WGRIB2_VERSION}.tar.gz" \
       -O wgrib2.tar.gz \
   && tar xzf wgrib2.tar.gz \
   && cd wgrib2-${WGRIB2_VERSION} \
   && mkdir build && cd build \
   && cmake .. -DCMAKE_INSTALL_PREFIX=/usr/local -DCMAKE_BUILD_TYPE=Release \
-       -DUSE_PNG=ON -DUSE_AEC=ON \
+       -DUSE_OPENJPEG=ON -DUSE_AEC=ON \
   && make -j$(nproc) \
   && make install \
   && strip /usr/local/bin/wgrib2
@@ -125,7 +136,7 @@ FROM ${RUNNER_IMAGE} AS final
 RUN apt-get update \
   && apt-get install -y --no-install-recommends \
      libstdc++6 openssl libncurses6 locales ca-certificates snmp \
-     libgfortran5 libaec0 zlib1g libpng16-16t64 \
+     libgfortran5 libaec0 zlib1g libpng16-16t64 libopenjp2-7 \
   && rm -rf /var/lib/apt/lists/*
 
 RUN sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen && locale-gen