[Pkg-fonts-devel] license violations with embedded binary copies of GNU FreeFont?

[Nicolas Spalinger]

On 09/06/11 07:29, Paul Wise wrote:
> Hi all,
> 
> Looking at the pkg-fonts review page I see quite a few GPL/LGPL fonts
> and I was wondering if anyone has done any investigation as to how
> many of these are GPL violations, given that people usually only embed
> copies of TTF files and not their fontforge or other source?
> 
> As an example, this appears to be a license violation:
> 
> http://pkg-fonts.alioth.debian.org/review/pkg-blinken.html
> http://pkg-fonts.alioth.debian.org/review/fnt-cf83ecfc862295cf6d117bcbf5295d45.html
> http://downloads.sourceforge.net/project/sjfonts/sjfonts/sjfonts-2.0.2/sjfonts-source-2.0.2.tar.bz2
> http://cdn.debian.net/debian/pool/main/k/kdeedu/kdeedu_4.6.3-2.dsc


Hi Paul,

Don't you mean "bundling" instead of "embedding" in this situation?

(Embedding is inclusion of the font in a document or file in a way that
makes extraction - and redistribution - difficult or clearly discouraged
and for which the fonts are transformed: the names of embedded fonts are
not obvious to those reading the document, the font data format is
altered, and only a subset of the font - only the glyphs required for
the text - is included. This is not just nit-picking on words but
looking at different use cases and different outcomes and corresponding
requirements. I think the example you give above is more akin to
bundling where the font files are directly included in the source tree
of another piece of software and can be pulled out again and used
separately and more importantly still contains authorship information:
copyright and licensing notices.)


I didn't take time to look at it in details (sorry, spare time is still
a very scarce resource) but I'm fairly sure there are still many fonts
under *GPL* without their source requirements satisfied both upstream
and downstream. It would be useful to point out the issues to the
maintainers so the bugs can be fixed. Many thanks for your efforts on this !


Also many of these fonts are still missing the font exception as a
okay-ish workaround to the embedding issues. (As you can expect I'm
recommend advocating a license with explicit coverage of the embedding
issues!) So I think another key issue for us is to flag in the Debian
archive is PDFs which embed fonts in breach of the license, probably
unwillingly but still problematic. Licenses that don't allow embedding
and propagate the copyleft and source requirements to the resulting
document without the user's consent unfortunately easily create breaches
of the author's chosen licensing.

To help with this I'm working on a simple adaptation of our review
script to analyse all pdfs in the archive and produce a report about all
the fonts used. Basically it's exposing the output of pdfinfo and
pdffonts (from poppler-utils) from all the pdfs. This should help us as
a team to fix the situation. (we can look at other types of documents
later on).

But I have trouble accessing our svn with the new Alioth setup. Can
someone in the team be so kind and explain how they've switched their
access configuration or point me to the right docs? Thanks in advance.


Cheers,


-- 
Nicolas Spalinger,
SIL NRSI volunteer - http://scripts.sil.org
Debian fonts task force -  http://pkg-fonts.alioth.debian.org
Open font community - http://planet.open-fonts.org