Hi,

I think fontforge is a false positive. It's just one line which imports setuptools and that is from third party sources in the pycontrib directory. That file (or directory) is not installed by the fontforge package.

Regards,

Parag