[Bug 1284215] New: Possible copyright violation with the Myanmar3 unicode font

[Bug 1271787] Review Request:...

Red Hat Bugzilla

Saturday, 21 November 2015 Sat, 21 Nov '15

6:25 p.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1284215 Bug ID: 1284215 Summary: Possible copyright violation with the Myanmar3 unicode font Product: Fedora Version: 23 Component: myanmar3-unicode-fonts Assignee: mvaliyav(a)redhat.com Reporter: htl10(a)users.sourceforge.net QA Contact: extras-qa(a)fedoraproject.org CC: fonts-bugs(a)lists.fedoraproject.org, mvaliyav(a)redhat.com, pnemade(a)redhat.com Description of problem: I am testing the new digital signature reading functionality of the newly open-sourced Microsoft Font Validator against all the fonts on Fedora, and found an anormaly - the Myanmar3 unicode font contains a digital signature table which has Microsoft as the signer. The digital signature does not verify. However, the fact that the copyright field in the SFNT name tables does not match the digital signature's signer, means that either the font editor copied the digital table itself from a microsoft font (which is a small copyright violation), or the whole font was derived and renamed from a microsoft copyrighted font (which is a big copyright violation). Please investigate. Version-Release number of selected component (if applicable): myanmar3-unicode-fonts-3.00-13.fc23.noarch How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info: -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=XGTU3EEz1J&a=cc_unsubscribe

Show replies by date

Red Hat Bugzilla

Saturday, 21 November Sat, 21 Nov

6:32 p.m.

New subject: [Bug 1284215] Possible copyright violation with the Myanmar3 unicode font

https://bugzilla.redhat.com/show_bug.cgi?id=1284215 Hin-Tak Leung <htl10(a)users.sourceforge.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |twaugh(a)redhat.com --- Comment #1 from Hin-Tak Leung <htl10(a)users.sourceforge.net> --- Tim: can you limit access of this bug report to redhat personnel only etc, the topic being sensitive? -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=0epRjGNAjV&a=cc_unsubscribe

Red Hat Bugzilla

7:45 p.m.

New subject: [Bug 1284215] Possible copyright violation with the Myanmar3 unicode font

https://bugzilla.redhat.com/show_bug.cgi?id=1284215 --- Comment #2 from Hin-Tak Leung <htl10(a)users.sourceforge.net> --- BTW, the URL in the rpm packaging is no longer reachable. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=P5HVNNLVKe&a=cc_unsubscribe

Red Hat Bugzilla

7:48 p.m.

New subject: [Bug 1284215] Possible copyright violation with the Myanmar3 unicode font

https://bugzilla.redhat.com/show_bug.cgi?id=1284215 --- Comment #3 from Hin-Tak Leung <htl10(a)users.sourceforge.net> --- Oh, I mean I tested all the fonts on *my* computer, which runs fedora 23 - it has *most* of the fonts shipped by fedora 23, but maybe not *all*. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=S9ybC8hwTl&a=cc_unsubscribe

Red Hat Bugzilla

Monday, 23 November Mon, 23 Nov

3:10 p.m.

New subject: [Bug 1284215] Possible copyright violation with the Myanmar3 unicode font

https://bugzilla.redhat.com/show_bug.cgi?id=1284215 --- Comment #4 from Hin-Tak Leung <htl10(a)users.sourceforge.net> --- The bottom line is, if they have authorization to modify and re-distribute a microsoft font, they probably should remove the microsoft digital signature; if they are not microsoft and ships with a font with a microsoft signature, that's highly suspicious. One way of confirming copyright violation is to find the same digital digest on a genuine microsoft font. At the moment all I can tell is that the digital signature was signed around 2002/2003, so if this is a copyright violation, it would be a microsoft font shipped around that time, ie. windows XP-ish? -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=iin26ZecN5&a=cc_unsubscribe

Red Hat Bugzilla

Thursday, 26 November Thu, 26 Nov

2:59 a.m.

New subject: [Bug 1284215] Possible copyright violation with the Myanmar3 unicode font

https://bugzilla.redhat.com/show_bug.cgi?id=1284215 Tim Waugh <twaugh(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Group| |redhat -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=KYG7sRfQye&a=cc_unsubscribe

Red Hat Bugzilla

4:12 a.m.

New subject: [Bug 1284215] Possible copyright violation with the Myanmar3 unicode font

https://bugzilla.redhat.com/show_bug.cgi?id=1284215 Pravin Satpute <psatpute(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tcallawa(a)redhat.com --- Comment #5 from Pravin Satpute <psatpute(a)redhat.com> --- Normal practice from font designer to edit existing font and draw new shapes on it and then rebuild/regenerate new ttf. I doubt in this case, designer might have edited Windows font and worked on it and while end missed updating digital signature. Problem in this case, upstream looks dead. I dont know other way to verify. Anyone else can help here? Just gone through Fedora comps. This font is optional for installation. If we decide to drop, we can do it safely. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=RtGY5ffCmh&a=cc_unsubscribe

Red Hat Bugzilla

7:13 a.m.

New subject: [Bug 1284215] Possible copyright violation with the Myanmar3 unicode font

https://bugzilla.redhat.com/show_bug.cgi?id=1284215 --- Comment #6 from Hin-Tak Leung <htl10(a)users.sourceforge.net> --- Yes, I suspect the font designer started out with an existing microsoft font and added glyphs, etc, then re-branded the font as his/her own. The digital signature serves no purpose in the open-source world, and until quite recently (weeks) no open tool can generate or check it. To make one or check one you need windows. I am trying to read the signing timestamp at the moment - and is hitting a mono bug (or rather, mono's implementation of some dotnet security related API is incomplete...) but I am making slow progress with dotnet under wine. When I am done, I might be able to identify *when* exactly microsoft signed it. ATM, the signing certificate indicates it is around 2002-2003. If I get a precise timestamp, there is a better chance of identifying the original font from which the signature came from. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=maFDNALWxw&a=cc_unsubscribe

Red Hat Bugzilla

11:21 p.m.

New subject: [Bug 1284215] Possible copyright violation with the Myanmar3 unicode font

https://bugzilla.redhat.com/show_bug.cgi?id=1284215 --- Comment #7 from Pravin Satpute <psatpute(a)redhat.com> --- Here Copyright shows: Copyright (c) Myanmar NLP, 2005. and Version: 3.00 January 25, 2007 Searching on net gives me some more links: 1. https://code.google.com/p/zawgyi/downloads/detail?name=mm3.ttf Not able to get email id of owner, he can provide more information. Waiting for response from Fedora legal in meanwhile. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=81km5LCrp5&a=cc_unsubscribe

Red Hat Bugzilla

11:35 p.m.

New subject: [Bug 1284215] Possible copyright violation with the Myanmar3 unicode font

https://bugzilla.redhat.com/show_bug.cgi?id=1284215 --- Comment #8 from Hin-Tak Leung <htl10(a)users.sourceforge.net> --- A rather difficult to read part of the digital signature contains an oid 1.3.6.1.4.1.311.2.1.12 (SPC_SP_OPUS_INFO_OBJID), which contains the string 'Times New Roman Version 3.00'. Windows 8.1's is FontName="Times New Roman" FontVersion="Version 6.85" FontDate="18/07/2013" I have 3 other versions of times I have gathered over the years as: Version 5.05 2008-2010 - win 7 ? Version 2.96 2001-2002 - win 2k3 ? Version 2.82 2000-2001 - win 98/2k ? The 'Times New Roman Version 3.00' is likely correct - and the english glyphs in the Myanmar3 font looks like Times' too. So it looks like the font is created from times, deleting most of the glyphs with diacritics and keeping the ascii ones, and adding a hundred or so of new glyphs. Need to find exactly version 3.00 of Times to be sure; unless somebody wants to compare glyph-level data of Version 2.96 of Times with the Myanmar3 font. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Gh1ojcUexM&a=cc_unsubscribe

Red Hat Bugzilla

11:57 p.m.

New subject: [Bug 1284215] Possible copyright violation with the Myanmar3 unicode font

https://bugzilla.redhat.com/show_bug.cgi?id=1284215 --- Comment #9 from Hin-Tak Leung <htl10(a)users.sourceforge.net> --- (sigh...) these people seem to specialise in copyright violation... The same part of the digital signature of https://code.google.com/p/zawgyi/downloads/detail?name=Myanmar1.ttf contains 'Tahoma Font Version 3.14 for XP SP2' !! -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Qk31S4JSgp&a=cc_unsubscribe

Red Hat Bugzilla

Friday, 27 November Fri, 27 Nov

12:10 a.m.

New subject: [Bug 1284215] Possible copyright violation with the Myanmar3 unicode font

https://bugzilla.redhat.com/show_bug.cgi?id=1284215 --- Comment #10 from Hin-Tak Leung <htl10(a)users.sourceforge.net> --- https://code.google.com/p/zawgyi/downloads/detail?name=ZawgyiOne2008.ttf has and identical digital signature as https://code.google.com/p/zawgyi/downloads/detail?name=Myanmar1.ttf I am pretty sure 'XP SP2' means 'Windows XP SP2'... Interestingly, https://code.google.com/p/zawgyi/downloads/detail?name=ZawgyiOne2008.ttf still mentions Tohama and Microsoft in the name table (ftdump -n ), but https://code.google.com/p/zawgyi/downloads/detail?name=Myanmar1.ttf no longer does, and claims to be LGPL. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=n9JSd6VGzi&a=cc_unsubscribe

Red Hat Bugzilla

12:21 a.m.

New subject: [Bug 1284215] Possible copyright violation with the Myanmar3 unicode font

https://bugzilla.redhat.com/show_bug.cgi?id=1284215 --- Comment #11 from Hin-Tak Leung <htl10(a)users.sourceforge.net> --- ZawgyiOne2008.ttf looks like Tahoma, Myanmar1.ttf does not. So one might says Myanmar1.ttf just contains the digital signature by mistake. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=x6JGLgn4W3&a=cc_unsubscribe

Red Hat Bugzilla

Monday, 30 November Mon, 30 Nov

11:07 a.m.

New subject: [Bug 1284215] Possible copyright violation with the Myanmar3 unicode font

https://bugzilla.redhat.com/show_bug.cgi?id=1284215 --- Comment #12 from Tom "spot" Callaway <tcallawa(a)redhat.com> --- Unless this leaves us without useful fonts for this language, I'd rather just remove this font package. There seems to be sufficient evidence that the font is derived from a proprietary Microsoft font. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=9ziESHpJFv&a=cc_unsubscribe

Red Hat Bugzilla

6:56 p.m.

New subject: [Bug 1284215] Possible copyright violation with the Myanmar3 unicode font

https://bugzilla.redhat.com/show_bug.cgi?id=1284215 --- Comment #13 from Hin-Tak Leung <htl10(a)users.sourceforge.net> --- The mm3.ttf font contains these two in the SPC_SP_OPUS_INFO_OBJID field in the digital signature: 00000000 80 42 00 54 00 69 00 6D 00 65 00 73 00 20 00 4E .B.T.i.m.e.s. .N 00000010 00 65 00 77 00 20 00 52 00 6F 00 6D 00 61 00 6E .e.w. .R.o.m.a.n 00000020 00 20 00 46 00 6F 00 6E 00 74 00 20 00 56 00 65 . .F.o.n.t. .V.e 00000030 00 72 00 73 00 69 00 6F 00 6E 00 20 00 33 00 2E .r.s.i.o.n. .3.. 00000040 00 30 00 30 .0.0 00000000 80 24 68 74 74 70 3A 2F 2F 77 77 77 2E 6D 69 63 .$http://www.mic 00000010 72 6F 73 6F 66 74 2E 63 6F 6D 2F 74 79 70 6F 67 rosoft.com/typog 00000020 72 61 70 68 79 20 raphy and Signing Time: 18/10/2002 21:17:23 Myanmar1.ttf contains 00000000 80 46 00 54 00 61 00 68 00 6F 00 6D 00 61 00 20 .F.T.a.h.o.m.a. 00000010 00 46 00 6F 00 6E 00 74 00 20 00 56 00 65 00 72 .F.o.n.t. .V.e.r 00000020 00 73 00 69 00 6F 00 6E 00 20 00 33 00 2E 00 31 .s.i.o.n. .3...1 00000030 00 34 00 20 00 66 00 6F 00 72 00 20 00 58 00 50 .4. .f.o.r. .X.P 00000040 00 20 00 53 00 50 00 32 . .S.P.2 00000000 80 24 68 74 74 70 3A 2F 2F 77 77 77 2E 6D 69 63 .$http://www.mic 00000010 72 6F 73 6F 66 74 2E 63 6F 6D 2F 74 79 70 6F 67 rosoft.com/typog 00000020 72 61 70 68 79 20 raphy and Signing Time: 17/06/2004 23:11:10 (The XX part of '80 XX" is simply the length - 80 is a tag for general free-format data). /usr/share/fonts/google-noto/NotoSansMyanmar-Regular.ttf from google-noto-sans-myanmar-fonts package seems to cover the same language. I agree that given the doubt, and that there seems to be another font which provides for the same language (somebody please check this), it is perhaps best to remove this font package. Times and Tahoma on win 8.1 contains this in the first field: 00000000 80 28 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F .(.M.i.c.r.o.s.o 00000010 00 66 00 74 00 20 00 54 00 79 00 70 00 6F 00 67 .f.t. .T.y.p.o.g 00000020 00 72 00 61 00 70 00 68 00 79 .r.a.p.h.y On win 7, Times and Tahoma have just the font names: 00000000 80 1C 00 54 00 61 00 68 00 6F 00 6D 00 61 00 20 ...T.a.h.o.m.a. 00000010 00 52 00 65 00 67 00 75 00 6C 00 61 00 72 .R.e.g.u.l.a.r 00000000 80 1E 00 54 00 69 00 6D 00 65 00 73 00 20 00 4E ...T.i.m.e.s. .N 00000010 00 65 00 77 00 20 00 52 00 6F 00 6D 00 61 00 6E .e.w. .R.o.m.a.n The win 98 era version s I found have these: 00000000 80 38 00 54 00 69 00 6D 00 65 00 73 00 20 00 4E .8.T.i.m.e.s. .N 00000010 00 65 00 77 00 20 00 52 00 6F 00 6D 00 61 00 6E .e.w. .R.o.m.a.n 00000020 00 20 00 52 00 65 00 67 00 75 00 6C 00 61 00 72 . .R.e.g.u.l.a.r 00000030 00 20 00 46 00 6F 00 6E 00 74 . .F.o.n.t 00000000 80 16 00 54 00 61 00 68 00 6F 00 6D 00 61 00 20 ...T.a.h.o.m.a. 00000010 00 66 00 6F 00 6E 00 74 .f.o.n.t The 2nd field of the earlier fonts also have this instead of the typography url: 00000000 80 22 68 74 74 70 3A 2F 2F 77 77 77 2E 6D 69 63 ."http://www.mic 00000010 72 6F 73 6F 66 74 2E 63 6F 6D 2F 74 72 75 65 74 rosoft.com/truet 00000020 79 70 65 2F ype/ I looked at a few Adobe signed fonts that came with Acrobat Reader, and it just have one field there, which contains "www.adobe.com". So usage of that field is not by any means formalized, but it is quite clear they contain vendor info. You don't need specialist tool - just doing $ strings /usr/share/fonts/myanmar3-unicode/mm3.ttf | grep -i microsoft | wc -l 32 i.e. the font contains 32 instances of the string "microsoft". (from the signing certificates). -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=as6YH4cPEt&a=cc_unsubscribe

Red Hat Bugzilla

Tuesday, 1 December Tue, 1 Dec

6:58 p.m.

New subject: [Bug 1284215] Possible copyright violation with the Myanmar3 unicode font

https://bugzilla.redhat.com/show_bug.cgi?id=1284215 --- Comment #14 from Hin-Tak Leung <htl10(a)users.sourceforge.net> --- Created attachment 1101213 --> https://bugzilla.redhat.com/attachment.cgi?id=1101213&action=edit very wide comparison table between 3 versions of times and the Myanmar3 font I asked around and managed to get exactly version 3.00 of Microsoft Times. Here is a very wide text table with "ttx -l" of 3 versions of Times and the Myanmar3 font. It can be seen that the Myanmar3 font has the same DSIG table as MS Times 3.00, and also identical tables of cvt, fpgm, prep with version 2.96 and 3.00 of Times. For comparison, while v 2.82 and v 2.96 of Times are similar in many ways (perhaps more so than 2.96 <-> 3.00), 2.82 have different tables of cvt, fpgm, prep . One can look at individual glyphs with: ttx -i -t glyf -o /tmp/times.glyphs.txt /tmp/times.ttf ttx -i -t glyf -o /tmp/mm3.glyphs.txt /usr/share/fonts/myanmar3-unicode/mm3.ttf Many of the glyphs (almost all ascii ones) are identical. I think it is quite certain that Myanmar3 derived from version 3.00 of Microsoft Times. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=os8WvzMpdL&a=cc_unsubscribe

Red Hat Bugzilla

Wednesday, 2 December Wed, 2 Dec

2:14 a.m.

New subject: [Bug 1284215] Possible copyright violation with the Myanmar3 unicode font

https://bugzilla.redhat.com/show_bug.cgi?id=1284215 Pravin Satpute <psatpute(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED Assignee|mvaliyav(a)redhat.com |psatpute(a)redhat.com --- Comment #15 from Pravin Satpute <psatpute(a)redhat.com> --- Thanks Hin-Tak for detailed comparison. Since we have not got any response from upstream we will disable this package from Fedora. Dont know should we simply follow package retirement process mentioning this bug in reference. https://fedoraproject.org/wiki/How_to_remove_a_package_at_end_of_life Or There is any other process documented from legal? Note: I took over this bug. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=3zXrhRdlUt&a=cc_unsubscribe

Red Hat Bugzilla

3:35 a.m.

New subject: [Bug 1284215] Possible copyright violation with the Myanmar3 unicode font

https://bugzilla.redhat.com/show_bug.cgi?id=1284215 --- Comment #16 from Pravin Satpute <psatpute(a)redhat.com> --- (In reply to Tom "spot" Callaway from comment #12)

...

Unless this leaves us without useful fonts for this language, I'd rather just remove this font package. There seems to be sufficient evidence that the font is derived from a proprietary Microsoft font.

Sure, will do it this week. Thanks :) -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=bCXZkLlVGx&a=cc_unsubscribe

Red Hat Bugzilla

Thursday, 3 December Thu, 3 Dec

12:46 a.m.

New subject: [Bug 1284215] Possible copyright violation with the Myanmar3 unicode font

https://bugzilla.redhat.com/show_bug.cgi?id=1284215 Pravin Satpute <psatpute(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |CLOSED Resolution|--- |CURRENTRELEASE Last Closed| |2015-12-03 01:46:12 --- Comment #17 from Pravin Satpute <psatpute(a)redhat.com> --- Package is retired and blocked now. Thanks Hin-Tak for your valuable inputs. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=g4pHg4HnN9&a=cc_unsubscribe

3077

days inactive

3088

days old

fonts-bugs@lists.fedoraproject.org

Manage subscription

18 comments

1 participants

tags (0)

participants (1)

Red Hat Bugzilla

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

[Bug 1284215] New: Possible copyright violation with the Myanmar3 unicode font