[Bug 525872] New: Please rebuild using external Adobe CMap and AGLFN data

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

Summary: Please rebuild using external Adobe CMap and AGLFN data

https://bugzilla.redhat.com/show_bug.cgi?id=525872

Summary: Please rebuild using external Adobe CMap and AGLFN
                    data
           Product: Fedora
           Version: rawhide
          Platform: All
        OS/Version: Linux
            Status: NEW
          Severity: medium
          Priority: low
         Component: qt
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]
         QAContact: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail],
                    [e-mail], [e-mail]
            Blocks: 182235,473302
    Classification: Fedora

Description of problem:

The Debian fonttool packager noticed a problem in fonttool's embedded Adobe
CMap and AGLFN data and got Adobe to release them under a good license

This data is embeded in many packages, including yours

Please rebuild your package using an external shared Adobe CMap and AGLFN data
package

FE-LEGAL since this was all triggered by a legal checl Debian-side

See also
http://bonedaddy.net/pabs3/log/2009/09/24/adobe-data-freed/
http://lwn.net/Articles/354360/
http://opensource.adobe.com/wiki/display/cmap/CMap+Resources

[Bug 525872] Please rebuild using external Adobe CMap and AGLFN data

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=525872

--- Comment #1 from Kevin Kofler   2009-09-26 10:47:44 EDT ---
As for the font bugs, it would be great if these bug reports included a list of
the offending files in the specific package. You obviously must have scanned
the packages for offending files to know they're affected, so it shouldn't be
too hard to come up with such a list and it'd make it much easier to fix the
issue and to be sure we fixed it completely.

[Bug 525872] Please rebuild using external Adobe CMap and AGLFN data

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=525872

--- Comment #2 from Kevin Kofler   2009-09-26 11:09:55 EDT ---
Oh, and did you scan the source package or the binary package? The source
package includes copies of some third-party libraries like freetype which we
don't ship (we build Qt against the system freetype).

[Bug 525872] Please rebuild using external Adobe CMap and AGLFN data

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=525872

--- Comment #3 from Nicolas Mailhot   2009-09-26 11:38:51 EDT ---
At this stage, I just relied on the google searches pabs linked to
So maybe they're not accurate in this case

[Bug 525872] Please rebuild using external Adobe CMap and AGLFN data

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=525872

--- Comment #4 from Nicolas Mailhot   2009-09-26 11:41:10 EDT ---
The keywords he used are:
— aglfn.txt
— aglfn13.txt
— glyphlist.txt
— afii64937

[Bug 525872] Please rebuild using external Adobe CMap and AGLFN data

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=525872

Rex Dieter  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|                            |NOTABUG

--- Comment #5 from Rex Dieter   2009-09-26 12:03:41 EDT ---
confirmed hits on
src/3rdparty/freetype
only, which we don't use.

[Bug 525872] Please rebuild using external Adobe CMap and AGLFN data

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=525872

--- Comment #6 from Kevin Kofler   2009-09-26 12:06:23 EDT ---
I get several hits in src/3rdparty/freetype, which isn't really a problem for
Qt as we don't ship its copy of freetype, but I guess you'll want to file a bug
against freetype (and I'll clone the fix into freetype-freeworld as soon as
freetype has it fixed).

There's also a hit for afii64937 inside src/gui/text/qfontsubset.cpp in the
static const char * const agl array. That array appears to contain a processed
copy of the data with no Adobe copyright notice. What should I do with it? Add
a copy of the new copyright notice and the BSD license in a patch? (I guess
it'll also need to show up somewhere in "supporting documentation" to really
comply with the license and to actually make sense to patch for.)

[Bug 525872] Please rebuild using external Adobe CMap and AGLFN data

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=525872

Kevin Kofler  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |Reopened
             Status|CLOSED                      |ASSIGNED
         Resolution|NOTABUG                     |

[Bug 525872] Please rebuild using external Adobe CMap and AGLFN data

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=525872

--- Comment #7 from Nicolas Mailhot   2009-09-26 12:13:04 EDT ---
(In reply to comment #1)
> As for the font bugs, it would be great if these bug reports included a list of
> the offending files in the specific package

Well for reports like
http://www.redhat.com/archives/fedora-fonts-list/2009-September/msg00005.htm...

it just can't be done there is too much data collected, I tried to post it the
first time and the lists refused to let the attached data pass (too big)

However it is always possible to ask me in PM for the data, or to run the test
yourself. It takes a simple bog-standard repo as argument, so if you don't want
to wait for a full rawhide run, just put the packages you're interested in a
dir, run createrepo on it, and point repo-font-audit there

(the current version only understands http:// and ftp:// URIs, I'm testing a
version that works with file:// too. Will probably publish it today)

[Bug 525872] Please rebuild using external Adobe CMap and AGLFN data

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=525872

--- Comment #8 from Kevin Kofler   2009-09-26 12:16:27 EDT ---
That said, I'm not sure whether that list in qfontsubset.cpp is copyrightable
at all, especially given that it is not even presented in the same format.

[Bug 525872] Please rebuild using external Adobe CMap and AGLFN data

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=525872

--- Comment #9 from Nicolas Mailhot   2009-09-26 12:18:17 EDT ---
(In reply to comment #6)
> I get several hits in src/3rdparty/freetype, which isn't really a problem for
> Qt as we don't ship its copy of freetype, but I guess you'll want to file a bug
> against freetype (and I'll clone the fix into freetype-freeworld as soon as
> freetype has it fixed).

Yes. I'm also thinking of pointing Spot to this mess, as those files seems
duplicated pretty much everywhere, and this is the kind of cleanup op he did
before
> There's also a hit for afii64937 inside src/gui/text/qfontsubset.cpp in the
> static const char * const agl array. That array appears to contain a processed
> copy of the data with no Adobe copyright notice. What should I do with it? Add
> a copy of the new copyright notice and the BSD license in a patch? (I guess
> it'll also need to show up somewhere in "supporting documentation" to really
> comply with the license and to actually make sense to patch for.)

I suppose the clean solution would be to make it process a canonical copy of
the data at build time (that will make the licensing appear in rpm deps checks,
and make sure QT uses the same values as others). Dunno about the licensing
patch. To be honest my primary interest is to make sure all our software uses
the same values, and the legal angle is just here to make people interested

[Bug 525872] Please rebuild using external Adobe CMap and AGLFN data

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=525872

--- Comment #10 from Nicolas Mailhot   2009-09-26 17:39:12 EDT ---
(In reply to comment #1)
> As for the font bugs, it would be great if these bug reports included a list of
> the offending files in the specific package.

If you see a way to improve this
http://www.redhat.com/archives/fedora-fonts-list/2009-September/msg00031.htm...
while staying within list limitations (size limit, wrapping, plain text) please
say how

[Bug 525872] Please rebuild using external Adobe CMap and AGLFN data

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=525872

Tom "spot" Callaway  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #11 from Tom "spot" Callaway   2009-11-30 17:35:28 EDT ---
Is the relicensed CMAP/AGLFN data identical to the data inside this code?

At a minimum, a bug should be opened with upstream QT (and freetype) to have
their local copies updated to the newer licensed versions.

[Bug 525872] Please rebuild using external Adobe CMap and AGLFN data

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=525872

--- Comment #13 from Bug Zapper  2011-06-02 13:40:16 EDT ---

This message is a reminder that Fedora 13 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 13.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '13'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 13's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 13 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

[Bug 525872] Please rebuild using external Adobe CMap and AGLFN data

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=525872

Rex Dieter  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |FutureFeature
            Version|13                          |rawhide
               Flag|needinfo?(nicolas.mailhot@l |
                   |aposte.net)                 |

--- Comment #14 from Rex Dieter  2011-06-02 14:21:28 EDT ---
rebased.

[Bug 525872] Please rebuild using external Adobe CMap and AGLFN data

https://bugzilla.redhat.com/show_bug.cgi?id=525872

Tom "spot" Callaway  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |needinfo?([e-mail]
                   |                            |)

--- Comment #15 from Tom "spot" Callaway  ---
Rex, is this still an issue?

[Bug 525872] Please rebuild using external Adobe CMap and AGLFN data

https://bugzilla.redhat.com/show_bug.cgi?id=525872

--- Comment #16 from Ngo Than  ---
Hi Tom,
the afii64937 still exists inside src/gui/text/qfontsubset.cpp in the current
qt version.

[Bug 525872] Please rebuild using external Adobe CMap and AGLFN data

https://bugzilla.redhat.com/show_bug.cgi?id=525872

Rex Dieter  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?([e-mail] |
                   |)                           |

--- Comment #17 from Rex Dieter  ---
Sounds like that's a "yes, still an issue" then.

[Bug 525872] Please rebuild using external Adobe CMap and AGLFN data

https://bugzilla.redhat.com/show_bug.cgi?id=525872

--- Comment #18 from Tom "spot" Callaway  ---
Okay, so here's the situation.

In qtbase-everywhere-src-5.11.2/src/gui/text/qfontsubset_agl.cpp, there are
copies of data taken from the https://github.com/adobe-type-tools/agl-aglfn.

That data is identical to the data in the 1.7 version of the AGLFN. That data
is BSD licensed.

Thus, I do not believe any code change is necessary here (and the qt upstream
has already rejected a bug to move to reading in this data externally, since
this source code is already generated from the AGLFN txt file).

It would be appropriate for qfontsubset_agl.cpp to add a BSD license notice to
reflect the use of the AGLFN (and probably in a separate license file).

I've opened an upstream bug on this here:

https://bugreports.qt.io/browse/QTBUG-70968

In the interim, the fix for Fedora is to include a copy of the AGLFN license in
qt5-qtbase (as %license). I will include that file for you here.

[Bug 525872] Please rebuild using external Adobe CMap and AGLFN data

https://bugzilla.redhat.com/show_bug.cgi?id=525872

--- Comment #19 from Tom "spot" Callaway  ---
Created attachment 1490899
  --> https://bugzilla.redhat.com/attachment.cgi?id=1490899&action=edit
license text for AGLFN

[Bug 525872] Please rebuild using external Adobe CMap and AGLFN data

https://bugzilla.redhat.com/show_bug.cgi?id=525872

Tom "spot" Callaway  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
    External Bug ID|                            |Qt Bug Tracker QTBUG-70968