Re: Guidance Needed on Licensing for a Debian Package

Soren Stoutner <[email protected]> Tue, 11 Mar 2025 17:06:14 -0700
Newsgroups	gmane.linux.debian.devel.legal
Organization	Debian
Message-ID	<4033989.qgXdJBQaxk@soren-desktop>
On Tuesday, March 11, 2025 7:11:25 AM MST Raul G wrote:
> Hi all,
> Thank you so much for your input. I have reviewed the aspects previously
> mentioned, and the updated version of the debian/copyright file is now
> available at the following link:   https://paste.debian.net/1362476/
> 
> This new version has been modified to remove incompatible fonts  and group all
> remaining fonts by license type.  
> 
> ---
> 
> Additionally, Soren Stoutner pointed out an important detail regarding
> OFL-licensed fonts that have a Reserved Font Name (RFN). My question is:   -
> Is it necessary to explicitly mention each font's Reserved Font Name in the
> OFL license section, or is a general mention of RFNs sufficient?

Each reserved name must be mentioned explicitly stating who has reserved it.  However, 
you could list of group of fonts with reserved names by different companies in one stanza 
with a comment explaining each of the reserved names underneath.

Or, you could choose to have a separate stanza for each for each font with a reserved 
name.  It is up to you.

> Lastly, I would appreciate further assistance regarding the following
> guideline:  
> > Build the font from source using tools from Debian main during the package
> > build but distribute the upstream build in the binary package instead. In
> > this case, it is not required to move the font to contrib. 
> Any clarification on this point would be greatly appreciated.  

When shipping fonts in main, you can’t ship the binary files provided by upstream.  You 
have to build them from source yourself during the package build.

However, OFL fonts with reserved names create a tricky problem in this regard.  The 
license states that "No Modified Version of the Font Software may use the Reserved Font 
Name”.  It allows you to make and distribute modified versions of the font as long as you 
change the name.  But if you want to use the name, you may only distribute unmodified 
versions of the fonts.

(By the way, this exists in the license so that a company like Adobe, which cares very much 
about a document containing one of their fonts laying out precisely on every computer in 
the world, can guarantee that someone cannot distribute one of their fonts that has even 
a slight variation in kerning or layout causing something like a change in the the line 
breaks in a document containing that font.)

The question then becomes, how do you determine that the copy of the font you build 
isn’t a “modified version” of the binary font distributed upstream?  If the fonts are bitwise 
identical, then that is an easy determination.  But, in many cases, when you build a font 
from source, it will not be bitwise identical to the copy distributed upstream.

Some of these variations don’t matter and probably don’t rise to the level of a “modified 
version”.  But it can be hard to guarantee that.

In the case of fonts-adobe-sourcesans3, it is built using AFDKO (Adobe Font Development 
Kit for OpenType).  Different versions of the AFDKO produce slightly bitwise different font 
binaries.  Because the AFDKO in Debian changes over time, even if the build I upload to 
unstable is bitwise identical to the upstream binary fonts, it isn’t guaranteed to stay that 
way if the package is rebuilt in the future.

There are several ways to deal with this in Debian, as described on the wiki.

https://wiki.debian.org/Fonts

One of them is:

"Build the font from source using tools from Debian main during the package build but 
distribute the upstream build in the binary package instead. In this case it is not required 
to move the font to contrib.”

This is a compromise position, not the ideal.  It is the course I followed with fonts-adobe-
sourcesans3.  It proves that the font can be built from the source, but it then distributes 
the upstream binary font to comply with the reserved name.

In the case of fonts-adobe-sourcesans3 I included simple instructions for how someone 
could modify the source package to keep the fonts generated at build time, making it easy 
for someone to verify that the fonts built by the package are substantively the same as the 
fonts distributed upstream.https://

salsa.debian.org/fonts-team/fonts-adobe-sourcesans3/-/blob/master/debian/
README.Source?ref_type=heads#L44-46

https://salsa.debian.org/fonts-team/fonts-adobe-sourcesans3/-/blob/master/debian/
install?ref_type=heads

-- 
Soren Stoutner
[email protected]
signature.asc (application/pgp-signature, 833 B)