#1029845 harfbuzz: non-distributable font included in source

Package:
src:harfbuzz
Source:
src:harfbuzz
Submitter:
Andres Salomon
Date:
2023-02-01 20:45:05 UTC
Severity:
normal
#1029845#5
Date:
2023-01-28 18:05:01 UTC
From:
To:
Harfbuzz includes a nondistributable font in its test suite. I thought
it was just in sid/bookworm, but it's apparently also in bullseye as
well.

In bullseye:
test/shaping/data/in-house/fonts/641ca9d7808b01cafa9a666c13811c9b56eb9c52.ttf

In sid:
test/shape/data/in-house/fonts/641ca9d7808b01cafa9a666c13811c9b56eb9c52.ttf


dilinger@hm90:~/sid-build/harfbuzz2$ exiftool -Copyright-en-US
test/shape/data/in-house/fonts/641ca9d7808b01cafa9a666c13811c9b56eb9c52.ttf
Copyright (en-US)               : The digitally signed machine readable
Typeface(Font) licensed to you is copyrighted ©, (2010), King Fahd
Glorious Quran Printing Complex...ISBN: 978-603-8010-15-0, Accession
No. 1430/7278..All rights reserved. This Font is the property of King
Fahd Glorious Quran Printing Complex, and may not be reproduced,
modified without the express written approval of King Fahd Glorious
Quran Printing Complex.


Upstream has removed the font, and Debian should as well:
https://github.com/harfbuzz/harfbuzz/issues/4059
#1029845#12
Date:
2023-01-31 21:24:29 UTC
From:
To:
Potentially relevant context:

 - https://github.com/flutter/flutter/issues/16886
 - https://lists.debian.org/debian-legal/2011/05/msg00005.html
#1029845#17
Date:
2023-01-31 21:34:41 UTC
From:
To:
Based on the previous: I think that the font was probably accidentally
committed to source control while testing a fix for the issue reported on
GitHub - and so following upstream's removal of the font seems to make sense,
given that there doesn't appear to be any explicit public permission provided
by the owner/successors of the license on the Debian mailing lists.
#1029845#24
Date:
2023-02-01 08:47:03 UTC
From:
To:
Hi Security Team & Jeremy,

I had originally planned to ask the release team about fixing #1029845
(the bug below) in bullseye via t-p-u. However, it would appear that
there's also an outstanding security bug in harfbuzz (CVE-2022-33068,
tracked at #1013673). So instead, maybe it's better if we group the
font removal and the security fix together and upload something like
what I've attached (a debdiff against 2.7.4-1) to bullseye-security.
What do folks think?

Jeremy, I created a bullseye branch over in my repo at
https://salsa.debian.org/dilinger/harfbuzz/-/commits/bullseye
Based on what's decided, I can adjust it and do a MR to whatever your
preferred branch name is.



On Sat, 28 Jan 2023 13:05:01 -0500 Andres Salomon <dilinger@queued.net>  wrote:
 > Source: harfbuzz
 > Severity: serious
 > Version: 6.0.0-1
 > Justification: Policy 2.1
 >
 > Harfbuzz includes a nondistributable font in its test suite. I
thought
 > it was just in sid/bookworm, but it's apparently also in bullseye as
 > well.
 >
 > In bullseye:
 >
test/shaping/data/in-house/fonts/641ca9d7808b01cafa9a666c13811c9b56eb9c52.ttf
 >
 > In sid:
 >
test/shape/data/in-house/fonts/641ca9d7808b01cafa9a666c13811c9b56eb9c52.ttf
 >
 >
 > dilinger@hm90:~/sid-build/harfbuzz2$ exiftool -Copyright-en-US
 >
test/shape/data/in-house/fonts/641ca9d7808b01cafa9a666c13811c9b56eb9c52.ttf
 > Copyright (en-US)               : The digitally signed machine
readable
 > Typeface(Font) licensed to you is copyrighted ©, (2010), King Fahd
 > Glorious Quran Printing Complex...ISBN: 978-603-8010-15-0, Accession
 > No. 1430/7278..All rights reserved. This Font is the property of King
 > Fahd Glorious Quran Printing Complex, and may not be reproduced,
 > modified without the express written approval of King Fahd Glorious
 > Quran Printing Complex.
 >
 >
 > Upstream has removed the font, and Debian should as well:
 > https://github.com/harfbuzz/harfbuzz/issues/4059
 >
 >
 >
 >
 >
#1029845#29
Date:
2023-02-01 09:09:15 UTC
From:
To:
Can you also include this change to fix a compiler warning on that security fix?

https://github.com/harfbuzz/harfbuzz/commit/e421613e8f825508afa9a0b54d33085557c37441

Cheers,
Emilio
#1029845#34
Date:
2023-02-01 09:16:25 UTC
From:
To:
On Wed, Feb 1 2023 at 10:09:15 AM +0100, Emilio Pozuelo Monfort <pochu@debian.org> wrote:


Thanks, good catch. It's in
https://salsa.debian.org/dilinger/harfbuzz/-/commit/d091e7184675da712b8bb308cf7c11f45d77011f
 now.
#1029845#39
Date:
2023-02-01 20:41:27 UTC
From:
To:
Hi Andres,

Note that CVE-2022-33068 is no-dsa, so the security fix can just be
batched in in the bullseye-pu update and fixed in the next point
release.

Regards,
Salvatore