Hi Debian legal list! I'd appreciate your suggestions on how best to manage this issue that I've discovered, and a judgement call on whether it is an issue - see below. I've cc'd the current bug report.
Best wishes, Julian ----- Forwarded message from Julian Gilbey <[email protected]> ----- Date: Wed, 13 May 2026 22:27:00 +0100 From: Julian Gilbey <[email protected]> Subject: DFSG status of fonts-font-awesome (was: Re: Bug#902981: new upstream (5.1.0)) To: Bastian Germann <[email protected]>, [email protected] Cc: [email protected], Debian developers list <[email protected]> affects 902981 src:aiodogstatsd src:ataqv src:bazel-bootstrap src:debci src:ipywidgets src:kanboard src:node-webfont src:orthanc-dicomweb src:pagure src:publican src:r-cran-shiny src:r-cran-visnetwork src:scaphandre src:sphinx-rtd-theme src:igraph src:mdbook src:lcdf-typetools ataqv bepasty bornagain-doc crmsh-doc debci dpdk-doc drbd-doc ford gerbera glances-doc glbinding-doc hackrf-doc icecast2 janus-demos jupyterhub kanboard libigraph-doc liblemonldap-ng-portal-perl mitmproxy mkdocs odoo-19 openmpi-doc otrs2 pagure prewikka publican python-aiodogstatsd-doc python-aioitertools-doc python-mintpy-doc python-qtawesome-common python-sphinx-mdinclude-doc python3-ase python3-cylc python3-django-hyperkitty python3-django-postorius python3-djangorestframework python3-flask-bootstrap python3-openstackdocstheme python3-xstatic-font-awesome r-cran-bookdown r-cran-rmarkdown r-cran-shiny r-cran-visnetwork reform-desktop-full rust-doc screenkey simple-whip-server sphinx-rtd-theme-common sreview-web swappy sympa texlive-fonts-extra-links tulip webext-foxyproxy weechat-doc wims wims-lti wsjtx-doc wsjtx-improved-doc thanks [Cc-ing debian-devel as there is a question about a mass bug filing at the end of this email; please Cc the bug report in any replies.] On Mon, Mar 30, 2026 at 10:07:53PM +0200, Bastian Germann wrote: > Please note that node-fortawesome-fontawesome-free builds the > fortawesome v6 from source now. So there is a chance that we can update > this package as well. Also, in #1135180, Bastian wrote: > When you are dealing with the fonts-font-awesome package please consider all > its reverse (build) dependencies. > > You should not make it hard on other package maintainers, i.e. please do not > make them transition manually unnecessarily. Dear all readers of this bug report, [I have marked all of the packages in unstable which build-depend or depend on fonts-font-awesome as "affected" by this bug, as this may well affect you significantly.] I have just packaged fonts-font-awesome-legacy, containing DFSG-free versions of Font Awesome 5 and 6, and it has been accepted into unstable. I next intend to upgrade the fonts-font-awesome package itself to version 7.x of the font. I was looking at including version 4.7.0 of FontAwesome in the legacy package to support other packages which need this specific legacy version, without requiring maintainers to make any major changes to their packages except to (build-)depend on the legacy package rather than the fonts-font-awesome package. But I've hit a major stumbling block... To summarise most of the discussion in this bug report (#902981): FontAwesome's build system became closed-source in version 5.x, so Debian can't distribute it, and we have to stick with version 4.7.0. Therefore fonts-font-awesome was downgraded from 5.1.0 back to 4.7.0. However, looking at the source package for fonts-font-awesome (which is the upstream 4.7.0 version), I cannot find any evidence of a build system. Nor do I find any source for the icons in the GitHub repository or any build system there (looking at the 4.x branch). Indeed, the Debian package simply copies the compiled fonts (TTF, OTF and so on) into the appropriate directories under /usr. So it seems that the package as-is is actually not DFSG-free in the same way that the 5.x version isn't: there is no "source code". And 4.x is even worse than 5.x: while the SVG sources are included in the GitHub repository in version 5.1.0 upwards (first committed to the repository in June 2018), they do not appear before that, so there is no hope of making a DFSG-free build of FontAwesome 4.7.0. (The SVG sources are embedded in the SVG font, but that is not the original source of the icons.) My proposal is therefore the following: - FontAwesome 4.7.0 should be dropped from Debian completely. This is a big deal, though; over 500 packages in testing ship fontawesome-webfont.woff2 But if I've read the situation correctly, that is the direction we should be heading in, though that's far beyond my capacity to manage. See below for some further thoughts on this. - fonts-font-awesome is upgraded to version 7.x of the upstream font, in TTF and WOFF2 formats, using a home-grown DFSG-free build system (courtesy of Roland Mas and Yadd, who wrote this for the node-fortawesome-fontawesome-free package); this package will no longer contain any other formats of the font, nor any CSS/LESS/JS code. - fonts-font-awesome-legacy provides versions 5 and 6 of the font in TTF and WOFF2 formats, again built in a DFSG-free way. This will resolve the DFSG-free nature of this package. Old package file layout (fonts only): /usr/share/fonts/opentype/font-awesome/FontAwesome.otf /usr/share/fonts/truetype/font-awesome/fontawesome-webfont.ttf /usr/share/fonts-font-awesome/fonts/fontawesome-webfont.eot /usr/share/fonts-font-awesome/fonts/fontawesome-webfont.svg /usr/share/fonts-font-awesome/fonts/fontawesome-webfont.woff /usr/share/fonts-font-awesome/fonts/fontawesome-webfont.woff2 Proposed new package file layout (fonts only): /usr/share/fonts/truetype/font-awesome/fa-brands-400.ttf /usr/share/fonts/truetype/font-awesome/fa-regular-400.ttf /usr/share/fonts/truetype/font-awesome/fa-solid-900.ttf /usr/share/fonts/woff/font-awesome/fa-brands-400.woff2 /usr/share/fonts/woff/font-awesome/fa-regular-400.woff2 /usr/share/fonts/woff/font-awesome/fa-solid-900.woff2 Those packages that require the JS/CSS files or SVG version of the font should migrate to using node-fortawesome-fontawesome-free which provides these. LESS files are no longer provided by upstream. If there is a pressing need for one of the other formats of version 7.x of the the font (EOT, SVG or WOFF), then I can use the fontcustom or node-webfont package to generate these. But if not, I can stick with the Python script written by Yadd and Roland as I used that before I discovered fontcustom. It would be good to upload a new version of fonts-font-awesome to experimental soon, but will wait a while before making any changes to unstable, in order to allow for a smooth transition. Further thoughts on removing FontAwesome 4.7.0 from Debian: * It seems that fonts-fork-awesome should be an almost drop-in replacement for those packages that require version 4.7.0 of FontAwesome; it provides (I believe) a superset of the icons, along with the CSS etc files. So making this change should be relatively straightforward (though a moderate amount of work). * Most of the binary packages that ship fontawesome-webfont.woff2 seem to have it as a static file in a local set of webpages. And this is presumably imported by something like sphinx-rtd-theme. So we can probably handle most of the cases by modifying just a handful of packages. Questions: (1) Have I understood the situation correctly regarding the DFSG-free nature of FontAwesome 4.7.0? (2) Should I do a mass bug filing against all of the potentially affected packages (as listed in the "affects" BTS command above) once I have uploaded fonts-font-awesome 7.x to experimental or to unstable, as many or all of them will need to make changes to either migrate to ForkAwesome or to accommodate the new structure of FontAwesome 7.x? Best wishes, Julian ----- End forwarded message -----
