Aman-Mittal opened a new issue, #362: URL: https://github.com/apache/fineract-backoffice-ui/issues/362
`src/index.html` loads Inter from `fonts.googleapis.com`: ```html <link rel="preconnect" href="https://fonts.googleapis.com"; /> <link rel="preconnect" href="https://fonts.gstatic.com"; crossorigin /> <link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&display=swap"; rel="stylesheet" /> ``` Three separate problems follow from those three lines, in increasing order of how long each went unnoticed. None is a licensing violation — nothing is redistributed today — but together they affect release readiness. ## 1. The production build cannot run without internet access Angular's font-inlining optimisation fetches that stylesheet during a production build and inlines the `@font-face` rules. When the host is unreachable the build does not degrade, it fails outright: ``` ✘ Building... [FAILED: Inlining of fonts failed. An error has occurred while retrieving https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&display=swap over the internet.] ``` Reproduce, with dependencies already installed so only the build's own network use is under test: ```bash npm ci unshare -rn npx ng build --configuration production # exit 1 ``` An ASF release is expected to be buildable from its source package. A verifier working from the tarball without network access — or after Google changes the endpoint — cannot reproduce the artifact. The failure also removes the previous `dist/` before aborting. ## 2. The fetched bytes are not pinned Every other dependency is locked by integrity hash in `package-lock.json`. A `css2?family=Inter:wght@…` URL pins nothing: no version, no checksum. Google may serve a different build tomorrow, or vary the response by request `User-Agent`, and two builds of the same commit would embed different bytes with nothing recording the difference. This is arguably worse than problem 1, because it is silent. The build succeeds either way. ## 3. The font never actually loads in our own container `deploy/nginx.conf` sets: ``` font-src 'self' data: ``` The built page asks the browser for the binaries from `fonts.gstatic.com`, which is not `'self'`. Measured in Chrome against an image built from `deploy/Dockerfile`, behind that exact policy: - 35 requests to `fonts.gstatic.com`, **all blocked** - 35 console errors: `Loading the font '…' violates the following Content Security Policy directive: "font-src 'self' data:"` - `document.fonts.check('16px Inter')` returns `false` The deployed UI has been rendering in the `-apple-system / Segoe UI / Roboto / sans-serif` fallback stack the entire time. The CSP is correct; the external font is what does not fit it. ## Secondary considerations - **Privacy.** Where the CSP does permit it, every user's browser discloses its IP address, `User-Agent` and `Accept-Language` to a third party — for a back-office banking application whose users are a financial institution's staff. `Referrer-Policy: no-referrer` already limits what else leaks. Not a vulnerability; a deployment consideration an institution may have to answer for. - **Offline and restricted deployments.** Air-gapped installations are a normal deployment mode for core banking, and corporate networks that block Google endpoints degrade silently. - **CSP.** Keeping the external font would mean *widening* `font-src` and `style-src` to admit two Google origins, weakening a policy otherwise configured deliberately. ## Options 1. **Remove the webfont** and declare the system UI font stack explicitly. Zero licensing surface, zero bytes shipped, and — per problem 3 — no visible change for anyone using the container image. 2. **Self-host Inter** from a pinned npm package. Preserves the design intent, but Inter is SIL OFL 1.1, which ASF policy treats as [Category B](https://www.apache.org/legal/resolved.html) — admissible in binary form in a convenience binary when labelled, *not* admissible in a source release. `CONTRIBUTING.md` already requires Category A for new runtime dependencies, and CI enforces it via `license-checker`. Workable, but it needs a licence file, a README label, a `.rat-excludes` entry, a Dockerfile change and an explicit allow-list exception. Whichever is chosen, a CI guard should stop the dependency returning silently — the source reference was one `<link>`, but the build baked it into the artifact, so the artifact needs checking too. ## Analysis Full audit with licence evidence, checksum comparisons, build results and browser measurements: `audit/GOOGLE-FONTS-ASF-AUDIT.md` (added in the linked PR). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
