Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Licenses for default embedded fonts not included in epaint crate license #2321

Closed
repi opened this issue Nov 19, 2022 · 5 comments · Fixed by #4853
Closed

Licenses for default embedded fonts not included in epaint crate license #2321

repi opened this issue Nov 19, 2022 · 5 comments · Fixed by #4853
Labels
bug Something is broken

Comments

@repi
Copy link

repi commented Nov 19, 2022 •
edited
Loading

The epaint crate uses license MIT OR Apache-2.0 but when one uses it with the default features or the default_fonts features a set of default fonts are embedded in the binary that have additional licenses.

This makes it so tools like cargo-deny (license compliance) and cargo-about (license attribution) can't see and validate/include the required licenses.

These are the licenses used for the default fonts:

  • ✔️ fonts/emoji-icon-font.ttf - license: MIT
  • ✔️ fonts/Hack-Regular.ttf - license: MIT
  • ❌ fonts/NotoEmoji-Regular.ttf - license: OFL-1.1
  • ❌ fonts/Ubuntu-Light.ttf - license: "UBUNTU FONT LICENSE 1.0"
    • haven't found an SPDX identifier for this in the spec
    • so maybe we have make up our own (SPDX supports it)? like LicenseRef-UFL-1.0.
    • what do you think @Jake-Shadle ?

So to be fully correct in the license definition of the epaint crate I believe we would have to specify to license as:

(MIT OR Apache-2.0) AND OFL-1.1 AND LicenseRef-UFL-1.0.

A recent and good previous example for another crate was dtolnay/unicode-ident#9.

A drawback of that however would be that if you use the crate with default-features = false and not with features = ["default_fonts"] tools wouldn't know that these licenses are then not required.

So believe the most clean solution for everyone would be to split out the default fonts into a separate crate (like epaint-default-fonts) that has this full license, a crate that just does include_bytes! on the fonts and exposes global variable with them. And then in epaint we can keep MIT OR Apache-2.0 license and include the epaint-default-fonts optionally in that.

Tools like cargo-deny and cargo-about would fully understand this and then only require that the OFL-1.1 and LicenseRef-UFL-1.0 are on the allow list if the optional default fonts are included.

What do you think about such an approach @emilk ?
@repi repi added the bug Something is broken label Nov 19, 2022
@repi repi mentioned this issue Nov 19, 2022
Merged
repi added a commit to EmbarkStudios/rust-ecosystem that referenced this issue Nov 19, 2022
@repi
Audit egui crates (#90)
80e11f5 
Yes I did actually manually (lightly) audit all these crates by opening up the exact versions and looking for `unsafe` usage (none found!), dependencies, ambient capabilities through std/core, and such. 

And looks good! reviewing large Rust crates is not that hard when not using any such features 💯  Thanks @emilk 😃 

Did find one under specified license though in `epaint` that I've stubbed out as a violation here
- Filed: emilk/egui#2321
- Once this is resolved later we can enable the violation so previous versions will fail to be audited due to it. But can't do it yet because would fail `cargo vet` in our projects.

Part of:
- https://github.com/EmbarkStudios/ark/issues/6167
- https://github.com/EmbarkStudios/ark/issues/7090
@emilk emilk mentioned this issue Nov 21, 2022
Merged
@emilk
Copy link
Owner

emilk commented Nov 21, 2022

Thanks for taking a look at this and opening an issue!

I agree that the clean solution is desirable, but also more complicated, so maybe I'll start with the simple solution.

@repi
Copy link
Author

repi commented Nov 21, 2022

sounds good!

repi added a commit to EmbarkStudios/rust-ecosystem that referenced this issue May 26, 2023
@repi
Remove old epaint audit as license is wrong
98f77c3 
In versions 0.19.0 and before the license was not including embedded static resources.

This was tracked in emilk/egui#2321 and resolved in 0.20.0.
@GunnarMorrigan
Copy link

GunnarMorrigan commented Feb 27, 2024 •
edited
Loading

Link to the ubuntu font license 404s
Please correct me if wrong, but I assume this is it:
https://ubuntu.com/legal/font-licence

@TheButlah
Copy link

Also just hit this - I think a separate crate for the fonts would be the right way to go

@emilk
Copy link
Owner

emilk commented Jun 23, 2024

You wanna make a PR for that? epaint_default_fonts makes sense imho. Maybe we should version and publish it separately from the other crates, though that's slightly more annoying. But releasing a new version of it every time we release a new egui seems wasteful, when the default fonts rarely change.

alex-pinkus pushed a commit to alex-pinkus/egui that referenced this issue Jul 20, 2024
Migrate default fonts to a new crate
2606b9a 
This allows license checking tools to omit the OFL and UFL licenses when
`default_fonts` are turned off.

Fixes emilk#2321
@alex-pinkus alex-pinkus mentioned this issue Jul 20, 2024
Merged
1 task
alex-pinkus pushed a commit to alex-pinkus/egui that referenced this issue Jul 20, 2024
Migrate default fonts to a new crate
7046a7b 
This allows license checking tools to omit the OFL and UFL licenses when
`default_fonts` are turned off.

Fixes emilk#2321
emilk pushed a commit that referenced this issue Jul 31, 2024
@alex-pinkus
Move default fonts to new crate epaint_default_fonts (#4853)
ae7672e 
This allows license checking tools to omit the OFL and UFL licenses when
`default_fonts` are turned off.

There was some discussion of versioning on the original issue; I have
chosen to label this version as `0.28.1` to match the other crates.
Happy to adjust the version as needed.

<!--
Please read the "Making a PR" section of
[`CONTRIBUTING.md`](https://github.com/emilk/egui/blob/master/CONTRIBUTING.md)
before opening a Pull Request!

* Keep your PR:s small and focused.
* The PR title is what ends up in the changelog, so make it descriptive!
* If applicable, add a screenshot or gif.
* If it is a non-trivial addition, consider adding a demo for it to
`egui_demo_lib`, or a new example.
* Do NOT open PR:s from your `master` branch, as that makes it hard for
maintainers to test and add commits to your PR.
* Remember to run `cargo fmt` and `cargo clippy`.
* Open the PR as a draft until you have self-reviewed it and run
`./scripts/check.sh`.
* When you have addressed a PR comment, mark it as resolved.

Please be patient! I will review your PR, but my time is limited!
-->

* Closes <#2321>
* [X] I have followed the instructions in the PR template

---------

Co-authored-by: Alex Pinkus <pinkus@amazon.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something is broken
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Move default fonts to new crate epaint_default_fonts alex-pinkus/egui
4 participants
@emilk @repi @TheButlah @GunnarMorrigan