Fenix: FNX3-15507 ⁃ Include Firefox Sharp Sans through our build process

[ghost]

As specified in #1307 we want to use _Firefox Sharp Sans_ throughout the application. This font however is not something we can include in our open source project:

we can ship the font to end users as part of our application, but we cannot include it next to the publicly available fenix source code in this GitHub repository

This ticket is about building something into our build automation that can fetch the font files from a locked down server and include them in the final build.

Since our build process is mostly transparent and publicly visible, the process of including the fonts must be either hidden or not reproducible by a third party.

[ghost]

I hope we can do something simple here, like reference the font in our code/layouts but not include it in the project until CI time. Hopefully that will simply fall back to the system font for dev builds and Firefox Sharp Sans for production builds.

Looping in @mozilla-mobile/releng to ask for advice

[pocmo]

One option could be:

• We place a different font in the repository and use that everywhere in the app.
• (Taskcluster) For release builds we pull Firefox Sharp Sans from taskcluster's secret service and replace the font in the repository with it.
• Via taskcluster's role system we make sure that only release builds are allowed to access the "font secret".

For a resource that ends up in the APK (e.g. other than a signing key) taskcluster's secret service may be sufficient.

@JohanLorenzo Does this approach make sense or would you recommend something else?

@st3fan Do we know how large the font is?

[mitchhentges]

If we properly license the Firefox Sharp Sans font, why can't we include it in our open Github repository? If we're worried about it being stolen, it will still be able to be extracted from our release builds of Fenix, so it won't be fully-secret either way :thinking:

I'm concerned about the additional maintenance overhead of handling this font differently: if there's an issue (font-wrapping or something :man_shrugging:) that's specific to the properties of this font, it will be much harder for developers to nail down the problem if they can't test with it locally. Additionally, we'll need to manage the complexity of the font in the CI pipeline.

I just want to confirm that it's definitely not an option to just have the font in the repository like the rest of our assets (like our proprietary logo, or other branding). :thinking:

[ghost]

It is definitely not an option to make the font available. It is not part of the license agreement.

[JohanLorenzo]

Thank you for opening this discussion, @sarentz. I chatted with a few other relengers and we have a few questions:

• What does the license allow Mozilla to distribute?
  
  
  
  • Is having the builds from CI (like on each master push) with the font possible? Is it just having the font-files directly available that is a problem?
  
  
  • Will the license impact hosting builds on archive.mozilla.org?
  
  
• Do we want to distribute some other files under a restrictive license? For instance, if we decided to ship a partner-version of a browser, we would probably have to embed some other files.
• I see the priority is P1. When do you need this by?

[ghost]

I'll take these questions and will get back with some answers.

[cadeyrn]

Maybe these are naive questions but I would like to understand the reasons.

Why must a font with such licencing restrictions be used at all in an open source project like Fenix? Apart from the concerns already expressed by @mitchhentges, does it not also make distribution via other channels like F-Droid more challenging? And if it's really so important to use this font is there really no way to get better licencing conditions which are more compatible with Mozilla and their open source culture? There are already other special Mozilla fonts like Fira Sans and Zilla Slab which are also open fonts. Why can't have Firefox Sharp Sans similar conditions?

[agi90]

I don't understand what's the difference between adding it to our APK and having it in the github repository? either way you can extract it (APKs are just zip files).

[ghost]

@mozilla-mobile/releng We have decided to move this post our initial release. I think it will be good to be prepared for this in the meantime, but there is no immediate urgency to make this a priority now.

[NotWoods]

Closing since #1307 was closed.