[tor-bugs] #13313 [Tor Browser]: Enable bundled fonts in Tor Browser

[Tor Bug Tracker & Wiki]

#13313: Enable bundled fonts in Tor Browser
-------------------------+-------------------------------------------------
     Reporter:  dcf      |      Owner:  tbb-team
         Type:           |     Status:  needs_review
  enhancement            |  Milestone:
     Priority:  normal   |    Version:
    Component:  Tor      |   Keywords:  tbb-fingerprinting-fonts,
  Browser                |  tbb-5.0a4, TorBrowserTeam201507R
   Resolution:           |  Parent ID:
Actual Points:           |
       Points:           |
-------------------------+-------------------------------------------------
Changes (by arthuredelstein):

 * status:  new => needs_review
 * keywords:  tbb-fingerprinting-fonts, tbb-5.0a4, TorBrowserTeam201507 =>
     tbb-fingerprinting-fonts, tbb-5.0a4, TorBrowserTeam201507R


Comment:

 I made corrections to both tor-browser.git and tor-browser-bundle.git
 patches. So here are my two new branches, for review:
 * The tor-browser-bundle.git patches enable font bundling as implemented
 in [https://bugzilla.mozilla.org/show_bug.cgi?id=998844 Mozilla Bug
 998844], download the Noto fonts and bundle them in Tor Browser:
 https://github.com/arthuredelstein/tor-browser-bundle/commits/13313+4
 * The tor-browser.git patches add a new mechanism for whitelisting fonts
 according to a pref (`font.system.whitelist`), and use this pref to
 whitelist the bundled Noto fonts only:
 https://github.com/arthuredelstein/tor-browser/commits/13313+4

 For ease of testing the results, I built packages for various platforms
 and languages, downloadable here:
 https://people.torproject.org/~arthuredelstein/downloads/13313-builds/

 (My gpg fingerprint is `20B2 4CEF E6AF D615 0B6A  6F18 D752 F538 C0D3
 8C3A`.)

 Here are a couple of pages that may be useful for testing:
 * This page displays the names of ~288 languages written in that language:
 https://meta.wikimedia.org/wiki/List_of_Wikipedias#1_000_000.2B_articles

 * This page allows you to check if the Simplified Chinese, Traditional
 Chinese, Japanese, Korean, and Vietnamese variants of Han characters are
 correctly displayed: https://en.wikipedia.org/wiki/Han_unification
 #Examples_of_language-dependent_glyphs

 The whitelisted fonts are given in the `font.system.whitelist` pref in
 about:config. They are:
 `Cousine, Noto Kufi Arabic, Noto Naskh Arabic, Noto Sans, Noto Sans
 Armenian, Noto Sans Bengali, Noto Sans Buginese, Noto Sans CJK SC Regular,
 Noto Sans Canadian Aboriginal, Noto Sans Cherokee, Noto Sans Devanagari,
 Noto Sans Ethiopic, Noto Sans Georgian, Noto Sans Gujarati, Noto Sans
 Gurmukhi, Noto Sans Hebrew, Noto Sans Kannada, Noto Sans Khmer, Noto Sans
 Lao, Noto Sans Malayalam, Noto Sans Mongolian, Noto Sans Myanmar, Noto
 Sans Oriya, Noto Sans Sinhala, Noto Sans Tamil, Noto Sans Telugu, Noto
 Sans Thaana, Noto Sans Thai, Noto Sans Tibetan, Noto Sans Yi, Noto Serif,
 Noto Serif Armenian, Noto Serif Khmer, Noto Serif Lao, Noto Serif Thai`

 Note that the extra MB added to Tor Browser are mostly from the file
 `NotoSansCJKsc-Regular.otf`, which covers Chinese (simplifed and
 traditional), Japanese, Korean. Also, `Cousine` is included as a monospace
 font similar in size and shape to the Noto fonts.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13313#comment:19>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online