fix splinefont shell command injection (#5367)

Gbp-Pq: Name 0001-fix-splinefont-shell-command-injection-5367.patch

Remove link to remote SourceForge logo from Japanese documentation

Origin: vendor
Forwarded: not-needed
Last-Update: 2020-11-23

Also image link to upstream author George Williams’s now defunct old website,
and image link to thunbmail of « Fontes & codages » on Amazon.
Fixes Lintian privacy-breach-logo error.
Last-Update: 2020-11-23
Gbp-Pq: Name 2004-fix-privacy-breach-logo.patch

Avoid links in html documents potentially breaching privacy

Replace potential tracking image URLs with inline single-pixel
transparent image from
<https://css-tricks.com/snippets/html/base64-encode-of-1x1px-transparent-gif/>.

Strip hardcoded host from demo form.

Forwarded: not-needed
Last-Update: 2017-09-23

Gbp-Pq: Name 2003_avoid_privacy_breach.patch

Use packaged copy of MathJax from libjs-mathjax

Origin: vendor
Forwarded: not-needed
Last-Update: 2020-11-24

FontForge documentation uses sphinx.ext.mathjax which insert script links
to MathJax served on remote CDNs.

This patch, together with debian/fontforge-doc.links, replaces remote
scripts with MathJax from the libjs-mathjax package.
See https://bugs.debian.org/739300 for discussion.

Fixes Lintian privacy-breach-generic warnings.
Last-Update: 2020-11-24
Gbp-Pq: Name 0003-use-local-libjs-mathjax.patch

Remove custom library search path (RPATH/RUNPATH)

Origin: vendor
Forwarded: not-needed
Last-Update: 2020-11-18

This reverts upstream's preference of setting RPATH/RUNPATH for
installed binaries.  Fixes Lintian custom-library-search-path error.
Last-Update: 2020-11-18
Gbp-Pq: Name 0002-remove-custom-library-search-path.patch

fontforge (1:20230101~dfsg-1.1) unstable; urgency=high

  * Non-maintainer upload.
  * CVE-2024-25081: Spline Font command injection via crafted filenames
  * CVE-2024-25082: Spline Font command injection via crafted archives
    or compressed files
  * Closes: #1064967

[dgit import unpatched fontforge 1:20230101~dfsg-1.1]

Import fontforge_20230101~dfsg-1.1.debian.tar.xz

[dgit import tarball fontforge 1:20230101~dfsg-1.1 fontforge_20230101~dfsg-1.1.debian.tar.xz]

Import fontforge_20230101~dfsg.orig.tar.xz

[dgit import orig fontforge_20230101~dfsg.orig.tar.xz]