This blog is built on Nikola & (until now) used the "hack" theme.

While playing with CSPs (why the hell can't I use hashes for CSS files, ffs) I noticed that fonts were getting loaded from google. Yay. Looks like I didn't check the theme in detail because why would you :upsidedown:.

Anyway, fix is fortunately quite easy:

• Copy & rename theme

• Download the CSS wrapper from Google & put it in the $theme/assets/css folder

• Download the font file from Google & put it in $theme/assets/fonts or something

• Update the themes template to point to the new CSS, update the new CSS to point to the local font, update the config to use the custom theme

I hate this shit - why create external dependencies, user & site trackability, complexity, ... . Just use a default font or ship one with the theme.

That aside: Reason #1280941 to play around with tight CSPs, as if we needed more...

Edit: Other v8 official themes with similar issues, may be incomplete:

• bnw: Google

• canterville: Google

• gruberwine: Google, fontawesome

• hack: Google

• hybrid: Google, jsdelivr

• hyde: Google

• All zen variants: Google, fontawesome, polyfill