fontisan 0.4.34 → 0.4.36

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1c278ba38670bfc65e41805d14d6bc175ae451f0e5400e4b25036bf3ae6a84f6
-  data.tar.gz: 59ec85b42b6879f589c13429e8e490a41eb32257530207647203c010ee461182
+  metadata.gz: 3957074ba3c679c22715fa1f1aabf4dbd3cc7334891f729d64988ec231237f3b
+  data.tar.gz: 18129617714b672947d8f39a88e7c06a7644e4ff12875c383321635a6e051377
 SHA512:
-  metadata.gz: 17b9aeaeeb0589379b2ff65413aabb3db15c4d0dd323bd4891e4863a9dca2fdb7190fd795ebcd62fa16d6d570e7f7bb50c740b9947c0b42a5e673380e0164cd2
-  data.tar.gz: c9b35dd44d43fc634b1bf07aa84d2bd99527e4695636424cbf46aca757615b09d6dc27f3512e701ab8676d1111f51f980dd97d0d0fd82c47f4177592f9b94c95
+  metadata.gz: 3315d7c7f3cd824dadcf4ecddc63319a5661ac13ebf8383dfab8f2eda3fffd2713a1a039df922d58073cc0b99615d0d608de5641f67528e48f2aa70678e5b8f1
+  data.tar.gz: 1bd98a99dc9902aeae6e5ceb3c40f16d01c7a61c16ae2c94f1c97f212602de2675602ab736545869640500dc49ac5f4bef6302bf3b43c34593071e94b513c448

data/.rubocop.yml

@@ -116,7 +116,19 @@ Style/BitwisePredicate:
   Enabled: false
 
 # Allow short math-conventional parameter names in font geometry code.
-# Point#x / Point#y are domain-standard coordinate names; renaming to
-# x_coord/y_coord adds noise without aiding readers.
+# Font geometry / binary parsing uses single-letter variables by domain
+# convention: affine matrix (a,b,c,d,e,f), loop indices (i,j,k,m,n),
+# coordinates (x,y,z), deltas (dx,dy). Renaming to 3+ chars adds noise
+# without aiding readers familiar with the math.
 Naming/MethodParameterName:
-  AllowedNames: ["x", "y", "cp", "gid", "n"]
+  AllowedNames: ["a", "b", "c", "d", "e", "f", "i", "j", "k", "m", "n",
+                 "p", "r", "s", "t", "u", "v", "w", "x", "y", "z",
+                 "cp", "gid", "dx", "dy", "fd", "io", "id"]
+
+# Allow spec-format identifiers that match OpenType spec terminology:
+# cmap format4, format6, format12, format14 are the official names.
+# Renaming to format_4 diverges from the spec and makes docs harder
+# to cross-reference.
+Naming/VariableNumber:
+  AllowedIdentifiers: ["format0", "format4", "format6", "format12", "format14",
+                        "version1", "version2", "table1", "table2"]

data/.rubocop_todo.yml

@@ -1,6 +1,6 @@
 # This configuration was generated by
 # `rubocop --auto-gen-config`
-# on 2026-07-11 04:55:54 UTC using RuboCop version 1.86.1.
+# on 2026-07-11 08:52:22 UTC using RuboCop version 1.86.1.
 # The point is for the user to remove these configuration records
 # one by one as the offenses are removed from the code base.
 # Note that changes in the inspected code, or installation of new
@@ -32,20 +32,13 @@ Layout/IndentationWidth:
     - 'lib/fontisan/commands/audit_command.rb'
     - 'lib/fontisan/ufo/compile/glyf_loca.rb'
 
-# Offense count: 1969
+# Offense count: 2053
 # This cop supports safe autocorrection (--autocorrect).
 # Configuration parameters: Max, AllowHeredoc, AllowURI, AllowQualifiedName, URISchemes, AllowRBSInlineAnnotation, AllowCopDirectives, AllowedPatterns, SplitStrings.
 # URISchemes: http, https
 Layout/LineLength:
   Enabled: false
 
-# Offense count: 2
-# This cop supports safe autocorrection (--autocorrect).
-# Configuration parameters: AllowInHeredoc.
-Layout/TrailingWhitespace:
-  Exclude:
-    - 'lib/fontisan/commands/audit_command.rb'
-
 # Offense count: 2
 Lint/CopDirectiveSyntax:
   Exclude:
@@ -118,7 +111,7 @@ Lint/UselessConstantScoping:
     - 'lib/fontisan/conversion_options.rb'
     - 'lib/fontisan/type1/charstrings.rb'
 
-# Offense count: 752
+# Offense count: 766
 # Configuration parameters: AllowedMethods, AllowedPatterns, CountRepeatedAttributes, Max.
 Metrics/AbcSize:
   Enabled: false
@@ -141,12 +134,12 @@ Metrics/CollectionLiteralLength:
     - 'lib/fontisan/type1/agl.rb'
     - 'lib/fontisan/type1/encodings.rb'
 
-# Offense count: 375
+# Offense count: 383
 # Configuration parameters: AllowedMethods, AllowedPatterns, Max.
 Metrics/CyclomaticComplexity:
   Enabled: false
 
-# Offense count: 1019
+# Offense count: 1045
 # Configuration parameters: CountComments, CountAsOne, AllowedMethods, AllowedPatterns.
 Metrics/MethodLength:
   Max: 135
@@ -157,16 +150,28 @@ Metrics/ParameterLists:
   Max: 39
   MaxOptionalParameters: 4
 
-# Offense count: 289
+# Offense count: 294
 # Configuration parameters: AllowedMethods, AllowedPatterns, Max.
 Metrics/PerceivedComplexity:
   Enabled: false
 
-# Offense count: 209
+# Offense count: 34
 # Configuration parameters: MinNameLength, AllowNamesEndingInNumbers, AllowedNames, ForbiddenNames.
 # AllowedNames: as, at, by, cc, db, id, if, in, io, ip, of, on, os, pp, to
 Naming/MethodParameterName:
-  Enabled: false
+  Exclude:
+    - 'lib/fontisan.rb'
+    - 'lib/fontisan/conversion_options.rb'
+    - 'lib/fontisan/optimizers/subroutine_optimizer.rb'
+    - 'lib/fontisan/svg_to_glyf/geometry/affine_transform.rb'
+    - 'lib/fontisan/svg_to_glyf/geometry/transform_parser.rb'
+    - 'lib/fontisan/type1/ttf_to_type1_converter.rb'
+    - 'lib/fontisan/ufo/compile/filters/cubic_to_quadratic.rb'
+    - 'lib/fontisan/ufo/convert.rb'
+    - 'lib/fontisan/variation/optimizer.rb'
+    - 'lib/fontisan/woff2/glyf_loca_reconstruct.rb'
+    - 'lib/fontisan/woff2/glyf_loca_transform.rb'
+    - 'spec/fontisan/subset/table_strategy/cff2_spec.rb'
 
 # Offense count: 13
 # Configuration parameters: Mode, AllowedMethods, AllowedPatterns, AllowBangMethods, WaywardPredicates.
@@ -228,7 +233,7 @@ RSpec/AnyInstance:
 RSpec/ContextWording:
   Enabled: false
 
-# Offense count: 40
+# Offense count: 42
 # Configuration parameters: IgnoredMetadata.
 RSpec/DescribeClass:
   Enabled: false
@@ -244,7 +249,7 @@ RSpec/DescribeMethod:
     - 'spec/fontisan/type1/seac_expander_spec.rb'
     - 'spec/fontisan/type1_real_fonts_spec.rb'
 
-# Offense count: 1726
+# Offense count: 1729
 # Configuration parameters: CountAsOne.
 RSpec/ExampleLength:
   Max: 66
@@ -322,7 +327,7 @@ RSpec/MultipleDescribes:
     - 'spec/fontisan/utils/thread_pool_spec.rb'
     - 'spec/fontisan/variation/cache_spec.rb'
 
-# Offense count: 2149
+# Offense count: 2153
 RSpec/MultipleExpectations:
   Max: 19
 

data/TODO.improvements/README.md

@@ -11,7 +11,7 @@ Each file is `NN-short-name.md` where `NN` is the priority order.
 - [x] ~~[15 — CFF/CFF2 subsetter strategy](15-cff-cff2-subsetter-strategy.md)~~ ✓ Done — CFF via UFO round-trip, CFF2 via standalone INDEX filter with VStore preservation
 
 ### P1 — High-value features
-- [x] ~~[03 — `fontisan audit` command (identity+style+features lens)](03-fontisan-audit-command.md)~~ ✓ Done (Phase 1: identity, style, coverage, OpenType layout, provenance; CLI `fontisan audit` with YAML/JSON output)
+- [x] ~~[03 — `fontisan audit` command (identity+style+features lens)](03-fontisan-audit-command.md)~~ ✓ Done (Phase 1: identity, style, coverage, layout, provenance; Phase 2 axes: table directory, glyph names, cmap, OTS, collection integrity; Phase 3 axes: variable-font, hinting, WOFF2, format-round-trip, OpenType conformance foundation; CLI `fontisan audit --validate` with profiles: default, structural, ots, layout, variable, hinting, web, spec)
 - [x] ~~[04 — UFO composite glyph encoding](04-ufo-composite-glyph-encoding.md)~~ ✓ Done
 - [x] ~~[05 — OTF compiler real CFF charstrings](05-otf-compiler-real-cff.md)~~ ✓ Already working (discovered in PR #117 — Cff.build produces real Type 2 charstrings; stale TODO marker removed)
 

data/lib/fontisan/audit/check.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require "lutaml/model"
+
+module Fontisan
+  module Audit
+    # Abstract base for all audit checks. A check is a stateless
+    # function that examines a loaded font and returns an Array of
+    # {Models::ValidationReport::Issue} records. An empty array means
+    # the font passed the check.
+    #
+    # Subclasses MUST override {.call} and {.code}.
+    #
+    # Checks are intentionally stateless + side-effect free so they
+    # can be composed, run in parallel, and tested in isolation.
+    class Check
+      # Run the check against +font+.
+      #
+      # @param font [SfntFont, BaseCollection]
+      # @return [Array<Models::ValidationReport::Issue>]
+      def self.call(font)
+        raise NotImplementedError,
+              "#{name} must override .call(font) -> Array<Issue>"
+      end
+
+      # Unique short identifier for this check (e.g. :table_checksum).
+      # Used as the issue +category+ for programmatic filtering.
+      #
+      # @return [Symbol]
+      def self.code
+        raise NotImplementedError,
+              "#{name} must override .code -> Symbol"
+      end
+
+      # Build an issue. Centralizes the category so callers don't repeat it.
+      # @return [Models::ValidationReport::Issue]
+      def self.issue(severity:, message:, location: nil)
+        Models::ValidationReport::Issue.new(
+          severity: severity.to_s,
+          category: code.to_s,
+          message: message,
+          location: location,
+        )
+      end
+    end
+  end
+end

data/lib/fontisan/audit/check_registry.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module Fontisan
+  module Audit
+    # Central registry of audit checks. A profile is a named subset of
+    # checks (e.g. +:ots+, +:structural+). The +:default+ profile runs
+    # every registered check.
+    #
+    # Profiles let callers opt into specific validation axes without
+    # running everything — e.g. +fontisan audit font.ttf --validate ots+
+    # runs only the OTS compatibility check.
+    #
+    # @example Run all checks
+    #   CheckRegistry.for(:default)  # => [TableDirectoryCheck, ...]
+    #
+    # @example Run a specific profile
+    #   CheckRegistry.for(:ots)      # => [OtsCompatibilityCheck]
+    class CheckRegistry
+      PROFILES = {
+        default: %i[table_directory glyph_names cmap ots_compatibility
+                    collection_integrity variable_font hinting woff2_validation
+                    format_round_trip opentype_conformance],
+        structural: %i[table_directory collection_integrity opentype_conformance],
+        ots: %i[ots_compatibility],
+        layout: %i[glyph_names cmap],
+        variable: %i[variable_font],
+        hinting: %i[hinting],
+        web: %i[ots_compatibility woff2_validation],
+        spec: %i[opentype_conformance],
+      }.freeze
+
+      # @param profile [Symbol]
+      # @return [Array<Class>] check classes for the profile
+      def self.for(profile)
+        codes = PROFILES[profile] || PROFILES[:default]
+        codes.filter_map { |code| check_for(code) }
+      end
+
+      # @param code [Symbol]
+      # @return [Class, nil] the check class
+      def self.check_for(code)
+        case code
+        when :table_directory then Checks::TableDirectoryCheck
+        when :glyph_names then Checks::GlyphNameCheck
+        when :cmap then Checks::CmapCheck
+        when :ots_compatibility then Checks::OtsCompatibilityCheck
+        when :collection_integrity then Checks::CollectionIntegrityCheck
+        when :variable_font then Checks::VariableFontCheck
+        when :hinting then Checks::HintingCheck
+        when :woff2_validation then Checks::Woff2ValidationCheck
+        when :format_round_trip then Checks::FormatRoundTripCheck
+        when :opentype_conformance then Checks::OpenTypeConformanceCheck
+        end
+      end
+    end
+  end
+end

data/lib/fontisan/audit/checks/cmap_check.rb

@@ -0,0 +1,249 @@
+# frozen_string_literal: true
+
+require "stringio"
+
+module Fontisan
+  module Audit
+    module Checks
+      # Validates cmap subtable invariants per the OpenType spec:
+      #
+      #   - At least one Unicode-encoded subtable is present
+      #   - Format 4: segCountX2 must equal segCount × 2
+      #   - Format 4: the last segment must have endCode 0xFFFF
+      #   - Format 4: reservedPad must be 0
+      #   - Format 12: groups must be sorted and non-overlapping
+      #   - Format 12: each group startCharCode ≤ endCharCode
+      #   - Subtable offsets must be within the cmap table bounds
+      #
+      # Catches the most common real-world cmap bugs that renderers and
+      # text shapers reject silently.
+      #
+      # @see https://learn.microsoft.com/en-us/typography/opentype/spec/cmap
+      class CmapCheck < Check
+        # @param font [SfntFont]
+        # @return [Array<Models::ValidationReport::Issue>]
+        def self.call(font)
+          return [] unless font.has_table?("cmap")
+
+          raw = font.table_data["cmap"]
+          return [] unless raw
+
+          issues = []
+          issues.concat(validate_header(raw))
+          return issues unless issues.empty?
+
+          records = read_encoding_records(raw)
+          issues.concat(validate_unicode_presence(records))
+          issues.concat(validate_subtables(raw, records))
+          issues
+        end
+
+        def self.code
+          :cmap
+        end
+
+        # ---------- header ----------
+
+        def self.validate_header(raw)
+          issues = []
+          version, num_tables = raw.unpack("nn")
+          if version != 0
+            issues << issue(severity: :error,
+                            message: "cmap version is #{version} but must be 0",
+                            location: "cmap.version")
+          end
+          if num_tables.zero?
+            issues << issue(severity: :error,
+                            message: "cmap has no encoding records",
+                            location: "cmap.numTables")
+          end
+          issues
+        end
+        private_class_method :validate_header
+
+        # ---------- encoding records ----------
+
+        def self.read_encoding_records(raw)
+          num_tables = raw.unpack1("x2n")
+          offset = 4
+          Array.new(num_tables) do |i|
+            break if offset + 8 > raw.bytesize
+
+            platform_id, encoding_id, subtable_offset = raw[offset, 8].unpack("nnN")
+            offset += 8
+            {
+              index: i,
+              platform_id: platform_id,
+              encoding_id: encoding_id,
+              subtable_offset: subtable_offset,
+            }
+          end
+        end
+        private_class_method :read_encoding_records
+
+        def self.validate_unicode_presence(records)
+          has_unicode = records.any? do |r|
+            unicode_platform?(r[:platform_id], r[:encoding_id])
+          end
+          return [] if has_unicode
+
+          [issue(severity: :warning,
+                 message: "cmap has no Unicode-encoded subtable " \
+                          "(expected platform 0 or 3 with encoding 1 or 10)",
+                 location: "cmap.encoding_records")]
+        end
+        private_class_method :validate_unicode_presence
+
+        def self.unicode_platform?(platform_id, encoding_id)
+          platform_id.zero? ||
+            (platform_id == 3 && [1, 10].include?(encoding_id))
+        end
+        private_class_method :unicode_platform?
+
+        # ---------- per-subtable validation ----------
+
+        def self.validate_subtables(raw, records)
+          records.flat_map { |r| validate_one_subtable(raw, r) }
+        end
+        private_class_method :validate_subtables
+
+        def self.validate_one_subtable(raw, record)
+          off = record[:subtable_offset]
+          if off + 2 > raw.bytesize
+            return [issue(severity: :error,
+                          message: "cmap subtable at record #{record[:index]} " \
+                                   "has offset #{off} beyond the table end",
+                          location: "cmap.encoding_records.#{record[:index]}")]
+          end
+
+          format = raw[off, 2].unpack1("n")
+          case format
+          when 0 then validate_format0(raw, off, record)
+          when 4 then validate_format4(raw, off, record)
+          when 6 then validate_format6(raw, off, record)
+          when 12 then validate_format12(raw, off, record)
+          when 14 then [] # format 14 (Unicode Variation Sequences) — skip for now
+          else
+            [issue(severity: :warning,
+                   message: "cmap subtable at record #{record[:index]} uses " \
+                            "unknown format #{format}",
+                   location: "cmap.encoding_records.#{record[:index]}")]
+          end
+        end
+        private_class_method :validate_one_subtable
+
+        # Format 4 validation: segCountX2 consistency, sentinel, reservedPad.
+        def self.validate_format4(raw, off, record)
+          issues = []
+          return issues unless off + 14 <= raw.bytesize
+
+          _format, _, _lang, seg_count_x2, _search, _sel, _shift,
+            = raw[off, 16].unpack("nnnnnnnn")
+          seg_count = seg_count_x2 / 2
+
+          if seg_count_x2.odd? || seg_count_x2 != seg_count * 2
+            issues << issue(severity: :error,
+                            message: "cmap format 4 (record #{record[:index]}): " \
+                                     "segCountX2=#{seg_count_x2} is inconsistent " \
+                                     "with segCount=#{seg_count}",
+                            location: "cmap.encoding_records.#{record[:index]}")
+          end
+
+          # Read the last endCode (the sentinel segment)
+          end_codes_start = off + 14
+          if seg_count.positive? && end_codes_start + (seg_count * 2) <= raw.bytesize
+            last_end = raw[end_codes_start + ((seg_count - 1) * 2), 2].unpack1("n")
+            if last_end != 0xFFFF
+              issues << issue(severity: :warning,
+                              message: "cmap format 4 (record #{record[:index]}): " \
+                                       "last segment endCode is 0x#{last_end.to_s(16)} " \
+                                       "but should be 0xFFFF (sentinel)",
+                              location: "cmap.encoding_records.#{record[:index]}")
+            end
+          end
+
+          # reservedPad check
+          reserved_pad_off = end_codes_start + (seg_count * 2)
+          if reserved_pad_off + 2 <= raw.bytesize
+            reserved_pad = raw[reserved_pad_off, 2].unpack1("n")
+            unless reserved_pad.zero?
+              issues << issue(severity: :error,
+                              message: "cmap format 4 (record #{record[:index]}): " \
+                                       "reservedPad is #{reserved_pad} but must be 0",
+                              location: "cmap.encoding_records.#{record[:index]}")
+            end
+          end
+
+          issues
+        end
+        private_class_method :validate_format4
+
+        # Format 12 validation: groups sorted, non-overlapping, ordered.
+        def self.validate_format12(raw, off, record)
+          issues = []
+          return issues unless off + 16 <= raw.bytesize
+
+          _format, _reserved, _length, _lang, num_groups = raw[off, 16].unpack("nnNnN")
+          groups_start = off + 16
+          return issues if num_groups.zero?
+          return issues unless groups_start + (num_groups * 12) <= raw.bytesize
+
+          prev_end = nil
+          num_groups.times do |g|
+            entry_off = groups_start + (g * 12)
+            start_cp, end_cp, _gid = raw[entry_off, 12].unpack("NNN")
+
+            if start_cp > end_cp
+              issues << issue(severity: :error,
+                              message: "cmap format 12 (record #{record[:index]}): " \
+                                       "group #{g} has startCharCode 0x#{start_cp.to_s(16)} " \
+                                       "> endCharCode 0x#{end_cp.to_s(16)}",
+                              location: "cmap.encoding_records.#{record[:index]}")
+            end
+
+            if prev_end && start_cp <= prev_end
+              issues << issue(severity: :error,
+                              message: "cmap format 12 (record #{record[:index]}): " \
+                                       "group #{g} overlaps or is out of order " \
+                                       "(startCharCode 0x#{start_cp.to_s(16)} ≤ " \
+                                       "previous endCharCode 0x#{prev_end.to_s(16)})",
+                              location: "cmap.encoding_records.#{record[:index]}")
+            end
+            prev_end = end_cp
+          end
+          issues
+        end
+        private_class_method :validate_format12
+
+        def self.validate_format0(raw, off, record)
+          # Format 0: 262 bytes (header 6 + 256-byte glyphIdArray)
+          if off + 262 > raw.bytesize
+            [issue(severity: :error,
+                   message: "cmap format 0 (record #{record[:index]}): " \
+                            "subtable is truncated (need 262 bytes)",
+                   location: "cmap.encoding_records.#{record[:index]}")]
+          else
+            []
+          end
+        end
+        private_class_method :validate_format0
+
+        def self.validate_format6(raw, off, record)
+          return [] unless off + 10 <= raw.bytesize
+
+          _fmt, _len, _lang, first, count = raw[off, 10].unpack("nnnnn")
+          needed = off + 10 + (count * 2)
+          if needed > raw.bytesize
+            [issue(severity: :error,
+                   message: "cmap format 6 (record #{record[:index]}): " \
+                            "subtable truncated (first=#{first}, count=#{count})",
+                   location: "cmap.encoding_records.#{record[:index]}")]
+          else
+            []
+          end
+        end
+        private_class_method :validate_format6
+      end
+    end
+  end
+end

data/lib/fontisan/audit/checks/collection_integrity_check.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+module Fontisan
+  module Audit
+    module Checks
+      # Validates TrueType/OpenType Collection (TTC/OTC) structural
+      # integrity: TTC header, per-face SFNT offsets, shared-table
+      # deduplication. TTC is undertooled — CJK and Apple workflows
+      # ship fonts as collections and no widely-available validator
+      # covers the collection-specific invariants.
+      #
+      # Checks:
+      #
+      #   - TTC tag must be 'ttcf'
+      #   - header.majorVersion must be 1 or 2
+      #   - numFonts must be positive and match the offset array length
+      #   - every face offset must be > 0 and within the file
+      #   - face offsets must not overlap the TTC header
+      #   - (v2 only) DSIG tag/length must be null or point inside the file
+      #
+      # @see https://learn.microsoft.com/en-us/typography/opentype/spec/otff#ttc-header
+      class CollectionIntegrityCheck < Check
+        TTC_TAG = "ttcf"
+        VALID_MAJOR_VERSIONS = [1, 2].freeze
+
+        # @param font [BaseCollection, SfntFont] a collection or single font
+        # @return [Array<Models::ValidationReport::Issue>]
+        def self.call(font)
+          return [] unless collection?(font)
+
+          issues = []
+          issues.concat(validate_header(font))
+          issues.concat(validate_face_offsets(font))
+          issues
+        end
+
+        def self.code
+          :collection_integrity
+        end
+
+        def self.collection?(font)
+          font.is_a?(BaseCollection)
+        end
+        private_class_method :collection?
+
+        def self.validate_header(collection)
+          issues = []
+          tag = collection.tag.to_s
+
+          if tag != TTC_TAG
+            issues << issue(severity: :error,
+                            message: "Collection tag is '#{tag}' but must be '#{TTC_TAG}'",
+                            location: "ttc_header.tag")
+          end
+
+          version = collection.major_version.to_i
+          unless VALID_MAJOR_VERSIONS.include?(version)
+            issues << issue(severity: :error,
+                            message: "Collection major version is #{version} " \
+                                     "but must be one of #{VALID_MAJOR_VERSIONS.join(', ')}",
+                            location: "ttc_header.majorVersion")
+          end
+
+          num_fonts = collection.num_fonts.to_i
+          if num_fonts <= 0
+            issues << issue(severity: :error,
+                            message: "Collection numFonts is #{num_fonts} " \
+                                     "but must be positive",
+                            location: "ttc_header.numFonts")
+          end
+
+          if collection.font_offsets.length != num_fonts
+            issues << issue(severity: :error,
+                            message: "Collection has #{num_fonts} fonts but " \
+                                     "#{collection.font_offsets.length} offsets " \
+                                     "(should match)",
+                            location: "ttc_header.font_offsets")
+          end
+
+          issues
+        end
+        private_class_method :validate_header
+
+        def self.validate_face_offsets(collection)
+          header_end = 12 + (collection.num_fonts.to_i * 4) +
+            (collection.major_version.to_i == 2 ? 8 : 0)
+          collection.font_offsets.each_with_index.with_object([]) do |(off, idx), issues|
+            off_val = off.to_i
+            if off_val < header_end
+              issues << issue(severity: :error,
+                              message: "Face #{idx} SFNT offset #{off_val} " \
+                                       "overlaps the TTC header " \
+                                       "(header ends at #{header_end})",
+                              location: "ttc_header.font_offsets.#{idx}")
+            end
+          end
+        end
+        private_class_method :validate_face_offsets
+      end
+    end
+  end
+end