Hello DFSG team.
There were a few things I needed to explain here.


W: gaphor: privacy-breach-generic (https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.1/css/all.min.css) [usr/lib/python3/dist-packages/gaphor/plugins/htmlreport/report.html]
W: gaphor: privacy-breach-generic (https://cdn.jsdelivr.net/npm/svg-pan-zoom@3.6.1/dist/svg-pan-zoom.min.js) [usr/lib/python3/dist-packages/gaphor/plugins/htmlreport/report.html]

The file report.html is a template for Gaphor's "Export as HTML" feature.
When a user exports their model, this template becomes their index.html file
- a single standalone HTML file they can share or open anywhere.

The external links to Font Awesome and svg-pan-zoom are needed so the exported
index.html works as one self-contained file. If we changed them to local files
(e.g., under /usr/share/...), the exported file would no longer be a single
file - it would depend on other local files, making it hard to move or share.

If we instead saved the CSS/JS files alongside each exported index.html, then
every time a user exports their model, they would get a folder with multiple
files instead of one HTML file. Moving or sharing that folder would be
cumbersome and break easily.

The Debian package itself never fetches these resources. The user's browser
only loads them when they open their own exported index.html. Please ignore
the privacy-breach-generic warnings for this file.

You can see an example of an exported file here:
https://salsa.debian.org/-/project/108912/uploads/063fcdc29d92b3793535a5145a60732e/index.html
