Source Code Pro rendered poorly in macOS Safari's Lockdown Mode

[jrose-signal]

When viewing play.rust-lang.org through macOS Safari with Lockdown Mode on, the capabilities of web fonts are dramatically restricted, and the playground ends up nigh-unreadably thin. It's still using Source Code Pro, but only in a single weight, and not even the "normal" weight used for non-bold text when the editor is working correctly. Hand-editing the CSS in the web inspector to use either monospace or the Ace defaults—which, in practice, is letting it use a font already available in the browser—leads to correct display, albeit not in Source Code Pro. (The problem isn't specific to Ace; the Simple and Monaco views have the same problem.) I don't know offhand if there's a way to get Source Code Pro to display well in Lockdown Mode.

[shepmaster]

While I do have macOS, testing with Lockdown Mode is super onerous, what with the required reboot and then affecting ~everything I do normally, so hopefully you are willing to do some testing and investigation for me!

I would have expected that lockdown would completely disable all webfonts, not just allow a subset. Is it possible that you have some variants of Source Code Pro installed locally but not all? When I check in the Font Book app, I have 16 styles available.

The reason I'm thinking this way is that AFAIK if the browser can't get Source Code Pro, it should fall back to your browser's default monospace font:

    font-family: 'Source Code Pro', monospace;

However, I don't know what happens if you do have some but not all of a given font family. I suppose it's unlikely that you've defined your browser's default font as Source Code Pro?

[jrose-signal]

Font Book does not show Source Code Pro installed (or anything with the name "source"). Safari doesn't provide an easy way to set default fonts anymore, so that's not involved either.

Happy to continue helping (I figured from the start this would be pretty low priority!), but I also wonder if it's possible to turn on Lockdown Mode in a macOS VM? I've never tried that. https://mac.getutm.app makes it pretty easy to set up Mac VMs, though it's a slow and space-consuming install process.

[shepmaster]

Heh, I've UTM installed for my Linux needs, so that was easier than anticipated. However, I'm not seeing the same thing:

That clearly has syntax highlighting and bold weights, and the base weight doesn't appear to be as thin as your screenshot.

My setup is very vanilla as I just installed it in the VM 😉

[jrose-signal]

Huh! Definitely a mystery. Another colleague saw the same thing on their machine running a different macOS, so it's not just me, but it definitely kicks things back towards "is Safari somehow finding Source Code Pro". I can at least positively identify that it's Lockdown Mode causing this (and not, say, my ad blocker) by testing the Lockdown Mode x ad blocker matrix, and seeing it consistently fail with Lockdown Mode regardless of whether the ad blocker is on or off (and consistently work otherwise).

[shepmaster]

My tests were with macOS 15.6.1; what about you?

[shepmaster]

Another data point is that my test is rendering with Menlo (monospaced) and Helvetica (otherwise), so it's not downloading any kind of Source Code Pro. This is corroborated by the network tab which shows all webfont resources are blocked.

[jrose-signal]

15.7.1 for me, but running Safari 26.0.1 (i.e. the Tahoe version). And my colleague was fully on macOS 26 (26.0.1). Could very well believe it's a Safari 26 regression…in which case there's a chance it's an Apple bug after all! But if it's an Apple Deliberate Change For Privacy, then the Rust-side issue stands.