openSUSE Build Service

Overview Repositories Revisions Requests Users Attributes Meta

File cups.spec of Package cups.17820

#
# spec file for package cups
#
# Copyright (c) 2021 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.

# Please submit bugfixes or comments via https://bugs.opensuse.org/
#

Name:           cups
BuildRequires:  dbus-1-devel
BuildRequires:  fdupes
BuildRequires:  gcc-c++
BuildRequires:  krb5-devel
BuildRequires:  libavahi-devel
BuildRequires:  libjpeg-devel
BuildRequires:  libpng-devel
BuildRequires:  libtiff-devel
# Have libtool as explicit buildrequirement to no longer depend
# on a "hidden" buildrequirement in the OBS project definition:
BuildRequires:  libtool
# See the comment at 'configure' below why on SLE11 (suse_version = 1110)
# the 'usb' backend must be built without libusb:
%if 0%{?suse_version} > 1110
BuildRequires:  libusb-1_0-devel
%endif
BuildRequires:  openssl-devel
BuildRequires:  pam-devel
BuildRequires:  pkgconfig
# See http://en.opensuse.org/openSUSE:Systemd_packaging_guidelines
# that reads as of this writing (Thu Feb 13 12:20:32 CET 2014)
# where here the RPM macro percentage sign is replaced with '@' to be safe:
#  Starting with openSUSE 12.1, several RPM macros
#  must be used to package systemd services files
#    Build Requirement
#      You should add :
#        @if 0@{?suse_version} >= 1210
#        BuildRequires: systemd
#        @endif
#      as Build Requires.
#    Requires
#      Add
#        @{?systemd_requires}
#      to ensure the needed dependencies are added to your package
%if 0%{?suse_version} >= 1210
BuildRequires:  pkgconfig(libsystemd-daemon)
BuildRequires:  pkgconfig(systemd)
%{?systemd_requires}
%define have_systemd 1
# _tmpfilesdir is not defined in systemd macros up to openSUSE 12.3 and
# in openSUSE 13.1 "rpm --eval @{_tmpfilesdir}" results /usr/lib/tmpfiles.d
# (above the RPM macro percentage sign is replaced with '@' to be safe):
%{!?_tmpfilesdir: %global _tmpfilesdir /usr/lib/tmpfiles.d }
%endif
BuildRequires:  update-desktop-files
BuildRequires:  zlib-devel
PreReq:         coreutils
# /usr/sbin/groupadd is called by the "pre" scriptlet:
PreReq:         /usr/sbin/groupadd
PreReq:         %insserv_prereq
PreReq:         %fillup_prereq
# sysvinit(syslog) is first provided in openSUSE 11.4:
%if 0%{?suse_version} > 1130
PreReq:         sysvinit(syslog)
%endif
URL:            http://www.cups.org/
Summary:        The Common UNIX Printing System
# Source0...Source9 is for sources from upstream:
# URL for Source0: http://www.cups.org/software/1.7.5/cups-1.7.5-source.tar.bz2
# MD5 sum for Source0 on http://www.cups.org/software.php 5d893edc2957005f78e2b2423fdace2e
License:        SUSE-GPL-2.0-with-openssl-exception AND LGPL-2.1-only
Group:          Hardware/Printing
Version:        1.7.5
Release:        0
Source0:        http://www.cups.org/software/%{version}/cups-%{version}-source.tar.bz2
# Require the exact matching version-release of the cups-libs sub-package because
# non-matching CUPS libraries may let CUPS software crash (e.g. segfault)
# because all CUPS software is built from the one same CUPS source tar ball
# so that there are CUPS-internal dependencies via CUPS private API calls
# (which do not happen for third-party software which uses only the CUPS public API).
# The exact matching version-release of the cups-libs sub-package is available
# on the same package repository where the cups package is because
# all are built simulaneously from the same cups source package
# and all required packages are provided on the same repository:
Requires:       cups-libs = %{version}-%{release}
# Require the exact matching version-release of the cups-client sub-package because
# because all CUPS software is built from the one same CUPS source tar ball
# so that there could be whatever subtle CUPS-internal dependencies.
# The exact matching version-release of the cups-client sub-package is available
# on the same package repository where the cups package is because
# all are built simulaneously from the same cups source package
# and all required packages are provided on the same repository:
Requires:       cups-client = %{version}-%{release}
# Since CUPS 1.6 all all non-Mac filters are dropped
# (in particular pdftops, imagetops, imagetoraster, and texttops).
# Linux-specific printing filters for CUPS are now provided by the cups-filters package.
# But those filters are not strictly required for CUPS
# (e.g. on client systems in the network where the filtering hapens on a CUPS server
# or on a CUPS server with only "raw" queues) so that a weak Recommends fits better:
Recommends:     cups-filters
# The Ghostscript device "cups" is needed by several CUPS filters
# (in particular the "rasterto..." filters) which might justify a RPM Requires.
# But a RPM requirement for ghostscript would cause a build dependency cycle because
# cups Requires ghostscript which BuildRequires cups-devel which Requires cups-libs
# and cups-libs is a sub-package of cups so that there is an implicit build dependency
# cycle between the main-packages cups and ghostscript.
# Furthermore Ghostscript is not needed on a system where those CUPS filters are not used
# (e.g. on client systems in the network where the filtering hapens on a CUPS server
# or on a CUPS server with only "raw" queues) so that a weak Recommends fits better:
Recommends:     ghostscript
# Our Source105 PSLEVEL1.PPD.bz2 and Source106 PSLEVEL2.PPD.bz2 need foomatic-rip
# but this does not justify a RPM Requires so that a weak Recommends is sufficient:
Recommends:     foomatic-filters
# Conflicts with CUPS < 1.6 versions because CUPS 1.6 has major incompatible changes,
# see https://bugzilla.novell.com/show_bug.cgi?id=735404
Conflicts:      cups < 1.6
# Conflicts with other print spoolers which provide same binaries like /usr/bin/lp and so on
# or which may listen on the same port (e.g. cups-lpd versus traditional lpd on port 515):
Conflicts:      lprng
Conflicts:      lprold
Conflicts:      plp
# Patch0...Patch9 is for patches from upstream:
# Source10...Source99 is for sources from SUSE which are intended for upstream:
# Patch10...Patch99 is for patches from SUSE which are intended for upstream:
# Patch10 cups-1.2rc1-template.patch adds 'smb://...' URIs to templates/choose-uri.tmpl:
Patch10:        cups-1.2rc1-template.patch
# Patch11 cups-1.4.3-default-webcontent-path.patch changes the default path whereto the
# web content is installed from /usr/share/doc/cups to /usr/share/cups/webcontent
# because the files of the CUPS web content are no documentation, see CUPS STR #3578
# and http://bugzilla.novell.com/show_bug.cgi?id=546023#c6 and subsequent comments:
Patch11:        cups-1.4.3-default-webcontent-path.patch
# Patch12 0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch bsc#955432 -- React properly to avahi's ALL_FOR_NOW signal to reduce unneeded delay
Patch12:        0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
# Patch13 0002-Save-work-on-Avahi-code.patch bsc#955432 -- React properly to avahi's ALL_FOR_NOW signal to reduce unneeded delay
Patch13:        0002-Save-work-on-Avahi-code.patch
# Patch14 0003-Avahi-fixes-for-cupsEnumDests.patch bsc#955432 -- React properly to avahi's ALL_FOR_NOW signal to reduce unneeded delay
Patch14:        0003-Avahi-fixes-for-cupsEnumDests.patch
# Patch15 0004-Fix-authorization-check-for-kerberos-local-connectio.patch
# Fix authorization check for clients (like samba) connected through the
# local socket when Kerberos authentication is enabled (bsc#1050082)
Patch15:        0004-Fix-authorization-check-for-kerberos-local-connectio.patch
# Patch16 Fix UTF-8 validation issue (bsc#1118118, Issue #5509)
Patch16:        issue5509-fix-utf-8-validation-issue.patch
# Source100...Source999 is for private sources from SUSE which are not intended for upstream:
Source101:      cups.init
Source102:      Postscript.ppd.gz
Source103:      cups.sysconfig
Source104:      cups.xinetd
Source105:      Postscript-level1.ppd.gz
Source106:      Postscript-level2.ppd.gz
Source108:      cups-client.conf
Source109:      baselibs.conf
Source110:      cups.service
# Patch100...Patch999 is for private patches from SUSE which are not intended for upstream:
# Patch100 cups-pam.diff adds conf/pam.suse regarding support for PAM for SUSE:
Patch100:       cups-pam.diff
# Patch101 cups-1.7-additional_policies.patch adds the 'allowallforanybody' policy
# to cupsd.conf see https://fate.novell.com/303515
Patch101:       cups-1.7-additional_policies.patch
# Patch102 cups-1.3.9-desktop_file.patch changes desktop/cups.desktop according to what SUSE needs:
Patch102:       cups-1.3.9-desktop_file.patch
# Patch103 cups-1.4-do_not_strip_recommended_from_PPDs.patch
# reverts the change which was added by Michael Sweet in Jan 2007
# which strips the word "recommended" from NickName in PPDs because
# at least yast2-printer in SUSE needs it, compare the
# 'Why not "recommend" PPDs in the NickName?' and the subsequent
# 'RFC: New Driver Rating/Information Attributes' mail thread on cups@easysw.com:
Patch103:       cups-1.4-do_not_strip_recommended_from_PPDs.patch
# Patch104 cups-config-libs.patch fixes option --libs in cups-config script:
Patch104:       cups-config-libs.patch
# Patch105 was str4351.patch that fixed STR #4351: cups-lpd hugh jobs (>2G) fail
# is obsolete because it is fixed upstream since CUPS 1.7.2
# Patch106 str4551.CVE-2014-9679.CUPS-1.7.5.patch is the upstream patch
# https://www.cups.org/strfiles.php/3438/str4551.patch
# backported to CUPS-1.7.5
# that fixes a possible buffer overflow in filter/raster.c
# (CUPS STR#4551 CVE-2014-9679 bugzilla.suse.com bsc#917799):
Patch106:       str4551.CVE-2014-9679.CUPS-1.7.5.patch
# Patch107 str4609.CERT-VU-810572.CUPS-1.7.5.patch is the upstream patch
# https://www.cups.org/strfiles.php/3480/str4609-1.7.patch
# adapted to fit exactly for CUPS-1.7.5
# that fixes a possible privilege escalation via cross-site scripting
# and bad print job submission used to replace cupsd.conf on server
# plus possible bad ld.so interaction via dynamic linker variables
# (CUPS STR#4609 CERT-VU-810572 CVE-2015-1158 CVE-2015-1159 bugzilla.suse.com bsc#924208):
Patch107:       str4609.CERT-VU-810572.CUPS-1.7.5.patch
# Patch108 add_gziptoany_filter_when_raw_printing_multiple_files_GitHub4782.patch
# is the upstream patch part for scheduler/job.c from
# https://github.com/apple/cups/commit/f62664600159820a136a6e726a01a598b9ea292e
# adapted to fit exactly for CUPS-1.7.5
# that fixes raw printing multiple files by adding the gziptoany filter see
# https://github.com/apple/cups/issues/4782
# (bsc#968706)
Patch108:       add_gziptoany_filter_when_raw_printing_multiple_files_GitHub4782.patch
# Patch109 cups-lpd_remove_adding_docname_GitHub4790.patch
# is an excerpt from the upstream patch part for scheduler/cups-lpd.c from
# https://github.com/apple/cups/commit/4cc64a80fd01016eb5c3b62b754fc684d87bfb89
# that avoids warnings in error_log of the form
#  "Unexpected 'document-name' operation attribute in a Create-Job request." see
# https://github.com/apple/cups/issues/4790
# (SUSE Service Request 10994025138)
Patch109:       cups-lpd_remove_adding_docname_GitHub4790.patch
# Patch110 cups-scheduler_logs_jobs_at_loglevel_info.patch is based on the upstream patch
# https://github.com/apple/cups/commit/75c86da7a721554caea2dcc22a2f84b2fff465e8
# so that the scheduler now also logs messages for jobs at LogLevel "info" see
# https://github.com/apple/cups/issues/4815
# and bsc#1021133 and bsc#990045
Patch110:       cups-scheduler_logs_jobs_at_loglevel_info.patch
# Patch111 CVE-2017-18190.patch removes localhost.localdomain from list
# of trustworthy hosts in scheduler/client.c to avoid arbitrary IPP
# command execution in conjunction with DNS rebinding (CVE-2017-18190 bsc#1081557).
Patch111:       CVE-2017-18190.patch
# Patch112 Patch113 Patch114
#   DBUS-notifications-could-crash-the-scheduler-Issue-5.patch
#   ipp-The-scheduler-now-substitutes-default-values-for-inv.patch
#   ipp-additional-changes-for-the-scheduler-to-substitute-d.patch
# fix bsc#1061066
#   DBUS library aborts caller process in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
# which are the CUPS upstream issues
# https://github.com/apple/cups/issues/5143
#   Remote DoS attack against cupsd via invalid username and malicious D-Bus library
# https://github.com/apple/cups/issues/5186
#   squash non-UTF-8 strings into ASCII on plain IPP level
# https://github.com/apple/cups/issues/5229
#   persistently substitute invalid job attributes with default values - not only in add_job
Patch112:       DBUS-notifications-could-crash-the-scheduler-Issue-5.patch
Patch113:       ipp-The-scheduler-now-substitutes-default-values-for-inv.patch
Patch114:       ipp-additional-changes-for-the-scheduler-to-substitute-d.patch
# Patch115 cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954-for-cups-1.7.5-stripped.diff
# is derived from https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
# and stripped down to only what is needed for CUPS 1.7.5
# that fixes local privilege escalation to root and sandbox bypasses in scheduler
# (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581)
# bsc#1096405 CVE-2018-4180: cups: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
# bsc#1096406 CVE-2018-4181: cups: Limited Local File Reads as Root via cupsd.conf Include Directive
# bsc#1096407 CVE-2018-4182: cups: cups-exec Sandbox Bypass Due to Insecure Error Handling
# bsc#1096408 CVE-2018-4183: cups: cups-exec Sandbox Bypass Due to Profile Misconfiguration
Patch115:       cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954-for-cups-1.7.5-stripped.diff
# Patch116 cups-2.2.7-CVE-2018-4700.patch from SLE15 also applies to cups-1.7.5 in SLE12 and fixes
# CVE-2018-4700: session cookie is extremely predictable, effectively
# breaking the CSRF protection of the CUPS web interface
# https://bugzilla.suse.com/show_bug.cgi?id=1115750 (bsc#1115750):
Patch116:       cups-2.2.7-CVE-2018-4700.patch
# Patch117 cups-1.7.5-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696
# bsc#1146358 CVE-2019-8675: cups: stack-buffer-overflow in libcups's asn1_get_type function
# bsc#1146359 CVE-2019-8696: cups: stack-buffer-overflow in libcups's asn1_get_packed function
# and some other security/disclosure issues in
# https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
# except scheduler/client.c where the cups-1.7.5 code is too different
Patch117:       cups-1.7.5-CVE-2019-8675.CVE-2019-8696.patch
# Patch118 cups-1.7.5-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
# heap-buffer-overflow in libcups ppdFindOption() function
Patch118:       cups-1.7.5-CVE-2020-3898.patch
# Patch119 cups-1.7.5-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
# the ippReadIO function may under-read an extension field
Patch119:       cups-1.7.5-CVE-2019-8842.patch
# Patch120 cups-1.7.5-CVE-2020-10001.patch fixes CVE-2020-10001 (bsc#1180520)
# access to uninitialized buffer in ipp.c
Patch120:       cups-1.7.5-CVE-2020-10001.patch
# Install into this non-root directory (required when norootforbuild is used):
BuildRoot:      %{_tmppath}/%{name}-%{version}-build

%description
The Common UNIX Printing System (CUPS) is the
standards-based, open source printing system.

See http://www.cups.org