[Buildroot] [PATCH 1/4] package/qpdf: bump to version 11.9.1

[Buildroot] [PATCH 1/4] package/qpdf: bump to version 11.9.1

[James Hilliard]

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
 package/qpdf/qpdf.hash |  4 ++--
 package/qpdf/qpdf.mk   | 31 ++++++++++++++++++++++++-------
 2 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/package/qpdf/qpdf.hash b/package/qpdf/qpdf.hash
index 08a048f2ed..0dc3a1212d 100644
--- a/package/qpdf/qpdf.hash
+++ b/package/qpdf/qpdf.hash
@@ -1,5 +1,5 @@
-# From https://sourceforge.net/projects/qpdf/files/qpdf/10.5.0/qpdf-10.5.0.sha256/download
-sha256  88257d36a44fd5c50b2879488324dd9cafc11686ae49d8c4922a4872203ce006  qpdf-10.5.0.tar.gz
+# From https://sourceforge.net/projects/qpdf/files/qpdf/11.9.1/qpdf-11.9.1.sha256/download
+sha256  2ba4d248f9567a27c146b9772ef5dc93bd9622317978455ffe91b259340d13d1  qpdf-11.9.1.tar.gz
 # Locally computed:
 sha256  cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30  LICENSE.txt
 sha256  fb929ac30decb4dc3a2eea2bec6c43296a797c5d2d602deb3784ee39430583d5  Artistic-2.0
diff --git a/package/qpdf/qpdf.mk b/package/qpdf/qpdf.mk
index d479515789..4b64e419c2 100644
--- a/package/qpdf/qpdf.mk
+++ b/package/qpdf/qpdf.mk
@@ -4,36 +4,53 @@
 #
 ################################################################################
 
-QPDF_VERSION = 10.5.0
+QPDF_VERSION = 11.9.1
 QPDF_SITE = http://downloads.sourceforge.net/project/qpdf/qpdf/$(QPDF_VERSION)
 QPDF_INSTALL_STAGING = YES
+QPDF_SUPPORTS_IN_SOURCE_BUILD = NO
 QPDF_LICENSE = Apache-2.0 or Artistic-2.0
 QPDF_LICENSE_FILES = LICENSE.txt Artistic-2.0
 QPDF_CPE_ID_VALID = YES
 QPDF_DEPENDENCIES = host-pkgconf zlib jpeg
 
-QPDF_CONF_OPTS = --with-random=/dev/urandom
+QPDF_CONF_OPTS = \
+	-DBUILD_DOC=OFF \
+	-DENABLE_COVERAGE=OFF \
+	-DQTEST_COLOR=OFF \
+	-DINSTALL_EXAMPLES=OFF
+
+ifeq ($(BR2_SHARED_LIBS)$(BR2_SHARED_STATIC_LIBS),y)
+QPDF_CONF_OPTS += -DBUILD_SHARED_LIBS=ON
+else
+QPDF_CONF_OPTS += -DBUILD_SHARED_LIBS=OFF
+endif
+
+ifeq ($(BR2_STATIC_LIBS)$(BR2_SHARED_STATIC_LIBS),y)
+QPDF_CONF_OPTS += -DBUILD_STATIC_LIBS=ON
+else
+QPDF_CONF_OPTS += -DBUILD_STATIC_LIBS=OFF
+endif
 
 ifeq ($(BR2_USE_WCHAR),)
 QPDF_CONF_ENV += CXXFLAGS="$(TARGET_CXXFLAGS) -DQPDF_NO_WCHAR_T"
 endif
 
 ifeq ($(BR2_PACKAGE_GNUTLS),y)
-QPDF_CONF_OPTS += --enable-crypto-gnutls
+QPDF_CONF_OPTS += -DREQUIRE_CRYPTO_GNUTLS=ON
 QPDF_DEPENDENCIES += gnutls
 else
-QPDF_CONF_OPTS += --disable-crypto-gnutls
+QPDF_CONF_OPTS += -DREQUIRE_CRYPTO_GNUTLS=OFF
 endif
 
 ifeq ($(BR2_PACKAGE_OPENSSL),y)
-QPDF_CONF_OPTS += --enable-crypto-openssl
+QPDF_CONF_OPTS += -DREQUIRE_CRYPTO_OPENSSL=ON
 QPDF_DEPENDENCIES += openssl
 else
-QPDF_CONF_OPTS += --disable-crypto-openssl
+QPDF_CONF_OPTS += -DREQUIRE_CRYPTO_OPENSSL=OFF
 endif
 
 ifeq ($(BR2_TOOLCHAIN_HAS_LIBATOMIC),y)
 QPDF_CONF_ENV += LIBS=-latomic
 endif
 
-$(eval $(autotools-package))
+$(eval $(cmake-package))
-- 
2.34.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 2/4] package/libcupsfilters: new package

[James Hilliard]

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
 package/Config.in                          |  1 +
 package/libcupsfilters/Config.in           | 26 +++++++++
 package/libcupsfilters/libcupsfilters.hash |  4 ++
 package/libcupsfilters/libcupsfilters.mk   | 65 ++++++++++++++++++++++
 4 files changed, 96 insertions(+)
 create mode 100644 package/libcupsfilters/Config.in
 create mode 100644 package/libcupsfilters/libcupsfilters.hash
 create mode 100644 package/libcupsfilters/libcupsfilters.mk

diff --git a/package/Config.in b/package/Config.in
index e1ceb81dc0..e0afe0f28b 100644
--- a/package/Config.in
+++ b/package/Config.in
@@ -2020,6 +2020,7 @@ menu "Networking"
 	source "package/libcgicc/Config.in"
 	source "package/libcoap/Config.in"
 	source "package/libcpprestsdk/Config.in"
+	source "package/libcupsfilters/Config.in"
 	source "package/libcurl/Config.in"
 	source "package/libdnet/Config.in"
 	source "package/libeXosip2/Config.in"
diff --git a/package/libcupsfilters/Config.in b/package/libcupsfilters/Config.in
new file mode 100644
index 0000000000..1d2addda95
--- /dev/null
+++ b/package/libcupsfilters/Config.in
@@ -0,0 +1,26 @@
+config BR2_PACKAGE_LIBCUPSFILTERS
+	bool "libcupsfilters"
+	# needs fork()
+	depends on BR2_USE_MMU
+	depends on BR2_INSTALL_LIBSTDCPP # qpdf
+	depends on !BR2_STATIC_LIBS
+	depends on BR2_PACKAGE_CUPS
+	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_5 # qpdf
+	depends on BR2_TOOLCHAIN_HAS_ATOMIC # qpdf
+	select BR2_PACKAGE_JPEG
+	select BR2_PACKAGE_FONTCONFIG
+	select BR2_PACKAGE_LCMS2
+	select BR2_PACKAGE_QPDF
+	help
+	  This package provides the libcupsfilters library, which in its
+	  2.x version contains all the code of the filters of the former
+	  cups-filters package as library functions, the so-called
+	  filter functions.
+
+	  https://github.com/OpenPrinting/libcupsfilters
+
+comment "libcupsfilters needs a toolchain w/ C++ and dynamic library, gcc >= 5"
+	depends on BR2_USE_MMU
+	depends on BR2_TOOLCHAIN_HAS_ATOMIC
+	depends on !BR2_INSTALL_LIBSTDCPP || \
+		BR2_STATIC_LIBS || !BR2_TOOLCHAIN_GCC_AT_LEAST_5
diff --git a/package/libcupsfilters/libcupsfilters.hash b/package/libcupsfilters/libcupsfilters.hash
new file mode 100644
index 0000000000..b8cc8348db
--- /dev/null
+++ b/package/libcupsfilters/libcupsfilters.hash
@@ -0,0 +1,4 @@
+# Locally computed:
+sha256  542f2bfbc58136a4743c11dc8c86cee03c9aca705612654e36ac34aa0d9aa601  libcupsfilters-2.0.0.tar.xz
+sha256  78cf92bd6a800263e865dcb3ea764cc3b0f7759d9a0bf3a0fb1253aacd1a1199  COPYING
+sha256  cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30  LICENSE
diff --git a/package/libcupsfilters/libcupsfilters.mk b/package/libcupsfilters/libcupsfilters.mk
new file mode 100644
index 0000000000..7c2d3ca5cf
--- /dev/null
+++ b/package/libcupsfilters/libcupsfilters.mk
@@ -0,0 +1,65 @@
+################################################################################
+#
+# libcupsfilters
+#
+################################################################################
+
+LIBCUPSFILTERS_VERSION = 2.0.0
+LIBCUPSFILTERS_SOURCE = libcupsfilters-$(LIBCUPSFILTERS_VERSION).tar.xz
+LIBCUPSFILTERS_SITE = https://github.com/OpenPrinting/libcupsfilters/releases/download/$(LIBCUPSFILTERS_VERSION)
+LIBCUPSFILTERS_LICENSE = Apache-2.0 with GPL-2.0/LGPL-2.0 exception
+LIBCUPSFILTERS_LICENSE_FILES = COPYING LICENSE
+LIBCUPSFILTERS_INSTALL_STAGING = YES
+LIBCUPSFILTERS_DEPENDENCIES = cups lcms2 qpdf fontconfig jpeg
+
+LIBCUPSFILTERS_CONF_OPTS = \
+	--disable-mutool \
+	--enable-imagefilters \
+	--with-cups-config=$(STAGING_DIR)/usr/bin/cups-config \
+	--with-sysroot=$(STAGING_DIR) \
+	--with-jpeg \
+	--with-test-font-path=/dev/null
+
+ifeq ($(BR2_PACKAGE_LIBPNG),y)
+LIBCUPSFILTERS_CONF_OPTS += --with-png
+LIBCUPSFILTERS_DEPENDENCIES += libpng
+else
+LIBCUPSFILTERS_CONF_OPTS += --without-png
+endif
+
+ifeq ($(BR2_PACKAGE_TIFF),y)
+LIBCUPSFILTERS_CONF_OPTS += --with-tiff
+LIBCUPSFILTERS_DEPENDENCIES += tiff
+else
+LIBCUPSFILTERS_CONF_OPTS += --without-tiff
+endif
+
+ifeq ($(BR2_PACKAGE_DBUS),y)
+LIBCUPSFILTERS_CONF_OPTS += --enable-dbus
+LIBCUPSFILTERS_DEPENDENCIES += dbus
+else
+LIBCUPSFILTERS_CONF_OPTS += --disable-dbus
+endif
+
+ifeq ($(BR2_PACKAGE_GHOSTSCRIPT),y)
+LIBCUPSFILTERS_DEPENDENCIES += ghostscript
+LIBCUPSFILTERS_CONF_OPTS += --enable-ghostscript
+else
+LIBCUPSFILTERS_CONF_OPTS += --disable-ghostscript
+endif
+
+ifeq ($(BR2_PACKAGE_POPPLER),y)
+LIBCUPSFILTERS_DEPENDENCIES += poppler
+LIBCUPSFILTERS_CONF_OPTS += --enable-poppler
+else
+LIBCUPSFILTERS_CONF_OPTS += --disable-poppler
+endif
+
+ifeq ($(BR2_PACKAGE_LIBEXIF),y)
+LIBCUPSFILTERS_CONF_OPTS += --enable-exif
+LIBCUPSFILTERS_DEPENDENCIES += libexif
+else
+LIBCUPSFILTERS_CONF_OPTS += --disable-exif
+endif
+
+$(eval $(autotools-package))
-- 
2.34.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 2/4] package/libcupsfilters: new package

[Peter Korsgaard]

>>>>> "James" == James Hilliard <james.hilliard1@gmail.com> writes:

 > Signed-off-by: James Hilliard <james.hilliard1@gmail.com>

We should probably use version 2.1b1 instead (or backport the fix) given
the vulnerability:

https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 2/4] package/libcupsfilters: new package

[James Hilliard]

[-- Attachment #1.1: Type: text/plain, Size: 519 bytes --]

On Tue, Oct 1, 2024, 2:16 PM Peter Korsgaard <peter@korsgaard.com> wrote:

> >>>>> "James" == James Hilliard <james.hilliard1@gmail.com> writes:
>
>  > Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
>
> We should probably use version 2.1b1 instead (or backport the fix) given
> the vulnerability:
>
>
> https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5


Maybe best to merge for now and backport if a final release doesn't show up
soon?


>
> --
> Bye, Peter Korsgaard
>

[-- Attachment #1.2: Type: text/html, Size: 1418 bytes --]

[-- Attachment #2: Type: text/plain, Size: 150 bytes --]

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 2/4] package/libcupsfilters: new package

[Peter Korsgaard]

>>>>> "James" == James Hilliard <james.hilliard1@gmail.com> writes:

 > On Tue, Oct 1, 2024, 2:16 PM Peter Korsgaard <peter@korsgaard.com> wrote:
 >> >>>>> "James" == James Hilliard <james.hilliard1@gmail.com> writes:
 >> 
 >> > Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
 >> 
 >> We should probably use version 2.1b1 instead (or backport the fix) given
 >> the vulnerability:
 >> 
 >> 
 >> https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5


 > Maybe best to merge for now and backport if a final release doesn't show up
 > soon?

Is that backport something you would be interested in doing? I would
mainly do the cups-filters bump to fix the security vulnerability, so it
is not great to add two other vulnerabilities while we do that.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 2/4] package/libcupsfilters: new package

[James Hilliard]

[-- Attachment #1.1: Type: text/plain, Size: 1232 bytes --]

On Wed, Oct 2, 2024 at 12:07 AM Peter Korsgaard <peter@korsgaard.com> wrote:

> >>>>> "James" == James Hilliard <james.hilliard1@gmail.com> writes:
>
>  > On Tue, Oct 1, 2024, 2:16 PM Peter Korsgaard <peter@korsgaard.com>
> wrote:
>  >> >>>>> "James" == James Hilliard <james.hilliard1@gmail.com> writes:
>  >>
>  >> > Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
>  >>
>  >> We should probably use version 2.1b1 instead (or backport the fix)
> given
>  >> the vulnerability:
>  >>
>  >>
>  >>
> https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5
>
>
>  > Maybe best to merge for now and backport if a final release doesn't
> show up
>  > soon?
>
> Is that backport something you would be interested in doing? I would
> mainly do the cups-filters bump to fix the security vulnerability, so it
> is not great to add two other vulnerabilities while we do that.
>

Yeah, I could do that or bump it once merged, I was just trying to keep this
series as small as possible since I'm not great at managing larger patch
series,
I try to keep patches separate when possible so I started with a minimal
version
bump.


>
> --
> Bye, Peter Korsgaard
>

[-- Attachment #1.2: Type: text/html, Size: 2256 bytes --]

[-- Attachment #2: Type: text/plain, Size: 150 bytes --]

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 2/4] package/libcupsfilters: new package

[Thomas Petazzoni via buildroot]

On Tue, 1 Oct 2024 14:49:58 -0600
James Hilliard <james.hilliard1@gmail.com> wrote:

> > https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5  
> 
> Maybe best to merge for now and backport if a final release doesn't show up
> soon?

Version 2.1.0 has been released in the mean time. I wanted to integrate
this, but it depends on the qpdf bump, which has issues.

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 3/4] package/libppd: new package

[James Hilliard]

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
 package/Config.in          |  1 +
 package/libppd/Config.in   | 23 +++++++++++++++++++++++
 package/libppd/libppd.hash |  4 ++++
 package/libppd/libppd.mk   | 35 +++++++++++++++++++++++++++++++++++
 4 files changed, 63 insertions(+)
 create mode 100644 package/libppd/Config.in
 create mode 100644 package/libppd/libppd.hash
 create mode 100644 package/libppd/libppd.mk

diff --git a/package/Config.in b/package/Config.in
index e0afe0f28b..68b313996f 100644
--- a/package/Config.in
+++ b/package/Config.in
@@ -2065,6 +2065,7 @@ menu "Networking"
 	source "package/libpagekite/Config.in"
 	source "package/libpcap/Config.in"
 	source "package/libpjsip/Config.in"
+	source "package/libppd/Config.in"
 	source "package/libpsl/Config.in"
 	source "package/librelp/Config.in"
 	source "package/librsync/Config.in"
diff --git a/package/libppd/Config.in b/package/libppd/Config.in
new file mode 100644
index 0000000000..5e59b81fdb
--- /dev/null
+++ b/package/libppd/Config.in
@@ -0,0 +1,23 @@
+config BR2_PACKAGE_LIBPPD
+	bool "libppd"
+	# needs fork()
+	depends on BR2_USE_MMU
+	depends on BR2_INSTALL_LIBSTDCPP # libcupsfilters -> qpdf
+	depends on !BR2_STATIC_LIBS
+	depends on BR2_PACKAGE_CUPS
+	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_5 # libcupsfilters -> qpdf
+	depends on BR2_TOOLCHAIN_HAS_ATOMIC # libcupsfilters -> qpdf
+	select BR2_PACKAGE_LIBCUPSFILTERS
+	help
+	  To avoid re-writing support for an obsolete format from
+	  scratch, only for retro-fitting legacy printer drivers
+	  we have created this package, libppd, the legacy support
+	  library for PPD files.
+
+	  https://github.com/OpenPrinting/libppd
+
+comment "libppd needs a toolchain w/ C++ and dynamic library, gcc >= 5"
+	depends on BR2_USE_MMU
+	depends on BR2_TOOLCHAIN_HAS_ATOMIC
+	depends on !BR2_INSTALL_LIBSTDCPP || \
+		BR2_STATIC_LIBS || !BR2_TOOLCHAIN_GCC_AT_LEAST_5
diff --git a/package/libppd/libppd.hash b/package/libppd/libppd.hash
new file mode 100644
index 0000000000..ee32f11bbe
--- /dev/null
+++ b/package/libppd/libppd.hash
@@ -0,0 +1,4 @@
+# Locally computed:
+sha256  882d3c659a336e91559de8f3c76fc26197fe6e5539d9b484a596e29a5a4e0bc8  libppd-2.0.0.tar.xz
+sha256  dc67c986b28ffbea80cb508622355213e2227fe854b43b1f1092e36087829c28  COPYING
+sha256  cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30  LICENSE
diff --git a/package/libppd/libppd.mk b/package/libppd/libppd.mk
new file mode 100644
index 0000000000..59478340b4
--- /dev/null
+++ b/package/libppd/libppd.mk
@@ -0,0 +1,35 @@
+################################################################################
+#
+# libppd
+#
+################################################################################
+
+LIBPPD_VERSION = 2.0.0
+LIBPPD_SOURCE = libppd-$(LIBPPD_VERSION).tar.xz
+LIBPPD_SITE = https://github.com/OpenPrinting/libppd/releases/download/$(LIBPPD_VERSION)
+LIBPPD_LICENSE = Apache-2.0 with GPL-2.0/LGPL-2.0 exception
+LIBPPD_LICENSE_FILES = COPYING LICENSE
+LIBPPD_INSTALL_STAGING = YES
+LIBPPD_DEPENDENCIES = cups libcupsfilters
+
+LIBPPD_CONF_OPTS = \
+	--disable-mutool \
+	--with-cups-config=$(STAGING_DIR)/usr/bin/cups-config \
+	--with-sysroot=$(STAGING_DIR) \
+	--with-pdftops=pdftops
+
+ifeq ($(BR2_PACKAGE_GHOSTSCRIPT),y)
+LIBPPD_DEPENDENCIES += ghostscript
+LIBPPD_CONF_OPTS += --enable-ghostscript
+else
+LIBPPD_CONF_OPTS += --disable-ghostscript
+endif
+
+ifeq ($(BR2_PACKAGE_POPPLER),y)
+LIBPPD_DEPENDENCIES += poppler
+LIBPPD_CONF_OPTS += --enable-pdftops
+else
+LIBPPD_CONF_OPTS += --disable-pdftops
+endif
+
+$(eval $(autotools-package))
-- 
2.34.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 3/4] package/libppd: new package

[Peter Korsgaard]

>>>>> "James" == James Hilliard <james.hilliard1@gmail.com> writes:

 > Signed-off-by: James Hilliard <james.hilliard1@gmail.com>

Same here, we should use 2.1b1 or backport the fix for:

https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 4/4] package/cups-filters: bump to version 2.0.1

[James Hilliard]

Drop patch which is now upstream.

Project relicensed to Apache-2.0 with GPL-2.0/LGPL-2.0 exception:
https://github.com/OpenPrinting/cups-filters/commit/14f11135d8aa25050e8627354b2c1f9984f7e3a3

Add new libcupsfilters dependency.

Add new libppd dependency.

Drop no longer required libglib2 dependency.

Drop no longer required lcms2 dependency.

Drop no longer required qpdf dependency.

Drop no longer required fontconfig dependency.

Drop no longer required freetype dependency.

Drop no longer required jpeg dependency.

Add new --enable-pstops config option.

Add new --enable-rastertopwg config option.

Add new --with-shell=/bin/sh config option.

Remove no longer supported --disable-braille config option.

Remove no longer supported --with-pdftops config option.

Remove no longer supported --with-jpeg config option.

Remove no longer supported --with-test-font-path config option.

Remove no longer supported --without-rcdir config option.

Remove no longer supported --with-png config option and dependency.

Remove no longer supported --with-tiff config option and dependency.

Remove no longer supported --enable-dbus config option and dependency.

Remove no longer supported --enable-avahi config option and
dependency.

Remove no longer supported --enable-ijs config option and dependency.

Remove no longer supported --enable-exif config option and dependency.

Remove cups-browsed service installation as cups-browsed is no longer
part of cups-filters.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
 ...ecv-instead-of-system-CVE-2023-24805.patch | 208 ------------------
 package/cups-filters/Config.in                |  23 +-
 package/cups-filters/S82cups-browsed          |  48 ----
 package/cups-filters/cups-filters.hash        |   5 +-
 package/cups-filters/cups-filters.mk          |  74 +------
 5 files changed, 20 insertions(+), 338 deletions(-)
 delete mode 100644 package/cups-filters/0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
 delete mode 100644 package/cups-filters/S82cups-browsed

diff --git a/package/cups-filters/0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch b/package/cups-filters/0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
deleted file mode 100644
index e527b20f91..0000000000
--- a/package/cups-filters/0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
+++ /dev/null
@@ -1,208 +0,0 @@
-From 93e60d3df358c0ae6f3dba79e1c9684657683d89 Mon Sep 17 00:00:00 2001
-From: Till Kamppeter <till.kamppeter@gmail.com>
-Date: Wed, 17 May 2023 11:11:29 +0200
-Subject: [PATCH] beh backend: Use execv() instead of system() - CVE-2023-24805
-
-With execv() command line arguments are passed as separate strings and
-not the full command line in a single string. This prevents arbitrary
-command execution by escaping the quoting of the arguments in a job
-with a forged job title.
-
-In addition, done the following fixes and improvements:
-
-- Do not allow '/' in the scheme of the URI (= backend executable
-  name), to assure that only backends inside /usr/lib/cups/backend/
-  are used.
-
-- URI must have ':', to split off scheme, otherwise error out.
-
-- Check return value of snprintf() to create call path for backend, to
-  error out on truncation of a too long scheme or on complete failure
-  due to a completely odd scheme.
-
-- Use strncat() instead of strncpy() for getting scheme from URI, the latter
-  does not require setting terminating zero byte in case of truncation.
-
-- Also exclude "." or ".." as scheme, as directories are not valid CUPS
-  backends.
-
-- Do not use fprintf() in sigterm_handler(), to not interfere with a
-  fprintf() which could be running in the main process when
-  sigterm_handler() is triggered.
-
-- Use "static volatile int" for global variable job_canceled.
-
-Upstream: https://github.com/OpenPrinting/cups-filters/commit/93e60d3df358c0ae6f3dba79e1c9684657683d89
-Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
----
- backend/beh.c | 107 +++++++++++++++++++++++++++++++++++++++-----------
- 1 file changed, 84 insertions(+), 23 deletions(-)
-
-diff --git a/backend/beh.c b/backend/beh.c
-index 225fd27d5..8d51235b1 100644
---- a/backend/beh.c
-+++ b/backend/beh.c
-@@ -22,12 +22,13 @@
- #include "backend-private.h"
- #include <cups/array.h>
- #include <ctype.h>
-+#include <sys/wait.h>
- 
- /*
-  * Local globals...
-  */
- 
--static int		job_canceled = 0; /* Set to 1 on SIGTERM */
-+static volatile int	job_canceled = 0; /* Set to 1 on SIGTERM */
- 
- /*
-  * Local functions...
-@@ -213,21 +214,40 @@ call_backend(char *uri,                 /* I - URI of final destination */
- 	     char **argv,		/* I - Command-line arguments */
- 	     char *filename) {          /* I - File name of input data */
-   const char	*cups_serverbin;	/* Location of programs */
-+  char          *backend_argv[8];	/* Arguments for backend */
-   char		scheme[1024],           /* Scheme from URI */
-                 *ptr,			/* Pointer into scheme */
--		cmdline[65536];		/* Backend command line */
--  int           retval;
-+		backend_path[2048];	/* Backend path */
-+  int           pid = 0, 		/* Process ID of backend */
-+                wait_pid,		/* Process ID from wait() */
-+                wait_status, 		/* Status from child */
-+                retval = 0;
-+  int           bytes;
- 
-  /*
-   * Build the backend command line...
-   */
- 
--  strncpy(scheme, uri, sizeof(scheme) - 1);
--  if (strlen(uri) > 1023)
--    scheme[1023] = '\0';
-+  scheme[0] = '\0';
-+  strncat(scheme, uri, sizeof(scheme) - 1);
-   if ((ptr = strchr(scheme, ':')) != NULL)
-     *ptr = '\0';
--
-+  else {
-+    fprintf(stderr,
-+	    "ERROR: beh: Invalid URI, no colon (':') to mark end of scheme part.\n");
-+    exit (CUPS_BACKEND_FAILED);
-+  }
-+  if (strchr(scheme, '/')) {
-+    fprintf(stderr,
-+	    "ERROR: beh: Invalid URI, scheme contains a slash ('/').\n");
-+    exit (CUPS_BACKEND_FAILED);
-+  }
-+  if (!strcmp(scheme, ".") || !strcmp(scheme, "..")) {
-+    fprintf(stderr,
-+	    "ERROR: beh: Invalid URI, scheme (\"%s\") is a directory.\n",
-+	    scheme);
-+    exit (CUPS_BACKEND_FAILED);
-+  }
-   if ((cups_serverbin = getenv("CUPS_SERVERBIN")) == NULL)
-     cups_serverbin = CUPS_SERVERBIN;
- 
-@@ -235,16 +255,29 @@ call_backend(char *uri,                 /* I - URI of final destination */
-     fprintf(stderr,
- 	    "ERROR: beh: Direct output into a file not supported.\n");
-     exit (CUPS_BACKEND_FAILED);
--  } else
--    snprintf(cmdline, sizeof(cmdline),
--	     "%s/backend/%s '%s' '%s' '%s' '%s' '%s' %s",
--	     cups_serverbin, scheme, argv[1], argv[2], argv[3],
--	     /* Apply number of copies only if beh was called with a
--		file name and not with the print data in stdin, as
--	        backends should handle copies only if they are called
--	        with a file name */
--	     (argc == 6 ? "1" : argv[4]),
--	     argv[5], filename);
-+  }
-+
-+  backend_argv[0] = uri;
-+  backend_argv[1] = argv[1];
-+  backend_argv[2] = argv[2];
-+  backend_argv[3] = argv[3];
-+  /* Apply number of copies only if beh was called with a file name
-+     and not with the print data in stdin, as backends should handle
-+     copies only if they are called with a file name */
-+  backend_argv[4] = (argc == 6 ? "1" : argv[4]);
-+  backend_argv[5] = argv[5];
-+  backend_argv[6] = filename;
-+  backend_argv[7] = NULL;
-+
-+  bytes = snprintf(backend_path, sizeof(backend_path),
-+		   "%s/backend/%s", cups_serverbin, scheme);
-+  if (bytes < 0 || bytes >= sizeof(backend_path))
-+  {
-+    fprintf(stderr,
-+	    "ERROR: beh: Invalid scheme (\"%s\"), could not determing backend path.\n",
-+	    scheme);
-+    return (CUPS_BACKEND_FAILED);
-+  }
- 
-  /*
-   * Overwrite the device URI and run the actual backend...
-@@ -253,18 +286,44 @@ call_backend(char *uri,                 /* I - URI of final destination */
-   setenv("DEVICE_URI", uri, 1);
- 
-   fprintf(stderr,
--	  "DEBUG: beh: Executing backend command line \"%s\"...\n",
--	  cmdline);
-+	  "DEBUG: beh: Executing backend command line \"%s '%s' '%s' '%s' '%s' '%s' %s\"...\n",
-+	  backend_path, backend_argv[1], backend_argv[2], backend_argv[3],
-+	  backend_argv[4], backend_argv[5], backend_argv[6]);
-   fprintf(stderr,
- 	  "DEBUG: beh: Using device URI: %s\n",
- 	  uri);
- 
--  retval = system(cmdline) >> 8;
-+  if ((pid = fork()) == 0) {
-+   /*
-+    * Child comes here...
-+    */
-+
-+    /* Run the backend */
-+    execv(backend_path, backend_argv);
- 
--  if (retval == -1)
-     fprintf(stderr, "ERROR: Unable to execute backend command line: %s\n",
- 	    strerror(errno));
- 
-+    exit(1);
-+  } else if (pid < 0) {
-+   /*
-+    * Unable to fork!
-+    */
-+
-+    return (CUPS_BACKEND_FAILED);
-+  }
-+
-+  while ((wait_pid = wait(&wait_status)) < 0 && errno == EINTR);
-+
-+  if (wait_pid >= 0 && wait_status) {
-+    if (WIFEXITED(wait_status))
-+      retval = WEXITSTATUS(wait_status);
-+    else if (WTERMSIG(wait_status) != SIGTERM)
-+      retval = WTERMSIG(wait_status);
-+    else
-+      retval = 0;
-+  }
-+
-   return (retval);
- }
- 
-@@ -277,8 +336,10 @@ static void
- sigterm_handler(int sig) {		/* I - Signal number (unused) */
-   (void)sig;
- 
--  fprintf(stderr,
--	  "DEBUG: beh: Job canceled.\n");
-+  const char * const msg = "DEBUG: beh: Job canceled.\n";
-+  /* The if() is to eliminate the return value and silence the warning
-+     about an unused return value. */
-+  if (write(2, msg, strlen(msg)));
- 
-   if (job_canceled)
-     _exit(CUPS_BACKEND_OK);
diff --git a/package/cups-filters/Config.in b/package/cups-filters/Config.in
index ded99a4774..c65265b0d8 100644
--- a/package/cups-filters/Config.in
+++ b/package/cups-filters/Config.in
@@ -2,19 +2,13 @@ config BR2_PACKAGE_CUPS_FILTERS
 	bool "cups-filters"
 	# needs fork()
 	depends on BR2_USE_MMU
-	depends on BR2_INSTALL_LIBSTDCPP # qpdf
+	depends on BR2_INSTALL_LIBSTDCPP # libcupsfilters -> qpdf
 	depends on !BR2_STATIC_LIBS
-	depends on BR2_USE_WCHAR # libglib2
-	depends on BR2_TOOLCHAIN_HAS_THREADS # libglib2
 	depends on BR2_PACKAGE_CUPS
-	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_5 # qpdf
-	depends on BR2_TOOLCHAIN_HAS_ATOMIC # qpdf
-	select BR2_PACKAGE_JPEG
-	select BR2_PACKAGE_FONTCONFIG
-	select BR2_PACKAGE_FREETYPE
-	select BR2_PACKAGE_LCMS2
-	select BR2_PACKAGE_LIBGLIB2
-	select BR2_PACKAGE_QPDF
+	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_5 # libcupsfilters -> qpdf
+	depends on BR2_TOOLCHAIN_HAS_ATOMIC # libcupsfilters -> qpdf
+	select BR2_PACKAGE_LIBCUPSFILTERS
+	select BR2_PACKAGE_LIBPPD
 	help
 	  This project provides backends, filters, and other software
 	  that was once part of the core CUPS distribution but is no
@@ -32,9 +26,8 @@ config BR2_PACKAGE_CUPS_FILTERS
 
 	  http://www.linuxfoundation.org/collaborate/workgroups/openprinting/cups-filters
 
-comment "cups-filters needs a toolchain w/ wchar, C++, threads and dynamic library, gcc >= 5"
+comment "cups-filters needs a toolchain w/ C++ and dynamic library, gcc >= 5"
 	depends on BR2_USE_MMU
 	depends on BR2_TOOLCHAIN_HAS_ATOMIC
-	depends on !BR2_INSTALL_LIBSTDCPP || !BR2_TOOLCHAIN_HAS_THREADS || \
-		!BR2_USE_WCHAR || BR2_STATIC_LIBS || \
-		!BR2_TOOLCHAIN_GCC_AT_LEAST_5
+	depends on !BR2_INSTALL_LIBSTDCPP || \
+		BR2_STATIC_LIBS || !BR2_TOOLCHAIN_GCC_AT_LEAST_5
diff --git a/package/cups-filters/S82cups-browsed b/package/cups-filters/S82cups-browsed
deleted file mode 100644
index f17bbe7465..0000000000
--- a/package/cups-filters/S82cups-browsed
+++ /dev/null
@@ -1,48 +0,0 @@
-#!/bin/sh
-
-DAEMON="cups-browsed"
-PIDFILE="/var/run/$DAEMON.pid"
-
-start() {
-	printf 'Starting %s: ' "$DAEMON"
-	# shellcheck disable=SC2086 # we need the word splitting
-	start-stop-daemon -b -m -S -q -p "$PIDFILE" -x "/usr/sbin/$DAEMON" \
-		-- -c /etc/cups/cups-browsed.conf
-	status=$?
-	if [ "$status" -eq 0 ]; then
-		echo "OK"
-	else
-		echo "FAIL"
-	fi
-	return "$status"
-}
-
-stop() {
-	printf 'Stopping %s: ' "$DAEMON"
-	start-stop-daemon -K -q -p "$PIDFILE"
-	status=$?
-	if [ "$status" -eq 0 ]; then
-		rm -f "$PIDFILE"
-		echo "OK"
-	else
-		echo "FAIL"
-	fi
-	return "$status"
-}
-
-restart() {
-	stop
-	sleep 1
-	start
-}
-
-case "$1" in
-	start|stop|restart)
-		"$1";;
-	reload)
-		# Restart, since there is no true "reload" feature.
-		restart;;
-	*)
-		echo "Usage: $0 {start|stop|restart|reload}"
-		exit 1
-esac
diff --git a/package/cups-filters/cups-filters.hash b/package/cups-filters/cups-filters.hash
index 7fb3badf46..f4bd4126a4 100644
--- a/package/cups-filters/cups-filters.hash
+++ b/package/cups-filters/cups-filters.hash
@@ -1,3 +1,4 @@
 # Locally computed:
-sha256  01a2acbd6bb78f09638047e4e9ce305d7e5ef4cb9ed6949672b5d901b7321dd4  cups-filters-1.28.17.tar.gz
-sha256  38192ffdaca98b718f78b2d4abc38bb087f0bbcc9a16d212c98b903b985f900f  COPYING
+sha256  39e71de3ce06762b342749f1dc7cba6817738f7bf4d322c1bb9ab10b8569ab80  cups-filters-2.0.1.tar.xz
+sha256  944512aa3c095722752ea2eb1aa6c32ee9ffc3e7f9fb6aab5ea56f6b64ec42ec  COPYING
+sha256  cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30  LICENSE
diff --git a/package/cups-filters/cups-filters.mk b/package/cups-filters/cups-filters.mk
index dcfb2e9500..9cee2b44ba 100644
--- a/package/cups-filters/cups-filters.mk
+++ b/package/cups-filters/cups-filters.mk
@@ -4,56 +4,24 @@
 #
 ################################################################################
 
-CUPS_FILTERS_VERSION = 1.28.17
+CUPS_FILTERS_VERSION = 2.0.1
+CUPS_FILTERS_SOURCE = cups-filters-$(CUPS_FILTERS_VERSION).tar.xz
 CUPS_FILTERS_SITE = https://github.com/OpenPrinting/cups-filters/releases/download/$(CUPS_FILTERS_VERSION)
-CUPS_FILTERS_LICENSE = GPL-2.0, GPL-2.0+, GPL-3.0, GPL-3.0+, LGPL-2, LGPL-2.1+, MIT, BSD-4-Clause
-CUPS_FILTERS_LICENSE_FILES = COPYING
+CUPS_FILTERS_LICENSE = Apache-2.0 with GPL-2.0/LGPL-2.0 exception
+CUPS_FILTERS_LICENSE_FILES = COPYING LICENSE
 CUPS_FILTERS_CPE_ID_VENDOR = linuxfoundation
 
-# 0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
-CUPS_FILTERS_IGNORE_CVES += CVE-2023-24805
-
-CUPS_FILTERS_DEPENDENCIES = cups libglib2 lcms2 qpdf fontconfig freetype jpeg
+CUPS_FILTERS_DEPENDENCIES = cups libcupsfilters libppd
 
 CUPS_FILTERS_CONF_OPTS = \
 	--disable-mutool \
 	--disable-foomatic \
-	--disable-braille \
+	--enable-pstops \
+	--enable-rastertopwg \
 	--enable-imagefilters \
+	--with-shell=/bin/sh \
 	--with-cups-config=$(STAGING_DIR)/usr/bin/cups-config \
-	--with-sysroot=$(STAGING_DIR) \
-	--with-pdftops=pdftops \
-	--with-jpeg \
-	--with-test-font-path=/dev/null \
-	--without-rcdir
-
-ifeq ($(BR2_PACKAGE_LIBPNG),y)
-CUPS_FILTERS_CONF_OPTS += --with-png
-CUPS_FILTERS_DEPENDENCIES += libpng
-else
-CUPS_FILTERS_CONF_OPTS += --without-png
-endif
-
-ifeq ($(BR2_PACKAGE_TIFF),y)
-CUPS_FILTERS_CONF_OPTS += --with-tiff
-CUPS_FILTERS_DEPENDENCIES += tiff
-else
-CUPS_FILTERS_CONF_OPTS += --without-tiff
-endif
-
-ifeq ($(BR2_PACKAGE_DBUS),y)
-CUPS_FILTERS_CONF_OPTS += --enable-dbus
-CUPS_FILTERS_DEPENDENCIES += dbus
-else
-CUPS_FILTERS_CONF_OPTS += --disable-dbus
-endif
-
-ifeq ($(BR2_PACKAGE_AVAHI_LIBAVAHI_CLIENT),y)
-CUPS_FILTERS_DEPENDENCIES += avahi
-CUPS_FILTERS_CONF_OPTS += --enable-avahi
-else
-CUPS_FILTERS_CONF_OPTS += --disable-avahi
-endif
+	--with-sysroot=$(STAGING_DIR)
 
 ifeq ($(BR2_PACKAGE_GHOSTSCRIPT),y)
 CUPS_FILTERS_DEPENDENCIES += ghostscript
@@ -62,13 +30,6 @@ else
 CUPS_FILTERS_CONF_OPTS += --disable-ghostscript
 endif
 
-ifeq ($(BR2_PACKAGE_IJS),y)
-CUPS_FILTERS_DEPENDENCIES += ijs
-CUPS_FILTERS_CONF_OPTS += --enable-ijs
-else
-CUPS_FILTERS_CONF_OPTS += --disable-ijs
-endif
-
 ifeq ($(BR2_PACKAGE_POPPLER),y)
 CUPS_FILTERS_DEPENDENCIES += poppler
 CUPS_FILTERS_CONF_OPTS += --enable-poppler
@@ -76,21 +37,4 @@ else
 CUPS_FILTERS_CONF_OPTS += --disable-poppler
 endif
 
-ifeq ($(BR2_PACKAGE_LIBEXIF),y)
-CUPS_FILTERS_CONF_OPTS += --enable-exif
-CUPS_FILTERS_DEPENDENCIES += libexif
-else
-CUPS_FILTERS_CONF_OPTS += --disable-exif
-endif
-
-define CUPS_FILTERS_INSTALL_INIT_SYSV
-	$(INSTALL) -D -m 0755 package/cups-filters/S82cups-browsed \
-		$(TARGET_DIR)/etc/init.d/S82cups-browsed
-endef
-
-define CUPS_FILTERS_INSTALL_INIT_SYSTEMD
-	$(INSTALL) -D -m 0755 $(@D)/utils/cups-browsed.service \
-		$(TARGET_DIR)/usr/lib/systemd/system/cups-browsed.service
-endef
-
 $(eval $(autotools-package))
-- 
2.34.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/4] package/qpdf: bump to version 11.9.1

[Thomas Petazzoni via buildroot]

Hello James,

On Mon, 30 Sep 2024 16:31:30 -0600
James Hilliard <james.hilliard1@gmail.com> wrote:

> Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
> ---
>  package/qpdf/qpdf.hash |  4 ++--
>  package/qpdf/qpdf.mk   | 31 ++++++++++++++++++++++++-------
>  2 files changed, 26 insertions(+), 9 deletions(-)

Thanks for this patch. However, I am not sure this conversion to
cmake-package is really complete.

> -QPDF_CONF_OPTS = --with-random=/dev/urandom
> +QPDF_CONF_OPTS = \
> +	-DBUILD_DOC=OFF \

This is already done by cmake-package.

>  ifeq ($(BR2_USE_WCHAR),)
>  QPDF_CONF_ENV += CXXFLAGS="$(TARGET_CXXFLAGS) -DQPDF_NO_WCHAR_T"

Are you sure this still has an effect with cmake-package?

>  ifeq ($(BR2_TOOLCHAIN_HAS_LIBATOMIC),y)
>  QPDF_CONF_ENV += LIBS=-latomic
>  endif

Same question (and I believe it doesn't have any effect).

Could you review qpdf.mk more thoroughly and check that what was done
for autotools-package is either removed if no longer needed, or
properly converted to have the same effect for cmake-package?

Thanks!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot