7 files changed, 77 insertions, 221 deletions

diff --git a/meta/recipes-extended/cups/cups.inc b/meta/recipes-extended/cups/cups.inc
index 244c87001f..9688efafae 100644
--- a/meta/recipes-extended/cups/cups.inc
+++ b/meta/recipes-extended/cups/cups.inc
@@ -6,77 +6,68 @@ document types."
 HOMEPAGE = "https://www.cups.org/"
 SECTION = "console/utils"
 LICENSE = "Apache-2.0"
-DEPENDS = "gnutls libpng jpeg dbus zlib libusb1"
+DEPENDS = "libpng jpeg dbus zlib libusb1"
 
-SRC_URI = "https://github.com/apple/cups/releases/download/v${PV}/${BP}-source.tar.gz \
+SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/cups-${PV}-source.tar.gz \
            file://0001-use-echo-only-in-init.patch \
            file://0002-don-t-try-to-run-generated-binaries.patch \
-           file://0003-cups_1.4.6.bb-Fix-build-on-ppc64.patch \
+           file://libexecdir.patch \
            file://0004-cups-fix-multilib-install-file-conflicts.patch \
            file://volatiles.99_cups \
            file://cups-volatiles.conf \
-           file://CVE-2020-10001.patch \
            "
 
-UPSTREAM_CHECK_URI = "https://github.com/apple/cups/releases"
-UPSTREAM_CHECK_REGEX = "cups-(?P<pver>\d+\.\d+(\.\d+)?)-source.tar"
+GITHUB_BASE_URI = "https://github.com/OpenPrinting/cups/releases"
 
-# Issue only applies to MacOS
-CVE_CHECK_WHITELIST += "CVE-2008-1033"
-# Issue affects pdfdistiller plugin used with but not part of cups
-CVE_CHECK_WHITELIST += "CVE-2009-0032"
-# This is an Ubuntu only issue.
-CVE_CHECK_WHITELIST += "CVE-2018-6553"
+CVE_STATUS[CVE-2008-1033] = "not-applicable-platform: Issue only applies to MacOS"
+CVE_STATUS[CVE-2009-0032] = "cpe-incorrect: Issue affects pdfdistiller plugin used with but not part of cups"
+CVE_STATUS[CVE-2018-6553] = "not-applicable-platform: This is an Ubuntu only issue"
+CVE_STATUS[CVE-2022-26691] = "fixed-version: This is fixed in 2.4.2 but the cve-check class still reports it"
+CVE_STATUS[CVE-2021-25317] = "not-applicable-config: This concerns /var/log/cups having lp ownership, our /var/log/cups is root:root, so this doesn't apply."
 
 LEAD_SONAME = "libcupsdriver.so"
 
 CLEANBROKEN = "1"
 
-inherit autotools-brokensep binconfig useradd systemd pkgconfig multilib_script
+inherit autotools-brokensep binconfig useradd systemd pkgconfig multilib_script github-releases
 
 USERADD_PACKAGES = "${PN}"
-GROUPADD_PARAM_${PN} = "--system lpadmin"
+GROUPADD_PARAM:${PN} = "--system lpadmin"
 
-SYSTEMD_SERVICE_${PN} = "org.cups.cupsd.socket org.cups.cupsd.path org.cups.cupsd.service org.cups.cups-lpd.socket"
+SYSTEMD_SERVICE:${PN} = "cups.socket cups.path cups.service cups-lpd.socket"
 
 PACKAGECONFIG ??= "${@bb.utils.contains('DISTRO_FEATURES', 'zeroconf', 'avahi', '', d)} \
-                   ${@bb.utils.filter('DISTRO_FEATURES', 'pam systemd', d)}"
-PACKAGECONFIG[avahi] = "--enable-avahi,--disable-avahi,avahi"
+                   ${@bb.utils.filter('DISTRO_FEATURES', 'pam systemd', d)} \
+                   openssl \
+"
+PACKAGECONFIG[avahi] = "--with-dnssd=avahi,--with-dnssd=no,avahi"
 PACKAGECONFIG[acl] = "--enable-acl,--disable-acl,acl"
+PACKAGECONFIG[gnutls] = "--with-tls=gnutls,,gnutls,,,openssl"
+PACKAGECONFIG[openssl] = "--with-tls=openssl,,openssl,,,gnutls"
 PACKAGECONFIG[pam] = "--enable-pam --with-pam-module=unix, --disable-pam, libpam"
 PACKAGECONFIG[systemd] = "--with-systemd=${systemd_system_unitdir},--without-systemd,systemd"
 PACKAGECONFIG[xinetd] = "--with-xinetd=${sysconfdir}/xinetd.d,--without-xinetd,xinetd"
+PACKAGECONFIG[webif] = "--enable-webif,--disable-webif"
 
 EXTRA_OECONF = " \
-               --enable-gnutls \
                --enable-dbus \
+               --with-dbusdir=${sysconfdir}/dbus-1 \
                --enable-browsing \
                --disable-gssapi \
                --enable-debug \
                --disable-relro \
                --enable-libusb \
-               --with-system-groups=lpadmin \
+               --with-system-groups=lpadmin,root,sys,wheel \
                --with-cups-group=lp \
                --with-domainsocket=/run/cups/cups.sock \
+               --with-pkgconfpath=${libdir}/pkgconfig \
                DSOFLAGS='${LDFLAGS}' \
                "
 
 EXTRA_AUTORECONF += "--exclude=autoheader"
 
-do_compile () {
-        echo "all:"    >  man/Makefile
-        echo "libs:" >> man/Makefile
-        echo "install:" >> man/Makefile
-        echo "install-data:" >> man/Makefile
-        echo "install-exec:" >> man/Makefile
-        echo "install-headers:" >> man/Makefile
-        echo "install-libs:" >> man/Makefile
-
-        oe_runmake
-}
-
 do_install () {
-        oe_runmake "DSTROOT=${D}" install
+        oe_runmake "BUILDROOT=${D}" install
 
         # Remove /var/run from package as cupsd will populate it on startup
         rm -fr ${D}/${localstatedir}/run
@@ -84,7 +75,7 @@ do_install () {
         rmdir ${D}/${libexecdir}/${BPN}/driver
 
         # Fix the pam configuration file permissions
-        if ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'true', 'false', d)}; then
+        if ${@bb.utils.contains('PACKAGECONFIG', 'pam', 'true', 'false', d)}; then
             chmod 0644 ${D}${sysconfdir}/pam.d/cups
         fi
 
@@ -93,36 +84,34 @@ do_install () {
             rm -rf ${D}${sysconfdir}/init.d/
             rm -rf ${D}${sysconfdir}/rc*
             install -d ${D}${sysconfdir}/tmpfiles.d
-            install -m 0644 ${WORKDIR}/cups-volatiles.conf \
+            install -m 0644 ${UNPACKDIR}/cups-volatiles.conf \
                     ${D}${sysconfdir}/tmpfiles.d/cups.conf
         else
             install -d ${D}${sysconfdir}/default/volatiles
-            install -m 0644 ${WORKDIR}/volatiles.99_cups \
+            install -m 0644 ${UNPACKDIR}/volatiles.99_cups \
                     ${D}${sysconfdir}/default/volatiles/99_cups
         fi
 }
 
-PACKAGES =+ "${PN}-lib ${PN}-libimage"
+PACKAGES =+ "${PN}-lib ${PN}-libimage ${PN}-webif"
 
-RDEPENDS_${PN} += "${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'procps', '', d)}"
-FILES_${PN} += "${libexecdir}/cups/ \
-               "
+RDEPENDS:${PN} += "${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'procps', '', d)}"
+FILES:${PN} += "${libexecdir}/cups/"
 
-FILES_${PN}-lib = "${libdir}/libcups.so.*"
+FILES:${PN}-lib = "${libdir}/libcups.so.*"
 
-FILES_${PN}-libimage = "${libdir}/libcupsimage.so.*"
+FILES:${PN}-libimage = "${libdir}/libcupsimage.so.*"
 
-#package the html for the webgui inside the main packages (~1MB uncompressed)
+# put the html for the web interface into its own PACKAGE
+FILES:${PN}-webif += "${datadir}/doc/cups/ ${datadir}/icons/"
+RRECOMMENDS:${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'webif', '${PN}-webif', '', d)}"
 
-FILES_${PN} += "${datadir}/doc/cups/images \
-                ${datadir}/doc/cups/*html \
-                ${datadir}/doc/cups/*.css \
-                ${datadir}/icons/ \
-               "
-CONFFILES_${PN} += "${sysconfdir}/cups/cupsd.conf"
+CONFFILES:${PN} += "${sysconfdir}/cups/cupsd.conf"
 
 MULTILIB_SCRIPTS = "${PN}-dev:${bindir}/cups-config"
 
+LOCALE_PATHS += "${datadir}/cups/templates"
+
 SYSROOT_PREPROCESS_FUNCS += "cups_sysroot_preprocess"
 cups_sysroot_preprocess () {
         sed -i ${SYSROOT_DESTDIR}${bindir_crossscripts}/cups-config -e 's:cups_datadir=.*:cups_datadir=${datadir}/cups:' -e 's:cups_serverbin=.*:cups_serverbin=${libexecdir}/cups:'
diff --git a/meta/recipes-extended/cups/cups/0002-don-t-try-to-run-generated-binaries.patch b/meta/recipes-extended/cups/cups/0002-don-t-try-to-run-generated-binaries.patch
index ea248e4710..2bc26edbfc 100644
--- a/meta/recipes-extended/cups/cups/0002-don-t-try-to-run-generated-binaries.patch
+++ b/meta/recipes-extended/cups/cups/0002-don-t-try-to-run-generated-binaries.patch
@@ -26,48 +26,6 @@ index 32e2e0b..f1478d4 100644
  
  
  #
-@@ -205,9 +205,9 @@ ppdc-static:                ppdc.o libcupsppdc.a ../cups/$(LIBCUPSSTATIC) foo.drv foo-fr.po
-        $(LD_CXX) $(ARCHFLAGS) $(ALL_LDFLAGS) -o ppdc-static ppdc.o libcupsppdc.a \
-                $(LINKCUPSSTATIC)
-        $(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
--       echo Testing PPD compiler...
--       ./ppdc-static -l en,fr -I ../data foo.drv
--       ./ppdc-static -l en,fr -z -I ../data foo.drv
-+#      echo Testing PPD compiler...
-+#      ./ppdc-static -l en,fr -I ../data foo.drv
-+#      ./ppdc-static -l en,fr -z -I ../data foo.drv
- 
- 
- #
-@@ -235,17 +235,17 @@ ppdi-static:              ppdc-static ppdi.o libcupsppdc.a ../cups/$(LIBCUPSSTATIC)
-        $(LD_CXX) $(ARCHFLAGS) $(ALL_LDFLAGS) -o ppdi-static ppdi.o libcupsppdc.a \
-                $(LINKCUPSSTATIC)
-        $(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
--       echo Testing PPD importer...
--       $(RM) -r ppd ppd2 sample-import.drv
--       ./ppdc-static -l en -I ../data sample.drv
--       ./ppdi-static -I ../data -o sample-import.drv ppd/*
--       ./ppdc-static -l en -I ../data -d ppd2 sample-import.drv
--       if diff -r ppd ppd2 >/dev/null; then \
--               echo PPD import OK; \
--       else \
--               echo PPD import FAILED; \
--               exit 1; \
--       fi
-+#      echo Testing PPD importer...
-+#      $(RM) -r ppd ppd2 sample-import.drv
-+#      ./ppdc-static -l en -I ../data sample.drv
-+#      ./ppdi-static -I ../data -o sample-import.drv ppd/*
-+#      ./ppdc-static -l en -I ../data -d ppd2 sample-import.drv
-+#      if diff -r ppd ppd2 >/dev/null; then \
-+#              echo PPD import OK; \
-+#      else \
-+#              echo PPD import FAILED; \
-+#              exit 1; \
-+#      fi
- 
- 
- #
 -- 
 2.17.1
 
diff --git a/meta/recipes-extended/cups/cups/0003-cups_1.4.6.bb-Fix-build-on-ppc64.patch b/meta/recipes-extended/cups/cups/0003-cups_1.4.6.bb-Fix-build-on-ppc64.patch
deleted file mode 100644
index b48c7a9ad2..0000000000
--- a/meta/recipes-extended/cups/cups/0003-cups_1.4.6.bb-Fix-build-on-ppc64.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 66c2079ae91389ee0f9d704bf0d2cccd53b2c603 Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Sun, 22 Jul 2012 16:54:17 -0700
-Subject: [PATCH 3/4] cups_1.4.6.bb: Fix build on ppc64
-
-Make CUPS_SERVERBIN relative to libdir otherwise on 64bit arches
-e.g. ppc64 where base libdir is lib64 this does not go well
-
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-Upstream-Status: Inappropriate [OE config specific]
-
-Update on 20190904:
-Redefine CUPS_SERVERBIN to "$libexecdir/cups" which solves file confliction
-when multilib is enabled.
-
-Signed-off-by: Kai Kang <kai.kang@windriver.com>
-
----
- config-scripts/cups-directories.m4 | 2 +-
- configure                          | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/config-scripts/cups-directories.m4 b/config-scripts/cups-directories.m4
-index b74083a..9a5abb2 100644
---- a/config-scripts/cups-directories.m4
-+++ b/config-scripts/cups-directories.m4
-@@ -270,7 +270,7 @@ case "$host_os_name" in
-        *)
-                # All others
-                INSTALL_SYSV="install-sysv"
--               CUPS_SERVERBIN="$exec_prefix/lib/cups"
-+               CUPS_SERVERBIN="$libexecdir/cups"
-                ;;
- esac
- 
-diff --git a/configure b/configure
-index d3df145..bc68a6c 100755
---- a/configure
-+++ b/configure
-@@ -6420,7 +6420,7 @@ case "$host_os_name" in
-        *)
-                # All others
-                INSTALL_SYSV="install-sysv"
--               CUPS_SERVERBIN="$exec_prefix/lib/cups"
-+               CUPS_SERVERBIN="$libexecdir/cups"
-                ;;
- esac
- 
--- 
-2.17.1
-
diff --git a/meta/recipes-extended/cups/cups/CVE-2020-10001.patch b/meta/recipes-extended/cups/cups/CVE-2020-10001.patch
deleted file mode 100644
index 09a0a5765d..0000000000
--- a/meta/recipes-extended/cups/cups/CVE-2020-10001.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From efbea1742bd30f842fbbfb87a473e5c84f4162f9 Mon Sep 17 00:00:00 2001
-From: Michael R Sweet <msweet@msweet.org>
-Date: Mon, 1 Feb 2021 15:02:32 -0500
-Subject: [PATCH] Fix a buffer (read) overflow in ippReadIO (CVE-2020-10001)
-
-Upstream-Status: Backport
-CVE: CVE-2020-10001
-
-Reference to upstream patch:
-[https://github.com/OpenPrinting/cups/commit/efbea1742bd30f842fbbfb87a473e5c84f4162f9]
-
-[SG: Addapted for version 2.3.3]
-Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
----
- CHANGES.md | 2 ++
- cups/ipp.c | 8 +++++---
- 2 files changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/CHANGES.md b/CHANGES.md
-index df72892..5ca12da 100644
---- a/CHANGES.md
-+++ b/CHANGES.md
-@@ -4,6 +4,8 @@ CHANGES - 2.3.3 - 2020-04-24
- Changes in CUPS v2.3.3
- ----------------------
- 
-+- Security: Fixed a buffer (read) overflow in the `ippReadIO` function
-+  (CVE-2020-10001)
- - CVE-2020-3898: The `ppdOpen` function did not handle invalid UI
-   constraint.  `ppdcSource::get_resolution` function did not handle
-   invalid resolution strings.
-diff --git a/cups/ipp.c b/cups/ipp.c
-index 3d52934..adbb26f 100644
---- a/cups/ipp.c
-+++ b/cups/ipp.c
-@@ -2866,7 +2866,8 @@ ippReadIO(void       *src,                /* I - Data source */
-   unsigned char                *buffer,        /* Data buffer */
-                        string[IPP_MAX_TEXT],
-                                        /* Small string buffer */
--                       *bufptr;        /* Pointer into buffer */
-+                       *bufptr,        /* Pointer into buffer */
-+                       *bufend;        /* End of buffer */
-   ipp_attribute_t      *attr;          /* Current attribute */
-   ipp_tag_t            tag;            /* Current tag */
-   ipp_tag_t            value_tag;      /* Current value tag */
-@@ -3441,6 +3442,7 @@ ippReadIO(void       *src,                /* I - Data source */
-                }
- 
-                 bufptr = buffer;
-+                bufend = buffer + n;
- 
-               /*
-                * text-with-language and name-with-language are composite
-@@ -3454,7 +3456,7 @@ ippReadIO(void       *src,                /* I - Data source */
- 
-                n = (bufptr[0] << 8) | bufptr[1];
- 
--               if ((bufptr + 2 + n) >= (buffer + IPP_BUF_SIZE) || n >= (int)sizeof(string))
-+               if ((bufptr + 2 + n + 2) > bufend || n >= (int)sizeof(string))
-                {
-                  _cupsSetError(IPP_STATUS_ERROR_INTERNAL,
-                                _("IPP language length overflows value."), 1);
-@@ -3481,7 +3483,7 @@ ippReadIO(void       *src,                /* I - Data source */
-                 bufptr += 2 + n;
-                n = (bufptr[0] << 8) | bufptr[1];
- 
--               if ((bufptr + 2 + n) >= (buffer + IPP_BUF_SIZE))
-+               if ((bufptr + 2 + n) > bufend)
-                {
-                  _cupsSetError(IPP_STATUS_ERROR_INTERNAL,
-                                _("IPP string length overflows value."), 1);
--- 
-2.17.1
-
diff --git a/meta/recipes-extended/cups/cups/libexecdir.patch b/meta/recipes-extended/cups/cups/libexecdir.patch
new file mode 100644
index 0000000000..7ccad94f0f
--- /dev/null
+++ b/meta/recipes-extended/cups/cups/libexecdir.patch
@@ -0,0 +1,35 @@
+From 1724f7bcdbcfdb445778f8a2e530c5c094c18c10 Mon Sep 17 00:00:00 2001
+From: Ross Burton <ross.burton@arm.com>
+Date: Tue, 13 Jul 2021 12:56:30 +0100
+Subject: [PATCH] Use $libexecdir instead of hardcoding $prefix/lib as this
+ breaks multilib builds.
+
+Upstream-Status: Pending
+Signed-off-by: Ross Burton <ross.burton@arm.com>
+
+---
+ config-scripts/cups-directories.m4 | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/config-scripts/cups-directories.m4 b/config-scripts/cups-directories.m4
+index 2033d47..230166e 100644
+--- a/config-scripts/cups-directories.m4
++++ b/config-scripts/cups-directories.m4
+@@ -239,7 +239,7 @@ AC_SUBST([CUPS_REQUESTS])
+ AS_CASE(["$host_os_name"], [*-gnu], [
+     # GNUs
+     INSTALL_SYSV="install-sysv"
+-    CUPS_SERVERBIN="$exec_prefix/lib/cups"
++    CUPS_SERVERBIN="$libexecdir/cups"
+ ], [*bsd* | darwin*], [
+     # *BSD and Darwin (macOS)
+     INSTALL_SYSV=""
+@@ -247,7 +247,7 @@ AS_CASE(["$host_os_name"], [*-gnu], [
+ ], [*], [
+     # All others
+     INSTALL_SYSV="install-sysv"
+-    CUPS_SERVERBIN="$exec_prefix/lib/cups"
++    CUPS_SERVERBIN="$libexecdir/cups"
+ ])
+ 
+ AC_DEFINE_UNQUOTED([CUPS_SERVERBIN], ["$CUPS_SERVERBIN"], [Location of server programs.])
diff --git a/meta/recipes-extended/cups/cups_2.3.3.bb b/meta/recipes-extended/cups/cups_2.3.3.bb
deleted file mode 100644
index 5caeb6f58b..0000000000
--- a/meta/recipes-extended/cups/cups_2.3.3.bb
+++ /dev/null
@@ -1,6 +0,0 @@
-require cups.inc
-
-LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
-
-SRC_URI[md5sum] = "412434ceefbdf3ec71bc9188a035f589"
-SRC_URI[sha256sum] = "261fd948bce8647b6d5cb2a1784f0c24cc52b5c4e827b71d726020bcc502f3ee"
diff --git a/meta/recipes-extended/cups/cups_2.4.8.bb b/meta/recipes-extended/cups/cups_2.4.8.bb
new file mode 100644
index 0000000000..c0cddf7e99
--- /dev/null
+++ b/meta/recipes-extended/cups/cups_2.4.8.bb
@@ -0,0 +1,5 @@
+require cups.inc
+
+LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
+
+SRC_URI[sha256sum] = "75c326b4ba73975efcc9a25078c4b04cdb4ee333caaad0d0823dbd522c6479a0"