kumquat-buildroot/package/cups/cups.mk
Peter Korsgaard b9d9497019 package/cups: add upstream security fix for CVE-2023-4504
Fixes CVE-2023-4504: Postscript Parsing Heap Overflow

https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
https://takeonme.org/cves/CVE-2023-4504.html

There is a 2.4.7 release with this fix, but upstream unfortunately broke
!gnutls builds, so backport the security fix instead:

https://github.com/OpenPrinting/cups/issues/762

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-11 10:59:52 +02:00

99 lines
2.4 KiB
Makefile

################################################################################
#
# cups
#
################################################################################
CUPS_VERSION = 2.4.6
CUPS_SOURCE = cups-$(CUPS_VERSION)-source.tar.gz
CUPS_SITE = https://github.com/OpenPrinting/cups/releases/download/v$(CUPS_VERSION)
CUPS_LICENSE = Apache-2.0 with GPL-2.0/LGPL-2.0 exception
CUPS_LICENSE_FILES = LICENSE NOTICE
CUPS_CPE_ID_VENDOR = openprinting
CUPS_SELINUX_MODULES = cups
CUPS_INSTALL_STAGING = YES
# 0005-raster-interpret.c-Fix-CVE-2023-4504.patch
CUPS_IGNORE_CVES += CVE-2023-4504
# Using autoconf, not autoheader, so we cannot use AUTORECONF = YES.
define CUPS_RUN_AUTOCONF
cd $(@D); $(AUTOCONF) -f
endef
CUPS_PRE_CONFIGURE_HOOKS += CUPS_RUN_AUTOCONF
CUPS_CONF_OPTS = \
--with-docdir=/usr/share/cups/doc-root \
--disable-gssapi \
--disable-pam \
--libdir=/usr/lib \
--with-cups-user=lp \
--with-cups-group=lp \
--with-system-groups="lpadmin sys root" \
--disable-libpaper \
--without-rcdir
CUPS_CONFIG_SCRIPTS = cups-config
CUPS_DEPENDENCIES = \
host-autoconf \
host-pkgconf \
$(if $(BR2_PACKAGE_ZLIB),zlib)
ifeq ($(BR2_PACKAGE_SYSTEMD),y)
CUPS_CONF_OPTS += --with-systemd=/usr/lib/systemd/system \
--enable-systemd
CUPS_DEPENDENCIES += systemd
else
CUPS_CONF_OPTS += --disable-systemd
endif
ifeq ($(BR2_PACKAGE_DBUS),y)
CUPS_CONF_OPTS += --enable-dbus
CUPS_DEPENDENCIES += dbus
else
CUPS_CONF_OPTS += --disable-dbus
endif
ifeq ($(BR2_PACKAGE_GNUTLS),y)
CUPS_CONF_OPTS += --with-tls=yes
CUPS_DEPENDENCIES += gnutls
else
CUPS_CONF_OPTS += --with-tls=no
endif
ifeq ($(BR2_PACKAGE_LIBUSB),y)
CUPS_CONF_OPTS += --enable-libusb
CUPS_DEPENDENCIES += libusb
else
CUPS_CONF_OPTS += --disable-libusb
endif
ifeq ($(BR2_PACKAGE_AVAHI),y)
CUPS_DEPENDENCIES += avahi
CUPS_CONF_OPTS += --enable-avahi
else
CUPS_CONF_OPTS += --disable-avahi
endif
ifeq ($(BR2_PACKAGE_HAS_UDEV),y)
define CUPS_INSTALL_UDEV_RULES
$(INSTALL) -D -m 0644 package/cups/70-usb-printers.rules \
$(TARGET_DIR)/lib/udev/rules.d/70-usb-printers.rules
endef
CUPS_POST_INSTALL_TARGET_HOOKS += CUPS_INSTALL_UDEV_RULES
endif
define CUPS_INSTALL_INIT_SYSV
$(INSTALL) -D -m 0755 package/cups/S81cupsd \
$(TARGET_DIR)/etc/init.d/S81cupsd
endef
# lp user is needed to run cups spooler
# lpadmin group membership grants administrative privileges
define CUPS_USERS
lp -1 lp -1 * /var/spool/lpd /bin/false - lp
- - lpadmin -1 * - - - Printers admin group.
endef
$(eval $(autotools-package))