[gentoo-commits] repo/gentoo:master commit in: net-print/cups/files/, net-print/cups/

[Lars Wendler]

commit:     5983cc09eade48687c10dd3241c946d899369a43
Author:     Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
AuthorDate: Tue Sep  3 07:51:15 2019 +0000
Commit:     Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
CommitDate: Tue Sep  3 07:51:15 2019 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5983cc09

net-print/cups: Security cleanup

Bug: https://bugs.gentoo.org/692300
Package-Manager: Portage-2.3.75, Repoman-2.3.17
Signed-off-by: Lars Wendler <polynomial-c <AT> gentoo.org>

 net-print/cups/Manifest                        |   1 -
 net-print/cups/cups-2.2.11.ebuild              | 336 -------------------------
 net-print/cups/files/cups-2.3_rc1-no_pam.patch | 164 ------------
 3 files changed, 501 deletions(-)

diff --git a/net-print/cups/Manifest b/net-print/cups/Manifest
index b9b923a3fe7..c4d4ef2a259 100644
--- a/net-print/cups/Manifest
+++ b/net-print/cups/Manifest
@@ -1,3 +1,2 @@
-DIST cups-2.2.11-source.tar.gz 10405908 BLAKE2B 9b7ee4da9502e42fd1b4a2c57ab709b3127ee8aeb8481a52f37da19fe5578f406260f1551e3fcedcd3a828fbed69267e68fcfd7bfabadf65afce4c3af19b4a1f SHA512 21a6916041b50044d336871f10d1192635458a3d318f19a18ad21d27027dd3839400601019e758424c218225a34aba148ba3a57f0ce3fe14c4df03bd1fde3403
 DIST cups-2.2.12-source.tar.gz 10409313 BLAKE2B 126ea81f7108b3b62f5e062ed522898dd48d4e5b4077c834e8fe89012445dd0a903bafa62f593551ed5f1c92cce4fbd22f56834e0615ed65ca4a6ae84dc2ca1c SHA512 b8e7be512938ad388d469d093ad0c882ab42ea1408c27a91340f8424aa0e79e588df3d59795624973b89074a2af650fa9b5b6ed5224138b17e4c6dbbcbf0a2e6
 DIST cups-2.3.0-source.tar.gz 8129049 BLAKE2B 738dbc7ee5ddcc9ffee44083cd93d8a0e75f4d3bf0b704dd643dc59db2cc2381dd65f676c0979bc65fee03438d160d9d650ceb93f8c702102eb1449d306a81a3 SHA512 c51f173b5fbae1554a3f4a3786fb3b5566e50d9f775473788ee3553922ac7e02e4785492c87c93fd46f159f50d97cc10ff6feafb3397cd9c1840840f3a9cdfae

diff --git a/net-print/cups/cups-2.2.11.ebuild b/net-print/cups/cups-2.2.11.ebuild
deleted file mode 100644
index 1c078ac92c8..00000000000
--- a/net-print/cups/cups-2.2.11.ebuild
+++ /dev/null
@@ -1,336 +0,0 @@
-# Copyright 1999-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-PYTHON_COMPAT=( python2_7 )
-
-inherit autotools flag-o-matic linux-info xdg multilib-minimal pam python-single-r1 user java-pkg-opt-2 systemd toolchain-funcs
-
-MY_P="${P/_rc/rc}"
-MY_P="${MY_P/_beta/b}"
-MY_PV="${PV/_rc/rc}"
-MY_PV="${MY_PV/_beta/b}"
-
-if [[ ${PV} == *9999 ]]; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/apple/cups.git"
-	if [[ ${PV} != 9999 ]]; then
-		EGIT_BRANCH=branch-${PV/.9999}
-	fi
-else
-	#SRC_URI="https://github.com/apple/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-	SRC_URI="https://github.com/apple/cups/releases/download/v${PV}/${P}-source.tar.gz"
-	KEYWORDS="alpha amd64 arm arm64 hppa ia64 ~mips ppc ppc64 s390 ~sh sparc x86 ~amd64-fbsd ~x86-fbsd ~m68k-mint"
-fi
-
-DESCRIPTION="The Common Unix Printing System"
-HOMEPAGE="https://www.cups.org/"
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="acl dbus debug java kerberos lprng-compat pam python selinux +ssl static-libs systemd +threads usb X xinetd zeroconf"
-
-CDEPEND="
-	app-text/libpaper
-	sys-libs/zlib
-	acl? (
-		kernel_linux? (
-			sys-apps/acl
-			sys-apps/attr
-		)
-	)
-	dbus? ( >=sys-apps/dbus-1.6.18-r1[${MULTILIB_USEDEP}] )
-	java? ( >=virtual/jre-1.6:* )
-	kerberos? ( >=virtual/krb5-0-r1[${MULTILIB_USEDEP}] )
-	!lprng-compat? ( !net-print/lprng )
-	pam? ( virtual/pam )
-	python? ( ${PYTHON_DEPS} )
-	ssl? ( >=net-libs/gnutls-2.12.23-r6:0=[${MULTILIB_USEDEP}] )
-	systemd? ( sys-apps/systemd )
-	usb? ( virtual/libusb:1 )
-	X? ( x11-misc/xdg-utils )
-	xinetd? ( sys-apps/xinetd )
-	zeroconf? ( >=net-dns/avahi-0.6.31-r2[${MULTILIB_USEDEP}] )
-"
-
-DEPEND="${CDEPEND}"
-BDEPEND="
-	>=virtual/pkgconfig-0-r1[${MULTILIB_USEDEP}]
-"
-
-RDEPEND="${CDEPEND}
-	selinux? ( sec-policy/selinux-cups )
-"
-
-PDEPEND=">=net-print/cups-filters-1.0.43"
-
-REQUIRED_USE="
-	python? ( ${PYTHON_REQUIRED_USE} )
-	usb? ( threads )
-"
-
-# upstream includes an interactive test which is a nono for gentoo
-RESTRICT="test"
-
-# systemd-socket.patch from Fedora
-PATCHES=(
-	"${FILESDIR}/${PN}-2.2.0-dont-compress-manpages.patch"
-	"${FILESDIR}/${PN}-2.2.6-fix-install-perms.patch"
-	"${FILESDIR}/${PN}-1.4.4-nostrip.patch"
-	"${FILESDIR}/${PN}-2.0.2-rename-systemd-service-files.patch"
-	"${FILESDIR}/${PN}-2.0.1-xinetd-installation-fix.patch"
-)
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/cups-config
-)
-
-pkg_setup() {
-	enewgroup lp
-	enewuser lp -1 -1 -1 lp
-	enewgroup lpadmin 106
-
-	use python && python-single-r1_pkg_setup
-
-	if use kernel_linux; then
-		linux-info_pkg_setup
-		if  ! linux_config_exists; then
-			ewarn "Can't check the linux kernel configuration."
-			ewarn "You might have some incompatible options enabled."
-		else
-			# recheck that we don't have usblp to collide with libusb; this should now work in most cases (bug 501122)
-			if use usb; then
-				if linux_chkconfig_present USB_PRINTER; then
-					elog "Your USB printers will be managed via libusb. In case you run into problems, "
-					elog "please try disabling USB_PRINTER support in your kernel or blacklisting the"
-					elog "usblp kernel module."
-					elog "Alternatively, just disable the usb useflag for cups (your printer will still work)."
-				fi
-			else
-				#here we should warn user that he should enable it so he can print
-				if ! linux_chkconfig_present USB_PRINTER; then
-					ewarn "If you plan to use USB printers you should enable the USB_PRINTER"
-					ewarn "support in your kernel."
-					ewarn "Please enable it:"
-					ewarn "    CONFIG_USB_PRINTER=y"
-					ewarn "in /usr/src/linux/.config or"
-					ewarn "    Device Drivers --->"
-					ewarn "        USB support  --->"
-					ewarn "            [*] USB Printer support"
-					ewarn "Alternatively, enable the usb useflag for cups and use the libusb code."
-				fi
-			fi
-		fi
-	fi
-}
-
-src_prepare() {
-	default
-
-	# Remove ".SILENT" rule for verbose output (bug 524338).
-	sed 's#^.SILENT:##g' -i "${S}"/Makedefs.in || die "sed failed"
-
-	# Fix install-sh, posix sh does not have 'function'.
-	sed 's#function gzipcp#gzipcp()#g' -i "${S}/install-sh"
-
-	AT_M4DIR=config-scripts eaclocal
-	eautoconf
-
-	# custom Makefiles
-	multilib_copy_sources
-}
-
-multilib_src_configure() {
-	export DSOFLAGS="${LDFLAGS}"
-
-	einfo LINGUAS=\"${LINGUAS}\"
-
-	# explicitly specify compiler wrt bug 524340
-	#
-	# need to override KRB5CONFIG for proper flags
-	# https://github.com/apple/cups/issues/4423
-	local myeconfargs=(
-		CC="$(tc-getCC)"
-		CXX="$(tc-getCXX)"
-		KRB5CONFIG="${EPREFIX}"/usr/bin/${CHOST}-krb5-config
-		--libdir="${EPREFIX}"/usr/$(get_libdir)
-		--localstatedir="${EPREFIX}"/var
-		--with-exe-file-perm=755
-		--with-rundir="${EPREFIX}"/run/cups
-		--with-cups-user=lp
-		--with-cups-group=lp
-		--with-docdir="${EPREFIX}"/usr/share/cups/html
-		--with-languages="${LINGUAS}"
-		--with-system-groups=lpadmin
-		--with-xinetd="${EPREFIX}"/etc/xinetd.d
-		$(multilib_native_use_enable acl)
-		$(use_enable dbus)
-		$(use_enable debug)
-		$(use_enable debug debug-guards)
-		$(use_enable debug debug-printfs)
-		$(multilib_native_use_with java)
-		$(use_enable kerberos gssapi)
-		$(multilib_native_use_enable pam)
-		$(multilib_native_use_with python python "${PYTHON}")
-		$(use_enable static-libs static)
-		$(use_enable threads)
-		$(use_enable ssl gnutls)
-		$(use_enable systemd)
-		$(multilib_native_use_enable usb libusb)
-		$(use_enable zeroconf avahi)
-		--disable-dnssd
-		--without-perl
-		--without-php
-		$(multilib_is_native_abi && echo --enable-libpaper || echo --disable-libpaper)
-	)
-
-	if tc-is-static-only; then
-		myeconfargs+=(
-			--disable-shared
-		)
-	fi
-
-	econf "${myeconfargs[@]}"
-
-	# install in /usr/libexec always, instead of using /usr/lib/cups, as that
-	# makes more sense when facing multilib support.
-	sed -i -e "s:SERVERBIN.*:SERVERBIN = \"\$\(BUILDROOT\)${EPREFIX}/usr/libexec/cups\":" Makedefs || die
-	sed -i -e "s:#define CUPS_SERVERBIN.*:#define CUPS_SERVERBIN \"${EPREFIX}/usr/libexec/cups\":" config.h || die
-	sed -i -e "s:cups_serverbin=.*:cups_serverbin=\"${EPREFIX}/usr/libexec/cups\":" cups-config || die
-
-	# additional path corrections needed for prefix, see bug 597728
-	sed \
-		-e "s:ICONDIR.*:ICONDIR = ${EPREFIX}/usr/share/icons:" \
-		-e "s:INITDIR.*:INITDIR = ${EPREFIX}/etc:" \
-		-e "s:DBUSDIR.*:DBUSDIR = ${EPREFIX}/etc/dbus-1:" \
-		-e "s:MENUDIR.*:MENUDIR = ${EPREFIX}/usr/share/applications:" \
-		-i Makedefs || die
-}
-
-multilib_src_compile() {
-	if multilib_is_native_abi; then
-		default
-	else
-		emake libs
-	fi
-}
-
-multilib_src_test() {
-	multilib_is_native_abi && default
-}
-
-multilib_src_install() {
-	if multilib_is_native_abi; then
-		emake BUILDROOT="${D}" install
-	else
-		emake BUILDROOT="${D}" install-libs install-headers
-		dobin cups-config
-	fi
-}
-
-multilib_src_install_all() {
-	dodoc {CHANGES,CREDITS,README}.md
-
-	# move the default config file to docs
-	dodoc "${ED}"/etc/cups/cupsd.conf.default
-	rm -f "${ED}"/etc/cups/cupsd.conf.default
-
-	# clean out cups init scripts
-	rm -rf "${ED}"/etc/{init.d/cups,rc*,pam.d/cups}
-
-	# install our init script
-	local neededservices
-	use zeroconf && neededservices+=" avahi-daemon"
-	use dbus && neededservices+=" dbus"
-	[[ -n ${neededservices} ]] && neededservices="need${neededservices}"
-	cp "${FILESDIR}"/cupsd.init.d-r3 "${T}"/cupsd || die
-	sed -i \
-		-e "s/@neededservices@/${neededservices}/" \
-		"${T}"/cupsd || die
-	doinitd "${T}"/cupsd
-
-	# install our pam script
-	pamd_mimic_system cups auth account
-
-	if use xinetd ; then
-		# correct path
-		sed -i \
-			-e "s:server = .*:server = /usr/libexec/cups/daemon/cups-lpd:" \
-			"${ED}"/etc/xinetd.d/cups-lpd || die
-		# it is safer to disable this by default, bug #137130
-		grep -w 'disable' "${ED}"/etc/xinetd.d/cups-lpd || \
-			{ sed -i -e "s:}:\tdisable = yes\n}:" "${ED}"/etc/xinetd.d/cups-lpd || die ; }
-		# write permission for file owner (root), bug #296221
-		fperms u+w /etc/xinetd.d/cups-lpd || die "fperms failed"
-	else
-		# always configure with --with-xinetd= and clean up later,
-		# bug #525604
-		rm -rf "${ED}"/etc/xinetd.d
-	fi
-
-	keepdir /usr/libexec/cups/driver /usr/share/cups/{model,profiles} \
-		/var/log/cups /var/spool/cups/tmp
-
-	keepdir /etc/cups/{interfaces,ppd,ssl}
-
-	if ! use X ; then
-		rm -r "${ED}"/usr/share/applications || die
-	fi
-
-	# create /etc/cups/client.conf, bug #196967 and #266678
-	echo "ServerName ${EPREFIX}/run/cups/cups.sock" >> "${ED}"/etc/cups/client.conf
-
-	# the following file is now provided by cups-filters:
-	rm -r "${ED}"/usr/share/cups/banners || die
-
-	# the following are created by the init script
-	rm -r "${ED}"/var/cache/cups || die
-	rm -r "${ED}"/run || die
-
-	# for the special case of running lprng and cups together, bug 467226
-	if use lprng-compat ; then
-		rm -fv "${ED}"/usr/bin/{lp*,cancel}
-		rm -fv "${ED}"/usr/sbin/lp*
-		rm -fv "${ED}"/usr/share/man/man1/{lp*,cancel*}
-		rm -fv "${ED}"/usr/share/man/man8/lp*
-		ewarn "Not installing lp... binaries, since the lprng-compat useflag is set."
-		ewarn "Unless you plan to install an exotic server setup, you most likely"
-		ewarn "do not want this. Disable the useflag then and all will be fine."
-	fi
-}
-
-pkg_preinst() {
-	xdg_pkg_preinst
-}
-
-pkg_postinst() {
-	# Update desktop file database and gtk icon cache (bug 370059)
-	xdg_pkg_postinst
-
-	local v
-
-	for v in ${REPLACING_VERSIONS}; do
-		if ! ver_test ${v} -ge 2.2.2-r2 ; then
-			echo
-			ewarn "The cupsd init script switched to using pidfiles. Shutting down"
-			ewarn "cupsd will fail the next time. To fix this, please run once as root"
-			ewarn "   killall cupsd ; /etc/init.d/cupsd zap ; /etc/init.d/cupsd start"
-			echo
-			break
-		fi
-	done
-
-	for v in ${REPLACING_VERSIONS}; do
-		echo
-		elog "For information about installing a printer and general cups setup"
-		elog "take a look at: https://wiki.gentoo.org/wiki/Printing"
-		echo
-		break
-	done
-}
-
-pkg_postrm() {
-	# Update desktop file database and gtk icon cache (bug 370059)
-	xdg_pkg_postrm
-}

diff --git a/net-print/cups/files/cups-2.3_rc1-no_pam.patch b/net-print/cups/files/cups-2.3_rc1-no_pam.patch
deleted file mode 100644
index 17e69ab7b0a..00000000000
--- a/net-print/cups/files/cups-2.3_rc1-no_pam.patch
+++ /dev/null
@@ -1,164 +0,0 @@
-From 3cd7b5e053f8100da1ca8d8daf93976cca3516ef Mon Sep 17 00:00:00 2001
-From: Michael R Sweet <michael.r.sweet@×××××.com>
-Date: Fri, 23 Feb 2018 13:21:56 -0500
-Subject: [PATCH] Fix builds without PAM (Issue #5253)
-
---- a/scheduler/auth.c
-+++ b/scheduler/auth.c
-@@ -67,9 +68,6 @@ static int		check_authref(cupsd_client_t *con, const char *right);
- static int		compare_locations(cupsd_location_t *a,
- 			                  cupsd_location_t *b);
- static cupsd_authmask_t	*copy_authmask(cupsd_authmask_t *am, void *data);
--#if !HAVE_LIBPAM
--static char		*cups_crypt(const char *pw, const char *salt);
--#endif /* !HAVE_LIBPAM */
- static void		free_authmask(cupsd_authmask_t *am, void *data);
- #if HAVE_LIBPAM
- static int		pam_func(int, const struct pam_message **,
-@@ -690,14 +688,14 @@ cupsdAuthorize(cupsd_client_t *con)	/* I - Client connection */
- 	    * client...
- 	    */
- 
--	    pass = cups_crypt(password, pw->pw_passwd);
-+	    pass = crypt(password, pw->pw_passwd);
- 
- 	    if (!pass || strcmp(pw->pw_passwd, pass))
- 	    {
- #  ifdef HAVE_SHADOW_H
- 	      if (spw)
- 	      {
--		pass = cups_crypt(password, spw->sp_pwdp);
-+		pass = crypt(password, spw->sp_pwdp);
- 
- 		if (pass == NULL || strcmp(spw->sp_pwdp, pass))
- 		{
-@@ -1991,129 +1989,6 @@ copy_authmask(cupsd_authmask_t *mask,	/* I - Existing auth mask */
- }
- 
- 
--#if !HAVE_LIBPAM
--/*
-- * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
-- *                  as needed.
-- */
--
--static char *				/* O - Encrypted password */
--cups_crypt(const char *pw,		/* I - Password string */
--           const char *salt)		/* I - Salt (key) string */
--{
--  if (!strncmp(salt, "$1$", 3))
--  {
--   /*
--    * Use MD5 passwords without the benefit of PAM; this is for
--    * Slackware Linux, and the algorithm was taken from the
--    * old shadow-19990827/lib/md5crypt.c source code... :(
--    */
--
--    int			i;		/* Looping var */
--    unsigned long	n;		/* Output number */
--    int			pwlen;		/* Length of password string */
--    const char		*salt_end;	/* End of "salt" data for MD5 */
--    char		*ptr;		/* Pointer into result string */
--    _cups_md5_state_t	state;		/* Primary MD5 state info */
--    _cups_md5_state_t	state2;		/* Secondary MD5 state info */
--    unsigned char	digest[16];	/* MD5 digest result */
--    static char		result[120];	/* Final password string */
--
--
--   /*
--    * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
--    * Get a maximum of 8 characters of salt data after $1$...
--    */
--
--    for (salt_end = salt + 3; *salt_end && (salt_end - salt) < 11; salt_end ++)
--      if (*salt_end == '$')
--        break;
--
--   /*
--    * Compute the MD5 sum we need...
--    */
--
--    pwlen = strlen(pw);
--
--    _cupsMD5Init(&state);
--    _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
--    _cupsMD5Append(&state, (unsigned char *)salt, salt_end - salt);
--
--    _cupsMD5Init(&state2);
--    _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
--    _cupsMD5Append(&state2, (unsigned char *)salt + 3, salt_end - salt - 3);
--    _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
--    _cupsMD5Finish(&state2, digest);
--
--    for (i = pwlen; i > 0; i -= 16)
--      _cupsMD5Append(&state, digest, i > 16 ? 16 : i);
--
--    for (i = pwlen; i > 0; i >>= 1)
--      _cupsMD5Append(&state, (unsigned char *)((i & 1) ? "" : pw), 1);
--
--    _cupsMD5Finish(&state, digest);
--
--    for (i = 0; i < 1000; i ++)
--    {
--      _cupsMD5Init(&state);
--
--      if (i & 1)
--        _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
--      else
--        _cupsMD5Append(&state, digest, 16);
--
--      if (i % 3)
--        _cupsMD5Append(&state, (unsigned char *)salt + 3, salt_end - salt - 3);
--
--      if (i % 7)
--        _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
--
--      if (i & 1)
--        _cupsMD5Append(&state, digest, 16);
--      else
--        _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
--
--      _cupsMD5Finish(&state, digest);
--    }
--
--   /*
--    * Copy the final sum to the result string and return...
--    */
--
--    memcpy(result, salt, (size_t)(salt_end - salt));
--    ptr = result + (salt_end - salt);
--    *ptr++ = '$';
--
--    for (i = 0; i < 5; i ++, ptr += 4)
--    {
--      n = ((((unsigned)digest[i] << 8) | (unsigned)digest[i + 6]) << 8);
--
--      if (i < 4)
--        n |= (unsigned)digest[i + 12];
--      else
--        n |= (unsigned)digest[5];
--
--      to64(ptr, n, 4);
--    }
--
--    to64(ptr, (unsigned)digest[11], 2);
--    ptr += 2;
--    *ptr = '\0';
--
--    return (result);
--  }
--  else
--  {
--   /*
--    * Use the standard crypt() function...
--    */
--
--    return (crypt(pw, salt));
--  }
--}
--#endif /* !HAVE_LIBPAM */
--
--
- /*
-  * 'free_authmask()' - Free function for auth masks.
-  */