diff --git a/cups.spec b/cups.spec index 6249282..45191ce 100644 --- a/cups.spec +++ b/cups.spec @@ -7,6 +7,13 @@ # but we use lib for compatibility with 3rd party drivers (at upstream request). %global cups_serverbin %{_exec_prefix}/lib/cups +# we still need something for python2... +%if 0%{?rhel} >= 8 || 0%{?fedora} +%bcond_without python3 +%else +%bcond_with python3 +%endif + #%%global prever rc1 #%%global VERSION %%{version}%%{prever} %global VERSION %{version} @@ -15,7 +22,7 @@ Summary: CUPS printing system Name: cups Epoch: 1 Version: 2.4.6 -Release: 4%{?dist} +Release: 5%{?dist} # backend/failover.c - BSD-3-Clause # cups/md5* - Zlib # scheduler/colorman.c - Apache-2.0 WITH LLVM-exception AND BSD-2-Clause @@ -33,7 +40,7 @@ Source1: cupsprinter.png Source2: macros.cups # upgrade script for CUPS-Get-Document fix # remove after Fedora 40 is EOL and C10S is released -Source3: upgrade_get_document.py +Source3: upgrade_get_document.py.in # PAM enablement, very old patch, not even git can track when or why # the patch was added. @@ -476,6 +483,13 @@ s:.*\('%{_datadir}'/\)\([^/_]\+\)\(.*\.po$\):%lang(\2) \1\2\3: # C10S is released and Fedora 40 is EOL install -m 0755 %{SOURCE3} %{buildroot}%{_sbindir}/upgrade_get_document +# adjust shebang for old python2 if needed - remove once C10S is released and F40 EOL +%if %{with python3} + sed -i 's,@PYTHON_SHEBANG@,#!/usr/bin/python3,' %{buildroot}%{_sbindir}/upgrade_get_document +%else + sed -i 's,@PYTHON_SHEBANG@,#!/usr/bin/python,' %{buildroot}%{_sbindir}/upgrade_get_document +%endif + %post # remove after CentOS Stream 10 is released # Require authentication for accessing /admin location @@ -778,6 +792,9 @@ rm -f %{cups_serverbin}/backend/smb %{_mandir}/man7/ippeveps.7.gz %changelog +* Mon Aug 14 2023 Zdenek Dohnal - 1:2.4.6-5 +- comply the upgrade script with python2 as well if needed + * Thu Aug 10 2023 Zdenek Dohnal - 1:2.4.6-4 - add upgrade script for setting authentication for CUPS-Get-Document operation diff --git a/upgrade_get_document.py b/upgrade_get_document.py deleted file mode 100755 index 7e54594..0000000 --- a/upgrade_get_document.py +++ /dev/null @@ -1,171 +0,0 @@ -#!/usr/bin/python3 - -""" -Upgrade script to enable authentication for CUPS-Get-Document in -default policy -""" - -import os -import sys -from shutil import copy - - -def get_cupsd_conf(): - """ - Get all lines from cupsd.conf - """ - if not os.path.exists('/etc/cups/cupsd.conf'): - return None - - lines = [] - with open('/etc/cups/cupsd.conf', encoding="utf-8") as conf: - lines = conf.readlines() - - return lines - - -def get_default_policy(lines): - """ - Get the default policy lines - - :param list lines: lines from cupsd.conf - """ - default_policy = [] - in_policy = False - - for line in lines: - if not in_policy and not line.lstrip().startswith(''): - continue - - default_policy.append(line) - - if line.lstrip().startswith(''): - return default_policy - - in_policy = True - - return default_policy - - -def get_limit_with_document(lines): - """ - Get scope which defines CUPS-Get-Document operation - - :param list lines: Lines containing the default policy - """ - limit = [] - in_limit = False - - for line in lines: - if not in_limit and not line.lstrip().startswith(''): - return limit - - in_limit = True - - return limit - - -def check_for_authtype(lines): - """ - Check if defining CUPS-Get-Document defines - any authentication - - :param list lines: Lines of scope which defines CUPS-Get-Document - """ - for line in lines: - if line.lstrip().startswith('AuthType'): - return True - return False - - -def migrate_cupsd_conf(lines): - """ - Make changes to cupsd.conf contents to use authentication - for CUPS-Get-Document - - :param list lines: Lines from cupsd.conf - """ - new_lines = [] - in_policy = False - create_document_limit = False - - for line in lines: - if (in_policy and line.lstrip().startswith('') and - 'CUPS-Get-Document' in line.lstrip().split('#')[0][1:-1]): - line = line.replace(' CUPS-Get-Document', '') - create_document_limit = True - - if in_policy and line.lstrip().startswith('') and create_document_limit: - new_lines.append('\n') - new_lines.append((len(line) - len(line.lstrip()) + 2) * ' ' + - '# added during upgrade\n') - new_lines.append((len(line) - len(line.lstrip()) + 2) * ' ' + - '\n') - new_lines.append((len(line) - len(line.lstrip()) + 4) * ' ' + - 'AuthType Default\n') - new_lines.append((len(line) - len(line.lstrip()) + 4) * ' ' + - 'Require user @OWNER @SYSTEM\n') - new_lines.append((len(line) - len(line.lstrip()) + 4) * ' ' + - 'Order deny,allow\n') - new_lines.append((len(line) - len(line.lstrip()) + 2) * ' ' + - '\n') - create_document_limit = False - - new_lines.append(line) - - if not in_policy: - if line.lstrip().startswith(''): - in_policy = True - continue - - if line.lstrip().startswith(''): - new_lines.append((len(line) - len(line.lstrip()) + 2) * ' ' + - '# added during upgrade\n') - new_lines.append((len(line) - len(line.lstrip()) + 2) * ' ' + - 'AuthType Default\n') - continue - - if line.lstrip().startswith(''): - in_policy = False - continue - - return new_lines - - -def apply_changes(lines): - """ - Backup the original file if there is no .rpmsave already and - apply changes to the actual cupsd.conf - - :param list lines: New lines for cupsd.conf - """ - if not os.path.exists('/etc/cups/cupsd.conf.rpmsave'): - copy('/etc/cups/cupsd.conf', '/etc/cups/cupsd.conf.rpmsave') - - with open('/etc/cups/cupsd.conf', 'w', encoding='utf-8') as conf: - conf.writelines(lines) - - - -content = get_cupsd_conf() -if content is None: - sys.exit(1) - -if check_for_authtype(get_limit_with_document(get_default_policy(content))): - sys.exit(0) - -new_content = migrate_cupsd_conf(content) - -apply_changes(new_content) - -sys.exit(0) diff --git a/upgrade_get_document.py.in b/upgrade_get_document.py.in new file mode 100755 index 0000000..91d393f --- /dev/null +++ b/upgrade_get_document.py.in @@ -0,0 +1,171 @@ +@PYTHON_SHEBANG@ + +""" +Upgrade script to enable authentication for CUPS-Get-Document in +default policy +""" + +import os +import sys +from shutil import copy + + +def get_cupsd_conf(): + """ + Get all lines from cupsd.conf + """ + if not os.path.exists('/etc/cups/cupsd.conf'): + return None + + lines = [] + with open('/etc/cups/cupsd.conf', 'r') as conf: + lines = conf.readlines() + + return lines + + +def get_default_policy(lines): + """ + Get the default policy lines + + :param list lines: lines from cupsd.conf + """ + default_policy = [] + in_policy = False + + for line in lines: + if not in_policy and not line.lstrip().startswith(''): + continue + + default_policy.append(line) + + if line.lstrip().startswith(''): + return default_policy + + in_policy = True + + return default_policy + + +def get_limit_with_document(lines): + """ + Get scope which defines CUPS-Get-Document operation + + :param list lines: Lines containing the default policy + """ + limit = [] + in_limit = False + + for line in lines: + if not in_limit and not line.lstrip().startswith(''): + return limit + + in_limit = True + + return limit + + +def check_for_authtype(lines): + """ + Check if defining CUPS-Get-Document defines + any authentication + + :param list lines: Lines of scope which defines CUPS-Get-Document + """ + for line in lines: + if line.lstrip().startswith('AuthType'): + return True + return False + + +def migrate_cupsd_conf(lines): + """ + Make changes to cupsd.conf contents to use authentication + for CUPS-Get-Document + + :param list lines: Lines from cupsd.conf + """ + new_lines = [] + in_policy = False + create_document_limit = False + + for line in lines: + if (in_policy and line.lstrip().startswith('') and + 'CUPS-Get-Document' in line.lstrip().split('#')[0][1:-1]): + line = line.replace(' CUPS-Get-Document', '') + create_document_limit = True + + if in_policy and line.lstrip().startswith('') and create_document_limit: + new_lines.append('\n') + new_lines.append((len(line) - len(line.lstrip()) + 2) * ' ' + + '# added during upgrade\n') + new_lines.append((len(line) - len(line.lstrip()) + 2) * ' ' + + '\n') + new_lines.append((len(line) - len(line.lstrip()) + 4) * ' ' + + 'AuthType Default\n') + new_lines.append((len(line) - len(line.lstrip()) + 4) * ' ' + + 'Require user @OWNER @SYSTEM\n') + new_lines.append((len(line) - len(line.lstrip()) + 4) * ' ' + + 'Order deny,allow\n') + new_lines.append((len(line) - len(line.lstrip()) + 2) * ' ' + + '\n') + create_document_limit = False + + new_lines.append(line) + + if not in_policy: + if line.lstrip().startswith(''): + in_policy = True + continue + + if line.lstrip().startswith(''): + new_lines.append((len(line) - len(line.lstrip()) + 2) * ' ' + + '# added during upgrade\n') + new_lines.append((len(line) - len(line.lstrip()) + 2) * ' ' + + 'AuthType Default\n') + continue + + if line.lstrip().startswith(''): + in_policy = False + continue + + return new_lines + + +def apply_changes(lines): + """ + Backup the original file if there is no .rpmsave already and + apply changes to the actual cupsd.conf + + :param list lines: New lines for cupsd.conf + """ + if not os.path.exists('/etc/cups/cupsd.conf.rpmsave'): + copy('/etc/cups/cupsd.conf', '/etc/cups/cupsd.conf.rpmsave') + + with open('/etc/cups/cupsd.conf', 'w') as conf: + conf.writelines(lines) + + + +content = get_cupsd_conf() +if content is None: + sys.exit(1) + +if check_for_authtype(get_limit_with_document(get_default_policy(content))): + sys.exit(0) + +new_content = migrate_cupsd_conf(content) + +apply_changes(new_content) + +sys.exit(0)