The return value of cupsdStartProcess is zero on error. Fix two cases where this is checked incorrectly. PR: 211465add06b461d
cups -- security vulnerabilitiesentered 2025-09-12
Common UNIX Printing System
# pkg install cupsinstalls 2.4.20 from latest; from quarterly (2026Q4) 2.4.20# cd /usr/ports/print/cups && make install clean# make -C /usr/ports/print/cups config # change options first
cups, group cups| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 2.4.20 | 2.4.19_2 | – |
| FreeBSD 15 | 2.4.20 | 2.4.20 | – |
| FreeBSD 14 | 2.4.20 | 2.4.19_2 | 2.4.20 |
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 2.4.20 | 2.4.20 | – |
| FreeBSD 14 | 2.4.20 | 2.4.19_2 | 2.4.20 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
pkg audit for the packaged version 2.4.20.The return value of cupsdStartProcess is zero on error. Fix two cases where this is checked incorrectly. PR: 211465add06b461d
Assume "pkg-config libusb*" works after 9.x EOL FreeBSD appears to use different pkg-config name for 0.1.x API but it doesn't matter much as 0.1, 1.0 and 2.0 share CFLAGS/LIBS.7277ec6a16
Update to 2.2.1.42f4778968
- Update to 2.1.4. - Let the socket backend print debug messages on the DEBUG channel. The other channels affect the printer status message in lpstat(1) which can be confusing. [1] PR: 203058 [1]50ed08f39a
Replace @*exec with explicit postinstall @postexecff857f1cf5
Remove ${PORTSDIR}/ from dependencies, categories m, n, o, and p.
With hat: portmgr
Sponsored by: Absolight8d6597e0bb- Update security/gnutls to 3.4.10. - Rename the LIBDANE option DANE because that's the name of the protocol supported by libgnutls-dane and gnutls-cli. Also clarify the option description. - Add an IDN option. - libgnutls-openssl has been removed in 3.4. Some ports used this library in their LIB_DEPENDS but no port actually required it. - Some old API functions have been removed. Ports t net-im/jabber: This port used the old API to give users fine grained control over which crypto algorithms were used via a configuration file. It's not immediately obvious how to port this to the new API so the port always uses the defaults now. www/hydra: Mark BROKEN. This uses more removed calls than the other ports, is said to be alpha quality and not fully functional and has been abandoned 10 years ago. PR: 207768 Exp-run by: antoine Approved by: portmgr (antoine)6bc6f3a9e0
print/cups: revive GNUTLS option after r389015 SSL remains enabled by default but now can be optionally disabled reducing reducing the number of dependencies. PR: 208223 Approved by: tijl (maintainer)97638adc98
Support systems with WITHOUT_USB in /etc/src.conf. Reported by: dweimer@dweimer.net0b4e0f28c9
Add a patch to print/cups and print/hplip to disable detaching of ulpt(4). This isn't needed on FreeBSD and it always fails because the process doesn't have the required privileges. Add a sample devd configuration file to print/cups that gives users in group cups access to USB printers. [1] Submitted by: hselasky, Alexander Zagrebin <alex@zagrebin.ru> [1]420c6d6b94
Fix make check-plist when ${LOCALBASE}/etc/pam.d does not exist.
Reported by: rakuco6159e62eccCombine print/cups-base, print/cups-client and print/cups-image into print/cups and update it to 2.1.3. Also remove print/cups-pstoraster, improve print/cups-filters, print/foomatic-* and update print/hplip to 3.16.2. Long description: First some background. When you hand a file to cups it sets up a chain of filter programs that converts the file to something a printer understands. Each filter has a cost associated with it and cups tries to find the cheapest chain. Costs used to be configured in such a way that files were first converted to PostScript. This could then be manipulated further (e.g. putting multiple pages on one sheet) before finally being sent to a PostScript printer or another filter like pstoraster which produces a raster format understood by non-PostScript printer drivers. Nowadays most filters have been moved from cups to cups-filters and they have been configured to use PDF as an intermediate format instead of PostScript. Merging of cups-base, cups-client and cups-image into print/cups: - cups-image provides a library to work with the cups raster format. It is only used to implement filters and printer drivers and these only exist in the context of a cups server so there's no need to separate this from cups-base. - cups-client provides a library that allows applications to print via cups. It is possible to use the library to access a remote cups server without running a local cups server, but such a setup is discouraged and the configuration file to set this up has been marked deprecated. It is better to run a local cups server and let that talk to the remote cups server because then you have the benefits of local job queuing in case the remote server is down or busy. Given this and the fact that without filters cups-base is now smaller than it used to be it makes sense to merge the ports. The patch also adds options IPPTOOL, DOCS and NLS which when disabled make the new cups package smaller than the current cups-client package. Merging the ports also prevents problems with options like ZEROCONF being configured differently in both ports. - print/cups was a metaport that depended on cups-base and some filters. There isn't really a need for such a metaport so cups-base can be renamed to cups. The filters can be depended on by printer drivers such as hplip if they need them. Additional changes to the new print/cups: - Clean up the patches. They seem to have been regenerated with post-patch changes included. - Add a patch to prevent intermediate conversion to PDF when a PostScript file is sent to a PostScript printer when cups-filters is installed. - Fix the PAM configuration file. - Add a patch to let the server search /usr/local/share/ppd like on Linux so other ports don't have to add links to it. - Remove ulpt(4) helper scripts. The port uses libusb with ugen(4). - Remove support for mDNSResponder. cups-filters only supports Avahi. - Combine ICONS and XDG_OPEN options into an X11 option to support WITHOUT_X11. - Optionally depend on colord for ICC profile support. - Various smaller changes. Changes to print/cups-filters: - Let the cups_browsed rc.d script depend on cupsd and avahi_daemon instead of LOGIN. - Development of foomatic-filters has been moved to cups-filters so let this port install foomatic related files and add foomatic-filters to CONFLICTS. - Fix location of liblouis tables. - Add patch to fix ICC support. Changes to print/cups-pstoraster: This port is essentially an old version of Ghostscript plus a cups filter. It's no longer developed. This commit removes it and changes existing dependencies to print/cups-filters which depends on print/ghostscript* and includes a gstoraster filter that can handle both PostScript and PDF. Changes to print/foomatic-db*: Remove old MASTER_SITES and dependencies and eliminate PKGNAMEPREFIX. Changes to print/foomatic-filters: Install beh backend with its original name again and add cups-filters to CONFLICTS. Changes to print/hplip: - Stop installing hpijs/foomatic-rip support. This is no longer supported upstream. - Stop installing hpcups PPDs. These are now automatically generated. The bundled PPDs are generated for an older version of cups. - Rename the QT option to X11 to support WITHOUT_X11. - Simplify the patches now that ports are installed in a staging area. - Add a patch to set SO_REUSEPORT (next to SO_REUSEADDR) on the mDNS socket like avahi-daemon does. This fixes Zeroconf support for HP network printers. PR: 207746 Exp-run by: antoine Approved by: portmgr (antoine)59272d1017
Delete print/cups before renaming print/cups-base. This is just a metaport for various cups components that will no longer be needed. PR: 207746f9f18301f0
- Makefile.local for slave ports is included by bsd.port.mk r39751978b97f0b61
print/cups-base: bump port revision PR: 190434 Pointy hat to: pi2c5577b377
print/cups-base: revert change for ICONS option - This does not really solve the problem PR: 190434 Pointy hat to: pi3a712d541e
print/cups-base: rename ICONS option to X11 Why this change ? - When compiling print/cups-base, if WITHOUT_X11=yes is present in /etc/make.conf, CUPS still tries to update the "Icons cache". - For this, it tries to build graphics/gtk-update-icon-cache, which in turns requires graphics/cairo, but Cairo builds without X11 support as requested, and graphics/gtk-update-icon-cache fails to build because it needs X11. PR: 190434 Submitted by: Tobias Kortkamp <t@tobik.me> Reported by: hjf@hjf.com.ar16d6bc5cf4
Remove UNIQUENAME and LATEST_LINK. UNIQUENAME was never unique, it was only used by USE_LDCONFIG and now, we won't have conflicts there. Use PKGBASE instead of LATEST_LINK in PKGLATESTFILE, the *only* consumer is pkg-devel, and it works just fine without LATEST_LINK as pkg-devel has the correct PKGNAME anyway. Now that UNIQUENAME is gone, OPTIONSFILE is too. (it's been called OPTIONS_FILE now.) Reviewed by: antoine, bapt Exp-run by: antoine Sponsored by: Absolight Differential Revision: https://reviews.freebsd.org/D333621a283f3be
Convert to USES=jpeg6e5719ca80
- Convert to USES=metaport - BUILD_DEPENDS are not needed for a metaport - Substitude real paths in pkg-messagea793c96ef3
Attempt to fix runtime on FreeBSD 10 Reported by: pkg-fallout6d18d6f568
Add missing iconv library. PR: 200755adc4965d0a
Add a missing file to plist when Avahi is selected.e017cd45cb
CUPS 2.x does not support OpenSSL any more. Switch to GNU TLS by default. MFH: 2015Q2faba3ae49d
Bump version after cups-base update. Noticed by: jkim MFH: 2015Q23a2b921932
Security update to 2.0.3.a054f91232
- Add CPE info Approved by: portmgr blanket0dc7363f5b
3 ports categories: Remove $PTHREAD_LIBS Categories: print, science, emulators approved by: PTHREAD blanket312461b6fa
print/cups-client via print/cups-base: treat avahi/dnssd explicitely
1. The port's configure script is auto-detecting if avahi exists
(unless avahi is explicitely disabled):
---
9096 if test "x$PKGCONFIG" != x -a x$enable_avahi != xno; then
9097 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for Avahi" >&5
9098 $as_echo_n "checking for Avahi... " >&6; }
9099 if $PKGCONFIG --exists avahi-client; then
9100 { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
9101 $as_echo "yes" >&6; }
---
So if avahi-lib is installed one get config.log:
---
configure:9097: checking for Avahi
configure:9100: result: yes
[...]
#define HAVE_AVAHI 1
---
And later avahi is used while building:
---
Using LIBS=-lcups -lssl -lcrypto -L/usr/local/lib -lavahi-common -lavahi-client -lz -pthread -lm -lcrypt -lz
---
Then print/cups-client installs libraries which are linked with avahi, ex.:
---
% ldd libcups.so | grep avahi
libavahi-common.so.3 => /usr/local/lib/libavahi-common.so.3 (0x801cda000)
libavahi-client.so.3 => /usr/local/lib/libavahi-client.so.3 (0x801ee6000)
---
Which leads to print/cups-base build failure (even if avahi is unset by options):
---
Linking ippserver...
cc -L../cgi-bin -L../cups -L../filter -L../ppdc -L../scheduler -L/usr/local/lib -Wl,-rpath,/usr/lib:/usr/local/lib -fstack-protector -Wl,-R/usr/local/lib -Wall -Wno-format-y2k -Wunused -fPIC -Os -g -fstack-protector -Wno-tautological-compare -o ippserver ippserver.o ../cups/libcups.a \
-lssl -lcrypto -ldns_sd -pthread -lm -lcrypt -lz -lz
../cups/libcups.a(http-support.o): In function `_httpResolveURI':
---
Let's reflect this fact.
2. Bump PORTREVISION for print/cups-client, it's default options and dependencies
were changed.
PR: ports/195743
Submitted by: O. Hartmann <ohartman@zedat.fu-berlin.de>
Discussed at: ports@
Tested by: O. Hartmann <ohartman@zedat.fu-berlin.de>5d2ca95e1bsecurity/libgcrypt: 1.6.1 -> 1.6.2, bump depends
Changes:
- src/sexp.c (do_vsexp_sscan): Return error for invalid args.
- cipher/md.c (_gcry_md_info): Fix a segv in case of calling
with wrong parameters.
- cipher/primegen.c (_gcry_generate_elg_prime): Change to return an
error code, possible NULL deref in call to prime generator.
- cipher/dsa.c (generate): Take care of new return code.
- cipher/elgamal.c (generate): Change to return an error code. Take
care of _gcry_generate_elg_prime return code.
- ecc: Support the non-standard 0x40 compression flag for EdDSA.
- mpi: Extend the internal mpi_get_buffer.
- mpi: Fix regression for powerpc-apple-darwin detection.
- Fix bug inhibiting the use of the sentinel attribute in src/gcrypt.h.in
- Fix building for the x32 target without asm modules in
mpi/generic/mpi-asm-defs.h: Use a fixed value for the x32 ABI.
- Fix ARM assembly when building __PIC__
- mpi: Fix a subtle bug setting spurious bits with in mpi_set_bit.
* mpi/mpi-bit.c (_gcry_mpi_set_bit, _gcry_mpi_set_highbit): Clear
allocated but not used bits before resizing.
* tests/t-mpi-bits.c (set_bit_with_resize): New.
- Use internal malloc function in fips.c.
* src/fips.c (check_binary_integrity): s/gcry_malloc/xtrymalloc/.
- pubkey: Re-map all deprecated RSA algo numbers.
- cipher: Fix possible NULL dereference in cipher/md.c for being NULL.
- Fix ARMv6 detection when CFLAGS modify target CPU architecture.
PR: 193264
Approved by: cpm@fbsd.es (maintainer)cba03c03e1Bump portrevision after png updatebb21093773
Change libpng15.so to libpng.so in LIB_DEPENDS to prepare the upgrade7ae46e9b12
print/cups-base: Fix build when PAM option is enabled The @sample keyword fixes the config file based error. While here, clean refactor the port a bit. PR: 194854 Submitted by: Adrian Waters Final fix by: Takefu (airport.fm)5f19ee0628
Properly strip libraries in cups-base, cups-client and cups-image portse7b109f6df
Cleanup plist115aba45f3
- Let the rc script require the mdnsd or avahi_daemon rc scripts [1] - Fix two getsockopt calls so they return peer credentials correctly [2] PR: 194856 [1], 191515 [2] Submitted by: Adrian Waters <draenan@gmail.com> [1] Submitted by: Bengt Ahlgren <bengta@sics.se> [2]7888e65fff
- Convert ports of news/ and print/ to new USES=python Approved by: portmgr (implicit)d45fbf3040
Update the default version of GCC in the Ports Collection from GCC 4.7.4 to GCC 4.8.3. Part II, Bump PORTREVISIONs. PR: 192025 Tested by: antoine (-exp runs) Approved by: portmgr (implicit)15945f8122
DOCS isn't optional. The files provide the cups web interface.9c67a6b13f
security/libgcrypt: 1.5.3_3 -> 1.6.1 - Update to 1.6.1 - Remove some unneeded patches - Fix pkg-plist - report configure bug upstream https://bugs.g10code.com/gnupg/issue1668 - report API breakage downstream and find that MacPorts had the same issue https://rt.cpan.org/Ticket/Display.html?id=97201 - bump PORTREVISION for dependent ports (approx. 100 ports) - Thanks to exp-run by antoine@ to find ports that break - patch ports that would otherwise break security/shishi with PR 192164 is already committed [1] devel/ccrtp [2] editors/abiword [3] security/p5-Crypt-GCrypt PR: 191256, 192162 [1], 192163 [2], 192166 [3] Submitted by: Carlos Jacobo Puga Medina <cjpugmed@gmail.com> Approved by: maintainer timeout, antoine (exp-run), portmgr (implicit)b95d127471
print/cups-base: Don't use avahi when MDNSRESPONDER option is selected PR: 191619 Submitted by: Don Lewis Approval: Not required; port is unmaintainedd1dbd236f3
- Replace security/gnutls with security/gnutls3 and update to 3.2.15 - Bump PORTREVISION on all ports that depend on security/gnutls and adjust all ports that depend on security/gnutls3 - Update mail/anubis to version 4.2 which supports gnutls 3.x - Update mail/libvmime to a development snapshot (recommended by upstream developers) PR: 191274 Exp-run by: antoine Approved by: portmgr (antoine)3ab1b8443e
- Update to 1.7.3 - Add DOCS option - PHP option no longer installs a PHP module (it was eliminated in 1.6) - Add options for other interpreters - Add OPENSSL option to make it clearer that it is enabled instead of GNUTLS - Fix build when ZEROCONF is disabled - Fix detection of libusb on FreeBSD < 10 as they do not have .pc files for it - Use @sample directive in pkg-plist - Remove some old cruft89fe55a74a
- Switch print/libpaper to USES=libtool, drop .la files - Bump dependent ports as .so version has changed Approved by: portmgr blanket627d72d304
Support LIBS like LDFLAGS.
- Add LIBS="${LIBS}" to MAKE_ENV and CONFIGURE_ENV.
- Add an option helper for LIBS.
- Adjust all ports that already use LIBS. Also remove references to
PTHREAD_CFLAGS and PTHREAD_LIBS while here.
- Some ports did not support having a LIBS environment variable and
required additional patches.
Somewhat simplified a linker command line looks like:
${CC} ${src_LDFLAGS} ${LDFLAGS} ${src_LIBS} ${LIBS}
where src_LDFLAGS and src_LIBS are controlled by upstream and LDFLAGS and
LIBS can be controlled by us. If possible -L and -l flags need to be
added to LIBS to make sure they appear after any -L and -l flags set by
upstream. Many ports currently add -L${LOCALBASE}/lib to LDFLAGS but this
may appear too early on the command line causing installed libraries to
be linked in instead of freshly built ones.
Additional changes:
benchmarks/netio: Replace WITH_IPV6 with an IPV6 option.
comms/gnokii: Replace some patches with USES=pathfix. Also remove -fPIC.
graphics/gimageview: USES=libtool and install desktop file in DESKTOPDIR.
graphics/visionworkbench: Remove FreeBSD 7 support.
multimedia/libmovtar: New LIB_DEPENDS syntax.
multimedia/opencinematools: Use standard do-build.
net/siproxd: USES=libtool:keepla (port actually needs .la files for plugins)
net-mgmt/nagios: Remove -fPIC.
net-mgmt/nagios4: Remove -fPIC.
print/cups-base: Only add -lssp_nonshared on i386 and OSVERSION < 1000036.
security/p11-kit: Replace PTHREAD_LIBS in CONFIGURE_ENV with
ac_cv_func_pthread_mutexattr_init=no in CONFIGURE_ARGS. This skips a test
in configure that falsely detects pthread_mutexattr_init in our libc.
sysutils/dar: Fix iconv detection.
x11/rxvt-unicode: Remove -lstdc++ and patch configure to remove a FreeBSD
hack and use $CXX as linker as on other platforms.
PR: 190592
Exp-run by: antoine
Approved by: portmgr (antoine)9f8b4bcde3print/cups-base: remove files/cups_browsed.in, it does not belong here . remove using cups_browsed.in; [1] . bump PORTREVISION. PR: ports/190085 [1] Submitted by: Fafael Ostertag <rafi@guengel.ch> [1]49d1531ae2
print/cups-base: unbreak AVAHI option and add missing rc script
- Add missing rc script for cups-browsed [1]
- Enable building CUPS with native Avahi backend [2]
- Disable AVAHI if not selected [3]
PR: ports/188550 [1],
ports/189757 [2],
ports/188751 [3]
Submitted by: Rafael Ostertag <rafi@guengel.ch> [1],
Raivo Hool <raivo.hool@gmail.com> [2],
Dan Lukes <dan@obluda.cz> [3]
Approved by: culot (mentor)a843d55831print/cups-base: add an options ICONS to install desktop icons When unchecked this option greatly reduces the package depends list [1] (from 82 to 42). Defaults to "on" for ordinary package users sake. Submitted by: Hilko Meyer <Hilko.Meyer@gmx.de> [1]aac0bcbd6e
print/cups{,-base,-client,-image}: update to version 1.7.2
MDNSRESPONDER id now the default option for print/cups-base
(can't be compiled without dnssd).38bd336744print/cups-base: remove BLOCKS detection from cups/cups.h It appears to be the best option here, i.e. just remove BLOCKS detection from cups/cups.h: there are some other ports which use cups/cups.h and get broken by a BLOCKS detection. So: . patch cups/cups.h to remove the offending code; . remove traces of previous attempts to fix cups-* ports; . bump PORTREVISION; . at PORTNAME block add a note that PORTREVISION is defined later for all ports. Discussed at: freebsd-ports Suggested by: tijl MFH: 2014Q20e9ef71a83