2253764 - golang-github-openprinting-ipp-usb-0.9.24 is available

.gitignore

@@ -8,3 +8,4 @@
 /ipp-usb-0.9.21.tar.gz
 /ipp-usb-0.9.22.tar.gz
 /ipp-usb-0.9.23.tar.gz
+/ipp-usb-0.9.24.tar.gz

golang-github-openprinting-ipp-usb.spec

@@ -3,8 +3,8 @@
 
 # https://github.com/OpenPrinting/ipp-usb
 %global goipath         github.com/OpenPrinting/ipp-usb
-Version:                0.9.23
+Version:                0.9.24
-%global tag             0.9.23
+%global tag             0.9.24
 
 %gometa
 
@@ -24,7 +24,7 @@ Requires:  pkgconfig(libusb-1.0) >= 1.0
 }
 
 Name:           %{goname}
-Release:        5%{?dist}
+Release:        1%{?dist}
 Summary:        HTTP reverse proxy, backed by IPP-over-USB connection to device
 
 # Upstream license specification: BSD-2-Clause
@@ -32,6 +32,11 @@ License:        BSD-2-Clause
 URL:            %{gourl}
 Source0:        %{gosource}
 
+# reverting the change which introduced support for Pantum printers, which
+# broke conformation to IPP standards and has security implications
+# https://lore.kernel.org/printing-architecture/b2c6c270-4933-4bde-a299-52802e6e8d88@shentel.net/T/#u
+Patch001: pantum-support-revert.patch
+
 # needed for registering device on localhost
 BuildRequires:  pkgconfig(avahi-client) >= 0.7
 # implements IPP protocol used in ipp-usb
@@ -61,6 +66,7 @@ Requires: systemd-udev
 
 %prep
 %goprep
+%autopatch
 
 %build
 %gobuild -o %{gobuilddir}/bin/ipp-usb %{goipath}
@@ -104,7 +110,7 @@ install -m 0644 -vp ipp-usb-quirks/* %{buildroot}%{_datadir}/ipp-usb/quirks
 %dir %{_datadir}/ipp-usb/quirks
 %{_datadir}/ipp-usb/quirks/*
 %{_mandir}/man8/ipp-usb.8.*
-%{_sbindir}/*
+%{_sbindir}/ipp-usb
 %dir %{_sysconfdir}/ipp-usb/
 %config(noreplace) %{_sysconfdir}/ipp-usb/ipp-usb.conf
 %dir %{_sysconfdir}/ipp-usb/quirks
@@ -114,6 +120,9 @@ install -m 0644 -vp ipp-usb-quirks/* %{buildroot}%{_datadir}/ipp-usb/quirks
 %gopkgfiles
 
 %changelog
+* Thu Jan 11 2024 Zdenek Dohnal <zdohnal@redhat.com> - 0.9.24-1
+- 2253764 - golang-github-openprinting-ipp-usb-0.9.24 is available
+
 * Thu Nov 23 2023 Zdenek Dohnal <zdohnal@redhat.com> - 0.9.23-5
 - Rebuild for any CVE fixed in Golang
 

pantum-support-revert.patch

@@ -0,0 +1,15 @@
+diff --git a/ipp.go b/ipp.go
+index e707665..c9bffcb 100644
+--- a/ipp.go
++++ b/ipp.go
+@@ -168,9 +168,7 @@ func ippGetPrinterAttributes(log *LogMessage, c *http.Client,
+ 		return
+ 	}
+ 
+-	err = msg.DecodeBytesEx(respData,
+-		goipp.DecoderOptions{EnableWorkarounds: true})
+-
++	err = msg.DecodeBytes(respData)
+ 	if err != nil {
+ 		log.Debug(' ', "Failed to decode IPP message: %s", err)
+ 		log.HexDump(LogTraceIPP, ' ', respData)

sources

@@ -1 +1 @@
-SHA512 (ipp-usb-0.9.23.tar.gz) = 3738f4a59e6c9d591c2b768464bbda4e15bfa3f7aa07010d4d2c20258b379d1439446e1df58c7c646102667671d72531fe5ac7390217be27333a59aa7a68920a
+SHA512 (ipp-usb-0.9.24.tar.gz) = 72c05ae3c4f98775142b3349fc3dee14882d7f348feec2e43fc5976497b90771e073e069becb5936c82036b696b4f9c830a796fb88f40cdd56219cb968e62a6e