FS#75016 - libcups 2.4.2 links to OpenSSL ... libcups 2.4.1 linked to libgnutls.so

Attached to Project: Arch Linux
Opened by Ryan Phillips (rphillips) - Friday, 10 June 2022, 01:01 GMT
Last edited by Toolybird (Toolybird) - Sunday, 31 July 2022, 03:42 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To No-one
Architecture All
Severity High
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No


The new libcups-2.4.2 added support for OpenSSL. Arch Linux is now linking to libcups-2.4.2 to OpenSSL where prior to 2.4.2 the library linked to libgnutls. This new behavior is breaking Plexamp (and likely other packages).

The main Plex forum is tracking the problem in this thread https://forums.plex.tv/t/plexamp-suddenly-no-longer-works-on-any-of-my-computers/795172/1 . The fix currently is to roll back to libcups-2.4.1. Forcing the Arch libcups-2.4.2 package to link to gnutls is probably a good fix.

Additional info:
* libcups-2.4.2-1 and libcups-2.4.2-2 (not working) is linking against OpenSSL
* libcups-2.4.1-X (working) is linking against GnuTLS

Steps to reproduce:
Install plexamp-appimage with the new libcups-2.4.2-{1 or 2}. Notice an 'Unknown Error' upon trying to login. A successful call to the API with invalid credentials will return an error to the app 'User could not be authenticated'.
This task depends upon

Closed by  Toolybird (Toolybird)
Sunday, 31 July 2022, 03:42 GMT
Reason for closing:  Fixed
Additional comments about closing:  cups 1:2.4.2-3
Comment by Ryan Phillips (rphillips) - Friday, 10 June 2022, 01:07 GMT

This patch fixes the issue for the PKGBUILD

diff --git a/trunk/PKGBUILD b/trunk/PKGBUILD
index 415a1d4..a07f924 100644
--- a/trunk/PKGBUILD
+++ b/trunk/PKGBUILD
@@ -83,6 +83,7 @@ build() {
--enable-pam=yes \
--enable-raw-printing \
--enable-dbus=yes \
+ --with-tls=gnutls \
--with-dbusdir=/usr/share/dbus-1 \
--enable-relro \
--enable-libpaper \
Comment by Michel Koss (MichelKoss1) - Sunday, 19 June 2022, 09:35 GMT
  • Field changed: Percent Complete (100% → 0%)
Openssl is upstream default preference now and I don't see why Arch need to change it only because some third party appimage is broken. This is bug in appimage app not in Arch package and the "fix" should be reverted.
Comment by Michael Gwin (oksijun) - Sunday, 19 June 2022, 18:09 GMT
I think there's more to this than that.
{,lib}cups-2.4.2-2 broke printing to my canon pixma ts8151 (throwing a cups-pki-invalid error), and the relink to gnutls in 2.4.2-3 fixed it.
No appimage involved.
Comment by Ryan Phillips (rphillips) - Sunday, 19 June 2022, 18:32 GMT
The OpenSSL support is not mature in libcups since the feature was introduced just recently. If we want to migrate to OpenSSL then it should be purposeful with it being tested.
Comment by Michel Koss (MichelKoss1) - Sunday, 19 June 2022, 21:32 GMT
There was one openssl related issue fixed post release: https://github.com/OpenPrinting/cups/commit/c0c403744b1bf4a9790a8fcaabcd60970cbefe06

It was reported by Arch user and fixed by upstream. Case closed. Those mentioned here were just hidden under the carpet. I don't think Arch maintainers could test for all possible bugs themselves ever and those bugs won't be fixed automagically - someone needs to find and report them. It happens elsewhere - Arch users are significant source of foss bug reports since they are often among first adopters of new releases.

For those reasons switching over to openssl may make sense even if there will be some short term pain which will convert to long term benefit. Keep in mind we talk about upstream default not some experimental knob.

I agree some sort of testing including reading changelogs and tracking actual set of dependencies is appreciated :)
Comment by Ryan Phillips (rphillips) - Sunday, 19 June 2022, 21:56 GMT
@MichelKoss1 That is not correct. I tested the upstream patch and it did not clear up the issue reported.

The upstream default should still be gnutls. Switching the default library on a point release is not semver compatible. We do need a report upstream on the issue, but I did not have the time to do so.
Comment by Michel Koss (MichelKoss1) - Monday, 20 June 2022, 00:03 GMT
@rphillips upstream patch fixed reported issue[1]. Yours issue wasn't fixed because you didn't report it. This is what I wrote in above comment, please re-read it. Basically you proved my point: instead of reporting issue you asked for hiding it and moved on, leaving it unfixed. Reporting it doesn't take much more time than writing comments here.

[1] https://github.com/OpenPrinting/cups/issues/409#issuecomment-1149019755
Comment by Ryan Phillips (rphillips) - Monday, 20 June 2022, 00:11 GMT
Thanks for the info.. Please report it upstream Michel!
Comment by Michel Koss (MichelKoss1) - Monday, 20 June 2022, 00:23 GMT
Report what? Bug I never hit myself? If you don't want to help solving your own problem then perhaps it's not worth solving by others.
Comment by Ryan Phillips (rphillips) - Monday, 20 June 2022, 00:29 GMT
It's definitely worth solving, and I would definitely like to help, but I do not have the time to dedicate to it at this moment.
Comment by Toolybird (Toolybird) - Sunday, 31 July 2022, 03:42 GMT
FWIW, both Debian & Fedora are building 2.4.2 against gnutls. We can revisit in the future.