packaging: Flatpak finds and prints to CUPS printers (#4634)

* packaging: Flatpak finds and prints to CUPS printers

The Print dialog listed no printers in the Flatpak: the runtime has libcups but not
lpstat/lp, the sandbox couldn't reach the CUPS socket, and driverless network printers
(lpstat -e) need Avahi. Bundle lpstat/lp/lpoptions from CUPS 2.4.20 (Apache-2.0,
statically linked, licence installed) and grant --socket=cups and
--system-talk-name=org.freedesktop.Avahi in both manifests.

* packaging: Flatpak reads the user's CUPS settings (~/.cups, read-only)

Review (CodeRabbit): without it the sandbox's lp/lpstat ignore the user's default
printer and saved options (lpoptions) and a print server named in their client.conf.

* packaging: Flatpak CUPS tools reach the host socket when client.conf names a custom path

Review: Flatpak mounts the host's CUPS socket at /var/run/cups/cups.sock whatever
path ~/.cups/client.conf or CUPS_SERVER names, so lp/lpstat/lpoptions now run through
a wrapper that points a socket path missing in the sandbox there. Server names
(remote servers) and sockets that exist are left alone. Tested in the sandbox:
CUPS_SERVER=/run/custom/cups.sock lists the host's printers through the wrapper and
none without it; a host name is passed through unchanged.

* packaging: redirect a custom CUPS socket only when it is the one Flatpak mounted

Review (CodeRabbit): Flatpak picks the socket it mounts at /var/run/cups/cups.sock
with stricter rules than CUPS (flatpak-run-cups.c: a socket CUPS_SERVER, else the
first line spelled exactly "ServerName /path" in ~/.cups/client.conf, else the
default), while CUPS reads the keyword in any case and takes the last ServerName. The
wrapper now redirects only when CUPS' socket is the one Flatpak chose, so a job can't
reach a different server; otherwise CUPS fails on the missing path.

* packaging: never redirect a CUPS_SERVER the sandbox was given

Review (CodeRabbit): Flatpak picks the socket it mounts from the host's CUPS_SERVER,
so one set by flatpak run --env or an override may not be what it mounted. The
wrapper now leaves any CUPS_SERVER alone and redirects only a client.conf socket that
matches Flatpak's choice; otherwise CUPS fails on the missing path instead of
reaching a different server.

* packaging: point CUPS at the mounted socket only when it is the one Flatpak chose, else fail

Review (CodeRabbit): with a custom socket listed first and the default last in
~/.cups/client.conf, Flatpak mounts the custom one at /var/run/cups/cups.sock while
CUPS picks the last line, finds that path, and talks to the custom server. The
wrapper now compares CUPS' socket with Flatpak's choice even when the path exists:
equal, CUPS is pointed at the mount; different, the tool fails with an error instead
of reaching another server.
This commit is contained in:
Dylan M. Taylor
2026-10-29 18:51:06 -04:00
committed by GitHub
parent 640131a053
commit 60833ae800
2 changed files with 104 additions and 0 deletions
@@ -24,6 +24,14 @@ finish-args:
- --socket=fallback-x11
# GPU access for the wgpu renderer (Vulkan, or GL as a fallback).
- --device=dri
# Printing: lpstat/lp (the cups-client module) reach the host's CUPS through its socket and
# find driverless network printers through Avahi (`lpstat -e`). Without these the Print
# dialog lists no printers.
- --socket=cups
- --system-talk-name=org.freedesktop.Avahi
# The user's CUPS settings, read-only: their default printer and saved options (lpoptions)
# and a print server named in their client.conf, which lp reaches over the network.
- --filesystem=~/.cups:ro
# Network for the update check against GitHub releases.
- --share=network
# Cursor theme: without the cursor-shape protocol (e.g. GNOME 46) winit loads the theme itself.
@@ -40,6 +48,50 @@ finish-args:
- --filesystem=~/.fonts:ro
# Deliberately not granted: home/host filesystem access beyond the read-only folders above.
modules:
# CUPS client tools for craft-print: the runtime has libcups but not lpstat/lp/lpoptions.
# Linked statically against this release's libcups, so a runtime update can't break them;
# the socket path matches the host's, which --socket=cups mounts.
- name: cups-client
buildsystem: simple
build-commands:
- ./configure --prefix=/app --sysconfdir=/etc --localstatedir=/var --with-rundir=/run/cups
--with-domainsocket=/run/cups/cups.sock --disable-shared --with-components=libcups
--with-dnssd=avahi --with-tls=gnutls --disable-pam --disable-dbus
- make -C cups libs
- make -C systemv lp lpoptions lpstat
- install -Dm755 -t /app/libexec/cups systemv/lp systemv/lpoptions systemv/lpstat
- for tool in lp lpoptions lpstat; do install -Dm755 cups-socket.sh "/app/bin/$tool"; done
- install -Dm644 -t /app/share/licenses/cups LICENSE NOTICE
sources:
- type: archive
url: https://github.com/OpenPrinting/cups/releases/download/v2.4.20/cups-2.4.20-source.tar.gz
sha256: ab4d9cd7f3e58060091d2b24972223d6401675f11c49b65abf4f6ef31dea22ff
# Runs each tool. Flatpak mounts the host's CUPS socket at /var/run/cups/cups.sock, choosing
# it as flatpak-run-cups.c does from the host's CUPS_SERVER, else the first line spelled
# exactly `ServerName /path` in ~/.cups/client.conf, else the default; it mounts nothing
# when that socket is missing. CUPS reads the keyword in any case and takes the last
# ServerName. When CUPS' socket from client.conf is the one Flatpak chose, it is pointed at
# the mount; when it isn't, the tool fails rather than reach a different server. A
# CUPS_SERVER is left alone: one set by `flatpak run --env` may not be what was mounted.
- type: script
dest-filename: cups-socket.sh
commands:
- 'conf="$HOME/.cups/client.conf"'
- 'if [ -z "${CUPS_SERVER:-}" ] && [ -r "$conf" ]; then'
- ' server=$(sed -n ''s/^[[:space:]]*[Ss][Ee][Rr][Vv][Ee][Rr][Nn][Aa][Mm][Ee][[:space:]]\{1,\}\([^[:space:]]*\).*/\1/p'' "$conf" | tail -n 1)'
- ' case "$server" in'
- ' /*)'
- ' mounted=$(sed -n ''s/^[[:space:]]*ServerName \(.*\)$/\1/p'' "$conf" | sed ''s/^[[:space:]]*//'' | grep -m 1 ''^/[^:]*$'')'
- ' if [ "$mounted" = "$server" ]; then'
- ' export CUPS_SERVER=/var/run/cups/cups.sock'
- ' else'
- ' echo "${0##*/}: ~/.cups/client.conf names the CUPS socket $server, but Flatpak gave this app ${mounted:-a different one}; give each socket one ServerName line, spelled ServerName" >&2'
- ' exit 1'
- ' fi'
- ' ;;'
- ' esac'
- 'fi'
- 'exec "/app/libexec/cups/${0##*/}" "$@"'
- name: vectorcraft
buildsystem: simple
build-commands:
@@ -22,6 +22,14 @@ finish-args:
- --socket=wayland
- --socket=fallback-x11
- --device=dri
# Printing: lpstat/lp (the cups-client module) reach the host's CUPS through its socket and
# find driverless network printers through Avahi (`lpstat -e`). Without these the Print
# dialog lists no printers.
- --socket=cups
- --system-talk-name=org.freedesktop.Avahi
# The user's CUPS settings, read-only: their default printer and saved options (lpoptions)
# and a print server named in their client.conf, which lp reaches over the network.
- --filesystem=~/.cups:ro
# Network for the update check against GitHub releases.
- --share=network
# Cursor theme: without the cursor-shape protocol (e.g. GNOME 46) winit loads the theme itself.
@@ -36,6 +44,50 @@ finish-args:
build-options:
append-path: /usr/lib/sdk/rust-stable/bin
modules:
# CUPS client tools for craft-print: the runtime has libcups but not lpstat/lp/lpoptions.
# Linked statically against this release's libcups, so a runtime update can't break them;
# the socket path matches the host's, which --socket=cups mounts.
- name: cups-client
buildsystem: simple
build-commands:
- ./configure --prefix=/app --sysconfdir=/etc --localstatedir=/var --with-rundir=/run/cups
--with-domainsocket=/run/cups/cups.sock --disable-shared --with-components=libcups
--with-dnssd=avahi --with-tls=gnutls --disable-pam --disable-dbus
- make -C cups libs
- make -C systemv lp lpoptions lpstat
- install -Dm755 -t /app/libexec/cups systemv/lp systemv/lpoptions systemv/lpstat
- for tool in lp lpoptions lpstat; do install -Dm755 cups-socket.sh "/app/bin/$tool"; done
- install -Dm644 -t /app/share/licenses/cups LICENSE NOTICE
sources:
- type: archive
url: https://github.com/OpenPrinting/cups/releases/download/v2.4.20/cups-2.4.20-source.tar.gz
sha256: ab4d9cd7f3e58060091d2b24972223d6401675f11c49b65abf4f6ef31dea22ff
# Runs each tool. Flatpak mounts the host's CUPS socket at /var/run/cups/cups.sock, choosing
# it as flatpak-run-cups.c does from the host's CUPS_SERVER, else the first line spelled
# exactly `ServerName /path` in ~/.cups/client.conf, else the default; it mounts nothing
# when that socket is missing. CUPS reads the keyword in any case and takes the last
# ServerName. When CUPS' socket from client.conf is the one Flatpak chose, it is pointed at
# the mount; when it isn't, the tool fails rather than reach a different server. A
# CUPS_SERVER is left alone: one set by `flatpak run --env` may not be what was mounted.
- type: script
dest-filename: cups-socket.sh
commands:
- 'conf="$HOME/.cups/client.conf"'
- 'if [ -z "${CUPS_SERVER:-}" ] && [ -r "$conf" ]; then'
- ' server=$(sed -n ''s/^[[:space:]]*[Ss][Ee][Rr][Vv][Ee][Rr][Nn][Aa][Mm][Ee][[:space:]]\{1,\}\([^[:space:]]*\).*/\1/p'' "$conf" | tail -n 1)'
- ' case "$server" in'
- ' /*)'
- ' mounted=$(sed -n ''s/^[[:space:]]*ServerName \(.*\)$/\1/p'' "$conf" | sed ''s/^[[:space:]]*//'' | grep -m 1 ''^/[^:]*$'')'
- ' if [ "$mounted" = "$server" ]; then'
- ' export CUPS_SERVER=/var/run/cups/cups.sock'
- ' else'
- ' echo "${0##*/}: ~/.cups/client.conf names the CUPS socket $server, but Flatpak gave this app ${mounted:-a different one}; give each socket one ServerName line, spelled ServerName" >&2'
- ' exit 1'
- ' fi'
- ' ;;'
- ' esac'
- 'fi'
- 'exec "/app/libexec/cups/${0##*/}" "$@"'
- name: vectorcraft
buildsystem: simple
build-options: