Merge pull request 'Update to Factory version' (#1) from mlin7442/hplip:leap-16.0 into leap-16.0

Reviewed-on: pool/hplip#1
Reviewed-by: Nathan Cutler <smithfarm@noreply.src.opensuse.org>

Fix-ReDoS-issue-in-HPLIP-s-SLP-parser.patch

@@ -0,0 +1,48 @@
+From 4315485efe9318b18bf859c5bf1a810b9235ae2e Mon Sep 17 00:00:00 2001
+From: Wolfgang Frisch <wfrisch@suse.de>
+Date: Tue, 15 Jul 2025 19:12:53 +0200
+Subject: [PATCH] Fix ReDoS issue in  HPLIP's SLP parser
+
+Patch for the ReDoS issue in HPLIP's SLP parser (bsc#1245358).
+https://bugs.launchpad.net/hplip/+bug/2115626
+
+An unauthenticated denial-of-service attack in the local network is possible
+against HPLIP's SLP network printer discovery. This vulnerability arises from
+an algorithmic complexity attack on regular expressions within the SLP parser
+(`base/slp.py`).
+
+Signed-off-by: Wolfgang Frisch <wfrisch@suse.de>
+---
+ base/slp.py | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/base/slp.py b/base/slp.py
+index 8e2d8f9..06a00aa 100644
+--- a/base/slp.py
++++ b/base/slp.py
+@@ -33,14 +33,14 @@ from .g import *
+ from . import utils
+ from .sixext import to_bytes_utf8, to_unicode, to_string_utf8
+ 
+-prod_pat = re.compile(r"""\(\s*x-hp-prod_id\s*=\s*(.*?)\s*\)""", re.IGNORECASE)
+-mac_pat  = re.compile(r"""\(\s*x-hp-mac\s*=\s*(.*?)\s*\)""", re.IGNORECASE)
+-num_port_pat = re.compile(r"""\(\s*x-hp-num_port\s*=\s*(.*?)\s*\)""", re.IGNORECASE)
+-ip_pat =   re.compile(r"""\(\s*x-hp-ip\s*=\s*(.*?)\s*\)""", re.IGNORECASE)
+-p1_pat =   re.compile(r"""\(\s*x-hp-p1\s*=(?:\d\)|\s*(.*?)\s*\))""", re.IGNORECASE)
+-p2_pat =   re.compile(r"""\(\s*x-hp-p2\s*=(?:\d\)|\s*(.*?)\s*\))""", re.IGNORECASE)
+-p3_pat =   re.compile(r"""\(\s*x-hp-p3\s*=(?:\d\)|\s*(.*?)\s*\))""", re.IGNORECASE)
+-hn_pat =   re.compile(r"""\(\s*x-hp-hn\s*=\s*(.*?)\s*\)""", re.IGNORECASE)
++prod_pat = re.compile(r"""\(\s*x-hp-prod_id\s*=\s*([^\s]*)\s*\)""", re.IGNORECASE)
++mac_pat  = re.compile(r"""\(\s*x-hp-mac\s*=\s*([^\s]*)\s*\)""", re.IGNORECASE)
++num_port_pat = re.compile(r"""\(\s*x-hp-num_port\s*=\s*([^\s]*)\s*\)""", re.IGNORECASE)
++ip_pat =   re.compile(r"""\(\s*x-hp-ip\s*=\s*([^\s]*)\s*\)""", re.IGNORECASE)
++p1_pat =   re.compile(r"""\(\s*x-hp-p1\s*=(?:\d\)|\s*([^\s]*)\s*\))""", re.IGNORECASE)
++p2_pat =   re.compile(r"""\(\s*x-hp-p2\s*=(?:\d\)|\s*([^\s]*)\s*\))""", re.IGNORECASE)
++p3_pat =   re.compile(r"""\(\s*x-hp-p3\s*=(?:\d\)|\s*([^\s]*)\s*\))""", re.IGNORECASE)
++hn_pat =   re.compile(r"""\(\s*x-hp-hn\s*=\s*([^\s]*)\s*\)""", re.IGNORECASE)
+ 
+ def createSocketsWithsetOption(ttl=4):
+     s=None
+-- 
+2.50.0
+

hp-setup-fix-python-crash-when-manually-importing-gz.patch

@@ -0,0 +1,28 @@
+From 216b15eb68bd5cacd26ff554e244fc4ea50a1acf Mon Sep 17 00:00:00 2001
+From: Martin Wilck <mwilck@suse.com>
+Date: Fri, 15 Aug 2025 23:10:44 +0200
+Subject: [PATCH 1/2] hp-setup: fix python crash when manually importing
+ gzipped PPD
+
+data read from gzip.GzipFile must be converted to a string, otherwise
+the subsequent regex match will cause a python stacktrace.
+---
+ setup.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/setup.py b/setup.py
+index 2608f95..962909b 100755
+--- a/setup.py
++++ b/setup.py
+@@ -552,7 +552,7 @@ else: # INTERACTIVE_MODE
+                         if os.path.exists(file_path) and os.path.isfile(file_path):
+ 
+                             if file_path.endswith('.gz'):
+-                                nickname = gzip.GzipFile(file_path, 'r').read(4096)
++                                nickname = gzip.GzipFile(file_path, 'r').read(4096).decode("utf-8")
+                             else:
+                                 nickname = open(file_path, 'r').read(4096)
+ 
+-- 
+2.50.1
+

hpcups-fix-compilation-on-SLE12.patch

@@ -0,0 +1,28 @@
+From e95a9cb2e946bec33d7f0afa04850f93ae258477 Mon Sep 17 00:00:00 2001
+From: Martin Wilck <mwilck@suse.com>
+Date: Wed, 7 May 2025 15:53:46 +0200
+Subject: [PATCH] hpcups: fix compilation on SLE12
+
+SLE12-SP5 is not using C++11 by default, thus nullptr is not
+defined. NULL is used elsewhere in the file, so we can just
+replace nullptr with NULL.
+---
+ prnt/hpcups/HPCupsFilter.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/prnt/hpcups/HPCupsFilter.cpp b/prnt/hpcups/HPCupsFilter.cpp
+index 6750684..7d397ed 100644
+--- a/prnt/hpcups/HPCupsFilter.cpp
++++ b/prnt/hpcups/HPCupsFilter.cpp
+@@ -435,7 +435,7 @@ DRIVER_ERROR HPCupsFilter::startPage (cups_page_header2_t *cups_header)
+ 
+         if (m_JA.media_attributes.PageSizeName[0] == '\0') {
+             // Copy the value of cups_header->cupsPageSizeName if it isnot null
+-            if (cups_header->cupsPageSizeName != nullptr) {
++            if (cups_header->cupsPageSizeName != NULL) {
+                 strncpy(m_JA.media_attributes.PageSizeName, cups_header->cupsPageSizeName, sizeof(m_JA.media_attributes.PageSizeName));
+             }
+         }   
+-- 
+2.49.0
+

hplip-3.24.4-gcc15.patch

@@ -0,0 +1,16 @@
+
+bugs.launchpad.net/hplip/+bug/2096650
+
+src.fedoraproject.org/rpms/hplip/blob/f42/f/hplip-gcc15-stdc23.patch
+
+--- a/scan/sane/ledmi.h	2025-02-27 13:12:29.000000000 +0100
++++ b/scan/sane/ledmi.h	2025-05-05 12:28:33.445527226 +0200
+@@ -162,7 +162,7 @@
+ int bb_open(struct ledm_session*);
+ int bb_close(struct ledm_session*);
+ int bb_get_parameters(struct ledm_session*, SANE_Parameters*, int);
+-int bb_is_paper_in_adf();         /* 0 = no paper in adf, 1 = paper in adf, -1 = error */
++int bb_is_paper_in_adf(struct ledm_session *);         /* 0 = no paper in adf, 1 = paper in adf, -1 = error */
+ SANE_Status bb_start_scan(struct ledm_session*);
+ int bb_get_image_data(struct ledm_session*, int); 
+ int bb_end_page(struct ledm_session*, int);

hplip-3.24.4.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:5d7643831893a5e2addf9d42d581a5dbfe5aaf023626886b8762c5645da0f1fb
-size 30217933

hplip-3.24.4.tar.gz.asc

@@ -1,6 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iF0EABECAB0WIQRKui9m29WpWJSRDgZz13DNpZBHuQUCZk13yQAKCRBz13DNpZBH
-uc7TAKDAX4308SYP7pgb85UTMbPbhfivmgCghMp2sBrpiCvOZTeozYO4WVzW1mg=
-=CKxG
------END PGP SIGNATURE-----

hplip-3.25.6.tar.gz.asc

@@ -0,0 +1,11 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2
+
+iQEcBAABCAAGBQJoekszAAoJEF5OTSSjTs1XCjUH/3W/RawreKnt4IuIqUqHMTJn
+haeiPj/jdArhbxreCjvYk3Z91VXJ4n2pyVWAwhW8ZKmSzdubDOEUrSs1fiRLF1qe
+y/wmCSmDF+ZcQu7/QfLDhZQI7I7IOFKNGTNNlWh1z3HpnHqBywPusM8ej8EgEb76
+6tGLlNuo8ykFDAQNJAPCN/qexj/LUs+p/s4lhpkNa+A7OIhBmQkfwscHXXrhf67f
+slavMnkCKbccegOtd9+i2NggtwkJDeNqZfgq6J7yXSxAm8jJjdAgJkqLmc9Vkxku
+GuUkQffIlHeDKj6jKg8Og+oAeRShLf6rxlFIB/PedJ9bjbZwUZDHUd80dHlAFWU=
+=VrP+
+-----END PGP SIGNATURE-----

hplip-base-fix-error-in-ConfigBase-handling.patch

@@ -0,0 +1,29 @@
+From 2a13a15b7f533606667e8586ff5ed736f038f2e8 Mon Sep 17 00:00:00 2001
+From: Martin Wilck <mwilck@suse.com>
+Date: Thu, 23 Jan 2025 12:47:43 +0100
+Subject: [PATCH 1/2] hplip/base: fix error in ConfigBase handling
+
+The code in question was apparently meant to handle the replacement
+of ConfigParser.readfp() by ConfigParser.read_file(). But the code
+is obviously broken, trying read_file() first and then read_file()
+again.
+---
+ base/g.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/base/g.py b/base/g.py
+index 0d1c986..c1f5d24 100644
+--- a/base/g.py
++++ b/base/g.py
+@@ -128,7 +128,7 @@ class ConfigBase(object):
+             try:
+                 fp = open(self.filename, "r")
+                 try:
+-                    self.conf.read_file(fp)
++                    self.conf.readfp(fp)
+                 except AttributeError as e:
+                     log.error(f"Error: {e}. Retrying with read_file")
+                     try:
+-- 
+2.48.1
+

hplip-base-replace-f-string-with-string.format-for-p.patch

@@ -0,0 +1,32 @@
+From f1fef1ed07951fbc6e81d90ab43172974979eeeb Mon Sep 17 00:00:00 2001
+From: Martin Wilck <mwilck@suse.com>
+Date: Wed, 22 Jan 2025 17:44:04 +0100
+Subject: [PATCH 2/2] hplip/base: replace f-string with string.format for
+ python2 compatibility
+
+---
+ base/g.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/base/g.py b/base/g.py
+index c1f5d24..a3b6191 100644
+--- a/base/g.py
++++ b/base/g.py
+@@ -130,12 +130,12 @@ class ConfigBase(object):
+                 try:
+                     self.conf.readfp(fp)
+                 except AttributeError as e:
+-                    log.error(f"Error: {e}. Retrying with read_file")
++                    log.error("Error: {0}. Retrying with read_file".format(e))
+                     try:
+                         # Attempting to use read_file as a fallback
+                         self.conf.read_file(fp)
+                     except Exception as e:
+-                        log.error(f"Reading file with read_file also failed. Error: {e}")
++                        log.error("Reading file with read_file also failed. Error: {0}".format(e))
+                 except configparser.MissingSectionHeaderError:
+                     print("")
+                     log.error("Found No Section in %s. Please set the http proxy for root and try again." % self.filename)
+-- 
+2.48.1
+

hplip-hardcode-new-signing-key-AC69536A2CF3A243.patch

@@ -0,0 +1,83 @@
+From b862d309e533c3272795119bfb706a1cc11d4727 Mon Sep 17 00:00:00 2001
+From: Martin Wilck <mwilck@suse.com>
+Date: Fri, 15 Aug 2025 23:12:13 +0200
+Subject: [PATCH 2/2] hplip: hardcode new signing key AC69536A2CF3A243
+
+hplip as introduced a new GPG key with fingerprint for 3.25.6:
+
+    82FF A7C6 AA74 11D9 34BD E173 AC69 536A 2CF3 A243
+
+See https://developers.hp.com/hp-linux-imaging-and-printing/hplipDigitalCertificate.html
+
+This key doesn't seem to be on public keyservers yet.
+For now, simply hardcode the public key in hplip. It's the same
+key with which the hplip code is signed, anyway.
+---
+ base/validation.py | 50 +++++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 47 insertions(+), 3 deletions(-)
+
+diff --git a/base/validation.py b/base/validation.py
+index d555f12..a2e5540 100644
+--- a/base/validation.py
++++ b/base/validation.py
+@@ -83,10 +83,54 @@ class GPG_Verification(DigiSign_Verification):
+ 
+     def __acquire_gpg_key(self):
+ 
+-        cmd = '%s --homedir %s --no-permission-warning --keyserver %s --recv-keys 0x%X' \
+-              % (self.__gpg, self.__gpg_dir, self.__pgp_site, self.__key)
++        key_AC69536A2CF3A243 = """
++-----BEGIN PGP PUBLIC KEY BLOCK-----
+ 
+-        log.info("Receiving digital keys: %s" % cmd)
++mQENBGhe8voBCAC/FDH1D4Y7d+8YbEjSb0jFROcpQrTBvB59tvTetm1YKi3Zm6Im
++BHqHaOLRsJk28lmv0JKPAQj52ybXvTgFwsbjFaOkA6X6y6jNdjzRXLMSGQxY1HMb
++0+ZwtLqEm3yWKsVuDHJ/8AsXc5uLT7q1v5snCWIzzapKD2UIcNL9nUkq1TGAD4xh
++sjoBy247ofnjZq921QJOod5GOhZfskISU7wfWwwSPl6NbOc5cK4Qpo2PMA/r38+m
++Y2svwS6u8XnljRU44txp76pNEFMYwGHsiaIviqTA/UXeib3yuN5NY7w2iXWMSqBs
++b0L9RWFCaxt/ZjNmG1qvo+MdGCSqs3E6wZzDABEBAAG0NEhQTElQIChIUCBMaW51
++eCBJbWFnaW5nIGFuZCBQcmludGluZykgPGhwbGlwQGhwLmNvbT6JATkEEwECACMF
++Amhe8voCGy8HCwkIBwMCAQYVCAIJCgsEFgIDAQIeAQIXgAAKCRCsaVNqLPOiQ2Lt
++B/950TaQebUviamSc+R+65jM6u2janmEAD0m9BMveUBNwMkAp4MycKuVEw04IPCa
++XKUhdQJw0a19SgqKjy3RYoksgYfpKCrQAN6iyNIjIvbm51Ui4VyQXIGDi/ytu6fW
++wQZG0mlc0BboZWFniERP17jDPVHLTrbERByvdr+ytPVzsnRGEURQpl+dIRA/V4jx
++euzcTwJ92pJDg/l0kenXv4JgZlOlsB60wFqFO2zWXiplpgprIvrOfpoynfYjTu96
++3stRD3z+PoEa9llWRMTuooHPLC1+lknuQxO+xeNMT9q68zUanpgp6K82ZH1ZDjaP
++ec+xtHmbhNxz1M724/3OLU3OuQENBGhe8voBCADRlC7StIqnYRIw9rHKDY5eSMht
++6y8hrO7Fmdb5+wdOgLTNXuEaQZxgU1w+CdWUFUxUf3V/NBojHM0I29GuIcIRByKX
++QmqHNAtfNnj8hsFFiU0Dmail4oPfwdXOgh5vo65sfYK+tvJH4SrYYh55DN/j4a3H
++sPEZ0rxG8kM3s7AyXU1gEotPUsrv8k255oEPD1OdFrKZ5urcQ4dunvbcGQ71Qjw1
++dYPtUv9iPnxxXTA9X5aXqCwlTeeL4jQSrJa5Rr8z/gpbFynLrgkV/FUzEcRuQ4gs
++POhcDgsGLPBOlFatoHU3Zk1HrflNSiV+kE7Uy9Uf8FIR9e2BIU8mtvj8YLc1ABEB
++AAGJAj4EGAECAAkFAmhe8voCGy4BKQkQrGlTaizzokPAXSAEGQECAAYFAmhe8voA
++CgkQXk5NJKNOzVeOdQgAk3Zp0eTuzxDZn9QQefM/hxFI2bxR2TNzV7QadphvwmRW
++9G1vnQPosTNs2ock23DQiBayh5oYExF2Y34hr8/GAwfViAKo/fzIZYzF9GosscRV
++R9SbeHEVQ8GZuXa9ifIv9L6fPvP+AsDA76stXGPWpDCGHHcP1eZ3jmDsoxucEDKK
++UgNwL8XSZUbjusrEJJtrNu0UTToo+dMF//9xsIWnsWJ16ypVNSAXCTlyQO8fBSEO
++m6+d1mAdMRd64o9QBu1iYB0DCotLE/gPdKOthIUElNQXey6jYUpg0kRqAvPxd1DH
++wZ+/MphQXtdIG3Sb4ogB/7o6R6iqOdp5lrCwORWmacgSB/oCVB8OVY0GqP1qYj/+
++tup+s8esPsJRCOlv5bPVGhzVTgCgBQWK4wsp57grAiptseBDoVF37HY3vRi/ldy0
++SoISK1udxR7j/cy6Bzsv5xB2UR2K5uaYW/MTd+RkncOT5rHijyrrYBLJvhpnvhzw
++H/fm+XRHQPEu+i3tsMgNrZ4No8Nxa/i+0lpNS1+TbtcPt27RFC+1F4P7Ff9xFSrL
++nkm8j4hYZzG5s8K3TvDGiosqLGcMsVVXt8lFFdC1Pxd1TuLiUM7IMnPweiAjlfM0
++onZMYpdNUWSPht/2v/UQLVe0U9Y2lEnYiqY+IXqnWT7N/0d1Zt+K+7IfZsJt4Uio
++6saq
++=EWRb
++-----END PGP PUBLIC KEY BLOCK-----
++"""
++
++        import tempfile
++        tf = tempfile.NamedTemporaryFile(mode='w', delete=False, encoding='utf-8')
++        tf.write(key_AC69536A2CF3A243)
++        tf.close()
++
++        cmd = '%s --homedir %s --import %s' \
++              % (self.__gpg, self.__gpg_dir, tf.name)
++
++        log.info("Importing digital keys: %s" % cmd)
+         status, output = utils.run(cmd)
+         log.debug(output)
+ 
+-- 
+2.50.1
+

hplip-hpaio-gcc14.patch

@@ -0,0 +1,114 @@
+diff --git a/scan/sane/hpaio.c b/scan/sane/hpaio.c
+index 57d1dde..3475929 100644
+--- a/scan/sane/hpaio.c
++++ b/scan/sane/hpaio.c
+@@ -379,7 +379,7 @@ extern SANE_Status sane_hpaio_get_devices(const SANE_Device ***deviceList, SANE_
+    ResetDeviceList(&DeviceList);
+    DevDiscovery(localOnly);
+    *deviceList = (const SANE_Device **)DeviceList;
+-   SANE_Device*** devList;
++   const SANE_Device*** devList;
+    orblite_get_devices(devList, localOnly);
+ 
+    return SANE_STATUS_GOOD;
+diff --git a/scan/sane/orblite.c b/scan/sane/orblite.c
+index 2eb7aba..4eaa468 100644
+--- a/scan/sane/orblite.c
++++ b/scan/sane/orblite.c
+@@ -64,28 +64,28 @@ SANE_Option_Descriptor	DefaultOrbOptions[] = {
+ 		SANE_NAME_SCAN_TL_X, SANE_TITLE_SCAN_TL_X, SANE_DESC_SCAN_TL_X,  // name, title, desc
+ 		SANE_TYPE_FIXED, SANE_UNIT_MM, sizeof(SANE_Fixed),// type, unit, size
+ 		SANE_CAP_SOFT_SELECT | SANE_CAP_SOFT_DETECT,      // cap(ability)
+-		SANE_CONSTRAINT_RANGE, (SANE_Char**)&SANE_rangeLeft  // constraint_type, constraint
++		SANE_CONSTRAINT_RANGE, (const SANE_Char**)&SANE_rangeLeft  // constraint_type, constraint
+ 	},
+ 
+ 	{
+ 		SANE_NAME_SCAN_TL_Y, SANE_TITLE_SCAN_TL_Y, SANE_DESC_SCAN_TL_Y,  // name, title, desc
+ 		SANE_TYPE_FIXED, SANE_UNIT_MM, sizeof(SANE_Fixed),// type, unit, size
+ 		SANE_CAP_SOFT_SELECT | SANE_CAP_SOFT_DETECT,      // cap(ability)
+-		SANE_CONSTRAINT_RANGE, (SANE_Char**)&SANE_rangeTop  // constraint_type, constraint
++		SANE_CONSTRAINT_RANGE, (const SANE_Char**)&SANE_rangeTop  // constraint_type, constraint
+ 	},
+   
+ 	{
+ 		SANE_NAME_SCAN_BR_X, SANE_TITLE_SCAN_BR_X, SANE_DESC_SCAN_BR_X,  // name, title, desc
+ 		SANE_TYPE_FIXED, SANE_UNIT_MM, sizeof(SANE_Fixed),// type, unit, size
+ 		SANE_CAP_SOFT_SELECT | SANE_CAP_SOFT_DETECT,      // cap(ability)
+-		SANE_CONSTRAINT_RANGE, (SANE_Char**)&SANE_rangeRight  // constraint_type, constraint
++		SANE_CONSTRAINT_RANGE, (const SANE_Char**)&SANE_rangeRight  // constraint_type, constraint
+ 	},
+ 
+ 	{
+ 		SANE_NAME_SCAN_BR_Y, SANE_TITLE_SCAN_BR_Y, SANE_DESC_SCAN_BR_Y,  // name, title, desc
+ 		SANE_TYPE_FIXED, SANE_UNIT_MM, sizeof(SANE_Fixed),// type, unit, size
+ 		SANE_CAP_SOFT_SELECT | SANE_CAP_SOFT_DETECT,      // cap(ability)
+-		SANE_CONSTRAINT_RANGE, (SANE_Char**)&SANE_rangeBottom  // constraint_type, constraint
++		SANE_CONSTRAINT_RANGE, (const SANE_Char**)&SANE_rangeBottom  // constraint_type, constraint
+ 	},
+    
+ 	// optResolution,                                       // resolution group  
+@@ -93,7 +93,7 @@ SANE_Option_Descriptor	DefaultOrbOptions[] = {
+ 		SANE_NAME_SCAN_RESOLUTION, SANE_TITLE_SCAN_RESOLUTION, SANE_DESC_SCAN_RESOLUTION, // name, title, desc
+ 		SANE_TYPE_INT, SANE_UNIT_DPI, sizeof(SANE_Word),  // type, unit, size,
+ 		SANE_CAP_SOFT_SELECT | SANE_CAP_SOFT_DETECT,      // cap(ability)
+-		SANE_CONSTRAINT_WORD_LIST, (SANE_Char**)SANE_resolutions // constraint type, constraint
++		SANE_CONSTRAINT_WORD_LIST, (const SANE_Char**)SANE_resolutions // constraint type, constraint
+ 	},
+ 
+ 	// optMode,                                            // color/depth group
+@@ -101,7 +101,7 @@ SANE_Option_Descriptor	DefaultOrbOptions[] = {
+ 		SANE_NAME_SCAN_MODE, SANE_TITLE_SCAN_MODE, SANE_DESC_SCAN_MODE, // name, title, desc
+ 		SANE_TYPE_STRING, SANE_UNIT_NONE, 256,  // type, unit, size,
+ 		SANE_CAP_SOFT_SELECT | SANE_CAP_SOFT_DETECT,      // cap(ability)
+-		SANE_CONSTRAINT_STRING_LIST, (SANE_Char**)SANE_modes   // constraint type, constraint
++		SANE_CONSTRAINT_STRING_LIST, (const SANE_Char**)SANE_modes   // constraint type, constraint
+ 	},
+  
+ 	// optSource, 
+@@ -109,7 +109,7 @@ SANE_Option_Descriptor	DefaultOrbOptions[] = {
+ 		SANE_NAME_SCAN_SOURCE, SANE_TITLE_SCAN_SOURCE, SANE_DESC_SCAN_SOURCE, // name, title, desc
+ 		SANE_TYPE_STRING, SANE_UNIT_NONE, 256,  // type, unit, size,
+ 		SANE_CAP_SOFT_SELECT | SANE_CAP_SOFT_DETECT,      // cap(ability)
+-		SANE_CONSTRAINT_STRING_LIST, (SANE_Char**)SANE_sources   // constraint type, constraint
++		SANE_CONSTRAINT_STRING_LIST, (const SANE_Char**)SANE_sources   // constraint type, constraint
+ 	},
+  
+ 	// optPaperSize, 
+@@ -117,7 +117,7 @@ SANE_Option_Descriptor	DefaultOrbOptions[] = {
+ 		SANE_NAME_PAPER_SIZE, SANE_TITLE_PAPER_SIZE, SANE_DESC_PAPER_SIZE, // name, title, desc
+ 		SANE_TYPE_STRING, SANE_UNIT_NONE, 256,  // type, unit, size,
+ 		SANE_CAP_SOFT_SELECT | SANE_CAP_SOFT_DETECT,      // cap(ability)
+-		SANE_CONSTRAINT_STRING_LIST, (SANE_Char**)SANE_paper_sizes   // constraint type, constraint
++		SANE_CONSTRAINT_STRING_LIST, (const SANE_Char**)SANE_paper_sizes   // constraint type, constraint
+ 	},
+  
+ 	// optPaperSize, 
+@@ -125,7 +125,7 @@ SANE_Option_Descriptor	DefaultOrbOptions[] = {
+ 		SANE_NAME_PAPER_SIZE, SANE_TITLE_PAPER_SIZE, SANE_DESC_PAPER_SIZE, // name, title, desc
+ 		SANE_TYPE_INT, SANE_UNIT_DPI, sizeof(SANE_Word),  // type, unit, size,
+ 		SANE_CAP_SOFT_SELECT | SANE_CAP_SOFT_DETECT,      // cap(ability)
+-		SANE_CONSTRAINT_WORD_LIST, (SANE_Char**)SANE_resolutions // constraint type, constraint
++		SANE_CONSTRAINT_WORD_LIST, (const SANE_Char**)SANE_resolutions // constraint type, constraint
+ 	},
+ #ifdef NOTDEF
+ // default template
+@@ -274,6 +274,7 @@ orblite_open (SANE_String_Const devicename, SANE_Handle * handle)
+ 	SANE_Auth_Callback authorize;
+ 	const SANE_Device *** device_list;
+ 	SANE_Bool local_only;
++	void * temp_handle;
+ 	
+ 	
+ 	// Allocate handle, set all handle values to zero
+@@ -305,7 +306,9 @@ orblite_open (SANE_String_Const devicename, SANE_Handle * handle)
+ 	if (stat != SANE_STATUS_GOOD)
+ 		return stat;
+ 
+-	stat = g_handle->bb_orblite_open(devicename, &g_handle);
++	temp_handle = g_handle;
++	stat = g_handle->bb_orblite_open(devicename, &temp_handle);
++	g_handle = temp_handle;
+ 	if (stat == SANE_STATUS_GOOD)
+ 		*handle = g_handle;
+ 

hplip-no-urlopener.patch

@@ -0,0 +1,79 @@
+diff --git a/base/device.py b/base/device.py
+index 2fdb29c..ca0d97e 100644
+--- a/base/device.py
++++ b/base/device.py
+@@ -2526,9 +2526,9 @@ Content-length: %d\r
+                 data = None
+ 
+             log.debug("Opening: %s" % url2)
+-            opener = LocalOpener({})
++            opener = LocalOpener()
+             try:
+-                f = opener.open(url2, data)
++                f = opener.open_hp(url2, data)
+                 
+             except Error:
+                 log.error("Status read failed: %s" % url2)
+@@ -2548,7 +2548,7 @@ Content-length: %d\r
+         try:
+             url2 = "%s&loc=%s" % (self.device_uri.replace('hpfax:', 'hp:'), url)
+             data = self
+-            opener = LocalOpenerEWS_LEDM({})
++            opener = LocalOpenerEWS_LEDM()
+             try:
+                 if footer:
+                     return opener.open_hp(url2, data, footer)
+@@ -2563,7 +2563,7 @@ Content-length: %d\r
+         try:
+             url2 = "%s&loc=%s" % (self.device_uri.replace('hpfax:', 'hp:'), url)
+             data = self
+-            opener = LocalOpener_LEDM({})
++            opener = LocalOpener_LEDM()
+             try:
+                 if footer:
+                     return opener.open_hp(url2, data, footer)
+@@ -2580,7 +2580,7 @@ Content-length: %d\r
+             url="/cdm/supply/v1/suppliesPublic"
+             url2 = "%s&loc=%s" % (self.device_uri.replace('hpfax:', 'hp:'), url)
+             data = self
+-            opener = LocalOpener_CDM({})
++            opener = LocalOpener_CDM()
+             try:
+                 if footer:
+                     return opener.open_hp(url2, data, footer)
+@@ -2688,7 +2688,7 @@ Content-length: %d\r
+ 
+ 
+ # URLs: hp:/usb/HP_LaserJet_3050?serial=00XXXXXXXXXX&loc=/hp/device/info_device_status.xml
+-class LocalOpener(urllib_request.URLopener):
++class LocalOpener():
+     def open_hp(self, url, dev):
+         log.debug("open_hp(%s)" % url)
+ 
+@@ -2718,7 +2718,7 @@ class LocalOpener(urllib_request.URLopener):
+             return response#.fp
+ 
+ # URLs: hp:/usb/HP_OfficeJet_7500?serial=00XXXXXXXXXX&loc=/hp/device/info_device_status.xml
+-class LocalOpenerEWS_LEDM(urllib_request.URLopener):
++class LocalOpenerEWS_LEDM():
+     def open_hp(self, url, dev, foot=""):
+         log.debug("open_hp(%s)" % url)
+ 
+@@ -2744,7 +2744,7 @@ class LocalOpenerEWS_LEDM(urllib_request.URLopener):
+ 
+ 
+ # URLs: hp:/usb/HP_OfficeJet_7500?serial=00XXXXXXXXXX&loc=/hp/device/info_device_status.xml
+-class LocalOpener_LEDM(urllib_request.URLopener):
++class LocalOpener_LEDM():
+     def open_hp(self, url, dev, foot=""):
+         log.debug("open_hp(%s)" % url)
+ 
+@@ -2771,7 +2771,7 @@ class LocalOpener_LEDM(urllib_request.URLopener):
+ 
+ 
+ # URLs: hp:/usb/HP_OfficeJet_7500?serial=00XXXXXXXXXX&loc=/hp/device/info_device_status.xml
+-class LocalOpener_CDM(urllib_request.URLopener):
++class LocalOpener_CDM():
+     def open_hp(self, url, dev, foot=""):
+         log.debug("open_hp(%s)" % url)
+         match_obj = http_pat_url.search(url)

hplip-pserror-c99.patch

@@ -0,0 +1,17 @@
+prnt/pserror.c: Replace an implicit int with an explicit int
+
+Submitted upstream: <https://bugs.launchpad.net/hplip/+bug/1997875>
+
+diff --git a/prnt/hpps/pserror.c b/prnt/hpps/pserror.c
+index 114d7e1b5fa364fb..493b49c27917a7e6 100644
+--- a/prnt/hpps/pserror.c
++++ b/prnt/hpps/pserror.c
+@@ -24,7 +24,7 @@ extern char *program ;	/* Defined by main program, giving program name */
+ void message(int flags, char *format, ...)
+ {
+   va_list args ;
+-  static column = 0 ;		/* current screen column for message wrap */
++  static int column = 0 ;	/* current screen column for message wrap */
+   char msgbuf[MAX_MESSAGE] ;	/* buffer in which to put the message */
+   char *bufptr = msgbuf ;	/* message buffer pointer */
+ 

hplip-scan-hpaio-include.patch

@@ -0,0 +1,19 @@
+scam/sane/hpaio.c: Include orblite.h for more function prototypes
+
+Otherwise the build fails with compilers which do not support
+implicit function declarations.
+
+Submitted upstream: <https://bugs.launchpad.net/hplip/+bug/1997875>
+
+diff --git a/scan/sane/hpaio.c b/scan/sane/hpaio.c
+index d342626822fc2190..57d1ddea32fb5816 100644
+--- a/scan/sane/hpaio.c
++++ b/scan/sane/hpaio.c
+@@ -50,6 +50,7 @@
+ #include "sclpml.h"
+ #include "escl.h"
+ #include "io.h"
++#include "orblite.h"
+ #include "orblitei.h"
+ 
+ 

hplip-scan-orblite-c99.patch

@@ -0,0 +1,48 @@
+scan/sane/orblite: Include <dflcn.h> for function prototypes
+
+This is required for C99 compatibility.  Also delete the unused
+bb_unload function because it calls a call to the undefined
+_DBG function/macro.
+
+Submitted upstream: <https://bugs.launchpad.net/hplip/+bug/1997875>
+
+diff --git a/scan/sane/orblite.c b/scan/sane/orblite.c
+index ba86640c7528fc9c..ac59dda9c2dba593 100644
+--- a/scan/sane/orblite.c
++++ b/scan/sane/orblite.c
+@@ -20,6 +20,7 @@
+ #include "orblitei.h"
+ #include "orblite.h"//Added New
+ #include <math.h>
++#include <dlfcn.h>
+ #include "utils.h"
+ #include "io.h"
+ 
+@@ -193,27 +194,6 @@ bugout:
+ 
+ }
+ 
+-static int bb_unload(SANE_THandle ps)
+-{
+-   _DBG("Calling orblite bb_unload: \n");
+-   if (ps->bb_handle)
+-   {
+-      dlclose(ps->bb_handle);
+-      ps->bb_handle = NULL;
+-   }
+-   if (ps->hpmud_handle)
+-   {
+-      dlclose(ps->hpmud_handle);
+-      ps->hpmud_handle = NULL;
+-   }
+-//   if (ps->math_handle)
+-//   { 
+-//      dlclose(ps->math_handle);
+-//      ps->math_handle = NULL;
+-//   }
+-   return 0;
+-}
+-
+ SANE_Status 
+ orblite_init (SANE_Int * version_code, SANE_Auth_Callback authorize)
+ {

hplip-sclpml-strcasestr.patch

@@ -0,0 +1,20 @@
+Kludge to support building C99 mode.  This should no longer be needed
+once glibc declares strcasestr by default, and not just with
+-D_GNU_SOURCE.
+
+Submitted upstream: <https://bugs.launchpad.net/hplip/+bug/1997875>
+
+diff --git a/scan/sane/sclpml.c b/scan/sane/sclpml.c
+index dc8b32ce02ad1202..f2cacd53e86800ce 100644
+--- a/scan/sane/sclpml.c
++++ b/scan/sane/sclpml.c
+@@ -47,6 +47,9 @@
+ #define DEBUG_DECLARE_ONLY
+ #include "sanei_debug.h"
+ 
++/* This file is not built with _GNU_SOURCE. */
++char *strcasestr(const char *, const char *);
++
+ //# define  SCLPML_DEBUG
+ # ifdef SCLPML_DEBUG
+    # define _DBG(args...) syslog(LOG_INFO, __FILE__ " " STRINGIZE(__LINE__) ": " args)

hplip-utils-Fix-plugin-verification-with-sha256.patch

@@ -0,0 +1,68 @@
+From 8d14912a48e589bee05e0c377c29218132083145 Mon Sep 17 00:00:00 2001
+From: Martin Wilck <mwilck@suse.com>
+Date: Wed, 7 May 2025 15:23:17 +0200
+Subject: [PATCH] hplip/utils: Fix plugin verification with sha256
+
+https://bugs.launchpad.net/hplip/+bug/2110100
+---
+ base/smart_install.py      |  2 +-
+ base/utils.py              | 12 +++++++++++-
+ installer/pluginhandler.py |  4 ++--
+ 3 files changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/base/smart_install.py b/base/smart_install.py
+index cff5924..699f70f 100755
+--- a/base/smart_install.py
++++ b/base/smart_install.py
+@@ -155,7 +155,7 @@ def validate(mode, smart_install_run, smart_install_asc, req_checksum=''):
+     calc_checksum = utils.get_checksum(open(smart_install_run, 'r').read())
+     log.debug("File checksum=%s" % calc_checksum)
+ 
+-    if req_checksum and req_checksum != calc_checksum:
++    if utils.sha256_checksum(req_checksum) != calc_checksum:
+         return ERROR_FILE_CHECKSUM, queryString(ERROR_CHECKSUM_ERROR, 0, plugin_file)
+ 
+     #Validate Digital Signature
+diff --git a/base/utils.py b/base/utils.py
+index d5b3a49..f9de94e 100644
+--- a/base/utils.py
++++ b/base/utils.py
+@@ -72,8 +72,18 @@ import hashlib
+ def get_checksum(s):
+     return hashlib.sha256(s).hexdigest()
+ 
++__sha1_sha256_map = {
++    "bd99405113d43447e7a37ed46d75187785774cff":
++    "9a2cf8d5661e846548dbbb595231a5448a5cb63729cc93df8d1f652dfd167a54"
++}
+ 
+-
++def sha256_checksum(s):
++    if not s:
++        return ""
++    elif s in __sha1_sha256_map:
++        return __sha1_sha256_map[s]
++    else:
++        return s
+ 
+ # Local
+ from .g import *
+diff --git a/installer/pluginhandler.py b/installer/pluginhandler.py
+index a37db39..26b0033 100755
+--- a/installer/pluginhandler.py
++++ b/installer/pluginhandler.py
+@@ -217,9 +217,9 @@ class PluginHandle(object):
+     def __validatePlugin(self,plugin_file, digsig_file, req_checksum):
+ 
+         #Validate Checksum
+-        calc_checksum = get_checksum(open(plugin_file, 'rb').read())
++        calc_checksum = utils.get_checksum(open(plugin_file, 'rb').read())
+         log.debug("D/L file checksum=%s" % calc_checksum)
+-        if req_checksum and req_checksum != calc_checksum:
++        if utils.sha256_checksum(req_checksum) != calc_checksum:
+             return ERROR_CHECKSUM_ERROR, queryString(ERROR_CHECKSUM_ERROR, 0, plugin_file)
+ 
+         #Validate Digital Signatures
+-- 
+2.49.0
+

hplip.changes

@@ -1,3 +1,133 @@
+-------------------------------------------------------------------
+Fri Aug 15 21:38:25 UTC 2025 - Martin Wilck <mwilck@suse.com>
+
+- Fix verification of HP plugin with new GPG key (lp#2120738)
+  * add hplip-hardcode-new-signing-key-AC69536A2CF3A243.patch
+- Fix python crash in hp-setup on compressed PPD file (lp#2120739)
+  * add hp-setup-fix-python-crash-when-manually-importing-gz.patch
+- Fix missing urllib.URLopener in python 3.14 (lp#2115046)
+  * add hplip-no-urlopener.patch
+- Only run cupstestppd if explicitly requested with "--with testppd"
+  build parameter
+
+-------------------------------------------------------------------
+Fri Aug 15 15:59:19 UTC 2025 - Martin Wilck <mwilck@suse.com>
+
+- Updated hplip gpg public key
+  fingerprint: 82FF A7C6 AA74 11D9 34BD E173 AC69 536A 2CF3 A243
+  https://developers.hp.com/hp-linux-imaging-and-printing/hplipDigitalCertificate.html
+
+- Update to hplip 3.25.6
+- Added support for new printers:
+  * HP LaserJet Enterprise Flow MFP 8601z
+  * HP LaserJet Pro MFP M126a plus
+  * HP LaserJet Pro MFP M126nw plus
+  * HP LaserJet Pro MFP M126snw plus
+  * HP Envy Photo 7200 series
+  * HP Envy Photo 7900 series
+  * HP OfficeJet Pro 9110 Series
+  * HP OfficeJet 9120 Series
+  * HP OfficeJet Pro 9120 Series
+  * HP OfficeJet Pro 9130 Series
+
+-------------------------------------------------------------------
+Thu Aug 14 19:57:37 UTC 2025 - Lubos Kocman <lubos.kocman@suse.com>
+
+- Disable hp-scan-utils on Leap 16.0
+  Leap does not want to ship scikit-image -> python-pandas
+
+-------------------------------------------------------------------
+Tue Jul 15 17:52:47 UTC 2025 - Martin Wilck <mwilck@suse.com>
+
+- Fix ReDoS issue in  HPLIP's SLP parser (bsc#1245358)
+  * add Fix-ReDoS-issue-in-HPLIP-s-SLP-parser.patch
+
+-------------------------------------------------------------------
+Wed May  7 13:33:02 UTC 2025 - Martin Wilck <mwilck@suse.com>
+
+- Update to hplip 3.25.2
+- Added support for new printers:
+  * HP LaserJet Enterprise Flow MFP 8601z
+  * HP LaserJet Enterprise Flow MFP 8601z+
+  * HP LaserJet Enterprise MFP 8601dn
+  * HP Color LaserJet Enterprise MFP 8801dn
+  * HP Color LaserJet Enterprise Flow MFP 8801z
+  * HP Color LaserJet Enterprise Flow MFP 8801z+
+  * HP LaserJet Enterprise 8501dn
+  * HP LaserJet Enterprise 8501x
+  * HP LaserJet Enterprise 8501x+
+  * DEX MFP D826
+  * DEX MFP D82640
+  * DEX MFP D82650
+  * DEX MFP D82660
+  * DEX D50145
+  * DEX MFP D42540
+  * DEX MFP D52645
+  * DEX Color D55745
+  * DEX Color MFP D57945
+  * DEX Color MFP D677
+  * DEX Color MFP D67755
+  * DEX Color MFP D67765
+  * DEX Color MFP D877
+  * DEX Color MFP D87740
+  * DEX Color MFP D87750
+  * DEX Color MFP D87760
+  * DEX Color MFP D87770
+  * DEX Color MFP D786
+  * DEX Colour MFP D78625
+  * DEX Color MFP D78630
+  * DEX Color MFP D78635
+  * DEX MFP D731
+  * DEX MFP D73130
+  * DEX MFP D73135
+  * DEX MFP D73140
+
+- Fix plugin verification with sha256 (lp#2110100)
+  * add hplip-utils-Fix-plugin-verification-with-sha256.patch
+
+- Fix C++ compilation on SLE12
+  * add hpcups-fix-compilation-on-SLE12.patch
+
+-------------------------------------------------------------------
+Mon May  5 11:07:28 UTC 2025 - Friedrich Haubensak <hsk17@mail.de>
+
+- Add hplip-3.24.4-gcc15.patch to fix gcc-15 compile time error
+  (lp#2096650)
+
+-------------------------------------------------------------------
+Wed Jan 29 14:51:04 UTC 2025 - Dominique Leuenberger <dimstar@opensuse.org>
+
+- Add python3-setuptools BuildRequires: replaces the fix to
+  manually inject PYTHON_INCLUDEDIR. Fix needed to build against
+  Python 3.13.
+
+-------------------------------------------------------------------
+Thu Jan 23 11:52:26 UTC 2025 - Martin Wilck <mwilck@suse.com>
+
+- Fix error in ConfigBase handling (bsc#1209401)
+  - add hplip-base-fix-error-in-ConfigBase-handling.patch
+
+-------------------------------------------------------------------
+Wed Jan 22 16:52:17 UTC 2025 - Martin Wilck <mwilck@suse.com>
+
+- Fix python error on SLE12-SP3 (bsc#1209401, bsc#1234745)
+  - add hplip-base-replace-f-string-with-string.format-for-p.patch
+
+-------------------------------------------------------------------
+Tue Jan 14 11:34:35 UTC 2025 - Martin Wilck <mwilck@suse.com>
+
+- hplip.spec: re-introduce macros for SLE12 compatibility, so that
+  we can backport security fixes to older releases
+  (bsc#1234745, CVE-2020-6923, jsc#PED-11978)
+
+-------------------------------------------------------------------
+Mon Jul 15 15:19:58 UTC 2024 - Martin Jambor <mjambor@suse.com>
+
+- Add hplip-pserror-c99.patch hplip-scan-hpaio-include.patch
+  hplip-scan-orblite-c99.patch hplip-sclpml-strcasestr.patch
+  hplip-hpaio-gcc14.patch to avoid C99 violations which prevent
+  building with GCC 14. [boo#1225777]
+
 -------------------------------------------------------------------
 Fri Jun 21 21:30:55 UTC 2024 - Martin Wilck <martin.wilck@suse.com>
 
@@ -9,6 +139,8 @@ Fri Jun 21 21:30:55 UTC 2024 - Martin Wilck <martin.wilck@suse.com>
   * HP OfficeJet Pro 8130 All-in-One series
   * HP OfficeJet Pro 9720 Series
   * HP OfficeJet Pro 9730 Series
+- Bug fixes:
+  * hpmud: sanitize printer serial number (bsc#1209401, lp#2012262)
  
 -------------------------------------------------------------------
 Thu Feb 22 07:51:33 UTC 2024 - Dominique Leuenberger <dimstar@opensuse.org>

hplip.keyring

@@ -1,39 +1,37 @@
 -----BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v2.0.18 (GNU/Linux)
 
-mQGiBEsnpscRBACyclffkMVkXXdtY2qTT2+B6HN4hBoUxBwZBULyHFuSP9lsB7wK
-16Hl5ZTu+oy+GegzzFRrHWxBLN9i67T0plNkqDJhWUrmXR7xvX+dFc+Qrl+uPR0i
-CY1NMnWwnFh01YtYb9NAlb3bLn8RLBH8Zo60i7wfwdW9Wi1mgzmUT/UI9wCg7y6R
-VmF4RjNWJ2WRdL/jVeAB8H0D/0xfePoYWrSGzOp7+Vl+xYo5TdSrzohUUnly6xla
-UIKwlBCG/jpQqKH17803GpkFyh5FxG1Db7VWsciDv7flcBLPtn75gU2fPHXL+gnv
-r1eJ+ugQwCl4/8d4iJ5TMXmHQOW2Pd0U47OmbZYNNgtA+lXhF8n8+6w3GRhqubLF
-/9b/A/4wH37bv1shLhdLpP+9WYHc8z9+jmStVUFdAGoD/n6vOpBX+GQYaEY5Y8RS
-Wf0DFhMF6CFYNZ2ngDyvPt53M2jU7hrxXIfs/b5bLMqG2et9M/avdEWGUKTsC7wu
-0zeGtD07r9EA3WDIhxN9QEGZAq5Q3NSbedMHIVE4Ynq7VNCdsrQ0SFBMSVAgKEhQ
-IExpbnV4IEltYWdpbmcgYW5kIFByaW50aW5nKSA8aHBsaXBAaHAuY29tPohgBBMR
-AgAgBQJLJ6bHAhsDBgsJCAcDAgQVAggDBBYCAwECHgECF4AACgkQc9dwzaWQR7n4
-dQCghZgIpxuTC+GhiQIO0dK9wTlbMmoAoOB252fEOvf73v8Ya8qmN1GlmYiXiJwE
-EAECAAYFAk7UORAACgkQnsV5kCcUcIjUuAP8D2rK0KZyA0uHyap2BkF5U4wm6qQ3
-p27K0hh50dZMIMSt3FH0TpW994jaoqBKqrHBk3U+/ZT4tD43hmaqc+XmnYNrNMRO
-KBwkjEzKeKaOBXd1I5Tid0I2u1L6bl5IlQzujbWsn/5YbWypLlZhf3Hxg8uuHYu9
-kiQLYM4jqIi0YgSJARwEEAECAAYFAk3NP24ACgkQd7E6jROY7coc8Af8DYe87G2u
-OSSPGkebecci11oTX9mudvDCQkuTFBcGPlMnPl6bn5QcMjBxuAm2TO0mYlR0QcPU
-vQ+tNypw4AZGfsgnvG1EsxSfTgiR6tD2KdIZD8GJw/GudmtUgF3sZkw1txLkk57u
-YufHc9u56oMvntAaU7nisosE1rdqON9fLf+tqvMcrX2+8tDHobfimltC+J+F5dyx
-Cnef+zB9/+dzAAjiunicNZ35zv9tKBh83kECPUpScpHjrXxAqdSHrNlnjGZdmiFB
-0luSbPCIF8sYyLYb5W+Sw1t7WsZ1XRgq67gTV8Vw2o9jw10a/vclwFHeVEtius6g
-Cj0CwkJ1uRuiLrkCDQRLJ6bHEAgAhDv8Ifl/QKaJONb5/qm8uWC70rlzXLm9YlUp
-bAcr/tvCkG271wzT4Sz/cHTvQ5s3yBsGq49Li7Z9IfVFk5xKV0mdGyiZwmHOxmaV
-L3DcoyLkrOvYStqy3d/DEm9YaAWiAi42REVIXvmRsJce87wCIIY/rLNbncKXOj3H
-TzWopqfnJPf/nkqYqwWbFkQxMmGfK9E84dLwjGRtwCWb5uN/YLM3uSJrwLfsRZbm
-EQhzAJF2mIplwIqR3R7naruQdfyjad5EXOvKQ8P5MxUieGxHUlv90LuYCcW+MvVw
-0zIqchbdWGaz+LGCTRDAIyJZZzB6kLCuHn3TWPyUpPdsBI5jfwAECwf+Nl+UUqw0
-HPZP9kXYG0VED1wFxWEckgzLeF32kDQGIlNp0NbYcSbi8xS56fFbpszA+LZrJgTZ
-mnFRUwDCclma7punj3b8nM0gRtHvuLentmAhnQPIX8SWDRwhBNIujSOxQrtjjw6o
-FyrMlYqpe73IUAAINzeCCwZXKDvOiTgm7oI/mI6fJiNrc8NqNxhGS4Bzw/rexAhZ
-ngekMqR9Nglxk7EzUOqrffc6/Orq1fE2t/UNAOqVVfNX5F2hiINXi1+ywhOYOJVf
-Q/xuil2FmI7txAc/7XmUcqxNwayjOzBKlVHIAcIyLMATw3yRVvh+gezGvUbE9Hny
-YHq7nO9dmenM7YhJBBgRAgAJBQJLJ6bHAhsMAAoJEHPXcM2lkEe5pLMAnA/kDShH
-CzfV5loZcyX8M41tzSYDAJ4jUTgQV69+3QpJmsE3GoCksIYlMQ==
-=lgaV
+mQENBGhe8voBCAC/FDH1D4Y7d+8YbEjSb0jFROcpQrTBvB59tvTetm1YKi3Zm6Im
+BHqHaOLRsJk28lmv0JKPAQj52ybXvTgFwsbjFaOkA6X6y6jNdjzRXLMSGQxY1HMb
+0+ZwtLqEm3yWKsVuDHJ/8AsXc5uLT7q1v5snCWIzzapKD2UIcNL9nUkq1TGAD4xh
+sjoBy247ofnjZq921QJOod5GOhZfskISU7wfWwwSPl6NbOc5cK4Qpo2PMA/r38+m
+Y2svwS6u8XnljRU44txp76pNEFMYwGHsiaIviqTA/UXeib3yuN5NY7w2iXWMSqBs
+b0L9RWFCaxt/ZjNmG1qvo+MdGCSqs3E6wZzDABEBAAG0NEhQTElQIChIUCBMaW51
+eCBJbWFnaW5nIGFuZCBQcmludGluZykgPGhwbGlwQGhwLmNvbT6JATkEEwECACMF
+Amhe8voCGy8HCwkIBwMCAQYVCAIJCgsEFgIDAQIeAQIXgAAKCRCsaVNqLPOiQ2Lt
+B/950TaQebUviamSc+R+65jM6u2janmEAD0m9BMveUBNwMkAp4MycKuVEw04IPCa
+XKUhdQJw0a19SgqKjy3RYoksgYfpKCrQAN6iyNIjIvbm51Ui4VyQXIGDi/ytu6fW
+wQZG0mlc0BboZWFniERP17jDPVHLTrbERByvdr+ytPVzsnRGEURQpl+dIRA/V4jx
+euzcTwJ92pJDg/l0kenXv4JgZlOlsB60wFqFO2zWXiplpgprIvrOfpoynfYjTu96
+3stRD3z+PoEa9llWRMTuooHPLC1+lknuQxO+xeNMT9q68zUanpgp6K82ZH1ZDjaP
+ec+xtHmbhNxz1M724/3OLU3OuQENBGhe8voBCADRlC7StIqnYRIw9rHKDY5eSMht
+6y8hrO7Fmdb5+wdOgLTNXuEaQZxgU1w+CdWUFUxUf3V/NBojHM0I29GuIcIRByKX
+QmqHNAtfNnj8hsFFiU0Dmail4oPfwdXOgh5vo65sfYK+tvJH4SrYYh55DN/j4a3H
+sPEZ0rxG8kM3s7AyXU1gEotPUsrv8k255oEPD1OdFrKZ5urcQ4dunvbcGQ71Qjw1
+dYPtUv9iPnxxXTA9X5aXqCwlTeeL4jQSrJa5Rr8z/gpbFynLrgkV/FUzEcRuQ4gs
+POhcDgsGLPBOlFatoHU3Zk1HrflNSiV+kE7Uy9Uf8FIR9e2BIU8mtvj8YLc1ABEB
+AAGJAj4EGAECAAkFAmhe8voCGy4BKQkQrGlTaizzokPAXSAEGQECAAYFAmhe8voA
+CgkQXk5NJKNOzVeOdQgAk3Zp0eTuzxDZn9QQefM/hxFI2bxR2TNzV7QadphvwmRW
+9G1vnQPosTNs2ock23DQiBayh5oYExF2Y34hr8/GAwfViAKo/fzIZYzF9GosscRV
+R9SbeHEVQ8GZuXa9ifIv9L6fPvP+AsDA76stXGPWpDCGHHcP1eZ3jmDsoxucEDKK
+UgNwL8XSZUbjusrEJJtrNu0UTToo+dMF//9xsIWnsWJ16ypVNSAXCTlyQO8fBSEO
+m6+d1mAdMRd64o9QBu1iYB0DCotLE/gPdKOthIUElNQXey6jYUpg0kRqAvPxd1DH
+wZ+/MphQXtdIG3Sb4ogB/7o6R6iqOdp5lrCwORWmacgSB/oCVB8OVY0GqP1qYj/+
+tup+s8esPsJRCOlv5bPVGhzVTgCgBQWK4wsp57grAiptseBDoVF37HY3vRi/ldy0
+SoISK1udxR7j/cy6Bzsv5xB2UR2K5uaYW/MTd+RkncOT5rHijyrrYBLJvhpnvhzw
+H/fm+XRHQPEu+i3tsMgNrZ4No8Nxa/i+0lpNS1+TbtcPt27RFC+1F4P7Ff9xFSrL
+nkm8j4hYZzG5s8K3TvDGiosqLGcMsVVXt8lFFdC1Pxd1TuLiUM7IMnPweiAjlfM0
+onZMYpdNUWSPht/2v/UQLVe0U9Y2lEnYiqY+IXqnWT7N/0d1Zt+K+7IfZsJt4Uio
+6saq
+=EWRb
 -----END PGP PUBLIC KEY BLOCK-----
+

hplip.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package hplip
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -17,14 +17,48 @@
 
 
 # python-rpm-macros doesn't work for hplip!
-# We just build for py3 since SLE15
+%if 0%{?suse_version} >= 1500
 %define pyversion 3
 %define pymod() python3-%{**}
 %define pyver %{py3_ver}
 %define pyexe %{_bindir}/python3
+%define py_compile(O) %{py3_compile %{-O} %*}
 %global use_qt5 1
+%define gobject gobject
+%else
+%define pyversion 2
+%define pymod() python-%{**}
+%define pyver %{py_ver}
+%define pyexe %{_bindir}/python
+%define gobject gobject2
+%global use_qt5 0
+%global make_build make V=1
+%global make_install make DESTDIR=%{buildroot} V=1 install
+%endif
+
+%if 0%{?suse_version} == 1600 && 0%{?is_opensuse}
+# Build without scanning support
+%bcond_with scan_utils
+%else
+# Build scanning support
+%bcond_without scan_utils
+%endif
+
+# Run cupstestppd on the generated PPDs (prints many warnings)
+%bcond_with testppd
+
+%if 0%{use_qt5}
+%global config_qt_opts --disable-qt4 --enable-qt5
+%global requires_qt %{pymod qt5}
+%global ui_dir ui5
+%else
+%global config_qt_opts --enable-qt4 --disable-qt5
+%global requires_qt %{pymod qt4}
+%global ui_dir ui4
+%endif
+
 Name:           hplip
-Version:        3.24.4
+Version:        3.25.6
 Release:        0
 Summary:        HP's Printing, Scanning, and Faxing Software
 License:        BSD-3-Clause AND GPL-2.0-or-later AND MIT
@@ -85,9 +119,37 @@ Patch402:       hplip-change-pgp-server.patch
 Patch403:       Revert-changes-from-3.18.5-that-break-hp-setup-for-f.patch
 # PATCH-FIX-UPSTREAM: https://bugs.launchpad.net/hplip/+bug/1879445
 Patch404:       hplip-3.20.6-python-includes.patch
+# PATCH-FIX-SUSE https://bugs.launchpad.net/hplip/+bug/2115626 bsc#1245358
+Patch405:       Fix-ReDoS-issue-in-HPLIP-s-SLP-parser.patch
 Patch500:       hplip-missing-drivers.patch
-BuildRequires:  %{pymod devel}
+# PATCH-FIX-UPSTREAM boo#1225777
+Patch601:       hplip-pserror-c99.patch
+Patch602:       hplip-scan-hpaio-include.patch
+Patch603:       hplip-scan-orblite-c99.patch
+Patch604:       hplip-sclpml-strcasestr.patch
+Patch605:       hplip-hpaio-gcc14.patch
+Patch606:       hplip-base-fix-error-in-ConfigBase-handling.patch
+Patch607:       hplip-utils-Fix-plugin-verification-with-sha256.patch
+# lp#2120739
+Patch608:       hp-setup-fix-python-crash-when-manually-importing-gz.patch
+# lp#2120738
+Patch609:       hplip-hardcode-new-signing-key-AC69536A2CF3A243.patch
+# lp#2115046
+Patch610:       hplip-no-urlopener.patch
+# PATCH-FIX-UPSTREAM https://bugs.launchpad.net/hplip/+bug/2096650
+Patch651:       hplip-3.24.4-gcc15.patch
+# Compatibility patches for old SUSE releases
+Patch700:       hplip-base-replace-f-string-with-string.format-for-p.patch
+Patch701:       hpcups-fix-compilation-on-SLE12.patch
+
+%if %use_qt5
 BuildRequires:  %{pymod qt5-devel}
+%else
+BuildRequires:  %{pymod qt4}
+BuildRequires:  libqt4-devel
+%endif
+BuildRequires:  %{pymod devel}
+BuildRequires:  %{pymod setuptools}
 BuildRequires:  %{pymod xml}
 BuildRequires:  cups > 1.5
 BuildRequires:  cups-devel > 1.5
@@ -126,7 +188,7 @@ Requires:       %{name}-hpijs = %{version}-%{release}
 Requires:       %{name}-sane = %{version}-%{release}
 Requires:       %{pymod dbus-python} >= 0.80
 Requires:       %{pymod gobject}
-Requires:       %{pymod qt5}
+Requires:       %{requires_qt}
 Requires:       cups > 1.5
 # foomatic-filters and cups-filters-foomatic-rip
 # do not require Ghostscript because depending on the PPD
@@ -151,11 +213,15 @@ Requires:       foomatic-filters
 Requires:       ghostscript
 # hp-plugin requries lsb_release
 Requires:       lsb-release
+# hp-plugin installation fails without /etc/sane/dll.conf
+Requires:       sane-backends
 Requires(post): %{_bindir}/find
 Requires(post): /bin/grep
 Requires(post): /bin/sed
 Requires(post): coreutils
+%if 0%{?suse_version} >= 1500
 Recommends:     python3-reportlab
+%endif
 # Obsolete earlier package names
 Obsoletes:      hplip17
 Provides:       hplip3 = 3.9.5
@@ -164,6 +230,12 @@ Obsoletes:      hplip3 < 3.9.5
 # This causes the "postscriptdriver" provides to be generated.
 # To avoid that, put "Ignore: cups-devel: cups-rpm-helper in the prjconf.
 
+# Make sure we obsolete old scan-utils
+# in case we're built without scan_utils
+%if %{without scan_utils}
+Obsoletes:      hplip-scan-utils < %{version}
+%endif
+
 %description
 The Hewlett-Packard Linux Imaging and Printing project (HPLIP) provides
 a unified single and multifunction connectivity solution for HP
@@ -253,13 +325,16 @@ Requires:       %{name}-udev-rules = %{version}-%{release}
 Suggests:       %{name} = %{version}
 Enhances:       sane-backends
 # Automatically install this package if hpijs sub-package and sane-backends are
-# both installed:
+# both installed (syntax only
+%if 0%{?suse_version} >= 1500
 Supplements:    (%{name}-hpijs and sane-backends)
+%endif
 
 %description sane
 This package includes the backend driver for scanning with HP scanners
 and all-in-one devices using SANE tools like xsane or scanimage.
 
+%if %{with scan_utils}
 %package scan-utils
 Summary:        HPLIP scanning frontends hp-scan and hp-uiscan
 # SLE does not provide python-pillow (PIL) (bsc#1131613)
@@ -278,6 +353,7 @@ Obsoletes:      %{name}-scan < %{version}-%{release}
 This package provides the "hp-scan" and "hp-uiscan" frontend utilities. These
 utilities are alternatives to the SANE frontends "xsane" and "scanimage". They
 expose some advanced features of certain HP scanner models.
+%endif
 
 %package udev-rules
 Summary:        HPLIP udev rules
@@ -329,8 +405,29 @@ This sub-package is only required by developers.
 %patch -P 401 -p1
 %patch -P 402 -p1
 %patch -P 403 -p1
+%if 0%{?suse_version} >= 1500
+# This patch replaces python-config by python3-config, don't apply on SLE12
 %patch -P 404 -p1
+%endif
+%patch -P 405 -p1
 %patch -P 500 -p1
+%patch -P 601 -p1
+%patch -P 602 -p1
+%patch -P 603 -p1
+%patch -P 604 -p1
+%patch -P 605 -p1
+%patch -P 606 -p1
+%patch -P 607 -p1
+%patch -P 608 -p1
+%patch -P 609 -p1
+%patch -P 610 -p1
+%patch -P 651 -p1
+%if 0%{?suse_version} < 1500
+# python2 compatibility
+%patch -P 700 -p1
+%patch -P 701 -p1
+%endif
+
 # replace "env" shebang and "/usr/bin/python" with real executable
 find . -name '*.py' -o -name pstotiff | \
     xargs -n 1 sed -i '1s,^#!\(%{_bindir}/env python\|%{_bindir}/python\),#!%{pyexe},'
@@ -348,11 +445,9 @@ cp -p %{SOURCE103} %{SOURCE104} ppd/hpcups
 # complains about missing files like NEWS, README, AUTHORS, ChangeLog
 # in each directory where a Makefile.am exists:
 AUTOMAKE='automake --foreign' autoreconf -fvi
-# Fix improper method of Python.h lookup in configure, no longer working with Python 3.8
-PYTHON_INCLUDEDIR="$(python3-config --includes)"
 # Set our preferred architecture-specific flags for the compiler and linker:
-export CFLAGS="%{optflags} ${PYTHON_INCLUDEDIR} -Wno-error=return-type"
-export CXXFLAGS="%{optflags} ${PYTHON_INCLUDEDIR} -fno-strict-aliasing -Wno-error=return-type"
+export CFLAGS="%{optflags} -Wno-error=return-type"
+export CXXFLAGS="%{optflags} -fno-strict-aliasing -Wno-error=return-type"
 # --disable-pp-build disables parallel port build because parallel port support is deprecated by upstream HPLIP
 # and by upstream in general cf. "Parallel port printers" at https://en.opensuse.org/SDB:Installing_a_Printer
 # Since version 3.9.6 the default printer driver install changed from hpijs to hpcups.
@@ -379,8 +474,7 @@ export CXXFLAGS="%{optflags} ${PYTHON_INCLUDEDIR} -fno-strict-aliasing -Wno-erro
 # so that --with-htmldir must be explicitly set.
 %configure \
             --disable-qt3 \
-            --disable-qt4 \
-            --enable-qt5 \
+            %{config_qt_opts} \
             --disable-policykit \
             --enable-doc-build \
             --enable-network-build \
@@ -412,8 +506,7 @@ sed -i 's|ppd/hpcups/\*.ppd.gz ||g' Makefile
 %make_install
 
 # Make and install Python compiled bytecode files
-%py3_compile %{buildroot}%{_datadir}/hplip
-%py3_compile -O %{buildroot}%{_datadir}/hplip
+%py_compile -O %{buildroot}%{_datadir}/hplip
 
 # Hardlink .pyc and .pyo when they have same content.
 # Do not run "fdupes buildroot/_datadir/hplip" because
@@ -490,29 +583,13 @@ done
 # Final test by cupstestppd:
 # To save disk space gzip the files (gzipped PPDs can also be used by CUPS).
 # Future goal: Only have files which don't FAIL for cupstestppd.
-# Ignore FAILs because of errors in UIConstraints and/or NonUIConstraints
-# which are detected since cupstestppd in CUPS > 1.2.7 (i.e. in openSUSE 10.3).
-# See Novell/Suse Bugzilla bug #309822: When this bug is fixed, cupstestppd would
-# no longer result zero exit code.
-# In the long run the PPDs should be fixed but as far as we know there have been
-# no problems because of such UIConstraints errors so that it should be o.k.
-# let those PPDs pass even if they are not strictly compliant.
-# Ignore FAILs because of missing cupsFilter programs because
-# in the package build environment the usual HPLIP filters
-# like "hpcups" and "hpcupsfax" are
-# installed at an unusual place (in the BuildRoot directory).
-# For now keep all PPDs even if cupstestppd FAILs.
-# Reason:
-# With each CUPS version upgrade cupstestppd finds more and more errors
-# so that more and more PPDs would be no longer included in the RPM
-# which have been included before which results a regression.
-# As far as we know there have been no problems at all because of
-# not strictly compliant PPDs in HPLIP so that it is much better
-# to provide all HPLIP PPDs so that the matching printers can be used
-# than to be rigorous regarding enforcing compliance to the PPD specification:
-echo "Final testing by cupstestppd..."
+# Update 2025-08-15: this goal is unrealistic. Skip the testppd step unless
+# explicitly enabled with --with testppd
 for p in *.ppd
-do grep -E -v '^\*UIConstraints:|^\*NonUIConstraints:|^\*cupsFilter:' $p | cupstestppd - || true
+do
+%if %{with testppd}
+   grep -E -v '^\*UIConstraints:|^\*NonUIConstraints:|^\*cupsFilter:' $p | cupstestppd - || true
+%endif
    gzip -n -9 $p
 done
 echo "Moving PPDs that use the hpps filter to %{_datadir}/cups/model/manufacturer-PPDs/hplip-hpps..."
@@ -576,6 +653,15 @@ find "%{buildroot}" -type f -name "*.la" -delete -print
 # so that fdupes can only run for specific directories where linking files is safe:
 %fdupes -s %{buildroot}%{_datadir}/hplip/data/images
 
+# Ensure we have no unpackaged files if build
+# without scan-util
+%if !%{with scan_utils}
+rm -f %{buildroot}%{_bindir}/hp-scan
+rm -f %{buildroot}%{_bindir}/hp-uiscan
+rm -f %{buildroot}%{python_sitearch}/scanext.so
+rm -f %{buildroot}%{_datadir}/applications/hp-uiscan.desktop
+%endif
+
 %post -p /bin/bash
 %udev_rules_update
 %desktop_database_post
@@ -661,15 +747,16 @@ exit 0
 %{_datadir}/hplip/
 %exclude %{_datadir}/hplip/data/models/models.dat
 %exclude %{_datadir}/hplip/base/imageprocessing.py*
-%exclude %{_datadir}/hplip/ui5/scandialog.py*
+%exclude %{_datadir}/hplip/%{ui_dir}/scandialog.py*
 %exclude %{_datadir}/hplip/scan
 %exclude %{_datadir}/hplip/scan.py*
 %exclude %{_datadir}/hplip/uiscan.py*
 %exclude %{_datadir}/hplip/__pycache__/uiscan.*
 %exclude %{_datadir}/hplip/__pycache__/scan.*
 %exclude %{_datadir}/hplip/base/__pycache__/imageprocessing.*
-%exclude %{_datadir}/hplip/ui5/__pycache__/scandialog.*
+%exclude %{_datadir}/hplip/%{ui_dir}/__pycache__/scandialog.*
 
+%if %{with scan_utils}
 # The scanning utils depend on PIL and python3-scikit-image,
 # which are not available in SLE
 %files scan-utils
@@ -681,11 +768,14 @@ exit 0
 %{_datadir}/hplip/scan.py*
 %{_datadir}/hplip/uiscan.py*
 %{_datadir}/hplip/base/imageprocessing.py*
-%{_datadir}/hplip/ui5/scandialog.py*
+%if %{pyversion} != 2
+%{_datadir}/hplip/%{ui_dir}/scandialog.py*
 %{_datadir}/hplip/__pycache__/uiscan.*
 %{_datadir}/hplip/__pycache__/scan.*
 %{_datadir}/hplip/base/__pycache__/imageprocessing.*
-%{_datadir}/hplip/ui5/__pycache__/scandialog.*
+%{_datadir}/hplip/%{ui_dir}/__pycache__/scandialog.*
+%endif
+%endif
 
 %files hpijs
 %config %{_sysconfdir}/hp/