Initial support for IPP / driverless printing

[deeplow]

Changes export logic (in sd-devices) to be able to detect IPP printers without breaking compatibility with the old system.

To achieve this, ipp-usb is used in combination with Avahi. The former detects IPP-compatible printers and creates a local IPP server. Avahi allows for the discovery of these printing servers such that print dialogs can display print information.

Contrary to the legacy printer support, for driverless printing, no print queue is setup with lpadmin. Printers are automatically discovered.

Status

Work in progress

Description

Fixes #2088 #2156.

TODO:

• Find a way to have avahi enabled (preset as enabled is not cutting it)
• add print dialog code (and get PyGObject wheels to build) (used system packages in venv instead)
• handle exceptions
• add tests

Test Plan

• add cups and avahi to sd-devices Qubes services

Checklist

If these changes modify code paths involving cryptography, the opening of files in VMs or network (via the RPC service) traffic, Qubes testing in the staging environment is required. For fine tuning of the graphical user interface, testing in any environment in Qubes is required. Please check as applicable:

• I have tested these changes in the appropriate Qubes environment
• I do not have an appropriate Qubes OS workstation set up (the reviewer will need to test these changes)
• These changes should not need testing in Qubes

If these changes add or remove files other than client code, the AppArmor profile may need to be updated. Please check as applicable:

• I have updated the AppArmor profile
• No update to the AppArmor profile is required for these changes
• I don't know and would appreciate guidance

If these changes modify the database schema, you should include a database migration. Please check as applicable:

• I have written a migration and upgraded a test database based on main and confirmed that the migration is self-contained and applies cleanly
• I have written a migration but have not upgraded a test database based on main and would like the reviewer to do so
• I need help writing a database migration
• No database schema changes are needed

[deeplow]

Progress update

I have now added the GTK dialog itself. As you can see it gets information from the printer before it shows the options. It's a bit of downside of driverless printing when the printer was not previously added. The user has to wait a tiny bit until the printer configurations are obtained. There are ways around that (i.e. adding a print queue), but that requires state, which we're avoiding in disposables. (we decided that here)

---

Next steps

I have updated the TODO list on the first post

[deeplow]

@legoktm regarding the following comment:

securedrop-client/export/pyproject.toml

Lines 14 to 21 in bdf52bc

	# In production these two are installed using a system package
	# so match those versions exactly
	pygobject = [
	{version = "=3.42.2", python = ">=3.11"}, # bookworm
	]
	pycairo = [
	{version = "=1.20.1", python = ">=3.11"}, # bookworm
	]

How critical is is that we keep this in sync? Should some sort of CI warning to update this when the debian packages have been updated? How is it handled for Qt in securedrop-client?

Also, do we need it in the root pyproject.toml? It's causing problems in the CI / safety (could be because it's asking for a later version).

[legoktm]

How critical is is that we keep this in sync? Should some sort of CI warning to update this when the debian packages have been updated? How is it handled for Qt in securedrop-client?

Relatively important, mostly so that our local operation and tests are using the same version that the package is. Realistically the version should only change when we switch Debian versions (e.g. bookworm -> trixie), so we can handle it then. It would be pretty rare for a version bump to come out once a version has already been made stable.

Also, do we need it in the root pyproject.toml?

No, just in export's. The only things in the root pyproject.toml should be the various CI tools we run across the whole project.