[Openicc] Do we want /usr/local/share/color/icc as a third profile directory ?

[Bob Friesenhahn]

On Sat, 26 Nov 2005, Hal V. Engel wrote:

> A specific example from a past thread in this list may raise some other issues
> related to this.  A while back there was a very long thread about printing
> systems that included information about the beta version of CUPS (1.2.x).
> This version of CUPS will handle a color space transformation to a printer
> color space using a profile passed in by the calling application.  For
> security reasons CUPS 1.2.x will only use profiles that are located in the
> CUPS directory.  Actually it only requires that these be logically in the
> CUPS directory since it will allow these files to be in a linked location.
> But that is really beside the point since to use the CM stuff in CUPS the
> users application needs to pass CUPS a printer profile that is either
> physically or logically located in the CUPS directory structure.

The CUPS issue is quite interesting.  Normally printing is either 
handled on the local system, or the job is spooled (without 
processing) to some other system which takes care of printing details. 
It may be that CUPS will be delivered as a component of some printers.

The process that initiates the printing knows about the document 
colors, but it may not have access to information on the printer.  It 
may not know about the printers which are available, or it may be 
printed by a different organization entirely.  So any necessary 
profiles which describe the document to be printed must be bundled up 
with the print job.  The print server may then apply these profiles 
before sending the data to the printer, or the print server may 
forward the job yet again, and the printer itself applies the 
profiles.

In a large organization, it is likely that any profiles which describe 
printers will be located on a network share.  Or maybe they won't be 
shared at all and only the underlying printing system actually knows 
about the properties of the printer.

If CUPS is worried about security, then ordinary users can not be 
allowed to update the CUPS profile directory, and CUPS may not trust 
profiles which are attached to print jobs.  This seems self-defeating 
to me.

Bob
======================================
Bob Friesenhahn
bfriesen at simple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/