In light of the recently published cups-browsed (which I don't run) vulnerability, I've been trying to remove net-print/cups from my systems that don't need it, only to find that I cannot, because even with USE=-cups, dev-java/openjdk pulls it in ANYWAY: minbar:root:~:7 # emerge -pvc app-text/ghostscript-gpl net-print/cups Calculating dependencies... done! net-print/cups-2.4.10-r1 pulled in by: dev-java/openjdk-17.0.12_p7 requires net-print/cups >>> Calculating removal order... >>> These are the packages that would be unmerged: app-text/ghostscript-gpl selected: 10.03.1 protected: none omitted: none All selected packages: =app-text/ghostscript-gpl-10.03.1 >>> 'Selected' packages are slated for removal. >>> 'Protected' and 'omitted' packages will not be removed. Packages installed: 1058 Packages in world: 172 Packages in system: 49 Required packages: 1035 Number to remove: 1 minbar:root:~:8 # grep openjdk /etc/portage/package.use dev-java/openjdk -cups On one of the affected systems, I don't have anything that depends any longer on dev-java/openjdk and can remove it. However, I cannot remove it from the machine that hosts minecraft servers because minecraft needs it.
I believe OpenJDK always needs the headers for CUPS, or at least it did for a very long time.
(In reply to Sam James from comment #1) > I believe OpenJDK always needs the headers for CUPS, or at least it did for > a very long time. Yep: https://github.com/openjdk/jdk/blob/73ebb848fdb66861e912ea747c039ddd1f7a5f48/make/autoconf/lib-cups.m4#L46.
