[rpms/rust-sequoia-openpgp] epel10.2: Update to version 2.4.0; Fixes RHBZ#2496672

[Fabio Valentini <decathorpe@gmail.com>]

A new commit has been pushed.

Repo   : rpms/rust-sequoia-openpgp
Branch : epel10.2
Commit : 094498b0eadfbe844bed12ec4c71356db6abff82
Author : Fabio Valentini <decathorpe@gmail.com>
Date   : 2026-07-03T00:37:30+02:00
Stats  : +24/-213 in 7 file(s)
URL    : https://src.fedoraproject.org/rpms/rust-sequoia-openpgp/c/094498b0eadfbe844bed12ec4c71356db6abff82?branch=epel10.2

Log:
Update to version 2.4.0; Fixes RHBZ#2496672

---
diff --git a/.gitignore b/.gitignore
index 850f215..56f34c3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,3 +25,4 @@
 /sequoia-openpgp-2.1.0.crate
 /sequoia-openpgp-2.2.0.crate
 /sequoia-openpgp-2.3.0.crate
+/sequoia-openpgp-2.4.0.crate

diff --git a/0001-Temporarily-revert-RustCrypto-support-for-X448-and-E.patch b/0001-Temporarily-revert-RustCrypto-support-for-X448-and-E.patch
deleted file mode 100644
index 30cb164..0000000
--- a/0001-Temporarily-revert-RustCrypto-support-for-X448-and-E.patch
+++ /dev/null
@@ -1,120 +0,0 @@
-From 987e16c1475c7ece0e51b08798953723c16e4ae3 Mon Sep 17 00:00:00 2001
-From: Fabio Valentini <decathorpe@gmail.com>
-Date: Mon, 11 May 2026 15:03:34 +0200
-Subject: [PATCH] Temporarily revert RustCrypto support for X448 and Ed448
-
-https://gitlab.com/sequoia-pgp/sequoia/-/work_items/1247
----
- src/crypto/backend/rust/asymmetric.rs | 80 +--------------------------
- 1 file changed, 2 insertions(+), 78 deletions(-)
-
-diff --git a/src/crypto/backend/rust/asymmetric.rs b/src/crypto/backend/rust/asymmetric.rs
-index 8741076..a28e468 100644
---- a/src/crypto/backend/rust/asymmetric.rs
-+++ b/src/crypto/backend/rust/asymmetric.rs
-@@ -51,29 +51,17 @@ impl TryFrom<&Protected> for Box<ed25519_dalek::SigningKey> {
-     }
- }
- 
--impl TryFrom<&Protected> for Box<cx448::SigningKey> {
--    type Error = anyhow::Error;
--
--    fn try_from(value: &Protected) -> Result<Self> {
--        if value.len() != cx448::SECRET_KEY_LENGTH {
--            return Err(crate::Error::InvalidArgument(
--                "Bad Ed448 secret length".into()).into());
--        }
--        Ok(Box::new(cx448::SigningKey::from(
--            cx448::SecretKey::from_slice(value.as_ref()))))
--    }
--}
--
- impl Asymmetric for super::Backend {
-     fn supports_algo(algo: PublicKeyAlgorithm) -> bool {
-         use PublicKeyAlgorithm::*;
-         #[allow(deprecated)]
-         match algo {
--            X25519 | Ed25519 | X448 | Ed448 |
-+            X25519 | Ed25519 |
-             RSAEncryptSign | RSAEncrypt | RSASign | ECDH | EdDSA | ECDSA
-                 => true,
-             DSA
-                 => true,
-+            X448 | Ed448 |
-             ElGamalEncrypt | ElGamalEncryptSign | Private(_) | Unknown(_)
-                 => false,
-         }
-@@ -156,70 +144,6 @@ impl Asymmetric for super::Backend {
-         Ok(public.verify(digest, &signature).is_ok())
-     }
- 
--    fn x448_generate_key() -> Result<(Protected, [u8; 56])> {
--        use cx448::x448::{Secret, PublicKey};
--        use cx448::rand_core::OsRng;
--
--        let secret = Secret::new(&mut OsRng);
--        let public = PublicKey::from(&secret);
--
--        Ok(((&secret.as_bytes()[..]).into(), *public.as_bytes()))
--    }
--
--    fn x448_derive_public(secret: &Protected) -> Result<[u8; 56]> {
--        use cx448::x448::{PublicKey, Secret};
--
--        let secret = Secret::from(<[u8; 56]>::try_from(&secret[..])?);
--        Ok(*PublicKey::from(&secret).as_bytes())
--    }
--
--    fn x448_shared_point(secret: &Protected, public: &[u8; 56])
--                         -> Result<Protected> {
--        use cx448::x448::{Secret, PublicKey};
--
--        let secret = Secret::from(<[u8; 56]>::try_from(&secret[..])?);
--        let public = PublicKey::from_bytes(public)
--            .ok_or_else(|| Error::InvalidKey(
--                "Invalid X448 public key".into()))?;
--        let shared = secret.as_diffie_hellman(&public)
--            .ok_or_else(|| Error::InvalidKey(
--                "X448 DH failed: low-order point".into()))?;
--        Ok((&shared.as_bytes()[..]).into())
--    }
--
--    fn ed448_generate_key() -> Result<(Protected, [u8; 57])> {
--        use cx448::rand_core::OsRng as OsRng;
--        let pair = cx448::SigningKey::generate(OsRng);
--        Ok(((&pair.as_bytes()[..]).into(), pair.verifying_key().to_bytes()))
--    }
--
--    fn ed448_derive_public(secret: &Protected) -> Result<[u8; 57]> {
--        use cx448::SigningKey;
--        let secret: Box<SigningKey> = secret.try_into()?;
--        let public = secret.verifying_key();
--        Ok(public.to_bytes())
--    }
--
--    fn ed448_sign(secret: &Protected, _public: &[u8; 57], digest: &[u8])
--                  -> Result<[u8; 114]> {
--        use cx448::SigningKey;
--        let secret: Box<SigningKey> = secret.try_into()?;
--        Ok(secret.sign_raw(digest).to_bytes())
--    }
--
--    fn ed448_verify(public: &[u8; 57], digest: &[u8], signature: &[u8; 114])
--                    -> Result<bool> {
--        use cx448::{VerifyingKey, Signature};
--
--        let public = VerifyingKey::from_bytes(public).map_err(|e| {
--            Error::InvalidKey(e.to_string())
--        })?;
--        let signature = Signature::from_bytes(signature).map_err(|e| {
--            Error::BadSignature(e.to_string())
--        })?;
--        Ok(public.verify_raw(&signature, digest).is_ok())
--    }
--
-     fn dsa_generate_key(p_bits: usize)
-                         -> Result<(MPI, MPI, MPI, MPI, ProtectedMPI)>
-     {
--- 
-2.54.0
-

diff --git a/rust-sequoia-openpgp.spec b/rust-sequoia-openpgp.spec
index 1df5aa8..93cbb79 100644
--- a/rust-sequoia-openpgp.spec
+++ b/rust-sequoia-openpgp.spec
@@ -5,7 +5,7 @@
 %global crate sequoia-openpgp
 
 Name:           rust-sequoia-openpgp
-Version:        2.3.0
+Version:        2.4.0
 Release:        %autorelease
 Summary:        OpenPGP data types and associated machinery
 
@@ -16,10 +16,7 @@ Source:         %{crates_source}
 Patch:          sequoia-openpgp-fix-metadata-auto.diff
 # Manually created patch for downstream crate metadata changes
 # * drop unused, benchmark-only criterion dev-dependency
-# * drop unwanted cx448 dependency
 Patch:          sequoia-openpgp-fix-metadata.diff
-# * partial revert of https://gitlab.com/sequoia-pgp/sequoia/-/commit/3681643a
-Patch:          0001-Temporarily-revert-RustCrypto-support-for-X448-and-E.patch
 
 BuildRequires:  cargo-rpm-macros >= 24
 
@@ -67,30 +64,6 @@ use the "__implicit-crypto-backend-for-tests" feature of the "%{crate}" crate.
 %files       -n %{name}+__implicit-crypto-backend-for-tests-devel
 %ghost %{crate_instdir}/Cargo.toml
 
-%package     -n %{name}+allow-experimental-crypto-devel
-Summary:        %{summary}
-BuildArch:      noarch
-
-%description -n %{name}+allow-experimental-crypto-devel %{_description}
-
-This package contains library source intended for building other packages which
-use the "allow-experimental-crypto" feature of the "%{crate}" crate.
-
-%files       -n %{name}+allow-experimental-crypto-devel
-%ghost %{crate_instdir}/Cargo.toml
-
-%package     -n %{name}+allow-variable-time-crypto-devel
-Summary:        %{summary}
-BuildArch:      noarch
-
-%description -n %{name}+allow-variable-time-crypto-devel %{_description}
-
-This package contains library source intended for building other packages which
-use the "allow-variable-time-crypto" feature of the "%{crate}" crate.
-
-%files       -n %{name}+allow-variable-time-crypto-devel
-%ghost %{crate_instdir}/Cargo.toml
-
 %package     -n %{name}+compression-devel
 Summary:        %{summary}
 BuildArch:      noarch
@@ -151,33 +124,19 @@ use the "crypto-openssl" feature of the "%{crate}" crate.
 %files       -n %{name}+crypto-openssl-devel
 %ghost %{crate_instdir}/Cargo.toml
 
-%package     -n %{name}+crypto-rust-devel
-Summary:        %{summary}
-BuildArch:      noarch
-
-%description -n %{name}+crypto-rust-devel %{_description}
-
-This package contains library source intended for building other packages which
-use the "crypto-rust" feature of the "%{crate}" crate.
-
-%files       -n %{name}+crypto-rust-devel
-%ghost %{crate_instdir}/Cargo.toml
-
 %prep
 %autosetup -n %{crate}-%{version} -p1
 %cargo_prep
 
 %generate_buildrequires
 # * ensure all dependencies for tests are generated
-%cargo_generate_buildrequires -f crypto-nettle,crypto-openssl,crypto-rust,compression
+%cargo_generate_buildrequires -f crypto-nettle,crypto-openssl,compression
 
 %build
-# * build with the Nettle crypto backend (default)
+# * build with the Nettle crypto backend (upstream default)
 %cargo_build -n -f crypto-nettle,compression
-# * build with the OpenSSL crypto backend
+# * build with the OpenSSL crypto backend (Fedora default)
 %cargo_build -n -f crypto-openssl,compression
-# * build with the RustCrypto crypto backend
-%cargo_build -n -f crypto-rust,compression,allow-experimental-crypto,allow-variable-time-crypto
 
 %install
 %cargo_install
@@ -186,12 +145,10 @@ use the "crypto-rust" feature of the "%{crate}" crate.
 %check
 # * skip tests that exploit undefined behaviour and are not reliable:
 #   https://gitlab.com/sequoia-pgp/sequoia/-/issues/1064
-# * run tests with the Nettle crypto backend (default)
+# * run tests with the Nettle crypto backend (upstream default)
 %cargo_test -n -f crypto-nettle,compression -- -- --skip leak_tests
-# * run tests with the OpenSSL crypto backend
+# * run tests with the OpenSSL crypto backend (Fedora default)
 %cargo_test -n -f crypto-openssl,compression -- -- --skip leak_tests
-# * run tests with the RustCrypto crypto backend
-%cargo_test -n -f crypto-rust,compression,allow-experimental-crypto,allow-variable-time-crypto -- -- --skip leak_tests
 %endif
 
 %changelog

diff --git a/rust2rpm.toml b/rust2rpm.toml
index 6b410c2..a673191 100644
--- a/rust2rpm.toml
+++ b/rust2rpm.toml
@@ -10,5 +10,10 @@ hide = [
     "crypto-botan2",
     "crypto-cng",
     "crypto-fuzzing",
+    # missing dependencies:
+    # ml-dsa ^0.1.1, ml-kem ^0.3.2, cx448 ^0.1.1
+    "crypto-rust",
+    "allow-experimental-crypto",
+    "allow-variable-time-crypto",
 ]
 

diff --git a/sequoia-openpgp-fix-metadata-auto.diff b/sequoia-openpgp-fix-metadata-auto.diff
index a1c03ce..c877495 100644
--- a/sequoia-openpgp-fix-metadata-auto.diff
+++ b/sequoia-openpgp-fix-metadata-auto.diff
@@ -1,5 +1,5 @@
---- sequoia-openpgp-2.3.0/Cargo.toml	1970-01-01T00:00:01+00:00
-+++ sequoia-openpgp-2.3.0/Cargo.toml	2026-05-11T13:05:33.937714+00:00
+--- sequoia-openpgp-2.4.0/Cargo.toml	2006-07-24T01:21:28+00:00
++++ sequoia-openpgp-2.4.0/Cargo.toml	2026-07-02T22:12:43.439333+00:00
 @@ -79,8 +79,6 @@
      "dep:cipher",
      "dep:cx448",
@@ -17,7 +17,7 @@
  ]
  crypto-fuzzing = []
  crypto-nettle = ["dep:nettle"]
-@@ -519,37 +516,6 @@
+@@ -537,37 +534,6 @@
  version = ">=0.20, <0.24"
  default-features = false
  
@@ -55,8 +55,8 @@
  [lints.clippy.complexity]
  level = "allow"
  priority = -1
-@@ -572,3 +538,4 @@
-     'cfg(osslconf, values("OPENSSL_NO_IDEA"))',
+@@ -591,3 +557,4 @@
      'cfg(osslconf, values("OPENSSL_NO_OCB"))',
+     'cfg(osslconf, values("OPENSSL_NO_DES"))',
  ]
 +

diff --git a/sequoia-openpgp-fix-metadata.diff b/sequoia-openpgp-fix-metadata.diff
index 89cdc3f..c96e6c2 100644
--- a/sequoia-openpgp-fix-metadata.diff
+++ b/sequoia-openpgp-fix-metadata.diff
@@ -1,45 +1,13 @@
---- sequoia-openpgp-2.3.0/Cargo.toml	1970-01-01T00:00:01+00:00
-+++ sequoia-openpgp-2.3.0/Cargo.toml	2026-05-11T13:05:48.855039+00:00
-@@ -77,7 +77,6 @@
- crypto-botan2 = ["dep:botan"]
- crypto-cng = [
-     "dep:cipher",
--    "dep:cx448",
-     "dep:eax",
-     "dep:ed25519",
-     "dep:ed25519-dalek",
-@@ -103,7 +102,6 @@
-     "dep:cast5",
-     "dep:cfb-mode",
-     "dep:cipher",
--    "dep:cx448",
-     "dep:des",
-     "dep:digest",
-     "dep:eax",
-@@ -291,15 +289,6 @@
- ]
- optional = true
- 
--[dependencies.cx448]
--version = "0.1.1"
--features = [
--    "signing",
--    "zeroize",
--]
--optional = true
--default-features = false
--
- [dependencies.des]
- version = "0.8"
- features = ["zeroize"]
-@@ -491,10 +480,6 @@
- [dependencies.xxhash-rust]
+--- sequoia-openpgp-2.4.0/Cargo.toml	2006-07-24T01:21:28+00:00
++++ sequoia-openpgp-2.4.0/Cargo.toml	2026-07-02T22:12:48.733874+00:00
+@@ -510,10 +510,6 @@
  version = "0.8"
  features = ["xxh3"]
--
+ 
 -[dev-dependencies.criterion]
 -version = "0.5"
 -features = ["html_reports"]
- 
+-
  [dev-dependencies.quickcheck]
  version = "1"
+ default-features = false

diff --git a/sources b/sources
index e99845c..7048194 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sequoia-openpgp-2.3.0.crate) = 3397484ba7bed50c63df48525988cdeb5556c094e1256fe27cbca6c6ff4c8629307fd55262f8f093085925b4c8af166fdb3e6ef10209acf45ef9eeb7ea4b46ee
+SHA512 (sequoia-openpgp-2.4.0.crate) = 6e33a2c4599e5d7543435be80c60657bfaf1bbb2e6aa30162dd455ca0054a19de2a9a5eed50b40896b2a49f82bcdae78455418dffcd4f053c5ea70978f7cc8b5