[rpms/epiphany] rawhide: Upstream backport: Fix building against Nettle 4.0

[Jan Grulich <jgrulich@redhat.com>]

A new commit has been pushed.

Repo   : rpms/epiphany
Branch : rawhide
Commit : 4dc6aa310b6ae045bc7fcfec7442f95b1bb2f98b
Author : Jan Grulich <jgrulich@redhat.com>
Date   : 2026-07-30T10:38:22+02:00
Stats  : +74/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/epiphany/c/4dc6aa310b6ae045bc7fcfec7442f95b1bb2f98b?branch=rawhide

Log:
Upstream backport: Fix building against Nettle 4.0

---
diff --git a/epiphany-sync-crypto-support-building-against-nettle-4-0.patch b/epiphany-sync-crypto-support-building-against-nettle-4-0.patch
new file mode 100644
index 0000000..ddc5627
--- /dev/null
+++ b/epiphany-sync-crypto-support-building-against-nettle-4-0.patch
@@ -0,0 +1,71 @@
+From a8c7c95efc7d6bd259dea55a8caf75d7cdbc675e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Fernando=20Mu=C3=B1oz?= <fernando@null-life.com>
+Date: Thu, 9 Jul 2026 21:44:11 -0500
+Subject: [PATCH] sync-crypto: Support building against nettle 4.0
+
+nettle 4.0 removed the explicit digest length argument from
+sha256_digest(), gcm_aes256_digest() and hkdf_extract(); the digest
+functions now always write the full digest size. Guard that argument
+with NETTLE_VERSION_MAJOR checks so the code keeps building against
+the nettle 3.x series, which our meson requirement (>= 3.4) still
+allows, as well as against 4.0.
+
+Fixes #2892
+---
+ lib/sync/ephy-sync-crypto.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/lib/sync/ephy-sync-crypto.c b/lib/sync/ephy-sync-crypto.c
+index 4da2a7a2c..8329c1cd4 100644
+--- a/lib/sync/ephy-sync-crypto.c
++++ b/lib/sync/ephy-sync-crypto.c
+@@ -37,6 +37,7 @@
+ #include <nettle/hmac.h>
+ #include <nettle/bignum.h>
+ #include <nettle/sha2.h>
++#include <nettle/version.h>
+ #include <string.h>
+ 
+ #if !NETTLE_USE_MINI_GMP
+@@ -1186,7 +1187,11 @@ ephy_sync_crypto_pkce_challenge_new (void)
+   sha256_init (&ctx);
+   sha256_update (&ctx, strlen (challenge->code_verifier),
+                  (const uint8_t *)challenge->code_verifier);
+-  sha256_digest (&ctx, SHA256_DIGEST_SIZE, digest);
++  sha256_digest (&ctx,
++#if NETTLE_VERSION_MAJOR < 4
++                 SHA256_DIGEST_SIZE,
++#endif
++                 digest);
+   challenge->code_challenge = ephy_sync_utils_base64_urlsafe_encode (digest, SHA256_DIGEST_SIZE, TRUE);
+ 
+   return challenge;
+@@ -1345,7 +1350,11 @@ concat_kdf_sha256 (const guint8 *shared_secret,
+     sha256_update (&ctx, apv_bytes_len, apv_bytes);
+   /* SuppPubInfo: key length in bits as 4-byte big-endian. */
+   sha256_update (&ctx, 4, (const uint8_t *)&key_len_be);
+-  sha256_digest (&ctx, SHA256_DIGEST_SIZE, digest);
++  sha256_digest (&ctx,
++#if NETTLE_VERSION_MAJOR < 4
++                 SHA256_DIGEST_SIZE,
++#endif
++                 digest);
+ 
+   /* For A256GCM (256 bits), one round of SHA-256 is sufficient. */
+   result = g_malloc (key_len_bits / 8);
+@@ -1543,7 +1552,11 @@ ephy_sync_crypto_decrypt_jwe (const char            *jwe,
+ 
+     decrypted = g_malloc (ciphertext_len);
+     gcm_aes256_decrypt (&ctx, ciphertext_len, decrypted, ciphertext);
+-    gcm_aes256_digest (&ctx, GCM_DIGEST_SIZE, computed_tag);
++    gcm_aes256_digest (&ctx,
++#if NETTLE_VERSION_MAJOR < 4
++                       GCM_DIGEST_SIZE,
++#endif
++                       computed_tag);
+ 
+     /* Verify the authentication tag. */
+     if (memcmp (computed_tag, tag, GCM_DIGEST_SIZE) != 0) {
+-- 
+GitLab
+

diff --git a/epiphany.spec b/epiphany.spec
index 4660f01..0cd10f5 100644
--- a/epiphany.spec
+++ b/epiphany.spec
@@ -19,6 +19,9 @@ Source0:        https://download.gnome.org/sources/epiphany/%{gnome_major_versio
 # Fedora bookmarks
 Patch0:         epiphany-default-bookmarks.patch
 
+# Upstream patches
+Patch10:        epiphany-sync-crypto-support-building-against-nettle-4-0.patch
+
 BuildRequires:  /usr/bin/rst2man
 BuildRequires:  blueprint-compiler
 BuildRequires:  desktop-file-utils