From: Marc-André Lureau <marcandre.lureau@redhat.com>

sha.h has been deprecated. It seems we could just rely on sha1.h/sha2.h
for older versions too, but I didn't check.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4184
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 crypto/hash-nettle.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/crypto/hash-nettle.c b/crypto/hash-nettle.c
index 53f68301efb5..c0ebb44e11f0 100644
--- a/crypto/hash-nettle.c
+++ b/crypto/hash-nettle.c
@@ -23,8 +23,14 @@
 #include "qapi/error.h"
 #include "crypto/hash.h"
 #include "hashpriv.h"
+#include <nettle/version.h>
 #include <nettle/md5.h>
+#if NETTLE_VERSION_MAJOR >= 4
+#include <nettle/sha1.h>
+#include <nettle/sha2.h>
+#else
 #include <nettle/sha.h>
+#endif
 #include <nettle/ripemd160.h>
 #ifdef CONFIG_CRYPTO_SM3
 #include <nettle/sm3.h>
-- 
2.55.0.543.g5ebe2ebe4ea8

On Thu, Aug 13, 2026 at 11:40:48AM +0400, marcandre.lureau@redhat.com wrote:
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
> 
> sha.h has been deprecated. It seems we could just rely on sha1.h/sha2.h
> for older versions too, but I didn't check.

They split the headers back in 2012 according to git, and our min
version is 3.7.3 which certainly has them, so drop the conditional.

> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4184
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>  crypto/hash-nettle.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/crypto/hash-nettle.c b/crypto/hash-nettle.c
> index 53f68301efb5..c0ebb44e11f0 100644
> --- a/crypto/hash-nettle.c
> +++ b/crypto/hash-nettle.c
> @@ -23,8 +23,14 @@
>  #include "qapi/error.h"
>  #include "crypto/hash.h"
>  #include "hashpriv.h"
> +#include <nettle/version.h>
>  #include <nettle/md5.h>
> +#if NETTLE_VERSION_MAJOR >= 4
> +#include <nettle/sha1.h>
> +#include <nettle/sha2.h>
> +#else
>  #include <nettle/sha.h>
> +#endif
>  #include <nettle/ripemd160.h>
>  #ifdef CONFIG_CRYPTO_SM3
>  #include <nettle/sm3.h>
> -- 
> 2.55.0.543.g5ebe2ebe4ea8
> 

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|

On 13/8/26 09:40, marcandre.lureau@redhat.com wrote:
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
> 
> sha.h has been deprecated. It seems we could just rely on sha1.h/sha2.h
> for older versions too, but I didn't check.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4184
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>   crypto/hash-nettle.c | 6 ++++++
>   1 file changed, 6 insertions(+)

Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

On 13/8/26 09:40, marcandre.lureau@redhat.com wrote:
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
> 
> sha.h has been deprecated. It seems we could just rely on sha1.h/sha2.h
> for older versions too, but I didn't check.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4184
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>   crypto/hash-nettle.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/crypto/hash-nettle.c b/crypto/hash-nettle.c
> index 53f68301efb5..c0ebb44e11f0 100644
> --- a/crypto/hash-nettle.c
> +++ b/crypto/hash-nettle.c
> @@ -23,8 +23,14 @@
>   #include "qapi/error.h"
>   #include "crypto/hash.h"
>   #include "hashpriv.h"
> +#include <nettle/version.h>
>   #include <nettle/md5.h>
> +#if NETTLE_VERSION_MAJOR >= 4
> +#include <nettle/sha1.h>
> +#include <nettle/sha2.h>
> +#else
>   #include <nettle/sha.h>
> +#endif
>   #include <nettle/ripemd160.h>
>   #ifdef CONFIG_CRYPTO_SM3
>   #include <nettle/sm3.h>