13 changed files with 789 additions and 943 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,2 +1,2 @@
-SOURCES/webkitgtk-2.42.5.tar.xz
+SOURCES/webkitgtk-2.46.3.tar.xz
 SOURCES/webkitgtk-keys.gpg
--- a/.webkit2gtk3.metadata
+++ b/.webkit2gtk3.metadata
@ -1,2 +1,2 @@
-c3ffb2beaac56f1089029f2254482f48d9e3db37 SOURCES/webkitgtk-2.42.5.tar.xz
+110e2c2ac964f207a8f2fecf6e2e61f0ed4bee00 SOURCES/webkitgtk-2.46.3.tar.xz
-cf57cbbadf2a07c6ede1c886f9742b7d352460c0 SOURCES/webkitgtk-keys.gpg
+04b10b8a486542c4551269c20b18b5c1c6cb4f94 SOURCES/webkitgtk-keys.gpg
--- a/SOURCES/CVE-2024-44309.patch
+++ b/SOURCES/CVE-2024-44309.patch
@ -0,0 +1,320 @@
 From c52da7c313795d61665253f23c9f298005549c73 Mon Sep 17 00:00:00 2001
 From: Charlie Wolfe <charliew@apple.com>
 Date: Thu, 14 Nov 2024 13:56:35 -0800
 Subject: [PATCH] Cherry-pick 60c387845715.
 Cherry-pick 2815b4e29829. rdar://139893250
    Data Isolation bypass via attacker controlled firstPartyForCookies
    https://bugs.webkit.org/show_bug.cgi?id=283095
    rdar://139818629
    Reviewed by Matthew Finkel and Alex Christensen.
    `NetworkProcess::allowsFirstPartyForCookies` unconditionally allows cookie access for about:blank or
    empty firstPartyForCookies URLs. We tried to remove this in rdar://105733798 and rdar://107270673, but
    we needed to revert both because there were rare and subtle bugs where certain requests would incorrectly
    have about:blank set as their firstPartyForCookies, causing us to kill the WCP.
    This patch is a lower risk change that removes the unconditional cookie access for requests that have an
    empty firstPartyForCookies, but will not kill the WCP that is incorrectly sending an empty
    firstPartyForCookies.
    * Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
    (WebKit::NetworkConnectionToWebProcess::createSocketChannel):
    (WebKit::NetworkConnectionToWebProcess::scheduleResourceLoad):
    (WebKit::NetworkConnectionToWebProcess::cookiesForDOM):
    (WebKit::NetworkConnectionToWebProcess::setCookiesFromDOM):
    (WebKit::NetworkConnectionToWebProcess::cookiesEnabled):
    (WebKit::NetworkConnectionToWebProcess::cookieRequestHeaderFieldValue):
    (WebKit::NetworkConnectionToWebProcess::getRawCookies):
    (WebKit::NetworkConnectionToWebProcess::cookiesForDOMAsync):
    (WebKit::NetworkConnectionToWebProcess::setCookieFromDOMAsync):
    (WebKit::NetworkConnectionToWebProcess::domCookiesForHost):
    (WebKit::NetworkConnectionToWebProcess::establishSWContextConnection):
    * Source/WebKit/NetworkProcess/NetworkProcess.cpp:
    (WebKit::NetworkProcess::allowsFirstPartyForCookies):
    * Source/WebKit/NetworkProcess/NetworkProcess.h:
    * Source/WebKit/NetworkProcess/NetworkSession.cpp:
    (WebKit::NetworkSession::addAllowedFirstPartyForCookies):
    * Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerConnection.cpp:
    (WebKit::WebSWServerConnection::scheduleJobInServer):
    * Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServerConnection.cpp:
    (WebKit::WebSharedWorkerServerConnection::requestSharedWorker):
    * Tools/TestWebKitAPI/Tests/WebKitCocoa/IPCTestingAPI.mm:
    (EmptyFirstPartyForCookiesCookieRequestHeaderFieldValue)):
    Canonical link: https://commits.webkit.org/283286.477@safari-7620-branch
 Canonical link: https://commits.webkit.org/282416.294@webkitglib/2.46
 ---
 .../NetworkConnectionToWebProcess.cpp         | 51 ++++++++++++++-----
 .../WebKit/NetworkProcess/NetworkProcess.cpp  | 37 +++++++-------
 Source/WebKit/NetworkProcess/NetworkProcess.h |  5 +-
 .../WebKit/NetworkProcess/NetworkSession.cpp  |  2 +-
 .../ServiceWorker/WebSWServerConnection.cpp   |  2 +-
 .../WebSharedWorkerServerConnection.cpp       |  2 +-
 .../Tests/WebKitCocoa/IPCTestingAPI.mm        | 33 ++++++++++++
 7 files changed, 96 insertions(+), 36 deletions(-)
 diff --git a/Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp b/Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
 index a0ad3c628ec38..c13a96f0e796a 100644
 --- a/Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
 +++ b/Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
@@ -502,7 +502,7 @@ void NetworkConnectionToWebProcess::didReceiveInvalidMessage(IPC::Connection&, I
 void NetworkConnectionToWebProcess::createSocketChannel(const ResourceRequest& request, const String& protocol, WebSocketIdentifier identifier, WebPageProxyIdentifier webPageProxyID, std::optional<FrameIdentifier> frameID, std::optional<PageIdentifier> pageID, const ClientOrigin& clientOrigin, bool hadMainFrameMainResourcePrivateRelayed, bool allowPrivacyProxy, OptionSet<AdvancedPrivacyProtections> advancedPrivacyProtections, ShouldRelaxThirdPartyCookieBlocking shouldRelaxThirdPartyCookieBlocking, WebCore::StoredCredentialsPolicy storedCredentialsPolicy)
 {
 -    MESSAGE_CHECK(m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, request.firstPartyForCookies()));
 +    MESSAGE_CHECK(m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, request.firstPartyForCookies()) != NetworkProcess::AllowCookieAccess::Terminate);
     ASSERT(!m_networkSocketChannels.contains(identifier));
     if (auto channel = NetworkSocketChannel::create(*this, m_sessionID, request, protocol, identifier, webPageProxyID, frameID, pageID, clientOrigin, hadMainFrameMainResourcePrivateRelayed, allowPrivacyProxy, advancedPrivacyProtections, shouldRelaxThirdPartyCookieBlocking, storedCredentialsPolicy))
@@ -552,11 +552,11 @@ RefPtr<ServiceWorkerFetchTask> NetworkConnectionToWebProcess::createFetchTask(Ne
 void NetworkConnectionToWebProcess::scheduleResourceLoad(NetworkResourceLoadParameters&& loadParameters, std::optional<NetworkResourceLoadIdentifier> existingLoaderToResume)
 {
 -    bool hasCookieAccess = m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, loadParameters.request.firstPartyForCookies());
 -    if (UNLIKELY(!hasCookieAccess))
 +    auto allowCookieAccess = m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, loadParameters.request.firstPartyForCookies());
 +    if (UNLIKELY(allowCookieAccess != NetworkProcess::AllowCookieAccess::Allow))
         RELEASE_LOG_ERROR(Loading, "scheduleResourceLoad: Web process does not have cookie access to url %" SENSITIVE_LOG_STRING " for request %" SENSITIVE_LOG_STRING, loadParameters.request.firstPartyForCookies().string().utf8().data(), loadParameters.request.url().string().utf8().data());
 -    MESSAGE_CHECK(hasCookieAccess);
 +    MESSAGE_CHECK(allowCookieAccess != NetworkProcess::AllowCookieAccess::Terminate);
     CONNECTION_RELEASE_LOG(Loading, "scheduleResourceLoad: (parentPID=%d, pageProxyID=%" PRIu64 ", webPageID=%" PRIu64 ", frameID=%" PRIu64 ", resourceID=%" PRIu64 ", existingLoaderToResume=%" PRIu64 ")", loadParameters.parentPID, loadParameters.webPageProxyID.toUInt64(), loadParameters.webPageID.toUInt64(), loadParameters.webFrameID.object().toUInt64(), loadParameters.identifier.toUInt64(), valueOrDefault(existingLoaderToResume).toUInt64());
@@ -785,7 +785,10 @@ void NetworkConnectionToWebProcess::registerURLSchemesAsCORSEnabled(Vector<Strin
 void NetworkConnectionToWebProcess::cookiesForDOM(const URL& firstParty, const SameSiteInfo& sameSiteInfo, const URL& url, FrameIdentifier frameID, PageIdentifier pageID, IncludeSecureCookies includeSecureCookies, ApplyTrackingPrevention applyTrackingPrevention, ShouldRelaxThirdPartyCookieBlocking shouldRelaxThirdPartyCookieBlocking, CompletionHandler<void(String cookieString, bool secureCookiesAccessed)>&& completionHandler)
 {
 -    MESSAGE_CHECK_COMPLETION(m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, firstParty), completionHandler({ }, false));
 +    auto allowCookieAccess = m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, firstParty);
 +    MESSAGE_CHECK_COMPLETION(allowCookieAccess != NetworkProcess::AllowCookieAccess::Terminate, completionHandler({ }, false));
 +    if (allowCookieAccess != NetworkProcess::AllowCookieAccess::Allow)
 +        return completionHandler({ }, false);
     auto* networkStorageSession = storageSession();
     if (!networkStorageSession)
@@ -802,7 +805,10 @@ void NetworkConnectionToWebProcess::cookiesForDOM(const URL& firstParty, const S
 void NetworkConnectionToWebProcess::setCookiesFromDOM(const URL& firstParty, const SameSiteInfo& sameSiteInfo, const URL& url, WebCore::FrameIdentifier frameID, PageIdentifier pageID, ApplyTrackingPrevention applyTrackingPrevention, const String& cookieString, ShouldRelaxThirdPartyCookieBlocking shouldRelaxThirdPartyCookieBlocking)
 {
 -    MESSAGE_CHECK(m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, firstParty));
 +    auto allowCookieAccess = m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, firstParty);
 +    MESSAGE_CHECK(allowCookieAccess != NetworkProcess::AllowCookieAccess::Terminate);
 +    if (allowCookieAccess != NetworkProcess::AllowCookieAccess::Allow)
 +        return;
     auto* networkStorageSession = storageSession();
     if (!networkStorageSession)
@@ -823,7 +829,10 @@ void NetworkConnectionToWebProcess::cookiesEnabledSync(const URL& firstParty, co
 void NetworkConnectionToWebProcess::cookiesEnabled(const URL& firstParty, const URL& url, std::optional<FrameIdentifier> frameID, std::optional<PageIdentifier> pageID, ShouldRelaxThirdPartyCookieBlocking shouldRelaxThirdPartyCookieBlocking, CompletionHandler<void(bool)>&& completionHandler)
 {
 -    MESSAGE_CHECK_COMPLETION(m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, firstParty), completionHandler(false));
 +    auto allowCookieAccess = m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, firstParty);
 +    MESSAGE_CHECK_COMPLETION(allowCookieAccess != NetworkProcess::AllowCookieAccess::Terminate, completionHandler(false));
 +    if (allowCookieAccess != NetworkProcess::AllowCookieAccess::Allow)
 +        return completionHandler(false);
     auto* networkStorageSession = storageSession();
     if (!networkStorageSession) {
@@ -837,7 +846,10 @@ void NetworkConnectionToWebProcess::cookiesEnabled(const URL& firstParty, const
 void NetworkConnectionToWebProcess::cookieRequestHeaderFieldValue(const URL& firstParty, const SameSiteInfo& sameSiteInfo, const URL& url, std::optional<FrameIdentifier> frameID, std::optional<PageIdentifier> pageID, IncludeSecureCookies includeSecureCookies, ApplyTrackingPrevention applyTrackingPrevention, ShouldRelaxThirdPartyCookieBlocking shouldRelaxThirdPartyCookieBlocking, CompletionHandler<void(String, bool)>&& completionHandler)
 {
 -    MESSAGE_CHECK_COMPLETION(m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, firstParty), completionHandler({ }, false));
 +    auto allowCookieAccess = m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, firstParty);
 +    MESSAGE_CHECK_COMPLETION(allowCookieAccess != NetworkProcess::AllowCookieAccess::Terminate, completionHandler({ }, false));
 +    if (allowCookieAccess != NetworkProcess::AllowCookieAccess::Allow)
 +        return completionHandler({ }, false);
     auto* networkStorageSession = storageSession();
     if (!networkStorageSession)
@@ -848,7 +860,10 @@ void NetworkConnectionToWebProcess::cookieRequestHeaderFieldValue(const URL& fir
 void NetworkConnectionToWebProcess::getRawCookies(const URL& firstParty, const SameSiteInfo& sameSiteInfo, const URL& url, std::optional<FrameIdentifier> frameID, std::optional<PageIdentifier> pageID, ApplyTrackingPrevention applyTrackingPrevention, ShouldRelaxThirdPartyCookieBlocking shouldRelaxThirdPartyCookieBlocking, CompletionHandler<void(Vector<WebCore::Cookie>&&)>&& completionHandler)
 {
 -    MESSAGE_CHECK_COMPLETION(m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, firstParty), completionHandler({ }));
 +    auto allowCookieAccess = m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, firstParty);
 +    MESSAGE_CHECK_COMPLETION(allowCookieAccess != NetworkProcess::AllowCookieAccess::Terminate, completionHandler({ }));
 +    if (allowCookieAccess != NetworkProcess::AllowCookieAccess::Allow)
 +        return completionHandler({ });
     auto* networkStorageSession = storageSession();
     if (!networkStorageSession)
@@ -877,7 +892,10 @@ void NetworkConnectionToWebProcess::deleteCookie(const URL& url, const String& c
 void NetworkConnectionToWebProcess::cookiesForDOMAsync(const URL& firstParty, const SameSiteInfo& sameSiteInfo, const URL& url, std::optional<WebCore::FrameIdentifier> frameID, std::optional<WebCore::PageIdentifier> pageID, IncludeSecureCookies includeSecureCookies, ApplyTrackingPrevention applyTrackingPrevention, ShouldRelaxThirdPartyCookieBlocking shouldRelaxThirdPartyCookieBlocking, WebCore::CookieStoreGetOptions&& options, CompletionHandler<void(std::optional<Vector<WebCore::Cookie>>&&)>&& completionHandler)
 {
 -    MESSAGE_CHECK_COMPLETION(m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, firstParty), completionHandler(std::nullopt));
 +    auto allowCookieAccess = m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, firstParty);
 +    MESSAGE_CHECK_COMPLETION(allowCookieAccess != NetworkProcess::AllowCookieAccess::Terminate, completionHandler(std::nullopt));
 +    if (allowCookieAccess != NetworkProcess::AllowCookieAccess::Allow)
 +        return completionHandler(std::nullopt);
     auto* networkStorageSession = storageSession();
     if (!networkStorageSession)
@@ -894,7 +912,10 @@ void NetworkConnectionToWebProcess::cookiesForDOMAsync(const URL& firstParty, co
 void NetworkConnectionToWebProcess::setCookieFromDOMAsync(const URL& firstParty, const SameSiteInfo& sameSiteInfo, const URL& url, std::optional<WebCore::FrameIdentifier> frameID, std::optional<WebCore::PageIdentifier> pageID, ApplyTrackingPrevention applyTrackingPrevention, WebCore::Cookie&& cookie, ShouldRelaxThirdPartyCookieBlocking shouldRelaxThirdPartyCookieBlocking, CompletionHandler<void(bool)>&& completionHandler)
 {
 -    MESSAGE_CHECK(m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, firstParty));
 +    auto allowCookieAccess = m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, firstParty);
 +    MESSAGE_CHECK_COMPLETION(allowCookieAccess != NetworkProcess::AllowCookieAccess::Terminate, completionHandler(false));
 +    if (allowCookieAccess != NetworkProcess::AllowCookieAccess::Allow)
 +        return completionHandler(false);
     auto* networkStorageSession = storageSession();
     if (!networkStorageSession)
@@ -914,7 +935,10 @@ void NetworkConnectionToWebProcess::domCookiesForHost(const URL& url, Completion
 {
     auto host = url.host().toString();
     MESSAGE_CHECK_COMPLETION(HashSet<String>::isValidValue(host), completionHandler({ }));
 -    MESSAGE_CHECK_COMPLETION(m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, url), completionHandler({ }));
 +    auto allowCookieAccess = m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, url);
 +    MESSAGE_CHECK_COMPLETION(allowCookieAccess != NetworkProcess::AllowCookieAccess::Terminate, completionHandler({ }));
 +    if (allowCookieAccess != NetworkProcess::AllowCookieAccess::Allow)
 +        return completionHandler({ });
     auto* networkStorageSession = storageSession();
     if (!networkStorageSession)
@@ -1423,7 +1447,8 @@ void NetworkConnectionToWebProcess::establishSWContextConnection(WebPageProxyIde
 {
     auto* session = networkSession();
     if (auto* swServer = session ? session->swServer() : nullptr) {
 -        MESSAGE_CHECK(session->networkProcess().allowsFirstPartyForCookies(webProcessIdentifier(), registrableDomain));
 +        auto allowCookieAccess = session->networkProcess().allowsFirstPartyForCookies(webProcessIdentifier(), registrableDomain);
 +        MESSAGE_CHECK(allowCookieAccess != NetworkProcess::AllowCookieAccess::Terminate);
         m_swContextConnection = makeUnique<WebSWServerToContextConnection>(*this, webPageProxyID, WTFMove(registrableDomain), serviceWorkerPageIdentifier, *swServer);
     }
     completionHandler();
 diff --git a/Source/WebKit/NetworkProcess/NetworkProcess.cpp b/Source/WebKit/NetworkProcess/NetworkProcess.cpp
 index db0437d3b70a2..8f637e6c85fd4 100644
 --- a/Source/WebKit/NetworkProcess/NetworkProcess.cpp
 +++ b/Source/WebKit/NetworkProcess/NetworkProcess.cpp
@@ -458,48 +458,49 @@ void NetworkProcess::webProcessWillLoadWebArchive(WebCore::ProcessIdentifier pro
     }).iterator->value.first = LoadedWebArchive::Yes;
 }
 -bool NetworkProcess::allowsFirstPartyForCookies(WebCore::ProcessIdentifier processIdentifier, const URL& firstParty)
 +auto NetworkProcess::allowsFirstPartyForCookies(WebCore::ProcessIdentifier processIdentifier, const URL& firstParty) -> AllowCookieAccess
 {
 -    // FIXME: This should probably not be necessary. If about:blank is the first party for cookies,
 -    // we should set it to be the inherited origin then remove this exception.
 -    if (firstParty.isAboutBlank())
 -        return true;
 +    auto allowCookieAccess = allowsFirstPartyForCookies(processIdentifier, RegistrableDomain { firstParty });
 +    if (allowCookieAccess == NetworkProcess::AllowCookieAccess::Terminate) {
 +        // FIXME: This should probably not be necessary. If about:blank is the first party for cookies,
 +        // we should set it to be the inherited origin then remove this exception.
 +        if (firstParty.isAboutBlank())
 +            return AllowCookieAccess::Disallow;
 -    if (firstParty.isNull())
 -        return true; // FIXME: This shouldn't be allowed.
 +        if (firstParty.isNull())
 +            return AllowCookieAccess::Disallow; // FIXME: This shouldn't be allowed.
 +    }
 -    return allowsFirstPartyForCookies(processIdentifier, RegistrableDomain { firstParty });
 +    return allowCookieAccess;
 }
 -bool NetworkProcess::allowsFirstPartyForCookies(WebCore::ProcessIdentifier processIdentifier, const RegistrableDomain& firstPartyDomain)
 +auto NetworkProcess::allowsFirstPartyForCookies(WebCore::ProcessIdentifier processIdentifier, const RegistrableDomain& firstPartyDomain) -> AllowCookieAccess
 {
     // FIXME: This shouldn't be needed but it is hit sometimes at least with PDFs.
 -    if (firstPartyDomain.isEmpty())
 -        return true;
 -
 +    auto terminateOrDisallow = firstPartyDomain.isEmpty() ? AllowCookieAccess::Disallow : AllowCookieAccess::Terminate;
     if (!decltype(m_allowedFirstPartiesForCookies)::isValidKey(processIdentifier)) {
         ASSERT_NOT_REACHED();
 -        return false;
 +        return terminateOrDisallow;
     }
     auto iterator = m_allowedFirstPartiesForCookies.find(processIdentifier);
     if (iterator == m_allowedFirstPartiesForCookies.end()) {
         ASSERT_NOT_REACHED();
 -        return false;
 +        return terminateOrDisallow;
     }
     if (iterator->value.first == LoadedWebArchive::Yes)
 -        return true;
 +        return AllowCookieAccess::Allow;
     auto& set = iterator->value.second;
     if (!std::remove_reference_t<decltype(set)>::isValidValue(firstPartyDomain)) {
         ASSERT_NOT_REACHED();
 -        return false;
 +        return terminateOrDisallow;
     }
     auto result = set.contains(firstPartyDomain);
 -    ASSERT(result);
 -    return result;
 +    ASSERT(result || terminateOrDisallow == AllowCookieAccess::Disallow);
 +    return result ? AllowCookieAccess::Allow : terminateOrDisallow;
 }
 void NetworkProcess::addStorageSession(PAL::SessionID sessionID, const WebsiteDataStoreParameters& parameters)
 diff --git a/Source/WebKit/NetworkProcess/NetworkProcess.h b/Source/WebKit/NetworkProcess/NetworkProcess.h
 index 0897537e58476..54f19ab96ce47 100644
 --- a/Source/WebKit/NetworkProcess/NetworkProcess.h
 +++ b/Source/WebKit/NetworkProcess/NetworkProcess.h
@@ -417,8 +417,9 @@ class NetworkProcess final : public AuxiliaryProcess, private DownloadManager::C
     void deleteWebsiteDataForOrigin(PAL::SessionID, OptionSet<WebsiteDataType>, const WebCore::ClientOrigin&, CompletionHandler<void()>&&);
     void deleteWebsiteDataForOrigins(PAL::SessionID, OptionSet<WebsiteDataType>, const Vector<WebCore::SecurityOriginData>& origins, const Vector<String>& cookieHostNames, const Vector<String>& HSTSCacheHostnames, const Vector<RegistrableDomain>&, CompletionHandler<void()>&&);
 -    bool allowsFirstPartyForCookies(WebCore::ProcessIdentifier, const URL&);
 -    bool allowsFirstPartyForCookies(WebCore::ProcessIdentifier, const RegistrableDomain&);
 +    enum class AllowCookieAccess : uint8_t { Disallow, Allow, Terminate };
 +    AllowCookieAccess allowsFirstPartyForCookies(WebCore::ProcessIdentifier, const URL&);
 +    AllowCookieAccess allowsFirstPartyForCookies(WebCore::ProcessIdentifier, const RegistrableDomain&);
     void addAllowedFirstPartyForCookies(WebCore::ProcessIdentifier, WebCore::RegistrableDomain&&, LoadedWebArchive, CompletionHandler<void()>&&);
     void webProcessWillLoadWebArchive(WebCore::ProcessIdentifier);
 diff --git a/Source/WebKit/NetworkProcess/NetworkSession.cpp b/Source/WebKit/NetworkProcess/NetworkSession.cpp
 index d3e9e8b4b64bc..2c5fb9ad6765e 100644
 --- a/Source/WebKit/NetworkProcess/NetworkSession.cpp
 +++ b/Source/WebKit/NetworkProcess/NetworkSession.cpp
@@ -728,7 +728,7 @@ void NetworkSession::appBoundDomains(CompletionHandler<void(HashSet<WebCore::Reg
 void NetworkSession::addAllowedFirstPartyForCookies(WebCore::ProcessIdentifier webProcessIdentifier, std::optional<WebCore::ProcessIdentifier> requestingProcessIdentifier, WebCore::RegistrableDomain&& firstPartyForCookies)
 {
 -    if (requestingProcessIdentifier && (requestingProcessIdentifier != webProcessIdentifier) && !m_networkProcess->allowsFirstPartyForCookies(requestingProcessIdentifier.value(), firstPartyForCookies)) {
 +    if (requestingProcessIdentifier && (requestingProcessIdentifier != webProcessIdentifier) && m_networkProcess->allowsFirstPartyForCookies(requestingProcessIdentifier.value(), firstPartyForCookies) != NetworkProcess::AllowCookieAccess::Allow) {
         ASSERT_NOT_REACHED();
         return;
     }
 diff --git a/Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerConnection.cpp b/Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerConnection.cpp
 index 72d67d9f98a2d..515f4597cf33f 100644
 --- a/Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerConnection.cpp
 +++ b/Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerConnection.cpp
@@ -344,7 +344,7 @@ void WebSWServerConnection::postMessageToServiceWorker(ServiceWorkerIdentifier d
 void WebSWServerConnection::scheduleJobInServer(ServiceWorkerJobData&& jobData)
 {
 -    MESSAGE_CHECK(networkProcess().allowsFirstPartyForCookies(identifier(), WebCore::RegistrableDomain::uncheckedCreateFromHost(jobData.topOrigin.host())));
 +    MESSAGE_CHECK(networkProcess().allowsFirstPartyForCookies(identifier(), WebCore::RegistrableDomain::uncheckedCreateFromHost(jobData.topOrigin.host())) != NetworkProcess::AllowCookieAccess::Terminate);
     ASSERT(!jobData.scopeURL.isNull());
     if (jobData.scopeURL.isNull()) {
 diff --git a/Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServerConnection.cpp b/Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServerConnection.cpp
 index 83affaaded38e..084bbdf8f8c55 100644
 --- a/Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServerConnection.cpp
 +++ b/Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServerConnection.cpp
@@ -79,7 +79,7 @@ NetworkSession* WebSharedWorkerServerConnection::session()
 void WebSharedWorkerServerConnection::requestSharedWorker(WebCore::SharedWorkerKey&& sharedWorkerKey, WebCore::SharedWorkerObjectIdentifier sharedWorkerObjectIdentifier, WebCore::TransferredMessagePort&& port, WebCore::WorkerOptions&& workerOptions)
 {
 -    MESSAGE_CHECK(m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, WebCore::RegistrableDomain::uncheckedCreateFromHost(sharedWorkerKey.origin.topOrigin.host())));
 +    MESSAGE_CHECK(m_networkProcess->allowsFirstPartyForCookies(m_webProcessIdentifier, WebCore::RegistrableDomain::uncheckedCreateFromHost(sharedWorkerKey.origin.topOrigin.host())) != NetworkProcess::AllowCookieAccess::Terminate);
     MESSAGE_CHECK(sharedWorkerObjectIdentifier.processIdentifier() == m_webProcessIdentifier);
     MESSAGE_CHECK(sharedWorkerKey.name == workerOptions.name);
     CONNECTION_RELEASE_LOG("requestSharedWorker: sharedWorkerObjectIdentifier=%" PUBLIC_LOG_STRING, sharedWorkerObjectIdentifier.toString().utf8().data());
--- a/SOURCES/cairo-1.15.patch
+++ b/SOURCES/cairo-1.15.patch
@ -1,36 +0,0 @@
 diff --git a/Source/cmake/OptionsGTK.cmake b/Source/cmake/OptionsGTK.cmake
 index 526fe7cfe0cf..7650ea1bade2 100644
 --- a/Source/cmake/OptionsGTK.cmake
 +++ b/Source/cmake/OptionsGTK.cmake
@@ -13,7 +13,7 @@ endif ()
 set(USER_AGENT_BRANDING "" CACHE STRING "Branding to add to user agent string")
 -find_package(Cairo 1.16.0 REQUIRED)
 +find_package(Cairo 1.14.0 REQUIRED)
 find_package(Fontconfig 2.13.0 REQUIRED)
 find_package(Freetype 2.9.0 REQUIRED)
 find_package(LibGcrypt 1.6.0 REQUIRED)
@@ -91,6 +91,14 @@ else ()
     WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_RESOURCE_USAGE PRIVATE OFF)
 endif ()
 +# Enable variation fonts when cairo >= 1.16, fontconfig >= 2.13.0, freetype >= 2.9.0 and harfbuzz >= 1.4.2.
 +if (("${PC_CAIRO_VERSION}" VERSION_GREATER "1.16.0" OR "${PC_CAIRO_VERSION}" STREQUAL "1.16.0")
 +    AND ("${PC_FONTCONFIG_VERSION}" VERSION_GREATER "2.13.0" OR "${PC_FONTCONFIG_VERSION}" STREQUAL "2.13.0")
 +    AND ("${FREETYPE_VERSION_STRING}" VERSION_GREATER "2.9.0" OR "${FREETYPE_VERSION_STRING}" STREQUAL "2.9.0")
 +    AND ("${PC_HARFBUZZ_VERSION}" VERSION_GREATER "1.4.2" OR "${PC_HARFBUZZ_VERSION}" STREQUAL "1.4.2"))
 +    WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_VARIATION_FONTS PRIVATE ON)
 +endif ()
 +
 # Public options shared with other WebKit ports. Do not add any options here
 # without approval from a GTK reviewer. There must be strong reason to support
 # changing the value of the option.
@@ -149,7 +157,6 @@ WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_POINTER_LOCK PRIVATE ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_SERVICE_WORKER PRIVATE ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_SHAREABLE_RESOURCE PRIVATE ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_SPEECH_SYNTHESIS PRIVATE ${ENABLE_EXPERIMENTAL_FEATURES})
 -WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_VARIATION_FONTS PRIVATE ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_WEB_API_STATISTICS PRIVATE ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_WEB_CODECS PRIVATE ${ENABLE_EXPERIMENTAL_FEATURES})
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_WEB_RTC PRIVATE ${ENABLE_EXPERIMENTAL_FEATURES})
--- a/SOURCES/evolution-sandbox-warning.patch
+++ b/SOURCES/evolution-sandbox-warning.patch
@ -0,0 +1,14 @@
 diff --git a/Source/WebKit/UIProcess/glib/WebProcessPoolGLib.cpp b/Source/WebKit/UIProcess/glib/WebProcessPoolGLib.cpp
 index a2f3b582dcc5..1faf219c2adb 100644
 --- a/Source/WebKit/UIProcess/glib/WebProcessPoolGLib.cpp
 +++ b/Source/WebKit/UIProcess/glib/WebProcessPoolGLib.cpp
@@ -91,7 +91,8 @@ void WebProcessPool::platformInitialize(NeedsGlobalStaticInitialization)
         else {
             static bool once = false;
             if (!once) {
 -                g_warning("WEBKIT_FORCE_SANDBOX no longer allows disabling the sandbox. Use WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1 instead.");
 +                if (g_strcmp0(g_get_prgname(), "evolution"))
 +                    g_warning("WEBKIT_FORCE_SANDBOX no longer allows disabling the sandbox. Use WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1 instead.");
                 once = true;
             }
         }
--- a/SOURCES/evolution-shared-secondary-process.patch
+++ b/SOURCES/evolution-shared-secondary-process.patch
@ -1,14 +0,0 @@
 diff --git a/Source/WebKit/UIProcess/API/glib/WebKitWebContext.cpp b/Source/WebKit/UIProcess/API/glib/WebKitWebContext.cpp
 index a30f5b13be26..72ad006cde21 100644
 --- a/Source/WebKit/UIProcess/API/glib/WebKitWebContext.cpp
 +++ b/Source/WebKit/UIProcess/API/glib/WebKitWebContext.cpp
@@ -438,6 +438,9 @@ static void webkitWebContextConstructed(GObject* object)
     }
     configuration.setTimeZoneOverride(String::fromUTF8(priv->timeZoneOverride.data(), priv->timeZoneOverride.length()));
 +    if (!g_strcmp0(g_get_prgname(), "evolution"))
 +        configuration.setUsesSingleWebProcess(true);
 +
 #if !ENABLE(2022_GLIB_API)
     if (!priv->websiteDataManager)
         priv->websiteDataManager = adoptGRef(webkit_website_data_manager_new("local-storage-directory", priv->localStorageDirectory.data(), nullptr));
--- a/SOURCES/glib-2.56.patch
+++ b/SOURCES/glib-2.56.patch
@ -1,39 +0,0 @@
 diff --git a/Tools/MiniBrowser/gtk/BrowserSettingsDialog.c b/Tools/MiniBrowser/gtk/BrowserSettingsDialog.c
 index ef000cd2b910..432c97257048 100644
 --- a/Tools/MiniBrowser/gtk/BrowserSettingsDialog.c
 +++ b/Tools/MiniBrowser/gtk/BrowserSettingsDialog.c
@@ -175,11 +175,12 @@ static void featureTreeViewRenderStatusData(GtkTreeViewColumn *column, GtkCellRe
 {
     g_autoptr(WebKitFeature) feature = NULL;
     gtk_tree_model_get(model, iter, FEATURES_LIST_COLUMN_FEATURE, &feature, -1);
 -    g_autoptr(GEnumClass) enumClass = g_type_class_ref(WEBKIT_TYPE_FEATURE_STATUS);
 +    GEnumClass *enumClass = g_type_class_ref(WEBKIT_TYPE_FEATURE_STATUS);
     g_object_set(renderer,
                  "markup", NULL,
                  "text", g_enum_get_value(enumClass, webkit_feature_get_status(feature))->value_nick,
                  NULL);
 +    g_type_class_unref(enumClass);
 }
 static void featureTreeViewRenderCategoryData(GtkTreeViewColumn *column, GtkCellRenderer *renderer, GtkTreeModel *model, GtkTreeIter *iter, gpointer data)
 diff --git a/Tools/MiniBrowser/gtk/main.c b/Tools/MiniBrowser/gtk/main.c
 index 8be643a54151..ae82b41400b5 100644
 --- a/Tools/MiniBrowser/gtk/main.c
 +++ b/Tools/MiniBrowser/gtk/main.c
@@ -273,7 +273,7 @@ static gboolean parseFeaturesOptionCallback(const gchar *option, const gchar *va
                 "features, prefixes '-' and '!' disable features. Names are case-insensitive. Example:\n"
                 "\n    %s --features='!DirPseudo,+WebAnimationsCustomEffects,webgl'\n\n"
                 "Available features (+/- = enabled/disabled by default):\n\n", g_get_prgname());
 -        g_autoptr(GEnumClass) statusEnum = g_type_class_ref(WEBKIT_TYPE_FEATURE_STATUS);
 +        GEnumClass *statusEnum = g_type_class_ref(WEBKIT_TYPE_FEATURE_STATUS);
         for (gsize i = 0; i < webkit_feature_list_get_length(featureList); i++) {
             WebKitFeature *feature = webkit_feature_list_get(featureList, i);
             g_print("  %c %s (%s)",
@@ -284,6 +284,7 @@ static gboolean parseFeaturesOptionCallback(const gchar *option, const gchar *va
                 g_print(": %s", webkit_feature_get_name(feature));
             g_print("\n");
         }
 +        g_type_class_unref(statusEnum);
         exit(EXIT_SUCCESS);
     }
--- a/SOURCES/gstreamer-1.16.1.patch
+++ b/SOURCES/gstreamer-1.16.1.patch
@ -1,483 +0,0 @@
 diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
 index 77a0d6507240..353fb87900ba 100644
 --- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
 +++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
@@ -479,7 +479,6 @@ bool MediaPlayerPrivateGStreamer::doSeek(const MediaTime& position, float rate)
     auto seekStart = toGstClockTime(startTime);
     auto seekStop = toGstClockTime(endTime);
 -    GST_DEBUG_OBJECT(pipeline(), "[Seek] Performing actual seek to %" GST_TIMEP_FORMAT " (endTime: %" GST_TIMEP_FORMAT ") at rate %f", &seekStart, &seekStop, rate);
     return gst_element_seek(m_pipeline.get(), rate, GST_FORMAT_TIME, m_seekFlags, GST_SEEK_TYPE_SET, seekStart, GST_SEEK_TYPE_SET, seekStop);
 }
@@ -3296,9 +3295,6 @@ static uint32_t fourccValue(GstVideoFormat format)
     case GST_VIDEO_FORMAT_P010_10LE:
     case GST_VIDEO_FORMAT_P010_10BE:
         return uint32_t(DMABufFormat::FourCC::P010);
 -    case GST_VIDEO_FORMAT_P016_LE:
 -    case GST_VIDEO_FORMAT_P016_BE:
 -        return uint32_t(DMABufFormat::FourCC::P016);
     default:
         break;
     }
 From bbc469a2b43531275243850693af65f5f7d11bc6 Mon Sep 17 00:00:00 2001
 From: Michael Catanzaro <mcatanzaro@redhat.com>
 Date: Wed, 20 Sep 2023 13:07:44 -0500
 Subject: [PATCH 1/2] Revert GStreamer 1.18 dependency
 This reverts https://commits.webkit.org/263218@main
 ---
 .../AudioSourceProviderGStreamer.cpp          |  5 +-
 .../gstreamer/GLVideoSinkGStreamer.cpp        | 11 ++--
 .../gstreamer/GStreamerAudioMixer.cpp         |  2 +-
 .../graphics/gstreamer/GStreamerCommon.cpp    | 52 +++++++++++++++++++
 .../graphics/gstreamer/GStreamerCommon.h      | 16 ++++++
 .../gstreamer/GStreamerRegistryScanner.cpp    |  9 +++-
 .../gstreamer/MediaPlayerPrivateGStreamer.cpp | 46 +++++++++++++---
 .../gstreamer/MediaPlayerPrivateGStreamer.h   |  1 +
 Source/cmake/GStreamerChecks.cmake            |  2 +-
 9 files changed, 127 insertions(+), 17 deletions(-)
 diff --git a/Source/WebCore/platform/audio/gstreamer/AudioSourceProviderGStreamer.cpp b/Source/WebCore/platform/audio/gstreamer/AudioSourceProviderGStreamer.cpp
 index a97e6431802c..d8b1a1f4bd8b 100644
 --- a/Source/WebCore/platform/audio/gstreamer/AudioSourceProviderGStreamer.cpp
 +++ b/Source/WebCore/platform/audio/gstreamer/AudioSourceProviderGStreamer.cpp
@@ -122,7 +122,10 @@ AudioSourceProviderGStreamer::AudioSourceProviderGStreamer(MediaStreamTrackPriva
     g_signal_connect_swapped(decodebin, "pad-added", G_CALLBACK(+[](AudioSourceProviderGStreamer* provider, GstPad* pad) {
         auto padCaps = adoptGRef(gst_pad_query_caps(pad, nullptr));
         bool isAudio = doCapsHaveType(padCaps.get(), "audio");
 -        RELEASE_ASSERT(isAudio);
 +        if (webkitGstCheckVersion(1, 18, 0))
 +            RELEASE_ASSERT(isAudio);
 +        else if (!isAudio)
 +            return;
         auto sinkPad = adoptGRef(gst_element_get_static_pad(provider->m_audioSinkBin.get(), "sink"));
         gst_pad_link(pad, sinkPad.get());
 diff --git a/Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp
 index 1a7480828861..f3a51be68534 100644
 --- a/Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp
 +++ b/Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp
@@ -186,12 +186,13 @@ static void webKitGLVideoSinkGetProperty(GObject* object, guint propertyId, GVal
     WebKitGLVideoSink* sink = WEBKIT_GL_VIDEO_SINK(object);
     switch (propertyId) {
 -    case PROP_STATS: {
 -        GUniqueOutPtr<GstStructure> stats;
 -        g_object_get(sink->priv->appSink.get(), "stats", &stats.outPtr(), nullptr);
 -        gst_value_set_structure(value, stats.get());
 +    case PROP_STATS:
 +        if (webkitGstCheckVersion(1, 18, 0)) {
 +            GUniqueOutPtr<GstStructure> stats;
 +            g_object_get(sink->priv->appSink.get(), "stats", &stats.outPtr(), nullptr);
 +            gst_value_set_structure(value, stats.get());
 +        }
         break;
 -    }
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propertyId, paramSpec);
         RELEASE_ASSERT_NOT_REACHED();
 diff --git a/Source/WebCore/platform/graphics/gstreamer/GStreamerAudioMixer.cpp b/Source/WebCore/platform/graphics/gstreamer/GStreamerAudioMixer.cpp
 index ad4b1ae3f77e..fb7e617b5d56 100644
 --- a/Source/WebCore/platform/graphics/gstreamer/GStreamerAudioMixer.cpp
 +++ b/Source/WebCore/platform/graphics/gstreamer/GStreamerAudioMixer.cpp
@@ -32,7 +32,7 @@ GST_DEBUG_CATEGORY_STATIC(webkit_media_gst_audio_mixer_debug);
 bool GStreamerAudioMixer::isAvailable()
 {
 -    return isGStreamerPluginAvailable("inter") && isGStreamerPluginAvailable("audiomixer");
 +    return webkitGstCheckVersion(1, 18, 0) && isGStreamerPluginAvailable("inter") && isGStreamerPluginAvailable("audiomixer");
 }
 GStreamerAudioMixer& GStreamerAudioMixer::singleton()
 diff --git a/Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.cpp b/Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.cpp
 index 794beaa6932a..5f6b3826f182 100644
 --- a/Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.cpp
 +++ b/Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.cpp
@@ -105,6 +105,24 @@ GstPad* webkitGstGhostPadFromStaticTemplate(GstStaticPadTemplate* staticPadTempl
     return pad;
 }
 +#if !GST_CHECK_VERSION(1, 18, 0)
 +void webkitGstVideoFormatInfoComponent(const GstVideoFormatInfo* info, guint plane, gint components[GST_VIDEO_MAX_COMPONENTS])
 +{
 +    guint c, i = 0;
 +
 +    /* Reverse mapping of info->plane. */
 +    for (c = 0; c < GST_VIDEO_FORMAT_INFO_N_COMPONENTS(info); c++) {
 +        if (GST_VIDEO_FORMAT_INFO_PLANE(info, c) == plane) {
 +            components[i] = c;
 +            i++;
 +        }
 +    }
 +
 +    for (c = i; c < GST_VIDEO_MAX_COMPONENTS; c++)
 +        components[c] = -1;
 +}
 +#endif
 +
 #if ENABLE(VIDEO)
 bool getVideoSizeAndFormatFromCaps(const GstCaps* caps, WebCore::IntSize& size, GstVideoFormat& format, int& pixelAspectRatioNumerator, int& pixelAspectRatioDenominator, int& stride)
 {
@@ -748,6 +766,36 @@ String gstStructureToJSONString(const GstStructure* structure)
     return value->toJSONString();
 }
 +#if !GST_CHECK_VERSION(1, 18, 0)
 +GstClockTime webkitGstElementGetCurrentRunningTime(GstElement* element)
 +{
 +    g_return_val_if_fail(GST_IS_ELEMENT(element), GST_CLOCK_TIME_NONE);
 +
 +    auto baseTime = gst_element_get_base_time(element);
 +    if (!GST_CLOCK_TIME_IS_VALID(baseTime)) {
 +        GST_DEBUG_OBJECT(element, "Could not determine base time");
 +        return GST_CLOCK_TIME_NONE;
 +    }
 +
 +    auto clock = adoptGRef(gst_element_get_clock(element));
 +    if (!clock) {
 +        GST_DEBUG_OBJECT(element, "Element has no clock");
 +        return GST_CLOCK_TIME_NONE;
 +    }
 +
 +    auto clockTime = gst_clock_get_time(clock.get());
 +    if (!GST_CLOCK_TIME_IS_VALID(clockTime))
 +        return GST_CLOCK_TIME_NONE;
 +
 +    if (clockTime < baseTime) {
 +        GST_DEBUG_OBJECT(element, "Got negative current running time");
 +        return GST_CLOCK_TIME_NONE;
 +    }
 +
 +    return clockTime - baseTime;
 +}
 +#endif
 +
 GstClockTime webkitGstInitTime()
 {
     return s_webkitGstInitTime;
@@ -805,6 +853,7 @@ PlatformVideoColorSpace videoColorSpaceFromInfo(const GstVideoInfo& info)
     case GST_VIDEO_TRANSFER_BT709:
         colorSpace.transfer = PlatformVideoTransferCharacteristics::Bt709;
         break;
 +#if GST_CHECK_VERSION(1, 18, 0)
     case GST_VIDEO_TRANSFER_BT601:
         colorSpace.transfer = PlatformVideoTransferCharacteristics::Smpte170m;
         break;
@@ -817,6 +866,7 @@ PlatformVideoColorSpace videoColorSpaceFromInfo(const GstVideoInfo& info)
     case GST_VIDEO_TRANSFER_BT2020_10:
         colorSpace.transfer = PlatformVideoTransferCharacteristics::Bt2020_10bit;
         break;
 +#endif
     case GST_VIDEO_TRANSFER_BT2020_12:
         colorSpace.transfer = PlatformVideoTransferCharacteristics::Bt2020_12bit;
         break;
@@ -935,6 +985,7 @@ void fillVideoInfoColorimetryFromColorSpace(GstVideoInfo* info, const PlatformVi
         case PlatformVideoTransferCharacteristics::Bt709:
             GST_VIDEO_INFO_COLORIMETRY(info).transfer = GST_VIDEO_TRANSFER_BT709;
             break;
 +#if GST_CHECK_VERSION(1, 18, 0)
         case PlatformVideoTransferCharacteristics::Smpte170m:
             GST_VIDEO_INFO_COLORIMETRY(info).transfer = GST_VIDEO_TRANSFER_BT601;
             break;
@@ -947,6 +998,7 @@ void fillVideoInfoColorimetryFromColorSpace(GstVideoInfo* info, const PlatformVi
         case PlatformVideoTransferCharacteristics::Bt2020_10bit:
             GST_VIDEO_INFO_COLORIMETRY(info).transfer = GST_VIDEO_TRANSFER_BT2020_10;
             break;
 +#endif
         case PlatformVideoTransferCharacteristics::Bt2020_12bit:
             GST_VIDEO_INFO_COLORIMETRY(info).transfer = GST_VIDEO_TRANSFER_BT2020_12;
             break;
 diff --git a/Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.h b/Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.h
 index fae7ef96d6c5..65ef4bfefdaa 100644
 --- a/Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.h
 +++ b/Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.h
@@ -56,6 +56,15 @@ inline bool webkitGstCheckVersion(guint major, guint minor, guint micro)
     return true;
 }
 +// gst_video_format_info_component() is GStreamer 1.18 API, so for older versions we use a local
 +// vendored copy of the function.
 +#if !GST_CHECK_VERSION(1, 18, 0)
 +#define GST_VIDEO_MAX_COMPONENTS 4
 +void webkitGstVideoFormatInfoComponent(const GstVideoFormatInfo*, guint, gint components[GST_VIDEO_MAX_COMPONENTS]);
 +
 +#define gst_video_format_info_component webkitGstVideoFormatInfoComponent
 +#endif
 +
 #define GST_VIDEO_CAPS_TYPE_PREFIX  "video/"
 #define GST_AUDIO_CAPS_TYPE_PREFIX  "audio/"
 #define GST_TEXT_CAPS_TYPE_PREFIX   "text/"
@@ -323,6 +332,13 @@ GstElement* makeGStreamerBin(const char* description, bool ghostUnlinkedPads);
 String gstStructureToJSONString(const GstStructure*);
 +// gst_element_get_current_running_time() is GStreamer 1.18 API, so for older versions we use a local
 +// vendored copy of the function.
 +#if !GST_CHECK_VERSION(1, 18, 0)
 +GstClockTime webkitGstElementGetCurrentRunningTime(GstElement*);
 +#define gst_element_get_current_running_time webkitGstElementGetCurrentRunningTime
 +#endif
 +
 GstClockTime webkitGstInitTime();
 PlatformVideoColorSpace videoColorSpaceFromCaps(const GstCaps*);
 diff --git a/Source/WebCore/platform/graphics/gstreamer/GStreamerRegistryScanner.cpp b/Source/WebCore/platform/graphics/gstreamer/GStreamerRegistryScanner.cpp
 index 7cd1926e6d15..032f086b43c0 100644
 --- a/Source/WebCore/platform/graphics/gstreamer/GStreamerRegistryScanner.cpp
 +++ b/Source/WebCore/platform/graphics/gstreamer/GStreamerRegistryScanner.cpp
@@ -900,8 +900,13 @@ GStreamerRegistryScanner::CodecLookupResult GStreamerRegistryScanner::isAVC1Code
         return checkH264Caps(makeString("video/x-h264, level=(string)", maxLevelString).utf8().data());
     }
 -    GST_DEBUG("Checking video decoders for constrained caps");
 -    return checkH264Caps(makeString("video/x-h264, level=(string)", level, ", profile=(string)", profile).utf8().data());
 +    if (webkitGstCheckVersion(1, 18, 0)) {
 +        GST_DEBUG("Checking video decoders for constrained caps");
 +        return checkH264Caps(makeString("video/x-h264, level=(string)", level, ", profile=(string)", profile).utf8().data());
 +    }
 +
 +    GST_DEBUG("Falling back to unconstrained caps");
 +    return checkH264Caps("video/x-h264");
 }
 const char* GStreamerRegistryScanner::configurationNameForLogging(Configuration configuration) const
 diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
 index aad2c0bc432b..77a0d6507240 100644
 --- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
 +++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
@@ -4114,7 +4114,29 @@ GstElement* MediaPlayerPrivateGStreamer::createVideoSink()
         g_signal_connect_swapped(m_videoSink.get(), "repaint-cancelled", G_CALLBACK(repaintCancelledCallback), this);
     }
 -    return m_videoSink.get();
 +    GstElement* videoSink = nullptr;
 +    if (!webkitGstCheckVersion(1, 18, 0)) {
 +        m_fpsSink = makeGStreamerElement("fpsdisplaysink", "sink");
 +        if (m_fpsSink) {
 +            g_object_set(m_fpsSink.get(), "silent", TRUE , nullptr);
 +
 +            // Turn off text overlay unless tracing is enabled.
 +            if (gst_debug_category_get_threshold(webkit_media_player_debug) < GST_LEVEL_TRACE)
 +                g_object_set(m_fpsSink.get(), "text-overlay", FALSE , nullptr);
 +
 +            if (gstObjectHasProperty(m_fpsSink.get(), "video-sink")) {
 +                g_object_set(m_fpsSink.get(), "video-sink", m_videoSink.get(), nullptr);
 +                videoSink = m_fpsSink.get();
 +            } else
 +                m_fpsSink = nullptr;
 +        }
 +    }
 +
 +    if (!m_fpsSink)
 +        videoSink = m_videoSink.get();
 +
 +    ASSERT(videoSink);
 +    return videoSink;
 }
 void MediaPlayerPrivateGStreamer::setStreamVolumeElement(GstStreamVolume* volume)
@@ -4147,16 +4169,26 @@ bool MediaPlayerPrivateGStreamer::updateVideoSinkStatistics()
     if (!m_videoSink)
         return false;
 +    if (!webkitGstCheckVersion(1, 18, 0) && !m_fpsSink)
 +        return false;
 +
     uint64_t totalVideoFrames = 0;
     uint64_t droppedVideoFrames = 0;
 -    GUniqueOutPtr<GstStructure> stats;
 -    g_object_get(m_videoSink.get(), "stats", &stats.outPtr(), nullptr);
 +    if (webkitGstCheckVersion(1, 18, 0)) {
 +        GUniqueOutPtr<GstStructure> stats;
 +        g_object_get(m_videoSink.get(), "stats", &stats.outPtr(), nullptr);
 -    if (!gst_structure_get_uint64(stats.get(), "rendered", &totalVideoFrames))
 -        return false;
 +        if (!gst_structure_get_uint64(stats.get(), "rendered", &totalVideoFrames))
 +            return false;
 -    if (!gst_structure_get_uint64(stats.get(), "dropped", &droppedVideoFrames))
 -        return false;
 +        if (!gst_structure_get_uint64(stats.get(), "dropped", &droppedVideoFrames))
 +            return false;
 +    } else if (m_fpsSink) {
 +        unsigned renderedFrames, droppedFrames;
 +        g_object_get(m_fpsSink.get(), "frames-rendered", &renderedFrames, "frames-dropped", &droppedFrames, nullptr);
 +        totalVideoFrames = renderedFrames;
 +        droppedVideoFrames = droppedFrames;
 +    }
     // Caching is required so that metrics queries performed after EOS still return valid values.
     if (totalVideoFrames)
 diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
 index e0cdb0a2d01f..f33a674481e1 100644
 --- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
 +++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
@@ -578,6 +578,7 @@ private:
     uint64_t m_networkReadPosition { 0 };
     mutable uint64_t m_readPositionAtLastDidLoadingProgress { 0 };
 +    GRefPtr<GstElement> m_fpsSink { nullptr };
     uint64_t m_totalVideoFrames { 0 };
     uint64_t m_droppedVideoFrames { 0 };
     uint64_t m_decodedVideoFrames { 0 };
 diff --git a/Source/cmake/GStreamerChecks.cmake b/Source/cmake/GStreamerChecks.cmake
 index 5380617afc9c..8774f1d2aca8 100644
 --- a/Source/cmake/GStreamerChecks.cmake
 +++ b/Source/cmake/GStreamerChecks.cmake
@@ -36,7 +36,7 @@ if (ENABLE_VIDEO OR ENABLE_WEB_AUDIO)
               list(APPEND GSTREAMER_COMPONENTS webrtc)
           endif ()
 -          find_package(GStreamer 1.18.4 REQUIRED COMPONENTS ${GSTREAMER_COMPONENTS})
 +          find_package(GStreamer 1.16.2 REQUIRED COMPONENTS ${GSTREAMER_COMPONENTS})
           if (ENABLE_WEB_AUDIO)
               if (NOT PC_GSTREAMER_AUDIO_FOUND OR NOT PC_GSTREAMER_FFT_FOUND)
 -- 
 2.41.0
 From 9046961d80cc168aab253e3e0eda2268bd956293 Mon Sep 17 00:00:00 2001
 From: Michael Catanzaro <mcatanzaro@redhat.com>
 Date: Wed, 20 Sep 2023 13:09:28 -0500
 Subject: [PATCH 2/2] Revert GStreamer 1.16 dependency
 This (mostly) reverts https://commits.webkit.org/256284@main
 ---
 .../gstreamer/GLVideoSinkGStreamer.cpp        | 20 ++++++++++++++++++-
 .../gstreamer/eme/GStreamerEMEUtilities.h     | 10 ++++++++++
 ...bKitCommonEncryptionDecryptorGStreamer.cpp |  7 +++++--
 Source/cmake/GStreamerChecks.cmake            |  2 +-
 4 files changed, 35 insertions(+), 4 deletions(-)
 diff --git a/Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp
 index f3a51be68534..bf8ebeda1725 100644
 --- a/Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp
 +++ b/Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp
@@ -88,7 +88,25 @@ static void webKitGLVideoSinkConstructed(GObject* object)
     ASSERT(colorconvert);
     gst_bin_add_many(GST_BIN_CAST(sink), upload, colorconvert, sink->priv->appSink.get(), nullptr);
 -    GRefPtr<GstCaps> caps = adoptGRef(gst_caps_from_string("video/x-raw, format = (string) " GST_GL_CAPS_FORMAT));
 +    // Workaround until we can depend on GStreamer 1.16.2.
 +    // https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/8d32de090554cf29fe359f83aa46000ba658a693
 +    // Forcing a color conversion to RGBA here allows glupload to internally use
 +    // an uploader that adds a VideoMeta, through the TextureUploadMeta caps
 +    // feature, without needing the patch above. However this specific caps
 +    // feature is going to be removed from GStreamer so it is considered a
 +    // short-term workaround. This code path most likely will have a negative
 +    // performance impact on embedded platforms as well. Downstream embedders
 +    // are highly encouraged to cherry-pick the patch linked above in their BSP
 +    // and set the WEBKIT_GST_NO_RGBA_CONVERSION environment variable until
 +    // GStreamer 1.16.2 is released.
 +    // See also https://bugs.webkit.org/show_bug.cgi?id=201422
 +    GRefPtr<GstCaps> caps;
 +    if (webkitGstCheckVersion(1, 16, 2) || getenv("WEBKIT_GST_NO_RGBA_CONVERSION"))
 +        caps = adoptGRef(gst_caps_from_string("video/x-raw, format = (string) " GST_GL_CAPS_FORMAT));
 +    else {
 +        GST_INFO_OBJECT(sink, "Forcing RGBA as GStreamer is not new enough.");
 +        caps = adoptGRef(gst_caps_from_string("video/x-raw, format = (string) RGBA"));
 +    }
     gst_caps_set_features(caps.get(), 0, gst_caps_features_new(GST_CAPS_FEATURE_MEMORY_GL_MEMORY, nullptr));
     g_object_set(sink->priv->appSink.get(), "caps", caps.get(), nullptr);
 diff --git a/Source/WebCore/platform/graphics/gstreamer/eme/GStreamerEMEUtilities.h b/Source/WebCore/platform/graphics/gstreamer/eme/GStreamerEMEUtilities.h
 index 6dbf6a67dfd1..184c5c3e5f77 100644
 --- a/Source/WebCore/platform/graphics/gstreamer/eme/GStreamerEMEUtilities.h
 +++ b/Source/WebCore/platform/graphics/gstreamer/eme/GStreamerEMEUtilities.h
@@ -61,8 +61,10 @@ public:
     const String& systemId() const { return m_systemId; }
     String payloadContainerType() const
     {
 +#if GST_CHECK_VERSION(1, 16, 0)
         if (m_systemId == GST_PROTECTION_UNSPECIFIED_SYSTEM_ID ""_s)
             return "webm"_s;
 +#endif
         return "cenc"_s;
     }
@@ -111,8 +113,10 @@ public:
     static constexpr auto s_WidevineKeySystem = "com.widevine.alpha"_s;
     static constexpr auto s_PlayReadyUUID = WEBCORE_GSTREAMER_EME_UTILITIES_PLAYREADY_UUID ""_s;
     static constexpr std::array<ASCIILiteral, 2> s_PlayReadyKeySystems = { "com.microsoft.playready"_s,  "com.youtube.playready"_s };
 +#if GST_CHECK_VERSION(1, 16, 0)
     static constexpr auto s_unspecifiedUUID = GST_PROTECTION_UNSPECIFIED_SYSTEM_ID ""_s;
     static constexpr auto s_unspecifiedKeySystem = GST_PROTECTION_UNSPECIFIED_SYSTEM_ID ""_s;
 +#endif
     static bool isClearKeyKeySystem(const String& keySystem)
     {
@@ -144,6 +148,7 @@ public:
         return equalIgnoringASCIICase(uuid, s_PlayReadyUUID);
     }
 +#if GST_CHECK_VERSION(1, 16, 0)
     static bool isUnspecifiedKeySystem(const String& keySystem)
     {
         return equalIgnoringASCIICase(keySystem, s_unspecifiedKeySystem);
@@ -153,6 +158,7 @@ public:
     {
         return equalIgnoringASCIICase(uuid, s_unspecifiedUUID);
     }
 +#endif
     static const char* keySystemToUuid(const String& keySystem)
     {
@@ -165,8 +171,10 @@ public:
         if (isPlayReadyKeySystem(keySystem))
             return s_PlayReadyUUID;
 +#if GST_CHECK_VERSION(1, 16, 0)
         if (isUnspecifiedKeySystem(keySystem))
             return s_unspecifiedUUID;
 +#endif
         ASSERT_NOT_REACHED();
         return { };
@@ -183,8 +191,10 @@ public:
         if (isPlayReadyUUID(uuid))
             return s_PlayReadyKeySystems[0];
 +#if GST_CHECK_VERSION(1, 16, 0)
         if (isUnspecifiedUUID(uuid))
             return s_unspecifiedKeySystem;
 +#endif
         ASSERT_NOT_REACHED();
         return ""_s;
 diff --git a/Source/WebCore/platform/graphics/gstreamer/eme/WebKitCommonEncryptionDecryptorGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/eme/WebKitCommonEncryptionDecryptorGStreamer.cpp
 index 0cde37e1f83f..a7bbf7fc569c 100644
 --- a/Source/WebCore/platform/graphics/gstreamer/eme/WebKitCommonEncryptionDecryptorGStreamer.cpp
 +++ b/Source/WebCore/platform/graphics/gstreamer/eme/WebKitCommonEncryptionDecryptorGStreamer.cpp
@@ -171,8 +171,11 @@ static GstCaps* transformCaps(GstBaseTransform* base, GstPadDirection direction,
                 // GST_PROTECTION_UNSPECIFIED_SYSTEM_ID was added in the GStreamer
                 // developement git master which will ship as version 1.16.0.
 -                gst_structure_set_name(outgoingStructure.get(), !g_strcmp0(klass->protectionSystemId(self),
 -                    GST_PROTECTION_UNSPECIFIED_SYSTEM_ID) ? "application/x-webm-enc" : "application/x-cenc");
 +                gst_structure_set_name(outgoingStructure.get(),
 +#if GST_CHECK_VERSION(1, 16, 0)
 +                    !g_strcmp0(klass->protectionSystemId(self), GST_PROTECTION_UNSPECIFIED_SYSTEM_ID) ? "application/x-webm-enc" :
 +#endif
 +                    "application/x-cenc");
             }
         }
 diff --git a/Source/cmake/GStreamerChecks.cmake b/Source/cmake/GStreamerChecks.cmake
 index 8774f1d2aca8..d43093ec7824 100644
 --- a/Source/cmake/GStreamerChecks.cmake
 +++ b/Source/cmake/GStreamerChecks.cmake
@@ -36,7 +36,7 @@ if (ENABLE_VIDEO OR ENABLE_WEB_AUDIO)
               list(APPEND GSTREAMER_COMPONENTS webrtc)
           endif ()
 -          find_package(GStreamer 1.16.2 REQUIRED COMPONENTS ${GSTREAMER_COMPONENTS})
 +          find_package(GStreamer 1.14.0 REQUIRED COMPONENTS ${GSTREAMER_COMPONENTS})
           if (ENABLE_WEB_AUDIO)
               if (NOT PC_GSTREAMER_AUDIO_FOUND OR NOT PC_GSTREAMER_FFT_FOUND)
 -- 
 2.41.0
--- a/SOURCES/i686-build.patch
+++ b/SOURCES/i686-build.patch
@ -1,16 +0,0 @@
 From: Alberto Garcia <berto@igalia.com>
 Subject: Fix FTBFS in i386
 Bug: https://bugs.webkit.org/show_bug.cgi?id=268739
 Index: webkitgtk/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp
 ===================================================================
 --- webkitgtk.orig/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp
 +++ webkitgtk/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp
@@ -336,8 +336,6 @@ JSValue CLoop::execute(OpcodeID entryOpc
     UNUSED_VARIABLE(t2);
     UNUSED_VARIABLE(t3);
     UNUSED_VARIABLE(t5);
 -    UNUSED_VARIABLE(t6);
 -    UNUSED_VARIABLE(t7);
     struct StackPointerScope {
         StackPointerScope(CLoopStack& stack)
--- a/SOURCES/icu60.patch
+++ b/SOURCES/icu60.patch
@ -1,167 +0,0 @@
 diff --git a/Source/JavaScriptCore/runtime/IntlCache.cpp b/Source/JavaScriptCore/runtime/IntlCache.cpp
 index b17d7340df56..94a5474059b6 100644
 --- a/Source/JavaScriptCore/runtime/IntlCache.cpp
 +++ b/Source/JavaScriptCore/runtime/IntlCache.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "IntlCache.h"
 +#include "IntlDisplayNames.h"
 #include <wtf/Vector.h>
 namespace JSC {
@@ -53,6 +54,7 @@ Vector<UChar, 32> IntlCache::getBestDateTimePattern(const CString& locale, const
     return patternBuffer;
 }
 +#if HAVE(ICU_U_LOCALE_DISPLAY_NAMES)
 Vector<UChar, 32> IntlCache::getFieldDisplayName(const CString& locale, UDateTimePatternField field, UDateTimePGDisplayWidth width, UErrorCode& status)
 {
     auto sharedGenerator = getSharedPatternGenerator(locale, status);
@@ -64,5 +66,6 @@ Vector<UChar, 32> IntlCache::getFieldDisplayName(const CString& locale, UDateTim
         return { };
     return buffer;
 }
 +#endif
 } // namespace JSC
 diff --git a/Source/JavaScriptCore/runtime/IntlCache.h b/Source/JavaScriptCore/runtime/IntlCache.h
 index 058b2423786d..e7a8c82f392b 100644
 --- a/Source/JavaScriptCore/runtime/IntlCache.h
 +++ b/Source/JavaScriptCore/runtime/IntlCache.h
@@ -25,6 +25,7 @@
 #pragma once
 +#include "IntlDisplayNames.h"
 #include <unicode/udatpg.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/text/CString.h>
@@ -39,7 +40,9 @@ public:
     IntlCache() = default;
     Vector<UChar, 32> getBestDateTimePattern(const CString& locale, const UChar* skeleton, unsigned skeletonSize, UErrorCode&);
 +#if HAVE(ICU_U_LOCALE_DISPLAY_NAMES)
     Vector<UChar, 32> getFieldDisplayName(const CString& locale, UDateTimePatternField, UDateTimePGDisplayWidth, UErrorCode&);
 +#endif
 private:
     UDateTimePatternGenerator* getSharedPatternGenerator(const CString& locale, UErrorCode& status)
 diff --git a/Source/JavaScriptCore/runtime/IntlDisplayNames.cpp b/Source/JavaScriptCore/runtime/IntlDisplayNames.cpp
 index ed8dd34fdf44..9ec789b65413 100644
 --- a/Source/JavaScriptCore/runtime/IntlDisplayNames.cpp
 +++ b/Source/JavaScriptCore/runtime/IntlDisplayNames.cpp
@@ -104,6 +104,7 @@ void IntlDisplayNames::initializeDisplayNames(JSGlobalObject* globalObject, JSVa
     m_languageDisplay = intlOption<LanguageDisplay>(globalObject, options, vm.propertyNames->languageDisplay, { { "dialect"_s, LanguageDisplay::Dialect }, { "standard"_s, LanguageDisplay::Standard } }, "languageDisplay must be either \"dialect\" or \"standard\""_s, LanguageDisplay::Dialect);
     RETURN_IF_EXCEPTION(scope, void());
 +#if HAVE(ICU_U_LOCALE_DISPLAY_NAMES)
     UErrorCode status = U_ZERO_ERROR;
     UDisplayContext contexts[] = {
@@ -131,6 +132,10 @@ void IntlDisplayNames::initializeDisplayNames(JSGlobalObject* globalObject, JSVa
         throwTypeError(globalObject, scope, "failed to initialize DisplayNames"_s);
         return;
     }
 +#else
 +    throwTypeError(globalObject, scope, "failed to initialize Intl.DisplayNames since feature is not supported by the ICU version"_s);
 +    return;
 +#endif
 }
 // https://tc39.es/proposal-intl-displaynames/#sec-Intl.DisplayNames.prototype.of
@@ -140,6 +145,7 @@ JSValue IntlDisplayNames::of(JSGlobalObject* globalObject, JSValue codeValue) co
     VM& vm = globalObject->vm();
     auto scope = DECLARE_THROW_SCOPE(vm);
 +#if HAVE(ICU_U_LOCALE_DISPLAY_NAMES)
     ASSERT(m_displayNames);
     auto code = codeValue.toWTFString(globalObject);
     RETURN_IF_EXCEPTION(scope, { });
@@ -344,6 +350,11 @@ JSValue IntlDisplayNames::of(JSGlobalObject* globalObject, JSValue codeValue) co
         return throwTypeError(globalObject, scope, "Failed to query a display name."_s);
     }
     return jsString(vm, String(WTFMove(buffer)));
 +#else
 +    UNUSED_PARAM(codeValue);
 +    throwTypeError(globalObject, scope, "failed to initialize Intl.DisplayNames since feature is not supported by the ICU version"_s);
 +    return { };
 +#endif
 }
 // https://tc39.es/proposal-intl-displaynames/#sec-Intl.DisplayNames.prototype.resolvedOptions
 diff --git a/Source/JavaScriptCore/runtime/IntlDisplayNames.h b/Source/JavaScriptCore/runtime/IntlDisplayNames.h
 index 2101c342865e..87a95a26f55c 100644
 --- a/Source/JavaScriptCore/runtime/IntlDisplayNames.h
 +++ b/Source/JavaScriptCore/runtime/IntlDisplayNames.h
@@ -29,6 +29,13 @@
 #include <unicode/uldnames.h>
 #include <wtf/unicode/icu/ICUHelpers.h>
 +#if !defined(HAVE_ICU_U_LOCALE_DISPLAY_NAMES)
 +// We need 61 or later since part of implementation uses UCURR_NARROW_SYMBOL_NAME.
 +#if U_ICU_VERSION_MAJOR_NUM >= 61
 +#define HAVE_ICU_U_LOCALE_DISPLAY_NAMES 1
 +#endif
 +#endif
 +
 namespace JSC {
 enum class RelevantExtensionKey : uint8_t;
 diff --git a/Source/JavaScriptCore/runtime/IntlDurationFormat.cpp b/Source/JavaScriptCore/runtime/IntlDurationFormat.cpp
 index fdcaa71f2011..f6aa1b0e3def 100644
 --- a/Source/JavaScriptCore/runtime/IntlDurationFormat.cpp
 +++ b/Source/JavaScriptCore/runtime/IntlDurationFormat.cpp
@@ -41,7 +41,6 @@
 #endif
 #endif
 #include <unicode/ulistformatter.h>
 -#include <unicode/unumberformatter.h>
 #include <unicode/ures.h>
 #if HAVE(ICU_U_LIST_FORMATTER)
 #define U_HIDE_DRAFT_API 1
@@ -49,6 +48,7 @@
 #if HAVE(ICU_U_LIST_FORMATTER)
 #include <unicode/uformattedvalue.h>
 +#include <unicode/unumberformatter.h>
 #endif
 namespace JSC {
 diff --git a/Source/JavaScriptCore/runtime/IntlObject.cpp b/Source/JavaScriptCore/runtime/IntlObject.cpp
 index cba15c79bc45..9553eb6b263b 100644
 --- a/Source/JavaScriptCore/runtime/IntlObject.cpp
 +++ b/Source/JavaScriptCore/runtime/IntlObject.cpp
@@ -165,7 +165,6 @@ namespace JSC {
   supportedValuesOf     intlObjectFuncSupportedValuesOf              DontEnum|Function 1
   Collator              createCollatorConstructor                    DontEnum|PropertyCallback
   DateTimeFormat        createDateTimeFormatConstructor              DontEnum|PropertyCallback
 -  DisplayNames          createDisplayNamesConstructor                DontEnum|PropertyCallback
   Locale                createLocaleConstructor                      DontEnum|PropertyCallback
   NumberFormat          createNumberFormatConstructor                DontEnum|PropertyCallback
   PluralRules           createPluralRulesConstructor                 DontEnum|PropertyCallback
@@ -253,6 +252,11 @@ void IntlObject::finishCreation(VM& vm, JSGlobalObject*)
     Base::finishCreation(vm);
     ASSERT(inherits(info()));
     JSC_TO_STRING_TAG_WITHOUT_TRANSITION();
 +#if HAVE(ICU_U_LOCALE_DISPLAY_NAMES)
 +    putDirectWithoutTransition(vm, vm.propertyNames->DisplayNames, createDisplayNamesConstructor(vm, this), static_cast<unsigned>(PropertyAttribute::DontEnum));
 +#else
 +    UNUSED_PARAM(&createDisplayNamesConstructor);
 +#endif
 #if HAVE(ICU_U_LIST_FORMATTER)
     if (Options::useIntlDurationFormat())
         putDirectWithoutTransition(vm, vm.propertyNames->DurationFormat, createDurationFormatConstructor(vm, this), static_cast<unsigned>(PropertyAttribute::DontEnum));
 diff --git a/Source/cmake/OptionsGTK.cmake b/Source/cmake/OptionsGTK.cmake
 index 526fe7cfe0cf..7b057f87b67e 100644
 --- a/Source/cmake/OptionsGTK.cmake
 +++ b/Source/cmake/OptionsGTK.cmake
@@ -18,7 +18,7 @@ find_package(Fontconfig 2.13.0 REQUIRED)
 find_package(Freetype 2.9.0 REQUIRED)
 find_package(LibGcrypt 1.6.0 REQUIRED)
 find_package(HarfBuzz 1.4.2 REQUIRED COMPONENTS ICU)
 -find_package(ICU 61.2 REQUIRED COMPONENTS data i18n uc)
 +find_package(ICU 60 REQUIRED COMPONENTS data i18n uc)
 find_package(JPEG REQUIRED)
 find_package(LibEpoxy 1.4.0 REQUIRED)
 find_package(LibXml2 2.8.0 REQUIRED)
--- a/SOURCES/webkitgtk-2.42.5.tar.xz.asc
+++ b/SOURCES/webkitgtk-2.42.5.tar.xz.asc
@ -1,6 +0,0 @@
 -----BEGIN PGP SIGNATURE-----
 iF0EABECAB0WIQTX/PYc+aLeqzHYG9Pz0yLQ7EWCwwUCZcCvFAAKCRDz0yLQ7EWC
 w1FoAJ9+JY5XpvsElI4nSgXhLk3k6O7L5QCeNx1Hj5iFlSDQY17oYfa4FyMEI9I=
 =NxQN
 -----END PGP SIGNATURE-----
--- a/SOURCES/webkitgtk-2.46.3.tar.xz.asc
+++ b/SOURCES/webkitgtk-2.46.3.tar.xz.asc
@ -0,0 +1,16 @@
 -----BEGIN PGP SIGNATURE-----
 iQIzBAABCgAdFiEEAToBJ6ycZbNP+mJSbBAJtpOXU5MFAmciLBQACgkQbBAJtpOX
 U5MFsBAAqwUuPEkirbQXxESAu8nJKUG3RVa4y3c1NaTRETW19cy/32KeiBlxbWW5
 UKF2gKlu5B+mJn9f0hebYBUkqr6HdWO1JnBz3XNXZ7dNObTWlN9g4T6tlqsxAdsk
 B04ddWFQKYQJ4pMLjlxVFkFXQ0vh9UywBwUyGXrqg9yo2OcSGpsqdujyZfdlWrHc
 0kDLow9SYM5XhkzFoQxKlYsVg1vhzpTxDuv39JqVTGHlX8pEplpCsrMwpVQ+89aP
 zv64u/xnPAEsN4wGeB0QyH6H0llukTmrgWUfoRqeDLHMGAeuHe1yONGyK5fWA1u+
 ABTsjVnh5nOQxUZaNc3dpMdUcrp+kVhjKDwMOhKNbfVoLWxchmU5VvrCoytRAX8i
 4js2xOgnMk26cNB4dZsMg9cYH4Zr+nkfkjGljGXRSvexF8iBUc2Dv0scrtDh3ArI
 aWk4eMyO5nRPIFWE6j5d+sAm1TF1hGMW33beYOTy5Iqm2l2inRoaxGdAz2ZFjF5S
 xcjG7tT3+pG8WXPhJ0Tl41mPJKg79tY3F0uzSedtJ+J3q4uRKORFOdChtDbqHHT7
 mI0jT6rrGckXlncufvg19RiCnmP8vmZEyeuTZja6vBsV3pA7Uc/IWcWEXi9ip/om
 grjX+68/ypghS571sFxrjQaNdqrO0fwMrJBZxhgelJKnykvoj2Y=
 =wug0
 -----END PGP SIGNATURE-----
--- a/SPECS/webkit2gtk3.spec
+++ b/SPECS/webkit2gtk3.spec
@ -5,69 +5,68 @@
        mkdir -p _license_files ; \
        cp -p %1 _license_files/$(echo '%1' | sed -e 's!/!.!g')
 # No libmanette in RHEL
 %if !0%{?rhel}
 %global with_gamepad 1
 %endif
 # FIXME: Clang is preferred: https://skia.org/docs/user/build/#supported-and-preferred-compilers
 # But Clang toolchain is broken on i686: https://issues.redhat.com/browse/RHEL-59586
 # So, for now we'll use GCC instead.
 # We run out of memory if building with LTO enabled on i686.
 %ifarch %{ix86}
 %global _lto_cflags %{nil}
 %endif
 Name:           webkit2gtk3
-Version:        2.42.5
+Version:        2.46.3
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        GTK Web content engine library
 License:        LGPLv2
-URL:            http://www.webkitgtk.org/
+URL:            https://www.webkitgtk.org/
-Source0:        http://webkitgtk.org/releases/webkitgtk-%{version}.tar.xz
+Source0:        https://webkitgtk.org/releases/webkitgtk-%{version}.tar.xz
 Source1:        https://webkitgtk.org/releases/webkitgtk-%{version}.tar.xz.asc
 # Use the keys from https://webkitgtk.org/verifying.html
 # $ gpg --import aperez.key carlosgc.key
-# $ gpg --export --export-options export-minimal D7FCF61CF9A2DEAB31D81BD3F3D322D0EC4582C3 5AA3BC334FD7E3369E7C77B291C559DBE4C9123B > webkitgtk-keys.gpg
+# $ gpg --export --export-options export-minimal 013A0127AC9C65B34FFA62526C1009B693975393 5AA3BC334FD7E3369E7C77B291C559DBE4C9123B > webkitgtk-keys.gpg
 Source2:        webkitgtk-keys.gpg
-# https://bugs.webkit.org/show_bug.cgi?id=193749
+# Don't print warning about Evolution's use of WEBKIT_FORCE_SANDBOX
-Patch0:         evolution-shared-secondary-process.patch
+Patch:          evolution-sandbox-warning.patch
 # https://bugs.webkit.org/show_bug.cgi?id=235367
 Patch1:         icu60.patch
 # Partial revert of https://commits.webkit.org/256284@main
 Patch2:         gstreamer-1.16.1.patch
-# Partial revert of https://commits.webkit.org/260744@main
+# https://bugs.webkit.org/show_bug.cgi?id=283095
-Patch3:         cairo-1.15.patch
+Patch:          CVE-2024-44309.patch
 # Avoid dependency on GEnumClass_autoptr
 Patch4:         glib-2.56.patch
 # https://bugs.webkit.org/show_bug.cgi?id=268739
 Patch5:          i686-build.patch
 BuildRequires:  bison
 BuildRequires:  bubblewrap
 BuildRequires:  cmake
 BuildRequires:  flex
 BuildRequires:  gcc-c++
 BuildRequires:  gcc-toolset-13
 BuildRequires:  gettext
 BuildRequires:  git
 BuildRequires:  gnupg2
 BuildRequires:  gperf
 BuildRequires:  hyphen-devel
 BuildRequires:  libatomic
 BuildRequires:  ninja-build
 BuildRequires:  openssl-devel
 BuildRequires:  perl(bigint)
 BuildRequires:  perl(English)
 BuildRequires:  perl(FindBin)
 BuildRequires:  perl(JSON::PP)
 BuildRequires:  python3
 BuildRequires:  ruby
 BuildRequires:  rubygem-json
 BuildRequires:  rubygems
-BuildRequires:  shadow-utils
+BuildRequires:  rubygem-json
 BuildRequires:  unifdef
 BuildRequires:  xdg-dbus-proxy
 BuildRequires:  pkgconfig(atspi-2)
 BuildRequires:  pkgconfig(cairo)
 BuildRequires:  pkgconfig(egl)
 %ifarch aarch64 s390x
 # On aarch64 and s390x enchant-2 is not available (gnome-less)
 BuildRequires:  pkgconfig(enchant)
 %else
 BuildRequires:  pkgconfig(enchant-2)
 %endif
 BuildRequires:  pkgconfig(epoxy)
 BuildRequires:  pkgconfig(fontconfig)
 BuildRequires:  pkgconfig(freetype2)
@ -82,9 +81,9 @@ BuildRequires:  pkgconfig(harfbuzz)
 BuildRequires:  pkgconfig(icu-uc)
 BuildRequires:  pkgconfig(lcms2)
 BuildRequires:  pkgconfig(libdrm)
 BuildRequires:  pkgconfig(libgcrypt)
 BuildRequires:  pkgconfig(libjpeg)
 BuildRequires:  pkgconfig(libnotify)
 BuildRequires:  pkgconfig(libopenjp2)
 BuildRequires:  pkgconfig(libpcre)
 BuildRequires:  pkgconfig(libpng)
 BuildRequires:  pkgconfig(libseccomp)
@ -95,16 +94,22 @@ BuildRequires:  pkgconfig(libtasn1)
 BuildRequires:  pkgconfig(libwebp)
 BuildRequires:  pkgconfig(libwoff2dec)
 BuildRequires:  pkgconfig(libxslt)
 %if 0%{?with_gamepad}
 BuildRequires:  pkgconfig(manette-0.2)
 %endif
 BuildRequires:  pkgconfig(sqlite3)
 BuildRequires:  pkgconfig(sysprof-capture-4)
 BuildRequires:  pkgconfig(upower-glib)
 BuildRequires:  pkgconfig(wayland-client)
 BuildRequires:  pkgconfig(wayland-egl)
 BuildRequires:  pkgconfig(wayland-protocols)
 BuildRequires:  pkgconfig(wayland-server)
 BuildRequires:  pkgconfig(wpe-1.0)
 BuildRequires:  pkgconfig(wpebackend-fdo-1.0)
 BuildRequires:  pkgconfig(xt)
 # These are hard requirements of WebKit's bubblewrap sandbox.
 Requires:       bubblewrap
 Requires:       xdg-dbus-proxy
 # libepoxy will crash when WebKit tries using GLES2 if it's not installed.
 Requires:       libGLES
@ -115,6 +120,11 @@ Recommends:     geoclue2
 Recommends:     gstreamer1-plugins-bad-free
 Recommends:     gstreamer1-plugins-good
 # If no xdg-desktop-portal backend is installed, many features will be broken
 # inside the sandbox. In particular, the -gtk backend has to be installed for
 # desktop settings access, including font settings.
 Recommends:     xdg-desktop-portal-gtk
 # Obsolete libwebkit2gtk from the webkitgtk3 package
 Obsoletes:      libwebkit2gtk < 2.5.0
 Provides:       libwebkit2gtk = %{version}-%{release}
@ -126,8 +136,6 @@ Provides:       webkitgtk4 = %{version}-%{release}
 # GTK+ 2 plugins support was removed in 2.25.3
 Obsoletes:      webkit2gtk3-plugin-process-gtk2 < %{version}-%{release}
 Provides:       webkit2gtk3-plugin-process-gtk2 = %{version}-%{release}
 Obsoletes:      webkitgtk4-plugin-process-gtk2 < %{version}-%{release}
 Provides:       webkitgtk4-plugin-process-gtk2 = %{version}-%{release}
 # Don't build documentation anymore to avoid gi-docgen dependency
 Obsoletes:      webkit2gtk3-doc < %{version}-%{release}
@ -136,6 +144,8 @@ Provides:       webkit2gtk3-doc = %{version}-%{release}
 # We're supposed to specify versions here, but these libraries don't do
 # normal releases. Accordingly, they're not suitable to be system libs.
 Provides:       bundled(angle)
 Provides:       bundled(pdfjs)
 Provides:       bundled(skia)
 Provides:       bundled(xdgmime)
 # Require the jsc subpackage
@ -166,6 +176,8 @@ files for developing applications that use %{name}.
 Summary:        JavaScript engine from %{name}
 Obsoletes:      webkitgtk4-jsc < %{version}-%{release}
 Provides:       webkitgtk4-jsc = %{version}-%{release}
 Provides:       bundled(simde)
 Provides:       bundled(simdutf)
 %description    jsc
 This package contains JavaScript engine from %{name}.
@ -182,7 +194,7 @@ files for developing applications that use JavaScript engine from %{name}.
 %prep
 %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
-%autosetup -p1 -n webkitgtk-%{version} -S git
+%autosetup -p1 -n webkitgtk-%{version}
 # Remove bundled libraries
 rm -rf Source/ThirdParty/gtest/
@ -205,42 +217,42 @@ rm -rf Source/ThirdParty/qunit/
 %global optflags %(echo %{optflags} | sed 's/-g /-g1 /')
 %endif
-# The system GCC is too old to build WebKit, so use a GCC Toolset instead.
+# Warning: although RHEL 9 aarch64 now uses 4 KB page sizes, we still have to
-# This prints warnings complaining that it should not be used except in
+# support 64 KB page sizes until the *builders* use RHEL 9. This means we still
-# SCL scriplets, but I can't figure out any other way to make it work.
+# have to disable JIT and bmalloc, even though this disables important heap
-source scl_source enable gcc-toolset-13
+# security features. We can't simply disable them only during this build,
 # because gobject-introspection will crash when building anything that depends
 # on WebKitGTK, because it calls each object's get_type() function, which will
 # initialize bmalloc and JIT.
 # -DUSE_SYSTEM_MALLOC=ON is really bad for security, but libpas requires
 # __atomic_compare_exchange_16 which does not seem to be available.
 mkdir -p %{_target_platform}
 pushd %{_target_platform}
 %cmake \
  -GNinja \
  -DPORT=GTK \
  -DCMAKE_BUILD_TYPE=Release \
  -DUSE_SYSTEM_MALLOC=ON \
  -DENABLE_JIT=OFF \
-  -DENABLE_BUBBLEWRAP_SANDBOX=OFF \
+  -DUSE_GTK4=OFF \
  -DUSE_SOUP2=ON \
  -DUSE_AVIF=OFF \
  -DENABLE_DOCUMENTATION=OFF \
  -DUSE_GSTREAMER_TRANSCODER=OFF \
  -DUSE_JPEGXL=OFF \
  -DUSE_LIBBACKTRACE=OFF \
 %if !0%{?with_gamepad}
  -DENABLE_GAMEPAD=OFF \
 %endif
 %if 0%{?rhel}
 %ifarch aarch64
  -DUSE_64KB_PAGE_BLOCK=ON \
 %endif
 %endif
-  ..
+  %{nil}
 popd
 # Show the build time in the status
 export NINJA_STATUS="[%f/%t][%e] "
-%ninja_build -C %{_target_platform}
+%cmake_build
 %install
-%ninja_install -C %{_target_platform}
+%cmake_install
 %find_lang WebKitGTK-4.0
@ -302,253 +314,498 @@ export NINJA_STATUS="[%f/%t][%e] "
 %{_datadir}/gir-1.0/JavaScriptCore-4.0.gir
 %changelog
 * Mon Nov 25 2024 Michael Catanzaro <mcatanzaro@redhat.com> - 2.46.3-2
 - Add patch for CVE-2024-44309
 * Wed Oct 30 2024 Michael Catanzaro <mcatanzaro@redhat.com> - 2.46.3-1
 - Update to 2.46.3
 * Mon Oct 21 2024 Michael Catanzaro <mcatanzaro@redhat.com> - 2.46.2-1
 - Update to 2.46.2
 - Add patch to disable Evolution sandbox warning
 * Thu Oct 10 2024 Michael Catanzaro <mcatanzaro@redhat.com> - 2.46.1-2
 - Add patch to keep GSocketMonitor callback alive
  Resolves: RHEL-59185
 * Tue Oct 8 2024 Michael Catanzaro <mcatanzaro@redhat.com> - 2.46.1-1
 - Update to 2.46.1
  Resolves: RHEL-59185
 * Thu Aug 15 2024 Michael Catanzaro <mcatanzaro@redhat.com> - 2.44.3-2
 - Add patch to fix WebAssembly
  Resolves: RHEL-32578
 * Tue Aug 13 2024 Michael Catanzaro <mcatanzaro@redhat.com> - 2.44.3-1
 - Update to 2.44.3
  Resolves: RHEL-32578
 * Thu May 16 2024 Michael Catanzaro <mcatanzaro@redhat.com> - 2.44.2-1
 - Update to 2.44.2
  Resolves: RHEL-32578
 * Thu Apr 11 2024 Michael Catanzaro <mcatanzaro@redhat.com> - 2.44.1-1
 - Update to 2.44.1
  Resolves: RHEL-32578
  Resolves: RHEL-29637 
 * Mon Feb 05 2024 Michael Catanzaro <mcatanzaro@redhat.com> - 2.42.5-1
 - Update to 2.42.5
-  Resolves: RHEL-3961
+  Resolves: RHEL-3960
 * Fri Dec 15 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.42.4-1
 - Update to 2.42.4
-  Resolves: RHEL-3961
+  Resolves: RHEL-3960
-  Resolves: RHEL-19365
+  Resolves: RHEL-19366
 * Tue Dec 05 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.42.3-1
 - Update to 2.42.3
-  Resolves: RHEL-3961
+  Resolves: RHEL-3960
 * Fri Nov 10 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.42.2-1
 - Update to 2.42.2
-  Resolves: RHEL-3961
+  Resolves: RHEL-3960
 * Wed Sep 27 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.42.1-1
 - Update to 2.42.1
-  Resolves: RHEL-3961
+  Resolves: RHEL-3960
-* Wed Sep 20 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.42.0-1
+* Mon Sep 18 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.42.0-1
 - Upgrade to 2.42.0
-  Resolves: RHEL-3961
+  Resolves: RHEL-3960
 * Tue Aug 01 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.40.5-1
- Upgrade to 2.40.5. Also, disable JIT
+- Update to 2.40.5
-  Resolves: #2176269
+  Related: #2176270
-  Resolves: #2185742
+
-  Resolves: #2209728
+* Fri Jul 21 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.40.4-1
-  Resolves: #2209745
+- Update to 2.40.4
-  Resolves: #2218649
+  Related: #2176270
-  Resolves: #2218651
+
-  Resolves: #2224611
+* Tue Jul 11 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.40.3-2
-
+- Disable JIT
-* Thu May 25 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.38.5-1.4
+  Related: #2176270
- Add patch for CVE-2023-28204
+
-  Resolves: #2209744
+* Wed Jun 28 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.40.3-1
- Add patch for CVE-2023-32373
+- Update to 2.40.3
-  Resolves: #2209727
+  Related: #2176270
-
+
-* Fri Apr 14 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.38.5-1.3
+* Tue May 30 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.40.2-1
- Restore libwpe and wpebackend-fdo dependencies
+- Update to 2.40.2
-  Related: #2185741 (sort of)
+  Related: #2176270
-
+
-* Wed Apr 12 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.38.5-1.2
+* Thu May 04 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.40.1-1
- Disable libwpe and wpebackend-fdo dependencies
+- Upgrade to 2.40.1
-  Related: #2185741 (sort of)
+  Resolves: #2176270
 * Tue Apr 11 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.38.5-1.1
 - Add patch for CVE-2023-28205
  Resolves: #2185741
 * Wed Feb 15 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.38.5-1
 - Update to 2.38.5
-  Related: #2127468
+  Related: #2127467
 * Thu Feb 02 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.38.4-1
 - Update to 2.38.4
-  Related: #2127468
+  Related: #2127467
 * Thu Dec 22 2022 Michael Catanzaro <mcatanzaro@redhat.com> - 2.38.3-1
 - Update to 2.38.3
-  Related: #2127468
+  Related: #2127467
 * Fri Nov 04 2022 Michael Catanzaro <mcatanzaro@redhat.com> - 2.38.2-1
 - Update to 2.38.2
-  Related: #2127468
+  Related: #2127467
-* Wed Nov 02 2022 Michael Catanzaro <mcatanzaro@redhat.com> - 2.38.1-2
+* Mon Oct 31 2022 Michael Catanzaro <mcatanzaro@redhat.com> - 2.38.1-2
- Fix crashes on aarch64
+- Fix use with aarch64 64 KiB page size
-  Enable WPE renderer
+  Related: #2127467
  Related: #2127468
-* Thu Oct 27 2022 Michael Catanzaro <mcatanzaro@redhat.com> - 2.38.1-1
+* Mon Oct 24 2022 Michael Catanzaro <mcatanzaro@redhat.com> - 2.38.1-1
 - Update to 2.38.1
-  Related: #2127468
+  Resolves: #2127467
 * Wed Aug 24 2022 Michael Catanzaro <mcatanzaro@redhat.com> - 2.36.7-1
 - Update to 2.36.7
-  Related: #2061994
+  Related: #2061996
 * Tue Aug 09 2022 Michael Catanzaro <mcatanzaro@redhat.com> - 2.36.6-1
 - Update to 2.36.6
-  Related: #2061994
+  Related: #2061996
 * Tue Aug 02 2022 Michael Catanzaro <mcatanzaro@redhat.com> - 2.36.5-2
 - Fix Eclipse after update to 2.36.5
-  Related: #2061994
+  Related: #2061996
 * Thu Jul 28 2022 Michael Catanzaro <mcatanzaro@redhat.com> - 2.36.5-1
 - Update to 2.36.5
-  Related: #2061994
+  Related: #2061996
  Resolves: #2099334
 * Tue Jul 05 2022 Michael Catanzaro <mcatanzaro@redhat.com> - 2.36.4-1
 - Update to 2.36.4
-  Related: #2061994
+  Related: #2061996
 * Thu Jun 02 2022 Michael Catanzaro <mcatanzaro@redhat.com> - 2.36.3-1
 - Update to 2.36.3
- Related: #2061994
+- Related: #2061996
- Resolves: #2092748
+- Resolves: #2092749
 * Wed May 18 2022 Michael Catanzaro <mcatanzaro@redhat.com> - 2.36.2-1
 - Update to 2.36.2
-  Related: #2061994
+  Related: #2061996
 * Thu Apr 21 2022 Michael Catanzaro <mcatanzaro@redhat.com> - 2.36.1-1
 - Update to 2.36.1
-  Related: #2061994
+  Related: #2061996
- Resolves: #2075492
+- Resolves: #2075493
- Resolves: #2075494
+- Resolves: #2075495
- Resolves: #2075496
+- Resolves: #2075497
 * Thu Feb 17 2022 Michael Catanzaro <mcatanzaro@redhat.com> - 2.34.6-1
 - Update to 2.34.6
-  Related: #1985042
+  Related: #1985041
 - Resolves: #2037016
 - Resolves: #2037269
 * Wed Feb 09 2022 Michael Catanzaro <mcatanzaro@redhat.com> - 2.34.5-1
 - Update to 2.34.5
- Related: #1985042
+  Related: #1985041
 * Fri Jan 21 2022 Michael Catanzaro <mcatanzaro@redhat.com> - 2.34.4-1
 - Update to 2.34.4
- Resolves: #1985042
+  Related: #1985041
 * Wed Nov 24 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 2.34.2-1
 - Update to 2.34.2
  Related: #1985041
-* Tue Sep 28 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 2.32.4-1
+* Tue Oct 26 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 2.34.1-1
- Update to 2.32.4
+- Update to 2.34.1
- Related: #1985042
+  Related: #1985041
- Resolves: #2006429
+
 * Wed Sep 29 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 2.34.0-1
 - Update to 2.34.0
  Related: #1985041
  Resolves: #2006423
 - Enable LTO
  Resolves: #1990111
 * Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 2.32.3-2
 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
  Related: rhbz#1991688
 * Fri Jul 23 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 2.32.3-1
 - Update to 2.32.3
- Related: #1937416
+- Related: #1947884
 * Fri Jul 16 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 2.32.2-2
 - Add missing GStreamer recommends
  Resolves: #1972375
 * Tue Jul 13 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 2.32.2-1
 - Update to 2.32.2
- Related: #1937416
+  Related: #1947884
-* Mon May 10 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 2.32.1-1
+* Tue May 11 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 2.32.1-1
 - Update to 2.32.1
- Related: #1937416
+  Related: #1947884
 * Wed May 05 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 2.32.0-4
 - Fix aarch64
  Resolves: #1957265
 * Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 2.32.0-3
 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
 * Tue Mar 30 2021 Jonathan Wakely <jwakely@redhat.com> - 2.32.0-2
 - Rebuilt for removed libstdc++ symbol (#1937698)
-* Fri Apr 30 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 2.32.0-1
+* Fri Mar 26 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 2.32.0-1
 - Update to 2.32.0
- Related: #1937416
+
 * Fri Mar 12 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 2.31.91-1
 - Update to 2.31.91
 * Tue Mar 02 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 2.31.90-1
 - Update to 2.31.90
 * Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.31.1-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
 * Thu Jan 14 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 2.31.1-3
 - Fix multilib conflict in gir files
 * Wed Jan 13 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 2.31.1-2
 - Disable gamepad support in RHEL
 * Tue Jan 12 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 2.31.1-1
 - Update to 2.31.1
 * Tue Dec 15 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.30.4-1
 - Update to 2.30.4
 - Related: #1883304
-* Wed Nov 25 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.30.3-1
+* Tue Nov 24 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.30.3-1
 - Update to 2.30.3
 - Related: #1883304
-* Thu Oct 29 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.30.2-2
+* Wed Nov 11 2020 Jeff Law <law@redhat.com> - 2.30.2-2
- Try to fix coverity build by disabling docs (thanks to Kamil Dudka <kdudka@redhat.com>!)
+- Fix bogus volatile caught by gcc-11
 - Related: #1883304
 * Mon Oct 26 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.30.2-1
 - Update to 2.30.2
 - Related: #1883304
-* Tue Oct 20 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.30.1-1
+* Mon Sep 21 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.30.1-1
 - Update to 2.30.1
 - Related: #1883304
-* Mon Aug 03 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.28.4-1
+* Fri Sep 11 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.30.0-1
- Update to 2.28.4
+- Update to 2.30.0. Add patch for libwpe#59.
- Related: #1817143
+
 * Fri Sep 04 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.29.92-1
 - Update to 2.29.92
 * Mon Aug 17 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.29.91-1
 - Update to 2.29.91
 * Wed Jul 29 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.29.4-1
 - Update to 2.29.4
 * Tue Jul 14 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.29.3-2
 - Drop some Requires to Recommends
 * Wed Jul 08 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.29.3-1
 - Update to 2.29.3
 * Wed Jul 01 2020 Jeff Law <law@redhat.com> - 2.29.2-2
 - Disable LTO
-* Thu May 21 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.28.2-2
+* Wed Jun 24 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.29.2-1
- Related: rhbz#1817143 Properly remove webkit2gtk3-plugin-process-gtk2 package
+- Update to 2.29.2
-* Thu May 14 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.28.2-1
+* Mon May 18 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.29.1-1
- Resolves: rhbz#1817143 Update to 2.28.2
+- Update to 2.29.1
-* Mon Oct 14 2019 Eike Rathke <erack@redhat.com> - 2.24.4-3
+* Sat May 16 2020 Pete Walter <pwalter@fedoraproject.org> - 2.28.2-3
- Related: rhbz#1748890 Bump NVR
+- Rebuild for ICU 67
-* Fri Sep 27 2019 Eike Rathke <erack@redhat.com> - 2.24.4-1
+* Fri May 08 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.28.2-2
- Resolves: rhbz#1748890 Update to 2.24.4
+- Fix garbage collection on ppc64le and s390x after upgrade to 2.28
-* Tue Jul 09 2019 Eike Rathke <erack@redhat.com> - 2.24.3-1
+* Fri Apr 24 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.28.2-1
- Resolves: rhbz#1728277 Update to 2.24.3
+- Update to 2.28.2
-* Wed May 22 2019 Eike Rathke <erack@redhat.com> - 2.24.2-2
+* Fri Apr 17 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.28.1-4
- Related: rhbz#1696708 Use enchant instead of enchant-2 on aarch64 and s390x
+- Actually reenable WPE renderer.
-* Tue May 21 2019 Eike Rathke <erack@redhat.com> - 2.24.2-1
+* Fri Apr 17 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.28.1-3
- Resolves: rhbz#1696708 Rebase to 2.24.2
+- Fix and reenable WPE renderer. Fix popup menus in X11.
 - Resolves: rhbz#1592271 Switch to Python 3 for build
-* Tue Feb 12 2019 Eike Rathke <erack@redhat.com> - 2.22.6-1
+* Wed Apr 15 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.28.1-2
- Resolves: rhbz#1676489 Update to 2.22.6
+- Disable WPE renderer again.
-* Fri Jan 25 2019 Eike Rathke <erack@redhat.com> - 2.22.5-2
+* Mon Apr 13 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.28.1-1
- Resolves: rhbz#1666984 Fix gigacage
+- Update to 2.28.1
-* Tue Dec 18 2018 Eike Rathke <erack@redhat.com> - 2.22.5-1
+* Thu Apr 09 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.28.0-9
- Update to 2.22.5
+- Reenable WPE renderer, seems to have mysteriously fixed itself.
 - Second attempt to fix ppc64le.
-* Tue Oct 30 2018 Tomas Popela <tpopela@redhat.com> - 2.22.3-1
+* Tue Mar 24 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.28.0-8
 - Fix accelerated compositing mode with bubblewrap sandbox enabled
 - Fix JavaScriptCore on ppc64le
 * Mon Mar 16 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.28.0-7
 - Disable WPE renderer since it's busted, rhbz#1813993.
 - Use perl() syntax to denote perl dependencies.
 - Bump revision to maintain upgrade path
 * Wed Mar 11 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.28.0-3
 - BuildRequires: perl-English
 * Wed Mar 11 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.28.0-2
 - Rebuild with koji hopefully not broken this time?
 - Add perl-FindBin BuildRequires
 * Wed Mar 11 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.28.0-1
 - Update to 2.28.0
 * Thu Feb 27 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.27.91-1
 - Update to 2.27.91
 * Mon Feb 10 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.27.90-2
 - Add GPG verification during prep
 * Mon Feb 10 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 2.27.90-1
 - Update to 2.27.90
 * Mon Feb 10 2020 Eike Rathke <erack@redhat.com> - 2.27.4-3
 - Resolves: rhbz#1800249 Fix FTBFS
 * Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.27.4-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
 * Fri Jan 10 2020 Eike Rathke <erack@redhat.com> - 2.27.4-1
 - Update to 2.27.4
 * Wed Dec 04 2019 Michael Catanzaro <mcatanzaro@gnome.org> - 2.27.3-2
 - Fix minor file and directory ownership issues, rhbz#1779754 and rhbz#1779772
 * Tue Nov 26 2019 Eike Rathke <erack@redhat.com> - 2.27.3-1
 - Resolves: rhbz#1776825 Update to 2.27.3
 * Sat Nov 02 2019 Pete Walter <pwalter@fedoraproject.org> - 2.27.2-2
 - Rebuild for ICU 65
 * Tue Oct 22 2019 Eike Rathke <erack@redhat.com> - 2.27.2-1
 - Resolves: rhbz#1764135 Update to 2.27.2
 * Fri Oct 04 2019 Eike Rathke <erack@redhat.com> - 2.27.1-1
 - Resolves: rhbz#1758590 Update to 2.27.1
 * Thu Sep 26 2019 Eike Rathke <erack@redhat.com> - 2.26.1-1
 - Resolves: rhbz#1754472 Update to 2.26.1
 * Thu Sep 19 2019 Michael Catanzaro <mcatanzaro@gnome.org> - 2.26.0-3
 - Enable WPE renderer, resolves rhbz#1753730
 * Tue Sep 17 2019 Tomas Popela <tpopela@redhat.com> - 2.26.0-2
 - Backport fix for a crash when closing the view and HW acceleration is enabled
 - Resolves: rhbz#1750345
 - Backport fix for EGL_BAD_ALLOC
 - Resolves: rhbz#1751936
 * Mon Sep 09 2019 Kalev Lember <klember@redhat.com> - 2.26.0-1
 - Update to 2.26.0
 * Wed Sep 04 2019 Michael Catanzaro <mcatanzaro@gnome.org> - 2.25.92-2
 - Add patch to fix startup in X11 when not using gdm
 * Tue Sep 03 2019 Eike Rathke <erack@redhat.com> - 2.25.92-1
 - Resolves: rhbz#1748305 Update to 2.25.92
 * Fri Aug 02 2019 Eike Rathke <erack@redhat.com> - 2.25.4-1
 - Update to 2.25.4
 * Fri Jul 26 2019 Tomas Popela <tpopela@redhat.com> - 2.25.3-2
 - Follow-up fixes for the GTK2 plugins support removal
 - Fixes: rhbz#1733436
 * Tue Jul 23 2019 Eike Rathke <erack@redhat.com> - 2.25.3-1
 - Update to 2.25.3
 - This removes support for GTK 2 based NPAPI plugins (such as Adobe Flash)
 * Wed Jul 17 2019 Adam Williamson <awilliam@redhat.com> - 2.25.2-2
 - Backport fix for crasher that affects Evolution (bwo#199621)
 * Mon Jun 24 2019 Eike Rathke <erack@redhat.com> - 2.25.2-1
 - Update to 2.25.2
 * Thu Jun 06 2019 Eike Rathke <erack@redhat.com> - 2.25.1-1
 - Update to 2.25.1
 * Fri May 17 2019 Eike Rathke <erack@redhat.com> - 2.24.2-1
 - Update to 2.24.2
 * Tue Apr 09 2019 Eike Rathke <erack@redhat.com> - 2.24.1-1
 - Update to 2.24.1
 * Wed Mar 13 2019 Tomas Popela <tpopela@redhat.com> - 2.24.0-1
 - Update to 2.24.0
 * Fri Mar 08 2019 Tomas Popela <tpopela@redhat.com> - 2.23.92-1
 - Update to 2.23.92
 - Switch to python3
 * Wed Feb 20 2019 Eike Rathke <erack@redhat.com> - 2.23.91-1
 - Update to 2.23.91
 * Mon Feb 18 2019 Eike Rathke <erack@redhat.com> - 2.23.90-1
 - Update to 2.23.90
 * Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.23.3-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
 * Thu Jan 24 2019 Pete Walter <pwalter@fedoraproject.org> - 2.23.3-2
 - Rebuild for ICU 63
 * Mon Jan 14 2019 Eike Rathke <erack@redhat.com> - 2.23.3-1
 - Update to 2.23.3
 * Tue Nov 27 2018 Eike Rathke <erack@redhat.com> - 2.23.1-1
 - Update to 2.23.1
 * Thu Nov 22 2018 Tomáš Popela <tpopela@redhat.com> - 2.22.4-1
 - Update to 2.22.4
 * Thu Nov 01 2018 Tomas Popela <tpopela@redhat.com> - 2.22.3-2
 - Switch to using pkgconfig build requires
 - Switch to enchant-2
 - Resolves: rhbz#1631486
 * Mon Oct 29 2018 Tomas Popela <tpopela@redhat.com> - 2.22.3-1
 - Update to 2.22.3
 - Resolves: rhbz#1641009
-* Mon Sep 24 2018 Tomas Popela <tpopela@redhat.com> - 2.22.2-1
+* Fri Oct 19 2018 Tomas Popela <tpopela@redhat.com> - 2.22.2-3
 - Fix WebProcess crash while printing
 - Resolves: rhbz#1639754
 * Tue Sep 25 2018 Tomas Popela <tpopela@redhat.com> - 2.22.2-2
 - Switch to Ninja:
  -7 minutes on the x86_64
  -11 minutes on ppc64le
  -13 minutes on i686
  -13 minutes on s390x
  -10 minutes on armv7hl
  -19 minutes on aarch64
 * Sun Sep 23 2018 Tomas Popela <tpopela@redhat.com> - 2.22.2-1
 - Update to 2.22.2
 - Resolves: rhbz#1625602
 * Thu Sep 20 2018 Tomas Popela <tpopela@redhat.com> - 2.22.1-1
 - Update to 2.22.1
 - Resolves: rhbz#1625602
-* Tue Sep 11 2018 Tomas Popela <tpopela@redhat.com> - 2.22.0-2
+* Fri Sep 07 2018 Kalev Lember <klember@redhat.com> - 2.22.0-3
- Backport patches from RHEL 7
+- Rebuilt against fixed atk (#1626575)
- Resolves: rhbz#1625602
+
 * Fri Sep 07 2018 Kalev Lember <klember@redhat.com> - 2.22.0-2
 - Rebuilt for GNOME 3.30.0 megaupdate
-* Wed Sep 05 2018 Tomas Popela <tpopela@redhat.com> - 2.22.0-1
+* Mon Sep 03 2018 Tomas Popela <tpopela@redhat.com> - 2.22.0-1
 - Update to 2.22.0
 - Resolves: rhbz#1625602
-* Tue Jul 17 2018 Tomas Popela <tpopela@redhat.com> - 2.20.3-3
+* Thu Aug 30 2018 Tomas Popela <tpopela@redhat.com> - 2.21.92-2
- Update the python2 patch
+- Update the JSC build fix patch
 * Wed Aug 29 2018 Tomas Popela <tpopela@redhat.com> - 2.21.92-1
 - Update to 2.21.92
 * Thu Aug 16 2018 Tomas Popela <tpopela@redhat.com> - 2.21.91-1
 - Update to 2.21.91
 * Fri Jul 20 2018 Tomas Popela <tpopela@redhat.com> - 2.21.5-1
 - Update to 2.21.5
 * Mon Jul 16 2018 Tomas Popela <tpopela@redhat.com> - 2.21.4-4
 - Fix the broken build due to python2 changes
 * Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.21.4-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 * Tue Jul 10 2018 Pete Walter <pwalter@fedoraproject.org> - 2.21.4-2
 - Rebuild for ICU 62
-* Mon Jun 18 2018 Tomas Popela <tpopela@redhat.com> - 2.20.3-3
+* Tue Jun 12 2018 Tomas Popela <tpopela@redhat.com> - 2.21.4-1
- Export the python2 env variable
+- Update to 2.21.4
 - Resolves: rhbz#1592264
-* Mon Jun 11 2018 Tomas Popela <tpopela@redhat.com> - 2.20.3-1
+* Mon May 28 2018 Tomas Popela <tpopela@redhat.com> - 2.21.3-1
- Update to 2.20.3
+- Update to 2.21.3
-* Thu May 24 2018 Tomas Popela <tpopela@redhat.com> - 2.20.2-4
+* Thu May 24 2018 Tomas Popela <tpopela@redhat.com> - 2.21.2-2
 - Explicitly specify python2 over python and add python2 to BR
-* Tue May 22 2018 Tomas Popela <tpopela@redhat.com> - 2.20.2-3
+* Mon May 21 2018 Tomas Popela <tpopela@redhat.com> - 2.21.2-1
- aarch64 on RHEL 8 does have a 64kb page size
+- Update to 2.21.2
 - Resolves: rhbz#1578576
-* Tue May 22 2018 Tomas Popela <tpopela@redhat.com> - 2.20.2-2
+* Mon Apr 30 2018 Pete Walter <pwalter@fedoraproject.org> - 2.21.1-2
- Temporary disable JIT and BMalloc on aarch64 due to Gigacage problems
+- Rebuild for ICU 61.1
 - Resolves: rhbz#1578576
-* Tue May 15 2018 Tomas Popela <tpopela@redhat.com> - 2.20.2-1
+* Wed Apr 18 2018 Tomas Popela <tpopela@redhat.com> - 2.21.1-1
- Update to 2.20.2
+- Update to 2.21.1
 - Resolves: rhbz#1577388
 * Tue Apr 10 2018 Tomas Popela <tpopela@redhat.com> - 2.20.1-1
 - Update to 2.20.1
`@ -1,2 +1,2 @@`
	`SOURCES/webkitgtk-2.42.5.tar.xz`	`SOURCES/webkitgtk-2.46.3.tar.xz`
	`SOURCES/webkitgtk-keys.gpg`	`SOURCES/webkitgtk-keys.gpg`
`@ -1,2 +1,2 @@`
	`c3ffb2beaac56f1089029f2254482f48d9e3db37 SOURCES/webkitgtk-2.42.5.tar.xz`	`110e2c2ac964f207a8f2fecf6e2e61f0ed4bee00 SOURCES/webkitgtk-2.46.3.tar.xz`
	`cf57cbbadf2a07c6ede1c886f9742b7d352460c0 SOURCES/webkitgtk-keys.gpg`	`04b10b8a486542c4551269c20b18b5c1c6cb4f94 SOURCES/webkitgtk-keys.gpg`