Ludovic Courtès ludo@gnu.org writes:

Are there plans to make a new 3.5 release including these fixes?

No, I don't plan any 3.5.x release.

Alternatively, could you provide guidance as to which commits should be cherry-picked in 3.5 for downstream distros?

Look at the branch release-3.7-fixes (https://git.lysator.liu.se/nettle/nettle/-/commits/release-3.7-fixes/). The commits since 3.7.1 are the ones you need.

Changes to gostdsa and ed448 will not apply, since those curves didn't exist in nettle-3.5. Changes to ed25519 might not apply cleanly, due to refactoring when adding ed448.

I’m asking because in Guix, the easiest way for us to deploy the fixes on the ‘master’ branch would be by “grafting” a new Nettle variant ABI-compatible with 3.5.1, which is the one packages currently depend on.

I still recommend upgrading to the latest version. There were an abi break in 3.6 (so you'd need to recompile lots of guix packages), but no incompatible changes to the (source level) api.

Regards, /Niels