From bc404033bbcf5876f9528300ead8d16fa3961558 Mon Sep 17 00:00:00 2001
From: Khem Raj <khem.raj@oss.qualcomm.com>
Date: Wed, 24 Jun 2026 09:58:19 -0700
Subject: [PATCH] networkmanager-openconnect: only require webkit2gtk for the
 auth dialog

The webkit2gtk pkg-config check was unconditional, but WEBKIT is only
used by the GNOME auth dialog. Move it under the with-gnome guard

add webkitgtk3 to the gnome PACKAGECONFIG deps

ship the D-Bus system policy file.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
---
 ...quire-webkit2gtk-when-building-the-a.patch | 54 +++++++++++++++++++
 .../networkmanager-openconnect_1.2.10.bb      |  7 ++-
 2 files changed, 59 insertions(+), 2 deletions(-)
 create mode 100644 meta-networking/recipes-connectivity/networkmanager/networkmanager-openconnect/0001-configure-only-require-webkit2gtk-when-building-the-a.patch

diff --git a/meta-networking/recipes-connectivity/networkmanager/networkmanager-openconnect/0001-configure-only-require-webkit2gtk-when-building-the-a.patch b/meta-networking/recipes-connectivity/networkmanager/networkmanager-openconnect/0001-configure-only-require-webkit2gtk-when-building-the-a.patch
new file mode 100644
index 0000000000..ba4752dd4b
--- /dev/null
+++ b/meta-networking/recipes-connectivity/networkmanager/networkmanager-openconnect/0001-configure-only-require-webkit2gtk-when-building-the-a.patch
@@ -0,0 +1,54 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Mon, 23 Jun 2026 00:00:00 +0000
+Subject: [PATCH] configure: only require webkit2gtk when building the auth
+ dialog
+
+The webkit2gtk pkg-config module (webkit2gtk-4.1 / -4.0) is only ever used
+by the GNOME authentication dialog (auth-dialog/nm-openconnect-auth-dialog),
+which is built only when WITH_GNOME && WITH_AUTHDLG. However configure.ac
+runs PKG_CHECK_MODULES(WEBKIT, ...) unconditionally, so a VPN-service-only
+build configured with --without-gnome (and hence without the auth dialog)
+still hard-fails with:
+
+    configure: error: Neither webkit2gtk-4.0 nor webkit2gtk-4.1 found
+
+Move the WEBKIT check inside the "with_authdlg" block (next to the
+OPENCONNECT check which is already guarded the same way) so that webkit2gtk
+is only required when the auth dialog is actually being built.
+
+Upstream-Status: Pending
+
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ configure.ac | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 1111111..2222222 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -145,10 +145,6 @@ if test x"$with_gtk4" != xno; then
+ 	PKG_CHECK_MODULES(LIBNMA_GTK4, libnma-gtk4 >= 1.8.33)
+ fi
+
+-PKG_CHECK_MODULES(WEBKIT, webkit2gtk-4.1, [wekbit=4.1],
+-			  [PKG_CHECK_MODULES(WEBKIT, webkit2gtk-4.0,
+-			  [webkit=4.0], AC_MSG_ERROR(Neither webkit2gtk-4.0 nor wekit2gtk-4.1 found))])
+-
+ PKG_CHECK_MODULES(LIBNM, libnm >= 1.2.0)
+ LIBNM_CFLAGS="$LIBNM_CFLAGS -DNM_VERSION_MIN_REQUIRED=NM_VERSION_1_2"
+ LIBNM_CFLAGS="$LIBNM_CFLAGS -DNM_VERSION_MAX_ALLOWED=NM_VERSION_1_4"
+@@ -165,6 +161,10 @@ else
+ fi
+ if test x"$with_authdlg" != xno; then
+ 	PKG_CHECK_MODULES(OPENCONNECT, openconnect >= 3.02)
++	PKG_CHECK_MODULES(WEBKIT, webkit2gtk-4.1, [webkit=4.1],
++			  [PKG_CHECK_MODULES(WEBKIT, webkit2gtk-4.0,
++			  [webkit=4.0],
++			  AC_MSG_ERROR(Neither webkit2gtk-4.0 nor webkit2gtk-4.1 found))])
+ fi
+ AM_CONDITIONAL(WITH_AUTHDLG, test x"$with_authdlg" != xno)
+
+--
+2.43.0
diff --git a/meta-networking/recipes-connectivity/networkmanager/networkmanager-openconnect_1.2.10.bb b/meta-networking/recipes-connectivity/networkmanager/networkmanager-openconnect_1.2.10.bb
index c3f9b9f806..b5bf715d38 100644
--- a/meta-networking/recipes-connectivity/networkmanager/networkmanager-openconnect_1.2.10.bb
+++ b/meta-networking/recipes-connectivity/networkmanager/networkmanager-openconnect_1.2.10.bb
@@ -9,14 +9,16 @@ DEPENDS = "glib-2.0-native intltool-native libxml2 networkmanager openconnect"
 GNOMEBASEBUILDCLASS = "autotools"
 inherit gnomebase useradd
 
-SRC_URI = "${GNOME_MIRROR}/NetworkManager-openconnect/${@gnome_verdir("${PV}")}/NetworkManager-openconnect-${PV}.tar.xz"
+SRC_URI = "${GNOME_MIRROR}/NetworkManager-openconnect/${@gnome_verdir("${PV}")}/NetworkManager-openconnect-${PV}.tar.xz \
+           file://0001-configure-only-require-webkit2gtk-when-building-the-a.patch \
+"
 
 SRC_URI[sha256sum] = "844b6bf64ecadb97b4a68c776db89aa5e6ee7e59bd24b0180228406863136464"
 
 S = "${UNPACKDIR}/NetworkManager-openconnect-${PV}"
 
 # meta-gnome in layers is required using gnome:
-PACKAGECONFIG[gnome] = "--with-gnome,--without-gnome,gtk+3 gcr3 libnma libsecret,"
+PACKAGECONFIG[gnome] = "--with-gnome,--without-gnome,gtk+3 gcr3 libnma libsecret webkitgtk3,"
 PACKAGECONFIG[gtk4] = "--with-gtk4,--without-gtk4,gtk4,"
 
 do_configure:append() {
@@ -35,6 +37,7 @@ USERADD_PARAM:${PN} = "--system nm-openconnect"
 FILES:${PN} += " \
     ${libdir}/NetworkManager/*.so \
     ${nonarch_libdir}/NetworkManager/VPN/nm-openconnect-service.name \
+    ${datadir}/dbus-1/system.d \
 "
 
 FILES:${PN}-staticdev += " \