mirror of
https://github.com/nodejs/node.git
synced 2026-10-28 10:15:07 +08:00
build: require OpenSSL 3 or later
configure now fails when --shared-openssl points at OpenSSL 1.x rather than failing later at compile or link time. The check skips BoringSSL, whose version macros claim 1.1.1. Stop setting the OpenSSL 1.1 API compatibility level for bundled builds. ncrypto selects the supported API level directly. Update the assembler capability check, shared-library test matrix, package fallbacks, and internal version-number typing for the new baseline. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: https://github.com/nodejs/node/pull/64777 Fixes: https://github.com/nodejs/node/issues/56733 Refs: https://github.com/nodejs/node/pull/64211 Refs: https://github.com/nodejs/node/pull/63966 Refs: https://github.com/nodejs/node/pull/53329 Refs: https://github.com/nodejs/node/pull/48950 Refs: https://github.com/nodejs/node/issues/45465 Refs: https://github.com/nodejs/node/issues/42827 Refs: https://github.com/nodejs/node/issues/47076 Refs: https://github.com/nodejs/node/pull/62862 Refs: https://github.com/nodejs/node/pull/38512 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
This commit is contained in:
7 files changed
+25
-18
No files matched your search
@@ -260,8 +260,8 @@ jobs:
|
||||
# the matrix-selected nixpkgs attribute (e.g. `openssl_3_6`). All
|
||||
# other shared libs (brotli, cares, libuv, …) keep their defaults.
|
||||
# `permittedInsecurePackages` whitelists just the matrix-selected
|
||||
# release (e.g. `openssl-1.1.1w`) so EOL-with-extended-support
|
||||
# cycles evaluate without relaxing nixpkgs' meta check globally.
|
||||
# release so EOL-with-extended-support cycles evaluate without relaxing
|
||||
# nixpkgs' meta check globally.
|
||||
extra-nix-flags: |
|
||||
--arg useSeparateDerivationForV8 ${{ needs.build-aarch64-linux-v8.outputs.local-cache && '"$(nix-store --import < libv8-aarch64-linux.nar)"' || 'true' }} \
|
||||
--arg sharedLibDeps "(import $TAR_DIR/tools/nix/sharedLibDeps.nix {}) // {
|
||||
|
||||
+6
-4
@@ -205,7 +205,7 @@ on your Linux distribution.
|
||||
|
||||
#### OpenSSL asm support
|
||||
|
||||
OpenSSL-1.1.1 requires the following assembler version for use of asm
|
||||
OpenSSL requires the following assembler version for use of asm
|
||||
support on x86\_64 and ia32.
|
||||
|
||||
For use of AVX-512,
|
||||
@@ -213,8 +213,6 @@ For use of AVX-512,
|
||||
* gas (GNU assembler) version 2.26 or higher
|
||||
* nasm version 2.11.8 or higher in Windows
|
||||
|
||||
AVX-512 is disabled for Skylake-X by OpenSSL-1.1.1.
|
||||
|
||||
For use of AVX2,
|
||||
|
||||
* gas (GNU assembler) version 2.23 or higher
|
||||
@@ -222,7 +220,7 @@ For use of AVX2,
|
||||
* llvm version 3.3 or higher
|
||||
* nasm version 2.10 or higher in Windows
|
||||
|
||||
Please refer to <https://docs.openssl.org/1.1.1/man3/OPENSSL_ia32cap/> for details.
|
||||
Please refer to <https://docs.openssl.org/master/man3/OPENSSL_ia32cap/> for details.
|
||||
|
||||
If compiling without one of the above, use `configure` with the
|
||||
`--openssl-no-asm` flag. Otherwise, `configure` will fail.
|
||||
@@ -1119,6 +1117,10 @@ A number of `configure` options are provided to support this use case.
|
||||
provide the ability to set the path to an external JavaScript file
|
||||
for the dependency to be used at runtime.
|
||||
|
||||
When building with `--shared-openssl`, Node.js requires OpenSSL 3.0 or later.
|
||||
Support for building against OpenSSL 1.x was removed in Node.js 27.0.0, and
|
||||
`configure` fails if an older version is detected.
|
||||
|
||||
It is the responsibility of any distribution
|
||||
shipping with these options to:
|
||||
|
||||
|
||||
+15
-6
@@ -1398,8 +1398,9 @@ def try_check_compiler(cc, lang):
|
||||
#
|
||||
# The version of asm compiler is needed for building openssl asm files.
|
||||
# See deps/openssl/openssl.gypi for detail.
|
||||
# Commands and regular expressions to obtain its version number are taken from
|
||||
# https://github.com/openssl/openssl/blob/OpenSSL_1_0_2-stable/crypto/sha/asm/sha512-x86_64.pl#L112-L129
|
||||
# Commands and regular expressions to obtain its version number mirror the
|
||||
# bundled OpenSSL assembler scripts, including
|
||||
# deps/openssl/openssl/crypto/sha/asm/sha512-x86_64.pl.
|
||||
#
|
||||
def get_version_helper(cc, regexp):
|
||||
try:
|
||||
@@ -2334,15 +2335,15 @@ def configure_openssl(o):
|
||||
if not options.shared_openssl and not options.openssl_no_asm:
|
||||
is_x86 = 'x64' in variables['target_arch'] or 'ia32' in variables['target_arch']
|
||||
|
||||
# supported asm compiler for AVX2. See https://github.com/openssl/openssl/
|
||||
# blob/OpenSSL_1_1_0-stable/crypto/modes/asm/aesni-gcm-x86_64.pl#L52-L69
|
||||
openssl110_asm_supported = \
|
||||
# Check for an assembler that supports the instructions used by OpenSSL.
|
||||
# See deps/openssl/openssl/INSTALL.md for its toolchain requirements.
|
||||
openssl_asm_supported = \
|
||||
('gas_version' in variables and Version(variables['gas_version']) >= Version('2.23')) or \
|
||||
('xcode_version' in variables and Version(variables['xcode_version']) >= Version('5.0')) or \
|
||||
('llvm_version' in variables and Version(variables['llvm_version']) >= Version('3.3')) or \
|
||||
('nasm_version' in variables and Version(variables['nasm_version']) >= Version('2.10'))
|
||||
|
||||
if is_x86 and not openssl110_asm_supported:
|
||||
if is_x86 and not openssl_asm_supported:
|
||||
error('''Did not find a new enough assembler, install one or build with
|
||||
--openssl-no-asm.
|
||||
Please refer to BUILDING.md''')
|
||||
@@ -2366,6 +2367,14 @@ def configure_openssl(o):
|
||||
o['variables']['openssl_version'] = get_openssl_version(o)
|
||||
o['variables']['openssl_is_boringssl'] = get_openssl_is_boringssl(o)
|
||||
|
||||
# BoringSSL identifies itself as OpenSSL 1.1.1 and is exempt from this check.
|
||||
# A version of 0 means detection failed, which is already warned about in
|
||||
# get_openssl_version() and is caught at compile time by ncrypto.h.
|
||||
openssl_version = o['variables']['openssl_version']
|
||||
if o['variables']['openssl_is_boringssl'] == 'false' and \
|
||||
0 < openssl_version < 0x30000000:
|
||||
error('OpenSSL 1.x is no longer supported, v3.0.0 or later is required.')
|
||||
|
||||
def configure_lief(o):
|
||||
if options.without_lief:
|
||||
if options.shared_lief:
|
||||
|
||||
@@ -408,7 +408,6 @@
|
||||
'defines': [ 'HAVE_OPENSSL=1' ],
|
||||
'conditions': [
|
||||
[ 'node_shared_openssl=="false"', {
|
||||
'defines': [ 'OPENSSL_API_COMPAT=0x10100000L', ],
|
||||
'dependencies': [
|
||||
'./deps/openssl/openssl.gyp:openssl',
|
||||
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
{
|
||||
pkgs ? import ./pkgs.nix {
|
||||
config.permittedInsecurePackages = [
|
||||
"openssl-1.1.1w"
|
||||
"openssl-3.0.22"
|
||||
];
|
||||
},
|
||||
@@ -14,7 +13,6 @@
|
||||
# Other OpenSSL variants we want to test for:
|
||||
inherit (pkgs)
|
||||
boringssl
|
||||
openssl_1_1
|
||||
openssl_3
|
||||
openssl_3_6
|
||||
openssl_4_0
|
||||
|
||||
+1
-2
@@ -15,9 +15,8 @@ if builtins.currentSystem == "x86_64-darwin" then
|
||||
else
|
||||
nixpkgs
|
||||
// {
|
||||
# OpenSSL 1.1.x and 3.0.x were removed from unstable, we want to keep testing with it
|
||||
# OpenSSL 3.0.x was removed from unstable, but we want to keep testing it.
|
||||
inherit (import ./pkgs-26.05.nix arg)
|
||||
openssl_1_1
|
||||
openssl_3
|
||||
;
|
||||
|
||||
|
||||
+1
-1
@@ -193,7 +193,7 @@ export interface ConstantsBinding {
|
||||
COPYFILE_FICLONE_FORCE: 4;
|
||||
};
|
||||
crypto: {
|
||||
OPENSSL_VERSION_NUMBER: 269488319;
|
||||
OPENSSL_VERSION_NUMBER: number;
|
||||
SSL_OP_ALL: 2147485780;
|
||||
SSL_OP_ALLOW_NO_DHE_KEX: 1024;
|
||||
SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION: 262144;
|
||||
|
||||
Reference in new issue
Block a user