GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — deps: update openssl to quictls/openssl 3.0.0+quic by danbev · Pull Request #38512 · nodejs/node

Conversation

@danbev

@danbev danbev commented May 3, 2021 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

This pull request updates the OpenSSL version that is statically linked with Node.js from OpenSSl 1.1.1 to quictls OpenSSL 3.0.0+quic.

This pull request will replace the OpenSSL version that is currently in the deps directory and when performing a normal build OpenSSL 3.0+quic will be statically linked to the Node.js executable. We will still be able to dynamically link to OpenSSL 1.1.1 and we have a CI job which dynamically links to OpenSSL 1.1.1 which is run for every pull request to make sure that we maintain backward compatibility.

The question is when does the community think that we should make this switch to OpenSSL 3.0+quic?


Building

$ ./configure && make -j8 test
...
[03:59|% 100|+ 3363|-   0]: Done

Verify that OpenSSL is statically linked

$ ldd ./node
	linux-vdso.so.1 (0x00007ffff7fcf000)
	libdl.so.2 => /usr/lib64/libdl.so.2 (0x00007ffff7f9d000)
	libstdc++.so.6 => /usr/lib64/libstdc++.so.6 (0x00007ffff7da4000)
	libm.so.6 => /usr/lib64/libm.so.6 (0x00007ffff7c5e000)
	libgcc_s.so.1 => /usr/lib64/libgcc_s.so.1 (0x00007ffff7c44000)
	libpthread.so.0 => /usr/lib64/libpthread.so.0 (0x00007ffff7c22000)
	libc.so.6 => /usr/lib64/libc.so.6 (0x00007ffff7a59000)
	/lib64/ld-linux-x86-64.so.2 (0x00007ffff7fd1000)
$ ./node -p 'process.versions.openssl'
3.0.0+quic

Building with FIPS support

$ ./configure --openssl-is-fips && make -j8 test
...
[04:06|% 100|+ 3384|-   0]: Done

The above command will build and install the FIPS module into the out directory.
This includes building fips.so, running the installfips command that generates the FIPS configuration file (fipsmodule.cnf), copying and updating openssl.cnf to include the correct path to fipsmodule.cnf and finally uncomment the fips section.

We can then run node specifying --enable-fips:

$ ./node --enable-fips  -p 'crypto.getFips()'
1

The above will use the Node's default locations for OpenSSL 3.0:

$ ./out/Release/openssl-cli version -m -d
OPENSSLDIR: "/home/danielbevenius/work/nodejs/openssl/out/Release/obj.target/deps/openssl"
MODULESDIR: "/home/danielbevenius/work/nodejs/openssl/out/Release/obj.target/deps/openssl/lib/openssl-modules"

Hopefully having these defaults will enable for CI jobs to be configured without too much trouble, and also enable developers to configure FIPS for development/testing.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

lin7sh, MomenNano, shrujalshah28, nicolashenry, tsugabloom, and bricss reacted with thumbs up emoji jasnell, bl-ue, lin7sh, MomenNano, and bricss reacted with hooray emoji janbrasna reacted with heart emoji
All reactions
  • 👍 6 reactions
  • 🎉 5 reactions
  • ❤️ 1 reaction
@github-actions github-actions Bot added build Issues and PRs related to Node.js builds or CI infrastructure. meta Issues and PRs related to the general management of the project. needs-ci PRs that need a full CI run. openssl Issues and PRs related to the OpenSSL dependency. labels May 3, 2021
@danbev danbev added dont-land-on-v12.x quic Issues and PRs related to the QUIC transport implementation. labels May 3, 2021
@danbev
danbev force-pushed the openssl-3.0-statically-linked branch from bcc569a to 2b5ef85 Compare May 3, 2021 16:30
@nodejs-github-bot

nodejs-github-bot commented May 4, 2021

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/37906/

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@danbev
danbev force-pushed the openssl-3.0-statically-linked branch from 2b5ef85 to eaf8adc Compare May 26, 2021 10:49
@danbev danbev changed the title deps: update openssl to quictls/openssl 3.0.0-alpha15+quic (wip) deps: update openssl to quictls/openssl 3.0.0-alpha17+quic (wip) May 26, 2021
@nodejs-github-bot

nodejs-github-bot commented May 27, 2021

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/38352/

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@danbev
danbev force-pushed the openssl-3.0-statically-linked branch from 04ac9e1 to d6fb5d7 Compare May 31, 2021 06:50
@nodejs-github-bot

nodejs-github-bot commented May 31, 2021

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/38389/

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@danbev
danbev force-pushed the openssl-3.0-statically-linked branch from d6fb5d7 to d677da6 Compare May 31, 2021 11:34
@nodejs-github-bot

nodejs-github-bot commented May 31, 2021

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/38390/

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@nodejs-github-bot

nodejs-github-bot commented Jun 1, 2021

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/38412/

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@danbev
danbev force-pushed the openssl-3.0-statically-linked branch from d677da6 to 955920c Compare June 1, 2021 05:57
@nodejs-github-bot

nodejs-github-bot commented Jun 3, 2021

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/38475/

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@targos targos removed the dont-land-on-v15.x label Jun 5, 2021
danbev added a commit to danbev/openssl that referenced this pull request Jun 7, 2021
@danbev
Add aix64-gcc-as architecture and p2align callback
be9d939
This commit adds an architecture named aix64-gcc-as which can generate
assembler source code compatible with AIX assembler (as) instead of the
GNU Assembler (gas). This architecture name is then used in a callback
for the .p2align directive which is not available in AIX as.

The motivation for this addition came out of an issue we ran into when
working on upgrading OpenSSL in Node.js. We ran into the following
compilation error on one of the CI machines that uses AIX:

  05:39:05 Assembler:
  05:39:05 crypto/bn/ppc64-mont-fixed.s: line 4: Error In Syntax

This machine is using AIX Version 7.2 and does not have gas installed
and the .p2align directive is causing this error. After asking around if
it would be possible to install GAS on this machine I learned that AIX
GNU utils are not maintained as well as the native AIX ones and we
(Red Hat/IBM) have run into issues with the GNU utils in the past and if
possible it would be preferable to be able to use the AIX native
assembler.

Refs: nodejs/node#38512
@danbev danbev mentioned this pull request Jun 7, 2021
Add aix64-gcc-as architecture and p2align callback openssl/openssl#15638
Closed
openssl-machine pushed a commit to openssl/openssl that referenced this pull request Jun 8, 2021
@danbev @paulidale
Add aix64-gcc-as architecture and p2align callback
178fa72
This commit adds an architecture named aix64-gcc-as which can generate
assembler source code compatible with AIX assembler (as) instead of the
GNU Assembler (gas). This architecture name is then used in a callback
for the .p2align directive which is not available in AIX as.

The motivation for this addition came out of an issue we ran into when
working on upgrading OpenSSL in Node.js. We ran into the following
compilation error on one of the CI machines that uses AIX:

  05:39:05 Assembler:
  05:39:05 crypto/bn/ppc64-mont-fixed.s: line 4: Error In Syntax

This machine is using AIX Version 7.2 and does not have gas installed
and the .p2align directive is causing this error. After asking around if
it would be possible to install GAS on this machine I learned that AIX
GNU utils are not maintained as well as the native AIX ones and we
(Red Hat/IBM) have run into issues with the GNU utils in the past and if
possible it would be preferable to be able to use the AIX native
assembler.

Refs: nodejs/node#38512

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from #15638)
@nodejs-github-bot

nodejs-github-bot commented Jun 8, 2021

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/38529/

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@danbev

danbev commented Jun 8, 2021

Copy link
Copy Markdown
Contributor Author

Just a note that node-test-linux-linked-openssl300 is expected to fail until it has our CI has been upgraded to alpha17 or later.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@danbev
danbev force-pushed the openssl-3.0-statically-linked branch 2 times, most recently from c75fdea to a8ff58a Compare June 17, 2021 05:06
@danbev
danbev force-pushed the openssl-3.0-statically-linked branch from ba291ca to a991d15 Compare June 23, 2021 10:15
@danbev danbev changed the title deps: update openssl to quictls/openssl 3.0.0-alpha17+quic (wip) deps: update openssl to quictls/openssl 3.0.0-beta1+quic (wip) Jun 23, 2021
danbev added 6 commits October 10, 2021 15:46
@danbev
src,tools: include new quic.h header
4790e49
This commit updates the node_metadata.{cc,h} to include openssl/quic.h
which was recently added in quictls/openssl. Previously this was part of
the generated openssl/crypto.h but has been moved out in
Commit 5517e642fc2a531666c909aae0180e9d258d539e ("QUIC: Don't muck with
FIPS checksums")
@danbev
deps: upgrade openssl sources to quictls/openssl-3.0.0+quic
8022a2e
This updates all sources in deps/openssl/openssl by:
    $ git clone [email protected]:quictls/openssl.git
    $ cd node/deps/openssl
    $ rm -rf openssl
    $ cp -R ../openssl openssl
    $ rm -rf openssl/.git* openssl/.travis*
    $ git add --all openssl
    $ git commit openssl
@danbev
deps: update archs files for quictls/openssl-3.0.0+quic
e2f2a93
After an OpenSSL source update, all the config files need to be
regenerated and committed by:
    $ make -C deps/openssl/config
    $ git add deps/openssl/config/archs
    $ git add deps/openssl/openssl
    $ git commit
@danbev
deps: regenerate linux64-riscv64 arch files
4297b2a
This commit updates the linux64-riscv64 arch files by running make
linux64-riscv64 followed by a make generate_headers so that these files
are generated for OpenSSL 3.0.
@danbev
squash! doc: update BUILDING.md with static FIPS section
c7795e9
@danbev
squash! tools,build: add PRODUCT_DIR_ABS default gyp var
07ded8b
Remove semicolon.
@danbev
danbev force-pushed the openssl-3.0-statically-linked branch from 1107e17 to 07ded8b Compare October 10, 2021 13:47
@nodejs-github-bot

nodejs-github-bot commented Oct 10, 2021

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/40249/

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@nodejs-github-bot

nodejs-github-bot commented Oct 10, 2021

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/40251/

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@github-actions github-actions Bot mentioned this pull request Oct 11, 2021
CI Reliability 2021-10-11 nodejs/reliability#84
Open
19 tasks
@danbev

danbev commented Oct 11, 2021

Copy link
Copy Markdown
Contributor Author

Re-run of failing node-test-commit-arm-fanned ✔️

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

danbev added a commit that referenced this pull request Oct 11, 2021
@danbev
deps,test,src,doc,tools: update to OpenSSL 3.0
66da32c
This pull request updates the OpenSSL version that is statically
linked with Node.js from OpenSSl 1.1.1 to quictls OpenSSL 3.0.0+quic.

This pull request will replace the OpenSSL version that is currently
in the deps directory and when performing a normal build
OpenSSL 3.0+quic will be statically linked to the Node.js executable.
We will still be able to dynamically link to OpenSSL 1.1.1 and we have
a CI job which dynamically links to OpenSSL 1.1.1 which is run for
every pull request to make sure that we maintain backward compatibility.

PR-URL: #38512
Reviewed-By: Michael Dawson <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>
@danbev

danbev commented Oct 11, 2021

Copy link
Copy Markdown
Contributor Author

Landed in 66da32c.

lin7sh reacted with thumbs up emoji lin7sh reacted with hooray emoji lin7sh reacted with rocket emoji
All reactions
  • 👍 1 reaction
  • 🎉 1 reaction
  • 🚀 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@danbev danbev closed this Oct 11, 2021
This was referenced Oct 13, 2021
CI Reliability 2021-10-13 nodejs/reliability#85
Open
CI Reliability 2021-10-14 nodejs/reliability#86
Open
@BethGriggs BethGriggs mentioned this pull request Oct 14, 2021
2021-10-19, Version 17.0.0 (Current) #40119
Merged
2 tasks done
This was referenced Oct 15, 2021
CI Reliability 2021-10-15 nodejs/reliability#87
Open
CI Reliability 2021-10-16 nodejs/reliability#88
Open
CI Reliability 2021-10-17 nodejs/reliability#89
Open
CI Reliability 2021-10-18 nodejs/reliability#90
Open
@tniessen tniessen mentioned this pull request Oct 26, 2021
crypto: add support for SM2 #37066
Closed
@tuzi3040 tuzi3040 mentioned this pull request Nov 10, 2021
node 17.1.0 Homebrew/homebrew-core#89068
Closed
@pimterry pimterry mentioned this pull request Jan 14, 2022
HTTP/3 support #38478
Closed
@johndevedu johndevedu mentioned this pull request Apr 7, 2022
request: update OpenSSL-Strategy.md w/ strategy on Node 17/18 nodejs/TSC#1207
Closed
@gengjiawen gengjiawen mentioned this pull request May 11, 2022
fix: update with changes for OpenSSL 3.x nodejs/gyp-next#149
Closed
@PallHaraldsson PallHaraldsson mentioned this pull request Jul 4, 2022
Drop mbedTLS (and support BoringSSL (and HTTP/3)) JuliaLang/julia#45856
Closed
@richardlau richardlau mentioned this pull request Oct 19, 2022
[v16.x] build: remove redundant condition from common.gypi #45076
Merged
@tniessen tniessen mentioned this pull request Apr 13, 2023
Perf regression on crypto.verify nodejs/performance#72
Closed
@panva panva mentioned this pull request Jul 27, 2026
crypto,build: drop OpenSSL 1.x and engine support #64777
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@richardlau richardlau richardlau left review comments
@tniessen tniessen tniessen approved these changes
+1 more reviewer
@mhdawson mhdawson mhdawson approved these changes
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

build Issues and PRs related to Node.js builds or CI infrastructure. meta Issues and PRs related to the general management of the project. needs-ci PRs that need a full CI run. openssl Issues and PRs related to the OpenSSL dependency. quic Issues and PRs related to the QUIC transport implementation. semver-major PRs that contain breaking changes and should be released in the next major version. tsc-agenda Issues and PRs to discuss during Technical Steering Committee meetings.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

7 participants

@danbev @nodejs-github-bot @richardlau @mhdawson @BethGriggs @tniessen @targos
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.