tools: store "default" OpenSSL version in `openssl-matrix.nix` · nodejs/node@ae4b8df · GitHub

nodejs / node Public

• Notifications You must be signed in to change notification settings
• Fork 36.6k
• Star 120k

• Code
• Issues 635
• Pull requests 559
• Actions
• Projects
• Security and quality
• Insights

Additional navigation options

Commit ae4b8df

Browse filesBrowse the repository at this point in the historyBrowse files

aduh95

committed

tools: store "default" OpenSSL version in openssl-matrix.nix

To help with automating keeping in sync with the bundled version. Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com> PR-URL: #64962 Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh>

1 parent 94d12f3 commit ae4b8df
Copy full SHA for ae4b8df

4 files changed

+29-5Lines changed: 29 additions & 5 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• tools
  • dep_updaters
    • update-nixpkgs-pin.sh
  • nix
    • openssl-matrix.nix
    • pkcs11.nix
    • sharedLibDeps.nix

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎tools/dep_updaters/update-nixpkgs-pin.sh‎

Copy file name to clipboardExpand all lines: tools/dep_updaters/update-nixpkgs-pin.sh

+23-2Lines changed: 23 additions & 2 deletions

Original file line number	Diff line number	Diff line change
@@ -26,22 +26,39 @@ TMP_FILE=$(mktemp)
26	26	sed "s/$CURRENT_VERSION_SHA1/$NEW_UPSTREAM_SHA1/;s/$CURRENT_TARBALL_HASH/$NEW_TARBALL_HASH/" "$NIXPKGS_PIN_FILE" > "$TMP_FILE"
27	27	mv "$TMP_FILE" "$NIXPKGS_PIN_FILE"
28	28
	29	+ # === Update openssl-matrix.nix ===
	30	+ # When bumping the pin, we want to update the openssl-matrix.nix file to keep the list in sync nixpkgs
	31	+ # i.e. add newly added release lines, remove newly dropped release lines), and make sure the "openssl"
	32	+ # attribute still refers to the same release line as the bundled version in deps/openssl/.
	33	+
	34	+ OPENSSL_MAJOR=$(awk -F= '/^MAJOR=[0-9]+$/ { print $2; exit }' "$BASE_DIR/deps/openssl/openssl/VERSION.dat")
	35	+ OPENSSL_MINOR=$(awk -F= '/^MINOR=[0-9]+$/ { print $2; exit }' "$BASE_DIR/deps/openssl/openssl/VERSION.dat")
	36	+
29	37	nix-instantiate -I "nixpkgs=$NIXPKGS_PIN_FILE" --eval --strict --json -E "
30	38	let
31	39	pkgs = import <nixpkgs> {};
32	40	opensslAttrs = builtins.filter
33	41	(n: builtins.match \"openssl_[0-9]+(_[0-9]+)?\" n != null)
34	42	(builtins.attrNames pkgs);
35	43	extraMatrixAttrs = [ \"boringssl\" ];
	44	+ default = builtins.head (builtins.filter (n:
	45	+ let
	46	+ inherit (pkgs.lib) versions;
	47	+ t = builtins.tryEval pkgs.\${n};
	48	+ v = if t.success then builtins.tryEval t.value.version else t;
	49	+ majorVersion = pkgs.lib.optionalString v.success (versions.major v.value);
	50	+ minorVersion = pkgs.lib.optionalString v.success (versions.minor v.value);
	51	+ in
	52	+ majorVersion == ''$OPENSSL_MAJOR'' && minorVersion == ''$OPENSSL_MINOR'') opensslAttrs);
36	53	attrs = builtins.filter
37	54	(n:
38	55	let t = builtins.tryEval pkgs.\${n}; in
39		- t.success && (builtins.tryEval t.value.version).success
	56	+ n != default && t.success && (builtins.tryEval t.value.version).success
40	57	)
41	58	(opensslAttrs ++ extraMatrixAttrs);
42	59	in
43	60	{
44		- inherit attrs;
	61	+ inherit attrs default;
45	62	permittedInsecurePackages = builtins.map (attr: pkgs.\${attr}.name) (
46	63	builtins.filter (attr: (pkgs.\${attr}.meta.insecure)) attrs
47	64	);
@@ -53,6 +70,10 @@ nix-instantiate -I "nixpkgs=$NIXPKGS_PIN_FILE" --eval --strict --json -E "
53	70	}:
54	71
55	72	{
	73	+ # "default" OpenSSL release line, should be kept in sync with the bundled version:
	74	+ openssl = pkgs.\(.default);
	75	+
	76	+ # Other OpenSSL variants we want to test for:
56	77	inherit (pkgs)
57	78	\(.attrs | sort | join("\n "))
58	79	;

Collapse file

‎tools/nix/openssl-matrix.nix‎

Copy file name to clipboardExpand all lines: tools/nix/openssl-matrix.nix

+4-1Lines changed: 4 additions & 1 deletion

Original file line number	Diff line number	Diff line change
@@ -5,11 +5,14 @@
5	5	}:
6	6
7	7	{
	8	+ # "default" OpenSSL release line, should be kept in sync with the bundled version:
	9	+ openssl = pkgs.openssl_3_5;
	10	+
	11	+ # Other OpenSSL variants we want to test for:
8	12	inherit (pkgs)
9	13	boringssl
10	14	openssl_1_1
11	15	openssl_3
12		- openssl_3_5
13	16	openssl_3_6
14	17	openssl_4_0
15	18	;

Collapse file

‎tools/nix/pkcs11.nix‎

Copy file name to clipboardExpand all lines: tools/nix/pkcs11.nix

+1-1Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
@@ -10,7 +10,7 @@
10	10	# pkcs11-provider is dlopen'd into the libcrypto Node.js itself links, so it
11	11	# has to be built against that very OpenSSL. SoftHSM links OpenSSL too;
12	12	# building it against the same one keeps a single libcrypto in the process.
13		- openssl ? (import ./sharedLibDeps.nix { inherit pkgs; }).openssl,
	13	+ openssl ? (import ./openssl-matrix.nix { inherit pkgs; }).openssl,
14	14
15	15	pin ? "1234",
16	16	}:

Collapse file

‎tools/nix/sharedLibDeps.nix‎

Copy file name to clipboardExpand all lines: tools/nix/sharedLibDeps.nix

+1-1Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
@@ -48,7 +48,7 @@
48	48	ffi = pkgs.libffiReal;
49	49	})
50	50	// (pkgs.lib.optionalAttrs withSSL ({
51		- openssl = (import ./openssl-matrix.nix { inherit pkgs; }).openssl_3_5;
	51	+ inherit (import ./openssl-matrix.nix { inherit pkgs; }) openssl;
52	52	}))
53	53	// (pkgs.lib.optionalAttrs withTemporal {
54	54	inherit (pkgs) temporal_capi;

0 commit comments

Comments

0 (0)