Commit a5af6440be1 for nodejs
commit a5af6440be11f4f346050e9946cacb6a17439db7
Author: Filip Skokan <panva.ip@gmail.com>
Date: Thu Oct 15 14:45:32 2026 +0200
tools: update OpenSSL on the selected branch
Use the selected workflow branch as the PR base and prefix PR titles
for branches other than the repository's default branch.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66704
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
diff --git a/.github/workflows/update-openssl.yml b/.github/workflows/update-openssl.yml
index b81a260312b..47c74e178ba 100644
--- a/.github/workflows/update-openssl.yml
+++ b/.github/workflows/update-openssl.yml
@@ -12,37 +12,40 @@ permissions:
jobs:
openssl-update:
if: github.repository == 'nodejs/node'
+ name: OpenSSL update (${{ github.ref_name }})
# Cannot use ubuntu-slim here because the update script requires Docker
runs-on: ubuntu-latest
+ concurrency:
+ group: openssl-update-${{ github.ref_name }}
+ cancel-in-progress: false
+ env:
+ TARGET_BRANCH: ${{ github.ref_name }}
+ DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
+ - name: Setup Git config
+ run: |
+ git config user.name "Node.js GitHub Bot"
+ git config user.email "github-bot@iojs.org"
+ if [ "$TARGET_BRANCH" != "$DEFAULT_BRANCH" ]; then
+ echo "PR_TITLE_PREFIX=[${TARGET_BRANCH%-staging}] " >> "$GITHUB_ENV"
+ fi
- name: Check and download new OpenSSL version
run: |
- ./tools/dep_updaters/update-openssl.sh download > temp-output
- cat temp-output
- tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
- rm temp-output
+ ./tools/dep_updaters/update-openssl.sh download \
+ | tee /dev/stderr \
+ | tail -n1 \
+ | sed -n '/^NEW_VERSION=/p' >> "$GITHUB_ENV"
+ shell: bash
env:
GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
- - name: Create PR with first commit
- id: create-pull-request
+ - name: Commit OpenSSL sources
if: env.NEW_VERSION
- uses: gr2m/create-or-update-pull-request-action@b65137ca591da0b9f43bad7b24df13050ea45d1b # v1.10.1
- # Creates a PR with the new OpenSSL source code committed
- env:
- GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
- with:
- author: Node.js GitHub Bot <github-bot@iojs.org>
- body: This is an automated update of OpenSSL to ${{ env.NEW_VERSION }}.
- branch: actions/tools-update-openssl # Custom branch *just* for this Action.
- commit-message: 'deps: upgrade openssl sources to openssl-${{ env.NEW_VERSION }}'
- labels: dependencies, openssl
- title: 'deps: update OpenSSL to ${{ env.NEW_VERSION }}'
- path: deps/openssl
- update-pull-request-title-and-body: true
- draft: true
+ run: |
+ git add -A deps/openssl/openssl
+ git commit -m "deps: upgrade openssl sources to openssl-$NEW_VERSION"
- name: Regenerate platform specific files
if: env.NEW_VERSION
run: |
@@ -50,20 +53,19 @@ jobs:
./tools/dep_updaters/update-openssl.sh regenerate
env:
GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
- - name: Add second commit
- # Adds a second commit to the PR with the generated platform-dependent files
+ - name: Commit generated files
if: env.NEW_VERSION
- uses: gr2m/create-or-update-pull-request-action@b65137ca591da0b9f43bad7b24df13050ea45d1b # v1.10.1
- env:
- GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+ run: |
+ git add -A deps/openssl
+ git commit -m "deps: update archs files for openssl-$NEW_VERSION"
+ - name: Create or update PR
+ if: env.NEW_VERSION
+ uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
with:
+ token: ${{ secrets.GH_USER_TOKEN }}
author: Node.js GitHub Bot <github-bot@iojs.org>
- branch: actions/tools-update-openssl # Custom branch *just* for this Action.
- commit-message: 'deps: update archs files for openssl-${{ env.NEW_VERSION }}'
- path: deps/openssl
- - name: Mark PR as ready for review
- if: env.NEW_VERSION
- env:
- GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
- PR_ID: ${{ steps.create-pull-request.outputs.pull-request-number }}
- run: gh --repo "$GITHUB_REPOSITORY" pr ready "$PR_ID"
+ committer: Node.js GitHub Bot <github-bot@iojs.org>
+ body: This is an automated update of OpenSSL to ${{ env.NEW_VERSION }} for ${{ github.ref_name }}.
+ branch: actions/${{ github.ref_name != github.event.repository.default_branch && format('{0}/', github.ref_name) || '' }}tools-update-openssl
+ labels: dependencies, openssl
+ title: '${{ env.PR_TITLE_PREFIX }}deps: update OpenSSL to ${{ env.NEW_VERSION }}'
diff --git a/doc/contributing/maintaining/maintaining-openssl.md b/doc/contributing/maintaining/maintaining-openssl.md
index aba013bb3c5..92525c4c65b 100644
--- a/doc/contributing/maintaining/maintaining-openssl.md
+++ b/doc/contributing/maintaining/maintaining-openssl.md
@@ -30,39 +30,49 @@ NASM version 2.11.08
## 1. Obtain and extract new OpenSSL sources
-Get a new source from <https://github.com/openssl/openssl/tree/openssl-3.0.16>
-and copy all files into `deps/openssl/openssl`. Then add all files and commit
-them. (The link above, and the branch, will change with each new OpenSSL
-release).
+Get the sources for the desired `openssl-<version>` tag from
+<https://github.com/openssl/openssl> and copy all files into
+`deps/openssl/openssl`. Then add all files and commit them.
```bash
git clone https://github.com/openssl/openssl
cd openssl
+git checkout openssl-<version>
cd ../node/deps/openssl
rm -rf openssl
cp -R ../../../openssl openssl
-rm -rf openssl/.git*
+rm -rf openssl/.git
git add --all openssl
git commit openssl
```
```text
-deps: upgrade openssl sources to openssl-3.0.16
+deps: upgrade openssl sources to openssl-<version>
This updates all sources in deps/openssl/openssl by:
$ git clone git@github.com:openssl/openssl.git
$ cd openssl
- $ git checkout openssl-3.0.16
+ $ git checkout openssl-<version>
$ cd ../node/deps/openssl
$ rm -rf openssl
$ cp -R ../../../openssl openssl
- $ rm -rf openssl/.git*
+ $ rm -rf openssl/.git
$ git add --all openssl
$ git commit openssl
```
## 2. Execute `make` in `deps/openssl/config` directory
+Fix up 32-bit Windows assembler directives. This will allow the commits to be
+cherry-picked to older release lines that still provide binaries on 32-bit Windows.
+
+```bash
+# Edit deps/openssl/openssl/crypto/perlasm/x86asm.pl changing
+# #ifdef/#endif to %ifdef/%endif for nasm on 32-bit Windows.
+# See: https://github.com/nodejs/node/pull/43603#issuecomment-1170670844
+# Reference: https://github.com/openssl/openssl/issues/18459
+```
+
Use `make` to regenerate all platform dependent files in
`deps/openssl/config/archs/`:
@@ -75,17 +85,6 @@ make -C deps/openssl/config clean
make -C deps/openssl/config
```
-Fix up 32-bit Windows assembler directives. This will allow the commits to be
-cherry-picked to older release lines that still provide binaries on 32-bit Windows.
-
-```bash
-make -C deps/openssl/config clean
-# Edit deps/openssl/openssl/crypto/perlasm/x86asm.pl changing
-# #ifdef to %ifdef to make it compatible to nasm on 32-bit Windows.
-# See: https://github.com/nodejs/node/pull/43603#issuecomment-1170670844
-# Reference: https://github.com/openssl/openssl/issues/18459
-```
-
## 3. Check diffs
Check diffs to ensure updates are right. Even if there are no updates in openssl
@@ -98,19 +97,19 @@ git diff -- deps/openssl
_Note_: On Windows, OpenSSL Configure generates a `makefile` that can be
used for the `nmake` command. The `make` command in step 2 (above) uses
-`Makefile_VC-WIN64A` and `Makefile_VC-WIN32` that are manually
-created. When source files or build options are updated in Windows,
-it needs to change these two Makefiles by hand. If you are not sure,
+`Makefile_VC-WIN64A`, `Makefile_VC-WIN32`, and `Makefile_VC-WIN64-ARM`,
+which are manually created. When source files or build options are updated in
+Windows, these Makefiles need to be changed by hand. If you are not sure,
please ask @shigeki for details.
-## 4. Commit and make test
+## 4. Commit and test
Update all architecture dependent files. Do not forget to git add or remove
files if they are changed before committing:
```bash
-git add deps/openssl/config/archs
-git add deps/openssl/openssl
+git add -A deps/openssl/config/archs
+git add -A deps/openssl/openssl
git commit
```
@@ -118,16 +117,16 @@ The commit message can be written as (with the openssl version set
to the relevant value):
```text
-deps: update archs files for openssl-3.0.16
+deps: update archs files for openssl-<version>
After an OpenSSL source update, all the config files need to be
regenerated and committed by:
$ make -C deps/openssl/config
- $ git add deps/openssl/config/archs
- $ git add deps/openssl/openssl
+ $ git add -A deps/openssl/config/archs
+ $ git add -A deps/openssl/openssl
$ git commit
```
-Finally, build Node.js and run the tests.
+Finally, build Node.js with the bundled OpenSSL and run the tests.
[update-openssl-action]: ../../../.github/workflows/update-openssl.yml