Commit 34e3b906210 for nodejs
commit 34e3b9062107cd1e60b66055dd0da0cd988aba37
Author: Filip Skokan <panva.ip@gmail.com>
Date: Sun Jul 26 14:18:37 2026 +0200
build: require OpenSSL 3 or later
configure now fails when --shared-openssl points at OpenSSL 1.x rather
than failing later at compile or link time. The check skips BoringSSL,
whose version macros claim 1.1.1.
Stop setting the OpenSSL 1.1 API compatibility level for bundled builds.
ncrypto selects the supported API level directly.
Update the assembler capability check, shared-library test matrix,
package fallbacks, and internal version-number typing for the new
baseline.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
diff --git a/.github/workflows/test-shared.yml b/.github/workflows/test-shared.yml
index bcf70cd6a92..6e10cf95338 100644
--- a/.github/workflows/test-shared.yml
+++ b/.github/workflows/test-shared.yml
@@ -260,8 +260,8 @@ jobs:
# the matrix-selected nixpkgs attribute (e.g. `openssl_3_6`). All
# other shared libs (brotli, cares, libuv, …) keep their defaults.
# `permittedInsecurePackages` whitelists just the matrix-selected
- # release (e.g. `openssl-1.1.1w`) so EOL-with-extended-support
- # cycles evaluate without relaxing nixpkgs' meta check globally.
+ # release so EOL-with-extended-support cycles evaluate without relaxing
+ # nixpkgs' meta check globally.
extra-nix-flags: |
--arg useSeparateDerivationForV8 ${{ needs.build-aarch64-linux-v8.outputs.local-cache && '"$(nix-store --import < libv8-aarch64-linux.nar)"' || 'true' }} \
--arg sharedLibDeps "(import $TAR_DIR/tools/nix/sharedLibDeps.nix {}) // {
diff --git a/BUILDING.md b/BUILDING.md
index 8c7407b9627..9ece644ce6f 100644
--- a/BUILDING.md
+++ b/BUILDING.md
@@ -205,7 +205,7 @@ on your Linux distribution.
#### OpenSSL asm support
-OpenSSL-1.1.1 requires the following assembler version for use of asm
+OpenSSL requires the following assembler version for use of asm
support on x86\_64 and ia32.
For use of AVX-512,
@@ -213,8 +213,6 @@ For use of AVX-512,
* gas (GNU assembler) version 2.26 or higher
* nasm version 2.11.8 or higher in Windows
-AVX-512 is disabled for Skylake-X by OpenSSL-1.1.1.
-
For use of AVX2,
* gas (GNU assembler) version 2.23 or higher
@@ -222,7 +220,7 @@ For use of AVX2,
* llvm version 3.3 or higher
* nasm version 2.10 or higher in Windows
-Please refer to <https://docs.openssl.org/1.1.1/man3/OPENSSL_ia32cap/> for details.
+Please refer to <https://docs.openssl.org/master/man3/OPENSSL_ia32cap/> for details.
If compiling without one of the above, use `configure` with the
`--openssl-no-asm` flag. Otherwise, `configure` will fail.
@@ -1119,6 +1117,10 @@ A number of `configure` options are provided to support this use case.
provide the ability to set the path to an external JavaScript file
for the dependency to be used at runtime.
+When building with `--shared-openssl`, Node.js requires OpenSSL 3.0 or later.
+Support for building against OpenSSL 1.x was removed in Node.js 27.0.0, and
+`configure` fails if an older version is detected.
+
It is the responsibility of any distribution
shipping with these options to:
diff --git a/configure.py b/configure.py
index 42a1e33e9df..25b735e7e24 100755
--- a/configure.py
+++ b/configure.py
@@ -1398,8 +1398,9 @@ def try_check_compiler(cc, lang):
#
# The version of asm compiler is needed for building openssl asm files.
# See deps/openssl/openssl.gypi for detail.
-# Commands and regular expressions to obtain its version number are taken from
-# https://github.com/openssl/openssl/blob/OpenSSL_1_0_2-stable/crypto/sha/asm/sha512-x86_64.pl#L112-L129
+# Commands and regular expressions to obtain its version number mirror the
+# bundled OpenSSL assembler scripts, including
+# deps/openssl/openssl/crypto/sha/asm/sha512-x86_64.pl.
#
def get_version_helper(cc, regexp):
try:
@@ -2334,15 +2335,15 @@ def configure_openssl(o):
if not options.shared_openssl and not options.openssl_no_asm:
is_x86 = 'x64' in variables['target_arch'] or 'ia32' in variables['target_arch']
- # supported asm compiler for AVX2. See https://github.com/openssl/openssl/
- # blob/OpenSSL_1_1_0-stable/crypto/modes/asm/aesni-gcm-x86_64.pl#L52-L69
- openssl110_asm_supported = \
+ # Check for an assembler that supports the instructions used by OpenSSL.
+ # See deps/openssl/openssl/INSTALL.md for its toolchain requirements.
+ openssl_asm_supported = \
('gas_version' in variables and Version(variables['gas_version']) >= Version('2.23')) or \
('xcode_version' in variables and Version(variables['xcode_version']) >= Version('5.0')) or \
('llvm_version' in variables and Version(variables['llvm_version']) >= Version('3.3')) or \
('nasm_version' in variables and Version(variables['nasm_version']) >= Version('2.10'))
- if is_x86 and not openssl110_asm_supported:
+ if is_x86 and not openssl_asm_supported:
error('''Did not find a new enough assembler, install one or build with
--openssl-no-asm.
Please refer to BUILDING.md''')
@@ -2366,6 +2367,14 @@ def configure_openssl(o):
o['variables']['openssl_version'] = get_openssl_version(o)
o['variables']['openssl_is_boringssl'] = get_openssl_is_boringssl(o)
+ # BoringSSL identifies itself as OpenSSL 1.1.1 and is exempt from this check.
+ # A version of 0 means detection failed, which is already warned about in
+ # get_openssl_version() and is caught at compile time by ncrypto.h.
+ openssl_version = o['variables']['openssl_version']
+ if o['variables']['openssl_is_boringssl'] == 'false' and \
+ 0 < openssl_version < 0x30000000:
+ error('OpenSSL 1.x is no longer supported, v3.0.0 or later is required.')
+
def configure_lief(o):
if options.without_lief:
if options.shared_lief:
diff --git a/node.gypi b/node.gypi
index 3ca9d4633d0..32e7dca2fd9 100644
--- a/node.gypi
+++ b/node.gypi
@@ -408,7 +408,6 @@
'defines': [ 'HAVE_OPENSSL=1' ],
'conditions': [
[ 'node_shared_openssl=="false"', {
- 'defines': [ 'OPENSSL_API_COMPAT=0x10100000L', ],
'dependencies': [
'./deps/openssl/openssl.gyp:openssl',
diff --git a/tools/nix/openssl-matrix.nix b/tools/nix/openssl-matrix.nix
index 7187d707281..b035f893568 100644
--- a/tools/nix/openssl-matrix.nix
+++ b/tools/nix/openssl-matrix.nix
@@ -1,7 +1,6 @@
{
pkgs ? import ./pkgs.nix {
config.permittedInsecurePackages = [
- "openssl-1.1.1w"
"openssl-3.0.22"
];
},
@@ -14,7 +13,6 @@
# Other OpenSSL variants we want to test for:
inherit (pkgs)
boringssl
- openssl_1_1
openssl_3
openssl_3_6
openssl_4_0
diff --git a/tools/nix/pkgs.nix b/tools/nix/pkgs.nix
index d81bf445a79..4d50ecb80bb 100644
--- a/tools/nix/pkgs.nix
+++ b/tools/nix/pkgs.nix
@@ -15,9 +15,8 @@ if builtins.currentSystem == "x86_64-darwin" then
else
nixpkgs
// {
- # OpenSSL 1.1.x and 3.0.x were removed from unstable, we want to keep testing with it
+ # OpenSSL 3.0.x was removed from unstable, but we want to keep testing it.
inherit (import ./pkgs-26.05.nix arg)
- openssl_1_1
openssl_3
;
diff --git a/typings/internalBinding/constants.d.ts b/typings/internalBinding/constants.d.ts
index 3c29df44c13..ce962a32e2d 100644
--- a/typings/internalBinding/constants.d.ts
+++ b/typings/internalBinding/constants.d.ts
@@ -193,7 +193,7 @@ export interface ConstantsBinding {
COPYFILE_FICLONE_FORCE: 4;
};
crypto: {
- OPENSSL_VERSION_NUMBER: 269488319;
+ OPENSSL_VERSION_NUMBER: number;
SSL_OP_ALL: 2147485780;
SSL_OP_ALLOW_NO_DHE_KEX: 1024;
SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION: 262144;