Update openssl1.1.1b #26327

sam-github · 2019-02-26T21:18:12Z

Checklist

make -j4 test (UNIX), or vcbuild test (Windows) passes
commit message follows commit guidelines

This reverts commit f395a4a. As of openssl-1.1.1b, the dot-files are no longer distributed, so this is no longer necessary.

This updates all sources in deps/openssl/openssl with openssl-1.1.1b.

This is a floating patch against OpenSSL-1.1.1 to generate asm files with Makefile rules. PR-URL: nodejs#25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>

`cd deps/openssl/config; make` updates all archs dependant files.

Since its not packaged, we don't have to delete it, and the Makefile and update can become a (tiny) bit simpler.

nodejs-github-bot · 2019-02-26T21:18:15Z

@sam-github sadly an error occured when I tried to trigger a build :(

sam-github · 2019-02-28T16:10:55Z

ci: https://ci.nodejs.org/job/node-test-pull-request/21039/

sam-github · 2019-02-28T21:41:17Z

Looks like everything passed, except custom-suites-freestyle, aka test-worker, which failed to git clone.

re-ci: https://ci.nodejs.org/job/node-test-pull-request/21068

sam-github · 2019-03-01T16:28:55Z

@nodejs/collaborators please take a look - routine OpenSSL patch update, nothing hard to review, and CI is green

I'd like this to hit 10.x on top of #26270 (so from the point of view of users of 10.x it would go straight to 1.1.1b skipping 1.1.1a), and I'm trying to figure out if that's possible . It would have to be in 11.x for a couple weeks until it can land in 10.x. It can't make the 10.16.0-rc of Mar 12th, but it could make the 10.16.0 release date of April 2nd if there is an 11.x in the next couple weeks.

@nodejs/release, the @nodejs/lts release schedule for 10.x is documented on https://github.com/nodejs/Release/wiki (but not 8.x or 6.x), is the 11.x schedule anywhere?

sam-github · 2019-03-01T17:30:44Z

@mhdawson points out that review-by-file has over 600 file diffs, so questioned my characterization of "not hard to review" :-)

It should be reviewed by looking at https://github.com/nodejs/node/pull/26327/commits:

Revert "deps: remove OpenSSL git and travis configuration" and deps: openssl-1.1.1b no longer packages .gitignore are trivial updates to the upgrade script, openssl no longer package some dot-files (yay!), so we no longer have to delete them
deps: upgrade openssl sources to 1.1.1b: result of https://github.com/nodejs/node/blob/master/deps/openssl/config/README.md#1-obtain-and-extract-new-openssl-sources, it is a simple untar of openssl1.1.1b replacing the existing openssl1.1.1a (huge, but doesn't need file-by-file review). I'm going to PR (seperately) a change to the commit message in the upgrade instructions to it is crystal clear what the commit contains.
deps: add s390 asm rules for OpenSSL-1.1.1 : result of https://github.com/nodejs/node/blob/master/deps/openssl/config/README.md#2-apply-a-floating-patch, it is a cherry pick of a commit that is already on the master, it doesn't need re-review but it needs reapplication because the files it changed got reset to their original state when update to the upstream the 1.1.1b source
deps: update archs files for OpenSSL-1.1.1b: result of https://github.com/nodejs/node/blob/master/deps/openssl/config/README.md#3-execute-make-in-depsopensslconfig-directory, as the commit message says, while huge, this is a mechanical commit of the cd deps/openssl/config; make. No file-by-file review necessary.

And that's it.

mhdawson

RSLGTM

sam-github · 2019-03-02T06:02:27Z

CI is green

sam-github · 2019-03-04T18:36:34Z

Green in CI, two approvals, 6 days open... I'll land it tomorrow if no objections, so @nodejs/crypto last chance to review.

bnoordhuis · 2019-03-05T15:23:15Z

deps/openssl/openssl/CHANGES

+     of a post handshake message exchange (although the messages themselves are
+     still signalled). This could break some applications that were expecting
+     the old signals. However without this KeyUpdate is not usable for many
+     applications.


FWIW, this is openssl/openssl@37857e9. That change looks safe to me in the sense of no observable change with TLS <= 1.2 (and TLSv1.3 isn't an issue for us just yet.) Agree/disagree?

Not just safe for TSL1.3, necessary. I'm floating this on #26209 and can drop it from there once 1.1.1b is merged.

sam-github · 2019-03-05T16:42:17Z

Landed in fe71629...b348ae7

This reverts commit f395a4a. As of openssl-1.1.1b, the dot-files are no longer distributed, so this is no longer necessary. PR-URL: #26327 Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

This updates all sources in deps/openssl/openssl with openssl-1.1.1b. PR-URL: #26327 Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

This is a floating patch against OpenSSL-1.1.1 to generate asm files with Makefile rules. PR-URL: #26327 Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Original: Fixes: #4270 PR-URL: #19794 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rod Vagg <rod@vagg.org> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

`cd deps/openssl/config; make` updates all archs dependant files. PR-URL: #26327 Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Since its not packaged, we don't have to delete it, and the Makefile and update can become a (tiny) bit simpler. PR-URL: #26327 Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

`cd deps/openssl/config; make` updates all archs dependant files. PR-URL: nodejs#26327 Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Particularly, ensure that the commit messages are self-explanatory so that reviewers can understand that the large commits are the result of a simple repeatable process. This should make them easier to review. See: nodejs#26327 (comment) PR-URL: nodejs#26378 Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Richard Lau <riclau@uk.ibm.com>

This updates all sources in deps/openssl/openssl with openssl-1.1.1b. PR-URL: nodejs#26327 Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Since its not packaged, we don't have to delete it, and the Makefile and update can become a (tiny) bit simpler. PR-URL: nodejs#26327 Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

`cd deps/openssl/config; make` updates all archs dependant files. PR-URL: nodejs#26327 Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Particularly, ensure that the commit messages are self-explanatory so that reviewers can understand that the large commits are the result of a simple repeatable process. This should make them easier to review. See: #26327 (comment) Backport-PR-URL: #27419 PR-URL: #26378 Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Richard Lau <riclau@uk.ibm.com>

This updates all sources in deps/openssl/openssl with openssl-1.1.1b. Backport-PR-URL: #27419 PR-URL: #26327 Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Since its not packaged, we don't have to delete it, and the Makefile and update can become a (tiny) bit simpler. Backport-PR-URL: #27419 PR-URL: #26327 Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

`cd deps/openssl/config; make` updates all archs dependant files. Backport-PR-URL: #27419 PR-URL: #26327 Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Particularly, ensure that the commit messages are self-explanatory so that reviewers can understand that the large commits are the result of a simple repeatable process. This should make them easier to review. See: #26327 (comment) Backport-PR-URL: #27419 PR-URL: #26378 Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Richard Lau <riclau@uk.ibm.com>

This updates all sources in deps/openssl/openssl with openssl-1.1.1b. Backport-PR-URL: #27419 PR-URL: #26327 Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Since its not packaged, we don't have to delete it, and the Makefile and update can become a (tiny) bit simpler. Backport-PR-URL: #27419 PR-URL: #26327 Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

`cd deps/openssl/config; make` updates all archs dependant files. Backport-PR-URL: #27419 PR-URL: #26327 Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Notable changes: - **deps**: - update ICU to 64.2 (Ujjwal Sharma) [#27361](#27361) - upgrade npm to 6.9.0 (Kat Marchán) [#26244](#26244) - upgrade openssl sources to 1.1.1b (Sam Roberts) [#26327](#26327) - upgrade to libuv 1.28.0 (cjihrig) [#27241](#27241) - **events**: - add once method to use promises with EventEmitter (Matteo Collina) [#26078](#26078) - **n-api**: - mark thread-safe function as stable (Gabriel Schulhof) [#25556](#25556) - **repl**: - support top-level for-await-of (Shelley Vohr) [#23841](#23841) - **zlib**: - add brotli support (Anna Henningsen) [#24938](#24938) PR-URL: #27514

sam-github and others added 5 commits February 26, 2019 11:28

Revert "deps: remove OpenSSL git and travis configuration"

5b59fb8

This reverts commit f395a4a. As of openssl-1.1.1b, the dot-files are no longer distributed, so this is no longer necessary.

deps: upgrade openssl sources to 1.1.1b

8c936cf

This updates all sources in deps/openssl/openssl with openssl-1.1.1b.

deps: add s390 asm rules for OpenSSL-1.1.1

c095c55

This is a floating patch against OpenSSL-1.1.1 to generate asm files with Makefile rules. PR-URL: nodejs#25381 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>

deps: update archs files for OpenSSL-1.1.1b

679294f

`cd deps/openssl/config; make` updates all archs dependant files.

deps: openssl-1.1.1b no longer packages .gitignore

960257a

Since its not packaged, we don't have to delete it, and the Makefile and update can become a (tiny) bit simpler.

sam-github requested a review from shigeki February 26, 2019 21:18

nodejs-github-bot added the openssl Issues and PRs related to the OpenSSL dependency. label Feb 26, 2019

This was referenced Feb 27, 2019

OpenSSL 1.1.1 Support TODO (pls help) #18770

Closed

TLS1.3 support #26209

Closed

gireeshpunathil approved these changes Mar 1, 2019

View reviewed changes

sam-github mentioned this pull request Mar 1, 2019

deps: update OpenSSL upgrade process #26378

Closed

4 tasks

mhdawson approved these changes Mar 1, 2019

View reviewed changes

bnoordhuis approved these changes Mar 5, 2019

View reviewed changes

BridgeAR added the author ready PRs that have at least one approval, no pending requests for changes, and a CI started. label Mar 5, 2019

sam-github closed this Mar 5, 2019

sam-github deleted the update_openssl1.1.1b branch March 5, 2019 16:55

BethGriggs mentioned this pull request May 16, 2019

v10.16.0 proposal #27514

Merged

watson mentioned this pull request Oct 14, 2019

Upgrade to Node 12.x elastic/kibana#47968

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update openssl1.1.1b #26327

Update openssl1.1.1b #26327

sam-github commented Feb 26, 2019

nodejs-github-bot commented Feb 26, 2019

sam-github commented Feb 28, 2019

sam-github commented Feb 28, 2019

sam-github commented Mar 1, 2019

sam-github commented Mar 1, 2019

mhdawson left a comment

sam-github commented Mar 2, 2019

sam-github commented Mar 4, 2019

bnoordhuis Mar 5, 2019

sam-github Mar 5, 2019

sam-github commented Mar 5, 2019

Update openssl1.1.1b #26327

Update openssl1.1.1b #26327

Conversation

sam-github commented Feb 26, 2019

Checklist

nodejs-github-bot commented Feb 26, 2019

sam-github commented Feb 28, 2019

sam-github commented Feb 28, 2019

sam-github commented Mar 1, 2019

sam-github commented Mar 1, 2019

mhdawson left a comment

Choose a reason for hiding this comment

sam-github commented Mar 2, 2019

sam-github commented Mar 4, 2019

bnoordhuis Mar 5, 2019

Choose a reason for hiding this comment

sam-github Mar 5, 2019

Choose a reason for hiding this comment

sam-github commented Mar 5, 2019