Skip to content

tools: add non-default OpenSSL versions to the test-shared workflow - #62862

Merged
nodejs-github-bot merged 3 commits into
nodejs:mainfrom
panva:additional-openssl-in-shared
Apr 26, 2026
Merged

tools: add non-default OpenSSL versions to the test-shared workflow#62862
nodejs-github-bot merged 3 commits into
nodejs:mainfrom
panva:additional-openssl-in-shared

Conversation

@panva

@panva panva commented Apr 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Adds an additional OpenSSL shared-libraries matrix to test-shared.yml so PRs run against additional supported OpenSSL releases. No more waiting for a full CI to find out a crypto/TLS change is broken on another version 🙏.

  • build-openssl now uses a committed matrix in test-shared.yml, regenerated by the existing weekly nixpkgs-unstable updater so the pin bump and tested OpenSSL variants stay in sync in a single PR.
  • The updater derives the matrix from the pinned nixpkgs and https://endoflife.date, dropping EOL versions, versions missing from the pinned nixpkgs, while keeping ones that still have extended support such as 1.1.1.
  • SUPPORTED_OPENSSL_VERSION remains a manually maintained value in tools/nix/collect-openssl-matrix.sh, and drives per-entry continue-on-error in the autogenerated matrix so releases newer than what we explicitly support do not fail GHA.

@panva
panva requested a review from aduh95 April 21, 2026 08:27
@nodejs-github-bot

nodejs-github-bot commented Apr 21, 2026

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/actions

@nodejs-github-bot nodejs-github-bot added meta Issues and PRs related to the general management of the project. tools Issues and PRs related to the tools directory. labels Apr 21, 2026
@panva panva added commit-queue-squash PRs the Commit Queue should land as one squashed commit. dont-land-on-v20.x dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x. labels Apr 21, 2026
@panva
panva marked this pull request as ready for review April 21, 2026 11:32
@aduh95

aduh95 commented Apr 21, 2026

Copy link
Copy Markdown
Contributor

Adding extra GHA workflows comes at the expense of spending more minutes to prepare security releases. We can skip the test-shared workflow on the private repo, but idk if it's worth it given that there are some path that we only run on that workflow.
That being said, there's certainly some value to run more variants on GHA, maybe we need to gate them behind github.repository == 'nodejs/node'

aduh95
aduh95 reviewed Apr 21, 2026
View reviewed changes
Comment thread tools/nix/collect-openssl-matrix.sh Outdated
aduh95
aduh95 reviewed Apr 21, 2026
View reviewed changes
Comment thread .github/actions/build-shared/action.yml
@panva

panva commented Apr 21, 2026

Copy link
Copy Markdown
Member Author

but idk if it's worth it given that there are some path that we only run on that workflow

The OpenSSL versions are a big gap. Since we don't/can't keep up with the versions in CI.

aduh95
aduh95 reviewed Apr 21, 2026
View reviewed changes
Comment thread .github/workflows/test-shared.yml Outdated
aduh95
aduh95 reviewed Apr 21, 2026
View reviewed changes
Comment thread .github/workflows/test-shared.yml
@panva
panva force-pushed the additional-openssl-in-shared branch from 8bab015 to 1311e12 Compare April 22, 2026 15:40
@panva
panva requested a review from richardlau April 22, 2026 15:41
aduh95
aduh95 reviewed Apr 22, 2026
View reviewed changes
Comment thread .github/workflows/test-shared.yml Outdated
aduh95
aduh95 reviewed Apr 22, 2026
View reviewed changes
Comment thread .github/workflows/test-shared.yml
@aduh95

aduh95 commented Apr 25, 2026

Copy link
Copy Markdown
Contributor

I did another pass at this PR, and tested aduh95@a01a6ef. Could you have a look, and feel free to pull it and/or adapt from it

@panva
panva force-pushed the additional-openssl-in-shared branch from bc5e7eb to 85900e8 Compare April 25, 2026 20:22
@panva

panva commented Apr 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

@aduh95 looks great, i pulled it in and lint-fixed it

@panva panva added the commit-queue PRs queued for automated landing through the Commit Queue. label Apr 26, 2026
@nodejs-github-bot nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Apr 26, 2026
@nodejs-github-bot
nodejs-github-bot merged commit 0f68423 into nodejs:main Apr 26, 2026
34 checks passed
@nodejs-github-bot

nodejs-github-bot commented Apr 26, 2026

Copy link
Copy Markdown
Collaborator

Landed in 0f68423

@panva
panva deleted the additional-openssl-in-shared branch April 26, 2026 06:01
@aduh95 aduh95 mentioned this pull request Apr 26, 2026
Merged
aduh95 pushed a commit that referenced this pull request May 5, 2026
@panva @aduh95
tools: add non-default OpenSSL versions to the test-shared workflow
027bef4 
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #62862
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
@aduh95 aduh95 mentioned this pull request May 5, 2026
Merged
@Renegade334

Renegade334 commented May 12, 2026

Copy link
Copy Markdown
Member
  • The updater derives the matrix from the pinned nixpkgs and https://endoflife.date, dropping EOL versions, versions missing from the pinned nixpkgs, while keeping ones that still have extended support such as 1.1.1.

So where are we with OpenSSL 1.x support? The conversation in #56733 was approaching whether to withdraw this for v24.x, whereas we appear to be upping our integration a year later?

@panva panva mentioned this pull request May 12, 2026
Closed
@panva panva mentioned this pull request Jul 27, 2026
Closed
panva added a commit that referenced this pull request Oct 25, 2026
@panva
build: require OpenSSL 3 or later
34e3b90 
configure now fails when --shared-openssl points at OpenSSL 1.x rather
than failing later at compile or link time. The check skips BoringSSL,
whose version macros claim 1.1.1.

Stop setting the OpenSSL 1.1 API compatibility level for bundled builds.
ncrypto selects the supported API level directly.

Update the assembler capability check, shared-library test matrix,
package fallbacks, and internal version-number typing for the new
baseline.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
panva added a commit that referenced this pull request Oct 25, 2026
@panva
deps: remove ncrypto legacy OpenSSL backend
85bfe9a 
Remove the OpenSSL 1.x backend and its legacy dss1 digest aliases.
Rename the provider-backed path switch to NCRYPTO_USE_OPENSSL_PROVIDER
and rewrite the remaining version guards as OPENSSL_IS_BORINGSSL checks.

Remove version-adapter casts now that supported OpenSSL signatures are
uniform. Drop legacy digest-context, raw-key, seed, signature-context,
SM2, primality, and RSA2 key-detail fallbacks. Keep name-based key
algorithms and capability discovery, with numeric key adapters and
low-level key paths only for BoringSSL.

Use the same backend split for KDFs, PKCS#1 decoding, key serialization,
and provider EC/RSA key details. Gate BoringSSL-only alternatives
explicitly instead of leaving them in #else branches.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
panva added a commit that referenced this pull request Oct 25, 2026
@panva
crypto: remove legacy OpenSSL code paths
8be36fb 
Remove the OpenSSL 1.x branches and stale version-specific assumptions
from src/. BoringSSL does not define OPENSSL_VERSION_MAJOR, so the
remaining version guards were excluding it as well; use
OPENSSL_IS_BORINGSSL checks instead, including the shared PKCS12 parser
and TLS PFX error handling.

Gate BoringSSL-only alternatives explicitly instead of leaving them
in #else branches, including the MAC/KMAC and OCB fallbacks. Fix the
BoringSSL guard on QUIC's unsupported-backend diagnostic.

Make the OpenSSL legacy-provider command-line help version-neutral.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
panva added a commit that referenced this pull request Oct 25, 2026
@panva
test,benchmark: drop OpenSSL 1.x-only coverage
acbc3ff 
Delete test-crypto-ecb.js, which can no longer run anywhere: Blowfish
is available only from OpenSSL's legacy provider and is absent from
BoringSSL.

The addon and cctest version guards become OPENSSL_IS_BORINGSSL checks.
Remove legacy digest-alias coverage and unreachable OpenSSL 1.x
branches. JavaScript test and benchmark gates, skip reasons, and TLS
error expectations that distinguished OpenSSL 1.x from provider-backed
OpenSSL now distinguish BoringSSL, including PKCS12 parsing, named DH
groups, private-key serialization, RSA-PSS parameters, consolidated
provider caches, FIPS availability, and empty KMAC output. Keep the CCM
alternate finalization error only for BoringSSL.

Provider-only test skips use version-neutral terminology or state the
actual minimum OpenSSL version.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
panva added a commit that referenced this pull request Oct 25, 2026
@panva
doc: remove OpenSSL 1.x references
7f16850 
Rename the openssl30 footnote, which marks APIs unavailable on
BoringSSL rather than ones requiring OpenSSL. Remove obsolete version
qualifiers from the provider and FIPS documentation, drop the "As of
OpenSSL 1.1.0" anchor from the PSK size limits, and point the man1.1.1
links at man3.0.

Document BoringSSL as the only backend with numeric key adapters.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
panva added a commit that referenced this pull request Oct 25, 2026
@panva
test,tools: drop OpenSSL 1.x-era FIPS leftovers
ee9ae88 
The openssl_fips_*.cnf fixtures use OpenSSL 1.x syntax, and their test
branches can no longer run. Remove the fixtures and related version
gates while keeping the provider-backed FIPS assertions.

get_env_type() sniffed for a "-fips" version suffix that can no longer
occur, and the crypto-check lint rule listed a helper that no longer
exists.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
panva added a commit that referenced this pull request Oct 25, 2026
@panva
build: remove the bundled FIPS provider build
21cfb2a 
--openssl-is-fips with bundled OpenSSL never worked: the
openssl-fipsmodule target had no dependency edge, so fipsinstall's
input was produced by nothing. Repairing it would not help, since a
FIPS provider built out of tree has no validation status.

Remove the machinery and restrict --openssl-is-fips to --shared-openssl.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
panva added a commit that referenced this pull request Oct 25, 2026
@panva
crypto: move DEP0093 to End-of-Life
fb8d52d 
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
panva added a commit that referenced this pull request Oct 25, 2026
@panva
Revert "crypto,https,tls: runtime-deprecate OpenSSL engine-based APIs…
b61e682 
… (DEP0183)"

This reverts commit da51692.

PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
panva added a commit that referenced this pull request Oct 25, 2026
@panva
crypto,https,tls: end OpenSSL engine support
a2cd8aa 
OpenSSL removed support for engines in version 4. Remove the Node.js
APIs, constants, native bindings, and implementation that depend on
ENGINE.

Keep recognizing the former TLS and HTTPS engine options so their use
fails explicitly instead of appearing to work while being ignored.

Move DEP0183 directly from Documentation-only to End-of-Life after
reverting its unreleased Runtime deprecation.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@anonrig anonrig anonrig approved these changes
@aduh95 aduh95 aduh95 approved these changes
@richardlau richardlau Awaiting requested review from richardlau

Assignees

No one assigned

Labels

commit-queue-squash PRs the Commit Queue should land as one squashed commit. dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x. meta Issues and PRs related to the general management of the project. tools Issues and PRs related to the tools directory.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@panva @nodejs-github-bot @aduh95 @Renegade334 @anonrig