diff options
Diffstat (limited to 'main/nodejs/APKBUILD')
| -rw-r--r-- | main/nodejs/APKBUILD | 148 |
1 files changed, 121 insertions, 27 deletions
diff --git a/main/nodejs/APKBUILD b/main/nodejs/APKBUILD index a8ac8321e37..a03f4bc7567 100644 --- a/main/nodejs/APKBUILD +++ b/main/nodejs/APKBUILD @@ -6,6 +6,38 @@ # Maintainer: Jakub Jirutka <jakub@jirutka.cz> # # secfixes: +# 20.12.1-r0: +# - CVE-2024-27982 +# - CVE-2024-27983 +# 18.18.2-r0: +# - CVE-2023-45143 +# - CVE-2023-38552 +# - CVE-2023-39333 +# 18.17.1-r0: +# - CVE-2023-32002 +# - CVE-2023-32006 +# - CVE-2023-32559 +# 18.14.1-r0: +# - CVE-2023-23918 +# - CVE-2023-23919 +# - CVE-2023-23920 +# - CVE-2023-23936 +# - CVE-2023-24807 +# 18.12.1-r0: +# - CVE-2022-3602 +# - CVE-2022-3786 +# - CVE-2022-43548 +# 16.17.1-r0: +# - CVE-2022-32213 +# - CVE-2022-32214 +# - CVE-2022-32215 +# - CVE-2022-35255 +# - CVE-2022-35256 +# 16.13.2-r0: +# - CVE-2021-44531 +# - CVE-2021-44532 +# - CVE-2021-44533 +# - CVE-2022-21824 # 14.18.1-r0: # - CVE-2021-22959 # - CVE-2021-22960 @@ -78,62 +110,109 @@ # - CVE-2017-14919 # 6.11.1-r0: # - CVE-2017-1000381 -# +# 0: +# - CVE-2021-43803 +# - CVE-2022-32212 +# - CVE-2023-44487 pkgname=nodejs # Note: Update only to even-numbered versions (e.g. 6.y.z, 8.y.z)! # Odd-numbered versions are supported only for 9 months by upstream. -pkgver=14.18.1 -pkgrel=1 +pkgver=20.12.1 +pkgrel=0 pkgdesc="JavaScript runtime built on V8 engine - LTS version" url="https://nodejs.org/" -arch="all !mips64 !mips64el !riscv64" +arch="all" license="MIT" -depends="ca-certificates nghttp2-libs>=1.41" +depends="ca-certificates" makedepends=" + ada-dev + base64-dev brotli-dev c-ares-dev icu-dev linux-headers nghttp2-dev - openssl1.1-compat-dev + openssl-dev + py3-jinja2 python3 + samurai zlib-dev " install="$pkgname.post-upgrade" -subpackages="$pkgname-dev $pkgname-doc" +subpackages=" + $pkgname-dev + $pkgname-libs + $pkgname-doc + " provider_priority=100 # highest priority (other provider is nodejs-current) -provides="nodejs-lts=$pkgver" # for backward compatibility +provides="nodejs-lts=$pkgver-r$pkgrel" # for backward compatibility replaces="nodejs-current nodejs-lts" # nodejs-lts for backward compatibility source="https://nodejs.org/dist/v$pkgver/node-v$pkgver.tar.gz disable-running-gyp-on-shared-deps.patch - link-with-libatomic-on-mips32.patch - fix-build-with-system-c-ares.patch + system-ada.patch + system-base64.patch + base64.gyp + $pkgname.pc.in " builddir="$srcdir/node-v$pkgver" prepare() { default_prepare + # openssl.cnf is required for build. + mv deps/openssl/nodejs-openssl.cnf . + # Remove bundled dependencies that we're not using. - rm -rf deps/brotli deps/cares deps/openssl deps/zlib + # + # NOTE: nghttp3 and ngtcp2 are only used when building with OpenSSL + # that supports QUIC. After the QUIC support is added to openssl, add + # options --shared-nghttp3 and --shared-ngtcp2. + rm -rf deps/ada/*.cpp \ + deps/base64/* \ + deps/brotli \ + deps/cares \ + deps/corepack \ + deps/nghttp2 \ + deps/nghttp3 \ + deps/ngtcp2 \ + deps/openssl/* \ + deps/v8/third_party/jinja2 \ + deps/zlib \ + tools/inspector_protocol/jinja2 + + mv nodejs-openssl.cnf deps/openssl/ + + cp "$srcdir"/base64.gyp deps/base64/ } build() { # Add defines recommended in libuv readme. local common_flags="-D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" + # -Os overwrites the optimizations enabled by BUILDTYPE=Release. # Compiling with O2 instead of Os increases binary size by ~10% # (53.1 MiB -> 58.6 MiB), but also increases performance by ~20% # according to v8/web-tooling-benchmark. Node.js is quite huge anyway; # there are better options for size constrained environments. - export CFLAGS="${CFLAGS/-Os/-O2} $common_flags" - export CXXFLAGS="${CXXFLAGS/-Os/-O2} $common_flags" - export CPPFLAGS="${CPPFLAGS/-Os/-O2} $common_flags" + export CFLAGS="${CFLAGS/-Os} $common_flags" + export CXXFLAGS="${CXXFLAGS/-Os} $common_flags" + export CPPFLAGS="${CPPFLAGS/-Os} $common_flags" - case "$CARCH" in - mips*) _carchflags="--with-mips-arch-variant=r1 --with-mips-float-abi=soft";; - esac + # When building shared libnode.so, the resulting package size is +15 % + # (~8 MiB), so we rather build it twice to keep the node binary smaller + # (there are currently no packages using libnode.so). + msg 'Building node binary' + _build + cp out/Release/node out/ + msg 'Building libnode.so' + _build --shared + cp out/Release/lib/libnode.so* out/Release/ + + sed "s/@VERSION@/$pkgver/" "$srcdir"/$pkgname.pc.in > out/Release/$pkgname.pc +} + +_build() { # NOTE: We use bundled libuv because they don't care much about backward # compatibility and it has happened several times in past that we # couldn't upgrade nodejs package in stable branches to fix CVEs due to @@ -143,10 +222,11 @@ build() { # its own release cycle and version numbering, so it's better to keep # it in a standalone aport. # - # TODO: After icu package is modified to split data into multiple - # variants, change --with-intl to "system-icu". - python3 configure.py --prefix=/usr \ - $_carchflags \ + # TODO: Fix and enable corepack. + python3 configure.py \ + --prefix=/usr \ + --ninja \ + --enable-lto \ --shared-brotli \ --shared-zlib \ --shared-openssl \ @@ -154,8 +234,10 @@ build() { --shared-nghttp2 \ --openssl-use-def-ca-store \ --with-icu-default-data-dir=$(icu-config --icudatadir) \ - --with-intl=small-icu \ - --without-npm + --with-intl=system-icu \ + --without-corepack \ + --without-npm \ + "$@" make BUILDTYPE=Release } @@ -166,10 +248,20 @@ check() { ./node -e 'console.log("Hello, world!")' ./node -e "require('assert').equal(process.versions.node, '$pkgver')" + ./node -e 'require("assert").equal( + Buffer.from(Buffer.from("foo").toString("base64"), "base64").toString("ascii"), + "foo")' } package() { make DESTDIR="$pkgdir" install + + # node binary built without libnode.so. + install -D -m755 out/node -t "$pkgdir"/usr/bin/ + + install -D -m644 out/Release/$pkgname.pc -t "$pkgdir"/usr/lib/pkgconfig/ + + (cd "$pkgdir"/usr/lib; ln -sf libnode.so.* libnode.so) } dev() { @@ -178,8 +270,10 @@ dev() { } sha512sums=" -f9455ff65a57772e242343e2c1113e769c2ab8123e8a4fd6bd65525f4401d5f35e0bc73981db4f76af4f8da4e14a389fd41d2eca97cde6f0dfed5ed7a6ec532c node-v14.18.1.tar.gz -dbe8167b61518f8f59176759d69834d57bf3e6a5a5fd3dfc2359cafe0325da08b27f8220d278ed77f50c9f63a03313eabbbb0eaca3e592e5bb4e0d5be0ced373 disable-running-gyp-on-shared-deps.patch -44e81fbf254bd79e38b813f7f5a1336df854588939cba50aaec600660495f9b7745a7049a99eb59d15a51100b3a44f66892a902d7fc32e1399b51883ad4c02cf link-with-libatomic-on-mips32.patch -30ca1ce7f9512c943950b8eec98bca99d24c740ebaa14619292fe5ed931dcf603ca90afb1d704ca7f545e421752ba4dde81c0c5bbb5242eb1726739ca627e15f fix-build-with-system-c-ares.patch +24a858477f087383b9a531247ecd5622810b8a1af3a3baf3c4f3e608cceacb90642230ddb0f2d9043c19e87459da45ea5d6f3ffe0874948b2be90be53f39cc8c node-v20.12.1.tar.gz +8c264eefc0bfa9dd57656f9f515e940d5c21b8d836dc549031ee559ba909643f4f2495b8b392ee9976c5eed7c3b4a09db876bbe0f7fcd5b2bf63fafca37bffc2 disable-running-gyp-on-shared-deps.patch +4fc09500212ebc178801e7419c840ccebc239ff06edcb28910315e39bfc772a3967f5ff2abff03845269e730643be161134ac95bab899069fa57dd64be98defa system-ada.patch +94db1f150cb962bf19f42e0ef7cec2c0e007d1909611d03a393095720cc8db58322e638ea3c3280b4412f47615963c88e69c71b4c5adf84292b9fc7f3be3b110 system-base64.patch +bb0f74d8fb1ef07fd457670b9073a3cecadb3ac7d4fea008e8f17c091a62d15ef50646be457a50ac24c4129085d4da21beedd03af0739dded5d636916482f082 base64.gyp +f908fa93f6194ec4f6c5e9d76ed7c918721c7f5d46afcc12de1f84683c185401a27a174b7a7c6a76085a4d0826f964e7088bf5596d4e6901a15bf751846299a6 nodejs.pc.in " |