Skip to content

Commit aa60c8c

Browse files
marco-ippolitomarco-ippolito
committed
tools: automate update openssl v16
PR-URL: nodejs#48377 Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Paolo Insogna <[email protected]>
1 parent 9bbd991 commit aa60c8c

File tree

2 files changed

+284
-0
lines changed

2 files changed

+284
-0
lines changed

‎tools/dep_updaters/update-openssl.sh

+185
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
#!/bin/sh
2+
set -e
3+
# Shell script to update OpenSSL in the source tree to a specific version
4+
# Based on https://github.com/nodejs/node/blob/main/doc/contributing/maintaining/maintaining-openssl.md
5+
6+
cleanup() {
7+
EXIT_CODE=$?
8+
[ -d "$WORKSPACE" ] && rm -rf "$WORKSPACE"
9+
exit $EXIT_CODE
10+
}
11+
12+
download_v1() {
13+
LATEST_V1_TAG_NAME="$("$NODE" --input-type=module --experimental-fetch <<'EOF'
14+
const res = await fetch('https://api.github.com/repos/quictls/openssl/git/matching-refs/tags/OpenSSL_1');
15+
if (!res.ok) throw new Error(`FetchError: ${res.status} ${res.statusText}`, { cause: res });
16+
const releases = await res.json()
17+
const latest = releases.reverse().find(({ ref }) => ref.includes('quic'));
18+
if(!latest) throw new Error(`Could not find latest release for v1`);
19+
console.log(latest.ref.replace('refs/tags/',''));
20+
EOF
21+
)"
22+
23+
NEW_VERSION_V1=$(echo "$LATEST_V1_TAG_NAME" | sed 's/OpenSSL_//;s/_/./g;s/-/+/g')
24+
25+
case "$NEW_VERSION_V1" in
26+
*quic1) NEW_VERSION_V1_NO_RELEASE="${NEW_VERSION_V1%1}" ;;
27+
*) NEW_VERSION_V1_NO_RELEASE="$NEW_VERSION_V1" ;;
28+
esac
29+
30+
VERSION_H="$DEPS_DIR/openssl/openssl/include/openssl/opensslv.h"
31+
CURRENT_VERSION=$(grep "OPENSSL_VERSION_TEXT" "$VERSION_H" | sed -n "s/.*OpenSSL \([^\"]*\).*/\1/p" | cut -d ' ' -f 1)
32+
33+
# This function exit with 0 if new version and current version are the same
34+
compare_dependency_version "openssl" "$NEW_VERSION_V1_NO_RELEASE" "$CURRENT_VERSION"
35+
36+
echo "Making temporary workspace..."
37+
WORKSPACE=$(mktemp -d 2> /dev/null || mktemp -d -t 'tmp')
38+
cd "$WORKSPACE"
39+
40+
echo "Fetching OpenSSL source archive..."
41+
OPENSSL_TARBALL="openssl.tar.gz"
42+
curl -sL -o "$OPENSSL_TARBALL" "https://api.github.com/repos/quictls/openssl/tarball/$LATEST_V1_TAG_NAME"
43+
log_and_verify_sha256sum "openssl" "$OPENSSL_TARBALL"
44+
gzip -dc "$OPENSSL_TARBALL" | tar xf -
45+
rm "$OPENSSL_TARBALL"
46+
47+
mv quictls-openssl-* openssl
48+
49+
echo "Replacing existing OpenSSL..."
50+
rm -rf "$DEPS_DIR/openssl/openssl"
51+
mv "$WORKSPACE/openssl" "$DEPS_DIR/openssl/"
52+
53+
echo "All done!"
54+
echo ""
55+
echo "Please git add openssl, and commit the new version:"
56+
echo ""
57+
echo "$ git add -A deps/openssl/openssl"
58+
echo "$ git add doc/contributing/maintaining/maintaining-dependencies.md"
59+
echo "$ git commit -m \"deps: upgrade openssl sources to quictls/openssl-$NEW_VERSION_V1\""
60+
echo ""
61+
# The last line of the script should always print the new version,
62+
# as we need to add it to $GITHUB_ENV variable.
63+
echo "NEW_VERSION=$NEW_VERSION_V1"
64+
}
65+
66+
download_v3() {
67+
LATEST_V3_TAG_NAME="$("$NODE" --input-type=module <<'EOF'
68+
const res = await fetch('https://api.github.com/repos/quictls/openssl/git/matching-refs/tags/openssl-3.0');
69+
if (!res.ok) throw new Error(`FetchError: ${res.status} ${res.statusText}`, { cause: res });
70+
const releases = await res.json()
71+
const latest = releases.findLast(({ ref }) => ref.includes('quic'));
72+
if(!latest) throw new Error(`Could not find latest release for v3.0`);
73+
console.log(latest.ref.replace('refs/tags/',''));
74+
EOF
75+
)"
76+
NEW_VERSION_V3=$(echo "$LATEST_V3_TAG_NAME" | sed 's/openssl-//;s/-/+/g')
77+
78+
case "$NEW_VERSION_V3" in
79+
*quic1) NEW_VERSION_V3_NO_RELEASE="${NEW_VERSION_V3%1}" ;;
80+
*) NEW_VERSION_V3_NO_RELEASE="$NEW_VERSION_V3" ;;
81+
esac
82+
VERSION_H="./deps/openssl/config/archs/linux-x86_64/asm/include/openssl/opensslv.h"
83+
CURRENT_VERSION=$(grep "OPENSSL_FULL_VERSION_STR" $VERSION_H | sed -n "s/^.*VERSION_STR \"\(.*\)\"/\1/p")
84+
# This function exit with 0 if new version and current version are the same
85+
compare_dependency_version "openssl" "$NEW_VERSION_V3_NO_RELEASE" "$CURRENT_VERSION"
86+
87+
echo "Making temporary workspace..."
88+
89+
WORKSPACE=$(mktemp -d 2> /dev/null || mktemp -d -t 'tmp')
90+
91+
cd "$WORKSPACE"
92+
echo "Fetching OpenSSL source archive..."
93+
94+
OPENSSL_TARBALL="openssl.tar.gz"
95+
96+
curl -sL -o "$OPENSSL_TARBALL" "https://api.github.com/repos/quictls/openssl/tarball/$LATEST_V3_TAG_NAME"
97+
98+
log_and_verify_sha256sum "openssl" "$OPENSSL_TARBALL"
99+
100+
gzip -dc "$OPENSSL_TARBALL" | tar xf -
101+
102+
rm "$OPENSSL_TARBALL"
103+
mv quictls-openssl-* openssl
104+
echo "Replacing existing OpenSSL..."
105+
rm -rf "$DEPS_DIR/openssl/openssl"
106+
mv "$WORKSPACE/openssl" "$DEPS_DIR/openssl/"
107+
108+
# Update the version number
109+
update_dependency_version "openssl" "$NEW_VERSION_V3"
110+
echo "All done!"
111+
echo ""
112+
echo "Please git add openssl, and commit the new version:"
113+
echo ""
114+
echo "$ git add -A deps/openssl/openssl"
115+
echo "$ git add doc/contributing/maintaining/maintaining-dependencies.md"
116+
echo "$ git commit -m \"deps: upgrade openssl sources to quictls/openssl-$NEW_VERSION_V3\""
117+
echo ""
118+
# The last line of the script should always print the new version,
119+
# as we need to add it to $GITHUB_ENV variable.
120+
echo "NEW_VERSION=$NEW_VERSION_V3"
121+
}
122+
123+
regenerate() {
124+
command -v perl >/dev/null 2>&1 || { echo >&2 "Error: 'Perl' required but not installed."; exit 1; }
125+
command -v nasm >/dev/null 2>&1 || { echo >&2 "Error: 'nasm' required but not installed."; exit 1; }
126+
command -v as >/dev/null 2>&1 || { echo >&2 "Error: 'GNU as' required but not installed."; exit 1; }
127+
perl -e "use Text::Template">/dev/null 2>&1 || { echo >&2 "Error: 'Text::Template' Perl module required but not installed."; exit 1; }
128+
129+
echo "Regenerating platform-dependent files..."
130+
131+
make -C "$DEPS_DIR/openssl/config" clean
132+
# Needed for compatibility with nasm on 32-bit Windows
133+
# See https://github.com/nodejs/node/blob/main/doc/contributing/maintaining/maintaining-openssl.md#2-execute-make-in-depsopensslconfig-directory
134+
sed -i 's/#ifdef/%ifdef/g' "$DEPS_DIR/openssl/openssl/crypto/perlasm/x86asm.pl"
135+
sed -i 's/#endif/%endif/g' "$DEPS_DIR/openssl/openssl/crypto/perlasm/x86asm.pl"
136+
make -C "$DEPS_DIR/openssl/config"
137+
138+
echo "All done!"
139+
echo ""
140+
echo "Please commit the regenerated files:"
141+
echo ""
142+
echo "$ git add -A deps/openssl/config/archs deps/openssl/openssl"
143+
echo "$ git commit -m \"deps: update archs files for openssl\""
144+
echo ""
145+
}
146+
147+
help() {
148+
echo "Shell script to update OpenSSL in the source tree to a specific version"
149+
echo "Sub-commands:"
150+
printf "%-23s %s\n" "help" "show help menu and commands"
151+
printf "%-23s %s\n" "download" "download and replace OpenSSL source code with new version"
152+
printf "%-23s %s\n" "regenerate" "regenerate platform-specific files"
153+
echo ""
154+
exit "${1:-0}"
155+
}
156+
157+
main() {
158+
if [ ${#} -eq 0 ]; then
159+
help 0
160+
fi
161+
162+
trap cleanup INT TERM EXIT
163+
164+
BASE_DIR=$(cd "$(dirname "$0")/../.." && pwd)
165+
DEPS_DIR="$BASE_DIR/deps"
166+
167+
[ -z "$NODE" ] && NODE="$BASE_DIR/out/Release/node"
168+
[ -x "$NODE" ] || NODE=$(command -v node)
169+
170+
# shellcheck disable=SC1091
171+
. "$BASE_DIR/tools/dep_updaters/utils.sh"
172+
173+
case ${1} in
174+
help | regenerate | download_v1 | download_v3 )
175+
$1 "${2}"
176+
;;
177+
* )
178+
echo "unknown command: $1"
179+
help 1
180+
exit 1
181+
;;
182+
esac
183+
}
184+
185+
main "$@"

‎tools/dep_updaters/utils.sh

+99
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
#!/bin/sh
2+
3+
ROOT=$(cd "$(dirname "$0")/../.." && pwd)
4+
5+
# This function compare new version with current version of a depdendency and
6+
# exit the script if the versions are the same
7+
#
8+
# $1 is the package name e.g. 'acorn', 'ada', 'base64' etc. See the file
9+
# https://github.com/nodejs/node/blob/main/doc/contributing/maintaining/maintaining-dependencies.md
10+
# for a complete list of package name
11+
# $2 is the new version.
12+
compare_dependency_version() {
13+
package_name="$1"
14+
new_version="$2"
15+
current_version="$3"
16+
echo "Comparing $new_version with $current_version"
17+
if [ "$new_version" = "$current_version" ]; then
18+
echo "Skipped because $package_name is on the latest version."
19+
exit 0
20+
fi
21+
}
22+
23+
# This function inform to commit the new version of a maintained dependency
24+
# and print the last line of the script "NEW_VERSION=$NEW_VERSION" as we need
25+
# to add it to $GITHUB_ENV variable.
26+
#
27+
# $1 is the package name e.g. 'acorn', 'ada', 'base64' etc. See the file
28+
# https://github.com/nodejs/node/blob/main/doc/contributing/maintaining/maintaining-dependencies.md
29+
# for a complete list of package name
30+
# $2 is the new version.
31+
# $3 (optional) other files to be git added apart from the deps/package_name
32+
finalize_version_update() {
33+
package_name="$1"
34+
new_version="$2"
35+
extra_files="$3"
36+
37+
# Update the version number on maintaining-dependencies.md
38+
update_dependency_version "$package_name" "$new_version"
39+
40+
echo "All done!"
41+
echo ""
42+
echo "Please git add $package_name and commit the new version:"
43+
echo ""
44+
echo "$ git add -A deps/$package_name $extra_files"
45+
echo "$ git add doc/contributing/maintaining/maintaining-dependencies.md"
46+
echo "$ git commit -m \"deps: update $package_name to $new_version\""
47+
echo ""
48+
49+
# The last line of the script should always print the new version,
50+
# as we need to add it to $GITHUB_ENV variable.
51+
echo "NEW_VERSION=$new_version"
52+
}
53+
54+
# This function logs the archive checksum and, if provided, compares it with
55+
# the deposited checksum
56+
#
57+
# $1 is the package name e.g. 'acorn', 'ada', 'base64' etc. See the file
58+
# https://github.com/nodejs/node/blob/main/doc/contributing/maintaining/maintaining-dependencies.md
59+
# for a complete list of package name
60+
# $2 is the downloaded archive
61+
# $3 (optional) is the deposited sha256 cheksum. When provided, it is checked
62+
# against the checksum generated from the archive
63+
log_and_verify_sha256sum() {
64+
package_name="$1"
65+
archive="$2"
66+
checksum="$3"
67+
bsd_formatted_checksum=$(shasum -a 256 --tag "$archive")
68+
if [ -z "$3" ]; then
69+
echo "$bsd_formatted_checksum"
70+
else
71+
archive_checksum=$(shasum -a 256 "$archive")
72+
if [ "$checksum" = "$archive_checksum" ]; then
73+
echo "Valid $package_name checksum"
74+
echo "$bsd_formatted_checksum"
75+
else
76+
echo "ERROR - Invalid $package_name checksum:"
77+
echo "deposited: $checksum"
78+
echo "generated: $archive_checksum"
79+
exit 1
80+
fi
81+
fi
82+
}
83+
84+
# This function update the version of a maintained dependency in
85+
# https://github.com/nodejs/node/blob/main/doc/contributing/maintaining/maintaining-dependencies.md
86+
#
87+
# $1 is the package name e.g. 'acorn', 'ada', 'base64' etc. See that file
88+
# for a complete list of package name
89+
# $2 is the new version.
90+
update_dependency_version() {
91+
package_name="$1"
92+
new_version="$2"
93+
deps_file_path="$ROOT/doc/contributing/maintaining/maintaining-dependencies.md"
94+
# Remove version dots for anchor markdown
95+
version_no_dots=$(echo "$new_version" | sed -e 's/\.//g')
96+
perl -i -pe 's|^\* \['"$package_name"'.*|* ['"$package_name"' '"$new_version"'][]|' "$deps_file_path"
97+
perl -i -pe 's|^\['"$package_name"'.*\]: #'"$package_name"'.*|['"$package_name"' '"$new_version"']: #'"$package_name"'-'"$version_no_dots"'|' "$deps_file_path"
98+
perl -i -pe 's|^### '"$package_name"'.*|### '"$package_name"' '"$new_version"'|' "$deps_file_path"
99+
}

0 commit comments

Comments
 (0)