From 5a33135a0c9397c8deb2964acfcb4bc2597432fa Mon Sep 17 00:00:00 2001 From: Filip Skokan Date: Tue, 13 Oct 2026 14:47:46 +0200 Subject: [PATCH] tools: update OpenSSL on the selected branch Use the selected workflow branch as the PR base and prefix PR titles for branches other than the repository's default branch. Signed-off-by: Filip Skokan Assisted-by: Codex --- .github/workflows/update-openssl.yml | 70 ++++++++++--------- .../maintaining/maintaining-openssl.md | 57 ++++++++------- 2 files changed, 64 insertions(+), 63 deletions(-) diff --git a/.github/workflows/update-openssl.yml b/.github/workflows/update-openssl.yml index b81a260312ba..47c74e178bab 100644 --- a/.github/workflows/update-openssl.yml +++ b/.github/workflows/update-openssl.yml @@ -12,37 +12,40 @@ permissions: jobs: openssl-update: if: github.repository == 'nodejs/node' + name: OpenSSL update (${{ github.ref_name }}) # Cannot use ubuntu-slim here because the update script requires Docker runs-on: ubuntu-latest + concurrency: + group: openssl-update-${{ github.ref_name }} + cancel-in-progress: false + env: + TARGET_BRANCH: ${{ github.ref_name }} + DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false + - name: Setup Git config + run: | + git config user.name "Node.js GitHub Bot" + git config user.email "github-bot@iojs.org" + if [ "$TARGET_BRANCH" != "$DEFAULT_BRANCH" ]; then + echo "PR_TITLE_PREFIX=[${TARGET_BRANCH%-staging}] " >> "$GITHUB_ENV" + fi - name: Check and download new OpenSSL version run: | - ./tools/dep_updaters/update-openssl.sh download > temp-output - cat temp-output - tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true - rm temp-output + ./tools/dep_updaters/update-openssl.sh download \ + | tee /dev/stderr \ + | tail -n1 \ + | sed -n '/^NEW_VERSION=/p' >> "$GITHUB_ENV" + shell: bash env: GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }} - - name: Create PR with first commit - id: create-pull-request + - name: Commit OpenSSL sources if: env.NEW_VERSION - uses: gr2m/create-or-update-pull-request-action@b65137ca591da0b9f43bad7b24df13050ea45d1b # v1.10.1 - # Creates a PR with the new OpenSSL source code committed - env: - GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }} - with: - author: Node.js GitHub Bot - body: This is an automated update of OpenSSL to ${{ env.NEW_VERSION }}. - branch: actions/tools-update-openssl # Custom branch *just* for this Action. - commit-message: 'deps: upgrade openssl sources to openssl-${{ env.NEW_VERSION }}' - labels: dependencies, openssl - title: 'deps: update OpenSSL to ${{ env.NEW_VERSION }}' - path: deps/openssl - update-pull-request-title-and-body: true - draft: true + run: | + git add -A deps/openssl/openssl + git commit -m "deps: upgrade openssl sources to openssl-$NEW_VERSION" - name: Regenerate platform specific files if: env.NEW_VERSION run: | @@ -50,20 +53,19 @@ jobs: ./tools/dep_updaters/update-openssl.sh regenerate env: GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }} - - name: Add second commit - # Adds a second commit to the PR with the generated platform-dependent files + - name: Commit generated files if: env.NEW_VERSION - uses: gr2m/create-or-update-pull-request-action@b65137ca591da0b9f43bad7b24df13050ea45d1b # v1.10.1 - env: - GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }} + run: | + git add -A deps/openssl + git commit -m "deps: update archs files for openssl-$NEW_VERSION" + - name: Create or update PR + if: env.NEW_VERSION + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: + token: ${{ secrets.GH_USER_TOKEN }} author: Node.js GitHub Bot - branch: actions/tools-update-openssl # Custom branch *just* for this Action. - commit-message: 'deps: update archs files for openssl-${{ env.NEW_VERSION }}' - path: deps/openssl - - name: Mark PR as ready for review - if: env.NEW_VERSION - env: - GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }} - PR_ID: ${{ steps.create-pull-request.outputs.pull-request-number }} - run: gh --repo "$GITHUB_REPOSITORY" pr ready "$PR_ID" + committer: Node.js GitHub Bot + body: This is an automated update of OpenSSL to ${{ env.NEW_VERSION }} for ${{ github.ref_name }}. + branch: actions/${{ github.ref_name != github.event.repository.default_branch && format('{0}/', github.ref_name) || '' }}tools-update-openssl + labels: dependencies, openssl + title: '${{ env.PR_TITLE_PREFIX }}deps: update OpenSSL to ${{ env.NEW_VERSION }}' diff --git a/doc/contributing/maintaining/maintaining-openssl.md b/doc/contributing/maintaining/maintaining-openssl.md index aba013bb3c58..92525c4c65ba 100644 --- a/doc/contributing/maintaining/maintaining-openssl.md +++ b/doc/contributing/maintaining/maintaining-openssl.md @@ -30,39 +30,49 @@ NASM version 2.11.08 ## 1. Obtain and extract new OpenSSL sources -Get a new source from -and copy all files into `deps/openssl/openssl`. Then add all files and commit -them. (The link above, and the branch, will change with each new OpenSSL -release). +Get the sources for the desired `openssl-` tag from + and copy all files into +`deps/openssl/openssl`. Then add all files and commit them. ```bash git clone https://github.com/openssl/openssl cd openssl +git checkout openssl- cd ../node/deps/openssl rm -rf openssl cp -R ../../../openssl openssl -rm -rf openssl/.git* +rm -rf openssl/.git git add --all openssl git commit openssl ``` ```text -deps: upgrade openssl sources to openssl-3.0.16 +deps: upgrade openssl sources to openssl- This updates all sources in deps/openssl/openssl by: $ git clone git@github.com:openssl/openssl.git $ cd openssl - $ git checkout openssl-3.0.16 + $ git checkout openssl- $ cd ../node/deps/openssl $ rm -rf openssl $ cp -R ../../../openssl openssl - $ rm -rf openssl/.git* + $ rm -rf openssl/.git $ git add --all openssl $ git commit openssl ``` ## 2. Execute `make` in `deps/openssl/config` directory +Fix up 32-bit Windows assembler directives. This will allow the commits to be +cherry-picked to older release lines that still provide binaries on 32-bit Windows. + +```bash +# Edit deps/openssl/openssl/crypto/perlasm/x86asm.pl changing +# #ifdef/#endif to %ifdef/%endif for nasm on 32-bit Windows. +# See: https://github.com/nodejs/node/pull/43603#issuecomment-1170670844 +# Reference: https://github.com/openssl/openssl/issues/18459 +``` + Use `make` to regenerate all platform dependent files in `deps/openssl/config/archs/`: @@ -75,17 +85,6 @@ make -C deps/openssl/config clean make -C deps/openssl/config ``` -Fix up 32-bit Windows assembler directives. This will allow the commits to be -cherry-picked to older release lines that still provide binaries on 32-bit Windows. - -```bash -make -C deps/openssl/config clean -# Edit deps/openssl/openssl/crypto/perlasm/x86asm.pl changing -# #ifdef to %ifdef to make it compatible to nasm on 32-bit Windows. -# See: https://github.com/nodejs/node/pull/43603#issuecomment-1170670844 -# Reference: https://github.com/openssl/openssl/issues/18459 -``` - ## 3. Check diffs Check diffs to ensure updates are right. Even if there are no updates in openssl @@ -98,19 +97,19 @@ git diff -- deps/openssl _Note_: On Windows, OpenSSL Configure generates a `makefile` that can be used for the `nmake` command. The `make` command in step 2 (above) uses -`Makefile_VC-WIN64A` and `Makefile_VC-WIN32` that are manually -created. When source files or build options are updated in Windows, -it needs to change these two Makefiles by hand. If you are not sure, +`Makefile_VC-WIN64A`, `Makefile_VC-WIN32`, and `Makefile_VC-WIN64-ARM`, +which are manually created. When source files or build options are updated in +Windows, these Makefiles need to be changed by hand. If you are not sure, please ask @shigeki for details. -## 4. Commit and make test +## 4. Commit and test Update all architecture dependent files. Do not forget to git add or remove files if they are changed before committing: ```bash -git add deps/openssl/config/archs -git add deps/openssl/openssl +git add -A deps/openssl/config/archs +git add -A deps/openssl/openssl git commit ``` @@ -118,16 +117,16 @@ The commit message can be written as (with the openssl version set to the relevant value): ```text -deps: update archs files for openssl-3.0.16 +deps: update archs files for openssl- After an OpenSSL source update, all the config files need to be regenerated and committed by: $ make -C deps/openssl/config - $ git add deps/openssl/config/archs - $ git add deps/openssl/openssl + $ git add -A deps/openssl/config/archs + $ git add -A deps/openssl/openssl $ git commit ``` -Finally, build Node.js and run the tests. +Finally, build Node.js with the bundled OpenSSL and run the tests. [update-openssl-action]: ../../../.github/workflows/update-openssl.yml