diff options
| author | Jakub Jirutka <jakub@jirutka.cz> | 2016-11-26 13:10:07 +0100 |
|---|---|---|
| committer | Jakub Jirutka <jakub@jirutka.cz> | 2016-11-26 21:51:21 +0100 |
| commit | b4764acab0dbcfe9a5c218f5896f6fa44cfe780d (patch) | |
| tree | 6dfbb88ceda1dcb0009db0f88b8fc85d1ebb2b6a /main/nodejs | |
| parent | 542db78c772f2b063f778e0214e83ef5f8c7c893 (diff) | |
| download | aports-b4764acab0dbcfe9a5c218f5896f6fa44cfe780d.tar.bz2 aports-b4764acab0dbcfe9a5c218f5896f6fa44cfe780d.tar.xz | |
main/nodejs: use system-provided CA certificates
Diffstat (limited to 'main/nodejs')
| -rw-r--r-- | main/nodejs/APKBUILD | 23 | ||||
| -rw-r--r-- | main/nodejs/use-system-ca-certs.patch | 75 |
2 files changed, 92 insertions, 6 deletions
diff --git a/main/nodejs/APKBUILD b/main/nodejs/APKBUILD index 3bf31092b1..7b6f11b3aa 100644 --- a/main/nodejs/APKBUILD +++ b/main/nodejs/APKBUILD @@ -1,19 +1,27 @@ # Maintainer: Jose-Luis Rivas <ghostbar@riseup.net> pkgname=nodejs pkgver=6.7.0 -pkgrel=0 +pkgrel=1 pkgdesc="JavaScript runtime built on V8 engine" url="http://nodejs.org/" arch="all" license="MIT" # gold is needed for mksnapshot makedepends="python2 openssl-dev zlib-dev libuv-dev linux-headers paxmark - binutils-gold http-parser-dev" + binutils-gold http-parser-dev ca-certificates" subpackages="$pkgname-dev $pkgname-doc" replaces="nodejs-lts" -source="https://nodejs.org/dist/v$pkgver/node-v$pkgver.tar.gz" +source="https://nodejs.org/dist/v$pkgver/node-v$pkgver.tar.gz + use-system-ca-certs.patch" builddir="$srcdir/node-v$pkgver" +prepare() { + default_prepare || return 1 + + # Remove bundled CA certificates. + rm -f src/node_root_certs.h +} + build() { cd "$builddir" @@ -43,6 +51,9 @@ package() { done } -md5sums="a42b7ab2bcf5f8d94a432163d90f3026 node-v6.7.0.tar.gz" -sha256sums="02b8ee1719a11b9ab22bef9279519efaaf31dd0d39cba4c3a1176ccda400b8d6 node-v6.7.0.tar.gz" -sha512sums="3cd095adc0866b780519006098b434e3b126f67a453e44863c773829de4ce29f573d13efa1c50af001009bdb433728309ef7109e144517ffc5dd5e3251b1f511 node-v6.7.0.tar.gz" +md5sums="a42b7ab2bcf5f8d94a432163d90f3026 node-v6.7.0.tar.gz +14ce8e0fb44d5bf75974026900e0d8c2 use-system-ca-certs.patch" +sha256sums="02b8ee1719a11b9ab22bef9279519efaaf31dd0d39cba4c3a1176ccda400b8d6 node-v6.7.0.tar.gz +fcd2becd2cb9a62537ae11f51f448fd1061aaae17835bb0f2d2aa71bdf9652c0 use-system-ca-certs.patch" +sha512sums="3cd095adc0866b780519006098b434e3b126f67a453e44863c773829de4ce29f573d13efa1c50af001009bdb433728309ef7109e144517ffc5dd5e3251b1f511 node-v6.7.0.tar.gz +c540878495761f4c38f3cccd61da75fa5619637ba9887b7946964a7cef790178e26678fe0aabe400e32c8f0f65e97a519ceee1534bbf18a1a14bc6e9fe067637 use-system-ca-certs.patch" diff --git a/main/nodejs/use-system-ca-certs.patch b/main/nodejs/use-system-ca-certs.patch new file mode 100644 index 0000000000..014b1cedf1 --- /dev/null +++ b/main/nodejs/use-system-ca-certs.patch @@ -0,0 +1,75 @@ +From: Jakub Jirutka <jakub@jirutka.cz> +Date: Sat, 26 Nov 2016 01:32:00 +0200 +Subject: Use system-provided CA certificates instead of bundled ones + +Forwarded: need some feedback before submitting the matter upstream +Author: Jérémy Lal <kapouer@melix.org> +Last-Update: 2014-03-02 + +Modified 2014-05-02 by T.C. Hollingsworth <tchollingsworth@gmail.com> with the +correct path for Fedora + +Modified 2015-12-01 by Stephen Gallagher <sgallagh@redhat.com> to update for +Node.js 4.2 + +Modified 2016-03-04 by Stephen Gallagher <sgallagh@redhat.com> to update for +Node.js 5.4.1 + +Modified 2016-07-26 by Haikel Guemar <hguemar@fedoraproject.org> to update for +Node.js 4.4.7 + +Modified 2016-11-26 by Jakub Jirutka <jakub@jirutka.cz> for Alpine Linux + +--- a/src/node_crypto.cc ++++ b/src/node_crypto.cc +@@ -192,8 +192,8 @@ static X509_NAME *cnnic_ev_name = + + static Mutex* mutexes; + +-const char* const root_certs[] = { +-#include "node_root_certs.h" // NOLINT(build/include_order) ++const char* root_certs[] = { ++ NULL + }; + + X509_STORE* root_cert_store; +@@ -847,29 +847,17 @@ void SecureContext::AddRootCerts(const FunctionCallbackInfo<Value>& args) { + CHECK_EQ(sc->ca_store_, nullptr); + + if (!root_cert_store) { +- root_cert_store = X509_STORE_new(); +- +- for (size_t i = 0; i < arraysize(root_certs); i++) { +- BIO* bp = NodeBIO::NewFixed(root_certs[i], strlen(root_certs[i])); +- if (bp == nullptr) { +- return; +- } +- +- X509 *x509 = PEM_read_bio_X509(bp, nullptr, CryptoPemCallback, nullptr); +- if (x509 == nullptr) { +- BIO_free_all(bp); +- return; +- } +- +- X509_STORE_add_cert(root_cert_store, x509); +- +- BIO_free_all(bp); +- X509_free(x509); ++ if (SSL_CTX_load_verify_locations(sc->ctx_, "/etc/ssl/certs/ca-certificates.crt", NULL) == 1) { ++ root_cert_store = SSL_CTX_get_cert_store(sc->ctx_); ++ } else { ++ // empty store ++ root_cert_store = X509_STORE_new(); + } ++ } else { ++ SSL_CTX_set_cert_store(sc->ctx_, root_cert_store); + } + + sc->ca_store_ = root_cert_store; +- SSL_CTX_set_cert_store(sc->ctx_, sc->ca_store_); + } + + +-- +2.9.0 + |