projects/aports·blob master · refs

355 lines · 10.0 KiB

1# Contributor: Jose-Luis Rivas <[email protected]>
2# Contributor: Jakub Jirutka <[email protected]>
3# Contributor: Dave Esaias <[email protected]>
4# Contributor: Tadahisa Kamijo <[email protected]>
5# Contributor: Eivind Uggedal <[email protected]>
6# Maintainer: Jakub Jirutka <[email protected]>
7pkgname=nodejs
8# Note: Update only to LTS versions! Other versions are supported only for
9# 9 months by upstream.
10pkgver=24.18.1
11pkgrel=5
12pkgdesc="JavaScript runtime built on V8 engine - LTS version"
13url="https://nodejs.org/"
14arch="all"
15license="MIT"
16depends="ca-certificates"
17makedepends="
18 ada-dev
19 brotli-dev
20 c-ares-dev
21 icu-dev
22 linux-headers
23 nghttp2-dev
24 openssl-dev
25 py3-jinja2
26 python3
27 samurai
28 simdjson-dev
29 simdutf-dev
30 sqlite-dev
31 zlib-dev
32 zstd-dev
33 "
34install="$pkgname.post-upgrade"
35subpackages="
36 $pkgname-dev
37 $pkgname-libs
38 $pkgname-doc
39 "
40provider_priority=100 # highest priority (other provider is nodejs-current)
41provides="nodejs-lts=$pkgver-r$pkgrel" # for backward compatibility
42replaces="nodejs-current nodejs-lts" # nodejs-lts for backward compatibility
43source="https://nodejs.org/dist/v$pkgver/node-v$pkgver.tar.gz
44 remove-unused-openssl-config.patch
45 v8-ppc64le-compat.patch
46 v8-riscv-trap-handler.patch
47 v8-no-static-zlib.patch
48 v8-disable-trap-handler-on-riscv-sv39.patch
49 v8-int64-lowering-reducer.patch
50 v8-ppc_vsx-inl.patch
51 $pkgname.pc.in
52 node_sea.patch
53 node_snapshotable.patch
54 "
55builddir="$srcdir/node-v$pkgver"
56
57# secfixes:
58# 24.18.1-r0:
59# - CVE-2026-56846
60# - CVE-2026-56848
61# - CVE-2026-58043
62# - CVE-2026-56850
63# - CVE-2026-58040
64# - CVE-2026-58041
65# - CVE-2026-58042
66# - CVE-2026-58045
67# - CVE-2026-56847
68# - CVE-2026-58039
69# - CVE-2026-58044
70# 24.17.0-r0:
71# - CVE-2026-48618
72# - CVE-2026-48933
73# - CVE-2026-48615
74# - CVE-2026-48619
75# - CVE-2026-48928
76# - CVE-2026-48930
77# - CVE-2026-48934
78# - CVE-2026-48937
79# - CVE-2026-48617
80# - CVE-2026-48931
81# - CVE-2026-48935
82# 24.14.1-r0:
83# - CVE-2026-21637
84# - CVE-2026-21710
85# - CVE-2026-21712
86# - CVE-2026-21713
87# - CVE-2026-21714
88# - CVE-2026-21715
89# - CVE-2026-21716
90# - CVE-2026-21717
91# 24.13.0-r0:
92# - CVE-2025-55132
93# - CVE-2025-55130
94# - CVE-2025-59466
95# - CVE-2025-55131
96# 22.16.0-r0:
97# - CVE-2025-23166
98# 22.13.1-r0:
99# - CVE-2025-23083
100# - CVE-2025-23084
101# - CVE-2025-23085
102# - CVE-2025-22150
103# 20.15.1-r0:
104# - CVE-2024-22018
105# - CVE-2024-22020
106# - CVE-2024-36137
107# 20.12.1-r0:
108# - CVE-2024-27982
109# - CVE-2024-27983
110# 18.18.2-r0:
111# - CVE-2023-45143
112# - CVE-2023-38552
113# - CVE-2023-39333
114# 18.17.1-r0:
115# - CVE-2023-32002
116# - CVE-2023-32006
117# - CVE-2023-32559
118# 18.14.1-r0:
119# - CVE-2023-23918
120# - CVE-2023-23919
121# - CVE-2023-23920
122# - CVE-2023-23936
123# - CVE-2023-24807
124# 18.12.1-r0:
125# - CVE-2022-3602
126# - CVE-2022-3786
127# - CVE-2022-43548
128# 16.17.1-r0:
129# - CVE-2022-32213
130# - CVE-2022-32214
131# - CVE-2022-32215
132# - CVE-2022-35255
133# - CVE-2022-35256
134# 16.13.2-r0:
135# - CVE-2021-44531
136# - CVE-2021-44532
137# - CVE-2021-44533
138# - CVE-2022-21824
139# 14.18.1-r0:
140# - CVE-2021-22959
141# - CVE-2021-22960
142# 14.17.6-r0:
143# - CVE-2021-37701
144# - CVE-2021-37712
145# - CVE-2021-37713
146# - CVE-2021-39134
147# - CVE-2021-39135
148# 14.17.5-r0:
149# - CVE-2021-3672
150# - CVE-2021-22931
151# - CVE-2021-22939
152# 14.17.4-r0:
153# - CVE-2021-22930
154# 14.16.1-r0:
155# - CVE-2020-7774
156# 14.16.0-r0:
157# - CVE-2021-22883
158# - CVE-2021-22884
159# 14.15.5-r0:
160# - CVE-2021-21148
161# 14.15.4-r0:
162# - CVE-2020-8265
163# - CVE-2020-8287
164# 14.15.1-r0:
165# - CVE-2020-8277
166# 12.18.4-r0:
167# - CVE-2020-8201
168# - CVE-2020-8252
169# 12.18.0-r0:
170# - CVE-2020-8172
171# - CVE-2020-11080
172# - CVE-2020-8174
173# 12.15.0-r0:
174# - CVE-2019-15606
175# - CVE-2019-15605
176# - CVE-2019-15604
177# 10.16.3-r0:
178# - CVE-2019-9511
179# - CVE-2019-9512
180# - CVE-2019-9513
181# - CVE-2019-9514
182# - CVE-2019-9515
183# - CVE-2019-9516
184# - CVE-2019-9517
185# - CVE-2019-9518
186# 10.15.3-r0:
187# - CVE-2019-5737
188# 10.14.0-r0:
189# - CVE-2018-12121
190# - CVE-2018-12122
191# - CVE-2018-12123
192# - CVE-2018-0735
193# - CVE-2018-0734
194# 8.11.4-r0:
195# - CVE-2018-12115
196# 8.11.3-r0:
197# - CVE-2018-7167
198# - CVE-2018-7161
199# - CVE-2018-1000168
200# 8.11.0-r0:
201# - CVE-2018-7158
202# - CVE-2018-7159
203# - CVE-2018-7160
204# 8.9.3-r0:
205# - CVE-2017-15896
206# - CVE-2017-15897
207# 6.11.5-r0:
208# - CVE-2017-14919
209# 6.11.1-r0:
210# - CVE-2017-1000381
211# 0:
212# - CVE-2021-43803
213# - CVE-2022-32212
214# - CVE-2023-44487
215# - CVE-2024-36138
216# - CVE-2024-37372
217
218prepare() {
219 default_prepare
220
221 # Remove bundled dependencies that we're not using.
222 #
223 # NOTE: nghttp3 and ngtcp2 are only used when building with OpenSSL
224 # that supports QUIC. After the QUIC support is added to openssl, add
225 # options --shared-nghttp3 and --shared-ngtcp2.
226 #
227 # NOTE: All bundled dependencies are described in
228 # doc/contributing/maintaining/maintaining-dependencies.md.
229 rm -rf deps/ada \
230 deps/brotli \
231 deps/cares \
232 deps/corepack \
233 deps/nghttp2 \
234 deps/nghttp3 \
235 deps/ngtcp2 \
236 deps/openssl \
237 deps/simdjson \
238 deps/simdutf \
239 deps/sqlite \
240 deps/v8/third_party/jinja2 \
241 deps/zlib \
242 deps/zstd \
243 tools/inspector_protocol/jinja2
244}
245
246build() {
247 # Add defines recommended in libuv readme.
248 local common_flags="-D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
249 # Disable use of OpenSSL ENGINE API - it's deprecated since OpenSSL 3.0
250 # (https://issues.redhat.com/browse/RHEL-33743).
251 common_flags="$common_flags -DOPENSSL_NO_ENGINE"
252
253 # -Os overwrites the optimizations enabled by BUILDTYPE=Release.
254 # Compiling with O2 instead of Os increases binary size by ~10%
255 # (53.1 MiB -> 58.6 MiB), but also increases performance by ~20%
256 # according to v8/web-tooling-benchmark. Node.js is quite huge anyway;
257 # there are better options for size constrained environments.
258 export CFLAGS="${CFLAGS/-Os} $common_flags"
259 export CXXFLAGS="${CXXFLAGS/-Os} $common_flags"
260 export CPPFLAGS="${CPPFLAGS/-Os} $common_flags"
261
262 # When building shared libnode.so, the resulting package size is +15 %
263 # (~8 MiB), so we rather build it twice to keep the node binary smaller
264 # (there are currently no packages using libnode.so).
265 if ! [ -x out/node ]; then
266 msg 'Building node binary'
267 _build
268 cp out/Release/node out/
269 fi
270
271 msg 'Building libnode.so'
272 _build --shared
273 cp out/Release/lib/libnode.so* out/Release/
274
275 sed "s/@VERSION@/$pkgver/" "$srcdir"/$pkgname.pc.in > out/Release/$pkgname.pc
276}
277
278_build() {
279 # NOTE: We use bundled libuv because they don't care much about backward
280 # compatibility and it has happened several times in past that we
281 # couldn't upgrade nodejs package in stable branches to fix CVEs due to
282 # libuv incompatibility.
283 #
284 # NOTE: We don't package the bundled npm - it's a separate project with
285 # its own release cycle and version numbering, so it's better to keep
286 # it in a standalone aport.
287 #
288 # TODO: Fix and enable corepack.
289 # TODO: Create aport for amaro and use --shared-builtin-amaro (amaro
290 # contains pre-built wasm binary).
291 python3 configure.py \
292 --prefix=/usr \
293 --use-prefix-to-find-headers \
294 --ninja \
295 --enable-lto \
296 --shared-ada \
297 --shared-brotli \
298 --shared-zlib \
299 --shared-openssl \
300 --shared-cares \
301 --shared-nghttp2 \
302 --shared-simdjson \
303 --shared-simdutf \
304 --shared-sqlite \
305 --shared-zstd \
306 --openssl-use-def-ca-store \
307 --with-icu-default-data-dir="$(icu-config --icudatadir)" \
308 --with-intl=system-icu \
309 --without-corepack \
310 --without-npm \
311 "$@"
312
313 make BUILDTYPE=Release
314}
315
316# TODO Run provided test suite.
317check() {
318 cd "$builddir"/out/Release
319
320 ./node -e 'console.log("Hello, world!")'
321 ./node -e "require('assert').equal(process.versions.node, '$pkgver')"
322 ./node -e 'require("assert").equal(
323 Buffer.from(Buffer.from("foo").toString("base64"), "base64").toString("ascii"),
324 "foo")'
325}
326
327package() {
328 make DESTDIR="$pkgdir" install
329
330 # node binary built without libnode.so.
331 install -D -m755 out/node -t "$pkgdir"/usr/bin/
332
333 install -D -m644 out/Release/$pkgname.pc -t "$pkgdir"/usr/lib/pkgconfig/
334
335 (cd "$pkgdir"/usr/lib; ln -sf libnode.so.* libnode.so)
336}
337
338dev() {
339 provides="nodejs-lts-dev=$pkgver" # for backward compatibility
340 default_dev
341}
342
343sha512sums="
344a7fead0ffffe78be8338e725bccd577d6bd083d197a7fd46dd0b912dd72c60abf90e58248c40b541479157202597618a6e2e18b26c5584449e6e86b629f5fe3c node-v24.18.1.tar.gz
345f538042ce7830792c4aeb56e65a81c61a0accbb41794187548da40d654e284526683d920789fe88be4e57e6e61444349f42a617f0def05dd70f2394c1e64ff3b remove-unused-openssl-config.patch
346fc795e2e61d266d286350ec3e2f7df2e3a874df60325ad11af319c376fc35a71d2c21821171ac6f02c9c9b099c1de346c7447d791b28ea16b1db2ed53c7708db v8-ppc64le-compat.patch
3474ad794959735ad46653496e6026e6404356237a5b7c1911a5897dea6c9e1b5989e8506f0dcfc2d237f9d8d15938d6a20c05b018ccef78da043b92755b8911d10 v8-riscv-trap-handler.patch
3485cf9198a9c391248241aeb681e682d07e47500f30fd41f54970f49acbc096fdc25419f2a07d28bd701d227fd437ad669baa9d80cddf8aa5e69541697cf5b2496 v8-no-static-zlib.patch
349be11f111280f2f8af99dfdd56d23a5929bc77a19575d6166847ef31af9c1c79f65ba591644e15b95a35ff8dc763486d63b64825be71eb455eb0c90830a0c8092 v8-disable-trap-handler-on-riscv-sv39.patch
3502d8eb3297c095e361fa3c9d6711b113236adfd83a9bd44f54df5c727707c945b5eb87ff7d4fa91c1e2ba60e04839a59f6c1e376b5861d47a445000bd4ae69c4f v8-int64-lowering-reducer.patch
351fb91dfcbc255af41c8a7a7da19f95c8b183b785ab96157940f959a688a36773922596aad789854071c1fa9608f815be8ae8259c58e1763455249038d868530be v8-ppc_vsx-inl.patch
352f908fa93f6194ec4f6c5e9d76ed7c918721c7f5d46afcc12de1f84683c185401a27a174b7a7c6a76085a4d0826f964e7088bf5596d4e6901a15bf751846299a6 nodejs.pc.in
35330c8572aaa5c0caf53d42650ccc6dbb0614e81e709b8604ea0a592aa5ca60803bb901b94f1b1822c180cbf9c2e28c46b38d22206245b0507d320e97e5af3c9ed node_sea.patch
354f904dd76f8e13d15b553e2b9b0226f82f108afe592b11d61118f32e9a74e4375b1146855c96fce916c662a10e7ecf3e1e30e34e924ec01eda99d74b0cc748b34 node_snapshotable.patch
355"