From f205c376e7f96ec45be6bdc2f991b34ba58b5e98 Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Fri, 16 Oct 2026 15:46:35 +0200 Subject: [PATCH 1/7] build: remove default values for `libname` By setting a default value, we override the pkg-config value, which is inconsistent with the other `--shared-*` flags. Signed-off-by: Antoine du Hamel --- configure.py | 25 ------------------------- tools/nix/non-v8-deps-mock.nix | 5 +---- 2 files changed, 1 insertion(+), 29 deletions(-) diff --git a/configure.py b/configure.py index fb742692f530..020cb2c5c9ca 100755 --- a/configure.py +++ b/configure.py @@ -297,7 +297,6 @@ shared_optgroup.add_argument('--shared-abseil-libname', action='store', dest='shared_abseil_libname', - default=None, help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-abseil-libpath', @@ -319,7 +318,6 @@ shared_optgroup.add_argument('--shared-gtest-libname', action='store', dest='shared_gtest_libname', - default='gtest', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-gtest-libpath', @@ -341,7 +339,6 @@ shared_optgroup.add_argument('--shared-hdr-histogram-libname', action='store', dest='shared_hdr_histogram_libname', - default='hdr_histogram', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-hdr-histogram-libpath', @@ -363,7 +360,6 @@ shared_optgroup.add_argument('--shared-highway-libname', action='store', dest='shared_highway_libname', - default='hwy', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-highway-libpath', @@ -385,7 +381,6 @@ shared_optgroup.add_argument('--shared-http-parser-libname', action='store', dest='shared_http_parser_libname', - default='llhttp', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-http-parser-libpath', @@ -407,7 +402,6 @@ shared_optgroup.add_argument('--shared-libuv-libname', action='store', dest='shared_libuv_libname', - default='uv', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-libuv-libpath', @@ -429,7 +423,6 @@ shared_optgroup.add_argument('--shared-lief-libname', action='store', dest='shared_lief_libname', - default='LIEF', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-lief-libpath', @@ -451,7 +444,6 @@ shared_optgroup.add_argument('--shared-nbytes-libname', action='store', dest='shared_nbytes_libname', - default='nbytes', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-nbytes-libpath', @@ -473,7 +465,6 @@ shared_optgroup.add_argument('--shared-nghttp2-libname', action='store', dest='shared_nghttp2_libname', - default='nghttp2', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-nghttp2-libpath', @@ -495,7 +486,6 @@ shared_optgroup.add_argument('--shared-nghttp3-libname', action='store', dest='shared_nghttp3_libname', - default='nghttp3', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-nghttp3-libpath', @@ -517,7 +507,6 @@ shared_optgroup.add_argument('--shared-ngtcp2-libname', action='store', dest='shared_ngtcp2_libname', - default='ngtcp2', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-ngtcp2-libpath', @@ -539,7 +528,6 @@ shared_optgroup.add_argument('--shared-openssl-libname', action='store', dest='shared_openssl_libname', - default='crypto,ssl', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-openssl-libpath', @@ -562,7 +550,6 @@ shared_optgroup.add_argument('--shared-perfetto-libname', action='store', dest='shared_perfetto_libname', - default='perfetto', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-perfetto-libpath', @@ -584,7 +571,6 @@ shared_optgroup.add_argument('--shared-uvwasi-libname', action='store', dest='shared_uvwasi_libname', - default='uvwasi', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-uvwasi-libpath', @@ -606,7 +592,6 @@ shared_optgroup.add_argument('--shared-zlib-libname', action='store', dest='shared_zlib_libname', - default='z', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-zlib-libpath', @@ -628,7 +613,6 @@ shared_optgroup.add_argument('--shared-simdjson-libname', action='store', dest='shared_simdjson_libname', - default='simdjson', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-simdjson-libpath', @@ -651,7 +635,6 @@ shared_optgroup.add_argument('--shared-simdutf-libname', action='store', dest='shared_simdutf_libname', - default='simdutf', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-simdutf-libpath', @@ -673,7 +656,6 @@ shared_optgroup.add_argument('--shared-ada-libname', action='store', dest='shared_ada_libname', - default='ada', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-ada-libpath', @@ -695,7 +677,6 @@ shared_optgroup.add_argument('--shared-merve-libname', action='store', dest='shared_merve_libname', - default='merve', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-merve-libpath', @@ -717,7 +698,6 @@ shared_optgroup.add_argument('--shared-brotli-libname', action='store', dest='shared_brotli_libname', - default='brotlidec,brotlienc', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-brotli-libpath', @@ -739,7 +719,6 @@ shared_optgroup.add_argument('--shared-cares-libname', action='store', dest='shared_cares_libname', - default='cares', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-cares-libpath', @@ -761,7 +740,6 @@ shared_optgroup.add_argument('--shared-sqlite-libname', action='store', dest='shared_sqlite_libname', - default='sqlite3', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-sqlite-libpath', @@ -783,7 +761,6 @@ shared_optgroup.add_argument('--shared-ffi-libname', action='store', dest='shared_ffi_libname', - default='ffi', help='alternative libffi name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-ffi-libpath', @@ -805,7 +782,6 @@ shared_optgroup.add_argument('--shared-temporal_capi-libname', action='store', dest='shared_temporal_capi_libname', - default='temporal_capi', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-temporal_capi-libpath', @@ -827,7 +803,6 @@ shared_optgroup.add_argument('--shared-zstd-libname', action='store', dest='shared_zstd_libname', - default='zstd', help='alternative lib name to link to [default: %(default)s]') shared_optgroup.add_argument('--shared-zstd-libpath', diff --git a/tools/nix/non-v8-deps-mock.nix b/tools/nix/non-v8-deps-mock.nix index 19032dbeb79b..1d00810436a5 100644 --- a/tools/nix/non-v8-deps-mock.nix +++ b/tools/nix/non-v8-deps-mock.nix @@ -59,10 +59,7 @@ symlinkJoin (finalAttrs: { "--without-ffi" "--without-ssl" ] - ++ (lib.concatMap (sharedLibName: [ - "--shared-${sharedLibName}" - "--shared-${sharedLibName}-libname=" - ]) (builtins.attrNames sharedLibsToMock)); + ++ map (sharedLibName: "--shared-${sharedLibName}") (builtins.attrNames sharedLibsToMock); tests.pkg-config = testers.hasPkgConfigModules { package = finalAttrs.finalPackage; From e781847a3706f9bef133cb51cf87f8cf04cfbc83 Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Fri, 16 Oct 2026 20:56:34 +0200 Subject: [PATCH 2/7] to be upstreamed! fix uvwasi.pc --- tools/nix/sharedLibDeps.nix | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/tools/nix/sharedLibDeps.nix b/tools/nix/sharedLibDeps.nix index 41a406237daa..cedf5379c174 100644 --- a/tools/nix/sharedLibDeps.nix +++ b/tools/nix/sharedLibDeps.nix @@ -19,7 +19,6 @@ nghttp2 simdjson simdutf - uvwasi zlib zstd ; @@ -28,6 +27,17 @@ hdr-histogram = pkgs.hdrhistogram_c; highway = pkgs.libhwy; http-parser = pkgs.llhttp; + uvwasi = pkgs.uvwasi.overrideAttrs (old: { + patches = old.patches ++ [ + (pkgs.fetchpatch2 { + url = "https://github.com/nodejs/uvwasi/pull/326.patch"; + hash = "sha256-PPr62+qycCSfr1/JWXhJS6X8vW10ea2b4L4361tdwgE="; + }) + ]; + + buildInputs = []; + propagatedBuildInputs = old.buildInputs; + }); } // (pkgs.lib.optionalAttrs withLief { inherit (pkgs) lief; From 28ee209c2579cb9d235ebaac8519a711a684b24c Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Sat, 17 Oct 2026 20:30:33 +0200 Subject: [PATCH 3/7] Apply changes discussed during review --- configure.py | 8 +++++--- tools/nix/pkgs.nix | 17 +++++++++++++++++ tools/nix/sharedLibDeps.nix | 8 +++++--- 3 files changed, 27 insertions(+), 6 deletions(-) diff --git a/configure.py b/configure.py index 020cb2c5c9ca..6d184caae0e1 100755 --- a/configure.py +++ b/configure.py @@ -2197,12 +2197,14 @@ def configure_library(lib, output, pkgname=None, libraries_key='libraries'): elif pkg_libpath: libraries += [pkg_libpath] - default_libs = getattr(options, shared_lib + '_libname') + user_provided_value = getattr(options, shared_lib + '_libname') - if default_libs: - libraries += [f'-l{l}' for l in default_libs.split(',')] + if user_provided_value is not None: + libraries += [f'-l{l}' for l in user_provided_value.split(',')] elif pkg_libs: libraries += pkg_libs.split() + else: + libraries += [f'-l{l}' for l in (pkgname or lib)] def configure_v8(o, configs): diff --git a/tools/nix/pkgs.nix b/tools/nix/pkgs.nix index 52ef60358b58..a65ee6f7b2c3 100644 --- a/tools/nix/pkgs.nix +++ b/tools/nix/pkgs.nix @@ -15,6 +15,23 @@ if builtins.currentSystem == "x86_64-darwin" then else nixpkgs // { + # TODO: remove this when the pin we use has picked up https://boringssl-review.googlesource.com/c/boringssl/+/104208 + boringssl = + let + inherit (nixpkgs) boringssl lib writeTextFile; + in + writeTextFile { + name = "openssl.pc"; + destination = "/lib/pkgconfig/openssl.pc"; + text = '' + Name: BoringSSL + Description: BoringSSL cryptography library + Version: ${boringssl.version} + Libs: -L${lib.getLib boringssl} -lcrypto -lssl + Cflags: -I${lib.getInclude boringssl} + ''; + }; + # TODO: remove pin once https://github.com/mozilla/sccache/issues/2869 is resolved sccache = nixpkgs.callPackage (builtins.fetchurl { url = "${repo}/raw/aff8a0b28396750446e5537a96461bc4facdb287/pkgs/by-name/sc/sccache/package.nix"; diff --git a/tools/nix/sharedLibDeps.nix b/tools/nix/sharedLibDeps.nix index cedf5379c174..6c9324f6c9ee 100644 --- a/tools/nix/sharedLibDeps.nix +++ b/tools/nix/sharedLibDeps.nix @@ -27,15 +27,17 @@ hdr-histogram = pkgs.hdrhistogram_c; highway = pkgs.libhwy; http-parser = pkgs.llhttp; + + # TODO: remove this override once the pin we use has picked up https://github.com/NixOS/nixpkgs/pull/575002 uvwasi = pkgs.uvwasi.overrideAttrs (old: { patches = old.patches ++ [ (pkgs.fetchpatch2 { - url = "https://github.com/nodejs/uvwasi/pull/326.patch"; - hash = "sha256-PPr62+qycCSfr1/JWXhJS6X8vW10ea2b4L4361tdwgE="; + url = "https://github.com/nodejs/uvwasi/commit/fe602a6911207efd8dcfc070a752bcf76813c978.patch?full_index=1"; + hash = "sha256-MyFvRuEhcqZR+Bz2pY9vani8U1iyQrDeni2kKKnJGEI="; }) ]; - buildInputs = []; + buildInputs = [ ]; propagatedBuildInputs = old.buildInputs; }); } From c0c14d2afe813531ab62bc8b0cbdc3ed7bbf8c01 Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Sat, 17 Oct 2026 20:57:21 +0200 Subject: [PATCH 4/7] fixup! Apply changes discussed during review --- configure.py | 4 +++- tools/nix/pkgs.nix | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/configure.py b/configure.py index 6d184caae0e1..a8d30cf07237 100755 --- a/configure.py +++ b/configure.py @@ -2204,7 +2204,9 @@ def configure_library(lib, output, pkgname=None, libraries_key='libraries'): elif pkg_libs: libraries += pkg_libs.split() else: - libraries += [f'-l{l}' for l in (pkgname or lib)] + pkg = (pkgname or lib) + if not isinstance(pkg, list): pkg += [pkg] + libraries += [f'-l{l}' for l in pkg] def configure_v8(o, configs): diff --git a/tools/nix/pkgs.nix b/tools/nix/pkgs.nix index a65ee6f7b2c3..57d437ca788b 100644 --- a/tools/nix/pkgs.nix +++ b/tools/nix/pkgs.nix @@ -21,7 +21,7 @@ else inherit (nixpkgs) boringssl lib writeTextFile; in writeTextFile { - name = "openssl.pc"; + name = "boringssl.pc"; destination = "/lib/pkgconfig/openssl.pc"; text = '' Name: BoringSSL From 03dddf66f34ded87626b50d6ce494c009a39679a Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Sat, 17 Oct 2026 21:01:14 +0200 Subject: [PATCH 5/7] fixup! Apply changes discussed during review --- configure.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/configure.py b/configure.py index a8d30cf07237..5ca47fad0c8b 100755 --- a/configure.py +++ b/configure.py @@ -2203,10 +2203,9 @@ def configure_library(lib, output, pkgname=None, libraries_key='libraries'): libraries += [f'-l{l}' for l in user_provided_value.split(',')] elif pkg_libs: libraries += pkg_libs.split() - else: + elif pkg_libs is None: pkg = (pkgname or lib) - if not isinstance(pkg, list): pkg += [pkg] - libraries += [f'-l{l}' for l in pkg] + libraries += [f'-l{l}' for l in pkg] if isinstance(pkg, list) else f'-l${pkg}' def configure_v8(o, configs): From dd9dd9a63d2b4135723d078ba52a2e4963ce9632 Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Sat, 17 Oct 2026 22:26:27 +0200 Subject: [PATCH 6/7] fixup! Apply changes discussed during review --- tools/nix/pkgs.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/nix/pkgs.nix b/tools/nix/pkgs.nix index 57d437ca788b..3b86947993cd 100644 --- a/tools/nix/pkgs.nix +++ b/tools/nix/pkgs.nix @@ -21,14 +21,14 @@ else inherit (nixpkgs) boringssl lib writeTextFile; in writeTextFile { - name = "boringssl.pc"; + inherit (boringssl) name; destination = "/lib/pkgconfig/openssl.pc"; text = '' Name: BoringSSL Description: BoringSSL cryptography library Version: ${boringssl.version} - Libs: -L${lib.getLib boringssl} -lcrypto -lssl - Cflags: -I${lib.getInclude boringssl} + Libs: -L${lib.getLib boringssl}/lib -lcrypto -lssl + Cflags: -I${lib.getInclude boringssl}/include ''; }; From c927bf45807da9959412f6b81fe741be6283fe6d Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Sun, 18 Oct 2026 16:54:11 +0200 Subject: [PATCH 7/7] build: do not pass vendored openssl headers on `--shared-openssl` builds Signed-off-by: Antoine du Hamel --- common.gypi | 1 + configure.py | 12 ++++++++---- test/addons/openssl-binding/binding.gyp | 7 +++++-- test/addons/openssl-get-ssl-ctx/binding.gyp | 5 ++++- test/addons/openssl-providers/binding.gyp | 5 ++++- 5 files changed, 22 insertions(+), 8 deletions(-) diff --git a/common.gypi b/common.gypi index e70270a793b4..eb1046d57061 100644 --- a/common.gypi +++ b/common.gypi @@ -26,6 +26,7 @@ 'node_module_version%': '', 'node_with_ltcg%': '', 'node_shared_openssl%': 'false', + 'node_shared_openssl_include_dirs%': [], 'openssl_is_boringssl%': 'false', 'node_tag%': '', diff --git a/configure.py b/configure.py index 5ca47fad0c8b..2f47e2a04e48 100755 --- a/configure.py +++ b/configure.py @@ -2170,19 +2170,21 @@ def configure_napi(output): version = getnapibuildversion.get_napi_version() output['variables']['napi_build_version'] = version -def configure_library(lib, output, pkgname=None, libraries_key='libraries'): +def configure_library(lib, output, pkgname=None, libraries_key='libraries', include_key='include_dirs'): shared_lib = 'shared_' + lib output['variables']['node_' + shared_lib] = b(getattr(options, shared_lib)) + libraries = output[libraries_key] if libraries_key in output else output['variables'][libraries_key] + include_dirs = output[include_key] if include_key in output else output['variables'][include_key] if getattr(options, shared_lib): (pkg_libs, pkg_cflags, pkg_libpath, _) = pkg_config(pkgname or lib) if options.__dict__[shared_lib + '_includes']: - output['include_dirs'] += [options.__dict__[shared_lib + '_includes']] + include_dirs += [options.__dict__[shared_lib + '_includes']] elif pkg_cflags: stripped_flags = [flag.strip() for flag in pkg_cflags.split('-I')] - output['include_dirs'] += [flag for flag in stripped_flags if flag] + include_dirs += [flag for flag in stripped_flags if flag] # libpath needs to be provided ahead libraries if options.__dict__[shared_lib + '_libpath']: @@ -2354,7 +2356,9 @@ def without_ssl_error(option): if options.openssl_is_fips and not options.shared_openssl: variables['node_fipsinstall'] = b(True) - configure_library('openssl', o) + o['variables']['node_shared_openssl_include_dirs'] = [] + configure_library('openssl', o, include_key='node_shared_openssl_include_dirs') + o['include_dirs'] += o['variables']['node_shared_openssl_include_dirs'] o['variables']['openssl_version'] = get_openssl_version(o) o['variables']['openssl_is_boringssl'] = get_openssl_is_boringssl(o) diff --git a/test/addons/openssl-binding/binding.gyp b/test/addons/openssl-binding/binding.gyp index 9d2f9bfd34fb..2a2c317d20b5 100644 --- a/test/addons/openssl-binding/binding.gyp +++ b/test/addons/openssl-binding/binding.gyp @@ -17,15 +17,18 @@ }], [ '"<(aix_variant_name)"!="OS400"', { # Not `OS400`(IBM i) 'sources': ['binding.cc'], - 'include_dirs': ['../../../deps/openssl/openssl/include'], }], ], }, { 'sources': ['binding.cc'], - 'include_dirs': ['../../../deps/openssl/openssl/include'], }], ], }], + ['node_shared_openssl=="false"', { + 'include_dirs': ['../../../deps/openssl/openssl/include'], + }, { + 'include_dirs': ['<@(node_shared_openssl_include_dirs)'], + }], ['OS=="mac"', { 'xcode_settings': { 'OTHER_CFLAGS+': [ diff --git a/test/addons/openssl-get-ssl-ctx/binding.gyp b/test/addons/openssl-get-ssl-ctx/binding.gyp index a405ba25bbe7..92468c21832c 100644 --- a/test/addons/openssl-get-ssl-ctx/binding.gyp +++ b/test/addons/openssl-get-ssl-ctx/binding.gyp @@ -17,12 +17,15 @@ }], [ '"<(aix_variant_name)"!="OS400"', { # Not `OS400`(IBM i) 'sources': ['binding.cc'], - 'include_dirs': ['../../../deps/openssl/openssl/include'], }], ], }, { 'sources': ['binding.cc'], + }], + ['node_shared_openssl=="false"', { 'include_dirs': ['../../../deps/openssl/openssl/include'], + }, { + 'include_dirs': ['<@(node_shared_openssl_include_dirs)'], }], ], }], diff --git a/test/addons/openssl-providers/binding.gyp b/test/addons/openssl-providers/binding.gyp index 9d2f9bfd34fb..eb2b354d9e45 100644 --- a/test/addons/openssl-providers/binding.gyp +++ b/test/addons/openssl-providers/binding.gyp @@ -17,12 +17,15 @@ }], [ '"<(aix_variant_name)"!="OS400"', { # Not `OS400`(IBM i) 'sources': ['binding.cc'], - 'include_dirs': ['../../../deps/openssl/openssl/include'], }], ], }, { 'sources': ['binding.cc'], + }], + ['node_shared_openssl=="false"', { 'include_dirs': ['../../../deps/openssl/openssl/include'], + }, { + 'include_dirs': ['<@(node_shared_openssl_include_dirs)'], }], ], }],