commit eb2face3eabd44c693b39d4dbfdc246043f4df41 Author: CentOS Sources Date: Thu Mar 4 10:19:13 2021 -0500 import nodejs-10.24.0-1.module+el8.3.0+10166+b07ac28e diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..eb6e49f --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +SOURCES/icu4c-64_2-src.tgz +SOURCES/node-v10.24.0-stripped.tar.gz diff --git a/.nodejs.metadata b/.nodejs.metadata new file mode 100644 index 0000000..fac6a06 --- /dev/null +++ b/.nodejs.metadata @@ -0,0 +1,2 @@ +3127155ecf2b75ab4835f501b7478e39c07bb852 SOURCES/icu4c-64_2-src.tgz +be0e0b385a852c376f452b3d94727492e05407e4 SOURCES/node-v10.24.0-stripped.tar.gz diff --git a/SOURCES/0001-Disable-running-gyp-on-shared-deps.patch b/SOURCES/0001-Disable-running-gyp-on-shared-deps.patch new file mode 100644 index 0000000..51d360f --- /dev/null +++ b/SOURCES/0001-Disable-running-gyp-on-shared-deps.patch @@ -0,0 +1,31 @@ +From 2cd4c12776af3da588231d3eb498e6451c30eae5 Mon Sep 17 00:00:00 2001 +From: Zuzana Svetlikova +Date: Thu, 27 Apr 2017 14:25:42 +0200 +Subject: [PATCH] Disable running gyp on shared deps + +Signed-off-by: rpm-build +--- + Makefile | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/Makefile b/Makefile +index 73feb4c..45bbceb 100644 +--- a/Makefile ++++ b/Makefile +@@ -123,10 +123,9 @@ with-code-cache: + test-code-cache: with-code-cache + $(PYTHON) tools/test.py $(PARALLEL_ARGS) --mode=$(BUILDTYPE_LOWER) code-cache + +-out/Makefile: common.gypi deps/uv/uv.gyp deps/http_parser/http_parser.gyp \ +- deps/zlib/zlib.gyp deps/v8/gypfiles/toolchain.gypi \ +- deps/v8/gypfiles/features.gypi deps/v8/gypfiles/v8.gyp node.gyp \ +- config.gypi ++out/Makefile: common.gypi deps/http_parser/http_parser.gyp \ ++ deps/v8/gypfiles/toolchain.gypi deps/v8/gypfiles/features.gypi \ ++ deps/v8/gypfiles/v8.gyp node.gyp config.gypi + $(PYTHON) tools/gyp_node.py -f make + + config.gypi: configure configure.py +-- +2.26.2 + diff --git a/SOURCES/0002-Suppress-NPM-message-to-run-global-update.patch b/SOURCES/0002-Suppress-NPM-message-to-run-global-update.patch new file mode 100644 index 0000000..e1b721f --- /dev/null +++ b/SOURCES/0002-Suppress-NPM-message-to-run-global-update.patch @@ -0,0 +1,84 @@ +From e7afb2d6e2a6c8f9c9c32e12a10c3c5c4902a251 Mon Sep 17 00:00:00 2001 +From: Stephen Gallagher +Date: Tue, 1 May 2018 08:05:30 -0400 +Subject: [PATCH] Suppress NPM message to run global update + +Signed-off-by: Stephen Gallagher +Signed-off-by: rpm-build +--- + deps/npm/bin/npm-cli.js | 54 ----------------------------------------- + 1 file changed, 54 deletions(-) + +diff --git a/deps/npm/bin/npm-cli.js b/deps/npm/bin/npm-cli.js +index c0d9be0..0f0892e 100755 +--- a/deps/npm/bin/npm-cli.js ++++ b/deps/npm/bin/npm-cli.js +@@ -71,65 +71,11 @@ + npm.command = 'help' + } + +- var isGlobalNpmUpdate = conf.global && ['install', 'update'].includes(npm.command) && npm.argv.includes('npm') +- + // now actually fire up npm and run the command. + // this is how to use npm programmatically: + conf._exit = true + npm.load(conf, function (er) { + if (er) return errorHandler(er) +- if ( +- !isGlobalNpmUpdate && +- npm.config.get('update-notifier') && +- !unsupported.checkVersion(process.version).unsupported +- ) { +- const pkg = require('../package.json') +- let notifier = require('update-notifier')({pkg}) +- const isCI = require('ci-info').isCI +- if ( +- notifier.update && +- notifier.update.latest !== pkg.version && +- !isCI +- ) { +- const color = require('ansicolors') +- const useColor = npm.config.get('color') +- const useUnicode = npm.config.get('unicode') +- const old = notifier.update.current +- const latest = notifier.update.latest +- let type = notifier.update.type +- if (useColor) { +- switch (type) { +- case 'major': +- type = color.red(type) +- break +- case 'minor': +- type = color.yellow(type) +- break +- case 'patch': +- type = color.green(type) +- break +- } +- } +- const changelog = `https://github.com/npm/cli/releases/tag/v${latest}` +- notifier.notify({ +- message: `New ${type} version of ${pkg.name} available! ${ +- useColor ? color.red(old) : old +- } ${useUnicode ? '→' : '->'} ${ +- useColor ? color.green(latest) : latest +- }\n` + +- `${ +- useColor ? color.yellow('Changelog:') : 'Changelog:' +- } ${ +- useColor ? color.cyan(changelog) : changelog +- }\n` + +- `Run ${ +- useColor +- ? color.green(`npm install -g ${pkg.name}`) +- : `npm i -g ${pkg.name}` +- } to update!` +- }) +- } +- } + npm.commands[npm.command](npm.argv, function (err) { + // https://genius.com/Lin-manuel-miranda-your-obedient-servant-lyrics + if ( +-- +2.26.2 + diff --git a/SOURCES/0003-build-auto-load-ICU-data-from-with-icu-default-data-.patch b/SOURCES/0003-build-auto-load-ICU-data-from-with-icu-default-data-.patch new file mode 100644 index 0000000..14d39ae --- /dev/null +++ b/SOURCES/0003-build-auto-load-ICU-data-from-with-icu-default-data-.patch @@ -0,0 +1,122 @@ +From 0028cc74dac4dd24b8599ade85cb49fdafa9f559 Mon Sep 17 00:00:00 2001 +From: Stephen Gallagher +Date: Fri, 6 Dec 2019 16:40:25 -0500 +Subject: [PATCH] build: auto-load ICU data from --with-icu-default-data-dir + +When compiled with `--with-intl=small` and +`--with-icu-default-data-dir=PATH`, Node.js will use PATH as a +fallback location for the ICU data. + +We will first perform an access check using fopen(PATH, 'r') to +ensure that the file is readable. If it is, we'll set the +icu_data_directory and proceed. There's a slight overhead for the +fopen() check, but it should be barely measurable. + +This will be useful for Linux distribution packagers who want to +be able to ship a minimal node binary in a container image but +also be able to add on the full i18n support where needed. With +this patch, it becomes possible to ship the interpreter as +/usr/bin/node in one package for the distribution and to ship the +data files in another package (without a strict dependency +between the two). This means that users of the distribution will +not need to explicitly direct Node.js to locate the ICU data. It +also means that in environments where full internationalization is +not required, they do not need to carry the extra content (with +the associated storage costs). + +Refs: https://github.com/nodejs/node/issues/3460 + +Signed-off-by: Stephen Gallagher +Signed-off-by: rpm-build +--- + configure.py | 9 +++++++++ + node.gypi | 7 +++++++ + src/node.cc | 20 ++++++++++++++++++++ + 3 files changed, 36 insertions(+) + +diff --git a/configure.py b/configure.py +index 89f7bf5..d611a88 100755 +--- a/configure.py ++++ b/configure.py +@@ -433,6 +433,14 @@ intl_optgroup.add_option('--with-icu-source', + 'the icu4c source archive. ' + 'v%d.x or later recommended.' % icu_versions['minimum_icu']) + ++intl_optgroup.add_option('--with-icu-default-data-dir', ++ action='store', ++ dest='with_icu_default_data_dir', ++ help='Path to the icuXXdt{lb}.dat file. If unspecified, ICU data will ' ++ 'only be read if the NODE_ICU_DATA environment variable or the ' ++ '--icu-data-dir runtime argument is used. This option has effect ' ++ 'only when Node.js is built with --with-intl=small-icu.') ++ + parser.add_option('--with-ltcg', + action='store_true', + dest='with_ltcg', +@@ -1359,6 +1367,7 @@ def configure_intl(o): + locs.add('root') # must have root + o['variables']['icu_locales'] = string.join(locs,',') + # We will check a bit later if we can use the canned deps/icu-small ++ o['variables']['icu_default_data'] = options.with_icu_default_data_dir or '' + elif with_intl == 'full-icu': + # full ICU + o['variables']['v8_enable_i18n_support'] = 1 +diff --git a/node.gypi b/node.gypi +index 466a174..65b97d6 100644 +--- a/node.gypi ++++ b/node.gypi +@@ -113,6 +113,13 @@ + 'conditions': [ + [ 'icu_small=="true"', { + 'defines': [ 'NODE_HAVE_SMALL_ICU=1' ], ++ 'conditions': [ ++ [ 'icu_default_data!=""', { ++ 'defines': [ ++ 'NODE_ICU_DEFAULT_DATA_DIR="<(icu_default_data)"', ++ ], ++ }], ++ ], + }]], + }], + [ 'node_use_bundled_v8=="true" and \ +diff --git a/src/node.cc b/src/node.cc +index 7c01187..c9840e3 100644 +--- a/src/node.cc ++++ b/src/node.cc +@@ -92,6 +92,7 @@ + + #if defined(NODE_HAVE_I18N_SUPPORT) + #include ++#include + #endif + + #if defined(LEAK_SANITIZER) +@@ -2643,6 +2644,25 @@ void Init(std::vector* argv, + // If the parameter isn't given, use the env variable. + if (per_process_opts->icu_data_dir.empty()) + SafeGetenv("NODE_ICU_DATA", &per_process_opts->icu_data_dir); ++ ++#ifdef NODE_ICU_DEFAULT_DATA_DIR ++ // If neither the CLI option nor the environment variable was specified, ++ // fall back to the configured default ++ if (per_process_opts->icu_data_dir.empty()) { ++ // Check whether the NODE_ICU_DEFAULT_DATA_DIR contains the right data ++ // file and can be read. ++ static const char full_path[] = ++ NODE_ICU_DEFAULT_DATA_DIR "/" U_ICUDATA_NAME ".dat"; ++ ++ FILE* f = fopen(full_path, "rb"); ++ ++ if (f != nullptr) { ++ fclose(f); ++ per_process_opts->icu_data_dir = NODE_ICU_DEFAULT_DATA_DIR; ++ } ++ } ++#endif // NODE_ICU_DEFAULT_DATA_DIR ++ + // Initialize ICU. + // If icu_data_dir is empty here, it will load the 'minimal' data. + if (!i18n::InitializeICUDirectory(per_process_opts->icu_data_dir)) { +-- +2.26.2 + diff --git a/SOURCES/0004-CVE-2020-7774-nodejs-y18n-prototype-pollution-vulnerability.patch b/SOURCES/0004-CVE-2020-7774-nodejs-y18n-prototype-pollution-vulnerability.patch new file mode 100644 index 0000000..88a9d75 --- /dev/null +++ b/SOURCES/0004-CVE-2020-7774-nodejs-y18n-prototype-pollution-vulnerability.patch @@ -0,0 +1,13 @@ +diff --git a/deps/npm/node_modules/y18n/index.js b/deps/npm/node_modules/y18n/index.js +index d720681628..727362aac0 100644 +--- a/deps/npm/node_modules/y18n/index.js ++++ b/deps/npm/node_modules/y18n/index.js +@@ -11,7 +11,7 @@ function Y18N (opts) { + this.fallbackToLanguage = typeof opts.fallbackToLanguage === 'boolean' ? opts.fallbackToLanguage : true + + // internal stuff. +- this.cache = {} ++ this.cache = Object.create(null) + this.writeQueue = [] + } + diff --git a/SOURCES/btest402.js b/SOURCES/btest402.js new file mode 100644 index 0000000..277319c --- /dev/null +++ b/SOURCES/btest402.js @@ -0,0 +1,151 @@ +// Copyright (C) 2014 IBM Corporation and Others. All Rights Reserved. +// This file is part of the Node.JS ICU enablement work +// https://github.com/joyent/node/pull/7719 +// and is under the same license. +// +// This is a very, very, very basic test of es402 +// +// URL: https://github.com/srl295/btest402 +// Author: Steven R. Loomis +// +// for a complete test, see http://test262.ecmascript.org +// +// Usage: node btest402.js + +try { + console.log("You have console.log."); +} catch(e) { + // this works on d8 + console = { log: print }; + console.log("Now you have console.log."); +} + +function runbtest() { + var summary = {}; + + try { + var i = Intl; + summary.haveIntl = true; + console.log("+ Congrats, you have the Intl object."); + } catch(e) { + console.log("You don't have the Intl object: " + e); + } + + if(summary.haveIntl) { + var locs = [ "en", "mt", "ja","tlh"]; + var d = new Date(196400000); + for ( var n=0; n 0 ) { + lsummary.haveSlo = true; + } + } catch (e) { + console.log("SLO err: " + e); + } + var dstr = "ERR"; + try { + lsummary.dstr = d.toLocaleString(loc,{month: "long",day:"numeric",weekday:"long",year:"numeric"}); + console.log(" date: (supported:"+sl+") " + lsummary.dstr); + } catch (e) { + console.log(" Date Format err: " + e); + } + try { + new Intl.v8BreakIterator(); + console.log(" Intl.v8BreakIterator:" + + Intl.v8BreakIterator.supportedLocalesOf(loc) + " Supported, first()==" + + new Intl.v8BreakIterator(loc).first() ); + lsummary.brkOk = true; + } catch ( e) { + console.log(" Intl.v8BreakIterator error (NOT part of EcmaScript402): " + e); + } + console.log(); + } + } + + // print summary + console.log(); + console.log("--------- Analysis ---------"); + stxt = ""; + if( summary.haveIntl ) { + console.log("* You have the 'Intl' object. Congratulations! You have the possibility of being EcmaScript 402 compliant."); + stxt += "Have Intl, "; + + if ( !summary.en.haveSlo ) { + stxt += "Date:no EN, "; + console.log("* English isn't a supported language by the date formatter. Perhaps the data isn't installed properly?"); + } + if ( !summary.tlh.haveSlo ) { + stxt += "Date:no 'tlh', "; + console.log("* Klingon isn't a supported language by the date formatter. It is without honor!"); + } + // now, what is it actually saying + if( summary.en.dstr.indexOf("1970") == -1) { + stxt += "Date:bad 'en', "; + console.log("* the English date format text looks bad to me. Doesn't even have the year."); + } else { + if( summary.en.dstr.indexOf("Jan") == -1) { + stxt += "Date:bad 'en', "; + console.log("* The English date format text looks bad to me. Doesn't have the right month."); + } + } + + if( summary.mt.dstr == summary.en.dstr ) { + stxt += "Date:'mt'=='en', "; + console.log("* The English and Maltese look the same to me. Probably a 'small' build."); + } else if( summary.mt.dstr.indexOf("1970") == -1) { + stxt += "Date:bad 'mt', "; + console.log("* the Maltese date format text looks bad to me. Doesn't even have the year. (This data is missing from the Chromium ICU build)"); + } else { + if( summary.mt.dstr.indexOf("Jann") == -1) { + stxt += "Date:bad 'mt', "; + console.log("* The Maltese date format text looks bad to me. Doesn't have the right month. (This data is missing from the Chromium ICU build)"); + } + } + + if ( !summary.ja.haveSlo ) { + stxt += "Date:no 'ja', "; + console.log("* Japanese isn't a supported language by the date formatter. Could be a 'small' build."); + } else { + if( summary.ja.dstr.indexOf("1970") == -1) { + stxt += "Date:bad 'ja', "; + console.log("* the Japanese date format text looks bad to me. Doesn't even have the year."); + } else { + if( summary.ja.dstr.indexOf("日") == -1) { + stxt += "Date:bad 'ja', "; + console.log("* The Japanese date format text looks bad to me."); + } + } + } + if ( summary.en.brkOk ) { + stxt += "FYI: v8Brk:have 'en', "; + console.log("* You have Intl.v8BreakIterator support. (Note: not part of ES402.)"); + } + } else { + console.log("* You don't have the 'Intl' object. You aren't EcmaScript 402 compliant."); + stxt += " NO Intl. "; + } + + // 1-liner. + console.log(); + console.log("----------------"); + console.log( "SUMMARY:" + stxt ); +} + +var dorun = true; + +try { + if(btest402_noautorun) { + dorun = false; + } +} catch(e) {} + +if(dorun) { + console.log("Running btest.."); + runbtest(); +} diff --git a/SOURCES/nodejs-tarball.sh b/SOURCES/nodejs-tarball.sh new file mode 100755 index 0000000..d333607 --- /dev/null +++ b/SOURCES/nodejs-tarball.sh @@ -0,0 +1,189 @@ +#!/bin/sh +# Uses Argbash to generate command argument parsing. To update +# arguments, make sure to call +# `argbash nodejs-tarball.sh -o nodejs-tarball.sh` + +# ARG_POSITIONAL_SINGLE([version],[Node.js release version],[""]) +# ARG_DEFAULTS_POS([]) +# ARG_HELP([Tool to aid in Node.js packaging of new releases]) +# ARGBASH_GO() +# needed because of Argbash --> m4_ignore([ +### START OF CODE GENERATED BY Argbash v2.8.1 one line above ### +# Argbash is a bash code generator used to get arguments parsing right. +# Argbash is FREE SOFTWARE, see https://argbash.io for more info + + +die() +{ + local _ret=$2 + test -n "$_ret" || _ret=1 + test "$_PRINT_HELP" = yes && print_help >&2 + echo "$1" >&2 + exit ${_ret} +} + + +begins_with_short_option() +{ + local first_option all_short_options='h' + first_option="${1:0:1}" + test "$all_short_options" = "${all_short_options/$first_option/}" && return 1 || return 0 +} + +# THE DEFAULTS INITIALIZATION - POSITIONALS +_positionals=() +_arg_version="" +# THE DEFAULTS INITIALIZATION - OPTIONALS + + +print_help() +{ + printf '%s\n' "Tool to aid in Node.js packaging of new releases" + printf 'Usage: %s [-h|--help] []\n' "$0" + printf '\t%s\n' ": Node.js release version (default: '""')" + printf '\t%s\n' "-h, --help: Prints help" +} + + +parse_commandline() +{ + _positionals_count=0 + while test $# -gt 0 + do + _key="$1" + case "$_key" in + -h|--help) + print_help + exit 0 + ;; + -h*) + print_help + exit 0 + ;; + *) + _last_positional="$1" + _positionals+=("$_last_positional") + _positionals_count=$((_positionals_count + 1)) + ;; + esac + shift + done +} + + +handle_passed_args_count() +{ + test "${_positionals_count}" -le 1 || _PRINT_HELP=yes die "FATAL ERROR: There were spurious positional arguments --- we expect between 0 and 1, but got ${_positionals_count} (the last one was: '${_last_positional}')." 1 +} + + +assign_positional_args() +{ + local _positional_name _shift_for=$1 + _positional_names="_arg_version " + + shift "$_shift_for" + for _positional_name in ${_positional_names} + do + test $# -gt 0 || break + eval "$_positional_name=\${1}" || die "Error during argument parsing, possibly an Argbash bug." 1 + shift + done +} + +parse_commandline "$@" +handle_passed_args_count +assign_positional_args 1 "${_positionals[@]}" + +# OTHER STUFF GENERATED BY Argbash + +### END OF CODE GENERATED BY Argbash (sortof) ### ]) +# [ <-- needed because of Argbash + + +set -e + +echo $_arg_version + +if [ x$_arg_version != x ]; then + version=$_arg_version +else + version=$(rpm -q --specfile --qf='%{version}\n' nodejs.spec | head -n1) +fi + +rm -f node-v${version}.tar.gz node-v${version}-stripped.tar.gz +wget http://nodejs.org/dist/v${version}/node-v${version}.tar.gz \ + http://nodejs.org/dist/v${version}/SHASUMS256.txt +sha256sum -c SHASUMS256.txt --ignore-missing +tar -zxf node-v${version}.tar.gz +rm -rf node-v${version}/deps/openssl +tar -zcf node-v${version}-stripped.tar.gz node-v${version} + +# Download the matching version of ICU +rm -f icu4c*-src.tgz icu.md5 +ICUMD5=$(cat node-v${version}/tools/icu/current_ver.dep |jq -r '.[0].md5') +wget $(cat node-v${version}/tools/icu/current_ver.dep |jq -r '.[0].url') +ICUTARBALL=$(ls -1 icu4c*-src.tgz) +echo "$ICUMD5 $ICUTARBALL" > icu.md5 +md5sum -c icu.md5 +rm -f icu.md5 SHASUMS256.txt + +rhpkg new-sources node-v${version}-stripped.tar.gz icu4c*-src.tgz + +rm -f node-v${version}.tar.gz + +set +e + +# Determine the bundled versions of the various packages +echo "Bundled software versions" +echo "-------------------------" +echo +echo "libnode shared object version" +echo "=========================" +grep "define NODE_MODULE_VERSION" node-v${version}/src/node_version.h +echo +echo "V8" +echo "=========================" +grep "define V8_MAJOR_VERSION" node-v${version}/deps/v8/include/v8-version.h +grep "define V8_MINOR_VERSION" node-v${version}/deps/v8/include/v8-version.h +grep "define V8_BUILD_NUMBER" node-v${version}/deps/v8/include/v8-version.h +grep "define V8_PATCH_LEVEL" node-v${version}/deps/v8/include/v8-version.h +echo +echo "c-ares" +echo "=========================" +grep "define ARES_VERSION_MAJOR" node-v${version}/deps/cares/include/ares_version.h +grep "define ARES_VERSION_MINOR" node-v${version}/deps/cares/include/ares_version.h +grep "define ARES_VERSION_PATCH" node-v${version}/deps/cares/include/ares_version.h +echo +echo "http-parser" +echo "=========================" +grep "define HTTP_PARSER_VERSION_MAJOR" node-v${version}/deps/http_parser/http_parser.h +grep "define HTTP_PARSER_VERSION_MINOR" node-v${version}/deps/http_parser/http_parser.h +grep "define HTTP_PARSER_VERSION_PATCH" node-v${version}/deps/http_parser/http_parser.h +echo +echo "libuv" +echo "=========================" +grep "define UV_VERSION_MAJOR" node-v${version}/deps/uv/include/uv/version.h +grep "define UV_VERSION_MINOR" node-v${version}/deps/uv/include/uv/version.h +grep "define UV_VERSION_PATCH" node-v${version}/deps/uv/include/uv/version.h +echo +echo "nghttp2" +echo "=========================" +grep "define NGHTTP2_VERSION " node-v${version}/deps/nghttp2/lib/includes/nghttp2/nghttp2ver.h +echo +echo "ICU" +echo "=========================" +grep "url" node-v${version}/tools/icu/current_ver.dep +echo +echo "punycode" +echo "=========================" +grep "'version'" node-v${version}/lib/punycode.js +echo +echo "npm" +echo "=========================" +grep "\"version\":" node-v${version}/deps/npm/package.json +echo +echo "Make sure these versions match what is in the RPM spec file" + +rm -rf node-v${version} +# ] <-- needed because of Argbash diff --git a/SOURCES/nodejs_native.attr b/SOURCES/nodejs_native.attr new file mode 100644 index 0000000..0527af6 --- /dev/null +++ b/SOURCES/nodejs_native.attr @@ -0,0 +1,2 @@ +%__nodejs_native_requires %{_rpmconfigdir}/nodejs_native.req +%__nodejs_native_path ^/usr/lib.*/node_modules/.*\\.node$ diff --git a/SOURCES/npmrc b/SOURCES/npmrc new file mode 100644 index 0000000..10437ca --- /dev/null +++ b/SOURCES/npmrc @@ -0,0 +1 @@ +prefix=/usr/local diff --git a/SPECS/nodejs.spec b/SPECS/nodejs.spec new file mode 100644 index 0000000..7021757 --- /dev/null +++ b/SPECS/nodejs.spec @@ -0,0 +1,894 @@ +%global with_debug 0 + +# PowerPC, s390x and aarch64 segfault during Debug builds +# https://github.com/nodejs/node/issues/20642 +%ifarch %{power64} s390x aarch64 +%global with_debug 0 +%endif + +# bundle dependencies that are not available as Fedora modules +%bcond_with bootstrap + +# == Master Relase == +# This is used by both the nodejs package and the npm subpackage that +# has a separate version - the name is special so that rpmdev-bumpspec +# will bump this rather than adding .1 to the end. +%global baserelease 1 + +%{?!_pkgdocdir:%global _pkgdocdir %{_docdir}/%{name}-%{version}} + +# == Node.js Version == +# Note: Fedora should only ship LTS versions of Node.js (currently expected +# to be major versions with even numbers). The odd-numbered versions are new +# feature releases that are only supported for nine months, which is shorter +# than a Fedora release lifecycle. +%global nodejs_epoch 1 +%global nodejs_major 10 +%global nodejs_minor 24 +%global nodejs_patch 0 +%global nodejs_abi %{nodejs_major}.%{nodejs_minor} +# nodejs_soversion - from NODE_MODULE_VERSION in src/node_version.h +%global nodejs_soversion 64 +%global nodejs_version %{nodejs_major}.%{nodejs_minor}.%{nodejs_patch} +%global nodejs_release %{baserelease} + +%global nodejs_datadir %{_datarootdir}/nodejs + +# == Bundled Dependency Versions == +# v8 - from deps/v8/include/v8-version.h +# Epoch is set to ensure clean upgrades from the old v8 package +%global v8_epoch 1 +%global v8_major 6 +%global v8_minor 8 +%global v8_build 275 +%global v8_patch 32 +# V8 presently breaks ABI at least every x.y release while never bumping SONAME +%global v8_abi %{v8_major}.%{v8_minor} +%global v8_version %{v8_major}.%{v8_minor}.%{v8_build}.%{v8_patch} +%global v8_release %{nodejs_epoch}.%{nodejs_major}.%{nodejs_minor}.%{nodejs_patch}.%{nodejs_release} + +# c-ares - from deps/cares/include/ares_version.h +# https://github.com/nodejs/node/pull/9332 +%global c_ares_major 1 +%global c_ares_minor 15 +%global c_ares_patch 0 +%global c_ares_version %{c_ares_major}.%{c_ares_minor}.%{c_ares_patch} + +# http-parser - from deps/http_parser/http_parser.h +%global http_parser_major 2 +%global http_parser_minor 9 +%global http_parser_patch 4 +%global http_parser_version %{http_parser_major}.%{http_parser_minor}.%{http_parser_patch} + +# libuv - from deps/uv/include/uv/version.h +%global libuv_major 1 +%global libuv_minor 34 +%global libuv_patch 2 +%global libuv_version %{libuv_major}.%{libuv_minor}.%{libuv_patch} + +# nghttp2 - from deps/nghttp2/lib/includes/nghttp2/nghttp2ver.h +%global nghttp2_major 1 +%global nghttp2_minor 41 +%global nghttp2_patch 0 +%global nghttp2_version %{nghttp2_major}.%{nghttp2_minor}.%{nghttp2_patch} + +# ICU - from tools/icu/current_ver.dep +%global icu_major 64 +%global icu_minor 2 +%global icu_version %{icu_major}.%{icu_minor} + +%global icudatadir %{nodejs_datadir}/icudata +%{!?little_endian: %global little_endian %(%{__python3} -c "import sys;print (0 if sys.byteorder=='big' else 1)")} +# " this line just fixes syntax highlighting for vim that is confused by the above and continues literal + + +# punycode - from lib/punycode.js +# Note: this was merged into the mainline since 0.6.x +# Note: this will be unmerged in an upcoming major release +%global punycode_major 2 +%global punycode_minor 1 +%global punycode_patch 0 +%global punycode_version %{punycode_major}.%{punycode_minor}.%{punycode_patch} + +# npm - from deps/npm/package.json +%global npm_epoch 1 +%global npm_major 6 +%global npm_minor 14 +%global npm_patch 11 +%global npm_version %{npm_major}.%{npm_minor}.%{npm_patch} + +# In order to avoid needing to keep incrementing the release version for the +# main package forever, we will just construct one for npm that is guaranteed +# to increment safely. Changing this can only be done during an update when the +# base npm version number is increasing. +%global npm_release %{nodejs_epoch}.%{nodejs_major}.%{nodejs_minor}.%{nodejs_patch}.%{nodejs_release} + +# brotli - from deps/brotli/c/common/version.h +# v10.x doesn't have --shared-brotli configure option, so we have to bundle it +%global brotli_major 1 +%global brotli_minor 0 +%global brotli_patch 7 +%global brotli_version %{brotli_major}.%{brotli_minor}.%{brotli_patch} + +Name: nodejs +Epoch: %{nodejs_epoch} +Version: %{nodejs_version} +Release: %{nodejs_release}%{?dist} +Summary: JavaScript runtime +License: MIT and ASL 2.0 and ISC and BSD +Group: Development/Languages +URL: http://nodejs.org/ + +ExclusiveArch: %{nodejs_arches} + +# nodejs bundles openssl, but we use the system version in Fedora +# because openssl contains prohibited code, we remove openssl completely from +# the tarball, using the script in Source100 +Source0: node-v%{nodejs_version}-stripped.tar.gz +Source1: npmrc +Source2: btest402.js +Source3: https://github.com/unicode-org/icu/releases/download/release-%{icu_major}-%{icu_minor}/icu4c-%{icu_major}_%{icu_minor}-src.tgz +Source100: %{name}-tarball.sh + +# The native module Requires generator remains in the nodejs SRPM, so it knows +# the nodejs and v8 versions. The remainder has migrated to the +# nodejs-packaging SRPM. +Source7: nodejs_native.attr + +# Disable running gyp on bundled deps we don't use +Patch1: 0001-Disable-running-gyp-on-shared-deps.patch + +# Suppress the message from npm to run `npm -g update npm` +# This does bad things on an RPM-managed npm. +Patch2: 0002-Suppress-NPM-message-to-run-global-update.patch + +# Upstream patch to enable auto-detection of full ICU data +# https://github.com/nodejs/node/pull/30825 +Patch3: 0003-build-auto-load-ICU-data-from-with-icu-default-data-.patch + +# CVE-2020-7774 +Patch4: 0004-CVE-2020-7774-nodejs-y18n-prototype-pollution-vulnerability.patch + +BuildRequires: make +BuildRequires: python2-devel +BuildRequires: python3-devel +BuildRequires: zlib-devel +BuildRequires: gcc >= 6.3.0 +BuildRequires: gcc-c++ >= 6.3.0 +# needed to generate bundled provides for npm dependencies +# https://src.fedoraproject.org/rpms/nodejs/pull-request/2 +# https://pagure.io/nodejs-packaging/pull-request/10 +BuildRequires: nodejs-packaging +BuildRequires: chrpath +BuildRequires: libatomic + +%if %{with bootstrap} +Provides: bundled(http-parser) = %{http_parser_version} +Provides: bundled(libuv) = %{libuv_version} +Provides: bundled(nghttp2) = %{nghttp2_version} +%else +BuildRequires: systemtap-sdt-devel +BuildRequires: libuv-devel >= 1:%{libuv_version} +Requires: libuv >= 1:%{libuv_version} +BuildRequires: libnghttp2-devel >= %{nghttp2_version} +Requires: libnghttp2 >= %{nghttp2_version} +BuildRequires: http-parser-devel >= %{http_parser_version} +Requires: http-parser >= %{http_parser_version} + +%endif + +BuildRequires: openssl-devel + +# we need the system certificate store +Requires: ca-certificates + +# Pull in the full-icu data by default +Recommends: nodejs-full-i18n%{?_isa} = %{nodejs_epoch}:%{version}-%{release} + +# we need ABI virtual provides where SONAMEs aren't enough/not present so deps +# break when binary compatibility is broken +Provides: nodejs(abi) = %{nodejs_abi} +Provides: nodejs(abi%{nodejs_major}) = %{nodejs_abi} +Provides: nodejs(v8-abi) = %{v8_abi} +Provides: nodejs(v8-abi%{v8_major}) = %{v8_abi} + +# this corresponds to the "engine" requirement in package.json +Provides: nodejs(engine) = %{nodejs_version} + +# Node.js currently has a conflict with the 'node' package in Fedora +# The ham-radio group has agreed to rename their binary for us, but +# in the meantime, we're setting an explicit Conflicts: here +Conflicts: node <= 0.3.2-12 + +# The punycode module was absorbed into the standard library in v0.6. +# It still exists as a seperate package for the benefit of users of older +# versions. Since we've never shipped anything older than v0.10 in Fedora, +# we don't need the seperate nodejs-punycode package, so we Provide it here so +# dependent packages don't need to override the dependency generator. +# See also: RHBZ#11511811 +# UPDATE: punycode will be deprecated and so we should unbundle it in Node v8 +# and use upstream module instead +# https://github.com/nodejs/node/commit/29e49fc286080215031a81effbd59eac092fff2f +Provides: nodejs-punycode = %{punycode_version} +Provides: npm(punycode) = %{punycode_version} + +# Node.js has forked c-ares from upstream in an incompatible way, so we need +# to carry the bundled version internally. +# See https://github.com/nodejs/node/commit/766d063e0578c0f7758c3a965c971763f43fec85 +Provides: bundled(c-ares) = %{c_ares_version} + +# Node.js is closely tied to the version of v8 that is used with it. It makes +# sense to use the bundled version because upstream consistently breaks ABI +# even in point releases. Node.js upstream has now removed the ability to build +# against a shared system version entirely. +# See https://github.com/nodejs/node/commit/d726a177ed59c37cf5306983ed00ecd858cfbbef +Provides: bundled(v8) = %{v8_version} + +# Node.js is bound to a specific version of ICU which may not match the OS +# We cannot pin the OS to this version of ICU because every update includes +# an ABI-break, so we'll use the bundled copy. +Provides: bundled(icu) = %{icu_version} + +# Make sure we keep NPM up to date when we update Node.js +%if 0%{?rhel} +# EPEL doesn't support Recommends, so make it strict +Requires: npm = %{npm_epoch}:%{npm_version}-%{npm_release}%{?dist} +%else +Recommends: npm = %{npm_epoch}:%{npm_version}-%{npm_release}%{?dist} +%endif + +# Provide bundled brotli until we can build it with system package +Provides: bundled(brotli) = %{brotli_version} + +%description +Node.js is a platform built on Chrome's JavaScript runtime +for easily building fast, scalable network applications. +Node.js uses an event-driven, non-blocking I/O model that +makes it lightweight and efficient, perfect for data-intensive +real-time applications that run across distributed devices. + + +%package devel +Summary: JavaScript runtime - development headers +Group: Development/Languages +Requires: %{name}%{?_isa} = %{epoch}:%{nodejs_version}-%{nodejs_release}%{?dist} +Requires: openssl-devel%{?_isa} +Requires: zlib-devel%{?_isa} +Requires: nodejs-packaging + +%if %{with bootstrap} +# deps are bundled +%else +Requires: http-parser-devel%{?_isa} +Requires: libuv-devel%{?_isa} +%endif + +%description devel +Development headers for the Node.js JavaScript runtime. + + +%package full-i18n +Summary: Non-English locale data for Node.js +Requires: %{name}%{?_isa} = %{nodejs_epoch}:%{nodejs_version}-%{nodejs_release}%{?dist} + +%description full-i18n +Optional data files to provide full-icu support for Node.js. Remove this +package to save space if non-English locales are not needed. + + +%package -n npm +Summary: Node.js Package Manager +Epoch: %{npm_epoch} +Version: %{npm_version} +Release: %{npm_release}%{?dist} + +# We used to ship npm separately, but it is so tightly integrated with Node.js +# (and expected to be present on all Node.js systems) that we ship it bundled +# now. +Obsoletes: npm < 0:3.5.4-6 +Provides: npm = %{npm_epoch}:%{npm_version} +Requires: nodejs = %{nodejs_epoch}:%{nodejs_version}-%{nodejs_release}%{?dist} + +# Do not add epoch to the virtual NPM provides or it will break +# the automatic dependency-generation script. +Provides: npm(npm) = %{npm_version} + +%description -n npm +npm is a package manager for node.js. You can use it to install and publish +your node programs. It manages dependencies and does other cool stuff. + + +%package docs +Summary: Node.js API documentation +Group: Documentation +BuildArch: noarch + +# We don't require that the main package be installed to +# use the docs, but if it is installed, make sure the +# version always matches +Conflicts: %{name} > %{nodejs_epoch}:%{nodejs_version}-%{nodejs_release}%{?dist} +Conflicts: %{name} < %{nodejs_epoch}:%{nodejs_version}-%{nodejs_release}%{?dist} + +%description docs +The API documentation for the Node.js JavaScript runtime. + + +%prep +%autosetup -p1 -n node-v%{nodejs_version} + +# remove bundled dependencies that we aren't building +rm -rf deps/zlib + +# Replace any instances of unversioned python' with python2 +pathfix.py -i %{__python2} -pn $(find -type f ! -name "*.js") +find . -type f -exec sed -i "s~/usr\/bin\/env python~/usr/bin/python2~" {} \; +find . -type f -exec sed -i "s~/usr\/bin\/python\W~/usr/bin/python2~" {} \; +sed -i "s~python~python2~" $(find . -type f | grep "gyp$") +sed -i "s~usr\/bin\/python2~usr\/bin\/python3~" ./deps/v8/tools/gen-inlining-tests.py +sed -i "s~usr\/bin\/python.*$~usr\/bin\/python2~" ./deps/v8/tools/mb/mb_unittest.py +find . -type f -exec sed -i "s~python -c~python2 -c~" {} \; +sed -i "s~which('python')~which('python2')~" configure + +%build + +%ifarch s390 s390x %{arm} %ix86 +# Decrease debuginfo verbosity to reduce memory consumption during final +# library linking +%global optflags %(echo %{optflags} | sed 's/-g /-g1 /') +%endif + +export RHEL_ALLOW_PYTHON2_FOR_BUILD=1 +export CC='%{__cc}' +export CXX='%{__cxx}' + +# build with debugging symbols and add defines from libuv (#892601) +# Node's v8 breaks with GCC 6 because of incorrect usage of methods on +# NULL objects. We need to pass -fno-delete-null-pointer-checks +export CFLAGS='%{optflags} \ + -D_LARGEFILE_SOURCE \ + -D_FILE_OFFSET_BITS=64 \ + -DZLIB_CONST \ + -fno-delete-null-pointer-checks' +export CXXFLAGS='%{optflags} \ + -D_LARGEFILE_SOURCE \ + -D_FILE_OFFSET_BITS=64 \ + -DZLIB_CONST \ + -fno-delete-null-pointer-checks' + +# Explicit new lines in C(XX)FLAGS can break naive build scripts +export CFLAGS="$(echo ${CFLAGS} | tr '\n\\' ' ')" +export CXXFLAGS="$(echo ${CXXFLAGS} | tr '\n\\' ' ')" + +export LDFLAGS="%{build_ldflags}" + +%if %{with bootstrap} +./configure --prefix=%{_prefix} \ + --shared-openssl \ + --shared-zlib \ + --without-dtrace \ + --with-intl=small-icu \ + --openssl-use-def-ca-store +%else +./configure --prefix=%{_prefix} \ + --shared-openssl \ + --shared-zlib \ + --shared-libuv \ + --shared-http-parser \ + --shared-nghttp2 \ + --with-dtrace \ + --with-intl=small-icu \ + --with-icu-default-data-dir=%{icudatadir} \ + --openssl-use-def-ca-store +%endif + +%if %{?with_debug} == 1 +# Setting BUILDTYPE=Debug builds both release and debug binaries +make BUILDTYPE=Debug %{?_smp_mflags} +%else +make BUILDTYPE=Release %{?_smp_mflags} +%endif + +# Extract the ICU data and convert it to the appropriate endianness +pushd deps/ +tar xfz %SOURCE3 + +pushd icu/source + +mkdir -p converted +%if 0%{?little_endian} +# The little endian data file is included in the ICU sources +install -Dpm0644 data/in/icudt%{icu_major}l.dat converted/ + +%else +# For the time being, we need to build ICU and use the included `icupkg` tool +# to convert the little endian data file into a big-endian one. +# At some point in the future, ICU releases will start including both data +# files and we should switch to those. +mkdir -p data/out/tmp + +%configure +%make_build + +icu_root=$(pwd) +LD_LIBRARY_PATH=./lib ./bin/icupkg -tb data/in/icudt%{icu_major}l.dat \ + converted/icudt%{icu_major}b.dat +%endif + +popd # icu/source +popd # deps + + +%install +export RHEL_ALLOW_PYTHON2_FOR_BUILD=1 + +rm -rf %{buildroot} + +./tools/install.py install %{buildroot} %{_prefix} + +# Set the binary permissions properly +chmod 0755 %{buildroot}/%{_bindir}/node +chrpath --delete %{buildroot}%{_bindir}/node + +%if %{?with_debug} == 1 +# Install the debug binary and set its permissions +install -Dpm0755 out/Debug/node %{buildroot}/%{_bindir}/node_g +%endif + +# own the sitelib directory +mkdir -p %{buildroot}%{_prefix}/lib/node_modules + +# ensure Requires are added to every native module that match the Provides from +# the nodejs build in the buildroot +install -Dpm0644 %{SOURCE7} %{buildroot}%{_rpmconfigdir}/fileattrs/nodejs_native.attr +cat << EOF > %{buildroot}%{_rpmconfigdir}/nodejs_native.req +#!/bin/sh +echo 'nodejs(abi%{nodejs_major}) >= %nodejs_abi' +echo 'nodejs(v8-abi%{v8_major}) >= %v8_abi' +EOF +chmod 0755 %{buildroot}%{_rpmconfigdir}/nodejs_native.req + +# install documentation +mkdir -p %{buildroot}%{_pkgdocdir}/html +cp -pr doc/* %{buildroot}%{_pkgdocdir}/html +rm -f %{buildroot}%{_pkgdocdir}/html/nodejs.1 + +# node-gyp needs common.gypi too +mkdir -p %{buildroot}%{_datadir}/node +cp -p common.gypi %{buildroot}%{_datadir}/node + +# Install the GDB init tool into the documentation directory +mv %{buildroot}/%{_datadir}/doc/node/gdbinit %{buildroot}/%{_pkgdocdir}/gdbinit + +# install NPM docs to mandir +mkdir -p %{buildroot}%{_mandir} \ + %{buildroot}%{_pkgdocdir}/npm + +cp -pr deps/npm/man/* %{buildroot}%{_mandir}/ +rm -rf %{buildroot}%{_prefix}/lib/node_modules/npm/man +ln -sf %{_mandir} %{buildroot}%{_prefix}/lib/node_modules/npm/man + +# Install Gatsby HTML documentation to %{_pkgdocdir} +cp -pr deps/npm/docs %{buildroot}%{_pkgdocdir}/npm/ +rm -rf %{buildroot}%{_prefix}/lib/node_modules/npm/docs +ln -sf %{_pkgdocdir}/npm %{buildroot}%{_prefix}/lib/node_modules/npm/docs + +# Node tries to install some python files into a documentation directory +# (and not the proper one). Remove them for now until we figure out what to +# do with them. +rm -f %{buildroot}/%{_defaultdocdir}/node/lldb_commands.py \ + %{buildroot}/%{_defaultdocdir}/node/lldbinit + +# Some NPM bundled deps are executable but should not be. This causes +# unnecessary automatic dependencies to be added. Make them not executable. +# Skip the npm bin directory or the npm binary will not work. +find %{buildroot}%{_prefix}/lib/node_modules/npm \ + -not -path "%{buildroot}%{_prefix}/lib/node_modules/npm/bin/*" \ + -executable -type f \ + -exec chmod -x {} \; + +# The above command is a little overzealous. Add a few permissions back. +chmod 0755 %{buildroot}%{_prefix}/lib/node_modules/npm/node_modules/npm-lifecycle/node-gyp-bin/node-gyp +chmod 0755 %{buildroot}%{_prefix}/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js + +# Drop the NPM default configuration in place +mkdir -p %{buildroot}%{_sysconfdir} +cp %{SOURCE1} %{buildroot}%{_sysconfdir}/npmrc + +# NPM upstream expects it to be in /usr/etc/npmrc, so we'll put a symlink here +# This is done in the interests of keeping /usr read-only. +mkdir -p %{buildroot}%{_prefix}/etc +ln -s %{_sysconfdir}/npmrc %{buildroot}%{_prefix}/etc/npmrc + +# Install the full-icu data files +install -Dpm0644 -t %{buildroot}%{icudatadir} deps/icu/source/converted/* + + +%check +# Fail the build if the versions don't match +%{buildroot}/%{_bindir}/node -e "require('assert').equal(process.versions.node, '%{nodejs_version}')" +%{buildroot}/%{_bindir}/node -e "require('assert').equal(process.versions.v8.replace(/-node\.\d+$/, ''), '%{v8_version}')" +%{buildroot}/%{_bindir}/node -e "require('assert').equal(process.versions.ares.replace(/-DEV$/, ''), '%{c_ares_version}')" + +# Ensure we have punycode and that the version matches +%{buildroot}/%{_bindir}/node -e "require(\"assert\").equal(require(\"punycode\").version, '%{punycode_version}')" + +# Ensure we have npm and that the version matches +NODE_PATH=%{buildroot}%{_prefix}/lib/node_modules:%{buildroot}%{_prefix}/lib/node_modules/npm/node_modules %{buildroot}/%{_bindir}/node -e "require(\"assert\").equal(require(\"npm\").version, '%{npm_version}')" + +# Make sure i18n support is working +NODE_PATH=%{buildroot}%{_prefix}/lib/node_modules:%{buildroot}%{_prefix}/lib/node_modules/npm/node_modules %{buildroot}/%{_bindir}/node --icu-data-dir=%{buildroot}%{icudatadir} %{SOURCE2} + + +%pretrans -n npm -p +-- Remove all of the symlinks from the bundled npm node_modules directory +-- This scriptlet can be removed in Fedora 31 +base_path = "%{_prefix}/lib/node_modules/npm/node_modules/" +d_st = posix.stat(base_path) +if d_st then + for f in posix.files(base_path) do + path = base_path..f + st = posix.stat(path) + if st and st.type == "link" then + os.remove(path) + end + end +end + +-- Replace the npm man directory with a symlink +-- Drop this scriptlet when F31 is EOL +path = "%{_prefix}/lib/node_modules/npm/man" +st = posix.stat(path) +if st and st.type == "directory" then + status = os.rename(path, path .. ".rpmmoved") + if not status then + suffix = 0 + while not status do + suffix = suffix + 1 + status = os.rename(path .. ".rpmmoved", path .. ".rpmmoved." .. suffix) + end + os.rename(path, path .. ".rpmmoved") + end +end + + +%files +%{_bindir}/node +%dir %{_prefix}/lib/node_modules +%dir %{_datadir}/node +%dir %{_datadir}/systemtap +%dir %{_datadir}/systemtap/tapset +%{_datadir}/systemtap/tapset/node.stp + +%if %{with bootstrap} +# no dtrace +%else +%dir %{_usr}/lib/dtrace +%{_usr}/lib/dtrace/node.d +%endif + +%{_rpmconfigdir}/fileattrs/nodejs_native.attr +%{_rpmconfigdir}/nodejs_native.req +%license LICENSE +%doc AUTHORS CHANGELOG.md COLLABORATOR_GUIDE.md GOVERNANCE.md README.md +%doc %{_mandir}/man1/node.1* + + +%files devel +%if %{?with_debug} == 1 +%{_bindir}/node_g +%endif +%{_includedir}/node +%{_datadir}/node/common.gypi +%{_pkgdocdir}/gdbinit + + +%files full-i18n +%dir %{icudatadir} +%{icudatadir}/icudt%{icu_major}*.dat + + +%files -n npm +%{_bindir}/npm +%{_bindir}/npx +%{_prefix}/lib/node_modules/npm +%config(noreplace) %{_sysconfdir}/npmrc +%{_prefix}/etc/npmrc +%ghost %{_sysconfdir}/npmignore +%doc %{_mandir}/man1/npm*.1* +%doc %{_mandir}/man1/npx.1* +%doc %{_mandir}/man5/folders.5* +%doc %{_mandir}/man5/install.5* +%doc %{_mandir}/man5/npmrc.5* +%doc %{_mandir}/man5/package-json.5* +%doc %{_mandir}/man5/package-lock-json.5* +%doc %{_mandir}/man5/package-locks.5* +%doc %{_mandir}/man5/shrinkwrap-json.5* +%doc %{_mandir}/man7/config.7* +%doc %{_mandir}/man7/developers.7* +%doc %{_mandir}/man7/disputes.7* +%doc %{_mandir}/man7/orgs.7* +%doc %{_mandir}/man7/registry.7* +%doc %{_mandir}/man7/removal.7* +%doc %{_mandir}/man7/scope.7* +%doc %{_mandir}/man7/scripts.7* +%doc %{_mandir}/man7/semver.7* + + +%files docs +%dir %{_pkgdocdir} +%{_pkgdocdir}/html +%{_pkgdocdir}/npm/docs + + +%changelog +* Wed Feb 24 2021 Zuzana Svetlikova - 1:10.24.0-1 +- Resolves: RHBZ#1932373, RHBZ#1932426 +- Resolves CVE-2021-22883 and CVE-2021-22884 +- remove -debug-nghttp2 flag (1930775) +- remove ini patch merged upstream + +* Mon Jan 18 2021 Zuzana Svetlikova - 1:10.23.1-1 +- January Security release +- https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/ +- Rebase to 10.23.1 +- Resolves: RHBZ#1916461, RHBZ#1914789 +- Resolves: RHBZ#1914783, RHBZ#1916462, RHBZ#1916395, RHBZ#1916459 +- Resolves: RHBZ#1916691, RHBZ#1916689, RHBZ#1916388 +- Remove dot-prop patch, as it is fixed by npm rebase + +* Tue Sep 22 2020 Jan Staněk - 1:10.22.1-1 +- Security rebase to 10.22.1 + +* Wed Jun 17 2020 Zuzana Svetlikova - 1:10.21.0-3 +- Resolves: RHBZ#1845307 +- Remove brotli-devel requires from nodejs-devel + +* Tue Jun 16 2020 Zuzana Svetlikova - 1:10.21.0-2 +- Resolves: RHBZ#1845307 +- Turn off debug builds + +* Mon Jun 15 2020 Zuzana Svetlikova - 1:10.21.0-1 +- Security update to 10.21.0 +- Resolves: RHBZ#1845307 +- Fixes CVE-2020-11080, CVE-2020-8174, CVE-2020-10531 +- Bundle brotli, because --shared-brotli configure option is missing +- Add i18n subpackage + +* Wed Mar 18 2020 Zuzana Svetlikova - 1:10.19.0-2 +- Resolves: RHBZ#1811499 + +* Mon Feb 10 2020 Jan Staněk - 1:10.19.0-1 +- Rebase to 10.19.0 to fix CVE-2019-15604 to CVE-2019-15606 + +* Tue Sep 10 2019 Jan Staněk - 1:10.16.3-1 +- Rebase to 10.16.3 to fix CVE-2019-9511 to CVE-2019-9518 + +* Thu Mar 14 2019 Zuzana Svetlikova - 1:10.14.1-2 +- move nodejs-packaging BR out of conditional + +* Tue Dec 11 2018 Zuzana Svetlikova - 1:10.14.1-1 +- Resolves: RHBZ#1644207 +- fixes node-gyp permissions +- rebase + +* Thu Oct 11 2018 Jan Staněk - 1:10.11.0-2 +- BuildRequire nodejs-packaging for proper npm dependency generation +- Resolves: rhbz#1615947 + +* Mon Oct 08 2018 Jan Staněk - 1:10.11.0-1 +- Rebase to 10.11.0 +- Import changes from fedora +- Resolves: rhbz#1621766 + +* Mon Jul 30 2018 Zuzana Svetlikova - 1:10.7.0-5 +- Import sources from fedora +- Allow using python2 at %%build and %%install +- turn off debug for aarch64 + +* Fri Jul 20 2018 Stephen Gallagher - 1:10.7.0-4 +- Fix npm upgrade scriptlet +- Fix unexpected trailing .1 in npm release field + +* Fri Jul 20 2018 Stephen Gallagher - 1:10.7.0-3 +- Restore annotations to binaries +- Fix unexpected trailing .1 in release field + +* Thu Jul 19 2018 Stephen Gallagher - 1:10.7.0-2 +- Update to 10.7.0 +- https://nodejs.org/en/blog/release/v10.7.0/ +- https://nodejs.org/en/blog/release/v10.6.0/ + +* Fri Jul 13 2018 Fedora Release Engineering - 1:10.5.0-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Thu Jun 21 2018 Stephen Gallagher - 1:10.5.0-1 +- Update to 10.5.0 +- https://nodejs.org/en/blog/release/v10.5.0/ + +* Thu Jun 14 2018 Stephen Gallagher - 1:10.4.1-1 +- Update to 10.4.1 to address security issues +- https://nodejs.org/en/blog/release/v10.4.1/ +- Resolves: rhbz#1590801 +- Resolves: rhbz#1591014 +- Resolves: rhbz#1591019 + +* Thu Jun 07 2018 Stephen Gallagher - 1:10.4.0-1 +- Update to 10.4.0 +- https://nodejs.org/en/blog/release/v10.4.0/ + +* Wed May 30 2018 Stephen Gallagher - 1:10.3.0-1 +- Update to 10.3.0 +- Update npm to 6.1.0 +- https://nodejs.org/en/blog/release/v10.3.0/ + +* Tue May 29 2018 Stephen Gallagher - 1:10.2.1-2 +- Fix up bare 'python' to be python2 +- Drop redundant entry in docs section + +* Fri May 25 2018 Stephen Gallagher - 1:10.2.1-1 +- Update to 10.2.1 +- https://nodejs.org/en/blog/release/v10.2.1/ + +* Wed May 23 2018 Stephen Gallagher - 1:10.2.0-1 +- Update to 10.2.0 +- https://nodejs.org/en/blog/release/v10.2.0/ + +* Thu May 10 2018 Stephen Gallagher - 1:10.1.0-3 +- Fix incorrect rpm macro + +* Thu May 10 2018 Stephen Gallagher - 1:10.1.0-2 +- Include upstream v8 fix for ppc64[le] +- Disable debug build on ppc64[le] and s390x + +* Wed May 09 2018 Stephen Gallagher - 1:10.1.0-1 +- Update to 10.1.0 +- https://nodejs.org/en/blog/release/v10.1.0/ +- Reenable node_g binary + +* Thu Apr 26 2018 Stephen Gallagher - 1:10.0.0-1 +- Update to 10.0.0 +- https://nodejs.org/en/blog/release/v10.0.0/ +- Drop workaround patch +- Temporarily drop node_g binary due to + https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85587 + +* Fri Apr 13 2018 Rafael dos Santos - 1:9.11.1-2 +- Use standard Fedora linker flags (bug #1543859) + +* Thu Apr 05 2018 Stephen Gallagher - 1:9.11.1-1 +- Update to 9.11.1 +- https://nodejs.org/en/blog/release/v9.11.0/ +- https://nodejs.org/en/blog/release/v9.11.1/ + +* Wed Mar 28 2018 Stephen Gallagher - 1:9.10.0-1 +- Update to 9.10.0 +- https://nodejs.org/en/blog/release/v9.10.0/ + +* Wed Mar 21 2018 Stephen Gallagher - 1:9.9.0-1 +- Update to 9.9.0 +- https://nodejs.org/en/blog/release/v9.9.0/ + +* Thu Mar 08 2018 Stephen Gallagher - 1:9.8.0-1 +- Update to 9.8.0 +- https://nodejs.org/en/blog/release/v9.8.0/ + +* Thu Mar 01 2018 Stephen Gallagher - 1:9.7.0-1 +- Update to 9.7.0 +- https://nodejs.org/en/blog/release/v9.7.0/ +- Work around F28 build issue + +* Sun Feb 25 2018 Stephen Gallagher - 1:9.6.1-1 +- Update to 9.6.1 +- https://nodejs.org/en/blog/release/v9.6.1/ +- https://nodejs.org/en/blog/release/v9.6.0/ + +* Mon Feb 05 2018 Stephen Gallagher - 1:9.5.0-1 +- Package Node.js 9.5.0 + +* Thu Jan 11 2018 Stephen Gallagher - 1:8.9.4-2 +- Fix incorrect Requires: + +* Thu Jan 11 2018 Stephen Gallagher - 1:8.9.4-1 +- Update to 8.9.4 +- https://nodejs.org/en/blog/release/v8.9.4/ +- Switch to system copy of nghttp2 + +* Fri Dec 08 2017 Stephen Gallagher - 1:8.9.3-2 +- Update to 8.9.3 +- https://nodejs.org/en/blog/release/v8.9.3/ +- https://nodejs.org/en/blog/release/v8.9.2/ + +* Thu Nov 30 2017 Pete Walter - 1:8.9.1-2 +- Rebuild for ICU 60.1 + +* Thu Nov 09 2017 Zuzana Svetlikova - 1:8.9.1-1 +- Update to 8.9.1 + +* Tue Oct 31 2017 Stephen Gallagher - 1:8.9.0-1 +- Update to 8.9.0 +- Drop upstreamed patch + +* Thu Oct 26 2017 Stephen Gallagher - 1:8.8.1-1 +- Update to 8.8.1 to fix a regression + +* Wed Oct 25 2017 Zuzana Svetlikova - 1:8.8.0-1 +- Security update to 8.8.0 +- https://nodejs.org/en/blog/release/v8.8.0/ + +* Sun Oct 15 2017 Zuzana Svetlikova - 1:8.7.0-1 +- Update to 8.7.0 +- https://nodejs.org/en/blog/release/v8.7.0/ + +* Fri Oct 06 2017 Zuzana Svetlikova - 1:8.6.0-2 +- Use bcond macro instead of bootstrap conditional + +* Wed Sep 27 2017 Zuzana Svetlikova - 1:8.6.0-1 +- Fix nghttp2 version +- Update to 8.6.0 +- https://nodejs.org/en/blog/release/v8.6.0/ + +* Wed Sep 20 2017 Zuzana Svetlikova - 1:8.5.0-3 +- Build with bootstrap + bundle libuv for modularity +- backport patch for aarch64 debug build + +* Wed Sep 13 2017 Stephen Gallagher - 1:8.5.0-2 +- Disable debug builds on aarch64 due to https://github.com/nodejs/node/issues/15395 + +* Tue Sep 12 2017 Stephen Gallagher - 1:8.5.0-1 +- Update to v8.5.0 +- https://nodejs.org/en/blog/release/v8.5.0/ + +* Thu Sep 07 2017 Zuzana Svetlikova - 1:8.4.0-2 +- Refactor openssl BR + +* Wed Aug 16 2017 Zuzana Svetlikova - 1:8.4.0-1 +- Update to v8.4.0 +- https://nodejs.org/en/blog/release/v8.4.0/ +- http2 is now supported, add bundled nghttp2 +- remove openssl 1.0.1 patches, we won't be using them in fedora + +* Thu Aug 10 2017 Zuzana Svetlikova - 1:8.3.0-1 +- Update to v8.3.0 +- https://nodejs.org/en/blog/release/v8.3.0/ +- update V8 to 6.0 +- update minimal gcc and g++ requirements to 4.9.4 + +* Wed Aug 09 2017 Tom Hughes - 1:8.2.1-2 +- Bump release to fix broken dependencies + +* Thu Aug 03 2017 Fedora Release Engineering - 1:8.2.1-1.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Wed Jul 26 2017 Fedora Release Engineering - 1:8.2.1-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Fri Jul 21 2017 Stephen Gallagher - 1:8.2.1-1 +- Update to v8.2.1 +- https://nodejs.org/en/blog/release/v8.2.1/ + +* Thu Jul 20 2017 Stephen Gallagher - 1:8.2.0-1 +- Update to v8.2.0 +- https://nodejs.org/en/blog/release/v8.2.0/ +- Update npm to 5.3.0 +- Adds npx command + +* Tue Jul 18 2017 Igor Gnatenko - 1:8.1.4-3 +- s/BuildRequires/Requires/ for http-parser-devel%%{?_isa} + +* Mon Jul 17 2017 Zuzana Svetlikova - 1:8.1.4-2 +- Rename python-devel to python2-devel +- own %%{_pkgdocdir}/npm + +* Tue Jul 11 2017 Stephen Gallagher - 1:8.1.4-1 +- Update to v8.1.4 +- https://nodejs.org/en/blog/release/v8.1.4/ +- Drop upstreamed c-ares patch + +* Thu Jun 29 2017 Zuzana Svetlikova - 1:8.1.3-1 +- Update to v8.1.3 +- https://nodejs.org/en/blog/release/v8.1.3/ + +* Wed Jun 28 2017 Zuzana Svetlikova - 1:8.1.2-1 +- Update to v8.1.2 +- remove GCC 7 patch, as it is now fixed in node >= 6.12 +