Re: Fwd: [SECURITY] [UPDATE] lang/node to

2022-03-10 Thread Stuart Henderson
On 2022/03/10 20:09, Volker Schlecht wrote: > On 3/10/22 15:13, Stuart Henderson wrote: > > > > https://github.com/nodejs/node/blob/v12.x/doc/api/net.md > > > > > > "If host is omitted, the server will accept connections on the unspecified > > > IPv6 address (::) when IPv6 is available, or the un

Re: Fwd: [SECURITY] [UPDATE] lang/node to

2022-03-10 Thread Stuart Henderson
On 2022/03/09 22:18, Volker Schlecht wrote: > > > On 3/9/22 15:57, Stuart Henderson wrote: > > On 2022/02/10 21:18, Volker Schlecht wrote: > > > I integrated the patch for src/env.cc, dropped one for the bundled uv and > > > upgraded to 12.22.10 ... what do you think? > > > > Sorry it took a whi

Re: Fwd: [SECURITY] [UPDATE] lang/node to

2022-03-09 Thread Stuart Henderson
On 2022/02/10 21:18, Volker Schlecht wrote: > I integrated the patch for src/env.cc, dropped one for the bundled uv and > upgraded to 12.22.10 ... what do you think? Sorry it took a while to test this. I would like to get this in but it's not working properly for me, sockets now only listen to IPv

Re: Fwd: [SECURITY] [UPDATE] lang/node to

2022-02-10 Thread Volker Schlecht
I integrated the patch for src/env.cc, dropped one for the bundled uv and upgraded to 12.22.10 ... what do you think? On 2/9/22 20:53, Volker Schlecht wrote: On 2/9/22 14:01, Stuart Henderson wrote: Some software I run doesn't work with 16.x yet, so I have reworked a port for 12 based on the c

Re: Fwd: [SECURITY] [UPDATE] lang/node to

2022-02-09 Thread Volker Schlecht
On 2/9/22 14:01, Stuart Henderson wrote: Some software I run doesn't work with 16.x yet, so I have reworked a port for 12 based on the changes in 16 (using system libraries etc) and wondered what you think about including it in the tree alongside? My only concern is that node 12 will not be sup

Re: Fwd: [SECURITY] [UPDATE] lang/node to

2022-02-09 Thread Stuart Henderson
On 2022/02/09 12:58, Stuart Henderson wrote: > /tmp/node12.tgz Oops, sent the attachment but not the text :) Some software I run doesn't work with 16.x yet, so I have reworked a port for 12 based on the changes in 16 (using system libraries etc) and wondered what you think about including it in t

Re: Fwd: [SECURITY] [UPDATE] lang/node to

2022-02-09 Thread Stuart Henderson
/tmp/node12.tgz node12.tgz Description: application/tar-gz

Re: Fwd: [SECURITY] [UPDATE] lang/node to

2022-02-03 Thread Volker Schlecht
Sure ... https://github.com/nodejs/node/issues/41834 On 2/3/22 20:05, Aaron Bieber wrote: Volker Schlecht writes: The other patch should fix builds breaking on machines with devel/gtest installed from ports. In those cases, node picked up and used the (ancient) ports version, instead of the

Re: Fwd: [SECURITY] [UPDATE] lang/node to

2022-02-03 Thread Aaron Bieber
Volker Schlecht writes: >>> The other patch should fix builds breaking on machines with devel/gtest >>> installed from ports. In those cases, node picked up and used the (ancient) >>> ports version, instead of the bundled one. >> that one fails on a system without gtest installed: > > Right, se

Re: Fwd: [SECURITY] [UPDATE] lang/node to

2022-02-03 Thread Volker Schlecht
The other patch should fix builds breaking on machines with devel/gtest installed from ports. In those cases, node picked up and used the (ancient) ports version, instead of the bundled one. that one fails on a system without gtest installed: Right, seem we have to add the bundle's include p

Re: Fwd: [SECURITY] [UPDATE] lang/node to

2022-02-03 Thread Stuart Henderson
On 2022/02/03 17:56, Volker Schlecht wrote: > I've included another patch nicked from www/chromium that looks like it > addresses this issue. I had no way of testing i386, so I didn't just blindly > include it at first. > > Note: www/chromium includes another ia32 patch, that's not needed in > lan

Re: Fwd: [SECURITY] [UPDATE] lang/node to

2022-02-03 Thread Volker Schlecht
I've included another patch nicked from www/chromium that looks like it addresses this issue. I had no way of testing i386, so I didn't just blindly include it at first. Note: www/chromium includes another ia32 patch, that's not needed in lang/node and probably in www/chromium anymore: patch

Re: Fwd: [SECURITY] [UPDATE] lang/node to

2022-02-03 Thread Stuart Henderson
This fails on i386; various errors like ../deps/v8/src/wasm/baseline/ia32/liftoff-assembler-ia32.h:433:24: error: out-of-line definition of 'Load' does not match any declaration in 'v8::internal::wasm::LiftoffAssembler' gzipped build log attached. node.log.gz Description: application/gunzip

Re: Fwd: [SECURITY] [UPDATE] lang/node to

2022-02-01 Thread Aaron Bieber
Volker Schlecht writes: > Even smaller diff attached. > > To reiterate the (intended) changes to look out for: > > * Update to v16.13.2 (Active LTS Release) > > * Change from bundled versions of > - libuv > - c-ares > - nghttp2 > - zlib > - brotli > - icu >

Re: Fwd: [SECURITY] [UPDATE] lang/node to 16.13.2

2022-01-26 Thread Stuart Henderson
On 2022/01/26 08:12, Volker Schlecht wrote: > At the risk of being considered a PITA: Is there anything *I* can do to > move this a step forward? I can only speak for myself and there are other people that can review too, but I already mentioned what would have made it easier for me to review on t

Re: Fwd: [SECURITY] [UPDATE] lang/node to 16.13.2

2022-01-25 Thread Volker Schlecht
At the risk of being considered a PITA: Is there anything *I* can do to move this a step forward? regards, Volker On 1/24/22 10:26, Stuart Henderson wrote: On 2022/01/23 17:47, Aaron Bieber wrote: Bogus WANTLIB: crypto.11 (/usr/local/bin/node) (NOT REACHABLE) Bogus WANTLIB: ssl.11 (/usr/l

Re: Fwd: [SECURITY] [UPDATE] lang/node to 16.13.2

2022-01-24 Thread Stuart Henderson
On 2022/01/23 17:47, Aaron Bieber wrote: > > Volker Schlecht writes: > > > Bump... > > > > On 1/16/22 16:48, Volker Schlecht wrote: > >> Update after feedback from abieber@ > > I was able to build webstuffs for the latest navidrome without > issue. pldc complains about: > > Bogus WANTLIB: cryp

Re: Fwd: [SECURITY] [UPDATE] lang/node to 16.13.2

2022-01-23 Thread Aaron Bieber
Volker Schlecht writes: > Bump... > > On 1/16/22 16:48, Volker Schlecht wrote: >> Update after feedback from abieber@ I was able to build webstuffs for the latest navidrome without issue. pldc complains about: Bogus WANTLIB: crypto.11 (/usr/local/bin/node) (NOT REACHABLE) Bogus WANTLIB: ssl.1

Re: Fwd: [SECURITY] [UPDATE] lang/node to 16.13.2

2022-01-20 Thread Volker Schlecht
Bump... On 1/16/22 16:48, Volker Schlecht wrote: Update after feedback from abieber@

Re: Fwd: [SECURITY] [UPDATE] lang/node to 16.13.2

2022-01-12 Thread Volker Schlecht
On 1/12/22 10:52, Stuart Henderson wrote: Firefox 96.0 builds without issue, and I managed to build Chromium 97.0.4692.71 as well, but when running the build on 24 cores, I did (presumably) hit some resource limit of my _pbuild user, resulting in seemingly random EAGAIN errors during the bundlin

Re: Fwd: [SECURITY] [UPDATE] lang/node to 16.13.2

2022-01-12 Thread Stuart Henderson
On 2022/01/12 02:03, Volker Schlecht wrote: > On 1/11/22 16:15, Stuart Henderson wrote: > > > here are a few cleanups > Thanks, I updated that in the attached archive. > > > I see do-extract is now new, but ugh, that's not the way that ports > > are normally unpacked.. > > I won't use it as a re

Re: Fwd: [SECURITY] [UPDATE] lang/node to 16.13.2

2022-01-11 Thread Volker Schlecht
On 1/11/22 16:15, Stuart Henderson wrote: here are a few cleanups Thanks, I updated that in the attached archive. I see do-extract is now new, but ugh, that's not the way that ports are normally unpacked.. I won't use it as a reference if I should ever maintain another port ;-) have you t

Re: Fwd: [SECURITY] [UPDATE] lang/node to 16.13.2

2022-01-11 Thread Stuart Henderson
here are a few cleanups I see do-extract is now new, but ugh, that's not the way that ports are normally unpacked.. have you tested with any of the ports that depend on it? diff --git Makefile Makefile index 7337eaa..34a8d9a 100644 --- Makefile +++ Makefile @@ -13,19 +13,17 @@ DISTFILES =

Fwd: [SECURITY] [UPDATE] lang/node to 16.13.2

2022-01-11 Thread Volker Schlecht
Here's the updated port for Node 16.3.2 that was released yesterday. It fixes CVE-2021-44531 CVE-2021-44532 CVE-2021-44533 Reference: https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/ On 1/10/22 00:17, Volker Schlecht wrote: The attached archive contains my first attempt