Commit 55e966fbe2d for nodejs
commit 55e966fbe2d9c9a0319d7e265c245177f379d6a8
Author: Yuya Inoue <65857152+inoway46@users.noreply.github.com>
Date: Sun Sep 27 17:09:47 2026 +0900
build: support LIEF 0.17.x and 1.x
Keep bundled LIEF at 0.17.0 while selecting the Mach-O section API
from the headers in use and the bundled build settings by version.
Prepare the updater for Mbed TLS 4 and TF-PSA-Crypto so the vendor
update can land separately.
Assisted-by: Codex
Signed-off-by: inoway46 <inoueyuya416@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66240
Fixes: https://github.com/nodejs/node/issues/66238
Refs: https://github.com/nodejs/node/pull/66242
Refs: https://github.com/nodejs/node/issues/63530
Refs: https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/360
Refs: https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/342
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
diff --git a/deps/LIEF/lief.gyp b/deps/LIEF/lief.gyp
index 783e97c181d..288a4af0397 100644
--- a/deps/LIEF/lief.gyp
+++ b/deps/LIEF/lief.gyp
@@ -13,6 +13,8 @@
},
},
'variables': {
+ # Read the bundled version; shared LIEF is selected through its own headers.
+ 'lief_version_major': '<!("<(python)" -c "print([line.split()[2] for line in open(\'include/LIEF/version.h\') if line.startswith(\'#define LIEF_VERSION_MAJOR \')][0])")',
'lief_sources': [
# Root
'src/Object.cpp',
@@ -411,6 +413,117 @@
'third-party/mbedtls/library/x509write.c',
'third-party/mbedtls/library/x509write_crt.c',
'third-party/mbedtls/library/x509write_csr.c',
+ ],
+ 'lief_1_third_party_sources': [
+ # Sources from upstream cmake/LIEFDependencies.cmake (Mbed TLS 4).
+ 'third-party/mbedtls/library/debug.c',
+ 'third-party/mbedtls/library/mps_reader.c',
+ 'third-party/mbedtls/library/mps_trace.c',
+ 'third-party/mbedtls/library/net_sockets.c',
+ 'third-party/mbedtls/library/pkcs7.c',
+ 'third-party/mbedtls/library/ssl_cache.c',
+ 'third-party/mbedtls/library/ssl_ciphersuites.c',
+ 'third-party/mbedtls/library/ssl_client.c',
+ 'third-party/mbedtls/library/ssl_cookie.c',
+ 'third-party/mbedtls/library/ssl_msg.c',
+ 'third-party/mbedtls/library/ssl_ticket.c',
+ 'third-party/mbedtls/library/ssl_tls.c',
+ 'third-party/mbedtls/library/ssl_tls12_client.c',
+ 'third-party/mbedtls/library/ssl_tls12_server.c',
+ 'third-party/mbedtls/library/ssl_tls13_client.c',
+ 'third-party/mbedtls/library/ssl_tls13_generic.c',
+ 'third-party/mbedtls/library/ssl_tls13_keys.c',
+ 'third-party/mbedtls/library/ssl_tls13_server.c',
+ 'third-party/mbedtls/library/timing.c',
+ 'third-party/mbedtls/library/version.c',
+ 'third-party/mbedtls/library/error.c',
+ 'third-party/mbedtls/library/x509.c',
+ 'third-party/mbedtls/library/x509_create.c',
+ 'third-party/mbedtls/library/x509_crl.c',
+ 'third-party/mbedtls/library/x509_crt.c',
+ 'third-party/mbedtls/library/x509_csr.c',
+ 'third-party/mbedtls/library/x509_oid.c',
+ 'third-party/mbedtls/library/x509write.c',
+ 'third-party/mbedtls/library/x509write_crt.c',
+ 'third-party/mbedtls/library/x509write_csr.c',
+ 'third-party/mbedtls/tf-psa-crypto/core/psa_crypto.c',
+ 'third-party/mbedtls/tf-psa-crypto/core/psa_crypto_client.c',
+ 'third-party/mbedtls/tf-psa-crypto/core/psa_crypto_slot_management.c',
+ 'third-party/mbedtls/tf-psa-crypto/core/psa_crypto_storage.c',
+ 'third-party/mbedtls/tf-psa-crypto/core/psa_its_file.c',
+ 'third-party/mbedtls/tf-psa-crypto/core/tf_psa_crypto_config.c',
+ 'third-party/mbedtls/tf-psa-crypto/core/tf_psa_crypto_version.c',
+ 'third-party/mbedtls/tf-psa-crypto/core/psa_crypto_driver_wrappers_no_static.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/aes.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/aesce.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/aesni.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/aria.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/asn1parse.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/asn1write.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/base64.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/bignum.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/bignum_core.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/bignum_mod.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/bignum_mod_raw.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/block_cipher.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/camellia.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/ccm.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/chacha20.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/chachapoly.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/cipher.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/cipher_wrap.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/cmac.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/constant_time.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/ctr_drbg.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/ecdh.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/ecdsa.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/ecjpake.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/ecp.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/ecp_curves.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/ecp_curves_new.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/entropy.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/entropy_poll.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/gcm.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/hmac_drbg.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/lmots.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/lms.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/md.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/md5.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/memory_buffer_alloc.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/nist_kw.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/oid.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/pem.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/pk.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/pk_ecc.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/pk_rsa.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/pk_wrap.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/pkcs5.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/pkparse.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/pkwrite.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/platform.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/platform_util.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/poly1305.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_aead.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_cipher.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_ecp.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_ffdh.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_hash.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_mac.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_pake.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_rsa.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/psa_util.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/ripemd160.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/rsa.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/rsa_alt_helpers.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/sha1.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/sha256.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/sha3.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/sha512.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/threading.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/everest/library/everest.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/everest/library/x25519.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/p256-m/p256-m/p256-m.c',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/p256-m/p256-m_driver_entrypoints.c',
]
},
'targets': [
@@ -444,7 +557,6 @@
'defines': [
'LIEF_STATIC',
'MBEDTLS_CONFIG_FILE="config/mbedtls/config.h"',
- 'MBEDTLS_NO_PLATFORM_ENTROPY',
'SPDLOG_DISABLE_DEFAULT_LOGGER',
'SPDLOG_NO_EXCEPTIONS',
'SPDLOG_FUNCTION=""',
@@ -487,7 +599,57 @@
},
'sources': [
'<@(lief_sources)',
- '<@(lief_third_party_sources)',
+ ],
+ 'conditions': [
+ ['lief_version_major >= 1', {
+ 'sources': [
+ 'src/DebugDeclOpt.cpp',
+ 'src/mbedtls_init.cpp',
+ 'src/threading_alt.cpp',
+ 'src/BinaryStream/DumpStream.cpp',
+ 'src/ELF/DynamicEntryAuxiliary.cpp',
+ 'src/ELF/DynamicEntryFilter.cpp',
+ 'src/ELF/elf_utils.cpp',
+ 'src/ELF/layout_check.cpp',
+ 'src/ELF/NoteDetails/properties/Needed.cpp',
+ 'src/MachO/LazyLoadDylibInfo.cpp',
+ 'src/MachO/ThreadLocalVariables.cpp',
+ # Stubs for disabled LIEF_RUNTIME_SUPPORT.
+ 'src/runtime/android/no_runtime.cpp',
+ 'src/runtime/disassembler/no_assembler.cpp',
+ 'src/runtime/disassembler/no_disassembler.cpp',
+ 'src/runtime/linux/no_runtime.cpp',
+ 'src/runtime/linux_android_shared/no_runtime.cpp',
+ 'src/runtime/no_runtime.cpp',
+ 'src/runtime/osx/common.cpp',
+ 'src/runtime/osx/no_runtime.cpp',
+ 'src/runtime/windows/common.cpp',
+ 'src/runtime/windows/no_runtime.cpp',
+ '<@(lief_1_third_party_sources)',
+ ],
+ 'include_dirs': [
+ 'src/runtime',
+ 'third-party/mbedtls/tf-psa-crypto/include',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/include',
+ 'third-party/mbedtls/tf-psa-crypto/core',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/everest/include/tf-psa-crypto/private/everest',
+ 'third-party/mbedtls/tf-psa-crypto/drivers/everest/include/tf-psa-crypto/private/everest/kremlib',
+ ],
+ 'defines': [
+ 'TF_PSA_CRYPTO_USER_CONFIG_FILE="config/mbedtls/psa_config.h"',
+ ],
+ 'conditions': [
+ ['OS=="win"', {
+ 'link_settings': {
+ 'libraries': [ '-lbcrypt' ],
+ },
+ }],
+ ],
+ }, {
+ 'sources': [ '<@(lief_third_party_sources)' ],
+ 'defines': [ 'MBEDTLS_NO_PLATFORM_ENTROPY' ],
+ }],
],
}
]
diff --git a/src/node_sea_bin.cc b/src/node_sea_bin.cc
index 30197b9bc3c..e11d36576b5 100644
--- a/src/node_sea_bin.cc
+++ b/src/node_sea_bin.cc
@@ -11,6 +11,7 @@
#else // defined(DEBUG)
#include "LIEF/LIEF.hpp"
#endif // defined(DEBUG)
+#include "LIEF/version.h"
#endif // HAVE_LIEF
#include "debug_utils-inl.h"
@@ -175,8 +176,13 @@ InjectOutput InjectIntoMachO(const std::vector<uint8_t>& executable,
LIEF::MachO::SegmentCommand::VM_PROTECTIONS::READ));
new_segment.init_protection(static_cast<uint32_t>(
LIEF::MachO::SegmentCommand::VM_PROTECTIONS::READ));
+#if LIEF_VERSION_MAJOR >= 1
+ auto section = LIEF::MachO::Section::create(section_name, data);
+ new_segment.add_section(*section);
+#else
LIEF::MachO::Section section(section_name, data);
new_segment.add_section(section);
+#endif
binary.add(new_segment);
} else {
// Check if the section exists
@@ -191,8 +197,13 @@ InjectOutput InjectIntoMachO(const std::vector<uint8_t>& executable,
segment_name,
section_name)};
}
+#if LIEF_VERSION_MAJOR >= 1
+ auto section = LIEF::MachO::Section::create(section_name, data);
+ binary.add_section(*segment, *section);
+#else
LIEF::MachO::Section section(section_name, data);
binary.add_section(*segment, section);
+#endif
}
// It will need to be signed again anyway, so remove the signature
@@ -295,7 +306,15 @@ InjectOutput InjectIntoPE(const std::vector<uint8_t>& executable,
cfg.resources = true;
cfg.rsrc_section = ".rsrc"; // ensure section name
LIEF::PE::Builder builder(*binary, cfg);
+#if LIEF_VERSION_MAJOR >= 1
+ // LIEF 1.0.0 does not export the result's bool conversion in shared builds.
+ // TODO(inoway46): Remove this workaround once the upstream issue is fixed.
+ // https://github.com/lief-project/LIEF/issues/1387
+ builder.build();
+ if (builder.get_build().empty()) {
+#else
if (!builder.build()) {
+#endif
return {InjectResult::kError, {}, "Failed to build modified PE binary"};
}
diff --git a/tools/prepare_lief.py b/tools/prepare_lief.py
index 3da0d8f3df4..b60579d5b2e 100644
--- a/tools/prepare_lief.py
+++ b/tools/prepare_lief.py
@@ -173,6 +173,9 @@ def main():
# Move the allow-listed directories from each lib in tmp_third_party to dst_third_party
src = tmp_third_party / lib
dst = dst_third_party / lib
+ if lib == 'mbedtls' and (src / 'tf-psa-crypto').is_dir():
+ included = included + ['tf-psa-crypto/core', 'tf-psa-crypto/include',
+ 'tf-psa-crypto/drivers', 'tf-psa-crypto/LICENSE']
for subpath in included:
src_item = src / subpath
dst_item = dst / subpath
@@ -187,6 +190,11 @@ def main():
dst_item.unlink()
print(f"Moving {src_item} -> {dst_item}")
shutil.move(str(src_item), str(dst_item))
+ if lib == 'mbedtls' and subpath.startswith('tf-psa-crypto/') and dst_item.is_dir():
+ # The release archive includes generated sources that must be
+ # checked in, despite the upstream development ignore rules.
+ for gitignore in dst_item.rglob('.gitignore'):
+ gitignore.unlink()
# 2) Place internal headers expected by the project layout under src/
# - third-party/expected/include/tl/expected.hpp
@@ -269,6 +277,7 @@ def main():
'LIEF_DYLD_SHARED_CACHE_SUPPORT': 0,
'LIEF_ASM_SUPPORT': 0,
'LIEF_EXTENDED': 0,
+ 'LIEF_RUNTIME_SUPPORT': 0,
'ENABLE_JSON_SUPPORT': 0,
'LIEF_JSON_SUPPORT': 0,