Bump release to get correct RHEL build

Filtering is needed as default .fmf would start test run with nodejs24 configuration

.gitignore

@@ -1,2 +1,4 @@
 /icu4c-*-data-bin-?.zip
 /node-*-stripped.tar.gz
+/SHASUM*
+/node*src.rpm

0001-fips-disable-options.patch

@@ -0,0 +1,84 @@
+From 98738d27288bd9ca634e29181ef665e812e7bbd3 Mon Sep 17 00:00:00 2001
+From: Michael Dawson <midawson@redhat.com>
+Date: Fri, 23 Feb 2024 13:43:56 +0100
+Subject: [PATCH] Disable FIPS options
+
+On RHEL, FIPS should be configured only on system level.
+Additionally, the related options may cause segfault when used on RHEL.
+
+This patch causes the option processing to end sooner
+than the problematic code gets executed.
+Additionally, the JS-level options to mess with FIPS settings
+are similarly disabled.
+
+Upstream report: https://github.com/nodejs/node/pull/48950
+RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=2226726
+---
+ lib/crypto.js             | 10 ++++++++++
+ lib/internal/errors.js    |  6 ++++++
+ src/crypto/crypto_util.cc |  2 ++
+ 3 files changed, 18 insertions(+)
+
+diff --git a/lib/crypto.js b/lib/crypto.js
+index 41adecc..b2627ac 100644
+--- a/lib/crypto.js
++++ b/lib/crypto.js
+@@ -36,7 +36,10 @@ const {
+ assertCrypto();
+
+ const {
++  // RHEL specific error
++  ERR_CRYPTO_FIPS_SYSTEM_CONTROLLED,
++
+   ERR_CRYPTO_FIPS_FORCED,
+   ERR_WORKER_UNSUPPORTED_OPERATION,
+ } = require('internal/errors').codes;
+ const constants = internalBinding('constants').crypto;
+@@ -251,6 +254,13 @@ function getFips() {
+ }
+ 
+ function setFips(val) {
++  // in RHEL FIPS enable/disable should only be done at system level
++  if (getFips() != val) {
++    throw new ERR_CRYPTO_FIPS_SYSTEM_CONTROLLED();
++  } else {
++    return;
++  }
++
+   if (getOptionValue('--force-fips')) {
+     if (val) return;
+     throw new ERR_CRYPTO_FIPS_FORCED();
+diff --git a/lib/internal/errors.js b/lib/internal/errors.js
+index a722360..04d8a53 100644
+--- a/lib/internal/errors.js
++++ b/lib/internal/errors.js
+@@ -1111,6 +1111,12 @@ module.exports = {
+ //
+ // Note: Node.js specific errors must begin with the prefix ERR_
+ 
++// insert RHEL specific erro
++E('ERR_CRYPTO_FIPS_SYSTEM_CONTROLLED',
++  'Cannot set FIPS mode. FIPS should be enabled/disabled at system level. See' +
++  'https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/assembly_installing-the-system-in-fips-mode_security-hardening for more details.\n',
++  Error);
++
+ E('ERR_ACCESS_DENIED',
+   function(msg, permission = '', resource = '') {
+     this.permission = permission;
+diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc
+index 5734d8f..ef9d1b1 100644
+--- a/src/crypto/crypto_util.cc
++++ b/src/crypto/crypto_util.cc
+@@ -121,6 +121,8 @@ bool ProcessFipsOptions() {
+   /* Override FIPS settings in configuration file, if needed. */
+   if (per_process::cli_options->enable_fips_crypto ||
+       per_process::cli_options->force_fips_crypto) {
++      fprintf(stderr, "ERROR: Using options related to FIPS is not recommended, configure FIPS in openssl instead. See https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/assembly_installing-the-system-in-fips-mode_security-hardening for more details.\n");
++      return false;
+ #if OPENSSL_VERSION_MAJOR >= 3
+     OSSL_PROVIDER* fips_provider = OSSL_PROVIDER_load(nullptr, "fips");
+     if (fips_provider == nullptr)
+-- 
+2.43.2
+
+

nodejs-tarball.sh

@@ -108,7 +108,7 @@ echo $_arg_version
 if [ x$_arg_version != x ]; then
     version=$_arg_version
 else
-    version=$(rpm -q --specfile --qf='%{version}\n' nodejs.spec | head -n1)
+    version=$(rpm -q --specfile --qf='%{version}\n' nodejs*.spec | head -n1)
 fi
 
 rm -f node-v${version}.tar.gz node-v${version}-stripped.tar.gz
@@ -123,8 +123,8 @@ tar -zcf node-v${version}-stripped.tar.gz node-v${version}
 ICU_MAJOR=$(jq -r '.[0].url' node-v${version}/tools/icu/current_ver.dep | sed --expression='s/.*release-\([[:digit:]]\+\)-\([[:digit:]]\+\).*/\1/g')
 ICU_MINOR=$(jq -r '.[0].url' node-v${version}/tools/icu/current_ver.dep | sed --expression='s/.*release-\([[:digit:]]\+\)-\([[:digit:]]\+\).*/\2/g')
 rm -Rf icu4c-${ICU_MAJOR}_${ICU_MINOR}-data-bin-*.zip
-wget $(grep Source3 nodejs.spec | sed --expression="s/.*http/http/g" --expression="s/\(\%{icu_major}\)/${ICU_MAJOR}/g" --expression="s/\(\%{icu_minor}\)/${ICU_MINOR}/g")
-wget $(grep Source4 nodejs.spec | sed --expression="s/.*http/http/g" --expression="s/\(\%{icu_major}\)/${ICU_MAJOR}/g" --expression="s/\(\%{icu_minor}\)/${ICU_MINOR}/g")
+wget $(grep -w 'Source3' nodejs*.spec | sed --expression="s/.*http/http/g" --expression="s/\(\%{icu_major}\)/${ICU_MAJOR}/g" --expression="s/\(\%{icu_minor}\)/${ICU_MINOR}/g")
+wget $(grep -w 'Source4' nodejs*.spec | sed --expression="s/.*http/http/g" --expression="s/\(\%{icu_major}\)/${ICU_MAJOR}/g" --expression="s/\(\%{icu_minor}\)/${ICU_MINOR}/g")
 
 #fedpkg new-sources node-v${version}-stripped.tar.gz icu4c*-src.tgz
 

nodejs22.spec

@@ -52,8 +52,8 @@
 # than a Fedora release lifecycle.
 %global nodejs_epoch 1
 %global nodejs_major 22
-%global nodejs_minor 13
-%global nodejs_patch 1
+%global nodejs_minor 22
+%global nodejs_patch 0
 # nodejs_soversion - from NODE_MODULE_VERSION in src/node_version.h
 %global nodejs_soversion 127
 %global nodejs_abi %{nodejs_soversion}
@@ -80,13 +80,13 @@
 
 # c-ares - from deps/cares/include/ares_version.h
 # https://github.com/nodejs/node/pull/9332
-%global c_ares_version 1.34.4
+%global c_ares_version 1.34.6
 
 # llhttp - from deps/llhttp/include/llhttp.h
-%global llhttp_version 9.2.1
+%global llhttp_version 9.3.0
 
 # libuv - from deps/uv/include/uv/version.h
-%global libuv_version 1.49.2
+%global libuv_version 1.51.0
 
 # nghttp2 - from deps/nghttp2/lib/includes/nghttp2/nghttp2ver.h
 %global nghttp2_version 1.64.0
@@ -95,10 +95,10 @@
 %global nghttp3_version 1.6.0
 
 # ngtcp2 from deps/ngtcp2/ngtcp2/lib/includes/ngtcp2/version.h
-%global ngtcp2_version 1.9.1
+%global ngtcp2_version 1.11.0
 
 # ICU - from tools/icu/current_ver.dep
-%global icu_major 76
+%global icu_major 77
 %global icu_minor 1
 %global icu_version %{icu_major}.%{icu_minor}
 
@@ -107,7 +107,7 @@
 # " this line just fixes syntax highlighting for vim that is confused by the above and continues literal
 
 # simdutf from deps/simdutf/simdutf.h
-%global simdutf_version 5.6.4
+%global simdutf_version 6.4.2
 
 # OpenSSL minimum version
 %global openssl11_minimum 1:1.1.1
@@ -120,7 +120,7 @@
 
 # npm - from deps/npm/package.json
 %global npm_epoch 1
-%global npm_version 10.9.2
+%global npm_version 10.9.4
 
 # In order to avoid needing to keep incrementing the release version for the
 # main package forever, we will just construct one for npm that is guaranteed
@@ -131,13 +131,13 @@
 %global npm_envr %{npm_epoch}:%{npm_version}-%{npm_release}
 
 # uvwasi - from deps/uvwasi/include/uvwasi.h
-%global uvwasi_version 0.0.21
+%global uvwasi_version 0.0.23
 
 # histogram_c - assumed from timestamps
-%global histogram_version 0.9.7
+%global histogram_version 0.11.9
 
 # sqlite – from deps/sqlite/sqlite3.h
-%global sqlite_version 3.47.2
+%global sqlite_version 3.50.4
 
 
 Name: nodejs%{nodejs_pkg_major}
@@ -167,8 +167,11 @@ Source202: nodejs.pc.in
 Source203: v8.pc.in
 Source204: nodejs22_abi.req
 Source205: nodejs22_abi.attr
+Source300: test-runner.sh
+Source301: test-should-pass.txt
 
 Patch: 0001-Remove-unused-OpenSSL-config.patch
+Patch: 0001-fips-disable-options.patch
 
 %if 0%{?nodejs_default}
 %global pkgname nodejs
@@ -352,7 +355,7 @@ Requires: nodejs-cjs-module-lexer
 %endif
 
 %if %{with bundled_undici}
-Provides: bundled(nodejs-undici) = 6.21.1
+Provides: bundled(nodejs-undici) = 6.23.0
 %else
 BuildRequires: nodejs-undici
 Requires: nodejs-undici
@@ -401,8 +404,10 @@ Provides: nodejs-devel = %{nodejs_envr}
 %endif
 %unversioned_obsoletes_of_nodejsXX_if_default devel
 
-Provides: nodejs-devel-pkg = %{nodejs_envr}
+Provides: alternative-for(nodejs-devel) = %{nodejs_envr}
+Conflicts: alternative-for(nodejs-devel)
 Conflicts: nodejs-devel-pkg
+ # previously VP used for the same reason as alternative-for() above
 
 
 %description -n %{pkgname}-devel
@@ -592,6 +597,7 @@ export PATH="${cwd}/.bin:$PATH"
            --ninja \
            --enable-lto \
            --prefix=%{_prefix} \
+           --use-prefix-to-find-headers \
            --shared \
            --libdir=%{_lib} \
            %{ssl_configure} \
@@ -643,12 +649,16 @@ chrpath --delete %{buildroot}%{_bindir}/node
 # Rename the node binary
 mv %{buildroot}%{_bindir}/node %{buildroot}%{_bindir}/node-%{nodejs_pkg_major}
 
-# Adjust the npm binaries
-# 1. Replace all hasbangs with versioned ones
-grep --extended-regexp --files-with-matches --recursive \
-    '^#!/usr/bin/(env )?node($|[[:space:]])+' '%{buildroot}%{nodejs_private_sitelib}/npm/bin' \
-| xargs sed --in-place --regexp-extended \
-    's;^#!/usr/bin/(env )?node($|[[:space:]])+;#!/usr/bin/node-%{nodejs_pkg_major};'
+# Adjust npm binaries
+# 1. Replace all hashbangs with versioned ones
+readonly NPM_DIR="%{buildroot}%{nodejs_private_sitelib}/npm"
+readonly SHEBANG_ERE='^#!/usr/bin/(env\s+)?node\b'
+readonly SHEBANG_FIX='#!%{_bindir}/node-%{nodejs_pkg_major}'
+readonly -a npm_bin_dirs=("${NPM_DIR}/bin" "${NPM_DIR}/node_modules")
+
+find "${npm_bin_dirs[@]}" -type f \
+| xargs grep --extended-regexp --files-with-matches "${SHEBANG_ERE}" \
+| xargs sed --regexp-extended --in-place "s;${SHEBANG_ERE};${SHEBANG_FIX};"
 
 # 2. Replace original links with the adjusted ones
 for bin in npm npx; do
@@ -669,6 +679,13 @@ ln -srf %{buildroot}%{_bindir}/npx-%{nodejs_pkg_major} \
         %{buildroot}%{_bindir}/npx
 %endif
 
+# Fix shell scripts that call 'node' as command
+readonly -a known_shell_scripts=(
+    "${NPM_DIR}/bin/node-gyp-bin/node-gyp"
+    "${NPM_DIR}/node_modules/@npmcli/run-script/lib/node-gyp-bin/node-gyp"
+)
+sed --regexp-extended --in-place 's;\bnode(\s);%{_bindir}/node-%{nodejs_pkg_major}\1;' "${known_shell_scripts[@]}"
+
 # Install library symlink
 ln -srf %{buildroot}%{_libdir}/libnode.so.%{nodejs_soversion} \
         %{buildroot}%{_libdir}/libnode.so
@@ -762,11 +779,6 @@ find %{buildroot}%{nodejs_private_sitelib}/npm \
 chmod 0755 %{buildroot}%{nodejs_private_sitelib}/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/node-gyp
 chmod 0755 %{buildroot}%{nodejs_private_sitelib}/npm/node_modules/node-gyp/bin/node-gyp.js
 
-# Set the hashbang to use the matching Node.js interpreter
-sed --in-place --regexp-extended \
-    's;^#!/usr/bin/env node($|\ |\t)+;#!/usr/bin/node-%{nodejs_pkg_major};g' \
-    %{buildroot}%{nodejs_private_sitelib}/npm/node_modules/node-gyp/bin/node-gyp.js
-
 # Drop the NPM builtin configuration in place
 sed -e 's#@SYSCONFDIR@#%{_sysconfdir}#g' \
     %{SOURCE201} > %{buildroot}%{nodejs_private_sitelib}/npm/npmrc
@@ -807,6 +819,13 @@ install -Dpm0644 %{SOURCE204} %{buildroot}%{_rpmconfigdir}/fileattrs/nodejs%{nod
 
 
 %check
+#run unit test that should pass from list
+LD_LIBRARY_PATH=%{buildroot}%{_libdir} \
+  bash %{SOURCE300} \
+       %{buildroot}/%{_bindir}/node-%{nodejs_pkg_major} \
+       %{_builddir}/node-v%{nodejs_version}/test/ \
+       %{SOURCE301}
+
 # Fail the build if the versions don't match
 LD_LIBRARY_PATH=%{buildroot}%{_libdir} %{buildroot}/%{_bindir}/node-%{nodejs_pkg_major} -e "require('assert').equal(process.versions.node, '%{nodejs_version}')"
 LD_LIBRARY_PATH=%{buildroot}%{_libdir} %{buildroot}/%{_bindir}/node-%{nodejs_pkg_major} -e "require('assert').equal(process.versions.v8.replace(/-node\.\d+$/, ''), '%{v8_version}')"

plans/centos-stream.fmf

@@ -3,13 +3,21 @@ summary: Package test suite
 discover:
   how: fmf
   url: https://gitlab.com/redhat/centos-stream/tests/nodejs
+  filter: "component:nodejs22"
 environment:
   NODEJS_MAIN_PACKAGE: nodejs22
-  NODEJS_BIN: /usr/bin/node-22
+  NODEJS_DEVEL_PACKAGE: nodejs22-devel
+  NODEJS_BIN_PACKAGE: nodejs22-bin
+  NPM_BIN_PACKAGE: nodejs22-npm-bin
+  NODE_BIN: /usr/bin/node-22
+  NPM_BIN: /usr/bin/npm-22
+  NODE_INCLUDE_PATH: /usr/include/node
 prepare:
-  - name: install tested package
+  - name: install tested packages
     how: install
-    package: '${NODEJS_MAIN_PACKAGE}'
+    package:
+        - ${NODEJS_MAIN_PACKAGE}
+        - ${NODEJS_DEVEL_PACKAGE}
 execute:
   how: tmt
 ...

plans/tier1-internal.fmf

@@ -1,7 +1,7 @@
 summary: Internal Tier1 tests plan
 discover:
     how: fmf
-    filter: 'tier: 1'
+    filter: 'tier: 1 & component: nodejs:22'
     url: https://pkgs.devel.redhat.com/git/tests/nodejs
 execute:
     how: tmt

rpminspect.yaml

@@ -0,0 +1,28 @@
+# This check is disabled because rpminspect has issues with 
+# macro nesting and autorelease macro
+# which led to continuous need to waive or ignore the failure of the test
+# e.g:https://artifacts.dev.testing-farm.io/07049d23-04ed-451c-99f6-eed73e369d28/
+inspections:
+  disttag: off
+  
+# Multiple annochecks are disabled because they are creating Verify type failures
+annocheck:
+  extra_opts:
+    # Issue: https://github.com/nodejs/node/issues/40368
+    # skip test for link time optimalization 
+    # test fails because nodejs is compiled without LTO. 
+    # This is on purpose as it creates issues.
+    hardened: --skip-lto
+    #  Temporarily disabled
+    #  skip test for GNU Property notes formatting
+    #  test fails because it's missing CET notes
+    #  feature is unsopported by upstream
+    #  See RHEL-85793 for details
+    hardened: --skip-property-note
+    hardened: --skip-cf-protection
+    #  Temporarily disabled
+    # skip test for dynamic tags
+    # BTI_PLT protection feature is missing from dynamic tags
+    # libnode.so.127 lacks this feature
+    # See RHEL-85837 for details
+    hardened: --skip-dynamic-tags

sources

@@ -1,3 +1,3 @@
-SHA512 (node-v22.13.1-stripped.tar.gz) = 0e38b017a4dbc2532287e582d0492eaef6971db987722f5497e1d0875e83f1d0ab00c5d31b6842692f07538e49bdaada8cd997af2b200f4b7f47378fcb81c4ee
-SHA512 (icu4c-76_1-data-bin-b.zip) = 098326fbb0f4a1b70a314985cbe6918f3fec94feb17236dcf8efbc516e139294ec96ae49210e11ee40f4de1ac6977e939cbfd6087009be057b8a60d3ad01daad
-SHA512 (icu4c-76_1-data-bin-l.zip) = 1359ff28bad54f73fe29cc5c4fffb4c11c64399ddcc39bea2ee60b5d3672e7f79546a2255d604474cbd861791c11e62eb50bcecc0cf2cf9a7ece59180e8520fc
+SHA512 (node-v22.22.0-stripped.tar.gz) = 32049c569d90145c918dd4db7847ccf4d979a418a54a01ecf966d277607c7460d13e62334386d75d9854db4ec345dcc1abfda32bde4edbda18a61cbf484d0580
+SHA512 (icu4c-77_1-data-bin-b.zip) = 93b4c8228a059546e7c3e337f1f837db255c0046c15f50a31a7bd20daf361174edab05b01faaac1dd4f515ca3c1f1d7fb0f61e4177eb5631833ad1450e252c4e
+SHA512 (icu4c-77_1-data-bin-l.zip) = 3de15bb5925956b8e51dc6724c2114a1009ec471a2241b09ae09127f1760f44d02cc29cfbeed6cbaac6ee880553ac8395c61c6043c00ddba3277233e19e6490e

test-runner.sh

@@ -0,0 +1,59 @@
+#!/bin/bash
+	
+NODE_BIN="$1"
+PARENT_TEST_FOLDER="$2"
+TEST_LIST_FILE="$3"
+
+# At most 10 min per test
+TIMEOUT_DURATION=600
+# Exit code
+FINAL_RESULT=0 	
+ARCH=$(uname -m)
+
+echo "Started test run:"
+# Run the list of test
+while IFS= read -r test_line; do
+  # ignore commented lines
+  if [[ "$test_line" =~ ^# ]]; then
+    continue
+  fi
+  # If test has specified ARCH which it should be skipped
+  # Extract it
+  TEST_PATH=$(echo "$test_line" | awk '{print $1}')
+  IGNORE_ARCHES=$(echo "$test_line" |\
+    awk '{for (i=2; i<=NF; i++) printf "%s ", $i; print ""}')
+  
+  # Skip test for specified ARCH
+  for ARCH_IGNORE in $IGNORE_ARCHES; do
+    if [[ "$ARCH_IGNORE" == "$ARCH" ]]; then
+      continue 2  
+    fi
+  done
+  
+  # Construct test path
+  TEST_SCRIPT="$PARENT_TEST_FOLDER/$TEST_PATH"
+
+  if [ ! -f "$TEST_SCRIPT" ]; then
+    continue
+  fi
+
+  TEST_OUTPUT=$(timeout "$TIMEOUT_DURATION" "$NODE_BIN" "$TEST_SCRIPT" 2>&1)
+  TEST_RESULT=$?
+
+  # Handle test result
+  if [ $TEST_RESULT -ne 0 ]; then
+    FINAL_RESULT=1
+    if [ $TEST_RESULT -eq 124 ]; then
+      echo "Test timed out: $TEST_SCRIPT"
+    else
+      echo "Test failed: $TEST_SCRIPT"
+    fi
+    echo "Test failure message:"
+    echo "$TEST_OUTPUT"
+  fi
+done < "$TEST_LIST_FILE"
+
+if [ $FINAL_RESULT -eq 0 ]; then
+    echo "All tests succesfully passed."
+fi
+exit $FINAL_RESULT