Arch Linux

This bug breaks uWebSockets (uws) library.

module.js:678
return process.dlopen(module, path.toNamespacedPath(filename));
^

Error: /node_modules/uws/uws_linux_59.node: undefined symbol: SSL_library_init

This is still broken in 9.9.0 - and I think it should at least be a medium severity since it breaks any module that depends on openssl in a non-intuitive way.

Did you report this upstream? I mean they are officially supporting OpenSSL 1.1.x, so those issues should be reported and fixed.

Fixed https://git.archlinux.org/svntogit/community.git/commit/trunk?h=packages/nodejs&id=690421143d41744f0a83cd1ff2a25ac2dc790ccf

That’s not really a fix, it’s a temporary workaround. Please see my message above.

I'm writing this to suggest a patch submitted with #57913 as it is commented that it should be mentioned here.

Here is a fix to enable OpenSSL 1.1.0, by preventing node-gyp fetch external headers:
https://bugs.archlinux.org/task/57913?getfile=16243

Node.js/npm/node-gyp DOES provide a way to use external headers in case that they are not compatible. By adding a file /usr/lib/node_modules/npm/npmrc with content "npm_config_nodedir=/usr", you can force to use system headers.
/usr/lib/node_modules/npm/npmrc is designed to be provided by a distributor, according to https://docs.npmjs.com/files/npmrc#built-in-config-file. node-gyp respects the configuration (see https://github.com/nodejs/node-gyp#configuration)

However, the configuration will not be applied when node-gyp is invoked directly. It is problematic for Arch Linux because its package symlinks node-gyp executable, allowing such an invocation. The patch mentioned above deals with the problem, too.

The patch solves node-gyp issue, but it just deals with the API, and does not deal with the ABI, and breaks prebuilt Node.js C++ addons. Node.js documentation does not say the version of each modules should be checked, and even C++ addons conforming to the documentation (https://nodejs.org/api/process.html#process_process_versions) may break. The author of uws said the bug is not the fault of uws, but of Arch Linux (or of Node.js if Node.js allows such a configuration) considering that.

IIRC, Arch Linux respects the upstream while keeping everything up-to-date, and linking with OpenSSL 1.1.0 should be the correct option in the principle, but note that the configuration is controversial.

With the update to 10.0.0 nodejs upstream switched to openssl 1.1. The package in [community-testing] has reflected the change.