GNU bug report logs - #43228
r-v8 doesn't build since node 10.22 update

Previous Next

Package: guix;

Reported by: Pierre Langlois <pierre.langlois <at> gmx.com>

Date: Sat, 5 Sep 2020 17:46:02 UTC

Severity: normal

Done: Pierre Langlois <pierre.langlois <at> gmx.com>

Bug is archived. No further changes may be made.

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 43228 in the body.
You can then email your comments to 43228 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to bug-guix <at> gnu.org:
bug#43228; Package guix. (Sat, 05 Sep 2020 17:46:02 GMT) Full text and rfc822 format available.

Acknowledgement sent to Pierre Langlois <pierre.langlois <at> gmx.com>:
New bug report received and forwarded. Copy sent to bug-guix <at> gnu.org. (Sat, 05 Sep 2020 17:46:02 GMT) Full text and rfc822 format available.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Pierre Langlois <pierre.langlois <at> gmx.com>
To: Bug guix <bug-guix <at> gnu.org>
Subject: r-v8 doesn't build since node 10.22 update
Date: Sat, 05 Sep 2020 18:44:52 +0100
[Message part 1 (text/plain, inline)]
Hello Guix!

I'm afraid I broke r-v8 and a few of its dependants by updating node,
sorry about that!

AFAIK, the new node uses a function from nghttp2 1.41 that's not present
in 1.40, `nghttp2_option_set_max_settings'. However, since curl depends
on nghttp2 we've grafted 1.40 -> 1.41 to avoid a full rebuild.

Looking at r-v8's log [0], it complains that the symbol is missing,
indicating it's trying to link with the old version 1.40. I /believe/
it's inherited it through r-curl.

I'm not sure how to fix this, I'm happy to revert the node update if
needed, let me know! Then we'd have to wait for the next core-updates
cycle so that we no longer graft nghttp2.

Unless somebody has a better idea?

Thanks,
Pierre

[0]: https://ci.guix.gnu.org/log/62nkhf9dnlzgw3dz9khd79khqdpaib79-r-v8-3.2.0
[signature.asc (application/pgp-signature, inline)]

Information forwarded to bug-guix <at> gnu.org:
bug#43228; Package guix. (Sat, 05 Sep 2020 18:38:01 GMT) Full text and rfc822 format available.

Message #8 received at 43228 <at> debbugs.gnu.org (full text, mbox):

From: Mark H Weaver <mhw <at> netris.org>
To: Pierre Langlois <pierre.langlois <at> gmx.com>, 43228 <at> debbugs.gnu.org
Subject: Re: bug#43228: r-v8 doesn't build since node 10.22 update
Date: Sat, 05 Sep 2020 14:35:52 -0400
Hi Pierre,

I'm quoting your message out of order to ease my reply.

Pierre Langlois <pierre.langlois <at> gmx.com> writes:

> I'm afraid I broke r-v8 and a few of its dependants by updating node,
> sorry about that!
[...]
> I'm not sure how to fix this, I'm happy to revert the node update if
> needed, let me know! Then we'd have to wait for the next core-updates
> cycle so that we no longer graft nghttp2.

We will actually need node-10.22 (or at least 10.21) in 'master' in just
over 2 weeks, when we'll be compelled to update IceCat to version 78.
On Sept 22, Mozilla is scheduled to release a new batch of security
fixes in 78.3, and there will be no corresponding 68.x release.

(In fact, I had an *identical* commit on my private branch to update
'node' to 10.22, to allow testing IceCat 78 WIP.)

However, if needed, I suppose it might be sufficient for my purposes to
leave 'node' at 10.19.0, and to bind a separate 'node-10.22' variable to
the new version.

> AFAIK, the new node uses a function from nghttp2 1.41 that's not
> present in 1.40, `nghttp2_option_set_max_settings'. However, since curl
> depends on nghttp2 we've grafted 1.40 -> 1.41 to avoid a full rebuild.
>
> Looking at r-v8's log [0], it complains that the symbol is missing,
> indicating it's trying to link with the old version 1.40. I /believe/
> it's inherited it through r-curl.

If grafting is working as it should, then nghttp2-1.40 should never be
linked at runtime.  However, it is certainly the case that most things
(except node-10.22) are *built* against nghttp2-1.40, where the
aforementioned symbol is missing.

One possible solution might be to update the replacement (graft) for
_curl_ so that it's *built* against nghttp2-1.41.  Something like this
(untested):

--8<---------------cut here---------------start------------->8---
diff --git a/gnu/packages/curl.scm b/gnu/packages/curl.scm
index 55b7e4393b..bfcb52b678 100644
--- a/gnu/packages/curl.scm
+++ b/gnu/packages/curl.scm
@@ -183,6 +183,9 @@ tunneling, and so on.")
               (sha256
                (base32
                 "0wlppmx9iry8slh4pqcxj7lwc6fqwnlhh9ri2pcym2rx76a8gwfd"))))
+    (inputs
+     `(("nghttp2" ,nghttp2-1.41 "lib")
+       ,@(alist-delete "nghttp2" (package-inputs curl))))
     (arguments
      (substitute-keyword-arguments (package-arguments curl)
        ((#:phases phases)
--8<---------------cut here---------------end--------------->8---

Would you like to try this and see if it solves the problem?

       Mark




Information forwarded to bug-guix <at> gnu.org:
bug#43228; Package guix. (Sat, 05 Sep 2020 19:31:01 GMT) Full text and rfc822 format available.

Message #11 received at 43228 <at> debbugs.gnu.org (full text, mbox):

From: Pierre Langlois <pierre.langlois <at> gmx.com>
To: Mark H Weaver <mhw <at> netris.org>
Cc: Pierre Langlois <pierre.langlois <at> gmx.com>, 43228 <at> debbugs.gnu.org
Subject: Re: bug#43228: r-v8 doesn't build since node 10.22 update
Date: Sat, 05 Sep 2020 20:29:37 +0100
[Message part 1 (text/plain, inline)]
Hi Mark,

Mark H Weaver writes:

> Hi Pierre,
>
> I'm quoting your message out of order to ease my reply.
>
> Pierre Langlois <pierre.langlois <at> gmx.com> writes:
>
>> I'm afraid I broke r-v8 and a few of its dependants by updating node,
>> sorry about that!
> [...]
>> I'm not sure how to fix this, I'm happy to revert the node update if
>> needed, let me know! Then we'd have to wait for the next core-updates
>> cycle so that we no longer graft nghttp2.
>
> We will actually need node-10.22 (or at least 10.21) in 'master' in just
> over 2 weeks, when we'll be compelled to update IceCat to version 78.
> On Sept 22, Mozilla is scheduled to release a new batch of security
> fixes in 78.3, and there will be no corresponding 68.x release.

Oooh cool! Looking forwards to icecat 78!

> (In fact, I had an *identical* commit on my private branch to update
> 'node' to 10.22, to allow testing IceCat 78 WIP.)
>
> However, if needed, I suppose it might be sufficient for my purposes to
> leave 'node' at 10.19.0, and to bind a separate 'node-10.22' variable to
> the new version.
>
>> AFAIK, the new node uses a function from nghttp2 1.41 that's not
>> present in 1.40, `nghttp2_option_set_max_settings'. However, since curl
>> depends on nghttp2 we've grafted 1.40 -> 1.41 to avoid a full rebuild.
>>
>> Looking at r-v8's log [0], it complains that the symbol is missing,
>> indicating it's trying to link with the old version 1.40. I /believe/
>> it's inherited it through r-curl.
>
> If grafting is working as it should, then nghttp2-1.40 should never be
> linked at runtime.  However, it is certainly the case that most things
> (except node-10.22) are *built* against nghttp2-1.40, where the
> aforementioned symbol is missing.
>
> One possible solution might be to update the replacement (graft) for
> _curl_ so that it's *built* against nghttp2-1.41.  Something like this
> (untested):
>
> --8<---------------cut here---------------start------------->8---
> diff --git a/gnu/packages/curl.scm b/gnu/packages/curl.scm
> index 55b7e4393b..bfcb52b678 100644
> --- a/gnu/packages/curl.scm
> +++ b/gnu/packages/curl.scm
> @@ -183,6 +183,9 @@ tunneling, and so on.")
>                (sha256
>                 (base32
>                  "0wlppmx9iry8slh4pqcxj7lwc6fqwnlhh9ri2pcym2rx76a8gwfd"))))
> +    (inputs
> +     `(("nghttp2" ,nghttp2-1.41 "lib")
> +       ,@(alist-delete "nghttp2" (package-inputs curl))))
>      (arguments
>       (substitute-keyword-arguments (package-arguments curl)
>         ((#:phases phases)
> --8<---------------cut here---------------end--------------->8---
>
> Would you like to try this and see if it solves the problem?

I'm afraid this still doesn't solve the problem. AFAIU, grafting the new
curl happens after building r-v8, so at link time it still sees the old
nghttp2 version.

Thinking about this, since the new node essentially uses a new ABI to
link with nghttp2 by requiring a new symbol, this isn't something we can
fix with grafting I believe.

It's possible to make r-curl specifically depend on the new curl like
so:

--8<---------------cut here---------------start------------->8---
diff --git a/gnu/packages/cran.scm b/gnu/packages/cran.scm
index 2c202e8508..16022c695d 100644
--- a/gnu/packages/cran.scm
+++ b/gnu/packages/cran.scm
@@ -1038,7 +1038,7 @@ if(_ca_bundle != NULL) { curl_easy_setopt(handle, CURLOPT_CAINFO, _ca_bundle); }
 " m)))
              #t)))))
     (inputs
-     `(("libcurl" ,curl)
+     `(("libcurl" ,curl-7.71.0)
        ("zlib" ,zlib)))
     (native-inputs
      `(("pkg-config" ,pkg-config)))
diff --git a/gnu/packages/curl.scm b/gnu/packages/curl.scm
index 55b7e4393b..aa103306a6 100644
--- a/gnu/packages/curl.scm
+++ b/gnu/packages/curl.scm
@@ -172,7 +172,7 @@ tunneling, and so on.")
     (inputs (alist-delete "openldap" (package-inputs curl))))))
 
 ;; Replacement package to fix CVE-2020-8169 and CVE-2020-8177.
-(define curl-7.71.0
+(define-public curl-7.71.0
   (package
     (inherit curl)
     (version "7.71.0")
@@ -183,6 +183,9 @@ tunneling, and so on.")
               (sha256
                (base32
                 "0wlppmx9iry8slh4pqcxj7lwc6fqwnlhh9ri2pcym2rx76a8gwfd"))))
+    (inputs
+     `(("nghttp2" ,nghttp2-1.41 "lib")
+       ,@(alist-delete "nghttp2" (package-inputs curl))))
     (arguments
      (substitute-keyword-arguments (package-arguments curl)
        ((#:phases phases)
--8<---------------cut here---------------end--------------->8---

But I'm not sure I like this very much, this is getting a bit messy.

Instead, I'm thinking your suggestion of leaving 'node' at 10.19 for now
(or 10.20, I can try that) and then introduce a 'node-10.22' package
that can be used for Icecat is better. I can do that. How does that
sound?

Thanks,
Pierre
[signature.asc (application/pgp-signature, inline)]

Information forwarded to bug-guix <at> gnu.org:
bug#43228; Package guix. (Sat, 05 Sep 2020 23:16:01 GMT) Full text and rfc822 format available.

Message #14 received at 43228 <at> debbugs.gnu.org (full text, mbox):

From: Mark H Weaver <mhw <at> netris.org>
To: Pierre Langlois <pierre.langlois <at> gmx.com>
Cc: 43228 <at> debbugs.gnu.org
Subject: Re: bug#43228: r-v8 doesn't build since node 10.22 update
Date: Sat, 05 Sep 2020 19:13:46 -0400
Hi Pierre,

Pierre Langlois <pierre.langlois <at> gmx.com> writes:

> Mark H Weaver writes:
>
>> One possible solution might be to update the replacement (graft) for
>> _curl_ so that it's *built* against nghttp2-1.41.  Something like this
>> (untested):
>
> I'm afraid this still doesn't solve the problem. AFAIU, grafting the new
> curl happens after building r-v8, so at link time it still sees the old
> nghttp2 version.

Ah yes, that makes sense.

> Instead, I'm thinking your suggestion of leaving 'node' at 10.19 for now
> (or 10.20, I can try that) and then introduce a 'node-10.22' package
> that can be used for Icecat is better.

That indeed might be the best approach for now.

> I can do that. How does that sound?

Sure, sounds good.  Thanks!

       Mark




Information forwarded to bug-guix <at> gnu.org:
bug#43228; Package guix. (Sun, 06 Sep 2020 11:18:02 GMT) Full text and rfc822 format available.

Message #17 received at 43228 <at> debbugs.gnu.org (full text, mbox):

From: Pierre Langlois <pierre.langlois <at> gmx.com>
To: Mark H Weaver <mhw <at> netris.org>
Cc: Pierre Langlois <pierre.langlois <at> gmx.com>, 43228 <at> debbugs.gnu.org
Subject: Re: bug#43228: r-v8 doesn't build since node 10.22 update
Date: Sun, 06 Sep 2020 12:17:00 +0100
[Message part 1 (text/plain, inline)]
Mark H Weaver writes:

> Hi Pierre,
>
> Pierre Langlois <pierre.langlois <at> gmx.com> writes:
>
>> Mark H Weaver writes:
>>
>>> One possible solution might be to update the replacement (graft) for
>>> _curl_ so that it's *built* against nghttp2-1.41.  Something like this
>>> (untested):
>>
>> I'm afraid this still doesn't solve the problem. AFAIU, grafting the new
>> curl happens after building r-v8, so at link time it still sees the old
>> nghttp2 version.
>
> Ah yes, that makes sense.
>
>> Instead, I'm thinking your suggestion of leaving 'node' at 10.19 for now
>> (or 10.20, I can try that) and then introduce a 'node-10.22' package
>> that can be used for Icecat is better.
>
> That indeed might be the best approach for now.
>
>> I can do that. How does that sound?
>
> Sure, sounds good.  Thanks!

Cool, here's a patch to do just that :-). I tried to update node to
10.21 but that still required the newer nghttp2 lib, but it worked for
10.20.

Thanks,
Pierre

[signature.asc (application/pgp-signature, inline)]
[0001-gnu-node-Downgrade-to-10.20.0.patch (text/x-patch, inline)]
From eb00ab49df23f7319009a9fec7fc2805016e2e25 Mon Sep 17 00:00:00 2001
From: Pierre Langlois <pierre.langlois <at> gmx.com>
Date: Sat, 5 Sep 2020 21:05:08 +0100
Subject: [PATCH] gnu: node: Downgrade to 10.20.0.

But keep version 10.22.0 around with a new node-10.22 variable.

* gnu/packages/node.scm (node): Downgrade to 10.22.0.
[inputs]: Downgrade nghttp2 to 1.40.
(node-10.22): New variable.
---
 gnu/packages/node.scm | 44 ++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 41 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index ed0b5c4f16..345668fa56 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -25,6 +25,7 @@

 (define-module (gnu packages node)
   #:use-module ((guix licenses) #:select (expat))
+  #:use-module ((guix build utils) #:select (alist-replace))
   #:use-module (guix packages)
   #:use-module (guix derivations)
   #:use-module (guix download)
@@ -47,14 +48,14 @@
 (define-public node
   (package
     (name "node")
-    (version "10.22.0")
+    (version "10.20.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://nodejs.org/dist/v" version
                                   "/node-v" version ".tar.xz"))
               (sha256
                (base32
-                "1nz18fa550li10r0kzsm28c2rvvq61nq8bqdygip0rmvbi2paxg0"))
+                "0cvjwnl0wkcsyw3kannbdv01s235wrnp11n2s6swzjx95gpichfi"))
               (modules '((guix build utils)))
               (snippet
                `(begin
@@ -186,7 +187,7 @@
        ("http-parser" ,http-parser)
        ("icu4c" ,icu4c)
        ("libuv" ,libuv)
-       ("nghttp2" ,nghttp2-1.41 "lib")
+       ("nghttp2" ,nghttp2 "lib")
        ("openssl" ,openssl)
        ("zlib" ,zlib)))
     (synopsis "Evented I/O for V8 JavaScript")
@@ -200,6 +201,43 @@ devices.")
     (properties '((max-silent-time . 7200)     ;2h, needed on ARM
                   (timeout . 21600)))))        ;6h

+;; TODO: Make this the default node on core-updates.  This cannot be done on
+;; master since this version of node requires a newer nghttp2 library at link
+;; time.
+(define-public node-10.22
+  (package
+    (inherit node)
+    (version "10.22.0")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://nodejs.org/dist/v" version
+                                  "/node-v" version ".tar.xz"))
+              (sha256
+               (base32
+                "1nz18fa550li10r0kzsm28c2rvvq61nq8bqdygip0rmvbi2paxg0"))
+              (modules '((guix build utils)))
+              (snippet
+               `(begin
+                  ;; Remove bundled software.
+                  (for-each delete-file-recursively
+                            '("deps/cares"
+                              "deps/http_parser"
+                              "deps/icu-small"
+                              "deps/nghttp2"
+                              "deps/openssl"
+                              "deps/uv"
+                              "deps/zlib"))
+                  (substitute* "Makefile"
+                    ;; Remove references to bundled software.
+                    (("deps/http_parser/http_parser.gyp") "")
+                    (("deps/uv/include/\\*.h") "")
+                    (("deps/uv/uv.gyp") "")
+                    (("deps/zlib/zlib.gyp") ""))
+                  #t))))
+    (inputs
+     (alist-replace "nghttp2" (list nghttp2-1.41 "lib")
+                    (package-inputs node)))))
+
 (define-public libnode
   (package
     (inherit node)
--
2.28.0


Information forwarded to bug-guix <at> gnu.org:
bug#43228; Package guix. (Sun, 06 Sep 2020 19:44:01 GMT) Full text and rfc822 format available.

Message #20 received at 43228 <at> debbugs.gnu.org (full text, mbox):

From: Mark H Weaver <mhw <at> netris.org>
To: Pierre Langlois <pierre.langlois <at> gmx.com>
Cc: 43228 <at> debbugs.gnu.org
Subject: Re: bug#43228: r-v8 doesn't build since node 10.22 update
Date: Sun, 06 Sep 2020 15:42:27 -0400
Hi Pierre,

Your new patch looks good to me, but the node-10.22 source field could
be simplified to avoid repeating the unchanged field (especially the
snippet), by inheriting from (package-source node) like this:

--8<---------------cut here---------------start------------->8---
    (source (origin
              (inherit (package-source node))
              (uri (string-append "https://nodejs.org/dist/v" version
                                  "/node-v" version ".tar.xz"))
              (sha256
               (base32
                "1nz18fa550li10r0kzsm28c2rvvq61nq8bqdygip0rmvbi2paxg0"))))
--8<---------------cut here---------------end--------------->8---

Also, it would be great to find a way to fit in the subject line that
10.22 is also being kept as a separate binding, especially since "guix
build node" and most other user commands will still build 10.22.  Maybe
something like this:

  gnu: node: Downgrade to 10.20.0; add separate 'node-10.22' binding.

What do you think?

Anyway, feel free to push this, preferably after incorporating these
suggestions.  If I'm not mistaken, the simplification suggested above
should not change the .drv file, and therefore not entail a rebuild, so
testing it should be very quick.

     Thanks!
       Mark 




Reply sent to Pierre Langlois <pierre.langlois <at> gmx.com>:
You have taken responsibility. (Sun, 06 Sep 2020 22:24:01 GMT) Full text and rfc822 format available.

Notification sent to Pierre Langlois <pierre.langlois <at> gmx.com>:
bug acknowledged by developer. (Sun, 06 Sep 2020 22:24:02 GMT) Full text and rfc822 format available.

Message #25 received at 43228-done <at> debbugs.gnu.org (full text, mbox):

From: Pierre Langlois <pierre.langlois <at> gmx.com>
To: Mark H Weaver <mhw <at> netris.org>
Cc: Pierre Langlois <pierre.langlois <at> gmx.com>, 43228-done <at> debbugs.gnu.org
Subject: Re: bug#43228: r-v8 doesn't build since node 10.22 update
Date: Sun, 06 Sep 2020 23:23:35 +0100
[Message part 1 (text/plain, inline)]
Hi Mark,

Mark H Weaver writes:

> Hi Pierre,
>
> Your new patch looks good to me, but the node-10.22 source field could
> be simplified to avoid repeating the unchanged field (especially the
> snippet), by inheriting from (package-source node) like this:
>
> --8<---------------cut here---------------start------------->8---
>     (source (origin
>               (inherit (package-source node))
>               (uri (string-append "https://nodejs.org/dist/v" version
>                                   "/node-v" version ".tar.xz"))
>               (sha256
>                (base32
>                 "1nz18fa550li10r0kzsm28c2rvvq61nq8bqdygip0rmvbi2paxg0"))))
> --8<---------------cut here---------------end--------------->8---

Oh yeah, that's much better.

>
> Also, it would be great to find a way to fit in the subject line that
> 10.22 is also being kept as a separate binding, especially since "guix
> build node" and most other user commands will still build 10.22.  Maybe
> something like this:
>
>   gnu: node: Downgrade to 10.20.0; add separate 'node-10.22' binding.
>
> What do you think?

Actually, even better, I can split this into two separate commits.

>
> Anyway, feel free to push this, preferably after incorporating these
> suggestions.  If I'm not mistaken, the simplification suggested above
> should not change the .drv file, and therefore not entail a rebuild, so
> testing it should be very quick.

Pushed as 6b7cba0fa897e97b43e76612e3736429426f4d9d and
92db0d39e2aa64be390e86172bd670d98e121c4b, thanks for the review!

Pierre
[signature.asc (application/pgp-signature, inline)]

bug archived. Request was from Debbugs Internal Request <help-debbugs <at> gnu.org> to internal_control <at> debbugs.gnu.org. (Mon, 05 Oct 2020 11:24:05 GMT) Full text and rfc822 format available.

This bug report was last modified 3 years and 175 days ago.

Previous Next


GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.