Update node.js v6, v8, v10 & v11 for security release

[PeterDaveHello]

https://github.com/nodejs/node/releases/tag/v11.10.1
https://github.com/nodejs/node/releases/tag/v10.15.2
https://github.com/nodejs/node/releases/tag/v8.15.1
https://github.com/nodejs/node/releases/tag/v6.17.0

Close#996

[pesho]

LGTM

[rvagg]

if someone else can take care of https://github.com/docker-library/official-images when this is merged that would be a big help, I need some 💤

[PeterDaveHello]

@rvagg you mean sending a PR or getting that PR being merged?

[PeterDaveHello]

It's been an hour since the PR was sent. Just wanna mention about Travis CI delay again, the build is even not started yet...
cc @nodejs/docker

[rvagg]

@PeterDaveHello the steps outlined in https://github.com/nodejs/security-wg/blob/master/processes/security_release_process.md#release-day re official-images, I could do it but it'll be delayed because it's 1am and I'm off to bed.

[LaurentGoderre]

There's a minor outage for Travis https://www.traviscistatus.com

[LaurentGoderre]

Builds are on their way

[PeterDaveHello]

@LaurentGoderre the outage is about npm registry, not the builds.

[PeterDaveHello]

@rvagg our bot(scripts) will handle it :)

[chorrell]

🤞

[tianon]

Might want to open the PR manually, given the Travis delay (since it's Travis that's automating that PR opening, right?).

Would it be helpful if I did so?

[PeterDaveHello]

That might be good.

[tianon]

docker-library/official-images#5489 👍

[tianon]

(I've also tried to prime the build cache ahead of time here, so hopefully our build test is relatively fast)

[PeterDaveHello]

thanks @tianon, btw, this is exactly one reason we want #927

[tianon]

Sure, but in this case, skipping Travis entirely for this PR is reasonable (since we do a test build downstream anyhow and it's a simple version bump so it's very unlikely to fail to build), and the delay is more complicated than just the many versions (since it took a long time to even start).

[LaurentGoderre]

@ericf theimages aren't ready on hub yet.

[rvagg]

our bot(scripts) will handle it :)

Do we need to update our release process docs to remove the official-images steps or does that still apply? FWIW removing steps would be a huge help because the process is super onerous at the moment and keeps getting more complex.

Also re Travis, if you're having lots of trouble with it (and I'd expect trouble to increase with the post-acquision news coming out of Travis), perhaps it's time to consider roping in @nodejs/build to set up some of our infra to make this work. It might require some collaboration with @nodejs/automation too so we can get a bot setup like we have for nodejs/node. If you want to explore that, open an issue on nodejs/build, and also ping @nodejs/automation into the discussion.

[chorrell]

Yes I think using the the existing node build infra would be a good idea.

[LaurentGoderre]

Would he loose the access we have now to configure and restart the builds?

[rvagg]

we can define what access and functionality is available, we just need to be mindful of enabling the execution of arbitrary code, which is why we don't automatically test every PR that goes in to nodejs/node, a collaborator needs to sign-off first. Open an issue in nodejs/build and outline what you're using travis for and what an ideal CI setup would be.