[wip] merge v0.10 by piscisaureus · Pull Request #267 · nodejs/node

piscisaureus · 2015-01-09T00:12:48Z

Many patches have been ported over from the node/v0.10 branch onto io.js. Others are in this pull request. The following still need to be looked at.

Once all these commits have either been ported or rejected, io.js is up-to-date up to nodejs/node-v0.x-archive@fe20196 and we can construct a new merge base.

Child process fixes: (@sam-github @cjihrig)

nodejs/node-v0.x-archive@542ac7f child_process: properly support optional args
nodejs/node-v0.x-archive@e17c5a7 child_process: check execFile args is an array
nodejs/node-v0.x-archive@70dafa7 child_process: check fork args is an array
nodejs/node-v0.x-archive@8032a21 test: test all spawn parameter positions
nodejs/node-v0.x-archive@a1b2875 lint: fix lint issues
nodejs/node-v0.x-archive@f75a8ad test: remove redundant code in test (this commit seems wrong - @cjihrig ?)

TLS related (@indutny @bnoordhuis)

Uncaught exceptions swallowed

nodejs/node-v0.x-archive@fbff705 v8: add api for aborting on uncaught exception
nodejs/node-v0.x-archive@caeb677 domains: fix issues with abort on uncaught

Timers (see also #268)

nodejs/node-v0.x-archive@934bfe2 timers: Avoid linear scan in _unrefActive.
nodejs/node-v0.x-archive@78db74d timers: don't close interval timers when unrefd
nodejs/node-v0.x-archive@fd2cb7c timers: don't mutate unref list while iterating it

Probably not needed

nodejs/node-v0.x-archive@2afa3d8 test: crypto-domains avoid spurious failures
nodejs/node-v0.x-archive@707cc25 test: fix test-crypto-stream

Misc (@piscisaureus)

nodejs/node-v0.x-archive@523929c repl: Private Buffer object in lib/* files

rvagg · 2015-01-09T01:08:06Z

@bnoordhuis removed upload targets in 73b9323, which I'm +1 on, I'll either PR to add some new ones back or we'll keep them separate. We should keep that consistent and remove this target.

bnoordhuis · 2015-01-11T12:09:33Z

Regarding the SSL/TLS commits, only the first two and last three seem worth taking. The others are all about making SSLv[23] support configurable at run-time and I don't think that's a path we want to take.

Personally, I would suggest ripping out SSLv2 support entirely and putting SSLv3 behind a configure flag that prints a big warning.

/cc @indutny Agree/disagree?

rvagg · 2015-01-11T12:12:51Z

+1, what was the argument for keeping SSLv2? IE6?

bnoordhuis · 2015-01-11T12:17:08Z

@rvagg I don't know, it's probably pure inertia. SSLv2 was considered broken almost immediately after its introduction in 1995, that's why SSLv3 was created shortly after. There really seems no reason to keep the support around.

bnoordhuis · 2015-01-11T12:24:16Z

@piscisaureus The uncaught exception changes seem pointless, they work around an issue when --abort_on_uncaught_exception is passed on the command line, effectively nullifying the flag.

When you tell a GP 'it hurts when I do this', they'll tell you to stop doing that. Tell a programmer, they'll add a hack.

bnoordhuis · 2015-01-11T12:29:19Z

@piscisaureus The timer commits can be omitted when some of the suggestions from #268 get implemented (because that practically constitutes a full rewrite, nullifying the issues those commits address.)

piscisaureus · 2015-01-11T16:07:20Z

@bnoordhuis Thanks for your replies. I agree with most of them except

putting SSLv3 behind a configure flag that prints a big warning.

It's not that I think using SSLv3 is a good idea, but I'm generally opposed to the idea of putting features behind a configure-time flag. It assumes that people build iojs themselves, which generally speaking only a very small fraction of the user base does; most people will get it from a package manager or installer. So we should choose: we either remove support for SSLv3 entirely, or we make a run-time decision possible.

Let me add that although you've indeed removed SSLv2 support a year ago, this change never saw the light of day in the form of a stable release.

bnoordhuis · 2015-01-11T21:26:29Z

I'm in the 'secure by default' camp, +1 for dropping SSLv3 support. @iojs/tc, please chime in.

rvagg · 2015-01-11T23:52:32Z

+1 for dropping SSLv3 from me

chrisdickinson · 2015-01-12T01:28:09Z

@bnoordhuis re: the uncaught exception handler: there was a specific issue that this was handling -- specifically, I think it was that using domains at the same time as --abort-on-uncaught-exception would keep the process from aborting and producing a core. @trevnorris might remember the details than I do at the moment. Here's the PR that introduced those changes.

chrisdickinson · 2015-01-12T01:33:50Z

Re: disabling SSLv3 entirely: I think this is a good opportunity to turn it off by default. If a lot of folks complain, we can go the runtime configuration route in a follow-up minor release. I'm -1 on a configure flag, for the same reason as @piscisaureus.

bnoordhuis · 2015-01-12T10:34:45Z

@chrisdickinson Re: --abort-on-uncaught-exception, I think a much easier - and better - solution is to tell users to not use that flag. I can put together a PR that makes iojs print a warning on start-up or require('domain'):

WARNING: --abort-on-uncaught-exception is incompatible with the domains module

indutny · 2015-01-12T20:07:05Z

I think it won't hurt to land these TLS patches:

piscisaureus · 2015-01-12T20:30:42Z

^ @bnoordhuis

bnoordhuis · 2015-01-12T20:35:06Z

@indutny @piscisaureus I mentioned up-thread that the first two and last three may be worth cherry-picking. nodejs/node-v0.x-archive@b9283cf is not because we won't be merging the SSL2_ENABLE/SSL3_ENABLE patches, right?

indutny · 2015-01-12T20:36:41Z

Ok, good!

Add a test that goes through the whole matrix of: - command line options (--enable-ssl*) - secureOptions - secureProtocols and makes sure that compatible test setups actually work as expected. The test works by spawning two processes for each test case: one client and one server. The test passes if a SSL/TLS connection from the client to the server is successful and the test case was supposed to pass, or if the connection couldn't be established and the test case was supposed to fail. The test is currently located in the directory 'test/external' because it has external dependencies. Cherry-picked-from: nodejs/node-v0.x-archive@8d045a3

Cherry-picked-from: nodejs/node-v0.x-archive@641cea0 Conflicts: Makefile

piscisaureus · 2015-01-13T02:31:43Z

@rvagg something in fasion of 64086a9 may also be useful for us.

rvagg · 2015-01-13T02:38:19Z

@piscisaureus tbh I don't really see the utility, it's providing a version 0.10 to the docs rather than the full process.version, unless I'm missing something. I'd rather it be explicit.

rvagg · 2015-01-13T02:38:39Z

actually this is an issue for the new docs team to take up! I delegate the decision to them, whoever they be / @chrisdickinson

chrisdickinson · 2015-01-13T05:24:38Z

@bnoordhuis Re: abort-on-uncaught-exception, I think that approach might preclude anyone using hapi from making use of post-mortem debugging. Though, this may not be a problem if there are plans to rip domains out of hapi -- cc'ing @geek to see if that's the plan or not.

@rvagg I'm not entirely sold on including that commit, either. I'm currently leaning towards giving the doctool responsibility for the entirety of the out/doc folder, which implies that it could be run separately from iojs' make doc, and probably given its own version explicitly.

Fishrock123 · 2015-01-22T02:33:51Z

Is this still in progress?

rvagg reviewed Jan 9, 2015
View reviewed changes

piscisaureus force-pushed the mergev010 branch 7 times, most recently from 8848675 to 44ddf76Compare January 10, 2015 21:40

rvagg added this to the v1.0.0 milestone Jan 12, 2015

rvagg mentioned this pull request Jan 12, 2015
1.0.0 release checklist #302
Closed
14 tasks

Julien Gilliand others added 2 commits January 13, 2015 03:29

doc: build branch versioned docs
64086a9
Cherry-picked-from: nodejs/node-v0.x-archive@641cea0 Conflicts: Makefile

piscisaureus force-pushed the mergev010 branch from 44ddf76 to 64086a9Compare January 13, 2015 02:29

rvagg mentioned this pull request Jan 14, 2015
Add more information to the homepage to explain what io.js is. nodejs/iojs.org#50
Closed

Fishrock123 removed this from the v1.0.0 milestone Jan 29, 2015

Fishrock123 closed this Jan 29, 2015

bnoordhuis mentioned this pull request Feb 14, 2015
--abort-on-uncaught-exception prevents domains from working at all (the process crashes) #836
Closed

snyk-bot mentioned this pull request Nov 10, 2021
[Snyk] Upgrade remark-preset-lint-node from 3.0.1 to 3.3.0 thisguy726/node#3
Open

Uh oh!

Uh oh!

Conversation

piscisaureus commented Jan 9, 2015

Child process fixes: (@sam-github@cjihrig)

TLS related (@indutny@bnoordhuis)

Uncaught exceptions swallowed

Timers (see also #268)

Probably not needed

Misc (@piscisaureus)

Uh oh!

rvaggJan 9, 2015

Choose a reason for hiding this comment

Uh oh!

bnoordhuis commented Jan 11, 2015

Uh oh!

rvagg commented Jan 11, 2015

Uh oh!

bnoordhuis commented Jan 11, 2015

Uh oh!

bnoordhuis commented Jan 11, 2015

Uh oh!

bnoordhuis commented Jan 11, 2015

Uh oh!

piscisaureus commented Jan 11, 2015

Uh oh!

bnoordhuis commented Jan 11, 2015

Uh oh!

rvagg commented Jan 11, 2015

Uh oh!

chrisdickinson commented Jan 12, 2015

Uh oh!

chrisdickinson commented Jan 12, 2015

Uh oh!

bnoordhuis commented Jan 12, 2015

Uh oh!

indutny commented Jan 12, 2015

Uh oh!

piscisaureus commented Jan 12, 2015

Uh oh!

bnoordhuis commented Jan 12, 2015

Uh oh!

indutny commented Jan 12, 2015

Uh oh!

piscisaureus commented Jan 13, 2015

Uh oh!

rvagg commented Jan 13, 2015

Uh oh!

rvagg commented Jan 13, 2015

Uh oh!

chrisdickinson commented Jan 13, 2015

Uh oh!

Fishrock123 commented Jan 22, 2015

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Child process fixes: (@sam-github @cjihrig)

TLS related (@indutny @bnoordhuis)