From debbugs-submit-bounces@debbugs.gnu.org Sun Nov 17 13:25:48 2019 Received: (at 34526) by debbugs.gnu.org; 17 Nov 2019 18:25:48 +0000 Received: from localhost ([127.0.0.1]:42575 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1iWPF2-0004Mt-LW for submit@debbugs.gnu.org; Sun, 17 Nov 2019 13:25:48 -0500 Received: from wout2-smtp.messagingengine.com ([64.147.123.25]:53081) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1iWPF0-0004Mf-C9 for 34526@debbugs.gnu.org; Sun, 17 Nov 2019 13:25:43 -0500 Received: from compute5.internal (compute5.nyi.internal [10.202.2.45]) by mailout.west.internal (Postfix) with ESMTP id 950C7614; Sun, 17 Nov 2019 13:25:36 -0500 (EST) Received: from mailfrontend2 ([10.202.2.163]) by compute5.internal (MEProxy); Sun, 17 Nov 2019 13:25:36 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastmail.com; h= from:to:cc:subject:in-reply-to:references:date:message-id :mime-version:content-type; s=fm1; bh=W6sVLTeExvqMvpzvid1g8+FYE2 x6y6uEsmj8BUaPZ0M=; b=Tw6Glg+VMP0qbynEZ4xLUdkTIpU/qi58zE0nR7a/Uj eo047guDjeKrXGsfVrMW4fmpVsdas1qTVJf1ipKveGHKccgiNft9EK5k98303DTp 7MX7n2h1mpwJ+9dRODuu50Nv4skhqE0519asMbnvCUP7yBTEoidwZyJJ4eyhRD+K I+kkBZ6Mtp5Ew9Jw1ABLsp9VGtNkNKJLi67QCIDaGEqh4rHHVYtJ8/GQgKtMH5GE IuvLLPEPCTRegPP1ADXBBVQ4PWarswqpZ7+haZP7ToB1oFJAkVTNS51cd4ITvrly qzSD1wOdHxgj+ed1SKXqRAZfrwb14ZT6G/YhN8/rJB7A== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=W6sVLT eExvqMvpzvid1g8+FYE2x6y6uEsmj8BUaPZ0M=; b=ZUeZIhY6gjIerr178WOrxT E2pvvmIbebFBo5bgOeR2At0XDix0t9N5msu5kBrvFZLh5LFz4VOh2ve0OX5no6TS sR4tUTxitJKrLxIVwsR6w2SFDFwUHKfzL0R6IjeZqEYkvC9H265HF9WzXwvQA/HF 44Jt75JsGfPXPYY3WiZzeTyjzpjhV7qs72U+VpE0kqZnEBvWztEqffIDV59cM+03 YjsTqzwAc6lPkxIBeYX06sRViC7fe7+iFmWmB5a33giX/BuGbOIu+uPoj9/mELSn DovxefVY02IZtJDPiTVoU0slVZBI4nVetHnLgcmtvRt8LgtXHI0QnwU7sYCPcpqQ == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedufedrudegfedgvddvucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurhephffvufgjfhgffffkgggtsehgtderredtredtnecuhfhrohhmpeforghrihhu shcuuegrkhhkvgcuoehmsggrkhhkvgesfhgrshhtmhgrihhlrdgtohhmqeenucffohhmrg hinhepnhhouggvjhhsrdhorhhgnecukfhppeeivddrudeirdduledvrdduhedtnecurfgr rhgrmhepmhgrihhlfhhrohhmpehmsggrkhhkvgesfhgrshhtmhgrihhlrdgtohhmnecuve hluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: from localhost (ti0006q161-0149.bb.online.no [62.16.192.150]) by mail.messagingengine.com (Postfix) with ESMTPA id 940113060057; Sun, 17 Nov 2019 13:25:35 -0500 (EST) From: Marius Bakke To: Christopher Lemmer Webber , 34526@debbugs.gnu.org Subject: Re: bug#34526: Updating node.js In-Reply-To: <871ru7h8gh.fsf@dustycloud.org> References: <87d0npb1tx.fsf@atufi.org> <877edw6cta.fsf@fsfe.org> <87h8cz20ic.fsf@atufi.org> <877edud0ha.fsf@fsfe.org> <87va1doz0z.fsf@atufi.org> <871ru7h8gh.fsf@dustycloud.org> User-Agent: Notmuch/0.29.1 (https://notmuchmail.org) Emacs/26.3 (x86_64-pc-linux-gnu) Date: Sun, 17 Nov 2019 19:25:33 +0100 Message-ID: <878soefjhe.fsf@devup.no> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-Spam-Score: -0.7 (/) X-Debbugs-Envelope-To: 34526 Cc: jlicht@fsfe.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.7 (-) --=-=-= Content-Type: text/plain Christopher Lemmer Webber writes: > Daniel Gerber writes: > >> Hi, >> >> 2019-02-20, Jelle Licht: >>> Daniel Gerber writes: >>> >>>> [snip] >>>> What about statically linking llhttp's C "sources" included in >>>> node? Building v11.10.0 succeeds with this: >>> >>> You could do this, of course, but afaics this is not acceptable for >>> inclusion in Guix proper. >>> >>> I don't really see any way forward between convincing the fine node >>> folks to see the 'error of their ways', or to implement a >>> ABI-compatible >>> replacement for llhttp that we can actually bootstrap. >> >> Although I would prefer the convincing-the-fine-node-folks solution, >> here are two more ways to avoid dropping node with the EOL of 8.x(LTS) >> at the end of 2019. >> >> - Remove llhttp and keep only the "legacy" http-parser, or >> >> - Accept to bootstrap it -- I mean use intermediary self-compiling >> steps, like ccl, golang, java, or haskell do. >> The build-time dependencies are: node@11.x -> llhttp -> ts-node -> >> typescript -> self (typescript), plus quite a few npm packages. >> It seems that node@8.x or 9.x should be a native-input to later >> versions, but I do not know enough of Guile / Guix packaging to do it >> myself anytime soon. > > Hello, > > Went through the process of trying to update node myself, not having > remembered this bug. Ran into the same issue. > > The bug was closed; I doubt we are going to convince the Node folks. > > Quite a few high-importance projects rely on Node at this point, and we > are running an out of date Node which I suspect probably has quite a few > insecurities. > > Our version of Node: v10.16.0 > LTS Node: v12.13.0 > Latest Node: v13.1.0 > > One way or another, we will probably need to update. Both Chromium and > Icecat depend on Node at this point. I'm not sure if either of them use > Node in any active way that an insecruity could manifest or if it's > "just for packaging" but I think there's good reason to be nervous about > being so out of date. Node 10.x is maintained until April 2021 though: https://nodejs.org/en/about/releases/ ...so we still have some time to figure out how to bootstrap Node 12.x and later. --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEu7At3yzq9qgNHeZDoqBt8qM6VPoFAl3RkJ0ACgkQoqBt8qM6 VPo3rQf9GTSaYchNAL4TWAYKFL49RewhVDbUzp0KrgS344kyHOUo6CSB48fg0sjl cfQMOmfKjZE1feH5N8wV4YTFtuyzEfR1FmtX3622d1h0KiXuvi6KpknduRdPapE/ NPb/H4hHNyoaDbXDJDALP72FScpxCcAXAA5aAzIgoN5eZ4E3a9VRbQFmWSPxICZv xCyug32AM3opAsOzpM+bMaSkniiP/k3IOUDUyxUTqoyMHm3Tm5dpi9ufgQUVq+pR 72MdxXivT54h5uto0jCEHhVdc70mN256Wsmh71d0WIv4y6X+zdE3Qry/helql15R 7uIodY0QulihesGZPTtvcpzuj6wQZg== =i9Ea -----END PGP SIGNATURE----- --=-=-=--