OpenSSL Dynamic Linkage Gotchas?

[terinjokes]

The Node.js build system supports creating a dynamic link to the system's OpenSSL instead of a static build against the vendored version. Many distributors continue to ship distributions with OpenSSL statically built.

Are there any known downsides or other gotchas in Node.js with dynamic linkage?

[Fishrock123]

cc @nodejs/crypto

[bnoordhuis]

Are there any known downsides or other gotchas in Node.js with dynamic linkage?

• The distro version of openssl should match the version that node ships with exactly but we sometimes float patches.
• Dynamically linked builds are unsupported. If something doesn't work, tough cookies - we may or may not fix it.

[MylesBorins]

There are at least 4 floating patch's that we have on openssl at the moment fwiw

edit: make that exactly four... documentation found here

[rvagg]

/cc @nodejs/build

This is something we really should be considering officially supporting since a significant number of users are getting Node from distro packages; Debian, Ubuntu, Fedora, EL, where they all strictly follow this practice. That's probably going to be what stops us jumping on OpenSSL 1.1.0 for some time. We've discussed throwing a test slave or two at this problem to see if we can track the support cause downstream users are impacted by this whether we like it or not.

[jbergstroem]

I feel somewhat responsible here; It's on my todo's to set up a shared build system. I'm already doing so by maintaining nodejs in gentoo - a distribution that strongly believes in the shared object. We've had a full test pass for some while now. It needs to be represented in ci though.

Last time I did a look around the packaging around nodejs I found out that the majority - if not most packaging - is building against a shared version of openssl, zlib and in other cases additional libraries (libuv, http-parser and icu).

[jasnell]

@nodejs/build does this need to remain open?

[Trott]

I'm pretty sure some progress happened on this, but I don't recall when/where/by-whom. Help, anyone?

[bnoordhuis]

It works (but then it always has, with the caveats I mention above) but it's not regularly tested. See also nodejs/build#419 (comment). I'll close out this issue.