Accepting request 1084846 from devel:languages:nodejs

OBS-URL: https://build.opensuse.org/request/show/1084846
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/nodejs-electron?expand=0&rev=67

nodejs-electron.changes

@@ -1,3 +1,13 @@
+-------------------------------------------------------------------
+Wed May  3 20:28:49 UTC 2023 - Bruno Pitrus <brunopitrus@hotmail.com>
+- New upstream release 22.3.8
+  * Fixed crash when executing eval in the utility process.
+- Drop ‘Revert-e2c4acd-apply-csp-correctly-when-contextIsolation-false.patch’ due to proper upstream fix in this release.
+
+-------------------------------------------------------------------
+Fri Apr 28 20:52:27 UTC 2023 - Bruno Pitrus <brunopitrus@hotmail.com>
+- Fix unresolvable build on Fedora 38 
+
 -------------------------------------------------------------------
 Wed Apr 26 20:43:42 UTC 2023 - Bruno Pitrus <brunopitrus@hotmail.com>
 - New upstream release 22.3.7

nodejs-electron.spec

@@ -178,7 +178,7 @@ BuildArch:      i686
 %if %{without clang}
 %bcond_without system_abseil
 
-%if 0%{?suse_version} >= 1550 || 0%{?sle_version} >= 150600 || 0%{?fedora} >= 38
+%if 0%{?suse_version} >= 1550 || 0%{?sle_version} >= 150600 || 0%{?fedora} >= 39
 %bcond_without abseil_2023
 %else
 %bcond_with abseil_2023
@@ -208,7 +208,7 @@ BuildArch:      i686
 
 
 Name:           nodejs-electron
-Version:        22.3.7
+Version:        22.3.8
 Release:        0
 Summary:        Build cross platform desktop apps with JavaScript, HTML, and CSS
 License:        AFL-2.0 AND Apache-2.0 AND blessing AND BSD-2-Clause AND BSD-3-Clause AND BSD-Protection AND BSD-Source-Code AND bzip2-1.0.6 AND IJG AND ISC AND LGPL-2.0-or-later AND LGPL-2.1-or-later AND MIT AND MIT-CMU AND MIT-open-group AND (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND MPL-2.0 AND OpenSSL AND SGI-B-2.0 AND SUSE-Public-Domain AND X11
@@ -266,7 +266,6 @@ Patch75:        gcc-asmflags.patch
 # https://sources.debian.org/patches/chromium/108.0.5359.124-1/disable/tests.patch/
 Patch76:        disable-devtools-tests.patch
 Patch77:        angle_link_glx.patch
-Patch78:        Revert-e2c4acd-apply-csp-correctly-when-contextIsolation-false.patch
 
 # PATCHES to use system libs
 Patch1000:      do-not-build-libvulkan.so.patch

Revert-e2c4acd-apply-csp-correctly-when-contextIsolation-false.patch

@@ -1,162 +0,0 @@
-Revert upstream changes causing VSCode crash:
-https://github.com/microsoft/vscode/pull/179991
-
-#0  blink::V8PerIsolateData::HasInstance(blink::WrapperTypeInfo const*, v8::Local<v8::Value>, WTF::HashMap<void const*, v8::Eternal<v8::Template>, blink::V8PerIsolateData::SimplePtrHash, WTF::HashTraits<void const*>, WTF::HashTraits<v8::Eternal<v8::Template> >, WTF::PartitionAllocator> const&) [clone .isra.0] () at ../../third_party/blink/renderer/platform/bindings/v8_per_isolate_data.cc:224
-#1  0x000055f3e7bdb2e7 in blink::V8PerIsolateData::HasInstance (Reading in symbols for <artificial>@0x83cf73c...
-this=0x0, wrapper_type_info=0x55f3ebf64b80 <blink::V8TrustedScript::wrapper_type_info_>, untrusted_value=...) at ../../third_party/blink/renderer/platform/bindings/v8_per_isolate_data.cc:218
-#2  0x000055f3e80509cf in blink::bindings::V8InterfaceBridge<blink::V8TrustedScript, blink::TrustedScript>::HasInstance () at ../../third_party/blink/renderer/platform/bindings/v8_interface_bridge.h:30
-#3  blink::V8UnionStringOrTrustedScript::Create (isolate=0x13280038c000, v8_value=..., exception_state=...) at gen/third_party/blink/renderer/bindings/core/v8/v8_union_string_trustedscript.cc:25
-#4  0x000055f3e6fdcbc3 in blink::NativeValueTraits<blink::V8UnionStringOrTrustedScript, void>::NativeValue () at ../../third_party/blink/renderer/bindings/core/v8/native_value_traits_impl.h:1489
-#5  TrustedTypesCodeGenerationCheck () at ../../third_party/blink/renderer/bindings/core/v8/v8_initializer.cc:420
-#6  blink::V8Initializer::CodeGenerationCheckCallbackInMainThread (Reading in symbols for <artificial>@0x1b39c10...
-context=..., source=..., is_code_like=56) at ../../third_party/blink/renderer/bindings/core/v8/v8_initializer.cc:460
-#7  0x000055f3e334e1df in ModifyCodeGenerationFromStrings (Reading in symbols for <artificial>@0x25392ba...
-context=..., source=..., is_code_like=48) at ../../electron/shell/common/node_bindings.cc:211
-#8  0x000055f3e3ea63bd in v8::internal::ModifyCodeGenerationFromStrings () at ../../v8/src/codegen/compiler.cc:2928
-#9  v8::internal::Compiler::ValidateDynamicCompilationSource (isolate=0x13280038c000, context=..., original_source=..., is_code_like=false) at ../../v8/src/codegen/compiler.cc:2991
-#10 0x000055f3e4263dd0 in CompileGlobalEval () at ../../v8/src/runtime/runtime-compiler.cc:578
-#11 __RT_impl_Runtime_ResolvePossiblyDirectEval () at ../../v8/src/runtime/runtime-compiler.cc:623
-#12 v8::internal::Runtime_ResolvePossiblyDirectEval (args_length=-336180352, args_object=0x132800280030, isolate=0x13280038c000) at ../../v8/src/runtime/runtime-compiler.cc:607
-#13 0x000055f37ff170b3 in ?? ()
-#14 0x00007fff7ce1df20 in ?? ()
-#15 0x0000000000000006 in ?? ()
-
-
-reverted:
---- b/electron/shell/common/node_bindings.cc
-+++ a/electron/shell/common/node_bindings.cc
-@@ -184,10 +184,9 @@
-     v8::Local<v8::Context> context,
-     v8::Local<v8::Value> source,
-     bool is_code_like) {
-+  // If we're running with contextIsolation enabled in the renderer process,
-+  // fall back to Blink's logic.
-   if (node::Environment::GetCurrent(context) == nullptr) {
--    // No node environment means we're in the renderer process, either in a
--    // sandboxed renderer or in an unsandboxed renderer with context isolation
--    // enabled.
-     if (gin_helper::Locker::IsBrowserProcess()) {
-       NOTREACHED();
-       return {false, {}};
-@@ -196,22 +195,6 @@
-         context, source, is_code_like);
-   }
- 
--  // If we get here then we have a node environment, so either a) we're in the
--  // main process, or b) we're in the renderer process in a context that has
--  // both node and blink, i.e. contextIsolation disabled.
--
--  // If we're in the main process, delegate to node.
--  if (gin_helper::Locker::IsBrowserProcess()) {
--    return node::ModifyCodeGenerationFromStrings(context, source, is_code_like);
--  }
--
--  // If we're in the renderer with contextIsolation disabled, ask blink first
--  // (for CSP), and iff that allows codegen, delegate to node.
--  v8::ModifyCodeGenerationFromStringsResult result =
--      blink::V8Initializer::CodeGenerationCheckCallbackInMainThread(
--          context, source, is_code_like);
--  if (!result.codegen_allowed)
--    return result;
-   return node::ModifyCodeGenerationFromStrings(context, source, is_code_like);
- }
- 
-reverted:
---- b/electron/spec/chromium-spec.ts
-+++ a/electron/spec/chromium-spec.ts
-@@ -355,74 +355,28 @@
-     });
-   });
- 
-+  describe('csp in sandbox: false', () => {
-+    it('is correctly applied', async () => {
-+      const w = new BrowserWindow({
-+        show: false,
-+        webPreferences: { sandbox: false }
--  describe('csp', () => {
--    for (const sandbox of [true, false]) {
--      describe(`when sandbox: ${sandbox}`, () => {
--        for (const contextIsolation of [true, false]) {
--          describe(`when contextIsolation: ${contextIsolation}`, () => {
--            it('prevents eval from running in an inline script', async () => {
--              const w = new BrowserWindow({
--                show: false,
--                webPreferences: { sandbox, contextIsolation }
--              });
--              w.loadURL(`data:text/html,<head>
--              <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline'">
--            </head>
--            <script>
--              try {
--                // We use console.log here because it is easier than making a
--                // preload script, and the behavior under test changes when
--                // contextIsolation: false
--                console.log(eval('true'))
--              } catch (e) {
--                console.log(e.message)
--              }
--            </script>`);
--              const [,, message] = await emittedOnce(w.webContents, 'console-message');
--              expect(message).to.match(/Refused to evaluate a string/);
--            });
--
--            it('does not prevent eval from running in an inline script when there is no csp', async () => {
--              const w = new BrowserWindow({
--                show: false,
--                webPreferences: { sandbox, contextIsolation }
--              });
--              w.loadURL(`data:text/html,
--            <script>
--              try {
--                // We use console.log here because it is easier than making a
--                // preload script, and the behavior under test changes when
--                // contextIsolation: false
--                console.log(eval('true'))
--              } catch (e) {
--                console.log(e.message)
--              }
--            </script>`);
--              const [,, message] = await emittedOnce(w.webContents, 'console-message');
--              expect(message).to.equal('true');
--            });
--
--            it('prevents eval from running in executeJavaScript', async () => {
--              const w = new BrowserWindow({
--                show: false,
--                webPreferences: { sandbox, contextIsolation }
--              });
--              w.loadURL('data:text/html,<head><meta http-equiv="Content-Security-Policy" content="default-src \'self\'; script-src \'self\' \'unsafe-inline\'"></meta></head>');
--              await expect(w.webContents.executeJavaScript('eval("true")')).to.be.rejected();
--            });
--
--            it('does not prevent eval from running in executeJavaScript when there is no csp', async () => {
--              const w = new BrowserWindow({
--                show: false,
--                webPreferences: { sandbox, contextIsolation }
--              });
--              w.loadURL('data:text/html,');
--              expect(await w.webContents.executeJavaScript('eval("true")')).to.be.true();
--            });
--          });
--        }
-       });
-+      w.loadURL(`data:text/html,<head>
-+          <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline'">
-+        </head>
-+        <script>
-+          try {
-+            // We use console.log here because it is easier than making a
-+            // preload script, and the behavior under test changes when
-+            // contextIsolation: false
-+            console.log(eval('failure'))
-+          } catch (e) {
-+            console.log('success')
-+          }
-+        </script>`);
-+      const [,, message] = await emittedOnce(w.webContents, 'console-message');
-+      expect(message).to.equal('success');
-+    });
--    }
-   });
- 
-   it('does not crash when multiple WebContent are created with web security disabled', () => {

create_tarball.sh

@@ -230,7 +230,7 @@ keeplibs=(
     third_party/libaom/source/libaom/third_party/vector
     third_party/libaom/source/libaom/third_party/x86inc
     third_party/libavif #leap too old
-    third_party/libgav1 #not in Factory yet, but available in unofficial repos. CONSIDER UNBUNDLING when any distro has it.
+    third_party/libgav1 #Usage of private headers (ObuFrameHeader from utils/types.h)
     third_party/libjxl #not in Leap
     third_party/libphonenumber #Depends on protobuf which cannot be unbundled
     third_party/libsrtp #Use of private headers. they were public in libsrtp1

electron-22.3.7.tar.zst

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:800b04e5d7c73bc76bc788dab8ed58d044a2de080746b80598eb1a41ce7a6638
-size 591793679

electron-22.3.8.tar.zst

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:22ffa3d9e94ee0d657032bcbf85ecf290cbf8390e70870e34541893e65eb560e
+size 591162834