Bug 1975437

Created attachment 1793544 [details]
build.log

Created attachment 1793545 [details]
root.log

file root.log too big, will only attach last 32768 bytes

Created attachment 1793546 [details]
state.log

+ ./node_modules/webpack/bin/webpack.js --mode production
Error: error:0308010C:digital envelope routines::unsupported
    at new Hash (node:internal/crypto/hash:67:19)
    at Object.createHash (node:crypto:130:10)
    at module.exports (/builddir/build/BUILD/d3-flame-graph-3.0.2/node_modules/webpack/lib/util/createHash.js:135:53)
    at NormalModule._initBuildHash (/builddir/build/BUILD/d3-flame-graph-3.0.2/node_modules/webpack/lib/NormalModule.js:417:16)

  opensslErrorStack: [ 'error:03000086:digital envelope routines::initialization error' ],
  library: 'digital envelope routines',
  reason: 'unsupported',
  code: 'ERR_OSSL_EVP_UNSUPPORTED'


Looking at the webpack code (the JS bundler) [1] [2] [3], it's executing

    require("crypto").createHash("md4")

Does the Node.js/OpenSSL implementation in CentOS stream not support the md4 hash function anymore?
The js-d3-flame-graph package itself doesn't need any crypto or hash functions, I assume the hash function above is used in webpack internally for caching purposes or sth like that.

I guess I could just change the hash function, but as this is the default for webpack, the same error will affect most/all packages built with webpack?


[1] https://github.com/webpack/webpack/blob/v4.42.0/lib/NormalModule.js
[2] https://github.com/webpack/webpack/blob/v4.42.0/lib/util/createHash.js
[3] https://v4.webpack.js.org/configuration/output/#outputhashfunction

Cheers,
Andreas

fyi: the RPM of the rebuild is 100% identical to the previous builds (only the build process changed)

*** Bug 1953085 has been marked as a duplicate of this bug. ***

agerstmayr incidentally I stumbled over the exact same failure in our cockpit starter-kit Fedora Rawhide build this morning:
https://download.copr.fedorainfracloud.org/results/packit/cockpit-project-starter-kit-494/fedora-rawhide-x86_64/02828853-cockpit-starter-kit/builder-live.log.gz
(from https://copr.fedorainfracloud.org/coprs/packit/cockpit-project-starter-kit-494/build/2828853/)

This must have regressed less than 4 days ago, as back then we still had an all-successful build:
https://github.com/cockpit-project/starter-kit/pull/492

This smells like a regression in npm/node with OpenSSL 3 (which explains why this this was also reported to happen on RHEL 9 for 389-console by Mark Reynolds). As your referenced erratum only contains a js-3d-flamegraph package, not an npm/node one, I take it you  found a workaround? Do you happen to have a pointer?

Thanks!

Thanks Andreas! Unfortunately in current webpack 5 there are not two, but 21(!) hardcoded createHash("md4") places, see [1]. But at least I now have a pointer where to look.

[1] https://github.com/webpack/webpack/issues/13572#issuecomment-923653464

For everyone who is following along here: I figured out a generic hack, see https://github.com/webpack/webpack/issues/13572#issuecomment-923736472

(In reply to Martin Pitt from comment #12)
> Thanks Andreas! Unfortunately in current webpack 5 there are not two, but
> 21(!) hardcoded createHash("md4") places, see [1]. But at least I now have a
> pointer where to look.

afaics it depends on which Webpack plugins you're using, in the js-d3-flame-graph case I had to only patch this one occurrence (and set the config option).

> For everyone who is following along here: I figured out a generic hack, see https://github.com/webpack/webpack/issues/13572#issuecomment-923736472

That's a nice one, more robust than my hardcoded patch, which can break any time when updating webpack. I'll drop my static patch and integrate your patch in the next rebase :)