feat: added support for reading certificates from macOS system store #56599

timja · 2025-01-14T16:03:07Z

Builds on #44532 but for macOS

TODO:

~~Make it work~~, it works 🥳
~~Review that all CF resources are being appropriately released~~, I think its right now
~~Review whether and where tests are appropriate~~ - Added although disabled by default

I can take a look at the Windows one after, resolving the conflicts and addressing the review comments as well.

Happy to refactor heavily, I haven't used c++ before and I wrote it initially in objective c and ported it across.
This is heavily based upon chromium and some of OpenJDK along with a PR I have open with OpenJDK

Testing

I'm using https://github.com./timja/openjdk-intermediate-ca-reproducer as a reproducer:

docker compose up --build

Install the certificates, either by adding to keychain manually (see README) or using /usr/bin/security (see what the test is doing in this PR.

main.js

let resp = await fetch("https://localhost:8443");
console.log(resp.status); // 200
console.log(resp.headers.get("Content-Type")); // "text/html"
console.log(await resp.text()); // "Hello, World!"

/Users/$USER/projects/node/out/Release/node --use-system-ca main.js

I've also tested this through a ZScaler MiTM setup.

nodejs-github-bot · 2025-01-14T16:03:13Z

Review requested:

@nodejs/crypto
@nodejs/gyp

src/crypto/crypto_context.cc

timja · 2025-01-15T09:04:36Z

Would it be possible for someone to re-open the feature request please? #39657. It was closed due to being stale / no progress on it.

doc/api/tls.md

src/crypto/crypto_context.cc

test/parallel/test-native-certs-macos.mjs

src/crypto/crypto_context.cc

timja · 2025-01-20T17:00:11Z

Thanks for the reviews all I'll continue actioning tomorrow.

joyeecheung

Some last comments, I think this is getting close. Thanks for following along!

src/crypto/crypto_context.cc

These are the PRs for --use-system-ca: - initial implementation of the option with just macOS support nodejs#56599 landed in v23.8.0. - Windows support nodejs#56833 landed in v23.8.0 - non-Windows and non-macOS support nodejs#57009 landed in v23.9.0 This change documents the history info. Signed-off-by: Darshan Sen <[email protected]>

These are the PRs for --use-system-ca: - initial implementation of the option with just macOS support #56599 landed in v23.8.0. - Windows support #56833 landed in v23.8.0 - non-Windows and non-macOS support #57009 landed in v23.9.0 This change documents the history info. Signed-off-by: Darshan Sen <[email protected]> PR-URL: #57432 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Joyee Cheung <[email protected]>

PR-URL: #56599 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Joyee Cheung <[email protected]>

These are the PRs for --use-system-ca: - initial implementation of the option with just macOS support nodejs#56599 landed in v23.8.0. - Windows support nodejs#56833 landed in v23.8.0 - non-Windows and non-macOS support nodejs#57009 landed in v23.9.0 This change documents the history info. Signed-off-by: Darshan Sen <[email protected]> PR-URL: nodejs#57432 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Joyee Cheung <[email protected]>

@geeksilva97

Notable changes: assert: * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370 * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370 assert,util: * (SEMVER-MINOR) improve performance (Ruben Bridgewater) #57370 benchmark: * (SEMVER-MINOR) adjust assert runtimes (Ruben Bridgewater) #57370 * (SEMVER-MINOR) skip running some assert benchmarks by default (Ruben Bridgewater) #57370 * (SEMVER-MINOR) add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370 cli: * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018 crypto: * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381 * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833 * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599 deps: * update timezone to 2025a (Node.js GitHub Bot) #56876 * (SEMVER-MINOR) update ada to v3.0.1 (Yagiz Nizipli) #56452 deps,tools: * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100 dns: * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983 doc: * add @geeksilva97 to collaborators (Edy Silva) #57241 module: * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 process: * (SEMVER-MINOR) add execve (Paolo Insogna) #56496 * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490 * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790 src: * set signal inspector io thread name (RafaelGSS) #56416 * set thread name for main thread and v8 worker (RafaelGSS) #56416 * set worker thread name using worker.name (RafaelGSS) #56416 * use a default thread name for inspector (RafaelGSS) #56416 test: * (SEMVER-MINOR) add WPT for URLPattern (Yagiz Nizipli) #56452 tls: * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107 url: * (SEMVER-MINOR) add URLPattern implementation (Yagiz Nizipli) #56452 util: * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462 v8: * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146 zlib: * (SEMVER-MINOR) add zstd support (Jan Martin) #52100 PR-URL: TODO

@geeksilva97

Notable changes: assert: * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370 * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370 assert,util: * (SEMVER-MINOR) improve performance (Ruben Bridgewater) #57370 benchmark: * (SEMVER-MINOR) adjust assert runtimes (Ruben Bridgewater) #57370 * (SEMVER-MINOR) skip running some assert benchmarks by default (Ruben Bridgewater) #57370 * (SEMVER-MINOR) add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370 cli: * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018 crypto: * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381 * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833 * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599 deps: * update timezone to 2025a (Node.js GitHub Bot) #56876 * (SEMVER-MINOR) update ada to v3.0.1 (Yagiz Nizipli) #56452 deps,tools: * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100 dns: * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983 doc: * add @geeksilva97 to collaborators (Edy Silva) #57241 module: * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 process: * (SEMVER-MINOR) add execve (Paolo Insogna) #56496 * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490 * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790 src: * set signal inspector io thread name (RafaelGSS) #56416 * set thread name for main thread and v8 worker (RafaelGSS) #56416 * set worker thread name using worker.name (RafaelGSS) #56416 * use a default thread name for inspector (RafaelGSS) #56416 test: * (SEMVER-MINOR) add WPT for URLPattern (Yagiz Nizipli) #56452 tls: * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107 url: * (SEMVER-MINOR) add URLPattern implementation (Yagiz Nizipli) #56452 util: * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462 v8: * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146 zlib: * (SEMVER-MINOR) add zstd support (Jan Martin) #52100 PR-URL: #57840

These are the PRs for --use-system-ca: - initial implementation of the option with just macOS support #56599 landed in v23.8.0. - Windows support #56833 landed in v23.8.0 - non-Windows and non-macOS support #57009 landed in v23.9.0 This change documents the history info. Signed-off-by: Darshan Sen <[email protected]> PR-URL: #57432 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Joyee Cheung <[email protected]>

@geeksilva97

Notable changes: assert: * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370 * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370 assert,util: * (SEMVER-MINOR) improve performance (Ruben Bridgewater) #57370 benchmark: * (SEMVER-MINOR) adjust assert runtimes (Ruben Bridgewater) #57370 * (SEMVER-MINOR) skip running some assert benchmarks by default (Ruben Bridgewater) #57370 * (SEMVER-MINOR) add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370 cli: * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018 crypto: * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381 * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833 * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599 deps: * update timezone to 2025a (Node.js GitHub Bot) #56876 * (SEMVER-MINOR) update ada to v3.0.1 (Yagiz Nizipli) #56452 deps,tools: * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100 dns: * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983 doc: * add @geeksilva97 to collaborators (Edy Silva) #57241 module: * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 process: * (SEMVER-MINOR) add execve (Paolo Insogna) #56496 * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490 * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790 src: * set signal inspector io thread name (RafaelGSS) #56416 * set thread name for main thread and v8 worker (RafaelGSS) #56416 * set worker thread name using worker.name (RafaelGSS) #56416 * use a default thread name for inspector (RafaelGSS) #56416 test: * (SEMVER-MINOR) add WPT for URLPattern (Yagiz Nizipli) #56452 tls: * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107 url: * (SEMVER-MINOR) add URLPattern implementation (Yagiz Nizipli) #56452 util: * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462 v8: * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146 zlib: * (SEMVER-MINOR) add zstd support (Jan Martin) #52100 PR-URL: #57840

These are the PRs for --use-system-ca: - initial implementation of the option with just macOS support #56599 landed in v23.8.0. - Windows support #56833 landed in v23.8.0 - non-Windows and non-macOS support #57009 landed in v23.9.0 This change documents the history info. Signed-off-by: Darshan Sen <[email protected]> PR-URL: #57432 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Joyee Cheung <[email protected]>

@geeksilva97

Notable changes: assert: * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370 * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370 assert,util: * (SEMVER-MINOR) improve performance (Ruben Bridgewater) #57370 benchmark: * (SEMVER-MINOR) adjust assert runtimes (Ruben Bridgewater) #57370 * (SEMVER-MINOR) skip running some assert benchmarks by default (Ruben Bridgewater) #57370 * (SEMVER-MINOR) add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370 cli: * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018 crypto: * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381 * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833 * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599 deps: * update timezone to 2025a (Node.js GitHub Bot) #56876 * (SEMVER-MINOR) update ada to v3.0.1 (Yagiz Nizipli) #56452 deps,tools: * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100 dns: * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983 doc: * add @geeksilva97 to collaborators (Edy Silva) #57241 module: * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 process: * (SEMVER-MINOR) add execve (Paolo Insogna) #56496 * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490 * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790 src: * set signal inspector io thread name (RafaelGSS) #56416 * set thread name for main thread and v8 worker (RafaelGSS) #56416 * set worker thread name using worker.name (RafaelGSS) #56416 * use a default thread name for inspector (RafaelGSS) #56416 test: * (SEMVER-MINOR) add WPT for URLPattern (Yagiz Nizipli) #56452 tls: * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107 url: * (SEMVER-MINOR) add URLPattern implementation (Yagiz Nizipli) #56452 util: * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462 v8: * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146 zlib: * (SEMVER-MINOR) add zstd support (Jan Martin) #52100 PR-URL: #57840

@geeksilva97

Notable changes: assert: * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370 * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370 assert,util: * (SEMVER-MINOR) improve performance (Ruben Bridgewater) #57370 benchmark: * (SEMVER-MINOR) adjust assert runtimes (Ruben Bridgewater) #57370 * (SEMVER-MINOR) skip running some assert benchmarks by default (Ruben Bridgewater) #57370 * (SEMVER-MINOR) add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370 cli: * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018 crypto: * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381 * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833 * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599 deps: * update timezone to 2025a (Node.js GitHub Bot) #56876 * (SEMVER-MINOR) update ada to v3.0.1 (Yagiz Nizipli) #56452 deps,tools: * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100 dns: * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983 doc: * add @geeksilva97 to collaborators (Edy Silva) #57241 module: * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 process: * (SEMVER-MINOR) add execve (Paolo Insogna) #56496 * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490 * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790 src: * set signal inspector io thread name (RafaelGSS) #56416 * set thread name for main thread and v8 worker (RafaelGSS) #56416 * set worker thread name using worker.name (RafaelGSS) #56416 * use a default thread name for inspector (RafaelGSS) #56416 test: * (SEMVER-MINOR) add WPT for URLPattern (Yagiz Nizipli) #56452 tls: * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107 url: * (SEMVER-MINOR) add URLPattern implementation (Yagiz Nizipli) #56452 util: * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462 v8: * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146 zlib: * (SEMVER-MINOR) add zstd support (Jan Martin) #52100 PR-URL: #57840

These are the PRs for --use-system-ca: - initial implementation of the option with just macOS support #56599 landed in v23.8.0. - Windows support #56833 landed in v23.8.0 - non-Windows and non-macOS support #57009 landed in v23.9.0 This change documents the history info. Signed-off-by: Darshan Sen <[email protected]> PR-URL: #57432 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Joyee Cheung <[email protected]>

@geeksilva97

Notable changes: assert: * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370 * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370 assert,util: * (SEMVER-MINOR) improve performance (Ruben Bridgewater) #57370 benchmark: * (SEMVER-MINOR) adjust assert runtimes (Ruben Bridgewater) #57370 * (SEMVER-MINOR) skip running some assert benchmarks by default (Ruben Bridgewater) #57370 * (SEMVER-MINOR) add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370 cli: * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018 crypto: * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381 * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833 * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599 deps: * update timezone to 2025a (Node.js GitHub Bot) #56876 deps,tools: * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100 dns: * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983 doc: * add @geeksilva97 to collaborators (Edy Silva) #57241 module: * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 process: * (SEMVER-MINOR) add execve (Paolo Insogna) #56496 * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490 * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790 src: * set signal inspector io thread name (RafaelGSS) #56416 * set thread name for main thread and v8 worker (RafaelGSS) #56416 * set worker thread name using worker.name (RafaelGSS) #56416 * use a default thread name for inspector (RafaelGSS) #56416 tls: * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107 util: * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462 v8: * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146 zlib: * (SEMVER-MINOR) add zstd support (Jan Martin) #52100 PR-URL: #57840

@geeksilva97

Notable changes: assert: * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370 * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370 assert,util: * (SEMVER-MINOR) improve performance (Ruben Bridgewater) #57370 benchmark: * (SEMVER-MINOR) adjust assert runtimes (Ruben Bridgewater) #57370 * (SEMVER-MINOR) skip running some assert benchmarks by default (Ruben Bridgewater) #57370 * (SEMVER-MINOR) add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370 cli: * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018 crypto: * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381 * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833 * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599 deps: * update timezone to 2025a (Node.js GitHub Bot) #56876 deps,tools: * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100 dns: * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983 doc: * add @geeksilva97 to collaborators (Edy Silva) #57241 module: * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 process: * (SEMVER-MINOR) add execve (Paolo Insogna) #56496 * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490 * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790 src: * set signal inspector io thread name (RafaelGSS) #56416 * set thread name for main thread and v8 worker (RafaelGSS) #56416 * set worker thread name using worker.name (RafaelGSS) #56416 * use a default thread name for inspector (RafaelGSS) #56416 tls: * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107 util: * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462 v8: * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146 zlib: * (SEMVER-MINOR) add zstd support (Jan Martin) #52100 PR-URL: #57840

These are the PRs for --use-system-ca: - initial implementation of the option with just macOS support #56599 landed in v23.8.0. - Windows support #56833 landed in v23.8.0 - non-Windows and non-macOS support #57009 landed in v23.9.0 This change documents the history info. Signed-off-by: Darshan Sen <[email protected]> PR-URL: #57432 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Joyee Cheung <[email protected]>

@geeksilva97

Notable changes: assert: * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370 * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370 assert,util: * (SEMVER-MINOR) improve performance (Ruben Bridgewater) #57370 benchmark: * (SEMVER-MINOR) adjust assert runtimes (Ruben Bridgewater) #57370 * (SEMVER-MINOR) skip running some assert benchmarks by default (Ruben Bridgewater) #57370 * (SEMVER-MINOR) add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370 cli: * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018 crypto: * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381 * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833 * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599 deps: * update timezone to 2025a (Node.js GitHub Bot) #56876 deps,tools: * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100 dns: * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983 doc: * add @geeksilva97 to collaborators (Edy Silva) #57241 module: * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 process: * (SEMVER-MINOR) add execve (Paolo Insogna) #56496 * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490 * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790 src: * set signal inspector io thread name (RafaelGSS) #56416 * set thread name for main thread and v8 worker (RafaelGSS) #56416 * set worker thread name using worker.name (RafaelGSS) #56416 * use a default thread name for inspector (RafaelGSS) #56416 tls: * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107 util: * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462 v8: * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146 zlib: * (SEMVER-MINOR) add zstd support (Jan Martin) #52100 PR-URL: #57840

@geeksilva97

Notable changes: assert: * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370 * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370 assert,util: * (SEMVER-MINOR) improve performance (Ruben Bridgewater) #57370 benchmark: * (SEMVER-MINOR) adjust assert runtimes (Ruben Bridgewater) #57370 * (SEMVER-MINOR) skip running some assert benchmarks by default (Ruben Bridgewater) #57370 * (SEMVER-MINOR) add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370 cli: * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018 crypto: * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381 * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833 * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599 deps: * update timezone to 2025a (Node.js GitHub Bot) #56876 deps,tools: * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100 dns: * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983 doc: * add @geeksilva97 to collaborators (Edy Silva) #57241 module: * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 process: * (SEMVER-MINOR) add execve (Paolo Insogna) #56496 * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490 * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790 src: * set signal inspector io thread name (RafaelGSS) #56416 * set thread name for main thread and v8 worker (RafaelGSS) #56416 * set worker thread name using worker.name (RafaelGSS) #56416 * use a default thread name for inspector (RafaelGSS) #56416 tls: * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107 util: * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462 v8: * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146 zlib: * (SEMVER-MINOR) add zstd support (Jan Martin) #52100 PR-URL: #57840

@geeksilva97

Notable changes: assert: * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370 * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370 cli: * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018 crypto: * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381 * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833 * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599 deps: * update timezone to 2025a (Node.js GitHub Bot) #56876 deps,tools: * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100 dns: * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983 doc: * add @geeksilva97 to collaborators (Edy Silva) #57241 module: * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 process: * (SEMVER-MINOR) add execve (Paolo Insogna) #56496 * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490 * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790 src: * set signal inspector io thread name (RafaelGSS) #56416 * set thread name for main thread and v8 worker (RafaelGSS) #56416 * set worker thread name using worker.name (RafaelGSS) #56416 * use a default thread name for inspector (RafaelGSS) #56416 tls: * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107 util: * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462 v8: * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146 zlib: * (SEMVER-MINOR) add zstd support (Jan Martin) #52100 PR-URL: #57840

@geeksilva97

Notable changes: assert: * (SEMVER-MINOR) implement partial error comparison (Ruben Bridgewater) #57370 * (SEMVER-MINOR) improve partialDeepStrictEqual (Ruben Bridgewater) #57370 cli: * (SEMVER-MINOR) allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018 crypto: * update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381 * (SEMVER-MINOR) support --use-system-ca on Windows (Joyee Cheung) #56833 * (SEMVER-MINOR) added support for reading certificates from macOS system store (Tim Jacomb) #56599 deps: * update timezone to 2025a (Node.js GitHub Bot) #56876 deps,tools: * (SEMVER-MINOR) add zstd 1.5.6 (Jan Martin) #52100 dns: * (SEMVER-MINOR) add TLSA record query and parsing (Rithvik Vibhu) #52983 doc: * add @geeksilva97 to collaborators (Edy Silva) #57241 module: * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 process: * (SEMVER-MINOR) add execve (Paolo Insogna) #56496 * (SEMVER-MINOR) add threadCpuUsage (Paolo Insogna) #56467 sqlite: * (SEMVER-MINOR) add StatementSync.prototype.columns() (Colin Ihrig) #57490 * (SEMVER-MINOR) allow returning `ArrayBufferView`s from user-defined functions (René) #56790 src: * set signal inspector io thread name (RafaelGSS) #56416 * set thread name for main thread and v8 worker (RafaelGSS) #56416 * set worker thread name using worker.name (RafaelGSS) #56416 * use a default thread name for inspector (RafaelGSS) #56416 tls: * (SEMVER-MINOR) implement tls.getCACertificates() (Joyee Cheung) #57107 util: * (SEMVER-MINOR) expose diff function used by the assertion errors (Giovanni Bucci) #57462 v8: * (SEMVER-MINOR) add v8.getCppHeapStatistics() method (Aditi) #57146 zlib: * (SEMVER-MINOR) add zstd support (Jan Martin) #52100 PR-URL: #57840

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels Jan 14, 2025

timja mentioned this pull request Jan 14, 2025

Allow Node to use certificates from the macOS Keychain when making HTTPS requests #39657

Closed

timja commented Jan 14, 2025

View reviewed changes

src/crypto/crypto_context.cc Show resolved Hide resolved

timja force-pushed the macos-system-ca-support branch from 8fd32ce to f3c212c Compare January 14, 2025 16:32

addaleax reviewed Jan 14, 2025

View reviewed changes

src/crypto/crypto_context.cc Outdated Show resolved Hide resolved

src/crypto/crypto_context.cc Outdated Show resolved Hide resolved

src/crypto/crypto_context.cc Outdated Show resolved Hide resolved

anonrig requested a review from jasnell January 14, 2025 17:29

joyeecheung reviewed Jan 15, 2025

View reviewed changes

doc/api/tls.md Outdated Show resolved Hide resolved

src/crypto/crypto_context.cc Outdated Show resolved Hide resolved

src/crypto/crypto_context.cc Outdated Show resolved Hide resolved

src/crypto/crypto_context.cc Outdated Show resolved Hide resolved

joyeecheung reviewed Jan 15, 2025

View reviewed changes

src/crypto/crypto_context.cc Outdated Show resolved Hide resolved

timja requested review from joyeecheung and addaleax January 15, 2025 17:03

timja marked this pull request as ready for review January 16, 2025 15:22

joyeecheung reviewed Jan 20, 2025

View reviewed changes