From f55a47766c301dcbd4aad2fa378b73360869b918 Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Thu, 15 Oct 2026 10:15:59 +0200 Subject: [PATCH 1/3] tools: add `--error-on-warn` configure flag in `test-shared.yml` Given that this workflow compiles V8 and other libs separately, that would allow us to detect any Node.js-specific warning that needs to be addressed. Signed-off-by: Antoine du Hamel --- tools/nix/ci-shell.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/tools/nix/ci-shell.nix b/tools/nix/ci-shell.nix index b446c9e33d3b..0d5c9e997271 100644 --- a/tools/nix/ci-shell.nix +++ b/tools/nix/ci-shell.nix @@ -9,6 +9,10 @@ import ../../shell.nix ( loadJSBuiltinsDynamically = false; devTools = [ ]; benchmarkTools = [ ]; + extraConfigFlags = [ + "--debug-node" + "--error-on-warn" + ]; } // pkgs.lib.optionalAttrs pkgs.stdenv.hostPlatform.isDarwin ( # Disable optional features on Darwin for coverage and faster CI. @@ -20,6 +24,7 @@ import ../../shell.nix ( // { withSSL = true; # no-SSL coverage is ensured by Jenkins extraConfigFlags = [ + "--error-on-warn" "--without-inspector" "--without-node-options" ]; From b30a3bc3e8a23a9c86ad2f6980d83125a00fcd91 Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Thu, 15 Oct 2026 10:48:26 +0200 Subject: [PATCH 2/3] crypto: use `OPENSSL_SIZE_T` instead of hard coding `int` Signed-off-by: Antoine du Hamel --- src/crypto/crypto_common.cc | 4 ++-- src/crypto/crypto_context.cc | 4 ++-- src/crypto/crypto_x509.cc | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/crypto/crypto_common.cc b/src/crypto/crypto_common.cc index ea0747511a10..ad056b5610bc 100644 --- a/src/crypto/crypto_common.cc +++ b/src/crypto/crypto_common.cc @@ -90,7 +90,7 @@ StackOfX509 CloneSSLCerts(X509Pointer&& cert, if (!peer_certs) return StackOfX509(); if (cert && !sk_X509_push(peer_certs.get(), cert.release())) return StackOfX509(); - for (int i = 0; i < sk_X509_num(ssl_certs); i++) { + for (OPENSSL_SIZE_T i = 0; i < sk_X509_num(ssl_certs); i++) { X509Pointer cert(X509_dup(sk_X509_value(ssl_certs, i))); if (!cert || !sk_X509_push(peer_certs.get(), cert.get())) return StackOfX509(); @@ -106,7 +106,7 @@ MaybeLocal AddIssuerChainToObject(X509Pointer* cert, Environment* const env) { cert->reset(sk_X509_delete(peer_certs.get(), 0)); for (;;) { - int i; + OPENSSL_SIZE_T i; for (i = 0; i < sk_X509_num(peer_certs.get()); i++) { X509View ca(sk_X509_value(peer_certs.get(), i)); if (!cert->view().isIssuedBy(ca)) continue; diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc index d314d15cc542..0f26b1ceb543 100644 --- a/src/crypto/crypto_context.cc +++ b/src/crypto/crypto_context.cc @@ -152,7 +152,7 @@ int SSL_CTX_use_certificate_chain(SSL_CTX* ctx, // the CA certificates. SSL_CTX_clear_extra_chain_certs(ctx); - for (int i = 0; i < sk_X509_num(extra_certs); i++) { + for (OPENSSL_SIZE_T i = 0; i < sk_X509_num(extra_certs); i++) { X509* ca = sk_X509_value(extra_certs, i); // NOTE: Increments reference count on `ca` @@ -2268,7 +2268,7 @@ void SecureContext::LoadPKCS12(const FunctionCallbackInfo& args) { } // Add CA certs too - for (int i = 0; i < sk_X509_num(extra_certs.get()); i++) { + for (OPENSSL_SIZE_T i = 0; i < sk_X509_num(extra_certs.get()); i++) { X509* ca = sk_X509_value(extra_certs.get(), i); X509_STORE_add_cert(sc->GetCertStoreOwnedByThisSecureContext(), ca); diff --git a/src/crypto/crypto_x509.cc b/src/crypto/crypto_x509.cc index 14825742e986..1fefd325ddf1 100644 --- a/src/crypto/crypto_x509.cc +++ b/src/crypto/crypto_x509.cc @@ -933,7 +933,7 @@ MaybeLocal X509Certificate::NewWithIssuers( } Local issuer; - if (issuer_chain != nullptr && start < sk_X509_num(issuer_chain)) { + if (issuer_chain != nullptr && static_cast(start) < sk_X509_num(issuer_chain)) { X509Pointer issuer_cert = X509View(sk_X509_value(issuer_chain, start)).clone(); if (!issuer_cert) [[unlikely]] { From a7ea4b43f3bb701597359e91be19a8ea791c3b0e Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Thu, 15 Oct 2026 11:01:45 +0200 Subject: [PATCH 3/3] fixup! crypto: use `OPENSSL_SIZE_T` instead of hard coding `int` --- src/crypto/crypto_hash.cc | 2 +- src/crypto/crypto_x509.cc | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/crypto/crypto_hash.cc b/src/crypto/crypto_hash.cc index 24d49a6d3774..c58c3ac6477e 100644 --- a/src/crypto/crypto_hash.cc +++ b/src/crypto/crypto_hash.cc @@ -403,7 +403,7 @@ void OneShotDigestWithMD(Environment* env, enum encoding output_enc = ParseEncoding(isolate, args[4], args[5], HEX); bool is_xof = (EVP_MD_flags(md) & EVP_MD_FLAG_XOF) != 0; - int output_length = EVP_MD_size(md); + OPENSSL_SIZE_T output_length = EVP_MD_size(md); // This is to cause hash() to fail when an incorrect // outputLength option was passed for a non-XOF hash function. diff --git a/src/crypto/crypto_x509.cc b/src/crypto/crypto_x509.cc index 1fefd325ddf1..bc90568b2259 100644 --- a/src/crypto/crypto_x509.cc +++ b/src/crypto/crypto_x509.cc @@ -933,7 +933,8 @@ MaybeLocal X509Certificate::NewWithIssuers( } Local issuer; - if (issuer_chain != nullptr && static_cast(start) < sk_X509_num(issuer_chain)) { + if (issuer_chain != nullptr && + static_cast(start) < sk_X509_num(issuer_chain)) { X509Pointer issuer_cert = X509View(sk_X509_value(issuer_chain, start)).clone(); if (!issuer_cert) [[unlikely]] {