trending/scriptc
1
0
Fork 0
mirror of https://github.com/vercel-labs/scriptc.git synced 2026-11-04 08:04:37 +08:00
Code Issues Packages Projects Releases Wiki Activity

Suppress the root certificates' leak under a stripped libnode

Browse Source 
The libnode-packs workflow's packs are stripped, so the certificate
loading threads' Node frames have no names and the node::crypto
suppressions do not match. Each certificate is parsed through libnode's
OpenSSL PEM reader, which the runtime never links.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Malte Ubl
2026-10-27 06:01:13 -07:00
co-authored by Claude Opus 5.5
parent 597b759e4f
commit db2c41910c
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/harness/lsan.supp
+5
View File
@@ -20,6 +20,11 @@ leak:node::crypto::GetSystemStoreCACertificates
leak:node::crypto::GetExtraCACertificates
leak:node::crypto::GetOpenSSLSystemCertificates
leak:node::crypto::LoadCertsFromBIO
# The same certificates under a stripped libnode (the packs the
# libnode-packs workflow builds), where the loading threads' Node frames
# have no names: each one is parsed through libnode's OpenSSL PEM reader.
# The runtime has no OpenSSL of its own, so only libnode reaches it.
leak:PEM_ASN1_read_bio
# The certificates' lazily decoded keys, cached in them when a root store
# is built.
leak:node::crypto::NewRootCertStore