From db2c41910cb2a13b91aa2ec1fa77dd5670f7286b Mon Sep 17 00:00:00 2001 From: Malte Ubl Date: Tue, 27 Oct 2026 06:01:13 -0700 Subject: [PATCH] Suppress the root certificates' leak under a stripped libnode The libnode-packs workflow's packs are stripped, so the certificate loading threads' Node frames have no names and the node::crypto suppressions do not match. Each certificate is parsed through libnode's OpenSSL PEM reader, which the runtime never links. Co-Authored-By: Claude Opus 5.5 --- tests/harness/lsan.supp | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/tests/harness/lsan.supp b/tests/harness/lsan.supp index a0fe1c5ae..cad4b08e9 100644 --- a/tests/harness/lsan.supp +++ b/tests/harness/lsan.supp @@ -20,6 +20,11 @@ leak:node::crypto::GetSystemStoreCACertificates leak:node::crypto::GetExtraCACertificates leak:node::crypto::GetOpenSSLSystemCertificates leak:node::crypto::LoadCertsFromBIO +# The same certificates under a stripped libnode (the packs the +# libnode-packs workflow builds), where the loading threads' Node frames +# have no names: each one is parsed through libnode's OpenSSL PEM reader. +# The runtime has no OpenSSL of its own, so only libnode reaches it. +leak:PEM_ASN1_read_bio # The certificates' lazily decoded keys, cached in them when a root store # is built. leak:node::crypto::NewRootCertStore