From 4dc9c18d469398c84b8592dc2d40184ca0105621 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A2u=20Cao?= Date: Sat, 24 Oct 2026 15:29:21 +0200 Subject: [PATCH] Move Node services onto patched releases for the eMudhra CA incident Bump Node to patched releases (mastodon/sockethub 24.22.1, RTL 22.23.4). Force the pinned major's latest patch in kosmos-nodejs: nodejs_install only selects the repo major and a bare `package nodejs` never upgrades an already installed package. For hosts stuck on Node 16 (no patched 16.x), run the services with NODE_OPTIONS=--use-openssl-ca so they use the patched system trust store: ipfs-pinner, kredits-github, hubot botka/hal8000, sockethub. --- site-cookbooks/kosmos-bitcoin/recipes/rtl.rb | 2 +- .../kosmos-hubot/recipes/botka_irc-libera-chat.rb | 3 +++ site-cookbooks/kosmos-hubot/recipes/hal8000_xmpp.rb | 3 +++ site-cookbooks/kosmos-ipfs/recipes/kredits_pinner.rb | 5 ++++- site-cookbooks/kosmos-mastodon/attributes/default.rb | 2 +- site-cookbooks/kosmos-nodejs/recipes/default.rb | 8 ++++++++ site-cookbooks/kredits-github/recipes/default.rb | 5 ++++- site-cookbooks/sockethub/recipes/default.rb | 3 ++- 8 files changed, 26 insertions(+), 5 deletions(-) diff --git a/site-cookbooks/kosmos-bitcoin/recipes/rtl.rb b/site-cookbooks/kosmos-bitcoin/recipes/rtl.rb index 118cd32..e19e829 100644 --- a/site-cookbooks/kosmos-bitcoin/recipes/rtl.rb +++ b/site-cookbooks/kosmos-bitcoin/recipes/rtl.rb @@ -3,7 +3,7 @@ # Recipe:: rtl # -node.override["kosmos_nodejs"]["version"] = "22.23.1" +node.override["kosmos_nodejs"]["version"] = "22.23.4" include_recipe 'kosmos-nodejs' app_name = "rtl" diff --git a/site-cookbooks/kosmos-hubot/recipes/botka_irc-libera-chat.rb b/site-cookbooks/kosmos-hubot/recipes/botka_irc-libera-chat.rb index 1e51b9e..a7340d4 100644 --- a/site-cookbooks/kosmos-hubot/recipes/botka_irc-libera-chat.rb +++ b/site-cookbooks/kosmos-hubot/recipes/botka_irc-libera-chat.rb @@ -48,6 +48,9 @@ end service_env = { "HUBOT_LOG_LEVEL" => node.chef_environment == "development" ? "debug" : "info", + # Node 16 bundles its own CA store, which still trusts the compromised + # eMudhra intermediate's root; use the (patched) system trust store instead. + "NODE_OPTIONS" => "--use-openssl-ca", "HUBOT_IRC_USESSL" => "true", "HUBOT_IRC_SERVER" => credentials["znc_host"], "HUBOT_IRC_PORT" => credentials["znc_port"], diff --git a/site-cookbooks/kosmos-hubot/recipes/hal8000_xmpp.rb b/site-cookbooks/kosmos-hubot/recipes/hal8000_xmpp.rb index 3afc8df..a33058a 100644 --- a/site-cookbooks/kosmos-hubot/recipes/hal8000_xmpp.rb +++ b/site-cookbooks/kosmos-hubot/recipes/hal8000_xmpp.rb @@ -69,6 +69,9 @@ end service_env = { "HUBOT_LOG_LEVEL" => node.chef_environment == "development" ? "debug" : "info", + # Node 16 bundles its own CA store, which still trusts the compromised + # eMudhra intermediate's root; use the (patched) system trust store instead. + "NODE_OPTIONS" => "--use-openssl-ca", "HUBOT_XMPP_USERNAME" => "hal8000@kosmos.org/hubot", "HUBOT_XMPP_PASSWORD" => data_bag['xmpp_password'], "HUBOT_XMPP_HOST" => "xmpp.kosmos.org", diff --git a/site-cookbooks/kosmos-ipfs/recipes/kredits_pinner.rb b/site-cookbooks/kosmos-ipfs/recipes/kredits_pinner.rb index 1c02cd8..28163a2 100644 --- a/site-cookbooks/kosmos-ipfs/recipes/kredits_pinner.rb +++ b/site-cookbooks/kosmos-ipfs/recipes/kredits_pinner.rb @@ -32,7 +32,10 @@ execute "npm install" do end service_env = { - 'DEBUG' => 'ipfs-pinner' + 'DEBUG' => 'ipfs-pinner', + # Node 16 bundles its own CA store, which still trusts the compromised + # eMudhra intermediate's root; use the (patched) system trust store instead. + 'NODE_OPTIONS' => '--use-openssl-ca' } systemd_unit "#{app_name}.service" do diff --git a/site-cookbooks/kosmos-mastodon/attributes/default.rb b/site-cookbooks/kosmos-mastodon/attributes/default.rb index 31f88e3..3704141 100644 --- a/site-cookbooks/kosmos-mastodon/attributes/default.rb +++ b/site-cookbooks/kosmos-mastodon/attributes/default.rb @@ -18,7 +18,7 @@ node.default["kosmos-mastodon"]["deploy"] = true node.default["kosmos-mastodon"]["build"] = true # Runtime versions -node.default["kosmos-mastodon"]["nodejs_version"] = "24.21.0" +node.default["kosmos-mastodon"]["nodejs_version"] = "24.22.1" node.default["kosmos-mastodon"]["ruby_version"] = "4.0.7" node.default["kosmos-mastodon"]["ruby_build_version"] = "v20260924" diff --git a/site-cookbooks/kosmos-nodejs/recipes/default.rb b/site-cookbooks/kosmos-nodejs/recipes/default.rb index 2769bdc..a01c622 100644 --- a/site-cookbooks/kosmos-nodejs/recipes/default.rb +++ b/site-cookbooks/kosmos-nodejs/recipes/default.rb @@ -7,3 +7,11 @@ nodejs_install 'nodejs' do install_method 'package' version node["kosmos_nodejs"]["version"] end + +# nodejs_install only uses the version to select the Nodesource repo major, then +# runs a bare `package nodejs`, which Chef considers up to date for an already +# installed package. Force an upgrade so a newer patch of the same major (e.g. +# 22.23.1 -> 22.23.4) is actually installed. +package 'nodejs' do + action :upgrade +end diff --git a/site-cookbooks/kredits-github/recipes/default.rb b/site-cookbooks/kredits-github/recipes/default.rb index 49fffe1..d37ba9e 100644 --- a/site-cookbooks/kredits-github/recipes/default.rb +++ b/site-cookbooks/kredits-github/recipes/default.rb @@ -44,7 +44,10 @@ service_env = { "LOG_LEVEL" => 'info', "APP_ID" => credentials["app_id"], "PRIVATE_KEY_PATH" => "#{app_path}/github_app_key.pem", - "WEBHOOK_SECRET" => credentials["webhook_secret"] + "WEBHOOK_SECRET" => credentials["webhook_secret"], + # Node 16 bundles its own CA store, which still trusts the compromised + # eMudhra intermediate's root; use the (patched) system trust store instead. + "NODE_OPTIONS" => "--use-openssl-ca" } systemd_unit "#{app_name}.service" do diff --git a/site-cookbooks/sockethub/recipes/default.rb b/site-cookbooks/sockethub/recipes/default.rb index 8eb4beb..5a86cdc 100644 --- a/site-cookbooks/sockethub/recipes/default.rb +++ b/site-cookbooks/sockethub/recipes/default.rb @@ -3,7 +3,7 @@ # Recipe:: default # -node.override["kosmos_nodejs"]["version"] = "24.21.0" +node.override["kosmos_nodejs"]["version"] = "24.22.1" include_recipe 'kosmos-nodejs' user = "sockethub" @@ -63,6 +63,7 @@ ExecStart=#{entry} User=#{user} Group=#{group} Environment=SOCKETHUB_CONFIG=/etc/sockethub/sockethub.config.json +Environment=NODE_OPTIONS=--use-openssl-ca Restart=always [Install]