WIP: Prebuild (needs to be 2nd publish, after setup)

Author: pimterry

.github/workflows/ci.yml

@@ -3,11 +3,12 @@ name: CI
 on:
   push:
   pull_request:
+  workflow_dispatch:
   schedule:
     - cron: '0 6 * * 1' # Weekly test to check new Node versions
 
 jobs:
-  build-and-test:
+  test:
     runs-on: ubuntu-latest
 
     strategy:
@@ -26,11 +27,109 @@ jobs:
           cache: npm
           check-latest: true
 
-      - name: Node version
-        run: node --version
-      - name: OpenSSL version
-        run: node -e "console.log('OpenSSL', process.versions.openssl)"
+      - run: node -e "console.log('Node', process.version, '| OpenSSL', process.versions.openssl)"
 
-      - run: npm ci
-      - run: npm run build
+      - run: npm ci --ignore-scripts
+
+      # Build the shipped artifact (a --napi prebuild) and prove it loads and
+      # works before running the suite against it.
+      - run: npm run prebuild
+      - run: npm run test:smoke
+
+      - run: npm run build:ts
       - run: npm test
+
+  prebuild:
+    name: prebuild (${{ matrix.name }})
+    runs-on: ${{ matrix.runs-on }}
+    container: ${{ matrix.container }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { name: linux-x64-glibc,   runs-on: ubuntu-latest }
+          - { name: linux-x64-musl,    runs-on: ubuntu-latest,    container: node:24-alpine }
+          - { name: linux-arm64-glibc, runs-on: ubuntu-24.04-arm }
+          - { name: linux-arm64-musl,  runs-on: ubuntu-24.04-arm, container: node:24-alpine }
+    steps:
+      # Alpine has no toolchain or git; install before checkout, which needs git.
+      - if: ${{ matrix.container }}
+        run: apk add --no-cache build-base python3 git tar
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        if: ${{ !matrix.container }}
+        with:
+          node-version: 24
+      - run: npm ci --ignore-scripts
+      - run: npm run prebuild
+      - run: npm run test:smoke
+      - run: tar -czf prebuilds-${{ matrix.name }}.tar.gz prebuilds
+      - uses: actions/upload-artifact@v4
+        with:
+          name: prebuilds-${{ matrix.name }}
+          path: prebuilds-${{ matrix.name }}.tar.gz
+
+  # Prove the single linux-x64 prebuild loads across the whole supported Node
+  # range (24.15+), not just the Node it was built with.
+  smoke-across-node:
+    name: smoke (node ${{ matrix.node-version }}, reuse prebuild)
+    needs: prebuild
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: [24, 26, latest]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+      - run: npm ci --ignore-scripts
+      - uses: actions/download-artifact@v4
+        with:
+          name: prebuilds-linux-x64-glibc
+      - run: tar -xzf prebuilds-linux-x64-glibc.tar.gz
+      - run: npm run test:smoke
+
+  publish:
+    name: Publish to npm
+    needs: [test, prebuild, smoke-across-node]
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    environment:
+      name: npm
+      url: https://www.npmjs.com/package/tls-impersonate
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          registry-url: 'https://registry.npmjs.org'
+
+      # Trusted publishing (tokenless OIDC) needs npm >= 11.5.1.
+      - run: npm install -g npm@latest
+
+      - run: npm ci --ignore-scripts
+
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: prebuilds-*
+          path: artifacts
+          merge-multiple: true
+      - run: for f in artifacts/*.tar.gz; do tar -xzf "$f"; done
+      - run: ls -R prebuilds
+
+      - name: Verify tag matches package.json version
+        run: |
+          TAG_VERSION=${GITHUB_REF#refs/tags/v}
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
+            echo "Tag v$TAG_VERSION does not match package.json version $PKG_VERSION"
+            exit 1
+          fi
+          echo "Publishing $PKG_VERSION"
+
+      - run: npm publish --provenance --access public

.gitignore

@@ -3,3 +3,4 @@ dist/
 *.tsbuildinfo
 *.tgz
 build/
+prebuilds/

native/binding.cc

@@ -3,19 +3,38 @@
 //
 // Registered as a NAPI module, so a single prebuilt binary loads across all
 // Node ABIs (no NODE_MODULE_VERSION gate). The one Node-internal dependency,
-// node::crypto::GetSSLCtx, is resolved with dlsym and passed V8 handles bridged
-// from napi_value; both the bridge and that symbol are ABI-stable, so the same
-// binary works on any Node >= 24.15.0 that exports GetSSLCtx.
+// node::crypto::GetSSLCtx, is declared and linked directly (weak on GCC/Clang, so
+// its address is null and we throw cleanly on a Node that lacks it); V8 handles
+// are bridged from napi_value. Both the bridge and that symbol are ABI-stable and
+// the mangled name depends only on the signature, so one binary works on any Node
+// >= 24.15.0 that exports GetSSLCtx - no per-version build.
 
 #include <node_api.h>
 #include <v8.h>
 #include <openssl/ssl.h>
 #include <openssl/tls1.h>
-#include <dlfcn.h>
 #include <cmath>
 #include <cstring>
 #include <vector>
 
+// node::crypto::GetSSLCtx (a NODE_EXTERN since Node 24.15) unwraps a SecureContext
+// to its SSL_CTX. We declare the prototype ourselves so the compiler emits the
+// correctly mangled reference on every platform - no hardcoded symbol string.
+// Marked weak where the toolchain supports it, so on a Node that does not export
+// it the address is null and we throw cleanly rather than failing to load.
+#ifdef _WIN32
+#define TLS_IMPERSONATE_WEAK
+#else
+#define TLS_IMPERSONATE_WEAK __attribute__((weak))
+#endif
+
+namespace node {
+namespace crypto {
+TLS_IMPERSONATE_WEAK SSL_CTX* GetSSLCtx(v8::Local<v8::Context> context,
+                                        v8::Local<v8::Value> value);
+}  // namespace crypto
+}  // namespace node
+
 namespace {
 
 // ─── napi_value <-> v8::Local bridge ─────────────────────────────────────────
@@ -33,29 +52,20 @@ static v8::Local<v8::Value> V8LocalFromNapi(napi_value v) {
 
 // ─── SSL_CTX resolution ──────────────────────────────────────────────────────
 
-using GetSSLCtxFunc = SSL_CTX* (*)(v8::Local<v8::Context>, v8::Local<v8::Value>);
-
-static GetSSLCtxFunc ResolveGetSSLCtx() {
-  // Mangled: node::crypto::GetSSLCtx(v8::Local<v8::Context>, v8::Local<v8::Value>)
-  return reinterpret_cast<GetSSLCtxFunc>(
-      dlsym(RTLD_DEFAULT,
-          "_ZN4node6crypto9GetSSLCtxEN2v85LocalINS1_7ContextEEENS2_INS1_5ValueEEE"));
-}
-
 // Resolve the SSL_CTX* behind a SecureContext value, throwing a JS exception
 // (and returning nullptr) if the runtime is unsupported or the value is invalid.
-// GetSSLCtx unwraps the outer tls.createSecureContext() wrapper itself.
+// node::crypto::GetSSLCtx unwraps the outer tls.createSecureContext() wrapper.
 static SSL_CTX* GetSSLCtx(napi_env env, napi_value secure_context) {
-  static GetSSLCtxFunc fn = ResolveGetSSLCtx();
-  if (fn == nullptr) {
+  auto* get_ssl_ctx = node::crypto::GetSSLCtx;  // null iff Node lacks the export
+  if (get_ssl_ctx == nullptr) {
     napi_throw_error(env, nullptr,
         "tls-impersonate requires Node.js >= 24.15.0 "
         "(node::crypto::GetSSLCtx is unavailable in this runtime)");
     return nullptr;
   }
   v8::Isolate* isolate = v8::Isolate::GetCurrent();
   v8::Local<v8::Context> context = isolate->GetCurrentContext();
-  SSL_CTX* ssl_ctx = fn(context, V8LocalFromNapi(secure_context));
+  SSL_CTX* ssl_ctx = get_ssl_ctx(context, V8LocalFromNapi(secure_context));
   if (ssl_ctx == nullptr) {
     napi_throw_type_error(env, nullptr,
         "Argument must be a TLS SecureContext");