build: support LIEF 0.17.x and 1.x

[inoway46]

Keep bundled LIEF at 0.17.0 while selecting the Mach-O section API from the headers in use and the bundled source list and Mbed TLS configuration by version.

Prepare the updater for Mbed TLS 4 and TF-PSA-Crypto, including its generated sources, so the LIEF vendor update can land separately.

Validated bundled 0.17.0 with a Node.js build on macOS x64, and bundled and shared 1.0.0 with Node.js builds and 47 SEA/related tests each on Linux x64.

Fixes: #66238
Refs: #66242

Note: The build fix for #63530 and the fix for CVE-2025-15504 remain in the follow-up LIEF vendor update.

Refs: #63530
Refs: nodejs/nodejs-dependency-vuln-assessments#360
Refs: nodejs/nodejs-dependency-vuln-assessments#342

[nodejs-github-bot]

Review requested:

• @nodejs/security-wg
• @nodejs/single-executable
• @nodejs/tsc

[aduh95]

Can we split the LIEF source update to a separate PR, ideally generated by the bot? It would make reviewing much easier

[Renegade334]

Doesn't look like it was added to the GHA workflow, have opened #66242.

[inoway46]

Thanks! I'll split the LIEF source update into a separate PR and keep the Node-side changes here.

[aduh95]

Can we land the Node.js side independently from the LIEF update? I.e. can we make the codebase compatible with both LIEF 0.17.x and 1.x?

[inoway46]

Can we land the Node.js side independently from the LIEF update?

Yes, I'll make the Node.js changes compatible with both LIEF 0.17.x and 1.x so this PR can land independently, then leave the LIEF update to a separate PR.

[inoway46]

I’m working on local builds and validation, and I expect to update the PR later.

[inoway46]

Updated as discussed: this PR now keeps bundled LIEF at 0.17.0 and supports both LIEF 0.17.x and 1.x, so it can land independently of the vendor update. Local validation results are in the PR description.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.36%. Comparing base (4889fb0) to head (534c117).
⚠️ Report is 8 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #66240      +/-   ##
==========================================
- Coverage   90.37%   90.36%   -0.01%     
==========================================
  Files         790      790              
  Lines      274497   274497              
  Branches    52562    52558       -4     
==========================================
- Hits       248077   248062      -15     
+ Misses      16921    16918       -3     
- Partials     9499     9517      +18     

Files with missing lines	Coverage Δ
src/node_sea_bin.cc	41.07% <ø> (ø)

... and 35 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/77872/

[aduh95]

I tried building with a shared LIEF 1.0.0 and got the following error:

Undefined symbols for architecture arm64:
  "tl::expected<LIEF::ok_t, lief_errors>::operator bool() const", referenced from:
      node::sea::InjectIntoPE(std::__1::vector<unsigned char, std::__1::allocator<unsigned char>> const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::vector<unsigned char, std::__1::allocator<unsigned char>> const&) in libnode_base.a(node_base.node_sea_bin.o)
ld: symbol(s) not found for architecture arm64

The following diff fixes it:

diff --git a/src/node_sea_bin.cc b/src/node_sea_bin.cc
index bd61ea2942e..44ac892a531 100644
--- a/src/node_sea_bin.cc
+++ b/src/node_sea_bin.cc
@@ -306,7 +306,12 @@ InjectOutput InjectIntoPE(const std::vector<uint8_t>& executable,
   cfg.resources = true;
   cfg.rsrc_section = ".rsrc";  // ensure section name
   LIEF::PE::Builder builder(*binary, cfg);
+#if LIEF_VERSION_MAJOR >= 1
+  builder.build();
+  if (builder.get_build().empty()) {
+#else
   if (!builder.build()) {
+#endif
     return {InjectResult::kError, {}, "Failed to build modified PE binary"};
   }

[inoway46]

@aduh95 I reproduced this on macOS x64 with shared LIEF 1.0.0 and optimization disabled. d91e91d6 added extern template declarations, but the instantiations are hidden in the shared library.

Two possible workarounds:

1. Explicitly instantiate the member in Node.js:

   template tl::expected<LIEF::ok_t, lief_errors>::operator bool() const;

   This fixed the link locally and preserves the return-value check, but depends on LIEF's underlying template type.
2. Your suggested builder.get_build().empty() check. This avoids that dependency; LIEF 1.0.0's build() returns ok() even after internal failures, though that could change later.

Which would you prefer pending an upstream fix? If we use option 2, should we restrict it to 1.0.0 rather than all 1.x versions?

[aduh95]

You're asking me but I have no idea. We should maybe ask upstream to add that to their migration guide

[inoway46]

Reported upstream: lief-project/LIEF#1387.

Added the get_build().empty() workaround in 249d04a restricted to LIEF 1.0.0. Verified linking with shared LIEF and optimization disabled, plus PE resource injection on macOS x64.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/77964/

[inoway46]

Validated LIEF build/SEA behavior and audited lief.gyp against upstream CMake.

Platform	Bundled 0.17.0	Shared 0.17.0	Bundled 1.0.0	Shared 1.0.0
Windows x64 *	Passed	Passed	Passed	Passed
Linux x64	—	—	Passed	—
macOS arm64	—	—	Passed	Passed
macOS x64	—	—	—	Build + SEA generation

Passed = build + SEA checks passed; — = not tested.

No PR-related failures or missing/unnecessary lief.gyp entries were found in the tested configurations.

Windows jobs failed only at the final check. Build and tests were all passed.

Runs: Windows, Linux/macOS bundled, macOS shared.