build: support LIEF 0.17.x and 1.x

[inoway46]

Keep bundled LIEF at 0.17.0 while selecting the Mach-O section API from the headers in use and the bundled source list and Mbed TLS configuration by version.

Prepare the updater for Mbed TLS 4 and TF-PSA-Crypto, including its generated sources, so the LIEF vendor update can land separately.

Validated bundled 0.17.0 with a Node.js build on macOS x64, and bundled and shared 1.0.0 with Node.js builds and 47 SEA/related tests each on Linux x64.

Fixes: #66238
Refs: #66242

Note: The build fix for #63530 and the fix for CVE-2025-15504 remain in the follow-up LIEF vendor update.

Refs: #63530
Refs: nodejs/nodejs-dependency-vuln-assessments#360
Refs: nodejs/nodejs-dependency-vuln-assessments#342

[nodejs-github-bot]

Review requested:

• @nodejs/security-wg
• @nodejs/single-executable
• @nodejs/tsc

[aduh95]

Can we split the LIEF source update to a separate PR, ideally generated by the bot? It would make reviewing much easier

[Renegade334]

Doesn't look like it was added to the GHA workflow, have opened #66242.

[inoway46]

Thanks! I'll split the LIEF source update into a separate PR and keep the Node-side changes here.

[aduh95]

Can we land the Node.js side independently from the LIEF update? I.e. can we make the codebase compatible with both LIEF 0.17.x and 1.x?

[inoway46]

Can we land the Node.js side independently from the LIEF update?

Yes, I'll make the Node.js changes compatible with both LIEF 0.17.x and 1.x so this PR can land independently, then leave the LIEF update to a separate PR.

[inoway46]

I’m working on local builds and validation, and I expect to update the PR later.

[inoway46]

Updated as discussed: this PR now keeps bundled LIEF at 0.17.0 and supports both LIEF 0.17.x and 1.x, so it can land independently of the vendor update. Local validation results are in the PR description.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.38%. Comparing base (18c2b33) to head (6a60729).
⚠️ Report is 96 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #66240      +/-   ##
==========================================
+ Coverage   90.27%   90.38%   +0.10%     
==========================================
  Files         789      790       +1     
  Lines      272907   274292    +1385     
  Branches    52117    52504     +387     
==========================================
+ Hits       246373   247916    +1543     
+ Misses      16988    16852     -136     
+ Partials     9546     9524      -22     

Files with missing lines	Coverage Δ
src/node_sea_bin.cc	41.07% <ø> (ø)

... and 117 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/77872/

[aduh95]

I tried building with a shared LIEF 1.0.0 and got the following error:

Undefined symbols for architecture arm64:
  "tl::expected<LIEF::ok_t, lief_errors>::operator bool() const", referenced from:
      node::sea::InjectIntoPE(std::__1::vector<unsigned char, std::__1::allocator<unsigned char>> const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::vector<unsigned char, std::__1::allocator<unsigned char>> const&) in libnode_base.a(node_base.node_sea_bin.o)
ld: symbol(s) not found for architecture arm64

The following diff fixes it:

diff --git a/src/node_sea_bin.cc b/src/node_sea_bin.cc
index bd61ea2942e..44ac892a531 100644
--- a/src/node_sea_bin.cc
+++ b/src/node_sea_bin.cc
@@ -306,7 +306,12 @@ InjectOutput InjectIntoPE(const std::vector<uint8_t>& executable,
   cfg.resources = true;
   cfg.rsrc_section = ".rsrc";  // ensure section name
   LIEF::PE::Builder builder(*binary, cfg);
+#if LIEF_VERSION_MAJOR >= 1
+  builder.build();
+  if (builder.get_build().empty()) {
+#else
   if (!builder.build()) {
+#endif
     return {InjectResult::kError, {}, "Failed to build modified PE binary"};
   }

[inoway46]

@aduh95 I reproduced this on macOS x64 with shared LIEF 1.0.0 and optimization disabled. d91e91d6 added extern template declarations, but the instantiations are hidden in the shared library.

Two possible workarounds:

1. Explicitly instantiate the member in Node.js:

   template tl::expected<LIEF::ok_t, lief_errors>::operator bool() const;

   This fixed the link locally and preserves the return-value check, but depends on LIEF's underlying template type.
2. Your suggested builder.get_build().empty() check. This avoids that dependency; LIEF 1.0.0's build() returns ok() even after internal failures, though that could change later.

Which would you prefer pending an upstream fix? If we use option 2, should we restrict it to 1.0.0 rather than all 1.x versions?

[aduh95]

You're asking me but I have no idea. We should maybe ask upstream to add that to their migration guide

[inoway46]

Reported upstream: lief-project/LIEF#1387.

Added the get_build().empty() workaround in c8b7fb1, restricted to LIEF 1.0.0. Verified linking with shared LIEF and optimization disabled, plus PE resource injection on macOS x64.

[aduh95]

What's the reasoning for restricting it to a specific version number?

[inoway46]

I restricted it to 1.0.0 because get_build().empty() is a workaround and isn’t exactly equivalent to checking build()’s return value, so I wanted other versions to keep the normal check.

That said, the full CI passed even without this workaround, so pinning it to 1.0.0 could silently reintroduce the issue on the next LIEF update if it hasn’t been fixed upstream yet. Applying it to 1.x and explicitly reverting it once the upstream issue is fixed seems safer and simpler to maintain. I’ll update it that way.