diff --git a/.gitignore b/.gitignore
index 7ba7e23..48f5536 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/node-v12.10.0-stripped.tar.gz
+SOURCES/node-v12.14.1-stripped.tar.gz
diff --git a/.rh-nodejs12-nodejs.metadata b/.rh-nodejs12-nodejs.metadata
index 7394743..49f377f 100644
--- a/.rh-nodejs12-nodejs.metadata
+++ b/.rh-nodejs12-nodejs.metadata
@@ -1 +1 @@
-a09db77361d685f5bd77634dff488d09bef8aaf9 SOURCES/node-v12.10.0-stripped.tar.gz
+6b06eb123f621c1f678c773938134679f7d6e6f4 SOURCES/node-v12.14.1-stripped.tar.gz
diff --git a/SOURCES/0001-Remove-or-backport-OpenSSL-features.patch b/SOURCES/0001-Remove-or-backport-OpenSSL-features.patch
index aa29290..775b3b5 100644
--- a/SOURCES/0001-Remove-or-backport-OpenSSL-features.patch
+++ b/SOURCES/0001-Remove-or-backport-OpenSSL-features.patch
@@ -1,11 +1,34 @@
+From fc16538049c634f735da3a40878c18f027004b37 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20Stan=C4=9Bk?= <jstanek@redhat.com>
+Date: Thu, 16 Jan 2020 08:48:52 +0100
+Subject: [PATCH 1/4] Remove or backport OpenSSL features
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Jan Staněk <jstanek@redhat.com>
+---
+ doc/api/cli.md                |  18 --
+ lib/_tls_common.js            |   2 +-
+ lib/internal/crypto/keygen.js |   8 +-
+ lib/tls.js                    |   9 +-
+ src/node_constants.cc         |  12 +-
+ src/node_crypto.cc            | 482 ++++++++++++++++++++++++++++++++--
+ src/node_crypto.h             |  42 +++
+ src/node_crypto_bio.cc        |  29 +-
+ src/node_errors.h             |   4 +-
+ src/node_options.cc           |   4 +
+ src/tls_wrap.cc               |   2 +
+ 11 files changed, 548 insertions(+), 64 deletions(-)
+
 diff --git a/doc/api/cli.md b/doc/api/cli.md
-index fdc1d790f1..619a9b11c4 100644
+index f9eb87e..89c41de 100644
 --- a/doc/api/cli.md
 +++ b/doc/api/cli.md
-@@ -670,14 +670,6 @@ added: v12.0.0
+@@ -695,14 +695,6 @@ added: v12.0.0
  Set [`tls.DEFAULT_MAX_VERSION`][] to 'TLSv1.2'. Use to disable support for
  TLSv1.3.
- 
+
 -### `--tls-max-v1.3`
 -<!-- YAML
 -added: v12.0.0
@@ -17,10 +40,10 @@ index fdc1d790f1..619a9b11c4 100644
  ### `--tls-min-v1.0`
  <!-- YAML
  added: v12.0.0
-@@ -703,14 +695,6 @@ Set default [`tls.DEFAULT_MIN_VERSION`][] to 'TLSv1.2'. This is the default for
+@@ -728,14 +720,6 @@ Set default [`tls.DEFAULT_MIN_VERSION`][] to 'TLSv1.2'. This is the default for
  12.x and later, but the option is supported for compatibility with older Node.js
  versions.
- 
+
 -### `--tls-min-v1.3`
 -<!-- YAML
 -added: v12.0.0
@@ -32,20 +55,20 @@ index fdc1d790f1..619a9b11c4 100644
  ### `--trace-deprecation`
  <!-- YAML
  added: v0.8.0
-@@ -1042,11 +1026,9 @@ Node.js options that are allowed are:
- - `--title`
- - `--tls-cipher-list`
- - `--tls-max-v1.2`
--- `--tls-max-v1.3`
- - `--tls-min-v1.0`
- - `--tls-min-v1.1`
- - `--tls-min-v1.2`
--- `--tls-min-v1.3`
- - `--trace-deprecation`
- - `--trace-event-categories`
- - `--trace-event-file-pattern`
+@@ -1070,11 +1054,9 @@ Node.js options that are allowed are:
+ * `--title`
+ * `--tls-cipher-list`
+ * `--tls-max-v1.2`
+-* `--tls-max-v1.3`
+ * `--tls-min-v1.0`
+ * `--tls-min-v1.1`
+ * `--tls-min-v1.2`
+-* `--tls-min-v1.3`
+ * `--trace-deprecation`
+ * `--trace-event-categories`
+ * `--trace-event-file-pattern`
 diff --git a/lib/_tls_common.js b/lib/_tls_common.js
-index efe9040956..a88bbdc7fd 100644
+index 981503e..17c3e3a 100644
 --- a/lib/_tls_common.js
 +++ b/lib/_tls_common.js
 @@ -49,7 +49,7 @@ function toV(which, v, def) {
@@ -56,9 +79,9 @@ index efe9040956..a88bbdc7fd 100644
 +  if (v === 'TLSv1.3' && TLS1_3_VERSION) return TLS1_3_VERSION;
    throw new ERR_TLS_INVALID_PROTOCOL_VERSION(v, which);
  }
- 
+
 diff --git a/lib/internal/crypto/keygen.js b/lib/internal/crypto/keygen.js
-index 0a4bde77fa..33e88e2065 100644
+index 0a4bde7..33e88e2 100644
 --- a/lib/internal/crypto/keygen.js
 +++ b/lib/internal/crypto/keygen.js
 @@ -9,10 +9,10 @@ const {
@@ -77,7 +100,7 @@ index 0a4bde77fa..33e88e2065 100644
    OPENSSL_EC_EXPLICIT_CURVE
  } = internalBinding('crypto');
 diff --git a/lib/tls.js b/lib/tls.js
-index 2ac43c01d3..429ccfd214 100644
+index c63c87a..2a32a0e 100644
 --- a/lib/tls.js
 +++ b/lib/tls.js
 @@ -62,17 +62,10 @@ else if (getOptionValue('--tls-min-v1.1'))
@@ -88,7 +111,7 @@ index 2ac43c01d3..429ccfd214 100644
 -  exports.DEFAULT_MIN_VERSION = 'TLSv1.3';
  else
    exports.DEFAULT_MIN_VERSION = 'TLSv1.2';
- 
+
 -if (getOptionValue('--tls-max-v1.3'))
 -  exports.DEFAULT_MAX_VERSION = 'TLSv1.3';
 -else if (getOptionValue('--tls-max-v1.2'))
@@ -96,17 +119,17 @@ index 2ac43c01d3..429ccfd214 100644
 -else
 -  exports.DEFAULT_MAX_VERSION = 'TLSv1.3'; // Will depend on node version.
 +exports.DEFAULT_MAX_VERSION = 'TLSv1.2'; // Will depend on node version.
- 
- 
+
+
  exports.getCiphers = internalUtil.cachedResult(
 diff --git a/src/node_constants.cc b/src/node_constants.cc
-index 7c9e4ce276..df349e69d6 100644
+index 68af221..0b8ee44 100644
 --- a/src/node_constants.cc
 +++ b/src/node_constants.cc
 @@ -956,8 +956,12 @@ void DefineCryptoConstants(Local<Object> target) {
      NODE_DEFINE_CONSTANT(target, ENGINE_METHOD_RAND);
  # endif
- 
+
 -# ifdef ENGINE_METHOD_EC
 -    NODE_DEFINE_CONSTANT(target, ENGINE_METHOD_EC);
 +# ifdef ENGINE_METHOD_ECDH
@@ -116,12 +139,12 @@ index 7c9e4ce276..df349e69d6 100644
 +# ifdef ENGINE_METHOD_ECDSA
 +    NODE_DEFINE_CONSTANT(target, ENGINE_METHOD_ECDSA);
  # endif
- 
+
  # ifdef ENGINE_METHOD_CIPHERS
 @@ -968,6 +972,10 @@ void DefineCryptoConstants(Local<Object> target) {
      NODE_DEFINE_CONSTANT(target, ENGINE_METHOD_DIGESTS);
  # endif
- 
+
 +# ifdef ENGINE_METHOD_STORE
 +    NODE_DEFINE_CONSTANT(target, ENGINE_METHOD_STORE);
 +# endif
@@ -130,12 +153,12 @@ index 7c9e4ce276..df349e69d6 100644
      NODE_DEFINE_CONSTANT(target, ENGINE_METHOD_PKEY_METHS);
  # endif
 diff --git a/src/node_crypto.cc b/src/node_crypto.cc
-index e32cdac70c..2af7d03e78 100644
+index ad06141..7bafe1e 100644
 --- a/src/node_crypto.cc
 +++ b/src/node_crypto.cc
 @@ -55,6 +55,7 @@
  #include <cstring>
- 
+
  #include <algorithm>
 +#include <atomic>
  #include <memory>
@@ -144,7 +167,7 @@ index e32cdac70c..2af7d03e78 100644
 @@ -128,6 +129,230 @@ struct OpenSSLBufferDeleter {
  };
  using OpenSSLBuffer = std::unique_ptr<char[], OpenSSLBufferDeleter>;
- 
+
 +#if OPENSSL_VERSION_NUMBER < 0x10100000L
 +static void RSA_get0_key(const RSA* r, const BIGNUM** n, const BIGNUM** e,
 +                         const BIGNUM** d) {
@@ -395,7 +418,7 @@ index e32cdac70c..2af7d03e78 100644
 @@ -168,6 +401,35 @@ template int SSLWrap<TLSWrap>::SelectALPNCallback(
      unsigned int inlen,
      void* arg);
- 
+
 +
 +#if OPENSSL_VERSION_NUMBER < 0x10100000L
 +static Mutex* mutexes;
@@ -442,12 +465,12 @@ index e32cdac70c..2af7d03e78 100644
 -    V(KDF)                                                                    \
 -    V(SM2)                                                                    \
      V(USER)                                                                   \
- 
+
  #define V(name) case ERR_LIB_##name: lib = #name "_"; break;
-@@ -533,9 +790,13 @@ void SecureContext::New(const FunctionCallbackInfo<Value>& args) {
+@@ -537,9 +794,13 @@ void SecureContext::New(const FunctionCallbackInfo<Value>& args) {
    new SecureContext(env, args.This());
  }
- 
+
 +#if OPENSSL_VERSION_NUMBER >= 0x10100000L
  // A maxVersion of 0 means "any", but OpenSSL may support TLS versions that
  // Node.js doesn't, so pin the max to what we do support.
@@ -455,19 +478,19 @@ index e32cdac70c..2af7d03e78 100644
 +#else
 +const int MAX_SUPPORTED_VERSION = TLS1_2_VERSION;
 +#endif
- 
+
  void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
    SecureContext* sc;
-@@ -548,7 +809,7 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
- 
+@@ -552,7 +813,7 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
+
    int min_version = args[1].As<Int32>()->Value();
    int max_version = args[2].As<Int32>()->Value();
 -  const SSL_METHOD* method = TLS_method();
 +  const SSL_METHOD* method = SSLv23_method();
- 
+
    if (max_version == 0)
      max_version = MAX_SUPPORTED_VERSION;
-@@ -582,54 +843,57 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
+@@ -586,54 +847,57 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
        max_version = TLS1_2_VERSION;
      } else if (strcmp(*sslmethod, "SSLv23_server_method") == 0) {
        max_version = TLS1_2_VERSION;
@@ -535,10 +558,10 @@ index e32cdac70c..2af7d03e78 100644
      } else {
        const std::string msg("Unknown method: ");
        THROW_ERR_TLS_INVALID_PROTOCOL_METHOD(env, (msg + * sslmethod).c_str());
-@@ -659,9 +923,16 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
+@@ -663,9 +927,16 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
                                   SSL_SESS_CACHE_NO_INTERNAL |
                                   SSL_SESS_CACHE_NO_AUTO_CLEAR);
- 
+
 +#if OPENSSL_VERSION_NUMBER < 0x10100000L
 +  if (max_version == 0) {
 +    // Selecting some secureProtocol methods allows the TLS version to be "any
@@ -553,23 +576,23 @@ index e32cdac70c..2af7d03e78 100644
    // OpenSSL 1.1.0 changed the ticket key size, but the OpenSSL 1.0.x size was
    // exposed in the public API. To retain compatibility, install a callback
    // which restores the old algorithm.
-@@ -671,6 +942,7 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
+@@ -675,6 +946,7 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
      return env->ThrowError("Error generating ticket keys");
    }
    SSL_CTX_set_tlsext_ticket_key_cb(sc->ctx_.get(), TicketCompatibilityCallback);
 +#endif
  }
- 
- 
-@@ -1131,6 +1403,7 @@ void SecureContext::SetCiphers(const FunctionCallbackInfo<Value>& args) {
+
+
+@@ -1202,6 +1474,7 @@ void SecureContext::SetCiphers(const FunctionCallbackInfo<Value>& args) {
    CHECK_EQ(args.Length(), 1);
    CHECK(args[0]->IsString());
- 
+
 +#if OPENSSL_VERSION_NUMBER >= 0x10100000L
    const node::Utf8Value ciphers(args.GetIsolate(), args[0]);
    if (!SSL_CTX_set_cipher_list(sc->ctx_.get(), *ciphers)) {
      unsigned long err = ERR_get_error();  // NOLINT(runtime/int)
-@@ -1146,6 +1419,32 @@ void SecureContext::SetCiphers(const FunctionCallbackInfo<Value>& args) {
+@@ -1217,6 +1490,32 @@ void SecureContext::SetCiphers(const FunctionCallbackInfo<Value>& args) {
        // that's actually an error.
        return;
      }
@@ -602,10 +625,10 @@ index e32cdac70c..2af7d03e78 100644
      return ThrowCryptoError(env, err);
    }
  }
-@@ -1163,6 +1462,11 @@ void SecureContext::SetECDHCurve(const FunctionCallbackInfo<Value>& args) {
- 
+@@ -1234,6 +1533,11 @@ void SecureContext::SetECDHCurve(const FunctionCallbackInfo<Value>& args) {
+
    node::Utf8Value curve(env->isolate(), args[0]);
- 
+
 +#if OPENSSL_VERSION_NUMBER < 0x10100000L
 +  SSL_CTX_set_options(sc->ctx_.get(), SSL_OP_SINGLE_ECDH_USE);
 +  SSL_CTX_set_ecdh_auto(sc->ctx_.get(), 1);
@@ -613,10 +636,10 @@ index e32cdac70c..2af7d03e78 100644
 +
    if (strcmp(*curve, "auto") == 0)
      return;
- 
-@@ -1468,9 +1772,17 @@ void SecureContext::GetTicketKeys(const FunctionCallbackInfo<Value>& args) {
+
+@@ -1536,9 +1840,17 @@ void SecureContext::GetTicketKeys(const FunctionCallbackInfo<Value>& args) {
    ASSIGN_OR_RETURN_UNWRAP(&wrap, args.Holder());
- 
+
    Local<Object> buff = Buffer::New(wrap->env(), 48).ToLocalChecked();
 +#if OPENSSL_VERSION_NUMBER >= 0x10100000L
    memcpy(Buffer::Data(buff), wrap->ticket_key_name_, 16);
@@ -629,12 +652,12 @@ index e32cdac70c..2af7d03e78 100644
 +    return wrap->env()->ThrowError("Failed to fetch tls ticket keys");
 +  }
 +#endif
- 
+
    args.GetReturnValue().Set(buff);
  #endif  // !def(OPENSSL_NO_TLSEXT) && def(SSL_CTX_get_tlsext_ticket_keys)
-@@ -1506,6 +1818,14 @@ void SecureContext::SetTicketKeys(const FunctionCallbackInfo<Value>& args) {
- 
- 
+@@ -1574,6 +1886,14 @@ void SecureContext::SetTicketKeys(const FunctionCallbackInfo<Value>& args) {
+
+
  void SecureContext::SetFreeListLength(const FunctionCallbackInfo<Value>& args) {
 +#if OPENSSL_VERSION_NUMBER < 0x10100000L
 +  // |freelist_max_len| was removed in OpenSSL 1.1.0. In that version OpenSSL
@@ -645,28 +668,28 @@ index e32cdac70c..2af7d03e78 100644
 +  wrap->ctx_->freelist_max_len = args[0].As<Int32>()->Value();
 +#endif
  }
- 
- 
-@@ -1608,6 +1928,7 @@ int SecureContext::TicketKeyCallback(SSL* ssl,
+
+
+@@ -1676,6 +1996,7 @@ int SecureContext::TicketKeyCallback(SSL* ssl,
  }
- 
- 
+
+
 +#if OPENSSL_VERSION_NUMBER >= 0x10100000L
  int SecureContext::TicketCompatibilityCallback(SSL* ssl,
                                                 unsigned char* name,
                                                 unsigned char* iv,
-@@ -1642,6 +1963,7 @@ int SecureContext::TicketCompatibilityCallback(SSL* ssl,
+@@ -1710,6 +2031,7 @@ int SecureContext::TicketCompatibilityCallback(SSL* ssl,
    }
    return 1;
  }
 +#endif
- 
- 
+
+
  void SecureContext::CtxGetter(const FunctionCallbackInfo<Value>& info) {
-@@ -1719,11 +2041,19 @@ void SSLWrap<Base>::ConfigureSecureContext(SecureContext* sc) {
+@@ -1788,11 +2110,19 @@ void SSLWrap<Base>::ConfigureSecureContext(SecureContext* sc) {
  }
- 
- 
+
+
 +#if OPENSSL_VERSION_NUMBER < 0x10100000L
 +template <class Base>
 +SSL_SESSION* SSLWrap<Base>::GetSessionCallback(SSL* s,
@@ -681,9 +704,9 @@ index e32cdac70c..2af7d03e78 100644
                                                 int* copy) {
 +#endif
    Base* w = static_cast<Base*>(SSL_get_app_data(s));
- 
+
    *copy = 0;
-@@ -2488,6 +2818,7 @@ void SSLWrap<Base>::GetEphemeralKeyInfo(
+@@ -2557,6 +2887,7 @@ void SSLWrap<Base>::GetEphemeralKeyInfo(
              .Check();
          break;
        case EVP_PKEY_EC:
@@ -691,7 +714,7 @@ index e32cdac70c..2af7d03e78 100644
        case EVP_PKEY_X25519:
        case EVP_PKEY_X448:
          {
-@@ -2510,6 +2841,21 @@ void SSLWrap<Base>::GetEphemeralKeyInfo(
+@@ -2579,6 +2910,21 @@ void SSLWrap<Base>::GetEphemeralKeyInfo(
                                   EVP_PKEY_bits(key.get()))).Check();
          }
          break;
@@ -713,7 +736,7 @@ index e32cdac70c..2af7d03e78 100644
        default:
          break;
      }
-@@ -3735,12 +4081,15 @@ Local<Value> KeyObject::GetAsymmetricKeyType() const {
+@@ -3886,12 +4232,15 @@ Local<Value> KeyObject::GetAsymmetricKeyType() const {
    switch (EVP_PKEY_id(this->asymmetric_key_.get())) {
    case EVP_PKEY_RSA:
      return env()->crypto_rsa_string();
@@ -729,7 +752,7 @@ index e32cdac70c..2af7d03e78 100644
    case EVP_PKEY_ED25519:
      return env()->crypto_ed25519_string();
    case EVP_PKEY_ED448:
-@@ -3749,6 +4098,7 @@ Local<Value> KeyObject::GetAsymmetricKeyType() const {
+@@ -3900,6 +4249,7 @@ Local<Value> KeyObject::GetAsymmetricKeyType() const {
      return env()->crypto_x25519_string();
    case EVP_PKEY_X448:
      return env()->crypto_x448_string();
@@ -737,10 +760,10 @@ index e32cdac70c..2af7d03e78 100644
    default:
      return Undefined(env()->isolate());
    }
-@@ -4044,10 +4394,10 @@ bool CipherBase::InitAuthenticated(const char* cipher_type, int iv_len,
+@@ -4195,10 +4545,10 @@ bool CipherBase::InitAuthenticated(const char* cipher_type, int iv_len,
    CHECK(IsAuthenticatedMode());
    MarkPopErrorOnReturn mark_pop_error_on_return;
- 
+
 -  if (!EVP_CIPHER_CTX_ctrl(ctx_.get(),
 -                           EVP_CTRL_AEAD_SET_IVLEN,
 -                           iv_len,
@@ -752,7 +775,7 @@ index e32cdac70c..2af7d03e78 100644
      env()->ThrowError("Invalid IV length");
      return false;
    }
-@@ -4395,8 +4745,12 @@ bool CipherBase::Final(AllocatedBuffer* out) {
+@@ -4546,8 +4896,12 @@ bool CipherBase::Final(AllocatedBuffer* out) {
          CHECK(mode == EVP_CIPH_GCM_MODE);
          auth_tag_len_ = sizeof(auth_tag_);
        }
@@ -767,7 +790,7 @@ index e32cdac70c..2af7d03e78 100644
                        reinterpret_cast<unsigned char*>(auth_tag_)));
      }
    }
-@@ -4676,8 +5030,12 @@ void Hash::HashDigest(const FunctionCallbackInfo<Value>& args) {
+@@ -4826,8 +5180,12 @@ void Hash::HashDigest(const FunctionCallbackInfo<Value>& args) {
        ret = EVP_DigestFinal_ex(hash->mdctx_.get(), hash->md_value_,
                                 &hash->md_len_);
      } else {
@@ -778,10 +801,10 @@ index e32cdac70c..2af7d03e78 100644
 +      return env->ThrowError("Unsupported XOF digest");
 +#endif  // OPENSSL_VERSION_NUMBER >= 0x10100000L
      }
- 
+
      if (ret != 1) {
-@@ -4707,12 +5065,14 @@ void Hash::HashDigest(const FunctionCallbackInfo<Value>& args) {
- 
+@@ -4857,12 +5215,14 @@ void Hash::HashDigest(const FunctionCallbackInfo<Value>& args) {
+
  SignBase::Error SignBase::Init(const char* sign_type) {
    CHECK_NULL(mdctx_);
 +#if OPENSSL_VERSION_NUMBER >= 0x10100000L
@@ -795,7 +818,7 @@ index e32cdac70c..2af7d03e78 100644
    const EVP_MD* md = EVP_get_digestbyname(sign_type);
    if (md == nullptr)
      return kSignUnknownDigest;
-@@ -4781,9 +5141,14 @@ static bool ApplyRSAOptions(const ManagedEVPPKey& pkey,
+@@ -4931,9 +5291,14 @@ static bool ApplyRSAOptions(const ManagedEVPPKey& pkey,
                              EVP_PKEY_CTX* pkctx,
                              int padding,
                              const Maybe<int>& salt_len) {
@@ -810,10 +833,10 @@ index e32cdac70c..2af7d03e78 100644
      if (EVP_PKEY_CTX_set_rsa_padding(pkctx, padding) <= 0)
        return false;
      if (padding == RSA_PKCS1_PSS_PADDING && salt_len.IsJust()) {
-@@ -4838,9 +5203,13 @@ void Sign::SignUpdate(const FunctionCallbackInfo<Value>& args) {
+@@ -4988,9 +5353,13 @@ void Sign::SignUpdate(const FunctionCallbackInfo<Value>& args) {
    sign->CheckThrow(err);
  }
- 
+
 -static int GetDefaultSignPadding(const ManagedEVPPKey& key) {
 +static int GetDefaultSignPadding([[maybe_unused]] const ManagedEVPPKey& key) {
 +#if OPENSSL_VERSION_NUMBER < 0x10100000L
@@ -823,11 +846,11 @@ index e32cdac70c..2af7d03e78 100644
                                                        RSA_PKCS1_PADDING;
 +#endif  // OPENSSL_VERSION_NUMBER < 0x10100000L
  }
- 
+
  static AllocatedBuffer Node_SignFinal(Environment* env,
-@@ -5991,9 +6360,24 @@ struct PBKDF2Job : public CryptoJob {
+@@ -6162,9 +6531,24 @@ struct PBKDF2Job : public CryptoJob {
    }
- 
+
    inline void DoThreadPoolWork() override {
 -    auto salt_data = reinterpret_cast<const unsigned char*>(salt.data());
 +    static const auto *empty = "";
@@ -852,101 +875,134 @@ index e32cdac70c..2af7d03e78 100644
                            iteration_count, digest, keybuf_size, keybuf_data);
      success = Just(ok);
      Cleanse();
-@@ -6176,6 +6560,7 @@ class RSAKeyPairGenerationConfig : public KeyPairGenerationConfig {
+@@ -6347,6 +6731,7 @@ class RSAKeyPairGenerationConfig : public KeyPairGenerationConfig {
    const unsigned int exponent_;
  };
- 
+
 +#if OPENSSL_VERSION_NUMBER >= 0x10100000L
  class RSAPSSKeyPairGenerationConfig : public RSAKeyPairGenerationConfig {
   public:
    RSAPSSKeyPairGenerationConfig(unsigned int modulus_bits,
-@@ -6217,6 +6602,7 @@ class RSAPSSKeyPairGenerationConfig : public RSAKeyPairGenerationConfig {
+@@ -6388,6 +6773,7 @@ class RSAPSSKeyPairGenerationConfig : public RSAKeyPairGenerationConfig {
    const EVP_MD* mgf1_md_;
    const int saltlen_;
  };
 +#endif
- 
+
  class DSAKeyPairGenerationConfig : public KeyPairGenerationConfig {
   public:
-@@ -6292,6 +6678,7 @@ class ECKeyPairGenerationConfig : public KeyPairGenerationConfig {
+@@ -6463,6 +6849,7 @@ class ECKeyPairGenerationConfig : public KeyPairGenerationConfig {
    const int param_encoding_;
  };
- 
+
 +#if OPENSSL_VERSION_NUMBER >= 0x10100000L
  class NidKeyPairGenerationConfig : public KeyPairGenerationConfig {
   public:
    explicit NidKeyPairGenerationConfig(int id) : id_(id) {}
-@@ -6303,6 +6690,7 @@ class NidKeyPairGenerationConfig : public KeyPairGenerationConfig {
+@@ -6474,6 +6861,7 @@ class NidKeyPairGenerationConfig : public KeyPairGenerationConfig {
   private:
    const int id_;
  };
 +#endif
- 
+
  class GenerateKeyPairJob : public CryptoJob {
   public:
-@@ -6447,6 +6835,7 @@ void GenerateKeyPairRSA(const FunctionCallbackInfo<Value>& args) {
+@@ -6618,6 +7006,7 @@ void GenerateKeyPairRSA(const FunctionCallbackInfo<Value>& args) {
    GenerateKeyPair(args, 2, std::move(config));
  }
- 
+
 +#if OPENSSL_VERSION_NUMBER >= 0x10100000L
  void GenerateKeyPairRSAPSS(const FunctionCallbackInfo<Value>& args) {
    Environment* env = Environment::GetCurrent(args);
- 
-@@ -6484,6 +6873,7 @@ void GenerateKeyPairRSAPSS(const FunctionCallbackInfo<Value>& args) {
+
+@@ -6655,6 +7044,7 @@ void GenerateKeyPairRSAPSS(const FunctionCallbackInfo<Value>& args) {
                                          md, mgf1_md, saltlen));
    GenerateKeyPair(args, 5, std::move(config));
  }
 +#endif
- 
+
  void GenerateKeyPairDSA(const FunctionCallbackInfo<Value>& args) {
    CHECK(args[0]->IsUint32());
-@@ -6515,6 +6905,7 @@ void GenerateKeyPairEC(const FunctionCallbackInfo<Value>& args) {
+@@ -6686,6 +7076,7 @@ void GenerateKeyPairEC(const FunctionCallbackInfo<Value>& args) {
    GenerateKeyPair(args, 2, std::move(config));
  }
- 
+
 +#if OPENSSL_VERSION_NUMBER >= 0x10100000L
  void GenerateKeyPairNid(const FunctionCallbackInfo<Value>& args) {
    CHECK(args[0]->IsInt32());
    const int id = args[0].As<Int32>()->Value();
-@@ -6522,6 +6913,7 @@ void GenerateKeyPairNid(const FunctionCallbackInfo<Value>& args) {
+@@ -6693,6 +7084,7 @@ void GenerateKeyPairNid(const FunctionCallbackInfo<Value>& args) {
        new NidKeyPairGenerationConfig(id));
    GenerateKeyPair(args, 1, std::move(config));
  }
 +#endif
- 
- 
+
+
  void GetSSLCiphers(const FunctionCallbackInfo<Value>& args) {
-@@ -6545,6 +6937,7 @@ void GetSSLCiphers(const FunctionCallbackInfo<Value>& args) {
+@@ -6716,6 +7108,7 @@ void GetSSLCiphers(const FunctionCallbackInfo<Value>& args) {
                             SSL_CIPHER_get_name(cipher))).Check();
    }
- 
+
 +#if OPENSSL_VERSION_NUMBER >= 0x10100000L
    // TLSv1.3 ciphers aren't listed by EVP. There are only 5, we could just
    // document them, but since there are only 5, easier to just add them manually
    // and not have to explain their absence in the API docs. They are lower-cased
-@@ -6562,6 +6955,7 @@ void GetSSLCiphers(const FunctionCallbackInfo<Value>& args) {
+@@ -6733,6 +7126,7 @@ void GetSSLCiphers(const FunctionCallbackInfo<Value>& args) {
      arr->Set(env->context(),
               arr->Length(), OneByteString(args.GetIsolate(), name)).Check();
    }
 +#endif
- 
+
    args.GetReturnValue().Set(arr);
  }
-@@ -6815,6 +7209,12 @@ void InitCryptoOnce() {
-   SSL_library_init();
-   OpenSSL_add_all_algorithms();
- 
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+@@ -6961,7 +7355,7 @@ void TimingSafeEqual(const FunctionCallbackInfo<Value>& args) {
+ }
+
+ void InitCryptoOnce() {
+-#ifndef OPENSSL_IS_BORINGSSL
++#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_NUMBER >= 0x10100000L
+   OPENSSL_INIT_SETTINGS* settings = OPENSSL_INIT_new();
+
+   // --openssl-config=...
+@@ -6973,7 +7367,35 @@ void InitCryptoOnce() {
+   OPENSSL_init_ssl(0, settings);
+   OPENSSL_INIT_free(settings);
+   settings = nullptr;
+-#endif
++#else // !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_NUMBER >= 0x10100000L
++  SSL_load_error_strings();
++  OPENSSL_no_config();
++
++  // --openssl-config=...
++  if (!per_process::cli_options->openssl_config.empty()) {
++    OPENSSL_load_builtin_modules();
++#ifndef OPENSSL_NO_ENGINE
++    ENGINE_load_builtin_engines();
++#endif // OPENSSL_NO_ENGINE
++    ERR_clear_error();
++
++    const char *conf = per_process::cli_options->openssl_config.c_str();
++    CONF_modules_load_file(conf, nullptr, CONF_MFLAGS_DEFAULT_SECTION);
++    auto err = ERR_get_error();
++    if (err != 0) {
++      fprintf(stderr, "openssl config failed: %s\n", ERR_error_string(err, nullptr));
++      CHECK_NE(err, 0);
++    }
++  }
++
++  // Initialize the whole library
++  SSL_library_init();
++  OpenSSL_add_all_algorithms();
++  // Allocate mutex array and set appropriate callbacks
 +  crypto_lock_init();
 +  CRYPTO_set_locking_callback(crypto_lock_cb);
 +  CRYPTO_THREADID_set_callback(crypto_threadid_cb);
-+#endif
-+
++#endif // !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_NUMBER >= 0x10100000L
+
  #ifdef NODE_FIPS_MODE
    /* Override FIPS settings in cnf file, if needed. */
-   unsigned long err = 0;  // NOLINT(runtime/int)
-@@ -6936,14 +7336,18 @@ void Initialize(Local<Object> target,
- 
+@@ -7096,14 +7518,18 @@ void Initialize(Local<Object> target,
+
    env->SetMethod(target, "pbkdf2", PBKDF2);
    env->SetMethod(target, "generateKeyPairRSA", GenerateKeyPairRSA);
 +#if OPENSSL_VERSION_NUMBER >= 0x10100000L
@@ -965,13 +1021,13 @@ index e32cdac70c..2af7d03e78 100644
    NODE_DEFINE_CONSTANT(target, OPENSSL_EC_EXPLICIT_CURVE);
    NODE_DEFINE_CONSTANT(target, kKeyEncodingPKCS1);
 diff --git a/src/node_crypto.h b/src/node_crypto.h
-index 99e6c48117..667fa87ad2 100644
+index 206a191..9de1616 100644
 --- a/src/node_crypto.h
 +++ b/src/node_crypto.h
 @@ -36,6 +36,41 @@
  #include <openssl/err.h>
  #include <openssl/ssl.h>
- 
+
 +// OpenSSL backport shims
 +#if OPENSSL_VERSION_NUMBER < 0x10100000L
 +
@@ -1009,11 +1065,11 @@ index 99e6c48117..667fa87ad2 100644
 +
  namespace node {
  namespace crypto {
- 
-@@ -230,10 +265,17 @@ class SSLWrap {
+
+@@ -235,10 +270,17 @@ class SSLWrap {
    static void ConfigureSecureContext(SecureContext* sc);
    static void AddMethods(Environment* env, v8::Local<v8::FunctionTemplate> t);
- 
+
 +#if OPENSSL_VERSION_NUMBER < 0x10100000L
 +  static SSL_SESSION* GetSessionCallback(SSL* s,
 +                                         unsigned char* key,
@@ -1029,13 +1085,13 @@ index 99e6c48117..667fa87ad2 100644
    static void KeylogCallback(const SSL* s, const char* line);
    static void OnClientHello(void* arg,
 diff --git a/src/node_crypto_bio.cc b/src/node_crypto_bio.cc
-index fc143043ba..75b55eb30c 100644
+index fc14304..75b55eb 100644
 --- a/src/node_crypto_bio.cc
 +++ b/src/node_crypto_bio.cc
 @@ -30,8 +30,18 @@
  namespace node {
  namespace crypto {
- 
+
 +#if OPENSSL_VERSION_NUMBER < 0x10100000L
 +#define BIO_set_data(bio, data) bio->ptr = data
 +#define BIO_get_data(bio) bio->ptr
@@ -1053,8 +1109,8 @@ index fc143043ba..75b55eb30c 100644
      NodeBIO::FromBIO(bio.get())->env_ = env;
    return bio;
 @@ -221,6 +231,22 @@ long NodeBIO::Ctrl(BIO* bio, int cmd, long num,  // NOLINT(runtime/int)
- 
- 
+
+
  const BIO_METHOD* NodeBIO::GetMethod() {
 +#if OPENSSL_VERSION_NUMBER < 0x10100000L
 +  static const BIO_METHOD method = {
@@ -1077,18 +1133,18 @@ index fc143043ba..75b55eb30c 100644
    static BIO_METHOD* method = nullptr;
 @@ -237,6 +263,7 @@ const BIO_METHOD* NodeBIO::GetMethod() {
    }
- 
+
    return method;
 +#endif
  }
- 
- 
+
+
 diff --git a/src/node_errors.h b/src/node_errors.h
-index 261c6077bb..85a68f8acd 100644
+index 6080aa9..48ae915 100644
 --- a/src/node_errors.h
 +++ b/src/node_errors.h
-@@ -148,8 +148,8 @@ inline v8::Local<v8::Value> ERR_STRING_TOO_LONG(v8::Isolate* isolate) {
- 
+@@ -149,8 +149,8 @@ inline v8::Local<v8::Value> ERR_STRING_TOO_LONG(v8::Isolate* isolate) {
+
  #define THROW_AND_RETURN_IF_NOT_STRING(env, val, prefix)                     \
    do {                                                                       \
 -    if (!val->IsString())                                                    \
@@ -1097,12 +1153,12 @@ index 261c6077bb..85a68f8acd 100644
 +      return node::THROW_ERR_INVALID_ARG_TYPE((env),                         \
                                                prefix " must be a string");   \
    } while (0)
- 
+
 diff --git a/src/node_options.cc b/src/node_options.cc
-index 98049453d8..5d40231b11 100644
+index 35cac18..0a6ed2f 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
-@@ -528,10 +528,12 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
+@@ -549,10 +549,12 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
              "set default TLS minimum to TLSv1.2 (default: TLSv1.2)",
              &EnvironmentOptions::tls_min_v1_2,
              kAllowedInEnvironment);
@@ -1115,7 +1171,7 @@ index 98049453d8..5d40231b11 100644
    AddOption("--tls-max-v1.2",
              "set default TLS maximum to TLSv1.2 (default: TLSv1.3)",
              &EnvironmentOptions::tls_max_v1_2,
-@@ -540,10 +542,12 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
+@@ -561,10 +563,12 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
    // - 11.x and below: TLS1.3 is opt-in with --tls-max-v1.3
    // - 12.x: TLS1.3 is opt-out with --tls-max-v1.2
    // In either case, support both options they are uniformly available.
@@ -1126,14 +1182,14 @@ index 98049453d8..5d40231b11 100644
              kAllowedInEnvironment);
 +#endif // TLS1_3_VERSION
  }
- 
+
  PerIsolateOptionsParser::PerIsolateOptionsParser(
 diff --git a/src/tls_wrap.cc b/src/tls_wrap.cc
-index 2d36c1a265..26af6e2fa8 100644
+index 42b9469..b8a55c6 100644
 --- a/src/tls_wrap.cc
 +++ b/src/tls_wrap.cc
 @@ -910,11 +910,13 @@ void TLSWrap::EnableSessionCallbacks(
- 
+
  void TLSWrap::EnableKeylogCallback(
      const FunctionCallbackInfo<Value>& args) {
 +#if OPENSSL_VERSION_NUMBER >= 0x10100000L
@@ -1144,5 +1200,8 @@ index 2d36c1a265..26af6e2fa8 100644
        SSLWrap<TLSWrap>::KeylogCallback);
 +#endif // OPENSSL_VERSION_NUMBER >= 0x10100000L
  }
- 
+
  // Check required capabilities were not excluded from the OpenSSL build:
+--
+2.24.1
+
diff --git a/SOURCES/0002-Adjust-tests-for-missing-OpenSSL-features.patch b/SOURCES/0002-Adjust-tests-for-missing-OpenSSL-features.patch
index 05881fa..1a51082 100644
--- a/SOURCES/0002-Adjust-tests-for-missing-OpenSSL-features.patch
+++ b/SOURCES/0002-Adjust-tests-for-missing-OpenSSL-features.patch
@@ -1,3 +1,63 @@
+From 83ca5907b708681c799e8f5435181dd068f57e4c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20Stan=C4=9Bk?= <jstanek@redhat.com>
+Date: Thu, 16 Jan 2020 09:06:24 +0100
+Subject: [PATCH 2/4] Adjust tests for missing OpenSSL features
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Jan Staněk <jstanek@redhat.com>
+---
+ .../test-crypto-aes-wrap.js                   |   0
+ .../test-crypto-des3-wrap.js                  |   0
+ .../test-crypto-hash-stream-pipe.js           |   0
+ .../test-make-doc.js                          |   0
+ .../test-tls-cli-max-version-1.3.js           |   0
+ .../test-tls-cli-min-max-conflict.js          |   0
+ .../test-tls-cli-min-version-1.3.js           |   0
+ .../test-tls-client-renegotiation-13.js       |   0
+ .../test-tls-keylog-tlsv13.js                 |   0
+ .../test-tls-no-sslv3.js                      |   0
+ .../test-tls-ticket-12.js                     |   0
+ .../test-tls-ticket-cluster.js                |   0
+ .../test-tls-ticket.js                        |   0
+ .../test-v8-serdes.js                         |   0
+ test/parallel/test-crypto-authenticated.js    |  54 +-----
+ test/parallel/test-crypto-hash.js             |  68 -------
+ test/parallel/test-crypto-key-objects.js      | 175 ------------------
+ test/parallel/test-crypto-keygen.js           |  54 ------
+ test/parallel/test-crypto-pbkdf2.js           |  18 --
+ test/parallel/test-crypto-sign-verify.js      |   8 -
+ test/parallel/test-crypto.js                  |   6 +-
+ .../test-https-agent-session-eviction.js      |  42 ++++-
+ test/parallel/test-tls-alert-handling.js      |   2 +-
+ test/parallel/test-tls-cli-min-version-1.0.js |   2 +-
+ test/parallel/test-tls-cli-min-version-1.1.js |   2 +-
+ test/parallel/test-tls-cli-min-version-1.2.js |   2 +-
+ .../test-tls-client-getephemeralkeyinfo.js    |   2 -
+ test/parallel/test-tls-destroy-stream.js      |   2 +-
+ test/parallel/test-tls-getcipher.js           |  25 +--
+ test/parallel/test-tls-min-max-version.js     |  29 +--
+ test/parallel/test-tls-multi-key.js           |   4 +-
+ test/parallel/test-tls-multi-pfx.js           |   4 +-
+ test/parallel/test-tls-passphrase.js          |   2 +-
+ test/parallel/test-tls-set-ciphers.js         |  27 +--
+ 34 files changed, 60 insertions(+), 468 deletions(-)
+ rename test/{parallel => known_issues}/test-crypto-aes-wrap.js (100%)
+ rename test/{parallel => known_issues}/test-crypto-des3-wrap.js (100%)
+ rename test/{parallel => known_issues}/test-crypto-hash-stream-pipe.js (100%)
+ rename test/{doctool => known_issues}/test-make-doc.js (100%)
+ rename test/{parallel => known_issues}/test-tls-cli-max-version-1.3.js (100%)
+ rename test/{parallel => known_issues}/test-tls-cli-min-max-conflict.js (100%)
+ rename test/{parallel => known_issues}/test-tls-cli-min-version-1.3.js (100%)
+ rename test/{parallel => known_issues}/test-tls-client-renegotiation-13.js (100%)
+ rename test/{parallel => known_issues}/test-tls-keylog-tlsv13.js (100%)
+ rename test/{parallel => known_issues}/test-tls-no-sslv3.js (100%)
+ rename test/{parallel => known_issues}/test-tls-ticket-12.js (100%)
+ rename test/{parallel => known_issues}/test-tls-ticket-cluster.js (100%)
+ rename test/{parallel => known_issues}/test-tls-ticket.js (100%)
+ rename test/{parallel => known_issues}/test-v8-serdes.js (100%)
+
 diff --git a/test/parallel/test-crypto-aes-wrap.js b/test/known_issues/test-crypto-aes-wrap.js
 similarity index 100%
 rename from test/parallel/test-crypto-aes-wrap.js
@@ -55,7 +115,7 @@ similarity index 100%
 rename from test/parallel/test-v8-serdes.js
 rename to test/known_issues/test-v8-serdes.js
 diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js
-index 8be7296c69..c9bf9612cb 100644
+index 8be7296..c9bf961 100644
 --- a/test/parallel/test-crypto-authenticated.js
 +++ b/test/parallel/test-crypto-authenticated.js
 @@ -404,7 +404,7 @@ for (const test of TEST_CASES) {
@@ -70,7 +130,7 @@ index 8be7296c69..c9bf9612cb 100644
 @@ -564,7 +564,7 @@ for (const test of TEST_CASES) {
    const key = Buffer.from('0123456789abcdef', 'utf8');
    const iv = Buffer.from('0123456789ab', 'utf8');
- 
+
 -  for (const mode of ['gcm', 'ocb']) {
 +  for (const mode of ['gcm']) {
      for (const authTagLength of mode === 'gcm' ? [undefined, 8] : [8]) {
@@ -79,7 +139,7 @@ index 8be7296c69..c9bf9612cb 100644
 @@ -598,7 +598,7 @@ for (const test of TEST_CASES) {
    const iv = Buffer.from('0123456789ab', 'utf8');
    const opts = { authTagLength: 8 };
- 
+
 -  for (const mode of ['gcm', 'ccm', 'ocb']) {
 +  for (const mode of ['gcm', 'ccm']) {
      const cipher = crypto.createCipheriv(`aes-128-${mode}`, key, iv, opts);
@@ -138,10 +198,10 @@ index 8be7296c69..c9bf9612cb 100644
 -  }
 -}
 diff --git a/test/parallel/test-crypto-hash.js b/test/parallel/test-crypto-hash.js
-index 4d3214adb2..de15f00bc9 100644
+index 7f752f8..dbfb9a1 100644
 --- a/test/parallel/test-crypto-hash.js
 +++ b/test/parallel/test-crypto-hash.js
-@@ -185,71 +185,3 @@ common.expectsError(
+@@ -181,71 +181,3 @@ common.expectsError(
    assert(instance instanceof Hash, 'Hash is expected to return a new instance' +
                                     ' when called without `new`');
  }
@@ -214,13 +274,13 @@ index 4d3214adb2..de15f00bc9 100644
 -  }
 -}
 diff --git a/test/parallel/test-crypto-key-objects.js b/test/parallel/test-crypto-key-objects.js
-index 558f7dc1f4..c94aae025e 100644
+index dc995be..4d2fc4c 100644
 --- a/test/parallel/test-crypto-key-objects.js
 +++ b/test/parallel/test-crypto-key-objects.js
-@@ -202,42 +202,6 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
+@@ -239,42 +239,6 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
    });
  }
- 
+
 -[
 -  { private: fixtures.readKey('ed25519_private.pem', 'ascii'),
 -    public: fixtures.readKey('ed25519_public.pem', 'ascii'),
@@ -257,13 +317,13 @@ index 558f7dc1f4..c94aae025e 100644
 -    });
 -  }
 -});
- 
+
  {
    // Reading an encrypted key without a passphrase should fail.
-@@ -284,145 +248,6 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
- 
+@@ -321,145 +285,6 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
+
  }
- 
+
 -{
 -  // Test RSA-PSS.
 -  {
@@ -407,13 +467,13 @@ index 558f7dc1f4..c94aae025e 100644
    // Exporting an encrypted private key requires a cipher
    const privateKey = createPrivateKey(privatePem);
 diff --git a/test/parallel/test-crypto-keygen.js b/test/parallel/test-crypto-keygen.js
-index 8c3432e06c..07815e11e5 100644
+index 8c3432e..07815e1 100644
 --- a/test/parallel/test-crypto-keygen.js
 +++ b/test/parallel/test-crypto-keygen.js
 @@ -265,43 +265,6 @@ const sec1EncExp = (cipher) => getRegExpForPEM('EC PRIVATE KEY', cipher);
    }));
  }
- 
+
 -{
 -  // Test RSA-PSS.
 -  generateKeyPair('rsa-pss', {
@@ -457,7 +517,7 @@ index 8c3432e06c..07815e11e5 100644
 @@ -964,23 +927,6 @@ const sec1EncExp = (cipher) => getRegExpForPEM('EC PRIVATE KEY', cipher);
    }));
  }
- 
+
 -// Test EdDSA key generation.
 -{
 -  if (!/^1\.1\.0/.test(process.versions.openssl)) {
@@ -479,7 +539,7 @@ index 8c3432e06c..07815e11e5 100644
  {
    // Invalid public key type.
 diff --git a/test/parallel/test-crypto-pbkdf2.js b/test/parallel/test-crypto-pbkdf2.js
-index 1d4e6f6617..64e8e8dbde 100644
+index 1d4e6f6..64e8e8d 100644
 --- a/test/parallel/test-crypto-pbkdf2.js
 +++ b/test/parallel/test-crypto-pbkdf2.js
 @@ -221,21 +221,3 @@ crypto.pbkdf2Sync(new Float32Array(10), 'salt', 8, 8, 'sha256');
@@ -505,12 +565,12 @@ index 1d4e6f6617..64e8e8dbde 100644
 -  }
 -);
 diff --git a/test/parallel/test-crypto-sign-verify.js b/test/parallel/test-crypto-sign-verify.js
-index 66c7ac7d80..2a48025455 100644
+index 66c7ac7..2a48025 100644
 --- a/test/parallel/test-crypto-sign-verify.js
 +++ b/test/parallel/test-crypto-sign-verify.js
 @@ -418,14 +418,6 @@ common.expectsError(
  }
- 
+
  [
 -  { private: fixtures.readKey('ed25519_private.pem', 'ascii'),
 -    public: fixtures.readKey('ed25519_public.pem', 'ascii'),
@@ -524,7 +584,7 @@ index 66c7ac7d80..2a48025455 100644
      public: fixtures.readKey('rsa_public_2048.pem', 'ascii'),
      algo: 'sha1',
 diff --git a/test/parallel/test-crypto.js b/test/parallel/test-crypto.js
-index 9337621d37..ac1fcce397 100644
+index 9337621..ac1fcce 100644
 --- a/test/parallel/test-crypto.js
 +++ b/test/parallel/test-crypto.js
 @@ -129,7 +129,7 @@ validateList(cryptoCiphers);
@@ -549,25 +609,25 @@ index 9337621d37..ac1fcce397 100644
      code: 'ERR_OSSL_ASN1_WRONG_TAG',
    });
 diff --git a/test/parallel/test-https-agent-session-eviction.js b/test/parallel/test-https-agent-session-eviction.js
-index 3f5cd36e8b..8e13b150bb 100644
+index 3f5cd36..8e13b15 100644
 --- a/test/parallel/test-https-agent-session-eviction.js
 +++ b/test/parallel/test-https-agent-session-eviction.js
 @@ -7,8 +7,10 @@ const { readKey } = require('../common/fixtures');
  if (!common.hasCrypto)
    common.skip('missing crypto');
- 
+
 +const assert = require('assert');
  const https = require('https');
 -const { SSL_OP_NO_TICKET } = require('crypto').constants;
 +const { OPENSSL_VERSION_NUMBER, SSL_OP_NO_TICKET } =
 +    require('crypto').constants;
- 
+
  const options = {
    key: readKey('agent1-key.pem'),
 @@ -58,12 +60,38 @@ function second(server, session) {
      res.resume();
    });
- 
+
 -  // Although we have a TLS 1.2 session to offer to the TLS 1.0 server,
 -  // connection to the TLS 1.0 server should work.
 -  req.on('response', common.mustCall(function(res) {
@@ -595,7 +655,7 @@ index 3f5cd36e8b..8e13b150bb 100644
 +  }
 +  req.end();
 +}
- 
+
 +// Try one more time - session should be evicted!
 +function third(server) {
 +  const req = https.request({
@@ -610,7 +670,7 @@ index 3f5cd36e8b..8e13b150bb 100644
    req.end();
  }
 diff --git a/test/parallel/test-tls-alert-handling.js b/test/parallel/test-tls-alert-handling.js
-index f9f42e2d51..9dc4637ff0 100644
+index f9f42e2..9dc4637 100644
 --- a/test/parallel/test-tls-alert-handling.js
 +++ b/test/parallel/test-tls-alert-handling.js
 @@ -33,7 +33,7 @@ let iter = 0;
@@ -623,46 +683,46 @@ index f9f42e2d51..9dc4637ff0 100644
    errorReceived = true;
    if (canCloseServer())
 diff --git a/test/parallel/test-tls-cli-min-version-1.0.js b/test/parallel/test-tls-cli-min-version-1.0.js
-index 577562782e..0a227c0b94 100644
+index 5775627..0a227c0 100644
 --- a/test/parallel/test-tls-cli-min-version-1.0.js
 +++ b/test/parallel/test-tls-cli-min-version-1.0.js
 @@ -8,7 +8,7 @@ if (!common.hasCrypto) common.skip('missing crypto');
  const assert = require('assert');
  const tls = require('tls');
- 
+
 -assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.3');
 +assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.2');
  assert.strictEqual(tls.DEFAULT_MIN_VERSION, 'TLSv1');
- 
+
  // Check the min-max version protocol versions against these CLI settings.
 diff --git a/test/parallel/test-tls-cli-min-version-1.1.js b/test/parallel/test-tls-cli-min-version-1.1.js
-index 3af2b39546..1219c82030 100644
+index 3af2b39..1219c82 100644
 --- a/test/parallel/test-tls-cli-min-version-1.1.js
 +++ b/test/parallel/test-tls-cli-min-version-1.1.js
 @@ -8,7 +8,7 @@ if (!common.hasCrypto) common.skip('missing crypto');
  const assert = require('assert');
  const tls = require('tls');
- 
+
 -assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.3');
 +assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.2');
  assert.strictEqual(tls.DEFAULT_MIN_VERSION, 'TLSv1.1');
- 
+
  // Check the min-max version protocol versions against these CLI settings.
 diff --git a/test/parallel/test-tls-cli-min-version-1.2.js b/test/parallel/test-tls-cli-min-version-1.2.js
-index 8385eabd0b..058dc180f6 100644
+index 8385eab..058dc18 100644
 --- a/test/parallel/test-tls-cli-min-version-1.2.js
 +++ b/test/parallel/test-tls-cli-min-version-1.2.js
 @@ -8,7 +8,7 @@ if (!common.hasCrypto) common.skip('missing crypto');
  const assert = require('assert');
  const tls = require('tls');
- 
+
 -assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.3');
 +assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.2');
  assert.strictEqual(tls.DEFAULT_MIN_VERSION, 'TLSv1.2');
- 
+
  // Check the min-max version protocol versions against these CLI settings.
 diff --git a/test/parallel/test-tls-client-getephemeralkeyinfo.js b/test/parallel/test-tls-client-getephemeralkeyinfo.js
-index 599306993e..cdfe5de87e 100644
+index 5993069..cdfe5de 100644
 --- a/test/parallel/test-tls-client-getephemeralkeyinfo.js
 +++ b/test/parallel/test-tls-client-getephemeralkeyinfo.js
 @@ -59,5 +59,3 @@ test(1024, 'DH', undefined, 'DHE-RSA-AES128-GCM-SHA256');
@@ -672,20 +732,20 @@ index 599306993e..cdfe5de87e 100644
 -test(253, 'ECDH', 'X25519', 'ECDHE-RSA-AES128-GCM-SHA256');
 -test(448, 'ECDH', 'X448', 'ECDHE-RSA-AES128-GCM-SHA256');
 diff --git a/test/parallel/test-tls-destroy-stream.js b/test/parallel/test-tls-destroy-stream.js
-index a49e985a7e..1964f676c2 100644
+index a49e985..1964f67 100644
 --- a/test/parallel/test-tls-destroy-stream.js
 +++ b/test/parallel/test-tls-destroy-stream.js
 @@ -9,7 +9,7 @@ const net = require('net');
  const assert = require('assert');
  const tls = require('tls');
- 
+
 -tls.DEFAULT_MAX_VERSION = 'TLSv1.3';
 +tls.DEFAULT_MAX_VERSION = 'TLSv1.2';
- 
+
  // This test ensures that an instance of StreamWrap should emit "end" and
  // "close" when the socket on the other side call `destroy()` instead of
 diff --git a/test/parallel/test-tls-getcipher.js b/test/parallel/test-tls-getcipher.js
-index 624f8efd24..93ad1f678a 100644
+index 624f8ef..93ad1f6 100644
 --- a/test/parallel/test-tls-getcipher.js
 +++ b/test/parallel/test-tls-getcipher.js
 @@ -52,7 +52,7 @@ server.listen(0, '127.0.0.1', common.mustCall(function() {
@@ -696,7 +756,7 @@ index 624f8efd24..93ad1f678a 100644
 +    assert.strictEqual(cipher.version, 'TLSv1/SSLv3');
      this.end();
    }));
- 
+
 @@ -65,28 +65,7 @@ server.listen(0, '127.0.0.1', common.mustCall(function() {
    }, common.mustCall(function() {
      const cipher = this.getCipher();
@@ -728,11 +788,11 @@ index 624f8efd24..93ad1f678a 100644
 -  }));
 -}));
 diff --git a/test/parallel/test-tls-min-max-version.js b/test/parallel/test-tls-min-max-version.js
-index 179ae1fa63..8b5435baf5 100644
+index 179ae1f..8b5435b 100644
 --- a/test/parallel/test-tls-min-max-version.js
 +++ b/test/parallel/test-tls-min-max-version.js
 @@ -126,9 +126,9 @@ if (DEFAULT_MIN_VERSION === 'TLSv1.3') {
- 
+
  if (DEFAULT_MIN_VERSION === 'TLSv1.2') {
    test(U, U, 'TLSv1_1_method', U, U, 'SSLv23_method',
 -       U, 'ECONNRESET', 'ERR_SSL_UNSUPPORTED_PROTOCOL');
@@ -761,7 +821,7 @@ index 179ae1fa63..8b5435baf5 100644
    test(U, U, 'TLSv1_method', U, U, U,
 -       U, 'ECONNRESET', 'ERR_SSL_UNSUPPORTED_PROTOCOL');
 +       U, 'ECONNRESET', 'ERR_SSL_UNKNOWN_PROTOCOL');
- 
+
    if (DEFAULT_MAX_VERSION === 'TLSv1.2') {
      test(U, U, U, U, U, 'TLSv1_1_method',
 @@ -182,7 +182,7 @@ if (DEFAULT_MIN_VERSION === 'TLSv1.2') {
@@ -771,12 +831,12 @@ index 179ae1fa63..8b5435baf5 100644
 -       U, 'ECONNRESET', 'ERR_SSL_UNSUPPORTED_PROTOCOL');
 +       U, 'ECONNRESET', 'ERR_SSL_UNKNOWN_PROTOCOL');
    test(U, U, U, U, U, 'TLSv1_1_method', 'TLSv1.1');
- 
+
    if (DEFAULT_MAX_VERSION === 'TLSv1.2') {
 @@ -213,26 +213,9 @@ test(U, U, 'TLSv1_method', 'TLSv1', 'TLSv1.2', U, 'TLSv1');
  test(U, U, 'TLSv1_1_method', 'TLSv1', 'TLSv1.2', U, 'TLSv1.1');
  test(U, U, 'TLSv1_2_method', 'TLSv1', 'TLSv1.2', U, 'TLSv1.2');
- 
+
 -test('TLSv1', 'TLSv1.1', U, 'TLSv1', 'TLSv1.3', U, 'TLSv1.1');
  test('TLSv1', 'TLSv1.1', U, 'TLSv1', 'TLSv1.2', U, 'TLSv1.1');
  test('TLSv1', 'TLSv1.2', U, 'TLSv1', 'TLSv1.1', U, 'TLSv1.1');
@@ -801,7 +861,7 @@ index 179ae1fa63..8b5435baf5 100644
 -test('TLSv1.1', 'TLSv1.1', U, 'TLSv1', 'TLSv1.3', U, 'TLSv1.1');
 -test('TLSv1', 'TLSv1', U, 'TLSv1', 'TLSv1.3', U, 'TLSv1');
 diff --git a/test/parallel/test-tls-multi-key.js b/test/parallel/test-tls-multi-key.js
-index c5e66f3980..de213f57e2 100644
+index c5e66f3..de213f5 100644
 --- a/test/parallel/test-tls-multi-key.js
 +++ b/test/parallel/test-tls-multi-key.js
 @@ -157,7 +157,7 @@ function test(options) {
@@ -823,7 +883,7 @@ index c5e66f3980..de213f57e2 100644
        assert.strictEqual(rsa.getPeerCertificate().subject.CN, rsaCN);
        assert(rsa.getPeerCertificate().exponent, 'cert for an RSA key');
 diff --git a/test/parallel/test-tls-multi-pfx.js b/test/parallel/test-tls-multi-pfx.js
-index 3b0c059182..28cd945e3c 100644
+index 3b0c059..28cd945 100644
 --- a/test/parallel/test-tls-multi-pfx.js
 +++ b/test/parallel/test-tls-multi-pfx.js
 @@ -42,9 +42,9 @@ const server = tls.createServer(options, function(conn) {
@@ -839,26 +899,26 @@ index 3b0c059182..28cd945e3c 100644
    }]);
  });
 diff --git a/test/parallel/test-tls-passphrase.js b/test/parallel/test-tls-passphrase.js
-index c3a99c3eb3..4bbabb4c9e 100644
+index c3a99c3..4bbabb4 100644
 --- a/test/parallel/test-tls-passphrase.js
 +++ b/test/parallel/test-tls-passphrase.js
 @@ -223,7 +223,7 @@ server.listen(0, common.mustCall(function() {
    }, onSecureConnect());
  })).unref();
- 
+
 -const errMessagePassword = /bad decrypt/;
 +const errMessagePassword = /bad decrypt|bad password read/;
- 
+
  // Missing passphrase
  assert.throws(function() {
 diff --git a/test/parallel/test-tls-set-ciphers.js b/test/parallel/test-tls-set-ciphers.js
-index fbca83b3d5..79fb178303 100644
+index fbca83b..79fb178 100644
 --- a/test/parallel/test-tls-set-ciphers.js
 +++ b/test/parallel/test-tls-set-ciphers.js
 @@ -68,36 +68,11 @@ const U = undefined;
  test(U, 'AES256-SHA', 'AES256-SHA');
  test('AES256-SHA', U, 'AES256-SHA');
- 
+
 -test(U, 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
 -test('TLS_AES_256_GCM_SHA384', U, 'TLS_AES_256_GCM_SHA384');
 -
@@ -883,7 +943,7 @@ index fbca83b3d5..79fb178303 100644
 -test('TLS_AES_128_CCM_8_SHA256', 'TLS_AES_128_CCM_8_SHA256',
 -     'TLS_AES_128_CCM_8_SHA256');
 +test('AES128-SHA', 'AES256-SHA', U, 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE', 'ERR_SSL_NO_SHARED_CIPHER');
- 
+
  // Invalid cipher values
  test(9, 'AES256-SHA', U, 'ERR_INVALID_ARG_TYPE', U);
  test('AES256-SHA', 9, U, U, 'ERR_INVALID_ARG_TYPE');
@@ -893,16 +953,6 @@ index fbca83b3d5..79fb178303 100644
 -// Using '' is synonymous for "use default ciphers"
 -test('TLS_AES_256_GCM_SHA384', '', 'TLS_AES_256_GCM_SHA384');
 -test('', 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
-diff --git a/test/sequential/test-async-wrap-getasyncid.js b/test/sequential/test-async-wrap-getasyncid.js
-index 13aee51175..e9a3b1893d 100644
---- a/test/sequential/test-async-wrap-getasyncid.js
-+++ b/test/sequential/test-async-wrap-getasyncid.js
-@@ -50,6 +50,8 @@ const { getSystemErrorName } = require('util');
-     delete providers.KEYPAIRGENREQUEST;
-     delete providers.HTTPCLIENTREQUEST;
-     delete providers.HTTPINCOMINGMESSAGE;
-+    // SCRYPTREQUEST may not be available (OPENSSL_NO_SCRYPT)
-+    delete providers.SCRYPTREQUEST;
- 
-     const objKeys = Object.keys(providers);
-     if (objKeys.length > 0)
+--
+2.24.1
+
diff --git a/SOURCES/0003-deps-Remove-statx-from-libuv.patch b/SOURCES/0003-deps-Remove-statx-from-libuv.patch
new file mode 100644
index 0000000..fc154bc
--- /dev/null
+++ b/SOURCES/0003-deps-Remove-statx-from-libuv.patch
@@ -0,0 +1,233 @@
+From aa084bccf16e52dbc549f5f11788d374b49b130d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20Stan=C4=9Bk?= <jstanek@redhat.com>
+Date: Thu, 16 Jan 2020 09:10:40 +0100
+Subject: [PATCH 3/4] deps: Remove statx from libuv
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Related: rhbz#1760184
+Signed-off-by: Jan Staněk <jstanek@redhat.com>
+---
+ deps/uv/src/unix/fs.c             | 82 -------------------------------
+ deps/uv/src/unix/linux-syscalls.c | 32 ------------
+ deps/uv/src/unix/linux-syscalls.h | 35 -------------
+ 3 files changed, 149 deletions(-)
+
+diff --git a/deps/uv/src/unix/fs.c b/deps/uv/src/unix/fs.c
+index b37cfbb..ab2365f 100644
+--- a/deps/uv/src/unix/fs.c
++++ b/deps/uv/src/unix/fs.c
+@@ -1203,84 +1203,10 @@ static void uv__to_stat(struct stat* src, uv_stat_t* dst) {
+ }
+
+
+-static int uv__fs_statx(int fd,
+-                        const char* path,
+-                        int is_fstat,
+-                        int is_lstat,
+-                        uv_stat_t* buf) {
+-  STATIC_ASSERT(UV_ENOSYS != -1);
+-#ifdef __linux__
+-  static int no_statx;
+-  struct uv__statx statxbuf;
+-  int dirfd;
+-  int flags;
+-  int mode;
+-  int rc;
+-
+-  if (no_statx)
+-    return UV_ENOSYS;
+-
+-  dirfd = AT_FDCWD;
+-  flags = 0; /* AT_STATX_SYNC_AS_STAT */
+-  mode = 0xFFF; /* STATX_BASIC_STATS + STATX_BTIME */
+-
+-  if (is_fstat) {
+-    dirfd = fd;
+-    flags |= 0x1000; /* AT_EMPTY_PATH */
+-  }
+-
+-  if (is_lstat)
+-    flags |= AT_SYMLINK_NOFOLLOW;
+-
+-  rc = uv__statx(dirfd, path, flags, mode, &statxbuf);
+-
+-  if (rc == -1) {
+-    /* EPERM happens when a seccomp filter rejects the system call.
+-     * Has been observed with libseccomp < 2.3.3 and docker < 18.04.
+-     */
+-    if (errno != EINVAL && errno != EPERM && errno != ENOSYS)
+-      return -1;
+-
+-    no_statx = 1;
+-    return UV_ENOSYS;
+-  }
+-
+-  buf->st_dev = 256 * statxbuf.stx_dev_major + statxbuf.stx_dev_minor;
+-  buf->st_mode = statxbuf.stx_mode;
+-  buf->st_nlink = statxbuf.stx_nlink;
+-  buf->st_uid = statxbuf.stx_uid;
+-  buf->st_gid = statxbuf.stx_gid;
+-  buf->st_rdev = statxbuf.stx_rdev_major;
+-  buf->st_ino = statxbuf.stx_ino;
+-  buf->st_size = statxbuf.stx_size;
+-  buf->st_blksize = statxbuf.stx_blksize;
+-  buf->st_blocks = statxbuf.stx_blocks;
+-  buf->st_atim.tv_sec = statxbuf.stx_atime.tv_sec;
+-  buf->st_atim.tv_nsec = statxbuf.stx_atime.tv_nsec;
+-  buf->st_mtim.tv_sec = statxbuf.stx_mtime.tv_sec;
+-  buf->st_mtim.tv_nsec = statxbuf.stx_mtime.tv_nsec;
+-  buf->st_ctim.tv_sec = statxbuf.stx_ctime.tv_sec;
+-  buf->st_ctim.tv_nsec = statxbuf.stx_ctime.tv_nsec;
+-  buf->st_birthtim.tv_sec = statxbuf.stx_btime.tv_sec;
+-  buf->st_birthtim.tv_nsec = statxbuf.stx_btime.tv_nsec;
+-  buf->st_flags = 0;
+-  buf->st_gen = 0;
+-
+-  return 0;
+-#else
+-  return UV_ENOSYS;
+-#endif /* __linux__ */
+-}
+-
+-
+ static int uv__fs_stat(const char *path, uv_stat_t *buf) {
+   struct stat pbuf;
+   int ret;
+
+-  ret = uv__fs_statx(-1, path, /* is_fstat */ 0, /* is_lstat */ 0, buf);
+-  if (ret != UV_ENOSYS)
+-    return ret;
+-
+   ret = stat(path, &pbuf);
+   if (ret == 0)
+     uv__to_stat(&pbuf, buf);
+@@ -1293,10 +1219,6 @@ static int uv__fs_lstat(const char *path, uv_stat_t *buf) {
+   struct stat pbuf;
+   int ret;
+
+-  ret = uv__fs_statx(-1, path, /* is_fstat */ 0, /* is_lstat */ 1, buf);
+-  if (ret != UV_ENOSYS)
+-    return ret;
+-
+   ret = lstat(path, &pbuf);
+   if (ret == 0)
+     uv__to_stat(&pbuf, buf);
+@@ -1309,10 +1231,6 @@ static int uv__fs_fstat(int fd, uv_stat_t *buf) {
+   struct stat pbuf;
+   int ret;
+
+-  ret = uv__fs_statx(fd, "", /* is_fstat */ 1, /* is_lstat */ 0, buf);
+-  if (ret != UV_ENOSYS)
+-    return ret;
+-
+   ret = fstat(fd, &pbuf);
+   if (ret == 0)
+     uv__to_stat(&pbuf, buf);
+diff --git a/deps/uv/src/unix/linux-syscalls.c b/deps/uv/src/unix/linux-syscalls.c
+index 9503878..9560fe6 100644
+--- a/deps/uv/src/unix/linux-syscalls.c
++++ b/deps/uv/src/unix/linux-syscalls.c
+@@ -187,22 +187,6 @@
+ # endif
+ #endif /* __NR_pwritev */
+
+-#ifndef __NR_statx
+-# if defined(__x86_64__)
+-#  define __NR_statx 332
+-# elif defined(__i386__)
+-#  define __NR_statx 383
+-# elif defined(__aarch64__)
+-#  define __NR_statx 397
+-# elif defined(__arm__)
+-#  define __NR_statx (UV_SYSCALL_BASE + 397)
+-# elif defined(__ppc__)
+-#  define __NR_statx 383
+-# elif defined(__s390__)
+-#  define __NR_statx 379
+-# endif
+-#endif /* __NR_statx */
+-
+ #ifndef __NR_getrandom
+ # if defined(__x86_64__)
+ #  define __NR_getrandom 318
+@@ -369,22 +353,6 @@ int uv__dup3(int oldfd, int newfd, int flags) {
+ }
+
+
+-int uv__statx(int dirfd,
+-              const char* path,
+-              int flags,
+-              unsigned int mask,
+-              struct uv__statx* statxbuf) {
+-  /* __NR_statx make Android box killed by SIGSYS.
+-   * That looks like a seccomp2 sandbox filter rejecting the system call.
+-   */
+-#if defined(__NR_statx) && !defined(__ANDROID__)
+-  return syscall(__NR_statx, dirfd, path, flags, mask, statxbuf);
+-#else
+-  return errno = ENOSYS, -1;
+-#endif
+-}
+-
+-
+ ssize_t uv__getrandom(void* buf, size_t buflen, unsigned flags) {
+ #if defined(__NR_getrandom)
+   return syscall(__NR_getrandom, buf, buflen, flags);
+diff --git a/deps/uv/src/unix/linux-syscalls.h b/deps/uv/src/unix/linux-syscalls.h
+index b7729b8..7312b0c 100644
+--- a/deps/uv/src/unix/linux-syscalls.h
++++ b/deps/uv/src/unix/linux-syscalls.h
+@@ -80,36 +80,6 @@
+ #define UV__IN_DELETE_SELF    0x400
+ #define UV__IN_MOVE_SELF      0x800
+
+-struct uv__statx_timestamp {
+-  int64_t tv_sec;
+-  uint32_t tv_nsec;
+-  int32_t unused0;
+-};
+-
+-struct uv__statx {
+-  uint32_t stx_mask;
+-  uint32_t stx_blksize;
+-  uint64_t stx_attributes;
+-  uint32_t stx_nlink;
+-  uint32_t stx_uid;
+-  uint32_t stx_gid;
+-  uint16_t stx_mode;
+-  uint16_t unused0;
+-  uint64_t stx_ino;
+-  uint64_t stx_size;
+-  uint64_t stx_blocks;
+-  uint64_t stx_attributes_mask;
+-  struct uv__statx_timestamp stx_atime;
+-  struct uv__statx_timestamp stx_btime;
+-  struct uv__statx_timestamp stx_ctime;
+-  struct uv__statx_timestamp stx_mtime;
+-  uint32_t stx_rdev_major;
+-  uint32_t stx_rdev_minor;
+-  uint32_t stx_dev_major;
+-  uint32_t stx_dev_minor;
+-  uint64_t unused1[14];
+-};
+-
+ struct uv__inotify_event {
+   int32_t wd;
+   uint32_t mask;
+@@ -143,11 +113,6 @@ int uv__sendmmsg(int fd,
+ ssize_t uv__preadv(int fd, const struct iovec *iov, int iovcnt, int64_t offset);
+ ssize_t uv__pwritev(int fd, const struct iovec *iov, int iovcnt, int64_t offset);
+ int uv__dup3(int oldfd, int newfd, int flags);
+-int uv__statx(int dirfd,
+-              const char* path,
+-              int flags,
+-              unsigned int mask,
+-              struct uv__statx* statxbuf);
+ ssize_t uv__getrandom(void* buf, size_t buflen, unsigned flags);
+
+ #endif /* UV_LINUX_SYSCALL_H_ */
+--
+2.24.1
+
diff --git a/SOURCES/0004-Revert-new-options-using-unsupported-OpenSSL-feature.patch b/SOURCES/0004-Revert-new-options-using-unsupported-OpenSSL-feature.patch
new file mode 100644
index 0000000..87f5fb0
--- /dev/null
+++ b/SOURCES/0004-Revert-new-options-using-unsupported-OpenSSL-feature.patch
@@ -0,0 +1,576 @@
+From 564a2856960790325f08726147b0eb9dde2bb10d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20Stan=C4=9Bk?= <jstanek@redhat.com>
+Date: Thu, 16 Jan 2020 11:41:47 +0100
+Subject: [PATCH 4/4] Revert new options using unsupported OpenSSL features
+
+Reverts 54f327b4dcb37f373bc4146686c7e4edcd9c524d
+https://github.com/nodejs/node/commit/54f327b4dcb37f373bc4146686c7e4edcd9c524d
+
+Reverts 6272f82c07e913a76a316a786c9aadbc09f953ff
+https://github.com/nodejs/node/commit/6272f82c07e913a76a316a786c9aadbc09f953ff
+
+Signed-off-by: Jan Staněk <jstanek@redhat.com>
+---
+ doc/api/crypto.md                      |   6 --
+ doc/api/tls.md                         |  10 --
+ lib/_tls_common.js                     |  13 ---
+ lib/_tls_wrap.js                       |   4 -
+ lib/internal/crypto/cipher.js          |  10 +-
+ src/node_crypto.cc                     | 123 -------------------------
+ src/node_crypto.h                      |   4 -
+ test/fixtures/rsa-oaep-test-vectors.js |  30 ------
+ test/parallel/test-crypto-rsa-dsa.js   |  65 +++++++++----
+ test/parallel/test-tls-set-sigalgs.js  |  74 ---------------
+ 10 files changed, 48 insertions(+), 291 deletions(-)
+ delete mode 100644 test/fixtures/rsa-oaep-test-vectors.js
+ delete mode 100644 test/parallel/test-tls-set-sigalgs.js
+
+diff --git a/doc/api/crypto.md b/doc/api/crypto.md
+index cf651fb..e72006a 100644
+--- a/doc/api/crypto.md
++++ b/doc/api/crypto.md
+@@ -2383,9 +2383,6 @@ An array of supported digest functions can be retrieved using
+ <!-- YAML
+ added: v0.11.14
+ changes:
+-  - version: v12.11.0
+-    pr-url: https://github.com/nodejs/node/pull/29489
+-    description: The `oaepLabel` option was added.
+   - version: v12.9.0
+     pr-url: https://github.com/nodejs/node/pull/28335
+     description: The `oaepHash` option was added.
+@@ -2470,9 +2467,6 @@ be passed instead of a public key.
+ <!-- YAML
+ added: v0.11.14
+ changes:
+-  - version: v12.11.0
+-    pr-url: https://github.com/nodejs/node/pull/29489
+-    description: The `oaepLabel` option was added.
+   - version: v12.9.0
+     pr-url: https://github.com/nodejs/node/pull/28335
+     description: The `oaepHash` option was added.
+diff --git a/doc/api/tls.md b/doc/api/tls.md
+index 3fd8e8c..09c0fa5 100644
+--- a/doc/api/tls.md
++++ b/doc/api/tls.md
+@@ -1362,10 +1362,6 @@ changes:
+     pr-url: https://github.com/nodejs/node/pull/28973
+     description: Added `privateKeyIdentifier` and `privateKeyEngine` options
+                  to get private key from an OpenSSL engine.
+-  - version: v12.11.0
+-    pr-url: https://github.com/nodejs/node/pull/29598
+-    description: Added `sigalgs` option to override supported signature
+-                 algorithms.
+   - version: v12.0.0
+     pr-url: https://github.com/nodejs/node/pull/26209
+     description: TLSv1.3 support added.
+@@ -1426,12 +1422,6 @@ changes:
+     order as their private keys in `key`. If the intermediate certificates are
+     not provided, the peer will not be able to validate the certificate, and the
+     handshake will fail.
+-  * `sigalgs` {string} Colon-separated list of supported signature algorithms.
+-    The list can contain digest algorithms (`SHA256`, `MD5` etc.), public key
+-    algorithms (`RSA-PSS`, `ECDSA` etc.), combination of both (e.g
+-    'RSA+SHA384') or TLS v1.3 scheme names (e.g. `rsa_pss_pss_sha512`).
+-    See [OpenSSL man pages](https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set1_sigalgs_list.html)
+-    for more info.
+   * `ciphers` {string} Cipher suite specification, replacing the default. For
+     more information, see [modifying the default cipher suite][]. Permitted
+     ciphers can be obtained via [`tls.getCiphers()`][]. Cipher names must be
+diff --git a/lib/_tls_common.js b/lib/_tls_common.js
+index 17c3e3a..f31b1eb 100644
+--- a/lib/_tls_common.js
++++ b/lib/_tls_common.js
+@@ -152,19 +152,6 @@ exports.createSecureContext = function createSecureContext(options) {
+     }
+   }
+
+-  const sigalgs = options.sigalgs;
+-  if (sigalgs !== undefined) {
+-    if (typeof sigalgs !== 'string') {
+-      throw new ERR_INVALID_ARG_TYPE('options.sigalgs', 'string', sigalgs);
+-    }
+-
+-    if (sigalgs === '') {
+-      throw new ERR_INVALID_OPT_VALUE('sigalgs', sigalgs);
+-    }
+-
+-    c.context.setSigalgs(sigalgs);
+-  }
+-
+   const { privateKeyIdentifier, privateKeyEngine } = options;
+   if (privateKeyIdentifier !== undefined) {
+     if (privateKeyEngine === undefined) {
+diff --git a/lib/_tls_wrap.js b/lib/_tls_wrap.js
+index 778afa7..f9dcaa1 100644
+--- a/lib/_tls_wrap.js
++++ b/lib/_tls_wrap.js
+@@ -861,7 +861,6 @@ function makeSocketMethodProxy(name) {
+
+ [
+   'getCipher',
+-  'getSharedSigalgs',
+   'getEphemeralKeyInfo',
+   'getFinished',
+   'getPeerFinished',
+@@ -1117,8 +1116,6 @@ Server.prototype.setSecureContext = function(options) {
+   else
+     this.crl = undefined;
+
+-  this.sigalgs = options.sigalgs;
+-
+   if (options.ciphers)
+     this.ciphers = options.ciphers;
+   else
+@@ -1160,7 +1157,6 @@ Server.prototype.setSecureContext = function(options) {
+     clientCertEngine: this.clientCertEngine,
+     ca: this.ca,
+     ciphers: this.ciphers,
+-    sigalgs: this.sigalgs,
+     ecdhCurve: this.ecdhCurve,
+     dhparam: this.dhparam,
+     minVersion: this.minVersion,
+diff --git a/lib/internal/crypto/cipher.js b/lib/internal/crypto/cipher.js
+index 1d6f32b..73fab0f 100644
+--- a/lib/internal/crypto/cipher.js
++++ b/lib/internal/crypto/cipher.js
+@@ -50,16 +50,10 @@ function rsaFunctionFor(method, defaultPadding, keyType) {
+         preparePrivateKey(options) :
+         preparePublicOrPrivateKey(options);
+     const padding = options.padding || defaultPadding;
+-    const { oaepHash, oaepLabel } = options;
++    const { oaepHash } = options;
+     if (oaepHash !== undefined && typeof oaepHash !== 'string')
+       throw new ERR_INVALID_ARG_TYPE('options.oaepHash', 'string', oaepHash);
+-    if (oaepLabel !== undefined && !isArrayBufferView(oaepLabel)) {
+-      throw new ERR_INVALID_ARG_TYPE('options.oaepLabel',
+-                                     ['Buffer', 'TypedArray', 'DataView'],
+-                                     oaepLabel);
+-    }
+-    return method(data, format, type, passphrase, buffer, padding, oaepHash,
+-                  oaepLabel);
++    return method(data, format, type, passphrase, buffer, padding, oaepHash);
+   };
+ }
+
+diff --git a/src/node_crypto.cc b/src/node_crypto.cc
+index 7bafe1e..17a69b8 100644
+--- a/src/node_crypto.cc
++++ b/src/node_crypto.cc
+@@ -737,7 +737,6 @@ void SecureContext::Initialize(Environment* env, Local<Object> target) {
+   env->SetProtoMethod(t, "addRootCerts", AddRootCerts);
+   env->SetProtoMethod(t, "setCipherSuites", SetCipherSuites);
+   env->SetProtoMethod(t, "setCiphers", SetCiphers);
+-  env->SetProtoMethod(t, "setSigalgs", SetSigalgs);
+   env->SetProtoMethod(t, "setECDHCurve", SetECDHCurve);
+   env->SetProtoMethod(t, "setDHParam", SetDHParam);
+   env->SetProtoMethod(t, "setMaxProto", SetMaxProto);
+@@ -1021,24 +1020,6 @@ void SecureContext::SetKey(const FunctionCallbackInfo<Value>& args) {
+   }
+ }
+
+-void SecureContext::SetSigalgs(const FunctionCallbackInfo<Value>& args) {
+-  SecureContext* sc;
+-  ASSIGN_OR_RETURN_UNWRAP(&sc, args.Holder());
+-  Environment* env = sc->env();
+-  ClearErrorOnReturn clear_error_on_return;
+-
+-  CHECK_EQ(args.Length(), 1);
+-  CHECK(args[0]->IsString());
+-
+-  const node::Utf8Value sigalgs(env->isolate(), args[0]);
+-
+-  int rv = SSL_CTX_set1_sigalgs_list(sc->ctx_.get(), *sigalgs);
+-
+-  if (rv == 0) {
+-    return ThrowCryptoError(env, ERR_get_error());
+-  }
+-}
+-
+ #ifndef OPENSSL_NO_ENGINE
+ // Helpers for the smart pointer.
+ void ENGINE_free_fn(ENGINE* engine) { ENGINE_free(engine); }
+@@ -2080,7 +2061,6 @@ void SSLWrap<Base>::AddMethods(Environment* env, Local<FunctionTemplate> t) {
+   env->SetProtoMethodNoSideEffect(t, "isSessionReused", IsSessionReused);
+   env->SetProtoMethodNoSideEffect(t, "verifyError", VerifyError);
+   env->SetProtoMethodNoSideEffect(t, "getCipher", GetCipher);
+-  env->SetProtoMethodNoSideEffect(t, "getSharedSigalgs", GetSharedSigalgs);
+   env->SetProtoMethod(t, "endParser", EndParser);
+   env->SetProtoMethod(t, "certCbDone", CertCbDone);
+   env->SetProtoMethod(t, "renegotiate", Renegotiate);
+@@ -3038,88 +3018,6 @@ void SSLWrap<Base>::GetCipher(const FunctionCallbackInfo<Value>& args) {
+ }
+
+
+-template <class Base>
+-void SSLWrap<Base>::GetSharedSigalgs(const FunctionCallbackInfo<Value>& args) {
+-  Base* w;
+-  ASSIGN_OR_RETURN_UNWRAP(&w, args.Holder());
+-  Environment* env = w->ssl_env();
+-  std::vector<Local<Value>> ret_arr;
+-
+-  SSL* ssl = w->ssl_.get();
+-  int nsig = SSL_get_shared_sigalgs(ssl, 0, nullptr, nullptr, nullptr, nullptr,
+-                                    nullptr);
+-
+-  for (int i = 0; i < nsig; i++) {
+-    int hash_nid;
+-    int sign_nid;
+-    std::string sig_with_md;
+-
+-    SSL_get_shared_sigalgs(ssl, i, &sign_nid, &hash_nid, nullptr, nullptr,
+-                           nullptr);
+-
+-    switch (sign_nid) {
+-      case EVP_PKEY_RSA:
+-        sig_with_md = "RSA+";
+-        break;
+-
+-      case EVP_PKEY_RSA_PSS:
+-        sig_with_md = "RSA-PSS+";
+-        break;
+-
+-      case EVP_PKEY_DSA:
+-        sig_with_md = "DSA+";
+-        break;
+-
+-      case EVP_PKEY_EC:
+-        sig_with_md = "ECDSA+";
+-        break;
+-
+-      case NID_ED25519:
+-        sig_with_md = "Ed25519+";
+-        break;
+-
+-      case NID_ED448:
+-        sig_with_md = "Ed448+";
+-        break;
+-#ifndef OPENSSL_NO_GOST
+-      case NID_id_GostR3410_2001:
+-        sig_with_md = "gost2001+";
+-        break;
+-
+-      case NID_id_GostR3410_2012_256:
+-        sig_with_md = "gost2012_256+";
+-        break;
+-
+-      case NID_id_GostR3410_2012_512:
+-        sig_with_md = "gost2012_512+";
+-        break;
+-#endif  // !OPENSSL_NO_GOST
+-      default:
+-        const char* sn = OBJ_nid2sn(sign_nid);
+-
+-        if (sn != nullptr) {
+-          sig_with_md = std::string(sn) + "+";
+-        } else {
+-          sig_with_md = "UNDEF+";
+-        }
+-        break;
+-    }
+-
+-    const char* sn_hash = OBJ_nid2sn(hash_nid);
+-    if (sn_hash != nullptr) {
+-      sig_with_md += std::string(sn_hash);
+-    } else {
+-      sig_with_md += "UNDEF";
+-    }
+-
+-    ret_arr.push_back(OneByteString(env->isolate(), sig_with_md.c_str()));
+-  }
+-
+-  args.GetReturnValue().Set(
+-                 Array::New(env->isolate(), ret_arr.data(), ret_arr.size()));
+-}
+-
+-
+ template <class Base>
+ void SSLWrap<Base>::GetProtocol(const FunctionCallbackInfo<Value>& args) {
+   Base* w;
+@@ -5720,8 +5618,6 @@ bool PublicKeyCipher::Cipher(Environment* env,
+                              const ManagedEVPPKey& pkey,
+                              int padding,
+                              const EVP_MD* digest,
+-                             const void* oaep_label,
+-                             size_t oaep_label_len,
+                              const unsigned char* data,
+                              int len,
+                              AllocatedBuffer* out) {
+@@ -5738,17 +5634,6 @@ bool PublicKeyCipher::Cipher(Environment* env,
+       return false;
+   }
+
+-  if (oaep_label_len != 0) {
+-    // OpenSSL takes ownership of the label, so we need to create a copy.
+-    void* label = OPENSSL_memdup(oaep_label, oaep_label_len);
+-    CHECK_NOT_NULL(label);
+-    if (0 >= EVP_PKEY_CTX_set0_rsa_oaep_label(ctx.get(), label,
+-                                              oaep_label_len)) {
+-      OPENSSL_free(label);
+-      return false;
+-    }
+-  }
+-
+   size_t out_len = 0;
+   if (EVP_PKEY_cipher(ctx.get(), nullptr, &out_len, data, len) <= 0)
+     return false;
+@@ -5794,12 +5679,6 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
+       return THROW_ERR_OSSL_EVP_INVALID_DIGEST(env);
+   }
+
+-  ArrayBufferViewContents<unsigned char> oaep_label;
+-  if (!args[offset + 3]->IsUndefined()) {
+-    CHECK(args[offset + 3]->IsArrayBufferView());
+-    oaep_label.Read(args[offset + 3].As<ArrayBufferView>());
+-  }
+-
+   AllocatedBuffer out;
+
+   ClearErrorOnReturn clear_error_on_return;
+@@ -5809,8 +5688,6 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
+       pkey,
+       padding,
+       digest,
+-      oaep_label.data(),
+-      oaep_label.length(),
+       buf.data(),
+       buf.length(),
+       &out);
+diff --git a/src/node_crypto.h b/src/node_crypto.h
+index 9de1616..b225cba 100644
+--- a/src/node_crypto.h
++++ b/src/node_crypto.h
+@@ -164,7 +164,6 @@ class SecureContext : public BaseObject {
+   static void AddRootCerts(const v8::FunctionCallbackInfo<v8::Value>& args);
+   static void SetCipherSuites(const v8::FunctionCallbackInfo<v8::Value>& args);
+   static void SetCiphers(const v8::FunctionCallbackInfo<v8::Value>& args);
+-  static void SetSigalgs(const v8::FunctionCallbackInfo<v8::Value>& args);
+   static void SetECDHCurve(const v8::FunctionCallbackInfo<v8::Value>& args);
+   static void SetDHParam(const v8::FunctionCallbackInfo<v8::Value>& args);
+   static void SetOptions(const v8::FunctionCallbackInfo<v8::Value>& args);
+@@ -297,7 +296,6 @@ class SSLWrap {
+   static void IsSessionReused(const v8::FunctionCallbackInfo<v8::Value>& args);
+   static void VerifyError(const v8::FunctionCallbackInfo<v8::Value>& args);
+   static void GetCipher(const v8::FunctionCallbackInfo<v8::Value>& args);
+-  static void GetSharedSigalgs(const v8::FunctionCallbackInfo<v8::Value>& args);
+   static void EndParser(const v8::FunctionCallbackInfo<v8::Value>& args);
+   static void CertCbDone(const v8::FunctionCallbackInfo<v8::Value>& args);
+   static void Renegotiate(const v8::FunctionCallbackInfo<v8::Value>& args);
+@@ -762,8 +760,6 @@ class PublicKeyCipher {
+                      const ManagedEVPPKey& pkey,
+                      int padding,
+                      const EVP_MD* digest,
+-                     const void* oaep_label,
+-                     size_t oaep_label_size,
+                      const unsigned char* data,
+                      int len,
+                      AllocatedBuffer* out);
+diff --git a/test/fixtures/rsa-oaep-test-vectors.js b/test/fixtures/rsa-oaep-test-vectors.js
+deleted file mode 100644
+index 47e681f..0000000
+--- a/test/fixtures/rsa-oaep-test-vectors.js
++++ /dev/null
+@@ -1,30 +0,0 @@
+-{
+-  "comment": "RSA-OAEP test vectors for test-crypto-rsa-dsa.js",
+-  "decryptionTests": [
+-    {
+-      "ct": "16ece59cf985a8cf1a3434e4b9707c922c20638fdf9abf7e5dc7943f4136899348c54116d15b2c17563b9c7143f9d5b85b45615ad0598ea6d21c900f3957b65400612306a9bebae441f005646f7a7c97129a103ab54e777168ef966514adb17786b968ea0ff430a524904c4a11c683764b7c8dbb60df0952768381cdba4d665e5006034393a10d56d33e75b2714db824a18da46441ef7f94a34a7058c0bbad0394083a038558bcc6dd370f8e518e1bd8d73b296fc51d77da44799e4ee774926ded7910e8768f92db76f63107338d33354b735d3ad094240dbd7ffdfda27ef0255306dcf4a6462849492abd1a97fdd37743ff87c4d2ec89866c5cdbb696bd2b30"
+-    },
+-    {
+-      "ct": "16ece59cf985a8cf1a3434e4b9707c922c20638fdf9abf7e5dc7943f4136899348c54116d15b2c17563b9c7143f9d5b85b45615ad0598ea6d21c900f3957b65400612306a9bebae441f005646f7a7c97129a103ab54e777168ef966514adb17786b968ea0ff430a524904c4a11c683764b7c8dbb60df0952768381cdba4d665e5006034393a10d56d33e75b2714db824a18da46441ef7f94a34a7058c0bbad0394083a038558bcc6dd370f8e518e1bd8d73b296fc51d77da44799e4ee774926ded7910e8768f92db76f63107338d33354b735d3ad094240dbd7ffdfda27ef0255306dcf4a6462849492abd1a97fdd37743ff87c4d2ec89866c5cdbb696bd2b30",
+-      "oaepHash": "sha1"
+-    },
+-    {
+-      "ct": "16ccf09afe5eb0130182b9fc1ca4af61a38e772047cac42146bfa0fa5879aa9639203e4d01442d212ff95bddfbe4661222215a2e91908c37ab926edea7cfc53f83357bc27f86af0f5f2818ae141f4e9e934d4e66189aff30f062c9c3f6eb9bc495a59082cb978f99b56ce5fa530a8469e46129258e5c42897cb194b6805e936e5cbbeaa535bad6b1d3cdfc92119b7dd325a2e6d2979e316bdacc9f80e29c7bbdf6846d738e380deadcb48df8c1e8aabf7a9dd2f8c71d6681dbec7dcadc01887c51288674268796bc77fdf8f1c94c9ca50b1cc7cddbaf4e56cb151d23e2c699d2844c0104ee2e7e9dcdb907cfab43339120a40c59ca54f32b8d21b48a29656c77",
+-      "oaepHash": "sha256"
+-    },
+-    {
+-      "ct": "831b72e8dd91841729ecbddf2647d6f19dc0094734f8803d8c651b5655a12ae6156b74d9b594bcc0eacd002728380b94f46e8657f130f354e03b6e7815ee257eda78dba296d67d24410c31c48e5875cc79e4bde594b412be5f357f57a7ac1f1d18b718e408df162d1795508e6a0616192b647ad942ea068a44fb2b323d35a3a61b926feb105d6c0b2a8fc8050222d1cf4a9e44da1f95bbc677fd643749c6c89ac551d072f04cd9320c97a8d94755c8a804954c082bed7fa59199a00aca154c14a7b584b63c538daf9b9c7c90abfca19387d2131f9d9b9ecfc8672249c33144d1be3bfc41558a13f994663661a3af24fd0a97619d508db36f5fc131af86fc68cf",
+-      "oaepHash": "sha512"
+-    },
+-    {
+-      "ct": "04a25a3dbe0a44b10b7dde19632ce0963e7a7e9876905cd4a4f68ba8e0bda593a738847235df4494f9c28927b165511d22006ef6fae0eb7fe01883e4ae495643328d21e13dad65e71e45f885c7e1e2fe77c39fa84b8bbd2d7d3ed72fea2bf3c87a5c864bdc41b45caa3d668ca3f35297f43dc97950fa959ee88031c8385da7628d03923dfd26a7e0568c95a2f38ec5760335b00fa30935abdd9ab5b3581fc319ff787c59930319707caa24fe9e5d0ce6c48eff4ee6e124fd6c595353acc29a194863dbf7b74d08edf7129ca52eb5f4ccf3888311e97602fcd37b476c41749b260efad4e0760064082f7c9ea0f8704134936b2e38fd0f82886486b5f7e5fb9696",
+-      "oaepHash": "sha384",
+-      "oaepLabel": "01020304"
+-    },
+-    {
+-      "ct": "678f9ff724e0f48b48e6ff3cbdac5eb995d263da1c23f948d8d09411131f69f40da07f0c650e1aedc82fbaf0972a5d3b3e8f1f82cc4fa1780abfebb4e06b6827a52bf768b12388817c1e3ee1324342e05135733a4056a6cc02f5211172c338eb96e5e33c1d6f53560e3f3aab2419c13a600c4e67648088ffe8aac2cea8bce78e2ab899741cf7c9a9d5246cde6ce97aae0157f42db68eea380dec6dcd842c1e6900ae21d5275c4bf21810b5e1b0e1bc0441cbce34e00a31b9e857f6f2c791257d45997c278ea928f42e8cb6476f633f5de102fa0c4af964a9c4f4336869509e933ebc0aa94ad16b0b1db2aaa924f409a5f9f29dfbd88849c5eaa4818e1c3e335e",
+-      "oaepHash": "sha1",
+-      "oaepLabel": "00112233445566778899"
+-    }
+-  ]
+-}
+diff --git a/test/parallel/test-crypto-rsa-dsa.js b/test/parallel/test-crypto-rsa-dsa.js
+index 30ef7ec..c773aae 100644
+--- a/test/parallel/test-crypto-rsa-dsa.js
++++ b/test/parallel/test-crypto-rsa-dsa.js
+@@ -202,21 +202,59 @@ common.expectsError(() => {
+ // The following RSA-OAEP test cases were created using the WebCrypto API to
+ // ensure compatibility when using non-SHA1 hash functions.
+ {
+-  const { decryptionTests } =
+-      JSON.parse(fixtures.readSync('rsa-oaep-test-vectors.js', 'utf8'));
+-
+-  for (const { ct, oaepHash, oaepLabel } of decryptionTests) {
++  function testDecrypt(oaepHash, ciphertext) {
+     const decrypted = crypto.privateDecrypt({
+       key: rsaPkcs8KeyPem,
+-      oaepHash,
+-      oaepLabel: oaepLabel ? Buffer.from(oaepLabel, 'hex') : undefined
+-    }, Buffer.from(ct, 'hex'));
++      oaepHash
++    }, Buffer.from(ciphertext, 'hex'));
+
+     assert.strictEqual(decrypted.toString('utf8'), 'Hello Node.js');
+   }
++
++  testDecrypt(undefined, '16ece59cf985a8cf1a3434e4b9707c922c20638fdf9abf7e5dc' +
++                         '7943f4136899348c54116d15b2c17563b9c7143f9d5b85b4561' +
++                         '5ad0598ea6d21c900f3957b65400612306a9bebae441f005646' +
++                         'f7a7c97129a103ab54e777168ef966514adb17786b968ea0ff4' +
++                         '30a524904c4a11c683764b7c8dbb60df0952768381cdba4d665' +
++                         'e5006034393a10d56d33e75b2714db824a18da46441ef7f94a3' +
++                         '4a7058c0bbad0394083a038558bcc6dd370f8e518e1bd8d73b2' +
++                         '96fc51d77da44799e4ee774926ded7910e8768f92db76f63107' +
++                         '338d33354b735d3ad094240dbd7ffdfda27ef0255306dcf4a64' +
++                         '62849492abd1a97fdd37743ff87c4d2ec89866c5cdbb696bd2b' +
++                         '30');
++  testDecrypt('sha1', '16ece59cf985a8cf1a3434e4b9707c922c20638fdf9abf7e5dc794' +
++                      '3f4136899348c54116d15b2c17563b9c7143f9d5b85b45615ad059' +
++                      '8ea6d21c900f3957b65400612306a9bebae441f005646f7a7c9712' +
++                      '9a103ab54e777168ef966514adb17786b968ea0ff430a524904c4a' +
++                      '11c683764b7c8dbb60df0952768381cdba4d665e5006034393a10d' +
++                      '56d33e75b2714db824a18da46441ef7f94a34a7058c0bbad039408' +
++                      '3a038558bcc6dd370f8e518e1bd8d73b296fc51d77da44799e4ee7' +
++                      '74926ded7910e8768f92db76f63107338d33354b735d3ad094240d' +
++                      'bd7ffdfda27ef0255306dcf4a6462849492abd1a97fdd37743ff87' +
++                      'c4d2ec89866c5cdbb696bd2b30');
++  testDecrypt('sha256', '16ccf09afe5eb0130182b9fc1ca4af61a38e772047cac42146bf' +
++                        'a0fa5879aa9639203e4d01442d212ff95bddfbe4661222215a2e' +
++                        '91908c37ab926edea7cfc53f83357bc27f86af0f5f2818ae141f' +
++                        '4e9e934d4e66189aff30f062c9c3f6eb9bc495a59082cb978f99' +
++                        'b56ce5fa530a8469e46129258e5c42897cb194b6805e936e5cbb' +
++                        'eaa535bad6b1d3cdfc92119b7dd325a2e6d2979e316bdacc9f80' +
++                        'e29c7bbdf6846d738e380deadcb48df8c1e8aabf7a9dd2f8c71d' +
++                        '6681dbec7dcadc01887c51288674268796bc77fdf8f1c94c9ca5' +
++                        '0b1cc7cddbaf4e56cb151d23e2c699d2844c0104ee2e7e9dcdb9' +
++                        '07cfab43339120a40c59ca54f32b8d21b48a29656c77');
++  testDecrypt('sha512', '831b72e8dd91841729ecbddf2647d6f19dc0094734f8803d8c65' +
++                        '1b5655a12ae6156b74d9b594bcc0eacd002728380b94f46e8657' +
++                        'f130f354e03b6e7815ee257eda78dba296d67d24410c31c48e58' +
++                        '75cc79e4bde594b412be5f357f57a7ac1f1d18b718e408df162d' +
++                        '1795508e6a0616192b647ad942ea068a44fb2b323d35a3a61b92' +
++                        '6feb105d6c0b2a8fc8050222d1cf4a9e44da1f95bbc677fd6437' +
++                        '49c6c89ac551d072f04cd9320c97a8d94755c8a804954c082bed' +
++                        '7fa59199a00aca154c14a7b584b63c538daf9b9c7c90abfca193' +
++                        '87d2131f9d9b9ecfc8672249c33144d1be3bfc41558a13f99466' +
++                        '3661a3af24fd0a97619d508db36f5fc131af86fc68cf');
+ }
+
+-// Test invalid oaepHash and oaepLabel options.
++// Test invalid oaepHash options.
+ for (const fn of [crypto.publicEncrypt, crypto.privateDecrypt]) {
+   assert.throws(() => {
+     fn({
+@@ -237,17 +275,6 @@ for (const fn of [crypto.publicEncrypt, crypto.privateDecrypt]) {
+       code: 'ERR_INVALID_ARG_TYPE'
+     });
+   }
+-
+-  for (const oaepLabel of [0, false, null, Symbol(), () => {}, {}, 'foo']) {
+-    common.expectsError(() => {
+-      fn({
+-        key: rsaPubPem,
+-        oaepLabel
+-      }, Buffer.alloc(10));
+-    }, {
+-      code: 'ERR_INVALID_ARG_TYPE'
+-    });
+-  }
+ }
+
+ // Test RSA key signing/verification
+diff --git a/test/parallel/test-tls-set-sigalgs.js b/test/parallel/test-tls-set-sigalgs.js
+deleted file mode 100644
+index 59dc2ca..0000000
+--- a/test/parallel/test-tls-set-sigalgs.js
++++ /dev/null
+@@ -1,74 +0,0 @@
+-'use strict';
+-const common = require('../common');
+-if (!common.hasCrypto) common.skip('missing crypto');
+-const fixtures = require('../common/fixtures');
+-
+-// Test sigalgs: option for TLS.
+-
+-const {
+-  assert, connect, keys
+-} = require(fixtures.path('tls-connect'));
+-
+-function assert_arrays_equal(left, right) {
+-  assert.strictEqual(left.length, right.length);
+-  for (let i = 0; i < left.length; i++) {
+-    assert.strictEqual(left[i], right[i]);
+-  }
+-}
+-
+-function test(csigalgs, ssigalgs, shared_sigalgs, cerr, serr) {
+-  assert(shared_sigalgs || serr || cerr, 'test missing any expectations');
+-  connect({
+-    client: {
+-      checkServerIdentity: (servername, cert) => { },
+-      ca: `${keys.agent1.cert}\n${keys.agent6.ca}`,
+-      cert: keys.agent2.cert,
+-      key: keys.agent2.key,
+-      sigalgs: csigalgs
+-    },
+-    server: {
+-      cert: keys.agent6.cert,
+-      key: keys.agent6.key,
+-      ca: keys.agent2.ca,
+-      context: {
+-        requestCert: true,
+-        rejectUnauthorized: true
+-      },
+-      sigalgs: ssigalgs
+-    },
+-  }, common.mustCall((err, pair, cleanup) => {
+-    if (shared_sigalgs) {
+-      assert.ifError(err);
+-      assert.ifError(pair.server.err);
+-      assert.ifError(pair.client.err);
+-      assert(pair.server.conn);
+-      assert(pair.client.conn);
+-      assert_arrays_equal(pair.server.conn.getSharedSigalgs(), shared_sigalgs);
+-    } else {
+-      if (serr) {
+-        assert(pair.server.err);
+-        assert(pair.server.err.code, serr);
+-      }
+-
+-      if (cerr) {
+-        assert(pair.client.err);
+-        assert(pair.client.err.code, cerr);
+-      }
+-    }
+-
+-    return cleanup();
+-  }));
+-}
+-
+-// Have shared sigalgs
+-test('RSA-PSS+SHA384', 'RSA-PSS+SHA384', ['RSA-PSS+SHA384']);
+-test('RSA-PSS+SHA256:RSA-PSS+SHA512:ECDSA+SHA256',
+-     'RSA-PSS+SHA256:ECDSA+SHA256',
+-     ['RSA-PSS+SHA256', 'ECDSA+SHA256']);
+-
+-// Do not have shared sigalgs.
+-test('RSA-PSS+SHA384', 'ECDSA+SHA256',
+-     undefined, 'ECONNRESET', 'ERR_SSL_NO_SHARED_SIGNATURE_ALGORITMS');
+-
+-test('RSA-PSS+SHA384:ECDSA+SHA256', 'ECDSA+SHA384:RSA-PSS+SHA256',
+-     undefined, 'ECONNRESET', 'ERR_SSL_NO_SHARED_SIGNATURE_ALGORITMS');
+--
+2.24.1
+
diff --git a/SOURCES/nodejs-revert-statx.patch b/SOURCES/nodejs-revert-statx.patch
deleted file mode 100644
index 31ce9b9..0000000
--- a/SOURCES/nodejs-revert-statx.patch
+++ /dev/null
@@ -1,207 +0,0 @@
-diff -up node-v12.10.0/deps/uv/src/unix/fs.c.orig node-v12.10.0/deps/uv/src/unix/fs.c
---- node-v12.10.0/deps/uv/src/unix/fs.c.orig	2019-09-04 17:36:23.000000000 +0200
-+++ node-v12.10.0/deps/uv/src/unix/fs.c	2019-10-10 12:46:10.743541964 +0200
-@@ -1212,84 +1212,10 @@ static void uv__to_stat(struct stat* src
- }
- 
- 
--static int uv__fs_statx(int fd,
--                        const char* path,
--                        int is_fstat,
--                        int is_lstat,
--                        uv_stat_t* buf) {
--  STATIC_ASSERT(UV_ENOSYS != -1);
--#ifdef __linux__
--  static int no_statx;
--  struct uv__statx statxbuf;
--  int dirfd;
--  int flags;
--  int mode;
--  int rc;
--
--  if (no_statx)
--    return UV_ENOSYS;
--
--  dirfd = AT_FDCWD;
--  flags = 0; /* AT_STATX_SYNC_AS_STAT */
--  mode = 0xFFF; /* STATX_BASIC_STATS + STATX_BTIME */
--
--  if (is_fstat) {
--    dirfd = fd;
--    flags |= 0x1000; /* AT_EMPTY_PATH */
--  }
--
--  if (is_lstat)
--    flags |= AT_SYMLINK_NOFOLLOW;
--
--  rc = uv__statx(dirfd, path, flags, mode, &statxbuf);
--
--  if (rc == -1) {
--    /* EPERM happens when a seccomp filter rejects the system call.
--     * Has been observed with libseccomp < 2.3.3 and docker < 18.04.
--     */
--    if (errno != EINVAL && errno != EPERM && errno != ENOSYS)
--      return -1;
--
--    no_statx = 1;
--    return UV_ENOSYS;
--  }
--
--  buf->st_dev = 256 * statxbuf.stx_dev_major + statxbuf.stx_dev_minor;
--  buf->st_mode = statxbuf.stx_mode;
--  buf->st_nlink = statxbuf.stx_nlink;
--  buf->st_uid = statxbuf.stx_uid;
--  buf->st_gid = statxbuf.stx_gid;
--  buf->st_rdev = statxbuf.stx_rdev_major;
--  buf->st_ino = statxbuf.stx_ino;
--  buf->st_size = statxbuf.stx_size;
--  buf->st_blksize = statxbuf.stx_blksize;
--  buf->st_blocks = statxbuf.stx_blocks;
--  buf->st_atim.tv_sec = statxbuf.stx_atime.tv_sec;
--  buf->st_atim.tv_nsec = statxbuf.stx_atime.tv_nsec;
--  buf->st_mtim.tv_sec = statxbuf.stx_mtime.tv_sec;
--  buf->st_mtim.tv_nsec = statxbuf.stx_mtime.tv_nsec;
--  buf->st_ctim.tv_sec = statxbuf.stx_ctime.tv_sec;
--  buf->st_ctim.tv_nsec = statxbuf.stx_ctime.tv_nsec;
--  buf->st_birthtim.tv_sec = statxbuf.stx_btime.tv_sec;
--  buf->st_birthtim.tv_nsec = statxbuf.stx_btime.tv_nsec;
--  buf->st_flags = 0;
--  buf->st_gen = 0;
--
--  return 0;
--#else
--  return UV_ENOSYS;
--#endif /* __linux__ */
--}
--
--
- static int uv__fs_stat(const char *path, uv_stat_t *buf) {
-   struct stat pbuf;
-   int ret;
- 
--  ret = uv__fs_statx(-1, path, /* is_fstat */ 0, /* is_lstat */ 0, buf);
--  if (ret != UV_ENOSYS)
--    return ret;
--
-   ret = stat(path, &pbuf);
-   if (ret == 0)
-     uv__to_stat(&pbuf, buf);
-@@ -1302,10 +1228,6 @@ static int uv__fs_lstat(const char *path
-   struct stat pbuf;
-   int ret;
- 
--  ret = uv__fs_statx(-1, path, /* is_fstat */ 0, /* is_lstat */ 1, buf);
--  if (ret != UV_ENOSYS)
--    return ret;
--
-   ret = lstat(path, &pbuf);
-   if (ret == 0)
-     uv__to_stat(&pbuf, buf);
-@@ -1318,10 +1240,6 @@ static int uv__fs_fstat(int fd, uv_stat_
-   struct stat pbuf;
-   int ret;
- 
--  ret = uv__fs_statx(fd, "", /* is_fstat */ 1, /* is_lstat */ 0, buf);
--  if (ret != UV_ENOSYS)
--    return ret;
--
-   ret = fstat(fd, &pbuf);
-   if (ret == 0)
-     uv__to_stat(&pbuf, buf);
-diff -up node-v12.10.0/deps/uv/src/unix/linux-syscalls.c.orig node-v12.10.0/deps/uv/src/unix/linux-syscalls.c
---- node-v12.10.0/deps/uv/src/unix/linux-syscalls.c.orig	2019-09-04 17:36:23.000000000 +0200
-+++ node-v12.10.0/deps/uv/src/unix/linux-syscalls.c	2019-10-10 12:46:46.261728396 +0200
-@@ -187,21 +187,6 @@
- # endif
- #endif /* __NR_pwritev */
- 
--#ifndef __NR_statx
--# if defined(__x86_64__)
--#  define __NR_statx 332
--# elif defined(__i386__)
--#  define __NR_statx 383
--# elif defined(__aarch64__)
--#  define __NR_statx 397
--# elif defined(__arm__)
--#  define __NR_statx (UV_SYSCALL_BASE + 397)
--# elif defined(__ppc__)
--#  define __NR_statx 383
--# elif defined(__s390__)
--#  define __NR_statx 379
--# endif
--#endif /* __NR_statx */
- 
- int uv__accept4(int fd, struct sockaddr* addr, socklen_t* addrlen, int flags) {
- #if defined(__i386__)
-@@ -350,20 +335,4 @@ int uv__dup3(int oldfd, int newfd, int f
- #else
-   return errno = ENOSYS, -1;
- #endif
--}
--
--
--int uv__statx(int dirfd,
--              const char* path,
--              int flags,
--              unsigned int mask,
--              struct uv__statx* statxbuf) {
--  /* __NR_statx make Android box killed by SIGSYS.
--   * That looks like a seccomp2 sandbox filter rejecting the system call.
--   */
--#if defined(__NR_statx) && !defined(__ANDROID__)
--  return syscall(__NR_statx, dirfd, path, flags, mask, statxbuf);
--#else
--  return errno = ENOSYS, -1;
--#endif
- }
-diff -up node-v12.10.0/deps/uv/src/unix/linux-syscalls.h.orig node-v12.10.0/deps/uv/src/unix/linux-syscalls.h
---- node-v12.10.0/deps/uv/src/unix/linux-syscalls.h.orig	2019-09-04 17:36:23.000000000 +0200
-+++ node-v12.10.0/deps/uv/src/unix/linux-syscalls.h	2019-10-10 12:43:54.858867961 +0200
-@@ -80,36 +80,6 @@
- #define UV__IN_DELETE_SELF    0x400
- #define UV__IN_MOVE_SELF      0x800
- 
--struct uv__statx_timestamp {
--  int64_t tv_sec;
--  uint32_t tv_nsec;
--  int32_t unused0;
--};
--
--struct uv__statx {
--  uint32_t stx_mask;
--  uint32_t stx_blksize;
--  uint64_t stx_attributes;
--  uint32_t stx_nlink;
--  uint32_t stx_uid;
--  uint32_t stx_gid;
--  uint16_t stx_mode;
--  uint16_t unused0;
--  uint64_t stx_ino;
--  uint64_t stx_size;
--  uint64_t stx_blocks;
--  uint64_t stx_attributes_mask;
--  struct uv__statx_timestamp stx_atime;
--  struct uv__statx_timestamp stx_btime;
--  struct uv__statx_timestamp stx_ctime;
--  struct uv__statx_timestamp stx_mtime;
--  uint32_t stx_rdev_major;
--  uint32_t stx_rdev_minor;
--  uint32_t stx_dev_major;
--  uint32_t stx_dev_minor;
--  uint64_t unused1[14];
--};
--
- struct uv__inotify_event {
-   int32_t wd;
-   uint32_t mask;
-@@ -143,10 +113,5 @@ int uv__sendmmsg(int fd,
- ssize_t uv__preadv(int fd, const struct iovec *iov, int iovcnt, int64_t offset);
- ssize_t uv__pwritev(int fd, const struct iovec *iov, int iovcnt, int64_t offset);
- int uv__dup3(int oldfd, int newfd, int flags);
--int uv__statx(int dirfd,
--              const char* path,
--              int flags,
--              unsigned int mask,
--              struct uv__statx* statxbuf);
- 
- #endif /* UV_LINUX_SYSCALL_H_ */
diff --git a/SPECS/nodejs.spec b/SPECS/nodejs.spec
index df6ce91..c5961ce 100644
--- a/SPECS/nodejs.spec
+++ b/SPECS/nodejs.spec
@@ -17,11 +17,11 @@
 # feature releases that are only supported for nine months, which is shorter
 # than a Fedora release lifecycle.
 %global nodejs_major 12
-%global nodejs_minor 10
-%global nodejs_patch 0
+%global nodejs_minor 14
+%global nodejs_patch 1
 %global nodejs_abi %{nodejs_major}.%{nodejs_minor}
 %global nodejs_version %{nodejs_major}.%{nodejs_minor}.%{nodejs_patch}
-%global nodejs_release 4
+%global nodejs_release 1
 
 # == Bundled Dependency Versions ==
 # v8 - from deps/v8/include/v8-version.h
@@ -114,7 +114,9 @@ Source100: %{pkg_name}-tarball.sh
 Patch1: 0001-Remove-or-backport-OpenSSL-features.patch
 Patch2: 0002-Adjust-tests-for-missing-OpenSSL-features.patch
 # Remove libuv attempts to use statx syscall – rhbz#1760184
-Patch3: nodejs-revert-statx.patch
+Patch3: 0003-deps-Remove-statx-from-libuv.patch
+
+Patch: 0004-Revert-new-options-using-unsupported-OpenSSL-feature.patch
 
 %{?scl:Requires: %{scl}-runtime}
 %{?scl:BuildRequires: %{scl}-runtime}
@@ -338,14 +340,11 @@ cp -pr deps/npm/man/* %{buildroot}%{_mandir}/
 rm -rf %{buildroot}%{_prefix}/lib/node_modules/npm/man
 ln -sf %{_mandir}  %{buildroot}%{_prefix}/lib/node_modules/npm/man
 
-# Install Markdown and HTML documentation to %{_pkgdocdir}
-cp -pr deps/npm/html deps/npm/doc %{buildroot}%{_pkgdocdir}/npm/
-rm -rf %{buildroot}%{_prefix}/lib/node_modules/npm/html \
-       %{buildroot}%{_prefix}/lib/node_modules/npm/doc
-
+# Install Gatsby HTML documentation to %{_pkgdocdir}
+cp -pr deps/npm/docs %{buildroot}%{_pkgdocdir}/npm/
+rm -rf %{buildroot}%{_prefix}/lib/node_modules/npm/docs
 
-ln -sf %{_pkgdocdir} %{buildroot}%{_prefix}/lib/node_modules/npm/html
-ln -sf %{_pkgdocdir}/npm/html %{buildroot}%{_prefix}/lib/node_modules/npm/doc
+ln -sf %{_pkgdocdir}/npm %{buildroot}%{_prefix}/lib/node_modules/npm/docs
 
 # Install the GDB init tool into the documentation directory
 mv %{buildroot}/%{_datadir}/doc/node/gdbinit %{buildroot}/%{_pkgdocdir}/gdbinit
@@ -373,22 +372,6 @@ do
   ln -s ../node_modules.bundled/$module %{buildroot}%{_prefix}/lib/node_modules/npm/node_modules/$module
 done
 
-# install NPM docs to mandir
-mkdir -p %{buildroot}%{_mandir} \
-         %{buildroot}%{_pkgdocdir}/npm
-
-cp -pr deps/npm/man/* %{buildroot}%{_mandir}/
-rm -rf %{buildroot}%{_prefix}/lib/node_modules/npm/man
-ln -sf %{_mandir}  %{buildroot}%{_prefix}/lib/node_modules/npm/man
-
-# Install Markdown and HTML documentation to %{_pkgdocdir}
-cp -pr deps/npm/html deps/npm/doc %{buildroot}%{_pkgdocdir}/npm/
-rm -rf %{buildroot}%{_prefix}/lib/node_modules/npm/html \
-       %{buildroot}%{_prefix}/lib/node_modules/npm/doc
-
-ln -sf %{_pkgdocdir} %{buildroot}%{_prefix}/lib/node_modules/npm/html
-ln -sf %{_pkgdocdir}/npm/html %{buildroot}%{_prefix}/lib/node_modules/npm/doc
-
 
 # Some NPM bundled deps are executable but should not be. This causes
 # unnecessary automatic dependencies to be added. Make them not executable.
@@ -467,23 +450,36 @@ python2 tools/test.py "${RUN_SUITES[@]}" || :
 %{_prefix}/lib/node_modules/npm
 %ghost %{_sysconfdir}/npmrc
 %ghost %{_sysconfdir}/npmignore
-%doc %{_mandir}/man*/npm*
-%doc %{_mandir}/man*/npx*
-%doc %{_mandir}/man5/package.json.5*
-%doc %{_mandir}/man5/package-lock.json.5*
-%doc %{_mandir}/man7/removing-npm.7*
+%doc %{_mandir}/man1/npm*.1*
+%doc %{_mandir}/man1/npx.1*
+%doc %{_mandir}/man5/folders.5*
+%doc %{_mandir}/man5/install.5*
+%doc %{_mandir}/man5/npmrc.5*
+%doc %{_mandir}/man5/package-json.5*
+%doc %{_mandir}/man5/package-lock-json.5*
+%doc %{_mandir}/man5/package-locks.5*
+%doc %{_mandir}/man5/shrinkwrap-json.5*
+%doc %{_mandir}/man7/config.7*
+%doc %{_mandir}/man7/developers.7*
+%doc %{_mandir}/man7/disputes.7*
+%doc %{_mandir}/man7/orgs.7*
+%doc %{_mandir}/man7/registry.7*
+%doc %{_mandir}/man7/removal.7*
+%doc %{_mandir}/man7/scope.7*
+%doc %{_mandir}/man7/scripts.7*
 %doc %{_mandir}/man7/semver.7*
 
 
 %files docs
 %dir %{_pkgdocdir}
 %{_pkgdocdir}/html
-%{_pkgdocdir}/npm
-%{_pkgdocdir}/npm/html
-%{_pkgdocdir}/npm/doc
+%{_pkgdocdir}/npm/docs
 
 
 %changelog
+* Thu Jan 16 2020 Jan Staněk <jstanek@redhat.com> - 12.14.1-1
+- Rebase to 12.14.1
+
 * Thu Nov 14 2019 Jan Staněk <jstanek@redhat.com> - 12.10.0-4
 - Patch more OpenSSL features
 - Adjust test suite to (mostly) pass without patched OpenSSL features