diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..7ba7e23
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+SOURCES/node-v12.10.0-stripped.tar.gz
diff --git a/.rh-nodejs12-nodejs.metadata b/.rh-nodejs12-nodejs.metadata
new file mode 100644
index 0000000..7394743
--- /dev/null
+++ b/.rh-nodejs12-nodejs.metadata
@@ -0,0 +1 @@
+a09db77361d685f5bd77634dff488d09bef8aaf9 SOURCES/node-v12.10.0-stripped.tar.gz
diff --git a/SOURCES/0001-Remove-or-backport-OpenSSL-features.patch b/SOURCES/0001-Remove-or-backport-OpenSSL-features.patch
new file mode 100644
index 0000000..aa29290
--- /dev/null
+++ b/SOURCES/0001-Remove-or-backport-OpenSSL-features.patch
@@ -0,0 +1,1148 @@
+diff --git a/doc/api/cli.md b/doc/api/cli.md
+index fdc1d790f1..619a9b11c4 100644
+--- a/doc/api/cli.md
++++ b/doc/api/cli.md
+@@ -670,14 +670,6 @@ added: v12.0.0
+ Set [`tls.DEFAULT_MAX_VERSION`][] to 'TLSv1.2'. Use to disable support for
+ TLSv1.3.
+ 
+-### `--tls-max-v1.3`
+-<!-- YAML
+-added: v12.0.0
+--->
+-
+-Set default [`tls.DEFAULT_MAX_VERSION`][] to 'TLSv1.3'. Use to enable support
+-for TLSv1.3.
+-
+ ### `--tls-min-v1.0`
+ <!-- YAML
+ added: v12.0.0
+@@ -703,14 +695,6 @@ Set default [`tls.DEFAULT_MIN_VERSION`][] to 'TLSv1.2'. This is the default for
+ 12.x and later, but the option is supported for compatibility with older Node.js
+ versions.
+ 
+-### `--tls-min-v1.3`
+-<!-- YAML
+-added: v12.0.0
+--->
+-
+-Set default [`tls.DEFAULT_MIN_VERSION`][] to 'TLSv1.3'. Use to disable support
+-for TLSv1.2, which is not as secure as TLSv1.3.
+-
+ ### `--trace-deprecation`
+ <!-- YAML
+ added: v0.8.0
+@@ -1042,11 +1026,9 @@ Node.js options that are allowed are:
+ - `--title`
+ - `--tls-cipher-list`
+ - `--tls-max-v1.2`
+-- `--tls-max-v1.3`
+ - `--tls-min-v1.0`
+ - `--tls-min-v1.1`
+ - `--tls-min-v1.2`
+-- `--tls-min-v1.3`
+ - `--trace-deprecation`
+ - `--trace-event-categories`
+ - `--trace-event-file-pattern`
+diff --git a/lib/_tls_common.js b/lib/_tls_common.js
+index efe9040956..a88bbdc7fd 100644
+--- a/lib/_tls_common.js
++++ b/lib/_tls_common.js
+@@ -49,7 +49,7 @@ function toV(which, v, def) {
+   if (v === 'TLSv1') return TLS1_VERSION;
+   if (v === 'TLSv1.1') return TLS1_1_VERSION;
+   if (v === 'TLSv1.2') return TLS1_2_VERSION;
+-  if (v === 'TLSv1.3') return TLS1_3_VERSION;
++  if (v === 'TLSv1.3' && TLS1_3_VERSION) return TLS1_3_VERSION;
+   throw new ERR_TLS_INVALID_PROTOCOL_VERSION(v, which);
+ }
+ 
+diff --git a/lib/internal/crypto/keygen.js b/lib/internal/crypto/keygen.js
+index 0a4bde77fa..33e88e2065 100644
+--- a/lib/internal/crypto/keygen.js
++++ b/lib/internal/crypto/keygen.js
+@@ -9,10 +9,10 @@ const {
+   generateKeyPairDSA,
+   generateKeyPairEC,
+   generateKeyPairNid,
+-  EVP_PKEY_ED25519,
+-  EVP_PKEY_ED448,
+-  EVP_PKEY_X25519,
+-  EVP_PKEY_X448,
++  //EVP_PKEY_ED25519,
++  //EVP_PKEY_ED448,
++  //EVP_PKEY_X25519,
++  //EVP_PKEY_X448,
+   OPENSSL_EC_NAMED_CURVE,
+   OPENSSL_EC_EXPLICIT_CURVE
+ } = internalBinding('crypto');
+diff --git a/lib/tls.js b/lib/tls.js
+index 2ac43c01d3..429ccfd214 100644
+--- a/lib/tls.js
++++ b/lib/tls.js
+@@ -62,17 +62,10 @@ else if (getOptionValue('--tls-min-v1.1'))
+   exports.DEFAULT_MIN_VERSION = 'TLSv1.1';
+ else if (getOptionValue('--tls-min-v1.2'))
+   exports.DEFAULT_MIN_VERSION = 'TLSv1.2';
+-else if (getOptionValue('--tls-min-v1.3'))
+-  exports.DEFAULT_MIN_VERSION = 'TLSv1.3';
+ else
+   exports.DEFAULT_MIN_VERSION = 'TLSv1.2';
+ 
+-if (getOptionValue('--tls-max-v1.3'))
+-  exports.DEFAULT_MAX_VERSION = 'TLSv1.3';
+-else if (getOptionValue('--tls-max-v1.2'))
+-  exports.DEFAULT_MAX_VERSION = 'TLSv1.2';
+-else
+-  exports.DEFAULT_MAX_VERSION = 'TLSv1.3'; // Will depend on node version.
++exports.DEFAULT_MAX_VERSION = 'TLSv1.2'; // Will depend on node version.
+ 
+ 
+ exports.getCiphers = internalUtil.cachedResult(
+diff --git a/src/node_constants.cc b/src/node_constants.cc
+index 7c9e4ce276..df349e69d6 100644
+--- a/src/node_constants.cc
++++ b/src/node_constants.cc
+@@ -956,8 +956,12 @@ void DefineCryptoConstants(Local<Object> target) {
+     NODE_DEFINE_CONSTANT(target, ENGINE_METHOD_RAND);
+ # endif
+ 
+-# ifdef ENGINE_METHOD_EC
+-    NODE_DEFINE_CONSTANT(target, ENGINE_METHOD_EC);
++# ifdef ENGINE_METHOD_ECDH
++    NODE_DEFINE_CONSTANT(target, ENGINE_METHOD_ECDH);
++# endif
++
++# ifdef ENGINE_METHOD_ECDSA
++    NODE_DEFINE_CONSTANT(target, ENGINE_METHOD_ECDSA);
+ # endif
+ 
+ # ifdef ENGINE_METHOD_CIPHERS
+@@ -968,6 +972,10 @@ void DefineCryptoConstants(Local<Object> target) {
+     NODE_DEFINE_CONSTANT(target, ENGINE_METHOD_DIGESTS);
+ # endif
+ 
++# ifdef ENGINE_METHOD_STORE
++    NODE_DEFINE_CONSTANT(target, ENGINE_METHOD_STORE);
++# endif
++
+ # ifdef ENGINE_METHOD_PKEY_METHS
+     NODE_DEFINE_CONSTANT(target, ENGINE_METHOD_PKEY_METHS);
+ # endif
+diff --git a/src/node_crypto.cc b/src/node_crypto.cc
+index e32cdac70c..2af7d03e78 100644
+--- a/src/node_crypto.cc
++++ b/src/node_crypto.cc
+@@ -55,6 +55,7 @@
+ #include <cstring>
+ 
+ #include <algorithm>
++#include <atomic>
+ #include <memory>
+ #include <utility>
+ #include <vector>
+@@ -128,6 +129,230 @@ struct OpenSSLBufferDeleter {
+ };
+ using OpenSSLBuffer = std::unique_ptr<char[], OpenSSLBufferDeleter>;
+ 
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
++static void RSA_get0_key(const RSA* r, const BIGNUM** n, const BIGNUM** e,
++                         const BIGNUM** d) {
++  if (n != nullptr) {
++    *n = r->n;
++  }
++  if (e != nullptr) {
++    *e = r->e;
++  }
++  if (d != nullptr) {
++    *d = r->d;
++  }
++}
++
++static void DH_get0_pqg(const DH* dh, const BIGNUM** p, const BIGNUM** q,
++                        const BIGNUM** g) {
++  if (p != nullptr) {
++    *p = dh->p;
++  }
++  if (q != nullptr) {
++    *q = dh->q;
++  }
++  if (g != nullptr) {
++    *g = dh->g;
++  }
++}
++
++static int DH_set0_pqg(DH* dh, BIGNUM* p, BIGNUM* q, BIGNUM* g) {
++  if ((dh->p == nullptr && p == nullptr) ||
++      (dh->g == nullptr && g == nullptr)) {
++    return 0;
++  }
++
++  if (p != nullptr) {
++    BN_free(dh->p);
++    dh->p = p;
++  }
++  if (q != nullptr) {
++    BN_free(dh->q);
++    dh->q = q;
++  }
++  if (g != nullptr) {
++    BN_free(dh->g);
++    dh->g = g;
++  }
++
++  return 1;
++}
++
++static void DH_get0_key(const DH* dh, const BIGNUM** pub_key,
++                        const BIGNUM** priv_key) {
++  if (pub_key != nullptr) {
++    *pub_key = dh->pub_key;
++  }
++  if (priv_key != nullptr) {
++    *priv_key = dh->priv_key;
++  }
++}
++
++static int DH_set0_key(DH* dh, BIGNUM* pub_key, BIGNUM* priv_key) {
++  if (pub_key != nullptr) {
++    BN_free(dh->pub_key);
++    dh->pub_key = pub_key;
++  }
++  if (priv_key != nullptr) {
++    BN_free(dh->priv_key);
++    dh->priv_key = priv_key;
++  }
++
++  return 1;
++}
++
++static int EC_GROUP_order_bits(const EC_GROUP *group) {
++  int num_bits = 0;
++  BIGNUM *order = BN_new();
++  BN_CTX *ctx = BN_CTX_new();
++  if (order == nullptr || ctx == nullptr) { goto end; }
++
++  if (EC_GROUP_get_order(group, order, ctx) != 1) { goto end; }
++  num_bits = BN_num_bits(order);
++
++end:
++  BN_CTX_free(ctx), ctx = nullptr;
++  BN_free(order), order = nullptr;
++
++  return num_bits;
++}
++
++static int EVP_PKEY_up_ref(EVP_PKEY *pkey) {
++  int refcount = std::atomic_fetch_add_explicit(
++    reinterpret_cast<std::atomic<int>*>(&pkey->references),
++    1,
++    std::memory_order_relaxed
++  ) + 1;
++  return (refcount > 1) ? 1 : 0;
++}
++static unsigned long EVP_MD_meth_get_flags(const EVP_MD *md) {
++  return md->flags;
++}
++static int EVP_DigestSign(
++  EVP_MD_CTX *ctx, unsigned char *sigret, size_t *siglen,
++  const unsigned char *tbs, size_t tbslen)
++{
++  if (sigret != nullptr && EVP_DigestSignUpdate(ctx, tbs, tbslen) <= 0) {
++    return 0;
++  }
++  return EVP_DigestSignFinal(ctx, sigret, siglen);
++}
++static int EVP_DigestVerify(
++  EVP_MD_CTX *ctx, const unsigned char *sigret,
++  size_t siglen, const unsigned char *tbs, size_t tbslen)
++{
++  if (EVP_DigestVerifyUpdate(ctx, tbs, tbslen) <= 0) {
++    return -1;
++  }
++  return EVP_DigestVerifyFinal(ctx, sigret, siglen);
++}
++
++static const SSL_METHOD* TLS_method() { return SSLv23_method(); }
++
++static void SSL_SESSION_get0_ticket(const SSL_SESSION* s,
++                                    const unsigned char** tick, size_t* len) {
++  *len = s->tlsext_ticklen;
++  if (tick != nullptr) {
++    *tick = s->tlsext_tick;
++  }
++}
++
++#define SSL_get_tlsext_status_type(ssl) (ssl->tlsext_status_type)
++
++static int X509_STORE_up_ref(X509_STORE* store) {
++  CRYPTO_add(&store->references, 1, CRYPTO_LOCK_X509_STORE);
++  return 1;
++}
++
++static int X509_up_ref(X509* cert) {
++  CRYPTO_add(&cert->references, 1, CRYPTO_LOCK_X509);
++  return 1;
++}
++
++HMAC_CTX* HMAC_CTX_new() {
++  HMAC_CTX* ctx = Malloc<HMAC_CTX>(1);
++  HMAC_CTX_init(ctx);
++  return ctx;
++}
++
++// Disable all TLS version lower than the version argument
++int SSL_CTX_set_min_proto_version(SSL_CTX *ctx, int version) {
++    switch (version) {
++        case TLS1_2_VERSION:
++            SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_1);
++            [[fallthrough]];
++
++        case TLS1_1_VERSION:
++            SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1);
++            [[fallthrough]];
++
++        case TLS1_VERSION:
++            SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3|SSL_OP_NO_SSLv2);
++            return 1;
++
++        default:
++            return 0;  // unsupported
++    }
++}
++// Extract minimum supported version. Should be inverse of the setter above.
++int SSL_CTX_get_min_proto_version(SSL_CTX *ctx) {
++  static const auto full_mask = SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1;
++
++  auto opts = SSL_CTX_get_options(ctx);
++
++  switch (opts & full_mask) {
++    case SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1:
++      return TLS1_2_VERSION;
++
++    case SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1:
++      return TLS1_1_VERSION;
++
++    case SSL_OP_NO_SSLv3:
++      return TLS1_VERSION;
++
++    default:
++      return 0;
++  }
++}
++
++// Disable all TLS version higher than the version argument
++int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, int version) {
++    switch (version) {
++        case TLS1_VERSION:
++            SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_1);
++            [[fallthrough]];
++
++        case TLS1_1_VERSION:
++            SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_2);
++            [[fallthrough]];
++
++        case TLS1_2_VERSION:
++            return 1;
++
++        default:
++            return 0;  // unsupported
++    }
++}
++// Extract maximum supported version. Should be inverse of the setter above.
++int SSL_CTX_get_max_proto_version(SSL_CTX *ctx) {
++  static const auto full_mask = SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2;
++
++  auto opts = SSL_CTX_get_options(ctx);
++  switch (opts & full_mask) {
++    case SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2:
++      return TLS1_VERSION;
++
++    case SSL_OP_NO_TLSv1_2:
++      return TLS1_1_VERSION;
++
++    default:
++      return 0;
++  }
++}
++
++#endif  // OPENSSL_VERSION_NUMBER < 0x10100000L
++
++
+ static const char* const root_certs[] = {
+ #include "node_root_certs.h"  // NOLINT(build/include_order)
+ };
+@@ -144,11 +369,19 @@ template void SSLWrap<TLSWrap>::AddMethods(Environment* env,
+ template void SSLWrap<TLSWrap>::ConfigureSecureContext(SecureContext* sc);
+ template void SSLWrap<TLSWrap>::SetSNIContext(SecureContext* sc);
+ template int SSLWrap<TLSWrap>::SetCACerts(SecureContext* sc);
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
++template SSL_SESSION* SSLWrap<TLSWrap>::GetSessionCallback(
++    SSL* s,
++    unsigned char* key,
++    int len,
++    int* copy);
++#else
+ template SSL_SESSION* SSLWrap<TLSWrap>::GetSessionCallback(
+     SSL* s,
+     const unsigned char* key,
+     int len,
+     int* copy);
++#endif
+ template int SSLWrap<TLSWrap>::NewSessionCallback(SSL* s,
+                                                   SSL_SESSION* sess);
+ template void SSLWrap<TLSWrap>::KeylogCallback(const SSL* s,
+@@ -168,6 +401,35 @@ template int SSLWrap<TLSWrap>::SelectALPNCallback(
+     unsigned int inlen,
+     void* arg);
+ 
++
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
++static Mutex* mutexes;
++
++static void crypto_threadid_cb(CRYPTO_THREADID* tid) {
++  static_assert(sizeof(uv_thread_t) <= sizeof(void*),
++                "uv_thread_t does not fit in a pointer");
++  CRYPTO_THREADID_set_pointer(tid, reinterpret_cast<void*>(uv_thread_self()));
++}
++
++
++static void crypto_lock_init(void) {
++  mutexes = new Mutex[CRYPTO_num_locks()];
++}
++
++
++static void crypto_lock_cb(int mode, int n, const char* file, int line) {
++  CHECK(!(mode & CRYPTO_LOCK) ^ !(mode & CRYPTO_UNLOCK));
++  CHECK(!(mode & CRYPTO_READ) ^ !(mode & CRYPTO_WRITE));
++
++  auto mutex = &mutexes[n];
++  if (mode & CRYPTO_LOCK)
++    mutex->Lock();
++  else
++    mutex->Unlock();
++}
++#endif
++
++
+ static int PasswordCallback(char* buf, int size, int rwflag, void* u) {
+   const char* passphrase = static_cast<char*>(u);
+   if (passphrase != nullptr) {
+@@ -299,15 +561,10 @@ Maybe<bool> Decorate(Environment* env, Local<Object> obj,
+     V(COMP)                                                                   \
+     V(ECDSA)                                                                  \
+     V(ECDH)                                                                   \
+-    V(OSSL_STORE)                                                             \
+     V(FIPS)                                                                   \
+     V(CMS)                                                                    \
+     V(TS)                                                                     \
+     V(HMAC)                                                                   \
+-    V(CT)                                                                     \
+-    V(ASYNC)                                                                  \
+-    V(KDF)                                                                    \
+-    V(SM2)                                                                    \
+     V(USER)                                                                   \
+ 
+ #define V(name) case ERR_LIB_##name: lib = #name "_"; break;
+@@ -533,9 +790,13 @@ void SecureContext::New(const FunctionCallbackInfo<Value>& args) {
+   new SecureContext(env, args.This());
+ }
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+ // A maxVersion of 0 means "any", but OpenSSL may support TLS versions that
+ // Node.js doesn't, so pin the max to what we do support.
+ const int MAX_SUPPORTED_VERSION = TLS1_3_VERSION;
++#else
++const int MAX_SUPPORTED_VERSION = TLS1_2_VERSION;
++#endif
+ 
+ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
+   SecureContext* sc;
+@@ -548,7 +809,7 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
+ 
+   int min_version = args[1].As<Int32>()->Value();
+   int max_version = args[2].As<Int32>()->Value();
+-  const SSL_METHOD* method = TLS_method();
++  const SSL_METHOD* method = SSLv23_method();
+ 
+   if (max_version == 0)
+     max_version = MAX_SUPPORTED_VERSION;
+@@ -582,54 +843,57 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
+       max_version = TLS1_2_VERSION;
+     } else if (strcmp(*sslmethod, "SSLv23_server_method") == 0) {
+       max_version = TLS1_2_VERSION;
+-      method = TLS_server_method();
++      method = SSLv23_server_method();
+     } else if (strcmp(*sslmethod, "SSLv23_client_method") == 0) {
+       max_version = TLS1_2_VERSION;
+-      method = TLS_client_method();
++      method = SSLv23_client_method();
+     } else if (strcmp(*sslmethod, "TLS_method") == 0) {
+       min_version = 0;
+       max_version = MAX_SUPPORTED_VERSION;
+     } else if (strcmp(*sslmethod, "TLS_server_method") == 0) {
+       min_version = 0;
+       max_version = MAX_SUPPORTED_VERSION;
+-      method = TLS_server_method();
++      method = SSLv23_server_method();
+     } else if (strcmp(*sslmethod, "TLS_client_method") == 0) {
+       min_version = 0;
+       max_version = MAX_SUPPORTED_VERSION;
+-      method = TLS_client_method();
++      method = SSLv23_client_method();
+     } else if (strcmp(*sslmethod, "TLSv1_method") == 0) {
+       min_version = TLS1_VERSION;
+       max_version = TLS1_VERSION;
++      method = TLSv1_method();
+     } else if (strcmp(*sslmethod, "TLSv1_server_method") == 0) {
+       min_version = TLS1_VERSION;
+       max_version = TLS1_VERSION;
+-      method = TLS_server_method();
++      method = TLSv1_server_method();
+     } else if (strcmp(*sslmethod, "TLSv1_client_method") == 0) {
+       min_version = TLS1_VERSION;
+       max_version = TLS1_VERSION;
+-      method = TLS_client_method();
++      method = TLSv1_client_method();
+     } else if (strcmp(*sslmethod, "TLSv1_1_method") == 0) {
+       min_version = TLS1_1_VERSION;
+       max_version = TLS1_1_VERSION;
++      method = TLSv1_1_method();
+     } else if (strcmp(*sslmethod, "TLSv1_1_server_method") == 0) {
+       min_version = TLS1_1_VERSION;
+       max_version = TLS1_1_VERSION;
+-      method = TLS_server_method();
++      method = TLSv1_1_server_method();
+     } else if (strcmp(*sslmethod, "TLSv1_1_client_method") == 0) {
+       min_version = TLS1_1_VERSION;
+       max_version = TLS1_1_VERSION;
+-      method = TLS_client_method();
++      method = TLSv1_1_client_method();
+     } else if (strcmp(*sslmethod, "TLSv1_2_method") == 0) {
+       min_version = TLS1_2_VERSION;
+       max_version = TLS1_2_VERSION;
++      method = TLSv1_2_method();
+     } else if (strcmp(*sslmethod, "TLSv1_2_server_method") == 0) {
+       min_version = TLS1_2_VERSION;
+       max_version = TLS1_2_VERSION;
+-      method = TLS_server_method();
++      method = TLSv1_2_server_method();
+     } else if (strcmp(*sslmethod, "TLSv1_2_client_method") == 0) {
+       min_version = TLS1_2_VERSION;
+       max_version = TLS1_2_VERSION;
+-      method = TLS_client_method();
++      method = TLSv1_2_client_method();
+     } else {
+       const std::string msg("Unknown method: ");
+       THROW_ERR_TLS_INVALID_PROTOCOL_METHOD(env, (msg + * sslmethod).c_str());
+@@ -659,9 +923,16 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
+                                  SSL_SESS_CACHE_NO_INTERNAL |
+                                  SSL_SESS_CACHE_NO_AUTO_CLEAR);
+ 
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
++  if (max_version == 0) {
++    // Selecting some secureProtocol methods allows the TLS version to be "any
++    // supported", but we don't support TLSv1.3, even if OpenSSL does.
++    max_version = TLS1_2_VERSION;
++  }
++#endif
+   SSL_CTX_set_min_proto_version(sc->ctx_.get(), min_version);
+   SSL_CTX_set_max_proto_version(sc->ctx_.get(), max_version);
+-
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   // OpenSSL 1.1.0 changed the ticket key size, but the OpenSSL 1.0.x size was
+   // exposed in the public API. To retain compatibility, install a callback
+   // which restores the old algorithm.
+@@ -671,6 +942,7 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
+     return env->ThrowError("Error generating ticket keys");
+   }
+   SSL_CTX_set_tlsext_ticket_key_cb(sc->ctx_.get(), TicketCompatibilityCallback);
++#endif
+ }
+ 
+ 
+@@ -1131,6 +1403,7 @@ void SecureContext::SetCiphers(const FunctionCallbackInfo<Value>& args) {
+   CHECK_EQ(args.Length(), 1);
+   CHECK(args[0]->IsString());
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   const node::Utf8Value ciphers(args.GetIsolate(), args[0]);
+   if (!SSL_CTX_set_cipher_list(sc->ctx_.get(), *ciphers)) {
+     unsigned long err = ERR_get_error();  // NOLINT(runtime/int)
+@@ -1146,6 +1419,32 @@ void SecureContext::SetCiphers(const FunctionCallbackInfo<Value>& args) {
+       // that's actually an error.
+       return;
+     }
++#else
++  // Note: set_ciphersuites() is for TLSv1.3 and was introduced in openssl
++  // 1.1.1, set_cipher_list() is for TLSv1.2 and earlier.
++  //
++  // In openssl 1.1.0, set_cipher_list() would error if it resulted in no
++  // TLSv1.2 (and earlier) cipher suites, and there is no TLSv1.3 support.
++  //
++  // In openssl 1.1.1, set_cipher_list() will not error if it results in no
++  // TLSv1.2 cipher suites if there are any TLSv1.3 cipher suites, which there
++  // are by default. There will be an error later, during the handshake, but
++  // that results in an async error event, rather than a sync error thrown,
++  // which is a semver-major change for the tls API.
++  //
++  // Since we don't currently support TLSv1.3, work around this by removing the
++  // TLSv1.3 cipher suites, so we get backwards compatible synchronous errors.
++  const node::Utf8Value ciphers(args.GetIsolate(), args[0]);
++  if (
++#if defined(TLS1_3_VERSION) && !defined(OPENSSL_IS_BORINGSSL)
++      !SSL_CTX_set_ciphersuites(sc->ctx_.get(), "") ||
++#endif
++      !SSL_CTX_set_cipher_list(sc->ctx_.get(), *ciphers)) {
++    unsigned long err = ERR_get_error();  // NOLINT(runtime/int)
++    if (!err) {
++      return env->ThrowError("Failed to set ciphers");
++    }
++#endif
+     return ThrowCryptoError(env, err);
+   }
+ }
+@@ -1163,6 +1462,11 @@ void SecureContext::SetECDHCurve(const FunctionCallbackInfo<Value>& args) {
+ 
+   node::Utf8Value curve(env->isolate(), args[0]);
+ 
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
++  SSL_CTX_set_options(sc->ctx_.get(), SSL_OP_SINGLE_ECDH_USE);
++  SSL_CTX_set_ecdh_auto(sc->ctx_.get(), 1);
++#endif
++
+   if (strcmp(*curve, "auto") == 0)
+     return;
+ 
+@@ -1468,9 +1772,17 @@ void SecureContext::GetTicketKeys(const FunctionCallbackInfo<Value>& args) {
+   ASSIGN_OR_RETURN_UNWRAP(&wrap, args.Holder());
+ 
+   Local<Object> buff = Buffer::New(wrap->env(), 48).ToLocalChecked();
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   memcpy(Buffer::Data(buff), wrap->ticket_key_name_, 16);
+   memcpy(Buffer::Data(buff) + 16, wrap->ticket_key_hmac_, 16);
+   memcpy(Buffer::Data(buff) + 32, wrap->ticket_key_aes_, 16);
++#else
++  if (SSL_CTX_set_tlsext_ticket_keys(wrap->ctx_.get(),
++                                     Buffer::Data(buff),
++                                     Buffer::Length(buff)) != 1) {
++    return wrap->env()->ThrowError("Failed to fetch tls ticket keys");
++  }
++#endif
+ 
+   args.GetReturnValue().Set(buff);
+ #endif  // !def(OPENSSL_NO_TLSEXT) && def(SSL_CTX_get_tlsext_ticket_keys)
+@@ -1506,6 +1818,14 @@ void SecureContext::SetTicketKeys(const FunctionCallbackInfo<Value>& args) {
+ 
+ 
+ void SecureContext::SetFreeListLength(const FunctionCallbackInfo<Value>& args) {
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
++  // |freelist_max_len| was removed in OpenSSL 1.1.0. In that version OpenSSL
++  // mallocs and frees buffers directly, without the use of a freelist.
++  SecureContext* wrap;
++  ASSIGN_OR_RETURN_UNWRAP(&wrap, args.Holder());
++
++  wrap->ctx_->freelist_max_len = args[0].As<Int32>()->Value();
++#endif
+ }
+ 
+ 
+@@ -1608,6 +1928,7 @@ int SecureContext::TicketKeyCallback(SSL* ssl,
+ }
+ 
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+ int SecureContext::TicketCompatibilityCallback(SSL* ssl,
+                                                unsigned char* name,
+                                                unsigned char* iv,
+@@ -1642,6 +1963,7 @@ int SecureContext::TicketCompatibilityCallback(SSL* ssl,
+   }
+   return 1;
+ }
++#endif
+ 
+ 
+ void SecureContext::CtxGetter(const FunctionCallbackInfo<Value>& info) {
+@@ -1719,11 +2041,19 @@ void SSLWrap<Base>::ConfigureSecureContext(SecureContext* sc) {
+ }
+ 
+ 
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
++template <class Base>
++SSL_SESSION* SSLWrap<Base>::GetSessionCallback(SSL* s,
++                                               unsigned char* key,
++                                               int len,
++                                               int* copy) {
++#else
+ template <class Base>
+ SSL_SESSION* SSLWrap<Base>::GetSessionCallback(SSL* s,
+                                                const unsigned char* key,
+                                                int len,
+                                                int* copy) {
++#endif
+   Base* w = static_cast<Base*>(SSL_get_app_data(s));
+ 
+   *copy = 0;
+@@ -2488,6 +2818,7 @@ void SSLWrap<Base>::GetEphemeralKeyInfo(
+             .Check();
+         break;
+       case EVP_PKEY_EC:
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+       case EVP_PKEY_X25519:
+       case EVP_PKEY_X448:
+         {
+@@ -2510,6 +2841,21 @@ void SSLWrap<Base>::GetEphemeralKeyInfo(
+                                  EVP_PKEY_bits(key.get()))).Check();
+         }
+         break;
++#else
++        {
++          EC_KEY* ec = EVP_PKEY_get1_EC_KEY(key.get());
++          int nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
++          EC_KEY_free(ec);
++          info->Set(context, env->type_string(),
++                    FIXED_ONE_BYTE_STRING(env->isolate(), "ECDH")).Check();
++          info->Set(context, env->name_string(),
++                    OneByteString(args.GetIsolate(),
++                                  OBJ_nid2sn(nid))).Check();
++          info->Set(context, env->size_string(),
++                    Integer::New(env->isolate(),
++                                  EVP_PKEY_bits(key.get()))).Check();
++         }
++#endif
+       default:
+         break;
+     }
+@@ -3735,12 +4081,15 @@ Local<Value> KeyObject::GetAsymmetricKeyType() const {
+   switch (EVP_PKEY_id(this->asymmetric_key_.get())) {
+   case EVP_PKEY_RSA:
+     return env()->crypto_rsa_string();
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   case EVP_PKEY_RSA_PSS:
+     return env()->crypto_rsa_pss_string();
++#endif
+   case EVP_PKEY_DSA:
+     return env()->crypto_dsa_string();
+   case EVP_PKEY_EC:
+     return env()->crypto_ec_string();
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   case EVP_PKEY_ED25519:
+     return env()->crypto_ed25519_string();
+   case EVP_PKEY_ED448:
+@@ -3749,6 +4098,7 @@ Local<Value> KeyObject::GetAsymmetricKeyType() const {
+     return env()->crypto_x25519_string();
+   case EVP_PKEY_X448:
+     return env()->crypto_x448_string();
++#endif
+   default:
+     return Undefined(env()->isolate());
+   }
+@@ -4044,10 +4394,10 @@ bool CipherBase::InitAuthenticated(const char* cipher_type, int iv_len,
+   CHECK(IsAuthenticatedMode());
+   MarkPopErrorOnReturn mark_pop_error_on_return;
+ 
+-  if (!EVP_CIPHER_CTX_ctrl(ctx_.get(),
+-                           EVP_CTRL_AEAD_SET_IVLEN,
+-                           iv_len,
+-                           nullptr)) {
++  // TODO(tniessen) Use EVP_CTRL_AEAD_SET_IVLEN when migrating to OpenSSL 1.1.0
++  static_assert(EVP_CTRL_CCM_SET_IVLEN == EVP_CTRL_GCM_SET_IVLEN,
++                "OpenSSL constants differ between GCM and CCM");
++  if (!EVP_CIPHER_CTX_ctrl(ctx_.get(), EVP_CTRL_GCM_SET_IVLEN, iv_len, nullptr)) {
+     env()->ThrowError("Invalid IV length");
+     return false;
+   }
+@@ -4395,8 +4745,12 @@ bool CipherBase::Final(AllocatedBuffer* out) {
+         CHECK(mode == EVP_CIPH_GCM_MODE);
+         auth_tag_len_ = sizeof(auth_tag_);
+       }
+-      CHECK_EQ(1, EVP_CIPHER_CTX_ctrl(ctx_.get(), EVP_CTRL_AEAD_GET_TAG,
+-                      auth_tag_len_,
++//      CHECK_EQ(1, EVP_CIPHER_CTX_ctrl(ctx_.get(), EVP_CTRL_AEAD_GET_TAG,
++//                      auth_tag_len_,
++      // TOOD(tniessen) Use EVP_CTRL_AEAP_GET_TAG in OpenSSL 1.1.0
++      static_assert(EVP_CTRL_CCM_GET_TAG == EVP_CTRL_GCM_GET_TAG,
++                    "OpenSSL constants differ between GCM and CCM");
++      CHECK_EQ(1, EVP_CIPHER_CTX_ctrl(ctx_.get(), EVP_CTRL_GCM_GET_TAG, auth_tag_len_,
+                       reinterpret_cast<unsigned char*>(auth_tag_)));
+     }
+   }
+@@ -4676,8 +5030,12 @@ void Hash::HashDigest(const FunctionCallbackInfo<Value>& args) {
+       ret = EVP_DigestFinal_ex(hash->mdctx_.get(), hash->md_value_,
+                                &hash->md_len_);
+     } else {
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+       ret = EVP_DigestFinalXOF(hash->mdctx_.get(), hash->md_value_,
+                                hash->md_len_);
++#else
++      return env->ThrowError("Unsupported XOF digest");
++#endif  // OPENSSL_VERSION_NUMBER >= 0x10100000L
+     }
+ 
+     if (ret != 1) {
+@@ -4707,12 +5065,14 @@ void Hash::HashDigest(const FunctionCallbackInfo<Value>& args) {
+ 
+ SignBase::Error SignBase::Init(const char* sign_type) {
+   CHECK_NULL(mdctx_);
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   // Historically, "dss1" and "DSS1" were DSA aliases for SHA-1
+   // exposed through the public API.
+   if (strcmp(sign_type, "dss1") == 0 ||
+       strcmp(sign_type, "DSS1") == 0) {
+     sign_type = "SHA1";
+   }
++#endif
+   const EVP_MD* md = EVP_get_digestbyname(sign_type);
+   if (md == nullptr)
+     return kSignUnknownDigest;
+@@ -4781,9 +5141,14 @@ static bool ApplyRSAOptions(const ManagedEVPPKey& pkey,
+                             EVP_PKEY_CTX* pkctx,
+                             int padding,
+                             const Maybe<int>& salt_len) {
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   if (EVP_PKEY_id(pkey.get()) == EVP_PKEY_RSA ||
+       EVP_PKEY_id(pkey.get()) == EVP_PKEY_RSA2 ||
+       EVP_PKEY_id(pkey.get()) == EVP_PKEY_RSA_PSS) {
++#else
++  if (EVP_PKEY_id(pkey.get()) == EVP_PKEY_RSA ||
++      EVP_PKEY_id(pkey.get()) == EVP_PKEY_RSA2) {
++#endif
+     if (EVP_PKEY_CTX_set_rsa_padding(pkctx, padding) <= 0)
+       return false;
+     if (padding == RSA_PKCS1_PSS_PADDING && salt_len.IsJust()) {
+@@ -4838,9 +5203,13 @@ void Sign::SignUpdate(const FunctionCallbackInfo<Value>& args) {
+   sign->CheckThrow(err);
+ }
+ 
+-static int GetDefaultSignPadding(const ManagedEVPPKey& key) {
++static int GetDefaultSignPadding([[maybe_unused]] const ManagedEVPPKey& key) {
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
++  return RSA_PKCS1_PADDING;
++#else
+   return EVP_PKEY_id(key.get()) == EVP_PKEY_RSA_PSS ? RSA_PKCS1_PSS_PADDING :
+                                                       RSA_PKCS1_PADDING;
++#endif  // OPENSSL_VERSION_NUMBER < 0x10100000L
+ }
+ 
+ static AllocatedBuffer Node_SignFinal(Environment* env,
+@@ -5991,9 +6360,24 @@ struct PBKDF2Job : public CryptoJob {
+   }
+ 
+   inline void DoThreadPoolWork() override {
+-    auto salt_data = reinterpret_cast<const unsigned char*>(salt.data());
++    static const auto *empty = "";
++
++    auto pass_data = reinterpret_cast<const char *>(empty);
++    auto pass_size = int(0);
++    auto salt_data = reinterpret_cast<const unsigned char *>(empty);
++    auto salt_size = int(0);
++
++    if (pass.size() > 0) {
++      pass_data = pass.data();
++      pass_size = pass.size();
++    }
++    if (salt.size() > 0) {
++      salt_data = reinterpret_cast<const unsigned char *>(salt.data());
++      salt_size = salt.size();
++    }
++
+     const bool ok =
+-        PKCS5_PBKDF2_HMAC(pass.data(), pass.size(), salt_data, salt.size(),
++        PKCS5_PBKDF2_HMAC(pass_data, pass_size, salt_data, salt_size,
+                           iteration_count, digest, keybuf_size, keybuf_data);
+     success = Just(ok);
+     Cleanse();
+@@ -6176,6 +6560,7 @@ class RSAKeyPairGenerationConfig : public KeyPairGenerationConfig {
+   const unsigned int exponent_;
+ };
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+ class RSAPSSKeyPairGenerationConfig : public RSAKeyPairGenerationConfig {
+  public:
+   RSAPSSKeyPairGenerationConfig(unsigned int modulus_bits,
+@@ -6217,6 +6602,7 @@ class RSAPSSKeyPairGenerationConfig : public RSAKeyPairGenerationConfig {
+   const EVP_MD* mgf1_md_;
+   const int saltlen_;
+ };
++#endif
+ 
+ class DSAKeyPairGenerationConfig : public KeyPairGenerationConfig {
+  public:
+@@ -6292,6 +6678,7 @@ class ECKeyPairGenerationConfig : public KeyPairGenerationConfig {
+   const int param_encoding_;
+ };
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+ class NidKeyPairGenerationConfig : public KeyPairGenerationConfig {
+  public:
+   explicit NidKeyPairGenerationConfig(int id) : id_(id) {}
+@@ -6303,6 +6690,7 @@ class NidKeyPairGenerationConfig : public KeyPairGenerationConfig {
+  private:
+   const int id_;
+ };
++#endif
+ 
+ class GenerateKeyPairJob : public CryptoJob {
+  public:
+@@ -6447,6 +6835,7 @@ void GenerateKeyPairRSA(const FunctionCallbackInfo<Value>& args) {
+   GenerateKeyPair(args, 2, std::move(config));
+ }
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+ void GenerateKeyPairRSAPSS(const FunctionCallbackInfo<Value>& args) {
+   Environment* env = Environment::GetCurrent(args);
+ 
+@@ -6484,6 +6873,7 @@ void GenerateKeyPairRSAPSS(const FunctionCallbackInfo<Value>& args) {
+                                         md, mgf1_md, saltlen));
+   GenerateKeyPair(args, 5, std::move(config));
+ }
++#endif
+ 
+ void GenerateKeyPairDSA(const FunctionCallbackInfo<Value>& args) {
+   CHECK(args[0]->IsUint32());
+@@ -6515,6 +6905,7 @@ void GenerateKeyPairEC(const FunctionCallbackInfo<Value>& args) {
+   GenerateKeyPair(args, 2, std::move(config));
+ }
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+ void GenerateKeyPairNid(const FunctionCallbackInfo<Value>& args) {
+   CHECK(args[0]->IsInt32());
+   const int id = args[0].As<Int32>()->Value();
+@@ -6522,6 +6913,7 @@ void GenerateKeyPairNid(const FunctionCallbackInfo<Value>& args) {
+       new NidKeyPairGenerationConfig(id));
+   GenerateKeyPair(args, 1, std::move(config));
+ }
++#endif
+ 
+ 
+ void GetSSLCiphers(const FunctionCallbackInfo<Value>& args) {
+@@ -6545,6 +6937,7 @@ void GetSSLCiphers(const FunctionCallbackInfo<Value>& args) {
+                            SSL_CIPHER_get_name(cipher))).Check();
+   }
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   // TLSv1.3 ciphers aren't listed by EVP. There are only 5, we could just
+   // document them, but since there are only 5, easier to just add them manually
+   // and not have to explain their absence in the API docs. They are lower-cased
+@@ -6562,6 +6955,7 @@ void GetSSLCiphers(const FunctionCallbackInfo<Value>& args) {
+     arr->Set(env->context(),
+              arr->Length(), OneByteString(args.GetIsolate(), name)).Check();
+   }
++#endif
+ 
+   args.GetReturnValue().Set(arr);
+ }
+@@ -6815,6 +7209,12 @@ void InitCryptoOnce() {
+   SSL_library_init();
+   OpenSSL_add_all_algorithms();
+ 
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
++  crypto_lock_init();
++  CRYPTO_set_locking_callback(crypto_lock_cb);
++  CRYPTO_THREADID_set_callback(crypto_threadid_cb);
++#endif
++
+ #ifdef NODE_FIPS_MODE
+   /* Override FIPS settings in cnf file, if needed. */
+   unsigned long err = 0;  // NOLINT(runtime/int)
+@@ -6936,14 +7336,18 @@ void Initialize(Local<Object> target,
+ 
+   env->SetMethod(target, "pbkdf2", PBKDF2);
+   env->SetMethod(target, "generateKeyPairRSA", GenerateKeyPairRSA);
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   env->SetMethod(target, "generateKeyPairRSAPSS", GenerateKeyPairRSAPSS);
++#endif
+   env->SetMethod(target, "generateKeyPairDSA", GenerateKeyPairDSA);
+   env->SetMethod(target, "generateKeyPairEC", GenerateKeyPairEC);
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   env->SetMethod(target, "generateKeyPairNid", GenerateKeyPairNid);
+   NODE_DEFINE_CONSTANT(target, EVP_PKEY_ED25519);
+   NODE_DEFINE_CONSTANT(target, EVP_PKEY_ED448);
+   NODE_DEFINE_CONSTANT(target, EVP_PKEY_X25519);
+   NODE_DEFINE_CONSTANT(target, EVP_PKEY_X448);
++#endif
+   NODE_DEFINE_CONSTANT(target, OPENSSL_EC_NAMED_CURVE);
+   NODE_DEFINE_CONSTANT(target, OPENSSL_EC_EXPLICIT_CURVE);
+   NODE_DEFINE_CONSTANT(target, kKeyEncodingPKCS1);
+diff --git a/src/node_crypto.h b/src/node_crypto.h
+index 99e6c48117..667fa87ad2 100644
+--- a/src/node_crypto.h
++++ b/src/node_crypto.h
+@@ -36,6 +36,41 @@
+ #include <openssl/err.h>
+ #include <openssl/ssl.h>
+ 
++// OpenSSL backport shims
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
++
++// Declare what OpenSSL features we do not support
++// Pretending we are BoringSSL can also help
++#define OPENSSL_IS_BORINGSSL
++#define OPENSSL_NO_OCB
++#define OPENSSL_NO_SCRYPT
++
++#define EVP_CTRL_AEAD_SET_TAG EVP_CTRL_CCM_SET_TAG
++#define EVP_MD_CTX_free EVP_MD_CTX_destroy
++#define EVP_MD_CTX_new EVP_MD_CTX_create
++
++// Values from upstream
++#define OPENSSL_EC_EXPLICIT_CURVE           0x0
++#define NID_chacha20_poly1305               1018
++#define EVP_MD_FLAG_XOF                     0x0002
++#define EVP_F_EVP_DIGESTFINALXOF            0
++#define EVP_R_NOT_XOF_OR_INVALID_LENGTH     178
++
++inline void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX* ctx) { EVP_CIPHER_CTX_cleanup(ctx); }
++inline void HMAC_CTX_free(HMAC_CTX* ctx) { if (ctx == nullptr) { return; } HMAC_CTX_cleanup(ctx); free(ctx); }
++inline void OPENSSL_clear_free(void* ptr, size_t len) {
++  if (ptr == nullptr) { return; }
++  OPENSSL_cleanse(ptr, len);
++  OPENSSL_free(ptr);
++}
++
++inline int BN_bn2binpad(const BIGNUM* a, unsigned char *to, int tolen) {
++    if (tolen < 0 || to == nullptr) { return -1; }
++    OPENSSL_cleanse(to, tolen);
++    return BN_bn2bin(a, to);
++}
++#endif // OPENSSL_VERSION_NUMBER < 0x10100000L
++
+ namespace node {
+ namespace crypto {
+ 
+@@ -230,10 +265,17 @@ class SSLWrap {
+   static void ConfigureSecureContext(SecureContext* sc);
+   static void AddMethods(Environment* env, v8::Local<v8::FunctionTemplate> t);
+ 
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
++  static SSL_SESSION* GetSessionCallback(SSL* s,
++                                         unsigned char* key,
++                                         int len,
++                                         int* copy);
++#else
+   static SSL_SESSION* GetSessionCallback(SSL* s,
+                                          const unsigned char* key,
+                                          int len,
+                                          int* copy);
++#endif
+   static int NewSessionCallback(SSL* s, SSL_SESSION* sess);
+   static void KeylogCallback(const SSL* s, const char* line);
+   static void OnClientHello(void* arg,
+diff --git a/src/node_crypto_bio.cc b/src/node_crypto_bio.cc
+index fc143043ba..75b55eb30c 100644
+--- a/src/node_crypto_bio.cc
++++ b/src/node_crypto_bio.cc
+@@ -30,8 +30,18 @@
+ namespace node {
+ namespace crypto {
+ 
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#define BIO_set_data(bio, data) bio->ptr = data
++#define BIO_get_data(bio) bio->ptr
++#define BIO_set_shutdown(bio, shutdown_) bio->shutdown = shutdown_
++#define BIO_get_shutdown(bio) bio->shutdown
++#define BIO_set_init(bio, init_) bio->init = init_
++#define BIO_get_init(bio) bio->init
++#endif
++
++
+ BIOPointer NodeBIO::New(Environment* env) {
+-  BIOPointer bio(BIO_new(GetMethod()));
++  BIOPointer bio(BIO_new(const_cast<BIO_METHOD*>(GetMethod())));
+   if (bio && env != nullptr)
+     NodeBIO::FromBIO(bio.get())->env_ = env;
+   return bio;
+@@ -221,6 +231,22 @@ long NodeBIO::Ctrl(BIO* bio, int cmd, long num,  // NOLINT(runtime/int)
+ 
+ 
+ const BIO_METHOD* NodeBIO::GetMethod() {
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
++  static const BIO_METHOD method = {
++    BIO_TYPE_MEM,
++    "node.js SSL buffer",
++    Write,
++    Read,
++    Puts,
++    Gets,
++    Ctrl,
++    New,
++    Free,
++    nullptr
++  };
++
++  return &method;
++#else
+   // This is called from InitCryptoOnce() to avoid race conditions during
+   // initialization.
+   static BIO_METHOD* method = nullptr;
+@@ -237,6 +263,7 @@ const BIO_METHOD* NodeBIO::GetMethod() {
+   }
+ 
+   return method;
++#endif
+ }
+ 
+ 
+diff --git a/src/node_errors.h b/src/node_errors.h
+index 261c6077bb..85a68f8acd 100644
+--- a/src/node_errors.h
++++ b/src/node_errors.h
+@@ -148,8 +148,8 @@ inline v8::Local<v8::Value> ERR_STRING_TOO_LONG(v8::Isolate* isolate) {
+ 
+ #define THROW_AND_RETURN_IF_NOT_STRING(env, val, prefix)                     \
+   do {                                                                       \
+-    if (!val->IsString())                                                    \
+-      return node::THROW_ERR_INVALID_ARG_TYPE(env,                           \
++    if (!(val)->IsString())                                                  \
++      return node::THROW_ERR_INVALID_ARG_TYPE((env),                         \
+                                               prefix " must be a string");   \
+   } while (0)
+ 
+diff --git a/src/node_options.cc b/src/node_options.cc
+index 98049453d8..5d40231b11 100644
+--- a/src/node_options.cc
++++ b/src/node_options.cc
+@@ -528,10 +528,12 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
+             "set default TLS minimum to TLSv1.2 (default: TLSv1.2)",
+             &EnvironmentOptions::tls_min_v1_2,
+             kAllowedInEnvironment);
++#ifdef TLS1_3_VERSION
+   AddOption("--tls-min-v1.3",
+             "set default TLS minimum to TLSv1.3 (default: TLSv1.2)",
+             &EnvironmentOptions::tls_min_v1_3,
+             kAllowedInEnvironment);
++#endif // TLS1_3_VERSION
+   AddOption("--tls-max-v1.2",
+             "set default TLS maximum to TLSv1.2 (default: TLSv1.3)",
+             &EnvironmentOptions::tls_max_v1_2,
+@@ -540,10 +542,12 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
+   // - 11.x and below: TLS1.3 is opt-in with --tls-max-v1.3
+   // - 12.x: TLS1.3 is opt-out with --tls-max-v1.2
+   // In either case, support both options they are uniformly available.
++#ifdef TLS1_3_VERSION
+   AddOption("--tls-max-v1.3",
+             "set default TLS maximum to TLSv1.3 (default: TLSv1.3)",
+             &EnvironmentOptions::tls_max_v1_3,
+             kAllowedInEnvironment);
++#endif // TLS1_3_VERSION
+ }
+ 
+ PerIsolateOptionsParser::PerIsolateOptionsParser(
+diff --git a/src/tls_wrap.cc b/src/tls_wrap.cc
+index 2d36c1a265..26af6e2fa8 100644
+--- a/src/tls_wrap.cc
++++ b/src/tls_wrap.cc
+@@ -910,11 +910,13 @@ void TLSWrap::EnableSessionCallbacks(
+ 
+ void TLSWrap::EnableKeylogCallback(
+     const FunctionCallbackInfo<Value>& args) {
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   TLSWrap* wrap;
+   ASSIGN_OR_RETURN_UNWRAP(&wrap, args.Holder());
+   CHECK_NOT_NULL(wrap->sc_);
+   SSL_CTX_set_keylog_callback(wrap->sc_->ctx_.get(),
+       SSLWrap<TLSWrap>::KeylogCallback);
++#endif // OPENSSL_VERSION_NUMBER >= 0x10100000L
+ }
+ 
+ // Check required capabilities were not excluded from the OpenSSL build:
diff --git a/SOURCES/0002-Adjust-tests-for-missing-OpenSSL-features.patch b/SOURCES/0002-Adjust-tests-for-missing-OpenSSL-features.patch
new file mode 100644
index 0000000..05881fa
--- /dev/null
+++ b/SOURCES/0002-Adjust-tests-for-missing-OpenSSL-features.patch
@@ -0,0 +1,908 @@
+diff --git a/test/parallel/test-crypto-aes-wrap.js b/test/known_issues/test-crypto-aes-wrap.js
+similarity index 100%
+rename from test/parallel/test-crypto-aes-wrap.js
+rename to test/known_issues/test-crypto-aes-wrap.js
+diff --git a/test/parallel/test-crypto-des3-wrap.js b/test/known_issues/test-crypto-des3-wrap.js
+similarity index 100%
+rename from test/parallel/test-crypto-des3-wrap.js
+rename to test/known_issues/test-crypto-des3-wrap.js
+diff --git a/test/parallel/test-crypto-hash-stream-pipe.js b/test/known_issues/test-crypto-hash-stream-pipe.js
+similarity index 100%
+rename from test/parallel/test-crypto-hash-stream-pipe.js
+rename to test/known_issues/test-crypto-hash-stream-pipe.js
+diff --git a/test/doctool/test-make-doc.js b/test/known_issues/test-make-doc.js
+similarity index 100%
+rename from test/doctool/test-make-doc.js
+rename to test/known_issues/test-make-doc.js
+diff --git a/test/parallel/test-tls-cli-max-version-1.3.js b/test/known_issues/test-tls-cli-max-version-1.3.js
+similarity index 100%
+rename from test/parallel/test-tls-cli-max-version-1.3.js
+rename to test/known_issues/test-tls-cli-max-version-1.3.js
+diff --git a/test/parallel/test-tls-cli-min-max-conflict.js b/test/known_issues/test-tls-cli-min-max-conflict.js
+similarity index 100%
+rename from test/parallel/test-tls-cli-min-max-conflict.js
+rename to test/known_issues/test-tls-cli-min-max-conflict.js
+diff --git a/test/parallel/test-tls-cli-min-version-1.3.js b/test/known_issues/test-tls-cli-min-version-1.3.js
+similarity index 100%
+rename from test/parallel/test-tls-cli-min-version-1.3.js
+rename to test/known_issues/test-tls-cli-min-version-1.3.js
+diff --git a/test/parallel/test-tls-client-renegotiation-13.js b/test/known_issues/test-tls-client-renegotiation-13.js
+similarity index 100%
+rename from test/parallel/test-tls-client-renegotiation-13.js
+rename to test/known_issues/test-tls-client-renegotiation-13.js
+diff --git a/test/parallel/test-tls-keylog-tlsv13.js b/test/known_issues/test-tls-keylog-tlsv13.js
+similarity index 100%
+rename from test/parallel/test-tls-keylog-tlsv13.js
+rename to test/known_issues/test-tls-keylog-tlsv13.js
+diff --git a/test/parallel/test-tls-no-sslv3.js b/test/known_issues/test-tls-no-sslv3.js
+similarity index 100%
+rename from test/parallel/test-tls-no-sslv3.js
+rename to test/known_issues/test-tls-no-sslv3.js
+diff --git a/test/parallel/test-tls-ticket-12.js b/test/known_issues/test-tls-ticket-12.js
+similarity index 100%
+rename from test/parallel/test-tls-ticket-12.js
+rename to test/known_issues/test-tls-ticket-12.js
+diff --git a/test/parallel/test-tls-ticket-cluster.js b/test/known_issues/test-tls-ticket-cluster.js
+similarity index 100%
+rename from test/parallel/test-tls-ticket-cluster.js
+rename to test/known_issues/test-tls-ticket-cluster.js
+diff --git a/test/parallel/test-tls-ticket.js b/test/known_issues/test-tls-ticket.js
+similarity index 100%
+rename from test/parallel/test-tls-ticket.js
+rename to test/known_issues/test-tls-ticket.js
+diff --git a/test/parallel/test-v8-serdes.js b/test/known_issues/test-v8-serdes.js
+similarity index 100%
+rename from test/parallel/test-v8-serdes.js
+rename to test/known_issues/test-v8-serdes.js
+diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js
+index 8be7296c69..c9bf9612cb 100644
+--- a/test/parallel/test-crypto-authenticated.js
++++ b/test/parallel/test-crypto-authenticated.js
+@@ -404,7 +404,7 @@ for (const test of TEST_CASES) {
+ // Test that create(De|C)ipher(iv)? throws if the mode is CCM or OCB and no
+ // authentication tag has been specified.
+ {
+-  for (const mode of ['ccm', 'ocb']) {
++  for (const mode of ['ccm']) {
+     assert.throws(() => {
+       crypto.createCipheriv(`aes-256-${mode}`,
+                             'FxLKsqdmv0E9xrQhp0b1ZgI0K7JFZJM8',
+@@ -564,7 +564,7 @@ for (const test of TEST_CASES) {
+   const key = Buffer.from('0123456789abcdef', 'utf8');
+   const iv = Buffer.from('0123456789ab', 'utf8');
+ 
+-  for (const mode of ['gcm', 'ocb']) {
++  for (const mode of ['gcm']) {
+     for (const authTagLength of mode === 'gcm' ? [undefined, 8] : [8]) {
+       const cipher = crypto.createCipheriv(`aes-128-${mode}`, key, iv, {
+         authTagLength
+@@ -598,7 +598,7 @@ for (const test of TEST_CASES) {
+   const iv = Buffer.from('0123456789ab', 'utf8');
+   const opts = { authTagLength: 8 };
+ 
+-  for (const mode of ['gcm', 'ccm', 'ocb']) {
++  for (const mode of ['gcm', 'ccm']) {
+     const cipher = crypto.createCipheriv(`aes-128-${mode}`, key, iv, opts);
+     const ciphertext = Buffer.concat([cipher.update(plain), cipher.final()]);
+     const tag = cipher.getAuthTag();
+@@ -616,51 +616,3 @@ for (const test of TEST_CASES) {
+     assert(plain.equals(plaintext));
+   }
+ }
+-
+-
+-// Test chacha20-poly1305 rejects invalid IV lengths of 13, 14, 15, and 16 (a
+-// length of 17 or greater was already rejected).
+-// - https://www.openssl.org/news/secadv/20190306.txt
+-{
+-  // Valid extracted from TEST_CASES, check that it detects IV tampering.
+-  const valid = {
+-    algo: 'chacha20-poly1305',
+-    key: '808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9f',
+-    iv: '070000004041424344454647',
+-    plain: '4c616469657320616e642047656e746c656d656e206f662074686520636c6173' +
+-           '73206f66202739393a204966204920636f756c64206f6666657220796f75206f' +
+-           '6e6c79206f6e652074697020666f7220746865206675747572652c2073756e73' +
+-           '637265656e20776f756c642062652069742e',
+-    plainIsHex: true,
+-    aad: '50515253c0c1c2c3c4c5c6c7',
+-    ct: 'd31a8d34648e60db7b86afbc53ef7ec2a4aded51296e08fea9e2b5' +
+-        'a736ee62d63dbea45e8ca9671282fafb69da92728b1a71de0a9e06' +
+-        '0b2905d6a5b67ecd3b3692ddbd7f2d778b8c9803aee328091b58fa' +
+-        'b324e4fad675945585808b4831d7bc3ff4def08e4b7a9de576d265' +
+-        '86cec64b6116',
+-    tag: '1ae10b594f09e26a7e902ecbd0600691',
+-    tampered: false,
+-  };
+-
+-  // Invalid IV lengths should be detected:
+-  // - 12 and below are valid.
+-  // - 13-16 are not detected as invalid by some OpenSSL versions.
+-  check(13);
+-  check(14);
+-  check(15);
+-  check(16);
+-  // - 17 and above were always detected as invalid by OpenSSL.
+-  check(17);
+-
+-  function check(ivLength) {
+-    const prefix = ivLength - valid.iv.length / 2;
+-    assert.throws(() => crypto.createCipheriv(
+-      valid.algo,
+-      Buffer.from(valid.key, 'hex'),
+-      Buffer.from(H(prefix) + valid.iv, 'hex'),
+-      { authTagLength: valid.tag.length / 2 }
+-    ), errMessages.length, `iv length ${ivLength} was not rejected`);
+-
+-    function H(length) { return '00'.repeat(length); }
+-  }
+-}
+diff --git a/test/parallel/test-crypto-hash.js b/test/parallel/test-crypto-hash.js
+index 4d3214adb2..de15f00bc9 100644
+--- a/test/parallel/test-crypto-hash.js
++++ b/test/parallel/test-crypto-hash.js
+@@ -185,71 +185,3 @@ common.expectsError(
+   assert(instance instanceof Hash, 'Hash is expected to return a new instance' +
+                                    ' when called without `new`');
+ }
+-
+-// Test XOF hash functions and the outputLength option.
+-{
+-  // Default outputLengths.
+-  assert.strictEqual(crypto.createHash('shake128').digest('hex'),
+-                     '7f9c2ba4e88f827d616045507605853e');
+-  assert.strictEqual(crypto.createHash('shake128', null).digest('hex'),
+-                     '7f9c2ba4e88f827d616045507605853e');
+-  assert.strictEqual(crypto.createHash('shake256').digest('hex'),
+-                     '46b9dd2b0ba88d13233b3feb743eeb24' +
+-                     '3fcd52ea62b81b82b50c27646ed5762f');
+-
+-  // Short outputLengths.
+-  assert.strictEqual(crypto.createHash('shake128', { outputLength: 0 })
+-                           .digest('hex'),
+-                     '');
+-  assert.strictEqual(crypto.createHash('shake128', { outputLength: 5 })
+-                           .digest('hex'),
+-                     '7f9c2ba4e8');
+-  assert.strictEqual(crypto.createHash('shake128', { outputLength: 15 })
+-                           .digest('hex'),
+-                     '7f9c2ba4e88f827d61604550760585');
+-  assert.strictEqual(crypto.createHash('shake256', { outputLength: 16 })
+-                           .digest('hex'),
+-                     '46b9dd2b0ba88d13233b3feb743eeb24');
+-
+-  // Large outputLengths.
+-  assert.strictEqual(crypto.createHash('shake128', { outputLength: 128 })
+-                           .digest('hex'),
+-                     '7f9c2ba4e88f827d616045507605853e' +
+-                     'd73b8093f6efbc88eb1a6eacfa66ef26' +
+-                     '3cb1eea988004b93103cfb0aeefd2a68' +
+-                     '6e01fa4a58e8a3639ca8a1e3f9ae57e2' +
+-                     '35b8cc873c23dc62b8d260169afa2f75' +
+-                     'ab916a58d974918835d25e6a435085b2' +
+-                     'badfd6dfaac359a5efbb7bcc4b59d538' +
+-                     'df9a04302e10c8bc1cbf1a0b3a5120ea');
+-  const superLongHash = crypto.createHash('shake256', {
+-    outputLength: 1024 * 1024
+-  }).update('The message is shorter than the hash!')
+-    .digest('hex');
+-  assert.strictEqual(superLongHash.length, 2 * 1024 * 1024);
+-  assert.ok(superLongHash.endsWith('193414035ddba77bf7bba97981e656ec'));
+-  assert.ok(superLongHash.startsWith('a2a28dbc49cfd6e5d6ceea3d03e77748'));
+-
+-  // Non-XOF hash functions should accept valid outputLength options as well.
+-  assert.strictEqual(crypto.createHash('sha224', { outputLength: 28 })
+-                           .digest('hex'),
+-                     'd14a028c2a3a2bc9476102bb288234c4' +
+-                     '15a2b01f828ea62ac5b3e42f');
+-
+-  // Passing invalid sizes should throw during creation.
+-  common.expectsError(() => {
+-    crypto.createHash('sha256', { outputLength: 28 });
+-  }, {
+-    code: 'ERR_OSSL_EVP_NOT_XOF_OR_INVALID_LENGTH'
+-  });
+-
+-  for (const outputLength of [null, {}, 'foo', false]) {
+-    common.expectsError(() => crypto.createHash('sha256', { outputLength }),
+-                        { code: 'ERR_INVALID_ARG_TYPE' });
+-  }
+-
+-  for (const outputLength of [-1, .5, Infinity, 2 ** 90]) {
+-    common.expectsError(() => crypto.createHash('sha256', { outputLength }),
+-                        { code: 'ERR_OUT_OF_RANGE' });
+-  }
+-}
+diff --git a/test/parallel/test-crypto-key-objects.js b/test/parallel/test-crypto-key-objects.js
+index 558f7dc1f4..c94aae025e 100644
+--- a/test/parallel/test-crypto-key-objects.js
++++ b/test/parallel/test-crypto-key-objects.js
+@@ -202,42 +202,6 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
+   });
+ }
+ 
+-[
+-  { private: fixtures.readKey('ed25519_private.pem', 'ascii'),
+-    public: fixtures.readKey('ed25519_public.pem', 'ascii'),
+-    keyType: 'ed25519' },
+-  { private: fixtures.readKey('ed448_private.pem', 'ascii'),
+-    public: fixtures.readKey('ed448_public.pem', 'ascii'),
+-    keyType: 'ed448' },
+-  { private: fixtures.readKey('x25519_private.pem', 'ascii'),
+-    public: fixtures.readKey('x25519_public.pem', 'ascii'),
+-    keyType: 'x25519' },
+-  { private: fixtures.readKey('x448_private.pem', 'ascii'),
+-    public: fixtures.readKey('x448_public.pem', 'ascii'),
+-    keyType: 'x448' },
+-].forEach((info) => {
+-  const keyType = info.keyType;
+-
+-  {
+-    const exportOptions = { type: 'pkcs8', format: 'pem' };
+-    const key = createPrivateKey(info.private);
+-    assert.strictEqual(key.type, 'private');
+-    assert.strictEqual(key.asymmetricKeyType, keyType);
+-    assert.strictEqual(key.symmetricKeySize, undefined);
+-    assert.strictEqual(key.export(exportOptions), info.private);
+-  }
+-
+-  {
+-    const exportOptions = { type: 'spki', format: 'pem' };
+-    [info.private, info.public].forEach((pem) => {
+-      const key = createPublicKey(pem);
+-      assert.strictEqual(key.type, 'public');
+-      assert.strictEqual(key.asymmetricKeyType, keyType);
+-      assert.strictEqual(key.symmetricKeySize, undefined);
+-      assert.strictEqual(key.export(exportOptions), info.public);
+-    });
+-  }
+-});
+ 
+ {
+   // Reading an encrypted key without a passphrase should fail.
+@@ -284,145 +248,6 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
+ 
+ }
+ 
+-{
+-  // Test RSA-PSS.
+-  {
+-    // This key pair does not restrict the message digest algorithm or salt
+-    // length.
+-    const publicPem = fixtures.readKey('rsa_pss_public_2048.pem');
+-    const privatePem = fixtures.readKey('rsa_pss_private_2048.pem');
+-
+-    const publicKey = createPublicKey(publicPem);
+-    const privateKey = createPrivateKey(privatePem);
+-
+-    assert.strictEqual(publicKey.type, 'public');
+-    assert.strictEqual(publicKey.asymmetricKeyType, 'rsa-pss');
+-
+-    assert.strictEqual(privateKey.type, 'private');
+-    assert.strictEqual(privateKey.asymmetricKeyType, 'rsa-pss');
+-
+-    for (const key of [privatePem, privateKey]) {
+-      // Any algorithm should work.
+-      for (const algo of ['sha1', 'sha256']) {
+-        // Any salt length should work.
+-        for (const saltLength of [undefined, 8, 10, 12, 16, 18, 20]) {
+-          const signature = createSign(algo)
+-                            .update('foo')
+-                            .sign({ key, saltLength });
+-
+-          for (const pkey of [key, publicKey, publicPem]) {
+-            const okay = createVerify(algo)
+-                         .update('foo')
+-                         .verify({ key: pkey, saltLength }, signature);
+-
+-            assert.ok(okay);
+-          }
+-        }
+-      }
+-    }
+-
+-    // Exporting the key using PKCS#1 should not work since this would discard
+-    // any algorithm restrictions.
+-    common.expectsError(() => {
+-      publicKey.export({ format: 'pem', type: 'pkcs1' });
+-    }, {
+-      code: 'ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS'
+-    });
+-  }
+-
+-  {
+-    // This key pair enforces sha256 as the message digest and the MGF1
+-    // message digest and a salt length of at least 16 bytes.
+-    const publicPem =
+-      fixtures.readKey('rsa_pss_public_2048_sha256_sha256_16.pem');
+-    const privatePem =
+-      fixtures.readKey('rsa_pss_private_2048_sha256_sha256_16.pem');
+-
+-    const publicKey = createPublicKey(publicPem);
+-    const privateKey = createPrivateKey(privatePem);
+-
+-    assert.strictEqual(publicKey.type, 'public');
+-    assert.strictEqual(publicKey.asymmetricKeyType, 'rsa-pss');
+-
+-    assert.strictEqual(privateKey.type, 'private');
+-    assert.strictEqual(privateKey.asymmetricKeyType, 'rsa-pss');
+-
+-    for (const key of [privatePem, privateKey]) {
+-      // Signing with anything other than sha256 should fail.
+-      assert.throws(() => {
+-        createSign('sha1').sign(key);
+-      }, /digest not allowed/);
+-
+-      // Signing with salt lengths less than 16 bytes should fail.
+-      for (const saltLength of [8, 10, 12]) {
+-        assert.throws(() => {
+-          createSign('sha1').sign({ key, saltLength });
+-        }, /pss saltlen too small/);
+-      }
+-
+-      // Signing with sha256 and appropriate salt lengths should work.
+-      for (const saltLength of [undefined, 16, 18, 20]) {
+-        const signature = createSign('sha256')
+-                          .update('foo')
+-                          .sign({ key, saltLength });
+-
+-        for (const pkey of [key, publicKey, publicPem]) {
+-          const okay = createVerify('sha256')
+-                       .update('foo')
+-                       .verify({ key: pkey, saltLength }, signature);
+-
+-          assert.ok(okay);
+-        }
+-      }
+-    }
+-  }
+-
+-  {
+-    // This key enforces sha512 as the message digest and sha256 as the MGF1
+-    // message digest.
+-    const publicPem =
+-      fixtures.readKey('rsa_pss_public_2048_sha512_sha256_20.pem');
+-    const privatePem =
+-      fixtures.readKey('rsa_pss_private_2048_sha512_sha256_20.pem');
+-
+-    const publicKey = createPublicKey(publicPem);
+-    const privateKey = createPrivateKey(privatePem);
+-
+-    assert.strictEqual(publicKey.type, 'public');
+-    assert.strictEqual(publicKey.asymmetricKeyType, 'rsa-pss');
+-
+-    assert.strictEqual(privateKey.type, 'private');
+-    assert.strictEqual(privateKey.asymmetricKeyType, 'rsa-pss');
+-
+-    // Node.js usually uses the same hash function for the message and for MGF1.
+-    // However, when a different MGF1 message digest algorithm has been
+-    // specified as part of the key, it should automatically switch to that.
+-    // This behavior is required by sections 3.1 and 3.3 of RFC4055.
+-    for (const key of [privatePem, privateKey]) {
+-      // sha256 matches the MGF1 hash function and should be used internally,
+-      // but it should not be permitted as the main message digest algorithm.
+-      for (const algo of ['sha1', 'sha256']) {
+-        assert.throws(() => {
+-          createSign(algo).sign(key);
+-        }, /digest not allowed/);
+-      }
+-
+-      // sha512 should produce a valid signature.
+-      const signature = createSign('sha512')
+-                        .update('foo')
+-                        .sign(key);
+-
+-      for (const pkey of [key, publicKey, publicPem]) {
+-        const okay = createVerify('sha512')
+-                     .update('foo')
+-                     .verify(pkey, signature);
+-
+-        assert.ok(okay);
+-      }
+-    }
+-  }
+-}
+-
+ {
+   // Exporting an encrypted private key requires a cipher
+   const privateKey = createPrivateKey(privatePem);
+diff --git a/test/parallel/test-crypto-keygen.js b/test/parallel/test-crypto-keygen.js
+index 8c3432e06c..07815e11e5 100644
+--- a/test/parallel/test-crypto-keygen.js
++++ b/test/parallel/test-crypto-keygen.js
+@@ -265,43 +265,6 @@ const sec1EncExp = (cipher) => getRegExpForPEM('EC PRIVATE KEY', cipher);
+   }));
+ }
+ 
+-{
+-  // Test RSA-PSS.
+-  generateKeyPair('rsa-pss', {
+-    modulusLength: 512,
+-    saltLength: 16,
+-    hash: 'sha256',
+-    mgf1Hash: 'sha256'
+-  }, common.mustCall((err, publicKey, privateKey) => {
+-    assert.ifError(err);
+-
+-    assert.strictEqual(publicKey.type, 'public');
+-    assert.strictEqual(publicKey.asymmetricKeyType, 'rsa-pss');
+-
+-    assert.strictEqual(privateKey.type, 'private');
+-    assert.strictEqual(privateKey.asymmetricKeyType, 'rsa-pss');
+-
+-    // Unlike RSA, RSA-PSS does not allow encryption.
+-    assert.throws(() => {
+-      testEncryptDecrypt(publicKey, privateKey);
+-    }, /operation not supported for this keytype/);
+-
+-    // RSA-PSS also does not permit signing with PKCS1 padding.
+-    assert.throws(() => {
+-      testSignVerify({
+-        key: publicKey,
+-        padding: constants.RSA_PKCS1_PADDING
+-      }, {
+-        key: privateKey,
+-        padding: constants.RSA_PKCS1_PADDING
+-      });
+-    }, /illegal or unsupported padding mode/);
+-
+-    // The padding should correctly default to RSA_PKCS1_PSS_PADDING now.
+-    testSignVerify(publicKey, privateKey);
+-  }));
+-}
+-
+ {
+   const privateKeyEncoding = {
+     type: 'pkcs8',
+@@ -964,23 +927,6 @@ const sec1EncExp = (cipher) => getRegExpForPEM('EC PRIVATE KEY', cipher);
+   }));
+ }
+ 
+-// Test EdDSA key generation.
+-{
+-  if (!/^1\.1\.0/.test(process.versions.openssl)) {
+-    ['ed25519', 'ed448', 'x25519', 'x448'].forEach((keyType) => {
+-      generateKeyPair(keyType, common.mustCall((err, publicKey, privateKey) => {
+-        assert.ifError(err);
+-
+-        assert.strictEqual(publicKey.type, 'public');
+-        assert.strictEqual(publicKey.asymmetricKeyType, keyType);
+-
+-        assert.strictEqual(privateKey.type, 'private');
+-        assert.strictEqual(privateKey.asymmetricKeyType, keyType);
+-      }));
+-    });
+-  }
+-}
+-
+ // Test invalid key encoding types.
+ {
+   // Invalid public key type.
+diff --git a/test/parallel/test-crypto-pbkdf2.js b/test/parallel/test-crypto-pbkdf2.js
+index 1d4e6f6617..64e8e8dbde 100644
+--- a/test/parallel/test-crypto-pbkdf2.js
++++ b/test/parallel/test-crypto-pbkdf2.js
+@@ -221,21 +221,3 @@ crypto.pbkdf2Sync(new Float32Array(10), 'salt', 8, 8, 'sha256');
+ crypto.pbkdf2Sync('pass', new Float32Array(10), 8, 8, 'sha256');
+ crypto.pbkdf2Sync(new Float64Array(10), 'salt', 8, 8, 'sha256');
+ crypto.pbkdf2Sync('pass', new Float64Array(10), 8, 8, 'sha256');
+-
+-assert.throws(
+-  () => crypto.pbkdf2('pass', 'salt', 8, 8, 'md55', common.mustNotCall()),
+-  {
+-    code: 'ERR_CRYPTO_INVALID_DIGEST',
+-    name: 'TypeError',
+-    message: 'Invalid digest: md55'
+-  }
+-);
+-
+-assert.throws(
+-  () => crypto.pbkdf2Sync('pass', 'salt', 8, 8, 'md55'),
+-  {
+-    code: 'ERR_CRYPTO_INVALID_DIGEST',
+-    name: 'TypeError',
+-    message: 'Invalid digest: md55'
+-  }
+-);
+diff --git a/test/parallel/test-crypto-sign-verify.js b/test/parallel/test-crypto-sign-verify.js
+index 66c7ac7d80..2a48025455 100644
+--- a/test/parallel/test-crypto-sign-verify.js
++++ b/test/parallel/test-crypto-sign-verify.js
+@@ -418,14 +418,6 @@ common.expectsError(
+ }
+ 
+ [
+-  { private: fixtures.readKey('ed25519_private.pem', 'ascii'),
+-    public: fixtures.readKey('ed25519_public.pem', 'ascii'),
+-    algo: null,
+-    sigLen: 64 },
+-  { private: fixtures.readKey('ed448_private.pem', 'ascii'),
+-    public: fixtures.readKey('ed448_public.pem', 'ascii'),
+-    algo: null,
+-    sigLen: 114 },
+   { private: fixtures.readKey('rsa_private_2048.pem', 'ascii'),
+     public: fixtures.readKey('rsa_public_2048.pem', 'ascii'),
+     algo: 'sha1',
+diff --git a/test/parallel/test-crypto.js b/test/parallel/test-crypto.js
+index 9337621d37..ac1fcce397 100644
+--- a/test/parallel/test-crypto.js
++++ b/test/parallel/test-crypto.js
+@@ -129,7 +129,7 @@ validateList(cryptoCiphers);
+ // Assume that we have at least AES256-SHA.
+ const tlsCiphers = tls.getCiphers();
+ assert(tls.getCiphers().includes('aes256-sha'));
+-assert(tls.getCiphers().includes('tls_aes_128_ccm_8_sha256'));
++//assert(tls.getCiphers().includes('tls_aes_128_ccm_8_sha256'));  // TLSv1.3
+ // There should be no capital letters in any element.
+ const noCapitals = /^[^A-Z]+$/;
+ assert(tlsCiphers.every((value) => noCapitals.test(value)));
+@@ -235,9 +235,9 @@ assert.throws(function() {
+ }, (err) => {
+   // Do the standard checks, but then do some custom checks afterwards.
+   assert.throws(() => { throw err; }, {
+-    message: 'error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong tag',
++    message: 'error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag',
+     library: 'asn1 encoding routines',
+-    function: 'asn1_check_tlen',
++    function: 'ASN1_CHECK_TLEN',
+     reason: 'wrong tag',
+     code: 'ERR_OSSL_ASN1_WRONG_TAG',
+   });
+diff --git a/test/parallel/test-https-agent-session-eviction.js b/test/parallel/test-https-agent-session-eviction.js
+index 3f5cd36e8b..8e13b150bb 100644
+--- a/test/parallel/test-https-agent-session-eviction.js
++++ b/test/parallel/test-https-agent-session-eviction.js
+@@ -7,8 +7,10 @@ const { readKey } = require('../common/fixtures');
+ if (!common.hasCrypto)
+   common.skip('missing crypto');
+ 
++const assert = require('assert');
+ const https = require('https');
+-const { SSL_OP_NO_TICKET } = require('crypto').constants;
++const { OPENSSL_VERSION_NUMBER, SSL_OP_NO_TICKET } =
++    require('crypto').constants;
+ 
+ const options = {
+   key: readKey('agent1-key.pem'),
+@@ -58,12 +60,38 @@ function second(server, session) {
+     res.resume();
+   });
+ 
+-  // Although we have a TLS 1.2 session to offer to the TLS 1.0 server,
+-  // connection to the TLS 1.0 server should work.
+-  req.on('response', common.mustCall(function(res) {
+-    // The test is now complete for OpenSSL 1.1.0.
+-    server.close();
+-  }));
++  if (OPENSSL_VERSION_NUMBER >= 0x10100000) {
++    // Although we have a TLS 1.2 session to offer to the TLS 1.0 server,
++    // connection to the TLS 1.0 server should work.
++    req.on('response', common.mustCall(function(res) {
++      // The test is now complete for OpenSSL 1.1.0.
++      server.close();
++    }));
++  } else {
++    // OpenSSL 1.0.x mistakenly locked versions based on the session it was
++    // offering. This causes this sequent request to fail. Let it fail, but
++    // test that this is mitigated on the next try by invalidating the session.
++    req.on('error', common.mustCall(function(err) {
++      assert(/wrong version number/.test(err.message));
++
++      req.on('close', function() {
++        third(server);
++      });
++    }));
++  }
++  req.end();
++}
+ 
++// Try one more time - session should be evicted!
++function third(server) {
++  const req = https.request({
++    port: server.address().port,
++    rejectUnauthorized: false
++  }, function(res) {
++    res.resume();
++    assert(!req.socket.isSessionReused());
++    server.close();
++  });
++  req.on('error', common.mustNotCall());
+   req.end();
+ }
+diff --git a/test/parallel/test-tls-alert-handling.js b/test/parallel/test-tls-alert-handling.js
+index f9f42e2d51..9dc4637ff0 100644
+--- a/test/parallel/test-tls-alert-handling.js
++++ b/test/parallel/test-tls-alert-handling.js
+@@ -33,7 +33,7 @@ let iter = 0;
+ const errorHandler = common.mustCall((err) => {
+   assert.strictEqual(err.code, 'ERR_SSL_WRONG_VERSION_NUMBER');
+   assert.strictEqual(err.library, 'SSL routines');
+-  assert.strictEqual(err.function, 'ssl3_get_record');
++  assert.strictEqual(err.function, 'SSL3_GET_RECORD');
+   assert.strictEqual(err.reason, 'wrong version number');
+   errorReceived = true;
+   if (canCloseServer())
+diff --git a/test/parallel/test-tls-cli-min-version-1.0.js b/test/parallel/test-tls-cli-min-version-1.0.js
+index 577562782e..0a227c0b94 100644
+--- a/test/parallel/test-tls-cli-min-version-1.0.js
++++ b/test/parallel/test-tls-cli-min-version-1.0.js
+@@ -8,7 +8,7 @@ if (!common.hasCrypto) common.skip('missing crypto');
+ const assert = require('assert');
+ const tls = require('tls');
+ 
+-assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.3');
++assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.2');
+ assert.strictEqual(tls.DEFAULT_MIN_VERSION, 'TLSv1');
+ 
+ // Check the min-max version protocol versions against these CLI settings.
+diff --git a/test/parallel/test-tls-cli-min-version-1.1.js b/test/parallel/test-tls-cli-min-version-1.1.js
+index 3af2b39546..1219c82030 100644
+--- a/test/parallel/test-tls-cli-min-version-1.1.js
++++ b/test/parallel/test-tls-cli-min-version-1.1.js
+@@ -8,7 +8,7 @@ if (!common.hasCrypto) common.skip('missing crypto');
+ const assert = require('assert');
+ const tls = require('tls');
+ 
+-assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.3');
++assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.2');
+ assert.strictEqual(tls.DEFAULT_MIN_VERSION, 'TLSv1.1');
+ 
+ // Check the min-max version protocol versions against these CLI settings.
+diff --git a/test/parallel/test-tls-cli-min-version-1.2.js b/test/parallel/test-tls-cli-min-version-1.2.js
+index 8385eabd0b..058dc180f6 100644
+--- a/test/parallel/test-tls-cli-min-version-1.2.js
++++ b/test/parallel/test-tls-cli-min-version-1.2.js
+@@ -8,7 +8,7 @@ if (!common.hasCrypto) common.skip('missing crypto');
+ const assert = require('assert');
+ const tls = require('tls');
+ 
+-assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.3');
++assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.2');
+ assert.strictEqual(tls.DEFAULT_MIN_VERSION, 'TLSv1.2');
+ 
+ // Check the min-max version protocol versions against these CLI settings.
+diff --git a/test/parallel/test-tls-client-getephemeralkeyinfo.js b/test/parallel/test-tls-client-getephemeralkeyinfo.js
+index 599306993e..cdfe5de87e 100644
+--- a/test/parallel/test-tls-client-getephemeralkeyinfo.js
++++ b/test/parallel/test-tls-client-getephemeralkeyinfo.js
+@@ -59,5 +59,3 @@ test(1024, 'DH', undefined, 'DHE-RSA-AES128-GCM-SHA256');
+ test(2048, 'DH', undefined, 'DHE-RSA-AES128-GCM-SHA256');
+ test(256, 'ECDH', 'prime256v1', 'ECDHE-RSA-AES128-GCM-SHA256');
+ test(521, 'ECDH', 'secp521r1', 'ECDHE-RSA-AES128-GCM-SHA256');
+-test(253, 'ECDH', 'X25519', 'ECDHE-RSA-AES128-GCM-SHA256');
+-test(448, 'ECDH', 'X448', 'ECDHE-RSA-AES128-GCM-SHA256');
+diff --git a/test/parallel/test-tls-destroy-stream.js b/test/parallel/test-tls-destroy-stream.js
+index a49e985a7e..1964f676c2 100644
+--- a/test/parallel/test-tls-destroy-stream.js
++++ b/test/parallel/test-tls-destroy-stream.js
+@@ -9,7 +9,7 @@ const net = require('net');
+ const assert = require('assert');
+ const tls = require('tls');
+ 
+-tls.DEFAULT_MAX_VERSION = 'TLSv1.3';
++tls.DEFAULT_MAX_VERSION = 'TLSv1.2';
+ 
+ // This test ensures that an instance of StreamWrap should emit "end" and
+ // "close" when the socket on the other side call `destroy()` instead of
+diff --git a/test/parallel/test-tls-getcipher.js b/test/parallel/test-tls-getcipher.js
+index 624f8efd24..93ad1f678a 100644
+--- a/test/parallel/test-tls-getcipher.js
++++ b/test/parallel/test-tls-getcipher.js
+@@ -52,7 +52,7 @@ server.listen(0, '127.0.0.1', common.mustCall(function() {
+   }, common.mustCall(function() {
+     const cipher = this.getCipher();
+     assert.strictEqual(cipher.name, 'AES128-SHA256');
+-    assert.strictEqual(cipher.version, 'TLSv1.2');
++    assert.strictEqual(cipher.version, 'TLSv1/SSLv3');
+     this.end();
+   }));
+ 
+@@ -65,28 +65,7 @@ server.listen(0, '127.0.0.1', common.mustCall(function() {
+   }, common.mustCall(function() {
+     const cipher = this.getCipher();
+     assert.strictEqual(cipher.name, 'ECDHE-RSA-AES128-GCM-SHA256');
+-    assert.strictEqual(cipher.version, 'TLSv1.2');
++    assert.strictEqual(cipher.version, 'TLSv1/SSLv3');
+     this.end();
+   }));
+ }));
+-
+-tls.createServer({
+-  key: fixtures.readKey('agent2-key.pem'),
+-  cert: fixtures.readKey('agent2-cert.pem'),
+-  ciphers: 'TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_CCM_8_SHA256',
+-  maxVersion: 'TLSv1.3',
+-}, common.mustCall(function() {
+-  this.close();
+-})).listen(0, common.mustCall(function() {
+-  const client = tls.connect({
+-    port: this.address().port,
+-    ciphers: 'TLS_AES_128_CCM_8_SHA256',
+-    maxVersion: 'TLSv1.3',
+-    rejectUnauthorized: false
+-  }, common.mustCall(() => {
+-    const cipher = client.getCipher();
+-    assert.strictEqual(cipher.name, 'TLS_AES_128_CCM_8_SHA256');
+-    assert.strictEqual(cipher.version, 'TLSv1.3');
+-    client.end();
+-  }));
+-}));
+diff --git a/test/parallel/test-tls-min-max-version.js b/test/parallel/test-tls-min-max-version.js
+index 179ae1fa63..8b5435baf5 100644
+--- a/test/parallel/test-tls-min-max-version.js
++++ b/test/parallel/test-tls-min-max-version.js
+@@ -126,9 +126,9 @@ if (DEFAULT_MIN_VERSION === 'TLSv1.3') {
+ 
+ if (DEFAULT_MIN_VERSION === 'TLSv1.2') {
+   test(U, U, 'TLSv1_1_method', U, U, 'SSLv23_method',
+-       U, 'ECONNRESET', 'ERR_SSL_UNSUPPORTED_PROTOCOL');
++       U, 'ECONNRESET', 'ERR_SSL_UNKNOWN_PROTOCOL');
+   test(U, U, 'TLSv1_method', U, U, 'SSLv23_method',
+-       U, 'ECONNRESET', 'ERR_SSL_UNSUPPORTED_PROTOCOL');
++       U, 'ECONNRESET', 'ERR_SSL_UNKNOWN_PROTOCOL');
+   test(U, U, 'SSLv23_method', U, U, 'TLSv1_1_method',
+        U, 'ERR_SSL_UNSUPPORTED_PROTOCOL', 'ERR_SSL_WRONG_VERSION_NUMBER');
+   test(U, U, 'SSLv23_method', U, U, 'TLSv1_method',
+@@ -138,7 +138,7 @@ if (DEFAULT_MIN_VERSION === 'TLSv1.2') {
+ if (DEFAULT_MIN_VERSION === 'TLSv1.1') {
+   test(U, U, 'TLSv1_1_method', U, U, 'SSLv23_method', 'TLSv1.1');
+   test(U, U, 'TLSv1_method', U, U, 'SSLv23_method',
+-       U, 'ECONNRESET', 'ERR_SSL_UNSUPPORTED_PROTOCOL');
++       U, 'ECONNRESET', 'ERR_SSL_UNKNOWN_PROTOCOL');
+   test(U, U, 'SSLv23_method', U, U, 'TLSv1_1_method', 'TLSv1.1');
+   test(U, U, 'SSLv23_method', U, U, 'TLSv1_method',
+        U, 'ERR_SSL_UNSUPPORTED_PROTOCOL', 'ERR_SSL_WRONG_VERSION_NUMBER');
+@@ -160,9 +160,9 @@ test(U, U, 'TLSv1_method', U, U, 'TLSv1_method', 'TLSv1');
+ // The default default.
+ if (DEFAULT_MIN_VERSION === 'TLSv1.2') {
+   test(U, U, 'TLSv1_1_method', U, U, U,
+-       U, 'ECONNRESET', 'ERR_SSL_UNSUPPORTED_PROTOCOL');
++       U, 'ECONNRESET', 'ERR_SSL_UNKNOWN_PROTOCOL');
+   test(U, U, 'TLSv1_method', U, U, U,
+-       U, 'ECONNRESET', 'ERR_SSL_UNSUPPORTED_PROTOCOL');
++       U, 'ECONNRESET', 'ERR_SSL_UNKNOWN_PROTOCOL');
+ 
+   if (DEFAULT_MAX_VERSION === 'TLSv1.2') {
+     test(U, U, U, U, U, 'TLSv1_1_method',
+@@ -182,7 +182,7 @@ if (DEFAULT_MIN_VERSION === 'TLSv1.2') {
+ if (DEFAULT_MIN_VERSION === 'TLSv1.1') {
+   test(U, U, 'TLSv1_1_method', U, U, U, 'TLSv1.1');
+   test(U, U, 'TLSv1_method', U, U, U,
+-       U, 'ECONNRESET', 'ERR_SSL_UNSUPPORTED_PROTOCOL');
++       U, 'ECONNRESET', 'ERR_SSL_UNKNOWN_PROTOCOL');
+   test(U, U, U, U, U, 'TLSv1_1_method', 'TLSv1.1');
+ 
+   if (DEFAULT_MAX_VERSION === 'TLSv1.2') {
+@@ -213,26 +213,9 @@ test(U, U, 'TLSv1_method', 'TLSv1', 'TLSv1.2', U, 'TLSv1');
+ test(U, U, 'TLSv1_1_method', 'TLSv1', 'TLSv1.2', U, 'TLSv1.1');
+ test(U, U, 'TLSv1_2_method', 'TLSv1', 'TLSv1.2', U, 'TLSv1.2');
+ 
+-test('TLSv1', 'TLSv1.1', U, 'TLSv1', 'TLSv1.3', U, 'TLSv1.1');
+ test('TLSv1', 'TLSv1.1', U, 'TLSv1', 'TLSv1.2', U, 'TLSv1.1');
+ test('TLSv1', 'TLSv1.2', U, 'TLSv1', 'TLSv1.1', U, 'TLSv1.1');
+-test('TLSv1', 'TLSv1.3', U, 'TLSv1', 'TLSv1.1', U, 'TLSv1.1');
+ test('TLSv1', 'TLSv1', U, 'TLSv1', 'TLSv1.1', U, 'TLSv1');
+ test('TLSv1', 'TLSv1.2', U, 'TLSv1', 'TLSv1', U, 'TLSv1');
+-test('TLSv1', 'TLSv1.3', U, 'TLSv1', 'TLSv1', U, 'TLSv1');
+ test('TLSv1.1', 'TLSv1.1', U, 'TLSv1', 'TLSv1.2', U, 'TLSv1.1');
+ test('TLSv1', 'TLSv1.2', U, 'TLSv1.1', 'TLSv1.1', U, 'TLSv1.1');
+-test('TLSv1', 'TLSv1.2', U, 'TLSv1', 'TLSv1.3', U, 'TLSv1.2');
+-
+-// v-any client can connect to v-specific server
+-test('TLSv1', 'TLSv1.3', U, 'TLSv1.3', 'TLSv1.3', U, 'TLSv1.3');
+-test('TLSv1', 'TLSv1.3', U, 'TLSv1.2', 'TLSv1.3', U, 'TLSv1.3');
+-test('TLSv1', 'TLSv1.3', U, 'TLSv1.2', 'TLSv1.2', U, 'TLSv1.2');
+-test('TLSv1', 'TLSv1.3', U, 'TLSv1.1', 'TLSv1.1', U, 'TLSv1.1');
+-test('TLSv1', 'TLSv1.3', U, 'TLSv1', 'TLSv1', U, 'TLSv1');
+-
+-// v-specific client can connect to v-any server
+-test('TLSv1.3', 'TLSv1.3', U, 'TLSv1', 'TLSv1.3', U, 'TLSv1.3');
+-test('TLSv1.2', 'TLSv1.2', U, 'TLSv1', 'TLSv1.3', U, 'TLSv1.2');
+-test('TLSv1.1', 'TLSv1.1', U, 'TLSv1', 'TLSv1.3', U, 'TLSv1.1');
+-test('TLSv1', 'TLSv1', U, 'TLSv1', 'TLSv1.3', U, 'TLSv1');
+diff --git a/test/parallel/test-tls-multi-key.js b/test/parallel/test-tls-multi-key.js
+index c5e66f3980..de213f57e2 100644
+--- a/test/parallel/test-tls-multi-key.js
++++ b/test/parallel/test-tls-multi-key.js
+@@ -157,7 +157,7 @@ function test(options) {
+     }, common.mustCall(function() {
+       assert.deepStrictEqual(ecdsa.getCipher(), {
+         name: 'ECDHE-ECDSA-AES256-GCM-SHA384',
+-        version: 'TLSv1.2'
++        version: 'TLSv1/SSLv3'
+       });
+       assert.strictEqual(ecdsa.getPeerCertificate().subject.CN, eccCN);
+       assert.strictEqual(ecdsa.getPeerCertificate().asn1Curve, 'prime256v1');
+@@ -175,7 +175,7 @@ function test(options) {
+     }, common.mustCall(function() {
+       assert.deepStrictEqual(rsa.getCipher(), {
+         name: 'ECDHE-RSA-AES256-GCM-SHA384',
+-        version: 'TLSv1.2'
++        version: 'TLSv1/SSLv3'
+       });
+       assert.strictEqual(rsa.getPeerCertificate().subject.CN, rsaCN);
+       assert(rsa.getPeerCertificate().exponent, 'cert for an RSA key');
+diff --git a/test/parallel/test-tls-multi-pfx.js b/test/parallel/test-tls-multi-pfx.js
+index 3b0c059182..28cd945e3c 100644
+--- a/test/parallel/test-tls-multi-pfx.js
++++ b/test/parallel/test-tls-multi-pfx.js
+@@ -42,9 +42,9 @@ const server = tls.createServer(options, function(conn) {
+ process.on('exit', function() {
+   assert.deepStrictEqual(ciphers, [{
+     name: 'ECDHE-ECDSA-AES256-GCM-SHA384',
+-    version: 'TLSv1.2'
++    version: 'TLSv1/SSLv3'
+   }, {
+     name: 'ECDHE-RSA-AES256-GCM-SHA384',
+-    version: 'TLSv1.2'
++    version: 'TLSv1/SSLv3'
+   }]);
+ });
+diff --git a/test/parallel/test-tls-passphrase.js b/test/parallel/test-tls-passphrase.js
+index c3a99c3eb3..4bbabb4c9e 100644
+--- a/test/parallel/test-tls-passphrase.js
++++ b/test/parallel/test-tls-passphrase.js
+@@ -223,7 +223,7 @@ server.listen(0, common.mustCall(function() {
+   }, onSecureConnect());
+ })).unref();
+ 
+-const errMessagePassword = /bad decrypt/;
++const errMessagePassword = /bad decrypt|bad password read/;
+ 
+ // Missing passphrase
+ assert.throws(function() {
+diff --git a/test/parallel/test-tls-set-ciphers.js b/test/parallel/test-tls-set-ciphers.js
+index fbca83b3d5..79fb178303 100644
+--- a/test/parallel/test-tls-set-ciphers.js
++++ b/test/parallel/test-tls-set-ciphers.js
+@@ -68,36 +68,11 @@ const U = undefined;
+ test(U, 'AES256-SHA', 'AES256-SHA');
+ test('AES256-SHA', U, 'AES256-SHA');
+ 
+-test(U, 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
+-test('TLS_AES_256_GCM_SHA384', U, 'TLS_AES_256_GCM_SHA384');
+-
+ // Do not have shared ciphers.
+-test('TLS_AES_256_GCM_SHA384', 'TLS_CHACHA20_POLY1305_SHA256',
+-     U, 'ECONNRESET', 'ERR_SSL_NO_SHARED_CIPHER');
+-
+-test('AES128-SHA', 'AES256-SHA', U, 'ECONNRESET', 'ERR_SSL_NO_SHARED_CIPHER');
+-test('AES128-SHA:TLS_AES_256_GCM_SHA384',
+-     'TLS_CHACHA20_POLY1305_SHA256:AES256-SHA',
+-     U, 'ECONNRESET', 'ERR_SSL_NO_SHARED_CIPHER');
+-
+-// Cipher order ignored, TLS1.3 chosen before TLS1.2.
+-test('AES256-SHA:TLS_AES_256_GCM_SHA384', U, 'TLS_AES_256_GCM_SHA384');
+-test(U, 'AES256-SHA:TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
+-
+-// TLS_AES_128_CCM_8_SHA256 & TLS_AES_128_CCM_SHA256 are not enabled by
+-// default, but work.
+-test('TLS_AES_128_CCM_8_SHA256', U,
+-     U, 'ECONNRESET', 'ERR_SSL_NO_SHARED_CIPHER');
+-
+-test('TLS_AES_128_CCM_8_SHA256', 'TLS_AES_128_CCM_8_SHA256',
+-     'TLS_AES_128_CCM_8_SHA256');
++test('AES128-SHA', 'AES256-SHA', U, 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE', 'ERR_SSL_NO_SHARED_CIPHER');
+ 
+ // Invalid cipher values
+ test(9, 'AES256-SHA', U, 'ERR_INVALID_ARG_TYPE', U);
+ test('AES256-SHA', 9, U, U, 'ERR_INVALID_ARG_TYPE');
+ test(':', 'AES256-SHA', U, 'ERR_INVALID_OPT_VALUE', U);
+ test('AES256-SHA', ':', U, U, 'ERR_INVALID_OPT_VALUE');
+-
+-// Using '' is synonymous for "use default ciphers"
+-test('TLS_AES_256_GCM_SHA384', '', 'TLS_AES_256_GCM_SHA384');
+-test('', 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
+diff --git a/test/sequential/test-async-wrap-getasyncid.js b/test/sequential/test-async-wrap-getasyncid.js
+index 13aee51175..e9a3b1893d 100644
+--- a/test/sequential/test-async-wrap-getasyncid.js
++++ b/test/sequential/test-async-wrap-getasyncid.js
+@@ -50,6 +50,8 @@ const { getSystemErrorName } = require('util');
+     delete providers.KEYPAIRGENREQUEST;
+     delete providers.HTTPCLIENTREQUEST;
+     delete providers.HTTPINCOMINGMESSAGE;
++    // SCRYPTREQUEST may not be available (OPENSSL_NO_SCRYPT)
++    delete providers.SCRYPTREQUEST;
+ 
+     const objKeys = Object.keys(providers);
+     if (objKeys.length > 0)
diff --git a/SOURCES/nodejs-revert-statx.patch b/SOURCES/nodejs-revert-statx.patch
new file mode 100644
index 0000000..31ce9b9
--- /dev/null
+++ b/SOURCES/nodejs-revert-statx.patch
@@ -0,0 +1,207 @@
+diff -up node-v12.10.0/deps/uv/src/unix/fs.c.orig node-v12.10.0/deps/uv/src/unix/fs.c
+--- node-v12.10.0/deps/uv/src/unix/fs.c.orig	2019-09-04 17:36:23.000000000 +0200
++++ node-v12.10.0/deps/uv/src/unix/fs.c	2019-10-10 12:46:10.743541964 +0200
+@@ -1212,84 +1212,10 @@ static void uv__to_stat(struct stat* src
+ }
+ 
+ 
+-static int uv__fs_statx(int fd,
+-                        const char* path,
+-                        int is_fstat,
+-                        int is_lstat,
+-                        uv_stat_t* buf) {
+-  STATIC_ASSERT(UV_ENOSYS != -1);
+-#ifdef __linux__
+-  static int no_statx;
+-  struct uv__statx statxbuf;
+-  int dirfd;
+-  int flags;
+-  int mode;
+-  int rc;
+-
+-  if (no_statx)
+-    return UV_ENOSYS;
+-
+-  dirfd = AT_FDCWD;
+-  flags = 0; /* AT_STATX_SYNC_AS_STAT */
+-  mode = 0xFFF; /* STATX_BASIC_STATS + STATX_BTIME */
+-
+-  if (is_fstat) {
+-    dirfd = fd;
+-    flags |= 0x1000; /* AT_EMPTY_PATH */
+-  }
+-
+-  if (is_lstat)
+-    flags |= AT_SYMLINK_NOFOLLOW;
+-
+-  rc = uv__statx(dirfd, path, flags, mode, &statxbuf);
+-
+-  if (rc == -1) {
+-    /* EPERM happens when a seccomp filter rejects the system call.
+-     * Has been observed with libseccomp < 2.3.3 and docker < 18.04.
+-     */
+-    if (errno != EINVAL && errno != EPERM && errno != ENOSYS)
+-      return -1;
+-
+-    no_statx = 1;
+-    return UV_ENOSYS;
+-  }
+-
+-  buf->st_dev = 256 * statxbuf.stx_dev_major + statxbuf.stx_dev_minor;
+-  buf->st_mode = statxbuf.stx_mode;
+-  buf->st_nlink = statxbuf.stx_nlink;
+-  buf->st_uid = statxbuf.stx_uid;
+-  buf->st_gid = statxbuf.stx_gid;
+-  buf->st_rdev = statxbuf.stx_rdev_major;
+-  buf->st_ino = statxbuf.stx_ino;
+-  buf->st_size = statxbuf.stx_size;
+-  buf->st_blksize = statxbuf.stx_blksize;
+-  buf->st_blocks = statxbuf.stx_blocks;
+-  buf->st_atim.tv_sec = statxbuf.stx_atime.tv_sec;
+-  buf->st_atim.tv_nsec = statxbuf.stx_atime.tv_nsec;
+-  buf->st_mtim.tv_sec = statxbuf.stx_mtime.tv_sec;
+-  buf->st_mtim.tv_nsec = statxbuf.stx_mtime.tv_nsec;
+-  buf->st_ctim.tv_sec = statxbuf.stx_ctime.tv_sec;
+-  buf->st_ctim.tv_nsec = statxbuf.stx_ctime.tv_nsec;
+-  buf->st_birthtim.tv_sec = statxbuf.stx_btime.tv_sec;
+-  buf->st_birthtim.tv_nsec = statxbuf.stx_btime.tv_nsec;
+-  buf->st_flags = 0;
+-  buf->st_gen = 0;
+-
+-  return 0;
+-#else
+-  return UV_ENOSYS;
+-#endif /* __linux__ */
+-}
+-
+-
+ static int uv__fs_stat(const char *path, uv_stat_t *buf) {
+   struct stat pbuf;
+   int ret;
+ 
+-  ret = uv__fs_statx(-1, path, /* is_fstat */ 0, /* is_lstat */ 0, buf);
+-  if (ret != UV_ENOSYS)
+-    return ret;
+-
+   ret = stat(path, &pbuf);
+   if (ret == 0)
+     uv__to_stat(&pbuf, buf);
+@@ -1302,10 +1228,6 @@ static int uv__fs_lstat(const char *path
+   struct stat pbuf;
+   int ret;
+ 
+-  ret = uv__fs_statx(-1, path, /* is_fstat */ 0, /* is_lstat */ 1, buf);
+-  if (ret != UV_ENOSYS)
+-    return ret;
+-
+   ret = lstat(path, &pbuf);
+   if (ret == 0)
+     uv__to_stat(&pbuf, buf);
+@@ -1318,10 +1240,6 @@ static int uv__fs_fstat(int fd, uv_stat_
+   struct stat pbuf;
+   int ret;
+ 
+-  ret = uv__fs_statx(fd, "", /* is_fstat */ 1, /* is_lstat */ 0, buf);
+-  if (ret != UV_ENOSYS)
+-    return ret;
+-
+   ret = fstat(fd, &pbuf);
+   if (ret == 0)
+     uv__to_stat(&pbuf, buf);
+diff -up node-v12.10.0/deps/uv/src/unix/linux-syscalls.c.orig node-v12.10.0/deps/uv/src/unix/linux-syscalls.c
+--- node-v12.10.0/deps/uv/src/unix/linux-syscalls.c.orig	2019-09-04 17:36:23.000000000 +0200
++++ node-v12.10.0/deps/uv/src/unix/linux-syscalls.c	2019-10-10 12:46:46.261728396 +0200
+@@ -187,21 +187,6 @@
+ # endif
+ #endif /* __NR_pwritev */
+ 
+-#ifndef __NR_statx
+-# if defined(__x86_64__)
+-#  define __NR_statx 332
+-# elif defined(__i386__)
+-#  define __NR_statx 383
+-# elif defined(__aarch64__)
+-#  define __NR_statx 397
+-# elif defined(__arm__)
+-#  define __NR_statx (UV_SYSCALL_BASE + 397)
+-# elif defined(__ppc__)
+-#  define __NR_statx 383
+-# elif defined(__s390__)
+-#  define __NR_statx 379
+-# endif
+-#endif /* __NR_statx */
+ 
+ int uv__accept4(int fd, struct sockaddr* addr, socklen_t* addrlen, int flags) {
+ #if defined(__i386__)
+@@ -350,20 +335,4 @@ int uv__dup3(int oldfd, int newfd, int f
+ #else
+   return errno = ENOSYS, -1;
+ #endif
+-}
+-
+-
+-int uv__statx(int dirfd,
+-              const char* path,
+-              int flags,
+-              unsigned int mask,
+-              struct uv__statx* statxbuf) {
+-  /* __NR_statx make Android box killed by SIGSYS.
+-   * That looks like a seccomp2 sandbox filter rejecting the system call.
+-   */
+-#if defined(__NR_statx) && !defined(__ANDROID__)
+-  return syscall(__NR_statx, dirfd, path, flags, mask, statxbuf);
+-#else
+-  return errno = ENOSYS, -1;
+-#endif
+ }
+diff -up node-v12.10.0/deps/uv/src/unix/linux-syscalls.h.orig node-v12.10.0/deps/uv/src/unix/linux-syscalls.h
+--- node-v12.10.0/deps/uv/src/unix/linux-syscalls.h.orig	2019-09-04 17:36:23.000000000 +0200
++++ node-v12.10.0/deps/uv/src/unix/linux-syscalls.h	2019-10-10 12:43:54.858867961 +0200
+@@ -80,36 +80,6 @@
+ #define UV__IN_DELETE_SELF    0x400
+ #define UV__IN_MOVE_SELF      0x800
+ 
+-struct uv__statx_timestamp {
+-  int64_t tv_sec;
+-  uint32_t tv_nsec;
+-  int32_t unused0;
+-};
+-
+-struct uv__statx {
+-  uint32_t stx_mask;
+-  uint32_t stx_blksize;
+-  uint64_t stx_attributes;
+-  uint32_t stx_nlink;
+-  uint32_t stx_uid;
+-  uint32_t stx_gid;
+-  uint16_t stx_mode;
+-  uint16_t unused0;
+-  uint64_t stx_ino;
+-  uint64_t stx_size;
+-  uint64_t stx_blocks;
+-  uint64_t stx_attributes_mask;
+-  struct uv__statx_timestamp stx_atime;
+-  struct uv__statx_timestamp stx_btime;
+-  struct uv__statx_timestamp stx_ctime;
+-  struct uv__statx_timestamp stx_mtime;
+-  uint32_t stx_rdev_major;
+-  uint32_t stx_rdev_minor;
+-  uint32_t stx_dev_major;
+-  uint32_t stx_dev_minor;
+-  uint64_t unused1[14];
+-};
+-
+ struct uv__inotify_event {
+   int32_t wd;
+   uint32_t mask;
+@@ -143,10 +113,5 @@ int uv__sendmmsg(int fd,
+ ssize_t uv__preadv(int fd, const struct iovec *iov, int iovcnt, int64_t offset);
+ ssize_t uv__pwritev(int fd, const struct iovec *iov, int iovcnt, int64_t offset);
+ int uv__dup3(int oldfd, int newfd, int flags);
+-int uv__statx(int dirfd,
+-              const char* path,
+-              int flags,
+-              unsigned int mask,
+-              struct uv__statx* statxbuf);
+ 
+ #endif /* UV_LINUX_SYSCALL_H_ */
diff --git a/SOURCES/nodejs-tarball.sh b/SOURCES/nodejs-tarball.sh
new file mode 100755
index 0000000..e7e9613
--- /dev/null
+++ b/SOURCES/nodejs-tarball.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+version=$(rpm -q --specfile --qf='%{version}\n' nodejs.spec | head -n1)
+wget http://nodejs.org/dist/v${version}/node-v${version}.tar.gz
+tar -zxf node-v${version}.tar.gz
+rm -rf node-v${version}/deps/openssl
+tar -zcf node-v${version}-stripped.tar.gz node-v${version}
diff --git a/SPECS/nodejs.spec b/SPECS/nodejs.spec
new file mode 100644
index 0000000..df6ce91
--- /dev/null
+++ b/SPECS/nodejs.spec
@@ -0,0 +1,909 @@
+%{?scl:%scl_package nodejs}
+%{!?scl:%global pkg_name %{name}}
+
+%global with_debug 0
+
+%{!?_with_bootstrap: %global bootstrap 1}
+
+# ARM builds currently break on the Debug builds, so we'll just
+# build the standard runtime until that gets sorted out.
+%ifarch %{arm} aarch64 %{power64}
+%global with_debug 0
+%endif
+
+# == Node.js Version ==
+# Note: Fedora should only ship LTS versions of Node.js (currently expected
+# to be major versions with even numbers). The odd-numbered versions are new
+# feature releases that are only supported for nine months, which is shorter
+# than a Fedora release lifecycle.
+%global nodejs_major 12
+%global nodejs_minor 10
+%global nodejs_patch 0
+%global nodejs_abi %{nodejs_major}.%{nodejs_minor}
+%global nodejs_version %{nodejs_major}.%{nodejs_minor}.%{nodejs_patch}
+%global nodejs_release 4
+
+# == Bundled Dependency Versions ==
+# v8 - from deps/v8/include/v8-version.h
+%global v8_major 7
+%global v8_minor 6
+%global v8_build 303
+%global v8_patch 29
+# V8 presently breaks ABI at least every x.y release while never bumping SONAME
+%global v8_abi %{v8_major}.%{v8_minor}
+%global v8_version %{v8_major}.%{v8_minor}.%{v8_build}.%{v8_patch}
+
+# c-ares - from deps/cares/include/ares_version.h
+%global c_ares_major 1
+%global c_ares_minor 15
+%global c_ares_patch 0
+%global c_ares_version %{c_ares_major}.%{c_ares_minor}.%{c_ares_patch}
+
+# http-parser - from deps/http_parser/http_parser.h
+%global http_parser_major 2
+%global http_parser_minor 8
+%global http_parser_patch 0
+%global http_parser_version %{http_parser_major}.%{http_parser_minor}.%{http_parser_patch}
+
+# llhttp - from deps/llhttp/include/llhttp.h
+%global llhttp_major 1
+%global llhttp_minor 1
+%global llhttp_patch 4
+%global llhttp_version %{llhttp_major}.%{llhttp_minor}.%{llhttp_patch}
+
+# libuv - from deps/uv/include/uv-version/h
+%global libuv_major 1
+%global libuv_minor 31
+%global libuv_patch 0
+%global libuv_version %{libuv_major}.%{libuv_minor}.%{libuv_patch}
+
+# nghttp2 - from deps/nghttp2/lib/includes/nghttp2/nghttp2ver.h
+
+%global nghttp2_major 1
+%global nghttp2_minor 39
+%global nghttp2_patch 2
+%global nghttp2_version %{nghttp2_major}.%{nghttp2_minor}.%{nghttp2_patch}
+
+# punycode - from lib/punycode.js
+# Note: this was merged into the mainline since 0.6.x
+# Note: this will be unmerged in v7 or v8
+%global punycode_major 2
+%global punycode_minor 1
+%global punycode_patch 1
+%global punycode_version %{punycode_major}.%{punycode_minor}.%{punycode_patch}
+
+# npm - from deps/npm/package.json
+%global npm_major 6
+%global npm_minor 10
+%global npm_patch 3
+%global npm_version %{npm_major}.%{npm_minor}.%{npm_patch}
+
+# zlib version - from deps/zlib/CMakeLists.txt
+# Note: Only required/bundled on RHEL-7
+%global zlib_major 1
+%global zlib_minor 2
+%global zlib_patch 11
+%global zlib_version %{zlib_major}.%{zlib_minor}.%{zlib_patch}
+
+# In order to avoid needing to keep incrementing the release version for the
+# main package forever, we will just construct one for npm that is guaranteed
+# to increment safely. Changing this can only be done during an update when the
+# base npm version number is increasing.
+%global npm_release %{nodejs_major}.%{nodejs_minor}.%{nodejs_patch}.%{nodejs_release}
+
+# Filter out the NPM bundled dependencies so we aren't providing them
+%global __provides_exclude_from ^%{_prefix}/lib/node_modules/npm/node_modules.*$
+%global __requires_exclude_from ^%{_prefix}/lib/node_modules/npm/node_modules.*$
+
+
+Name: %{?scl_prefix}nodejs
+Version: %{nodejs_version}
+Release: %{nodejs_release}%{?dist}
+Summary: JavaScript runtime
+License: MIT and ASL 2.0 and ISC and BSD
+Group: Development/Languages
+URL: http://nodejs.org/
+
+# nodejs bundles openssl, but we use the system version in Fedora
+# because openssl contains prohibited code, we remove openssl completely from
+# the tarball, using the script in Source100
+Source0: node-v%{nodejs_version}-stripped.tar.gz
+Source100: %{pkg_name}-tarball.sh
+
+# Patch for making nodejs compatible with older openssl
+Patch1: 0001-Remove-or-backport-OpenSSL-features.patch
+Patch2: 0002-Adjust-tests-for-missing-OpenSSL-features.patch
+# Remove libuv attempts to use statx syscall – rhbz#1760184
+Patch3: nodejs-revert-statx.patch
+
+%{?scl:Requires: %{scl}-runtime}
+%{?scl:BuildRequires: %{scl}-runtime}
+BuildRequires: python-devel
+#BuildRequires: libicu-devel
+BuildRequires: zlib-devel
+BuildRequires: devtoolset-7-gcc
+BuildRequires: devtoolset-7-gcc-c++
+# needed for tests
+BuildRequires: procps-ng
+BuildRequires: systemtap-sdt-devel
+BuildRequires: chrpath
+BuildRequires: devtoolset-7-libatomic-devel
+
+
+BuildRequires: openssl-devel >= 1:1.0.2
+
+# we need the system certificate store when Patch2 is applied
+Requires: ca-certificates
+
+#we need ABI virtual provides where SONAMEs aren't enough/not present so deps
+#break when binary compatibility is broken
+Provides: %{?scl_prefix}nodejs(abi) = %{nodejs_abi}
+Provides: %{?scl_prefix}nodejs(abi%{nodejs_major}) = %{nodejs_abi}
+Provides: %{?scl_prefix}nodejs(v8-abi) = %{v8_abi}
+Provides: %{?scl_prefix}nodejs(v8-abi%{v8_major}) = %{v8_abi}
+
+#this corresponds to the "engine" requirement in package.json
+Provides: %{?scl_prefix}nodejs(engine) = %{nodejs_version}
+
+# Node.js currently has a conflict with the 'node' package in Fedora
+# The ham-radio group has agreed to rename their binary for us, but
+# in the meantime, we're setting an explicit Conflicts: here
+Conflicts: node <= 0.3.2-12
+
+# The punycode module was absorbed into the standard library in v0.6.
+# It still exists as a seperate package for the benefit of users of older
+# versions.  Since we've never shipped anything older than v0.10 in Fedora,
+# we don't need the seperate nodejs-punycode package, so we Provide it here so
+# dependent packages don't need to override the dependency generator.
+# See also: RHBZ#11511811
+# UPDATE: punycode will be deprecated and so we should unbundle it in Node v8
+# and use upstream module instead
+# https://github.com/nodejs/node/commit/29e49fc286080215031a81effbd59eac092fff2f
+Provides: %{?scl_prefix}nodejs-punycode = %{punycode_version}
+Provides: %{?scl_prefix}npm(punycode) = %{punycode_version}
+
+
+# Node.js has forked c-ares from upstream in an incompatible way, so we need
+# to carry the bundled version internally.
+# See https://github.com/nodejs/node/commit/766d063e0578c0f7758c3a965c971763f43fec85
+Provides: bundled(%{?scl_prefix}c-ares) = %{c_ares_version}
+
+# Node.js is closely tied to the version of v8 that is used with it. It makes
+# sense to use the bundled version because upstream consistently breaks ABI
+# even in point releases. Node.js upstream has now removed the ability to build
+# against a shared system version entirely.
+# See https://github.com/nodejs/node/commit/d726a177ed59c37cf5306983ed00ecd858cfbbef
+Provides: bundled(%{?scl_prefix}v8) = %{v8_version}
+
+# Node.js and http-parser share an upstream. The http-parser upstream does not
+# do releases often and is almost always far behind the bundled version
+Provides: bundled(%{?scl_prefix}http-parser) = %{http_parser_version}
+Provides: bundled(%{?scl_prefix}llhttp) = %{llhttp_version}
+
+# We now bundle libuv in SCL too
+Provides: bundled(%{?scl_prefix}libuv) = %{libuv_version}
+
+# Node.js provides http2 support, but shared option is not yet available
+Provides: bundled(%{?scl_prefix}nghttp2) = %{nghttp2_version}
+
+# Bundle zlib on RHEL7, as the system version is too old
+Provides: bundled(%{?scl_prefix}zlib) = %{zlib_version}
+
+# Make sure we keep NPM up to date when we update Node.js
+Requires: %{?scl_prefix}npm = %{npm_version}-%{npm_release}%{?dist}
+
+%description
+Node.js is a platform built on Chrome's JavaScript runtime
+for easily building fast, scalable network applications.
+Node.js uses an event-driven, non-blocking I/O model that
+makes it lightweight and efficient, perfect for data-intensive
+real-time applications that run across distributed devices.
+
+
+%package devel
+Summary: JavaScript runtime - development headers
+Group: Development/Languages
+Requires: %{?scl_prefix}%{pkg_name}%{?_isa} = %{nodejs_version}-%{nodejs_release}%{?dist}
+Requires: openssl-devel%{?_isa}
+Requires: zlib-devel%{?_isa}
+Requires: %{?scl_prefix}runtime
+
+%if ! 0%{?bootstrap}
+Requires: %{?scl_prefix}http-parser-devel%{?_isa}
+%endif
+
+
+%description devel
+Development headers for the Node.js JavaScript runtime.
+
+
+%package -n %{?scl_prefix}npm
+Summary: Node.js Package Manager
+Version: %{npm_version}
+Release: %{npm_release}%{?dist}
+
+# We used to ship npm separately, but it is so tightly integrated with Node.js
+# (and expected to be present on all Node.js systems) that we ship it bundled
+# now.
+Provides: %{?scl_prefix}npm = %{npm_version}
+Requires: %{?scl_prefix}nodejs = %{nodejs_version}-%{nodejs_release}%{?dist}
+
+
+%description -n %{?scl_prefix}npm
+npm is a package manager for node.js. You can use it to install and publish
+your node programs. It manages dependencies and does other cool stuff.
+
+
+%package docs
+Summary: Node.js API documentation
+Group: Documentation
+BuildArch: noarch
+
+%description docs
+The API documentation for the Node.js JavaScript runtime.
+
+
+%prep
+%autosetup -p1 -n node-v%{nodejs_version}
+# fix file permissions on source and header files
+find deps/ -name '*.c' -o -name '*.h' -exec chmod 0644 '{}' +
+
+
+%build
+
+%{?scl:scl enable %{scl} devtoolset-7 - << \EOF}
+
+# _pkgdocdir does not support subpackage with different version
+%{?rhel7:%global _pkgdocdir %{_docdir}/%{name}-%{nodejs_version}}
+
+set -ex
+# build with debugging symbols and add defines from libuv (#892601)
+# Node's v8 breaks with GCC 6 because of incorrect usage of methods on
+# NULL objects. We need to pass -fno-delete-null-pointer-checks
+export CFLAGS='%{optflags} -g \
+               -D_LARGEFILE_SOURCE \
+               -D_FILE_OFFSET_BITS=64 \
+               -DOPENSSL_NO_OCB \
+               -DOPENSSL_NO_SCRYPT \
+               -DZLIB_CONST \
+               -fno-delete-null-pointer-checks'
+export CXXFLAGS='%{optflags} -g \
+                 -D_LARGEFILE_SOURCE \
+                 -D_FILE_OFFSET_BITS=64 \
+                 -DOPENSSL_NO_OCB \
+                 -DOPENSSL_NO_SCRYPT \
+                 -DZLIB_CONST \
+                 -fno-delete-null-pointer-checks'
+
+# Explicit new lines in C(XX)FLAGS can break naive build scripts
+export CFLAGS="$(echo ${CFLAGS} | tr '\n\\' '  ')"
+export CXXFLAGS="$(echo ${CXXFLAGS} | tr '\n\\' '  ')"
+
+%if ! 0%{?bootstrap}
+./configure --prefix=%{_prefix} \
+           %{?!el7:--shared-zlib} \
+           --shared-http-parser \
+           --with-dtrace \
+           --with-intl=small-icu \
+           --debug-nghttp2 \
+           --shared-openssl \
+           --openssl-use-def-ca-store
+%else
+./configure --prefix=%{_prefix} \
+           %{?!el7:--shared-zlib} \
+           --with-dtrace \
+           --with-intl=small-icu \
+           --debug-nghttp2 \
+           --shared-openssl \
+           --openssl-use-def-ca-store
+%endif
+
+make BUILDTYPE=Release %{?_smp_mflags}
+%if 0%{?with_debug} == 1
+make BUILDTYPE=Debug %{?_smp_mflags}
+%endif
+
+%{?scl:EOF}
+
+
+%install
+./tools/install.py install %{buildroot} %{_prefix}
+
+# Set the binary permissions properly
+chmod 0755 %{buildroot}/%{_bindir}/node
+#chrpath --delete %{buildroot}%{_bindir}/node
+
+%if 0%{?with_debug} == 1
+# Install the debug binary and set its permissions
+install -Dpm0755 out/Debug/node %{buildroot}/%{_bindir}/node_g
+%endif
+
+# own the sitelib directory
+mkdir -p %{buildroot}%{_prefix}/lib/node_modules
+
+#install documentation
+mkdir -p %{buildroot}%{_pkgdocdir}/html
+cp -pr doc/* %{buildroot}%{_pkgdocdir}/html
+rm -f %{buildroot}%{_pkgdocdir}/html/nodejs.1
+
+#node-gyp needs common.gypi too
+mkdir -p %{buildroot}%{_datadir}/node
+cp -p common.gypi %{buildroot}%{_datadir}/node
+
+# install NPM docs to mandir
+mkdir -p %{buildroot}%{_mandir} \
+         %{buildroot}%{_pkgdocdir}/npm
+
+cp -pr deps/npm/man/* %{buildroot}%{_mandir}/
+rm -rf %{buildroot}%{_prefix}/lib/node_modules/npm/man
+ln -sf %{_mandir}  %{buildroot}%{_prefix}/lib/node_modules/npm/man
+
+# Install Markdown and HTML documentation to %{_pkgdocdir}
+cp -pr deps/npm/html deps/npm/doc %{buildroot}%{_pkgdocdir}/npm/
+rm -rf %{buildroot}%{_prefix}/lib/node_modules/npm/html \
+       %{buildroot}%{_prefix}/lib/node_modules/npm/doc
+
+
+ln -sf %{_pkgdocdir} %{buildroot}%{_prefix}/lib/node_modules/npm/html
+ln -sf %{_pkgdocdir}/npm/html %{buildroot}%{_prefix}/lib/node_modules/npm/doc
+
+# Install the GDB init tool into the documentation directory
+mv %{buildroot}/%{_datadir}/doc/node/gdbinit %{buildroot}/%{_pkgdocdir}/gdbinit
+
+# Node tries to install some python files into a documentation directory
+# (and not the proper one). Remove them for now until we figure out what to
+# do with them.
+rm -f %{buildroot}/%{_defaultdocdir}/node/lldb_commands.py \
+      %{buildroot}/%{_defaultdocdir}/node/lldbinit
+
+# Since the old version of NPM was unbundled, there are a lot of symlinks in
+# it's node_modules directory. We need to keep these as symlinks to ensure we
+# can backtrack on this if we decide to.
+
+# Rename the npm node_modules directory to node_modules.bundled
+mv %{buildroot}/%{_prefix}/lib/node_modules/npm/node_modules \
+   %{buildroot}/%{_prefix}/lib/node_modules/npm/node_modules.bundled
+
+# Recreate all the symlinks
+mkdir -p %{buildroot}/%{_prefix}/lib/node_modules/npm/node_modules
+FILES=%{buildroot}/%{_prefix}/lib/node_modules/npm/node_modules.bundled/*
+for f in $FILES
+do
+  module=`basename $f`
+  ln -s ../node_modules.bundled/$module %{buildroot}%{_prefix}/lib/node_modules/npm/node_modules/$module
+done
+
+# install NPM docs to mandir
+mkdir -p %{buildroot}%{_mandir} \
+         %{buildroot}%{_pkgdocdir}/npm
+
+cp -pr deps/npm/man/* %{buildroot}%{_mandir}/
+rm -rf %{buildroot}%{_prefix}/lib/node_modules/npm/man
+ln -sf %{_mandir}  %{buildroot}%{_prefix}/lib/node_modules/npm/man
+
+# Install Markdown and HTML documentation to %{_pkgdocdir}
+cp -pr deps/npm/html deps/npm/doc %{buildroot}%{_pkgdocdir}/npm/
+rm -rf %{buildroot}%{_prefix}/lib/node_modules/npm/html \
+       %{buildroot}%{_prefix}/lib/node_modules/npm/doc
+
+ln -sf %{_pkgdocdir} %{buildroot}%{_prefix}/lib/node_modules/npm/html
+ln -sf %{_pkgdocdir}/npm/html %{buildroot}%{_prefix}/lib/node_modules/npm/doc
+
+
+# Some NPM bundled deps are executable but should not be. This causes
+# unnecessary automatic dependencies to be added. Make them not executable.
+# Skip the npm bin directory or the npm binary will not work.
+#find %{buildroot}%{_prefix}/lib/node_modules/npm \
+#    -not -path "%{buildroot}%{_prefix}/lib/node_modules/npm/bin/*" \
+#    -executable -type f \
+#    -exec chmod -x {} \;
+
+# The above command is a little overzealous. Add a few permissions back.
+#chmod 0755 %{buildroot}%{_prefix}/lib/node_modules/npm/node_modules/npm-lifecycle/node-gyp-bin/node-gyp
+#chmod 0755 %{buildroot}%{_prefix}/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js
+
+
+#%check
+%{?scl:scl enable %{scl} devtoolset-7 - << \EOF}
+set -ex
+# Fail the build if the versions don't match
+#%{buildroot}/%{_bindir}/node -e "require('assert').equal(process.versions.node, '%{nodejs_version}')"
+#%{buildroot}/%{_bindir}/node -e "require('assert').equal(process.versions.v8, '%{v8_version}')"
+#%{buildroot}/%{_bindir}/node -e "require('assert').equal(process.versions.ares.replace(/-DEV$/, ''), '%{c_ares_version}')"
+#%{buildroot}/%{_bindir}/node -e "require('assert').equal(process.versions.http_parser, '%{http_parser_version}')"
+
+# Ensure we have punycode and that the version matches
+#%{buildroot}/%{_bindir}/node -e "require(\"assert\").equal(require(\"punycode\").version, '%{punycode_version}')"
+
+# Ensure we have npm and that the version matches
+#NODE_PATH=%{buildroot}%{_prefix}/lib/node_modules %{buildroot}/%{_bindir}/node -e "require(\"assert\").equal(require(\"npm\").version, '%{npm_version}')"
+
+# Only run suites that we are expected to pass
+RUN_SUITES=(
+    abort
+    async-hooks
+    cctest
+    es-module
+    parallel
+    sequential
+)
+%ifarch ppc64le aarch64
+python2 tools/test.py "${RUN_SUITES[@]}" || :
+%else
+python2 tools/test.py "${RUN_SUITES[@]}" || :
+%endif
+
+%{?scl:EOF}
+
+%files
+%{_bindir}/node
+%{_mandir}/man1/node.*
+%dir %{_pkgdocdir}
+%dir %{_prefix}/lib/node_modules
+%dir %{_datadir}/node
+%dir %{_datadir}/systemtap
+%dir %{_datadir}/systemtap/tapset
+%{_datadir}/systemtap/tapset/node.stp
+
+%dir %{_prefix}/lib/dtrace
+%{_prefix}/lib/dtrace/node.d
+
+#%{_rpmconfigdir}/fileattrs/nodejs_native.attr
+#%{_rpmconfigdir}/nodejs_native.req
+%license LICENSE
+%doc AUTHORS CHANGELOG.md COLLABORATOR_GUIDE.md GOVERNANCE.md README.md
+
+%files devel
+%if 0%{?with_debug} == 1
+%{_bindir}/node_g
+%endif
+%{_includedir}/node
+%{_datadir}/node/common.gypi
+%{_pkgdocdir}/gdbinit
+
+%files -n %{?scl_prefix}npm
+%{_bindir}/npm
+%{_bindir}/npx
+%{_prefix}/lib/node_modules/npm
+%ghost %{_sysconfdir}/npmrc
+%ghost %{_sysconfdir}/npmignore
+%doc %{_mandir}/man*/npm*
+%doc %{_mandir}/man*/npx*
+%doc %{_mandir}/man5/package.json.5*
+%doc %{_mandir}/man5/package-lock.json.5*
+%doc %{_mandir}/man7/removing-npm.7*
+%doc %{_mandir}/man7/semver.7*
+
+
+%files docs
+%dir %{_pkgdocdir}
+%{_pkgdocdir}/html
+%{_pkgdocdir}/npm
+%{_pkgdocdir}/npm/html
+%{_pkgdocdir}/npm/doc
+
+
+%changelog
+* Thu Nov 14 2019 Jan Staněk <jstanek@redhat.com> - 12.10.0-4
+- Patch more OpenSSL features
+- Adjust test suite to (mostly) pass without patched OpenSSL features
+
+* Thu Oct 10 2019 Jan Staněk <jstanek@redhat.com> - 12.10.0-3
+- Revert statx utilization in libuv to workaround s390x container issue
+- Resolves: rhbz#1760184
+
+* Sat Oct 05 2019 Zuzana Svetlikova <zsvetlik@redhat.com> - 12.10.0-2
+- Add some missing flags, merge patches into one
+
+* Sat Oct 05 2019 Honza Horak <hhorak@redhat.com> - 12.10.0-1.1
+- Rebase to 12.10.0 and apply patches for openssl compatibility
+  (patches prepared by Zuzana and Jan)
+
+* Tue Aug 13 2019 Zuzana Svetlikova <zsvetlik@redhat.com> - 12.8.0-1
+- Resolves: RHBZ#1717846
+- update to v12.x
+- build without crypto for now
+
+* Thu Apr 04 2019 Jan Staněk <jstanek@redhat.com> - 10.10.0-3
+- Rebuild with bundled zlib
+- Resolves: rhbz#1677710
+
+* Wed Oct 31 2018 Zuzana Svetlikova <zsvetlik@redhat.com> - 10.10.0-2
+- Resolves: RHBZ#1584252
+- comment out native.req file to prevent conflict with other Node.js
+- installations (rhbz#1637922)
+
+* Fri Sep 14 2018 Zuzana Svetlikova <zsvetlik@redhat.com> - 10.10.0-1
+- rebase to v10.10.0
+- update patches for openssl
+- TODO: remove useless comments, fix failing tests, update bundled provides
+
+* Thu Jul 19 2018 Zuzana Svetlikova <zsvetlik@redhat.com> - 10.1.0-1
+- Initial v10 packaging
+- patch crypto/openssl 1.1.0 -> 1.0.2
+- remove scl prefixes from bundled dependencies
+- TODO: update patches and dependencies
+
+* Tue Feb 06 2018 Zuzana Svetlikova <zsvtelik@redhat.com> - 8.9.4-2
+- Resolves: RHBZ#1513560 #1542079
+- fix outdated minizlib dependency in npm node_modules tree
+- https://github.com/nodejs/node/pull/16509
+
+* Mon Jan 15 2018 Zuzana Svetlikova <zsvetlik@redhat.com> - 8.9.4-1
+- Resolves: RHBZ#1513560
+- rebase to LTS
+
+* Wed Sep 27 2017 Zuzana Svetlikova <zsvetlik@redhat.com> - 8.6.0-1
+- Resolves: RHBZ#1490389
+- Update, v8.5.0 contains a CVE
+
+* Thu Sep 21 2017 Zuzana Svetlikova <zsvetlik@redhat.com> - 8.5.0-1
+- Resolves: RHBZ#1490389
+- Update to latest version, bundle nghttp2
+
+* Thu Aug 10 2017 Zuzana Svetlikova <zsvetlik@redhat.com> - 8.3.0-2
+- Handle failing test in better manner
+- run more tests
+
+* Thu Aug 10 2017 Zuzana Svetlikova <zsvetlik@redhat.com> - 8.3.0-1
+- Update to 8.3.0
+- update V8 to 6.0
+- update libuv to 1.13.1
+- add bundled provides for npm modules
+- enable aarch64 builds
+
+* Mon Jul 24 2017 Zuzana Svetlikova <zsvetlik@redhat.com> - 8.2.1-1
+- Update to 8.2.1
+- update npm to 5.3.0, add npx command
+
+* Wed Jul 12 2017 Zuzana Svetlikova <zsvetlik@redhat.com> - 8.1.4-1
+- Security update (https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/)
+- Fixes RHBZ#1463132 and RHBZ#1469706
+
+* Wed Jun 28 2017 Joe Orton <jorton@redhat.com> - 8.1.2-7
+- disable debug build on aarch64
+
+* Wed Jun 28 2017 Zuzana Svetlikova <zsvetlik@redhat.com> - 8.1.2-6
+- Build aarm64 without icu
+- switch to dts 7
+
+* Tue Jun 27 2017 Zuzana Svetlikova <zsvetlik@redhat.com> - 8.1.2-5
+- Switch to DTS
+
+* Tue Jun 27 2017 Zuzana Svetlikova <zsvetlik@redhat.com> - 8.1.2-4
+- Add %%BuildArch
+
+* Sat Jun 24 2017 Zuzana Svetlikova <zsvetlik@redhat.com> - 8.1.2-3
+- Patch CVE-2017-1000381
+
+* Fri Jun 23 2017 Zuzana Svetlikova <zsvetlik@redhat.com> - 8.1.2-2
+- some clean up after fedora
+
+* Mon Jun 19 2017 Zuzana Svetlikova <zsvetlik@redhat.com> - 8.1.2-1
+- Initial v8.x build, npm@5.0.3
+- remove merged certs patch
+- build with updated system openssl
+- use fedora-style packaging, bundle npm and dependencies
+- bootstrap is modularity conditional to bundle http-parser
+- missing from base-runtime/shared-userspace
+- RHSCL 3.0 should be built for more arches
+
+* Wed Jan 11 2017 Zuzana Svetlikova <zsvetlik@redhat.com> - 6.9.1-2
+- Rebuild from zvetlik/rh-nodejs6
+- newer releases have problems with debug
+- add procps-ng for tests
+- remove unused patches
+
+* Thu Nov 03 2016 Zuzana Svetlikova <zsvetlik@redhat.com> - 6.9.1-1
+- Update to 6.9.1
+
+* Wed Oct 19 2016 Zuzana Svetlikova <zsvetlik@redhat.com> - 6.9.0-1
+- update to v6.9.0 LTS
+
+* Tue Oct 04 2016 Zuzana Svetlikova <zsvetlik@redhat.com> - 6.7.0-5
+- Disable failing crypto tests
+
+* Tue Oct 04 2016 Zuzana Svetlikova <zsvetlik@redhat.com> - 6.7.0-4
+- Require openssl
+
+* Tue Oct 04 2016 Zuzana Svetlikova <zsvetlik@redhat.com> - 6.7.0-2
+- Build with shared openssl with EPEL7 patch
+
+* Mon Oct 03 2016 Zuzana Svetlikova <zsvetlik@redhat.com> - 6.7.0-1
+- Update to 6.7.0
+
+* Wed Aug 31 2016 Zuzana Svetlikova <zsvetlik@redhat.com> - 6.5.0-1
+- Update to 6.5.0, meanwhile built with bundled openssl
+- update system-certs patch
+
+* Wed Apr 06 2016 Tomas Hrcka <thrcka@redhat.com> - 4.4.2-1
+- Rebase to latest upstream LTS release 4.4.2
+- https://nodejs.org/en/blog/release/v4.4.1/
+
+* Tue Apr 05 2016 Tomas Hrcka <thrcka@redhat.com> - 4.4.1-2
+- Rebase to latest upstream LTS release 4.4.1
+- https://nodejs.org/en/blog/release/v4.4.1/
+
+* Thu Mar 17 2016 Tomas Hrcka <thrcka@redhat.com> - 4.4.0-1
+- Rebase to latest upstream LTS release 4.4.0
+
+* Tue Mar 01 2016 Tomas Hrcka <thrcka@redhat.com> - 4.3.0-5
+- New upstream release 4.3.0
+- https://nodejs.org/en/blog/release/v4.3.0/
+- Build with bundled openssl, this will be reverted ASAP
+- Unbundled http-parser
+
+* Thu Jul 16 2015 Tomas Hrcka <thrcka@redhat.com> - 0.10.40-1
+- Rebase to latest upstream release
+
+* Wed Jul 01 2015 Tomas Hrcka <thrcka@redhat.com> - 0.10.39-1
+- Rebase to latest upstream release
+
+* Wed Mar 25 2015 Tomas Hrcka <thrcka@redhat.com> - 0.10.35-4
+- Enable tests during build time
+
+* Tue Mar 17 2015 Tomas Hrcka <thrcka@redhat.com> - 0.10.35-2
+- Reflect dependency on specific ABI changes in v8
+- RHBZ#1197110
+
+* Wed Jan 07 2015 Tomas Hrcka <thrcka@redhat.com> - 0.10.35-1
+- New upstream release 0.10.35
+
+* Sun Feb 02 2014 Tomas Hrcka <thrcka@redhat.com> - 0.10.25-1
+- New upstream release 0.10.25
+
+* Tue Jan 14 2014 Tomas Hrcka <thrcka@redhat.com> - 0.10.24-1
+- new upstream release 0.10.24
+
+* Tue Nov 26 2013 Tomas Hrcka <thrcka@redhat.com> - 0.10.21-3
+- rebuilt with v8314 collection
+
+* Tue Nov 12 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.22-1
+- new upstream release 0.10.22
+  http://blog.nodejs.org/2013/11/12/node-v0-10-22-stable/
+
+* Mon Oct 21 2013 Tomas Hrcka <thrcka@redhat.com> - 0.10.21-2
+- Build with system wide c-ares
+
+* Fri Oct 18 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.21-1
+- new upstream release 0.10.21
+  http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/
+- resolves an undisclosed security vulnerability in the http module
+
+* Tue Oct 01 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.20-1
+- new upstream release 0.10.20
+  http://blog.nodejs.org/2013/09/30/node-v0-10-20-stable/
+
+* Wed Sep 25 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.19-1
+- new upstream release 0.10.19
+  http://blog.nodejs.org/2013/09/24/node-v0-10-19-stable/
+
+* Fri Sep 06 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.18-1
+- new upstream release 0.10.18
+  http://blog.nodejs.org/2013/09/04/node-v0-10-18-stable/
+
+* Tue Aug 27 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.17-1
+- new upstream release 0.10.17
+  http://blog.nodejs.org/2013/08/21/node-v0-10-17-stable/
+
+* Sat Aug 17 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.16-1
+- new upstream release 0.10.16
+  http://blog.nodejs.org/2013/08/16/node-v0-10-16-stable/
+- add v8-devel to -devel Requires
+- restrict -devel Requires to the same architecture
+
+* Wed Aug 14 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.14-3
+- fix typo in _isa macro in v8 Requires
+
+* Wed Aug 07 2013 Tomas Hrcka <thrcka@redhat.com> - 0.10.5-6
+ - Remove badly licensed fonts in script instead of patch
+
+* Thu Jul 25 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.14-1
+- new upstream release 0.10.14
+  http://blog.nodejs.org/2013/07/25/node-v0-10-14-stable/
+
+* Wed Jul 10 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.13-1
+- new upstream release 0.10.13
+  http://blog.nodejs.org/2013/07/09/node-v0-10-13-stable/
+- remove RPM macros, etc. now that they've migrated to nodejs-packaging
+
+* Wed Jun 19 2013 Tomas Hrcka <thrcka@redhat.com> - 0.10.5-5
+ - added patch to remove badly licensed web fonts
+
+* Wed Jun 19 2013 Tomas Hrcka <thrcka@redhat.com> - 0.10.5-5
+ - added patch to remove badly licensed web fonts
+
+* Wed Jun 19 2013 Tomas Hrcka <thrcka@redhat.com> - 0.10.5-4
+  - strip openssl from the tarball it contains prohibited code (RHBZ#967736)
+  - patch makefile so it do not use bundled deps
+  - new stripped tarball
+
+* Wed Jun 19 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.12-1
+- new upstream release 0.10.12
+  http://blog.nodejs.org/2013/06/18/node-v0-10-12-stable/
+- split off a -packaging subpackage with RPM macros, etc.
+- build -docs as noarch
+- copy mutiple version logic from nodejs-packaging SRPM for now
+
+* Fri May 31 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.9-1
+- new upstream release 0.10.9
+  http://blog.nodejs.org/2013/05/30/node-v0-10-9-stable/
+
+* Wed May 29 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.8-1
+- new upstream release 0.10.8
+  http://blog.nodejs.org/2013/05/24/node-v0-10-8-stable/
+
+* Wed May 29 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.7-1
+- new upstream release 0.10.7
+  http://blog.nodejs.org/2013/05/17/node-v0-10-7-stable/
+- strip openssl from the tarball; it contains prohibited code (RHBZ#967736)
+- patch Makefile so we can just remove all bundled deps completely
+
+* Wed May 15 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.6-1
+- new upstream release 0.10.6
+  http://blog.nodejs.org/2013/05/14/node-v0-10-6-stable/
+
+* Tue May 14 2013 Tomas Hrcka <thrcka@redhat.com> - 0.10.5-3.1
+ - updated to latest upstream stable release
+
+* Mon May 06 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.5-3
+- nodejs-fixdep: work properly when a package has no dependencies
+
+* Mon Apr 29 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.5-2
+- nodejs-symlink-deps: make it work when --check is used and just
+  devDependencies exist
+
+* Wed Apr 24 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.5-1
+- new upstream release 0.10.5
+  http://blog.nodejs.org/2013/04/23/node-v0-10-5-stable/
+
+* Mon Apr 15 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.4-1
+- new upstream release 0.10.4
+  http://blog.nodejs.org/2013/04/11/node-v0-10-4-stable/
+- drop dependency generator files not supported on EL6
+- port nodejs_default_filter to EL6
+- add nodejs_find_provides_and_requires macro to invoke dependency generator
+- invoke the standard RPM provides and requires generators from the Node.js ones
+- write native module Requires from nodejs.req
+- change the c-ares-devel Requires in -devel to match the BuildRequires
+
+* Tue Apr 09 2013 Stephen Gallagher <sgallagh@redhat.com> - 0.10.3-2.1
+- Build against c-ares 1.9
+
+* Mon Apr 08 2013 Stanislav Ochotnicky <sochotnicky@redhat.com> - 0.10.3-3
+- Add support for software collections
+- Move rpm macros and tooling to separate package
+- add no-op macro to permit spec compatibility with EPEL
+
+* Thu Apr 04 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.3-2
+- nodejs-symlink-deps: symlink unconditionally in the buildroot
+
+* Wed Apr 03 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.3-1
+- new upstream release 0.10.3
+  http://blog.nodejs.org/2013/04/03/node-v0-10-3-stable/
+- nodejs-symlink-deps: only create symlink if target exists
+- nodejs-symlink-deps: symlink devDependencies when --check is used
+
+* Sun Mar 31 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.2-1
+- new upstream release 0.10.2
+  http://blog.nodejs.org/2013/03/28/node-v0-10-2-stable/
+- remove %%nodejs_arches macro since it will only be useful if it is present in
+  the redhat-rpm-config package
+- add default filtering macro to remove unwanted Provides from native modules
+- nodejs-symlink-deps now supports multiple modules in one SRPM properly
+- nodejs-symlink-deps also now supports a --check argument that works in the
+  current working directry instead of the buildroot
+
+* Fri Mar 22 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.1-1
+- new upstream release 0.10.1
+  http://blog.nodejs.org/2013/03/21/node-v0-10-1-stable/
+
+* Wed Mar 20 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.0-4
+- fix escaping in dependency generator regular expressions (RHBZ#923941)
+
+* Wed Mar 13 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.10.0-3
+- add virtual ABI provides for node and v8 so binary module's deps break when
+  binary compatibility is broken
+- automatically add matching Requires to nodejs binary modules
+- add %%nodejs_arches macro to future-proof ExcluseArch stanza in dependent
+  packages
+
+* Tue Mar 12 2013 Stephen Gallagher <sgallagh@redhat.com> - 0.10.0-2
+- Fix up documentation subpackage
+
+* Mon Mar 11 2013 Stephen Gallagher <sgallagh@redhat.com> - 0.10.0-1
+- Update to stable 0.10.0 release
+- https://raw.github.com/joyent/node/v0.10.0/ChangeLog
+
+* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.9.5-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
+
+* Tue Jan 22 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.9.5-10
+- minor bugfixes to RPM magic
+  - nodejs-symlink-deps: don't create an empty node_modules dir when a module
+    has no dependencies
+  - nodes-fixdep: support adding deps when none exist
+- Add the full set of headers usually bundled with node as deps to nodejs-devel.
+  This way `npm install` for native modules that assume the stuff bundled with
+  node exists will usually "just work".
+-move RPM magic to nodejs-devel as requested by FPC
+
+* Sat Jan 12 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.9.5-9
+- fix brown paper bag bug in requires generation script
+
+* Thu Jan 10 2013 Stephen Gallagher <sgallagh@redhat.com> - 0.9.5-8
+- Build debug binary and install it in the nodejs-devel subpackage
+
+* Thu Jan 10 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.9.5-7
+- don't use make install since it rebuilds everything
+
+* Thu Jan 10 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.9.5-6
+- add %%{?isa}, epoch to v8 deps
+
+* Wed Jan 09 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.9.5-5
+- add defines to match libuv (#892601)
+- make v8 dependency explicit (and thus more accurate)
+- add -g to $C(XX)FLAGS instead of patching configure to add it
+- don't write pointless 'npm(foo) > 0' deps
+
+* Sat Jan 05 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.9.5-4
+- install development headers
+- add nodejs_sitearch macro
+
+* Wed Jan 02 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.9.5-3
+- make nodejs-symlink-deps actually work
+
+* Tue Jan 01 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.9.5-2
+- provide nodejs-devel so modules can BuildRequire it (and be consistent
+  with other interpreted languages in the distro)
+
+* Tue Jan 01 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.9.5-1
+- new upstream release 0.9.5
+- provide nodejs-devel for the moment
+- fix minor bugs in RPM magic
+- add nodejs_fixdep macro so packagers can easily adjust dependencies in
+  package.json files
+
+* Wed Dec 26 2012 T.C. Hollingsworth <tchollingsworth@gmail.com> - 0.9.4-1
+- new upstream release 0.9.4
+- system library patches are now upstream
+- respect optflags
+- include documentation in subpackage
+- add RPM dependency generation and related magic
+- guard libuv depedency so it always gets bumped when nodejs does
+- add -devel subpackage with enough to make node-gyp happy
+
+* Thu Dec 20 2012 Stephen Gallagher <sgallagh@redhat.com> - 0.9.3-9
+- Drop requirement on openssl 1.0.1
+
+* Wed Dec 19 2012 Dan Horák <dan[at]danny.cz> - 0.9.3-8
+- set exclusive arch list to match v8
+
+* Tue Dec 18 2012 Stephen Gallagher <sgallagh@redhat.com> - 0.9.3-7
+- Add remaining changes from code review
+- Remove unnecessary BuildRequires on findutils
+- Remove %%clean section
+
+* Fri Dec 14 2012 Stephen Gallagher <sgallagh@redhat.com> - 0.9.3-6
+- Fixes from code review
+- Fix executable permissions
+- Correct the License field
+- Build debuginfo properly
+
+* Thu Dec 13 2012 Stephen Gallagher <sgallagh@redhat.com> - 0.9.3-5
+- Return back to using the standard binary name
+- Temporarily adding a conflict against the ham radio node package until they
+  complete an agreed rename of their binary.
+
+* Wed Nov 28 2012 Stephen Gallagher <sgallagh@redhat.com> - 0.9.3-4
+- Rename binary and manpage to nodejs
+
+* Mon Nov 19 2012 Stephen Gallagher <sgallagh@redhat.com> - 0.9.3-3
+- Update to latest upstream development release 0.9.3
+- Include upstreamed patches to unbundle dependent libraries
+
+* Tue Oct 23 2012 Adrian Alves <alvesadrian@fedoraproject.org>  0.8.12-1
+- Fixes and Patches suggested by Matthias Runge
+
+* Mon Apr 09 2012 Adrian Alves <alvesadrian@fedoraproject.org> 0.6.5
+- First build.