On Wed, Aug 23, 2017 at 12:02 PM Peter Robinson <pbrobinson@gmail.com> wrote:
> The problem is that CentOS 7.4 still doesn't exist yet, so if Node.js
> requires OpenSSL 1.0.2 functionality, it's still broken for CentOS users.

Yep, but then also is a bunch of other stuff due to the fact things
were bumped in RHEL, sadly without forking of each el7 dot release
there's not much can be done about that and the consensus (right or
wrong) has been to build for RHEL and when CentOS catches up they'll
be OK.

Yeah, not having forked minor releases for EPEL tends to leave stuff like this unsolvable.
You could do a whole bunch of work here to find CentOS is out before
the fix hits stable, if you've got that amount of time go for it.

That was my original plan; to just carry the bundled http-parser in epel-testing for a week or two while CentOS caught up, then switch the Bodhi update back to using the unbundled version. Unfortunately, I didn't foresee the OpenSSL issue.
> I'm trying right now to figure out if I build it for 1.0.1 functionality if
> 1.0.2 is sufficiently backwards-compatible. Because my initial glance
> suggests that it might not be and so I would have to choose between whether
> it works against 1.0.1 and breaks RHEL 7.4 users or 1.0.2 and breaks CentOS
> 7.3 users.

So, the patch for 1.0.1 support is very invasive and would be painful to make work when 1.0.2 is in the buildroot (which of course it is because Koji uses the latest RHEL repos). 

I think the only sane approach here is going to be to just drop all of the 7.3-specific stuff and just tell people that they're unfortunately out of luck on CentOS until 7.4 is out for that platform.