⚠ Project Status: Deprecated? Or Node 18 Support Coming?

[alkami-jdalrymple]

Good evening!

We're currently running into a number of issues with serverless-s3-local, and upon digging deeper, we noticed that this project is heavily reliant on a project that ceased development several years ago. Most notably, s3rver has not been actively maintained since 2020.

Three years later, with AWS removal of Node 14 fast approaching, and Node 16's demise around the corner, there's a major need for this project (and others) to update in order to support Node 18.

Presently, the most egregious is s3rver's lack of support for latest Crypto envelope routines:

error: Error listing objects in bucket "bucket-name" {"code":"ERR_OSSL_EVP_UNSUPPORTED","library":"digital envelope routines","reason":"unsupported"}
info: GET /bucket-name/?list-type=2&max-keys=1&prefix=production%2Fthemesets%2F78554577-9de6-43cd-9085-5868977156d1%2F 500 4ms -

  Error: error:0308010C:digital envelope routines::unsupported
      at Cipheriv.createCipherBase (node:internal/crypto/cipher:122:19)
      at Cipheriv.createCipherWithIV (node:internal/crypto/cipher:141:3)
      at new Cipheriv (node:internal/crypto/cipher:249:3)
      at Object.createCipheriv (node:crypto:141:10)
      at generateContinuationToken (/****/node_modules/s3rver/lib/controllers/bucket.js:20:25)
      at Object.getBucket (/****/node_modules/s3rver/lib/controllers/bucket.js:248:19)
      at async bucketExists (/****/node_modules/s3rver/lib/controllers/bucket.js:51:13)
      at async queryMethod (/****/node_modules/s3rver/lib/routes.js:36:5)
      at async responseHeaderOverride (/****/node_modules/s3rver/lib/middleware/response-header-override.js:61:9)
      at async /****/node_modules/s3rver/lib/s3rver.js:53:9
      at async logger (/****/node_modules/koa-logger/index.js:67:7)

Given the popularity of this project, and the fact that it is likely the only present solution for emulating S3 buckets locally for iterative development of S3-dependent lambda services (among other things), it would be crippling to lose offline S3 support.

Are there plans to continue to maintain this project?

[ar90n]

@alkami-jdalrymple
Thanks for the feedback about serverless-s3-local. I'm sorry for any issues it caused. I have realized there are risks with the project. I can't take on the whole s3rver project, but I'm considering creating a fork to support serverless-s3-local better.

[ar90n]

Hi @alkami-jdalrymple
I met the error you said above. And I found a workaround.
If you don’t mind, please set the following environment variable and try it again.
In my environemt, serverless-s3-local worked correctly.

export NODE_OPTIONS=--openssl-legacy-provider

[alkami-jdalrymple]

@ar90n Unfortunately, that was one of the first workarounds that we tried, and it isn't allowed for later version of Node.

We've been looking for an alternative to this, and it seems like everyone points to this project, and it doesn't look like there's any real alternative.

The biggest problem here is that it's not just Node that doesn't support these, it's the fact that modern machine have remove legacy OpenSSL ciphers in order to prevent downgrade attacks. So they don't even exist on most machines, even if --openssl-legacy-provider is still an option in Node.js. This is true for most up-to-date versions of macOS and Linux.

I'm not sure we have the capacity to take on an OSS project like that either, but I'm also not sure how viable this is without an update to s3rver 🙁

I'm surprised there hasn't been more involvement from the greater community on some of these things, but I've also noticed that a lot of other Serverless projects haven't had many updates in a while either. Maybe Serverless doesn't have the traction that it used to. 🙁

EDIT: Just found min.io, which might actually be an alternative. Basically, standing up a local container to point at and use rather than emulating it?

[ar90n]

@alkami-jdalrymple
Thanks for your comment. Using min.io may be good idea. I'll evaluate it.

[ar90n]

I started to develop v0.9.X. This version uses minio as its backend.

https://github.com/ar90n/serverless-s3-local/tree/v0.9.0

[pianomansam]

If you're going to move to minio, how will this project be any different than serverless-offline-s3 which already depends on an external s3-compatible API like minio. I recently switched several projects away from serverless-offline-s3 to serverless-s3-local because of the simpler implementation. Now it's going to switch right back?

[ar90n]

@pianomansam
Thanks for your comment and sharing good information. serverless-offline-s3 is great project. If serverless-offline-s3 meets the requirements of your project, I recommend use it.
As you said, its implementation is simple.

serverless-s3-local is designed to be used without extra configuration except for serverless.yml. This means that serverless-s3-local launch and configure minio as its backend. I'm not familiar with serverless-offline-s3. But I guess that serverless-offline-s3 is not designed to be as it. If my view is wrong, I'm so sorry.