Merge remote-tracking branch 'origin/main' into beta-releases

Author: github-actions[bot]

.evergreen/buildvariants-and-tasks.in.yml

@@ -32,31 +32,31 @@ const PACKAGE_BUILD_VARIANTS = [
     // # when compiling/re-building addons. This ensures compatibility with other
     // # debian platforms that have glibc 2.27 or newer.
     run_on: 'ubuntu1804-large',
-    silk_asset_group: 'compass-ubuntu',
+    target_platform: 'ubuntu',
   },
   {
     name: 'package-windows',
     display_name: 'Package Windows',
     run_on: 'windows-vsCurrent-large',
-    silk_asset_group: 'compass-windows',
+    target_platform: 'windows',
   },
   {
     name: 'package-rhel',
     display_name: 'Package RHEL',
     run_on: 'rhel80-large',
-    silk_asset_group: 'compass-rhel',
+    target_platform: 'rhel',
   },
   {
     name: 'package-macos-x64',
     display_name: 'Package MacOS Intel',
     run_on: 'macos-14',
-    silk_asset_group: 'compass-macos',
+    target_platform: 'macos',
   },
   {
     name: 'package-macos-arm',
     display_name: 'Package MacOS Arm64',
     run_on: 'macos-14-arm64',
-    silk_asset_group: 'compass-macos-arm',
+    target_platform: 'macos-arm',
   }
 ];
 

.evergreen/buildvariants-and-tasks.yml

@@ -33,7 +33,7 @@ buildvariants:
         run_on: macos-14-arm64-gui
   - name: package-ubuntu
     expansions:
-      silk_asset_group: compass-ubuntu
+      target_platform: ubuntu
     display_name: Package Ubuntu
     run_on: ubuntu1804-large
     tasks:
@@ -42,7 +42,7 @@ buildvariants:
       - name: package-compass-readonly
   - name: package-windows
     expansions:
-      silk_asset_group: compass-windows
+      target_platform: windows
     display_name: Package Windows
     run_on: windows-vsCurrent-large
     tasks:
@@ -51,7 +51,7 @@ buildvariants:
       - name: package-compass-readonly
   - name: package-rhel
     expansions:
-      silk_asset_group: compass-rhel
+      target_platform: rhel
     display_name: Package RHEL
     run_on: rhel80-large
     tasks:
@@ -60,7 +60,7 @@ buildvariants:
       - name: package-compass-readonly
   - name: package-macos-x64
     expansions:
-      silk_asset_group: compass-macos
+      target_platform: macos
     display_name: Package MacOS Intel
     run_on: macos-14
     tasks:
@@ -69,7 +69,7 @@ buildvariants:
       - name: package-compass-readonly
   - name: package-macos-arm
     expansions:
-      silk_asset_group: compass-macos-arm
+      target_platform: macos-arm
     display_name: Package MacOS Arm64
     run_on: macos-14-arm64
     tasks:

.evergreen/create-sbom.sh

@@ -7,27 +7,26 @@ CRYPT_SHARED_VERSION=$(cat packages/compass/src/deps/csfle/version)
 
 set +x
 echo "${ARTIFACTORY_PASSWORD}" > /tmp/artifactory_password
-cat << EOF > /tmp/silkbomb.env
-SILK_CLIENT_ID=${SILK_CLIENT_ID}
-SILK_CLIENT_SECRET=${SILK_CLIENT_SECRET}
-EOF
 set -x
 
 trap_handler() {
-  rm -vf /tmp/artifactory_password /tmp/silkbomb.env
+  rm -vf /tmp/artifactory_password
 }
 trap trap_handler ERR EXIT
 
-scp -v -i "$SIGNING_SERVER_PRIVATE_KEY_CYGPATH" -P "$SIGNING_SERVER_PORT" .sbom/dependencies.json /tmp/silkbomb.env /tmp/artifactory_password "$SIGNING_SERVER_USERNAME"@"$SIGNING_SERVER_HOSTNAME":/tmp/
+scp -v -i "$SIGNING_SERVER_PRIVATE_KEY_CYGPATH" -P "$SIGNING_SERVER_PORT" .sbom/dependencies.json /tmp/artifactory_password "$SIGNING_SERVER_USERNAME"@"$SIGNING_SERVER_HOSTNAME":/tmp/
 ssh -v -i "$SIGNING_SERVER_PRIVATE_KEY_CYGPATH" -p "$SIGNING_SERVER_PORT" "$SIGNING_SERVER_USERNAME"@"$SIGNING_SERVER_HOSTNAME" \
   "(cat /tmp/dependencies.json | jq -r '.[] | "'"pkg:npm/" + .name + "@" + .version'"' > /tmp/purls.txt) && \
   echo "pkg:generic/mongo_crypt_shared@${CRYPT_SHARED_VERSION}" >> /tmp/purls.txt && \
-  (cat /tmp/artifactory_password | docker login artifactory.corp.mongodb.com --username '${ARTIFACTORY_USERNAME}' --password-stdin ; rm -f /tmp/artifactor_password ) && \
-  docker pull artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:1.0 && \
-  docker run --rm -v /tmp:/tmp artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:1.0 update \
+  (cat /tmp/artifactory_password | docker login artifactory.corp.mongodb.com --username '${ARTIFACTORY_USERNAME}' --password-stdin ; rm -f /tmp/artifactory_password ) && \
+  docker pull artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0 && \
+  docker run --rm -v /tmp:/tmp artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0 update \
     --purls /tmp/purls.txt --sbom-out /tmp/sbom-lite.json && \
-  docker run --env-file /tmp/silkbomb.env --rm -v /tmp:/tmp artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:1.0 upload \
-    --silk-asset-group "${SILK_ASSET_GROUP}" --sbom-in /tmp/sbom-lite.json && \
-  docker run --env-file /tmp/silkbomb.env --rm -v /tmp:/tmp artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:1.0 download \
-    --silk-asset-group "${SILK_ASSET_GROUP}" --sbom-out /tmp/sbom.json"
-scp -v -i "$SIGNING_SERVER_PRIVATE_KEY_CYGPATH" -P "$SIGNING_SERVER_PORT" "$SIGNING_SERVER_USERNAME"@"$SIGNING_SERVER_HOSTNAME":/tmp/{sbom-lite.json,sbom.json,purls.txt} .sbom/
+  kondukto_token=\$(AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} \
+                  AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} \
+                  AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN} \
+                  aws secretsmanager get-secret-value --secret-id \"kondukto-token\" --query 'SecretString' --output text) && \
+  echo \"KONDUKTO_TOKEN=\$kondukto_token\" > /tmp/kondukto_credentials.env && \
+  docker run --env-file /tmp/kondukto_credentials.env --rm -v /tmp:/tmp artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0 augment \
+    --repo mongodb-js/compass --branch ${KONDUKTO_BRANCH} --sbom-in /tmp/sbom-lite.json --sbom-out /tmp/sbom.json"
+scp -v -i "$SIGNING_SERVER_PRIVATE_KEY_CYGPATH" -P "$SIGNING_SERVER_PORT" "$SIGNING_SERVER_USERNAME"@"$SIGNING_SERVER_HOSTNAME":/tmp/{sbom-lite.json,sbom.json,purls.txt} .sbom/

.evergreen/functions.yml

@@ -413,10 +413,15 @@ functions:
           # Load environment variables
           eval $(.evergreen/print-compass-env.sh)
           cd packages/compass && npm run prepackage-compass
+    - command: ec2.assume_role
+      display_name: Assume IAM role with permissions to pull Kondukto API token
+      params:
+        role_arn: ${kondukto_role_arn}
     - command: shell.exec
       params:
         working_dir: src
         shell: bash
+        include_expansions_in_env: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN]
         env:
           ARTIFACTORY_USERNAME: ${artifactory_username}
           ARTIFACTORY_PASSWORD: ${artifactory_password}
@@ -425,10 +430,8 @@ functions:
           SIGNING_SERVER_PRIVATE_KEY_CYGPATH: ${SIGNING_SERVER_PRIVATE_KEY_CYGPATH}
           SIGNING_SERVER_USERNAME: ${SIGNING_SERVER_USERNAME}
           SIGNING_SERVER_PORT: ${SIGNING_SERVER_PORT}
-          # for Silk SBOM integration
-          SILK_ASSET_GROUP: ${silk_asset_group}
-          SILK_CLIENT_ID: ${silk_client_id}
-          SILK_CLIENT_SECRET: ${silk_client_secret}
+          # for SilkBomb integration
+          KONDUKTO_BRANCH: ${branch_name}_${target_platform}
         script: |
           set -e
 
@@ -698,7 +701,7 @@ functions:
           fi
 
           if [[ "$IS_RHEL" == "true" ]]; then
-            npm run --unsafe-perm --workspace @mongodb-js/compass-smoke-tests start -- --package=linux_rpm --tests=time-to-first-query
+            # npm run --unsafe-perm --workspace @mongodb-js/compass-smoke-tests start -- --package=linux_rpm --tests=time-to-first-query
             npm run --unsafe-perm --workspace @mongodb-js/compass-smoke-tests start -- --package=linux_tar --tests=time-to-first-query
           fi
 

.evergreen/verify-artifacts.sh

@@ -74,18 +74,23 @@ if [ "$IS_WINDOWS" = true ]; then
   verify_using_powershell $WINDOWS_EXE_NAME
   verify_using_powershell $WINDOWS_MSI_NAME
   echo "Skipping verification for Windows artifacts using gpg: $WINDOWS_ZIP_NAME, $WINDOWS_NUPKG_NAME"
+  DEBUG=compass* npm run -w mongodb-compass verify-package-contents
+
 elif [ "$IS_UBUNTU" = true ]; then
   setup_gpg
   verify_using_gpg $LINUX_DEB_NAME
   verify_using_gpg $LINUX_TAR_NAME
+  DEBUG=compass* npm run -w mongodb-compass verify-package-contents
 elif [ "$IS_RHEL" = true ]; then
   setup_gpg
   verify_using_rpm $RHEL_RPM_NAME
   verify_using_gpg $RHEL_TAR_NAME
+  DEBUG=compass* npm run -w mongodb-compass verify-package-contents
 elif [ "$IS_OSX" = true ]; then
   setup_gpg
   verify_using_gpg $OSX_ZIP_NAME
   verify_using_codesign $OSX_DMG_NAME
+  DEBUG=compass* npm run -w mongodb-compass verify-package-contents
 else
   echo "Unknown OS, failed to verify file signing"
   exit 1

.github/ISSUE_TEMPLATE/config.yml

@@ -9,3 +9,4 @@ contact_links:
   - name: General Questions and Inquiries
     url: https://www.mongodb.com/community/forums/tags/c/data/developer-tools/49/compass
     about: Visit our forums for public community discussion and collaboration.
+

.github/workflows/test-installers.yml

@@ -39,7 +39,7 @@ jobs:
           # TODO: Re-enable (see https://github.com/mongodb-js/compass/actions/runs/13281152689/job/37079619474)
           # - linux_tar
           # TODO: Enable (needs a docker container)
-          # - linux_rpm
+          - linux_rpm
         hadron-distribution:
           - compass
           - compass-readonly
@@ -78,10 +78,21 @@ jobs:
           #   runs-on: ubuntu-latest
           #   arch: x64
           #   hadron-platform: linux
-          # - package: linux_rpm
-          #   runs-on: ubuntu-latest
-          #   arch: x64
-          #   hadron-platform: linux
+          - package: linux_rpm
+            runs-on: ubuntu-latest
+            arch: x64
+            hadron-platform: linux
+            distro-id: rhel80
+            post-checkout-command: |
+              dnf install -y gcc gcc-c++ make git nss dbus xorg-x11-server-Xvfb yum-utils
+              # Enable the devel repo to install compat-openssl11 (bringing libcrupto.so.1.1 to run mongod)
+              dnf config-manager --set-enabled devel
+              dnf update -y
+              dnf install -y compat-openssl11
+            container:
+              image: rockylinux:9
+              volumes:
+                - ${{ github.workspace }}:/compass
 
           # Install the update server for auto-update tests
           - test: auto-update-from
@@ -115,15 +126,19 @@ jobs:
             package: windows_msi
           - test: auto-update-to
             package: windows_setup
+          # Waiting for https://github.com/10gen/compass-mongodb-com/pull/122 to be released
           - test: auto-update-to
             package: linux_deb
+          - test: auto-update-to
+            package: linux_rpm
 
           # Skip time-to-first-query tests for readonly because it doesn't have editable documents
           # See https://github.com/mongodb-js/compass/actions/runs/13286945911/job/37097791601
           - hadron-distribution: compass-readonly
             test: time-to-first-query
 
     runs-on: ${{ matrix.runs-on }}
+    container: ${{ matrix.container }}
     env:
       DEBUG: compass:smoketests:*
     steps:
@@ -134,6 +149,11 @@ jobs:
         with:
           node-version: 20
           cache: "npm"
+
+      - name: Run post-checkout command
+        if: matrix.post-checkout-command
+        run: ${{ matrix.post-checkout-command }}
+
       - name: Cache downloads
         uses: actions/cache@v4
         with:
@@ -161,10 +181,10 @@ jobs:
           token: ${{ steps.app-token.outputs.token }}
           # Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
           persist-credentials: false
-          path: 'compass-mongodb-com'
+          path: compass-mongodb-com
       - name: Install Compass Update server
         if: matrix.install-update-server
-        run: npm install --no-save --workspace packages/compass-smoke-tests ${{ github.workspace }}/compass-mongodb-com
+        run: npm install --no-save --workspace packages/compass-smoke-tests ./compass-mongodb-com
 
       - name: Run tests
         env:
@@ -174,7 +194,11 @@ jobs:
           HADRON_DISTRIBUTION: ${{ matrix.hadron-distribution }}
           PLATFORM: ${{ matrix.hadron-platform }}
           ARCH: ${{ matrix.arch }}
+          # Useful to pass a "fake" DISTRO_ID environment to inform the "mongodb-download-url" package
+          # See https://github.com/mongodb-js/devtools-shared/blob/aff66db7b7fc4f8ecaec2383fd4e8c116733a7e4/packages/download-url/src/linux-distro.ts#L14
+          DISTRO_ID: ${{ matrix.distro-id }}
           # Exposing token to prevent update server from being rate limited
           GITHUB_TOKEN: ${{ github.token }}
         working-directory: packages/compass-smoke-tests
-        run: npm start -- --package ${{ matrix.package }} --tests ${{ matrix.test }}
+        # Using --skipUninstalling --skipCleanup because the runners are ephemeral
+        run: npm start -- --package ${{ matrix.package }} --tests ${{ matrix.test }} --skipUninstall --skipCleanup

AUTHORS

@@ -98,3 +98,4 @@ djechlin-mongodb <[email protected]>
 Dylan Richardson <[email protected]>
 Luke Wilson <[email protected]>
 Niva Sivakumar <[email protected]>
+Will Ratner <[email protected]>

THIRD-PARTY-NOTICES.md

@@ -1,5 +1,5 @@
 The following third-party software is used by and included in **Mongodb Compass**.
-This document was automatically generated on Sun Feb 16 2025.
+This document was automatically generated on Sun Feb 23 2025.
 
 ## List of dependencies
 
@@ -245,7 +245,7 @@ Package|Version|License
 **[ee-first](#e2746902c758ae8a6f91ffb9618cd53717f936cb33c6323e65b6b7b24f7ebefe)**|1.1.1|MIT
 **[electron-dl](#e97e034c7b93c63e7a433d75f6f1de3e0668764225ebbd61dbde8d1b55d6f3b7)**|3.5.0|MIT
 **[electron-squirrel-startup](#09fb8168e8fda2e174f8d1a1c392ffd8f762c5637c788edd00d1e2486d060349)**|1.0.1|Apache-2.0
-**[electron](#b2112dacf9fd21713f4828c72f03403f9b5039136d2aef26dbf55cbdc0ad434b)**|32.3.0|MIT
+**[electron](#214bb0bf0e0750595853808b26356f8ebe7d892e6d1e23618c3a3f71a94708d1)**|32.3.1|MIT
 **[encodeurl](#b89152db475e86531e570f87b45d8a51aa5e5d87d4cc3b960cee7b8febf1d26a)**|1.0.2|MIT
 **[encodeurl](#177948a319ae0aeebbd65742c53c62b37c75ec1d021afa5a188d10a7ceae6623)**|2.0.0|MIT
 **[end-of-stream](#fadc10994f5fa767d06fb25cfff35fb17a895daf3bc3477c782907668ed16563)**|1.4.4|MIT
@@ -450,7 +450,7 @@ Package|Version|License
 **[napi-build-utils](#26912b5ff7632f262d64273f99cd1a869376c5c378960e24501585e35b31054a)**|1.0.2|MIT
 **[negotiator](#e3856213d8f0a7d28cd4166e53ec7e2c019cb7becf4a8535097bac28d21e8579)**|0.6.3|MIT
 **[netmask](#2bd5b8ff7fab9adace6c38d3fd32e7328484939fdd07836635b0155d0afc35b2)**|2.0.2|MIT
-**[node-abi](#d828b90b26e003401ce41aa4719bb6164ab1e897f15db9728e6871146a8197da)**|3.73.0|MIT
+**[node-abi](#e0fdace18ee5ae0d28d9180ead4d34c46d38ba2185a05dd566a3f7b1a699b2f0)**|3.74.0|MIT
 **[node-addon-api](#75c2a47526765afc024a6641ec7b1b37935dc672a211ebdd9773d74bc43a95b4)**|6.1.0|MIT
 **[node-domexception](#3c25065fd2bc1b6b56856e30ac5b8f34ddae33ca87b225854f8d855b0ccabfbe)**|1.0.0|MIT
 **[node-fetch](#364527ef1b51cc6ac34872b931049c9e25b5014f9b40e3898c84e1a830e21720)**|2.6.7|MIT
@@ -18952,8 +18952,8 @@ License files:
 
 
 
-<a id="b2112dacf9fd21713f4828c72f03403f9b5039136d2aef26dbf55cbdc0ad434b"></a>
-### [electron](https://www.npmjs.com/package/electron) (version 32.3.0)
+<a id="214bb0bf0e0750595853808b26356f8ebe7d892e6d1e23618c3a3f71a94708d1"></a>
+### [electron](https://www.npmjs.com/package/electron) (version 32.3.1)
 License tags: MIT
 
 License files:
@@ -27676,8 +27676,8 @@ License files:
 License tags: MIT
 
 
-<a id="d828b90b26e003401ce41aa4719bb6164ab1e897f15db9728e6871146a8197da"></a>
-### [node-abi](https://www.npmjs.com/package/node-abi) (version 3.73.0)
+<a id="e0fdace18ee5ae0d28d9180ead4d34c46d38ba2185a05dd566a3f7b1a699b2f0"></a>
+### [node-abi](https://www.npmjs.com/package/node-abi) (version 3.74.0)
 License tags: MIT
 
 License files:

configs/eslint-config-compass/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mongodb-js/eslint-config-compass",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "description": "Shared Compass eslint configuration",
   "license": "SSPL",
   "main": "index.js",
@@ -16,7 +16,7 @@
     "@babel/core": "^7.21.4",
     "@babel/eslint-parser": "^7.14.3",
     "@mongodb-js/eslint-config-devtools": "^0.9.9",
-    "@mongodb-js/eslint-plugin-compass": "^1.2.1",
+    "@mongodb-js/eslint-plugin-compass": "^1.2.2",
     "@typescript-eslint/eslint-plugin": "^5.59.0",
     "@typescript-eslint/parser": "^5.59.0",
     "eslint-config-prettier": "^8.3.0",