Version 1.12.0 of libmongocrypt

ext/libmongocrypt/libmongocrypt/.evergreen/config.yml

@@ -162,8 +162,10 @@ functions:
     - command: subprocess.exec
       params:
         binary: bash
+        working_dir: "${DRIVERS_TOOLS}"
         env:
           TOPOLOGY: replica_set
+          MONGODB_VERSION: "8.0"
         args:
           - ${DRIVERS_TOOLS}/.evergreen/run-orchestration.sh
     - command: "subprocess.exec"
@@ -296,17 +298,6 @@ functions:
           ./curator version
           ./curator repo submit --config etc/repo_config.yaml --distro ${packager_distro} --edition org --version $pkg_version --arch ${packager_arch} --service https://barque.corp.mongodb.com/ --packages https://mciuploads.s3.amazonaws.com/${project}/${build_variant}/${branch_name}/${libmongocrypt_s3_suffix}/libmongocrypt-distro-packages.tar.gz
 
-  "build csharp and test":
-    - command: "shell.exec"
-      params:
-        shell: bash
-        script: |-
-          . libmongocrypt/.evergreen/init.sh
-          if test "$OS_NAME" != "windows"; then export USE_NINJA=ON; fi
-          env ${compile_env|} DEFAULT_BUILD_ONLY=true \
-            bash ./libmongocrypt/.evergreen/build_all.sh
-          env ${compile_env|} bash ./libmongocrypt/.evergreen/compile_cs.sh
-
   "build python release":
     - command: shell.exec
       params:
@@ -445,6 +436,17 @@ tasks:
         # Add detect_odr_violation=0 to ASAN_OPTIONS to ignore odr-violation in IntelDFP symbol: __dpml_bid_globals_table
         ASAN_OPTIONS="detect_leaks=1 detect_odr_violation=0"
 
+- name: build-and-test-ubsan
+  commands:
+  - func: "fetch source"
+  - func: "build and test"
+    vars:
+      compile_env: >-
+        ${compile_env|}
+        LIBMONGOCRYPT_EXTRA_CFLAGS="-fsanitize=undefined -fno-omit-frame-pointer"
+        UBSAN_OPTIONS="halt_on_error=1,print_stacktrace=1"
+
+
 - name: build-and-test-asan-mac
   commands:
   - func: "fetch source"
@@ -538,13 +540,6 @@ tasks:
   commands:
     - func: "download and merge python releases"
 
-- name: build-and-test-csharp
-  commands:
-  - func: "fetch source"
-  - func: "build csharp and test"
-    vars:
-      test_env: PROJECT_DIRECTORY=${project_directory}
-
 - name: publish-java
   depends_on:
     - variant: ubuntu2004-64
@@ -569,6 +564,7 @@ tasks:
     - variant: macos
       name: build-and-test-and-upload
   commands:
+    - func: "fetch source" # To set `tag_upload_location` expansion.
     - command: shell.exec
       params:
         script: mkdir all
@@ -1090,7 +1086,6 @@ buildvariants:
   - build-and-test-and-upload
   - build-and-test-shared-bson
   - build-and-test-asan-mac
-  # - build-and-test-csharp // temporary removed to make strong named release.
   - test-java
 - name: rhel72-zseries-test
   display_name: "RHEL 7.2 on zSeries"
@@ -1131,7 +1126,6 @@ buildvariants:
   tasks:
   - build-and-test-and-upload
   - build-and-test-shared-bson
-  # - build-and-test-csharp // temporary removed to make strong named release.
   - test-java
 - name: windows-test-python
   display_name: "Windows Python"
@@ -1272,17 +1266,10 @@ buildvariants:
 - name: rhel-62-64-bit
   display_name: "RHEL 6.2 64-bit"
   run_on: rhel62-small
-  expansions:
-    has_packages: true
-    packager_distro: rhel62
-    packager_arch: x86_64
   tasks:
   - build-and-test-and-upload
   - build-and-test-shared-bson
   - test-java
-  - name: publish-packages
-    distros:
-    - rhel70-small
 - name: rhel-70-64-bit
   display_name: "RHEL 7.0 64-bit"
   run_on: rhel70-small
@@ -1444,7 +1431,6 @@ buildvariants:
   - build-and-test-and-upload
   - build-and-test-shared-bson
   - build-and-test-asan
-  # - build-and-test-csharp // temporary removed to make strong named release.
   - test-java
   - name: publish-packages
     distros:
@@ -1486,7 +1472,6 @@ buildvariants:
   - build-and-test-and-upload
   - build-and-test-shared-bson
   - build-and-test-asan
-  # - build-and-test-csharp // temporary removed to make strong named release.
   - test-java
   - upload-java
   - publish-packages
@@ -1517,8 +1502,7 @@ buildvariants:
   - build-and-test-and-upload
   - build-and-test-shared-bson
   - build-and-test-asan
-  # see https://jira.mongodb.org/browse/MONGOCRYPT-515
-  #- build-and-test-csharp
+  - build-and-test-ubsan
   - test-java
   - upload-java
   - name: publish-packages

ext/libmongocrypt/libmongocrypt/.evergreen/debian_package_build.sh

@@ -66,7 +66,7 @@ export DEBOOTSTRAP_DIR=`pwd`/debootstrap.git
 sudo -E ./debootstrap.git/debootstrap "${_dbs_args[@]}" ./unstable-chroot/ http://cdn-aws.deb.debian.org/debian
 cp -a libmongocrypt ./unstable-chroot/tmp/
 sudo chroot ./unstable-chroot /bin/bash -c '(set -o xtrace && \
-  apt-get install -y build-essential git-buildpackage fakeroot debhelper cmake curl ca-certificates libssl-dev pkg-config libbson-dev libintelrdfpmath-dev && \
+  apt-get install -y build-essential git-buildpackage fakeroot debhelper cmake curl ca-certificates libssl-dev pkg-config libbson-dev libintelrdfpmath-dev python3-packaging && \
   chown -R root:root /tmp/libmongocrypt && \
   cd /tmp/libmongocrypt && \
   git clean -fdx && \

ext/libmongocrypt/libmongocrypt/.evergreen/prep_c_driver_source.sh

@@ -3,7 +3,7 @@
 set -euxo pipefail
 
 # Clone mongo-c-driver and check out to a tagged version.
-MONGO_C_DRIVER_VERSION=1.27.1
+MONGO_C_DRIVER_VERSION=1.28.1
 
 # Force checkout with lf endings since .sh must have lf, not crlf on Windows
 git clone https://github.com/mongodb/mongo-c-driver.git --config core.eol=lf --config core.autocrlf=false --depth=1 --branch $MONGO_C_DRIVER_VERSION

ext/libmongocrypt/libmongocrypt/CHANGELOG.md

@@ -1,4 +1,11 @@
 # ChangeLog
+## 1.12.0
+### New features
+- Add option to configure Data Encryption Key cache lifetime (`mongocrypt_setopt_key_expiration`)
+- Add opt-in retry behavior for KMS operations (`mongocrypt_setopt_retry_kms`)
+### Removed
+- libmongocrypt is no longer published in the MongoDB package repository for RHEL 6. libmongocrypt may instead be built from source on RHEL 6, but support for RHEL 6 will be dropped in a future release.
+
 ## 1.11.0
 ### New features
 - Support `range` algorithm as stable.
@@ -75,7 +82,7 @@ This release makes backwards breaking changes to Queryable Encryption (QE) behav
 - Set context error state during KMS provider validation.
 ## 1.6.1
 ## Fixed
-- Fix libbson dependency in pkg-config for PPA.
+- Fix libbson dependency in pkg-config for MongoDB repository package.
 ## 1.6.0
 ## New Features
 - Support accessToken to authenticate with Azure.

ext/libmongocrypt/libmongocrypt/CMakeLists.txt

@@ -83,8 +83,6 @@ if (ENABLE_MORE_WARNINGS_AS_ERRORS)
       )
 endif ()
 
-add_subdirectory (bindings/cs)
-
 include (GenerateExportHeader)
 
 include (CTest)
@@ -116,6 +114,7 @@ set (MONGOCRYPT_SOURCES
    src/mc-fle2-payload-uev-common.c
    src/mc-fle2-payload-uev-v2.c
    src/mc-fle2-rfds.c
+   src/mc-fle2-tag-and-encrypted-metadata-block.c
    src/mc-range-edge-generation.c
    src/mc-range-mincover.c
    src/mc-range-encoding.c
@@ -459,6 +458,7 @@ endif ()
 
 set (TEST_MONGOCRYPT_SOURCES
    test/test-gcp-auth.c
+   test/test-mc-cmp.c
    test/test-mc-efc.c
    test/test-mc-fle2-find-equality-payload-v2.c
    test/test-mc-fle2-find-range-payload-v2.c
@@ -469,6 +469,7 @@ set (TEST_MONGOCRYPT_SOURCES
    test/test-mc-fle2-payload-uev.c
    test/test-mc-fle2-payload-uev-v2.c
    test/test-mc-fle2-rfds.c
+   test/test-mc-fle2-tag-and-encrypted-metadata-block.c
    test/test-mc-range-edge-generation.c
    test/test-mc-range-mincover.c
    test/test-mc-rangeopts.c

ext/libmongocrypt/libmongocrypt/CODEOWNERS

@@ -5,6 +5,3 @@ bindings/python @mongodb/dbx-python
 
 # Java Bindings
 bindings/java @jyemin @rozza
-
-# CSharp Bindings
-bindings/cs @DmitryLukyanov

ext/libmongocrypt/libmongocrypt/README.md

@@ -112,10 +112,38 @@ See [releasing](./doc/releasing.md).
 Distribution packages (i.e., .deb/.rpm) are built and published for several Linux distributions.  The installation of these packages for supported platforms is documented here.
 
 ### Unstable Development Distribution Packages ###
-To install the latest unstable development package, change `1.11` to `development` in the package URLs listed in the subsequent instructions. For example, `https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/1.11` in the instructions would become `https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/development`. Do not use the unstable version of libmongocrypt in a production environment.
+To install the latest unstable development package, change `1.12` to `development` in the package URLs listed in the subsequent instructions. For example, `https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/1.12` in the instructions would become `https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/development`. Do not use the unstable version of libmongocrypt in a production environment.
 
 ### .deb Packages (Debian and Ubuntu) ###
 
+The repository containing the Debian and Ubuntu .deb packages can be configured automatically, using extrepo, or manually. Once the repository is configured then the packages can be installed.
+
+#### Repository configuration with extrepo ####
+
+Extrepo is available on Debian 11 and newer, as well as Ubuntu 20.04 and newer.
+
+First, install the extrepo package:
+
+```
+sudo apt install extrepo
+```
+
+If you would like to see the information about the repository, it can be viewed with the search command:
+
+```
+extrepo search libmongocrypt
+```
+
+In order to enable the repository, execute this command:
+
+```
+sudo extrepo enable libmongocrypt
+```
+
+Once the repository is configured, continue with package installation.
+
+#### Manual repository configuration ####
+
 First, import the public key used to sign the package repositories:
 
 ```
@@ -125,24 +153,21 @@ sudo sh -c 'curl -s --location https://pgp.mongodb.com/libmongocrypt.asc | gpg -
 Second, create a list entry for the repository.  For Ubuntu systems (be sure to change `<release>` to `xenial`, `bionic`, `focal`, or `jammy`, as appropriate to your system):
 
 ```
-echo "deb https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/1.11 universe" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list
+echo "deb https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/1.12 universe" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list
 ```
 
 For Debian systems (be sure to change `<release>` to `stretch`, `buster`, `bullseye`, or `bookworm` as appropriate to your system):
 
 ```
-echo "deb https://libmongocrypt.s3.amazonaws.com/apt/debian <release>/libmongocrypt/1.11 main" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list
+echo "deb https://libmongocrypt.s3.amazonaws.com/apt/debian <release>/libmongocrypt/1.12 main" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list
 ```
 
-Third, update the package cache:
+#### Package installation ####
 
-```
-sudo apt-get update
-```
-
-Finally, install the libmongocrypt packages:
+Finally, update the package cache and install the libmongocrypt packages:
 
 ```
+sudo apt-get update
 sudo apt-get install -y libmongocrypt-dev
 ```
 
@@ -156,7 +181,7 @@ Create the file `/etc/yum.repos.d/libmongocrypt.repo` with contents:
 ```
 [libmongocrypt]
 name=libmongocrypt repository
-baseurl=https://libmongocrypt.s3.amazonaws.com/yum/redhat/$releasever/libmongocrypt/1.11/x86_64
+baseurl=https://libmongocrypt.s3.amazonaws.com/yum/redhat/$releasever/libmongocrypt/1.12/x86_64
 gpgcheck=1
 enabled=1
 gpgkey=https://pgp.mongodb.com/libmongocrypt.asc
@@ -175,7 +200,7 @@ Create the file `/etc/yum.repos.d/libmongocrypt.repo` with contents:
 ```
 [libmongocrypt]
 name=libmongocrypt repository
-baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2023/libmongocrypt/1.11/x86_64
+baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2023/libmongocrypt/1.12/x86_64
 gpgcheck=1
 enabled=1
 gpgkey=https://pgp.mongodb.com/libmongocrypt.asc
@@ -194,7 +219,7 @@ Create the file `/etc/yum.repos.d/libmongocrypt.repo` with contents:
 ```
 [libmongocrypt]
 name=libmongocrypt repository
-baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2/libmongocrypt/1.11/x86_64
+baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2/libmongocrypt/1.12/x86_64
 gpgcheck=1
 enabled=1
 gpgkey=https://pgp.mongodb.com/libmongocrypt.asc
@@ -213,7 +238,7 @@ Create the file `/etc/yum.repos.d/libmongocrypt.repo` with contents:
 ```
 [libmongocrypt]
 name=libmongocrypt repository
-baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2013.03/libmongocrypt/1.11/x86_64
+baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2013.03/libmongocrypt/1.12/x86_64
 gpgcheck=1
 enabled=1
 gpgkey=https://pgp.mongodb.com/libmongocrypt.asc
@@ -236,7 +261,7 @@ sudo rpm --import https://pgp.mongodb.com/libmongocrypt.asc
 Second, add the repository (be sure to change `<release>` to `12` or `15`, as appropriate to your system):
 
 ```
-sudo zypper addrepo --gpgcheck "https://libmongocrypt.s3.amazonaws.com/zypper/suse/<release>/libmongocrypt/1.11/x86_64" libmongocrypt
+sudo zypper addrepo --gpgcheck "https://libmongocrypt.s3.amazonaws.com/zypper/suse/<release>/libmongocrypt/1.12/x86_64" libmongocrypt
 ```
 
 Finally, install the libmongocrypt packages: