libmongocrypt-helper 1.11.0.0.1001 → 1.13.2.0.1001

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/binding.py

@@ -312,6 +312,17 @@ mongocrypt_t *mongocrypt_new(void);
  */
 bool mongocrypt_setopt_log_handler(mongocrypt_t *crypt, mongocrypt_log_fn_t log_fn, void *log_ctx);
 
+/**
+ * Enable or disable KMS retry behavior.
+ *
+ * @param[in] crypt The @ref mongocrypt_t object.
+ * @param[in] enable A boolean indicating whether to retry operations.
+ * @pre @ref mongocrypt_init has not been called on @p crypt.
+ * @returns A boolean indicating success. If false, an error status is set.
+ * Retrieve it with @ref mongocrypt_ctx_status
+ */
+bool mongocrypt_setopt_retry_kms(mongocrypt_t *crypt, bool enable);
+
 /**
  * Configure an AWS KMS provider on the @ref mongocrypt_t object.
  *
@@ -665,7 +676,6 @@ bool mongocrypt_ctx_setopt_algorithm(mongocrypt_ctx_t *ctx, const char *algorith
 /// String constant for setopt_algorithm "Indexed" explicit encryption
 /// String constant for setopt_algorithm "Unindexed" explicit encryption
 // DEPRECATED: support "RangePreview" has been removed in favor of "range".
-// NOTE: "Range" is currently unstable API and subject to backwards breaking changes.
 
 /**
  * Identify the AWS KMS master key to use for creating a data key.
@@ -849,8 +859,6 @@ bool mongocrypt_ctx_explicit_encrypt_init(mongocrypt_ctx_t *ctx, mongocrypt_bina
  * Contexts created for explicit encryption will not go through mongocryptd.
  * Requires query_type to be "range".
  *
- * NOTE: "range" is currently unstable API and subject to backwards breaking changes.
- *
  * This method expects the passed-in BSON to be of the form:
  * { "v" : FLE2RangeFindDriverSpec }
  *
@@ -1045,6 +1053,8 @@ typedef struct _mongocrypt_kms_ctx_t mongocrypt_kms_ctx_t;
  * If KMS handles are being handled synchronously, the driver can reuse the same
  * TLS socket to send HTTP requests and receive responses.
  *
+ * The returned KMS handle does not outlive `ctx`.
+ *
  * @param[in] ctx A @ref mongocrypt_ctx_t.
  * @returns a new @ref mongocrypt_kms_ctx_t or NULL.
  */
@@ -1089,6 +1099,14 @@ bool mongocrypt_kms_ctx_endpoint(mongocrypt_kms_ctx_t *kms, const char **endpoin
  */
 uint32_t mongocrypt_kms_ctx_bytes_needed(mongocrypt_kms_ctx_t *kms);
 
+/**
+ * Indicates how long to sleep before sending this request.
+ *
+ * @param[in] kms The @ref mongocrypt_kms_ctx_t.
+ * @returns How long to sleep in microseconds.
+ */
+int64_t mongocrypt_kms_ctx_usleep(mongocrypt_kms_ctx_t *kms);
+
 /**
  * Feed bytes from the HTTP response.
  *
@@ -1103,6 +1121,14 @@ uint32_t mongocrypt_kms_ctx_bytes_needed(mongocrypt_kms_ctx_t *kms);
  */
 bool mongocrypt_kms_ctx_feed(mongocrypt_kms_ctx_t *kms, mongocrypt_binary_t *bytes);
 
+/**
+ * Indicate a network-level failure.
+ *
+ * @param[in] kms The @ref mongocrypt_kms_ctx_t.
+ * @return A boolean indicating whether the failed request may be retried.
+ */
+bool mongocrypt_kms_ctx_fail(mongocrypt_kms_ctx_t *kms);
+
 /**
  * Get the status associated with a @ref mongocrypt_kms_ctx_t object.
  *
@@ -1360,7 +1386,6 @@ void mongocrypt_setopt_bypass_query_analysis(mongocrypt_t *crypt);
 
 /**
  * DEPRECATED: Use of `mongocrypt_setopt_use_range_v2` is deprecated. Range V2 is always enabled.
- * NOTE: "range" is currently unstable API and subject to backwards breaking changes.
  *
  * @param[in] crypt The @ref mongocrypt_t object.
  *
@@ -1412,13 +1437,12 @@ bool mongocrypt_ctx_setopt_query_type(mongocrypt_ctx_t *ctx, const char *query_t
 
 /**
  * Set options for explicit encryption with the "range" algorithm.
- * NOTE: "range" is currently unstable API and subject to backwards breaking changes.
  *
  * @p opts is a BSON document of the form:
  * {
  *    "min": Optional<BSON value>,
  *    "max": Optional<BSON value>,
- *    "sparsity": Int64,
+ *    "sparsity": Optional<Int64>,
  *    "precision": Optional<Int32>,
  *    "trimFactor": Optional<Int32>
  * }
@@ -1431,9 +1455,17 @@ bool mongocrypt_ctx_setopt_query_type(mongocrypt_ctx_t *ctx, const char *query_t
  */
 bool mongocrypt_ctx_setopt_algorithm_range(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *opts);
 
+/**
+ * Set the expiration time for the data encryption key cache. Defaults to 60 seconds if not set.
+ *
+ * @param[in] ctx The @ref mongocrypt_ctx_t object.
+ * @param[in] cache_expiration_ms The cache expiration time in milliseconds. If zero, the cache
+ * never expires.
+ */
+bool mongocrypt_setopt_key_expiration(mongocrypt_t *crypt, uint64_t cache_expiration_ms);
+
 /// String constants for setopt_query_type
 // DEPRECATED: Support "rangePreview" has been removed in favor of "range".
-/// NOTE: "range" is currently unstable API and subject to backwards breaking changes.
 """
 )
 

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/mongocrypt.py

@@ -149,6 +149,14 @@ class MongoCrypt:
         if any([on_demand_aws, on_demand_gcp, on_demand_azure]):
             lib.mongocrypt_setopt_use_need_kms_credentials_state(self.__crypt)
 
+        # Enable KMS retry when available, libmongocrypt >= 1.12.0,
+        try:
+            if not lib.mongocrypt_setopt_retry_kms(self.__crypt, True):
+                self.__raise_from_status()
+        except AttributeError:
+            # libmongocrypt < 1.12
+            pass
+
         if not lib.mongocrypt_init(self.__crypt):
             self.__raise_from_status()
 
@@ -670,6 +678,30 @@ class MongoCryptKmsContext:
             if not lib.mongocrypt_kms_ctx_feed(self.__ctx, binary.bin):
                 self.__raise_from_status()
 
+    @property
+    def usleep(self):
+        """Indicates how long to sleep in microseconds before sending this request.
+
+        .. versionadded:: 1.12
+        """
+        try:
+            return lib.mongocrypt_kms_ctx_usleep(self.__ctx)
+        except AttributeError:
+            # libmongocrypt < 1.12
+            return 0
+
+    def fail(self):
+        """Indicate a network-level failure.
+
+        .. versionadded:: 1.12
+        """
+        try:
+            if not lib.mongocrypt_kms_ctx_fail(self.__ctx):
+                self.__raise_from_status()
+        except AttributeError:
+            # libmongocrypt < 1.12
+            pass
+
     def __raise_from_status(self):
         status = lib.mongocrypt_status_new()
         try:

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/version.py

@@ -12,6 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-__version__ = "1.11.0.dev0"
+__version__ = "1.13.0.dev0"
 
 _MIN_LIBMONGOCRYPT_VERSION = "1.8.0"

data/ext/libmongocrypt/libmongocrypt/bindings/python/pyproject.toml

@@ -36,6 +36,7 @@ classifiers = [
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
     "Topic :: Database",
 ]
 

data/ext/libmongocrypt/libmongocrypt/bindings/python/release.sh

@@ -19,7 +19,7 @@ set -o errexit  # Exit the script with error if any of the commands fail
 LIBMONGOCRYPT_VERSION=$(cat ./libmongocrypt-version.txt)
 REVISION=$(git rev-list -n 1 $LIBMONGOCRYPT_VERSION)
 # The libmongocrypt release branch.
-BRANCH="r1.10"
+BRANCH="r1.12"
 # The python executable to use.
 PYTHON=${PYTHON:-python}
 

data/ext/libmongocrypt/libmongocrypt/bindings/python/sbom.json

@@ -1,31 +1,31 @@
 {
   "components": [
     {
-      "bom-ref": "pkg:github/mongodb/libmongocrypt@1.10.1",
+      "bom-ref": "pkg:github/mongodb/libmongocrypt@1.12.0",
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://github.com/mongodb/libmongocrypt/archive/refs/tags/1.10.1.tar.gz"
+          "url": "https://github.com/mongodb/libmongocrypt/archive/refs/tags/1.12.0.tar.gz"
         },
         {
           "type": "website",
-          "url": "https://github.com/mongodb/libmongocrypt/tree/1.10.1"
+          "url": "https://github.com/mongodb/libmongocrypt/tree/1.12.0"
         }
       ],
       "group": "mongodb",
       "name": "libmongocrypt",
-      "purl": "pkg:github/mongodb/libmongocrypt@1.10.1",
+      "purl": "pkg:github/mongodb/libmongocrypt@1.12.0",
       "type": "library",
-      "version": "1.10.1"
+      "version": "1.12.0"
     }
   ],
   "dependencies": [
     {
-      "ref": "pkg:github/mongodb/libmongocrypt@1.10.1"
+      "ref": "pkg:github/mongodb/libmongocrypt@1.12.0"
     }
   ],
   "metadata": {
-    "timestamp": "2024-06-28T19:11:17.100829+00:00",
+    "timestamp": "2024-12-30T18:25:06.574241+00:00",
     "tools": [
       {
         "externalReferences": [
@@ -68,9 +68,10 @@
       }
     ]
   },
-  "serialNumber": "urn:uuid:b09e93cf-eb1b-4d38-add5-86b01139769f",
+  "serialNumber": "urn:uuid:5e81b4d2-1313-43dd-9ec0-b958d0d71bca",
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5"
+  "specVersion": "1.5",
+  "vulnerabilities": []
 }

data/ext/libmongocrypt/libmongocrypt/bindings/python/test/data/compact/success/encrypted-field-config-map.json

@@ -1,7 +1,6 @@
 {
     "db.test": {
         "escCollection": "esc",
-        "eccCollection": "ecc",
         "ecocCollection": "ecoc",
         "fields": [
             {

data/ext/libmongocrypt/libmongocrypt/bindings/python/test/data/encrypted-field-config-map.json

@@ -1,7 +1,6 @@
 {
     "test.test": {
         "escCollection": "fle2.basic.esc",
-        "eccCollection": "fle2.basic.ecc",
         "ecocCollection": "fle2.basic.ecoc",
         "fields": [
             {
@@ -24,7 +23,6 @@
     },
     "test.test2": {
         "escCollection": "fle2.basic.esc",
-        "eccCollection": "fle2.basic.ecc",
         "ecocCollection": "fle2.basic.ecoc",
         "fields": [
             {

data/ext/libmongocrypt/libmongocrypt/bindings/python/test/test_mongocrypt.py

@@ -478,7 +478,8 @@ class MockAsyncCallback(AsyncMongoCryptCallback):
         return self.mongocryptd_reply
 
     async def fetch_keys(self, filter):
-        return self.key_docs
+        for doc in self.key_docs:
+            yield doc
 
     async def insert_data_key(self, data_key):
         raise NotImplementedError
@@ -606,7 +607,7 @@ class TestMongoCryptCallback(unittest.TestCase):
         encrypter = AutoEncrypter(callback, opts)
         self.addCleanup(encrypter.close)
 
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             data = {"access_token": "foo"}
             url = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"
             router.add(
@@ -747,7 +748,7 @@ if sys.version_info >= (3, 8, 0):  # noqa: UP036
             encrypter = AsyncAutoEncrypter(callback, opts)
             self.addAsyncCleanup(encrypter.close)
 
-            with respx.mock() as router:
+            with respx.mock(using="httpx") as router:
                 data = {"access_token": "foo"}
                 url = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"
                 router.add(
@@ -1018,7 +1019,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_success(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             data = {"access_token": "foo", "expires_in": 4000}
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
@@ -1033,7 +1034,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_empty_json(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
                 respx.get(url=url).mock(return_value=httpx.Response(200, json={}))
@@ -1047,7 +1048,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_bad_json(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
                 respx.get(url=url).mock(return_value=httpx.Response(200, text="a'"))
@@ -1061,7 +1062,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_http_404(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(respx.get(url=url).mock(return_value=httpx.Response(404)))
             with self.assertRaisesRegex(
@@ -1073,7 +1074,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_http_500(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(respx.get(url=url).mock(return_value=httpx.Response(500)))
             with self.assertRaisesRegex(
@@ -1085,7 +1086,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_slow_response(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
                 respx.get(url=url).mock(side_effect=httpx._exceptions.ConnectTimeout)
@@ -1099,7 +1100,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_cache(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             data = {"access_token": "foo", "expires_in": 4000}
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
@@ -1120,7 +1121,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_cache_expires_soon(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             data = {"access_token": "foo", "expires_in": 10}
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
@@ -1136,7 +1137,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
         # Should not use the cached value.
         encrypter = self.get_encrypter(False)
         self.assertIsNotNone(pymongocrypt.synchronous.credentials._azure_creds_cache)
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
                 respx.get(url=url).mock(side_effect=httpx._exceptions.ConnectTimeout)

data/ext/libmongocrypt/libmongocrypt/cmake/FetchMongoC.cmake

@@ -1,8 +1,8 @@
 include (FetchContent)
 
 # Set the tag that we will fetch.
-# When updating the version of libbson, also update the version in etc/purls.txt
-set (MONGOC_FETCH_TAG_FOR_LIBBSON "1.27.1" CACHE STRING "The Git tag of mongo-c-driver that will be fetched to obtain libbson")
+# When updating the version of libbson, also update the version in etc/purls.txt and .evergreen/prep_c_driver_source.sh
+set (MONGOC_FETCH_TAG_FOR_LIBBSON "1.30.3" CACHE STRING "The Git tag of mongo-c-driver that will be fetched to obtain libbson")
 
 # Add an option to disable patching if a patch command is unavailable.
 option (LIBBSON_PATCH_ENABLED "Whether to apply patches to the libbson library" ON)
@@ -18,6 +18,8 @@ make_patch_command (patch_command
     DISABLED "${patch_disabled}"
     PATCHES
         ${PROJECT_SOURCE_DIR}/etc/libbson-remove-GCC-diagnostic-pragma.patch
+        # Fix old GCC error: "#pragma GCC diagnostic not allowed inside functions". Remove patch after libbson 2.0.0:
+        ${PROJECT_SOURCE_DIR}/etc/libbson-remove-GCC-diagnostic-in-functions.patch
     )
 
 # Fetch the source archive for the requested tag from GitHub

data/ext/libmongocrypt/libmongocrypt/cmake/ImportBSON.cmake

@@ -56,9 +56,9 @@ cmake_push_check_state ()
    # extra-alignment enabled. We want to match that setting as our default, for convenience
    # purposes only.
    find_path (SYSTEM_BSON_INCLUDE_DIR bson/bson.h PATH_SUFFIXES libbson-1.0)
+   set (_extra_alignment_default OFF)
    if (SYSTEM_BSON_INCLUDE_DIR AND NOT DEFINED ENABLE_EXTRA_ALIGNMENT)
       set (CMAKE_REQUIRED_INCLUDES "${SYSTEM_BSON_INCLUDE_DIR}")
-      set (_extra_alignment_default OFF)
       check_c_source_compiles ([[
          #include <bson/bson.h>
 

data/ext/libmongocrypt/libmongocrypt/doc/releasing.md

@@ -17,8 +17,6 @@ Go to [Snyk](https://app.snyk.io/) and select the `dev-prod` organization. If ac
 
 ![Reference Targets](img/reference-targets.png)
 
-Copy the organization ID from [Snyk settings](https://app.snyk.io/org/dev-prod/manage/settings).
-
 ##### Update Snyk
 
 Update the Snyk reference target tracking the to-be-released branch. For a patch release (e.g. x.y.z), check-out the `rx.y` branch and update the `rx.y` reference target. For a minor release (e.g. x.y.0), check out the `master` branch update the `master` reference target.
@@ -44,29 +42,17 @@ snyk monitor \
 --remote-repo-url=https://github.com/mongodb/libmongocrypt.git
 ```
 
-```bash
-snyk auth
-snyk monitor \
---org=$ORGANIZATION_ID \
---target-reference=<rx.y or master> \
---unmanaged \
---remote-repo-url=https://github.com/mongodb/libmongocrypt.git
-```
-
 Check the updated reference targets in Snyk for detected vulnerabilities.
 
-#### Check Silk
+#### Check the Augmented SBOM
 
-Get credentials for Silk from the `drivers/libmongocrypt` vault in [AWS Secrets Manager](https://wiki.corp.mongodb.com/display/DRIVERS/Using+AWS+Secrets+Manager+to+Store+Testing+Secrets).
+Examine the Augmented SBOM from a recent execution of the `sbom` task in an Evergreen patch or commit build.
+
+Evergreen CLI may be used to schedule only the `sbom` task:
 
-Download the Augmented SBOM using:
 ```bash
-./.evergreen/earthly.sh \
-   --secret silk_client_id=${silk_client_id} \
-   --secret silk_client_secret=${silk_client_secret} \
-   +sbom-download \
-   --out cyclonedx.augmented.sbom.json \
-   --branch <branch>
+# Ensure `-p` matches the correct Evergreen project for the current branch!
+evergreen patch -y -p libmongocrypt -t all -v sbom -f
 ```
 
 Check the contents of the "vulnerabilities" field (if present) in the Augmented SBOM.
@@ -80,7 +66,7 @@ Do the following when releasing:
 - Ensure `etc/purls.txt` is up-to-date.
 - Update `etc/third_party_vulnerabilities.md` with any updates to new or known vulnerabilities for third party dependencies that must be reported.
 - If this is a new minor release (e.g. `x.y.0`):
-   - Update the Linux distribution package installation instructions in the below sections to refer to the new version `x.y`.
+   - Update the Linux distribution package installation instructions in [README.md](../README.md) to refer to the new version `x.y`.
    - Update the [libmongocrypt-release](https://spruce.mongodb.com/project/libmongocrypt-release/settings/general) Evergreen project (requires auth) to set `Branch Name` to `rx.y`.
 - Commit the changes on the `rx.y` branch with a message like "Update CHANGELOG.md for x.y.z".
 - Tag the commit with `git tag -a <tag>`.
@@ -94,29 +80,16 @@ Do the following when releasing:
       - If the `publish-packages` tasks fail with an error like `[curator] 2024/01/02 13:56:17 [p=emergency]: problem submitting repobuilder job: 404 (Not Found)`, this suggests the published path does not yet exist. Barque (the Linux package publishing service) has protection to avoid unintentional publishes. File a DEVPROD ticket ([example](https://jira.mongodb.org/browse/DEVPROD-4053)) and assign to the team called Release Infrastructure to request the path be created. Then re-run the failing `publish-packages` task. Ask in the slack channel `#devprod-release-tools` for further help with `Barque` or `curator`.
 - Create the release from the GitHub releases page from the new tag.
    - Attach the tarball and signature file from the Files tab of the `windows-upload-release` task. [Example](https://github.com/mongodb/libmongocrypt/releases/tag/1.10.0).
-   - Attach the Augmented SBOM file. Download the Augmented SBOM using:
-     ```bash
-     ./.evergreen/earthly.sh \
-        --secret silk_client_id=${silk_client_id} \
-        --secret silk_client_secret=${silk_client_secret} \
-        +sbom-download \
-        --out cyclonedx.augmented.sbom.json \
-        --branch <branch>
-     ```
-     For a new minor release, use `master` for `--branch`. For a patch release, use the release branch (e.g. `rx.y`).
-     Secrets can be obtained from [AWS Secrets Manager](https://wiki.corp.mongodb.com/display/DRIVERS/Using+AWS+Secrets+Manager+to+Store+Testing+Secrets) under `drivers/libmongocrypt`.
+   - Attach the Augmented SBOM file to the release as `cyclonedx.augmented.sbom.json`.
+     Download the Augmented SBOM from a recent execution of the `sbom` task in an Evergreen patch or commit build.
    - Attach `etc/third_party_vulnerabilities.md` to the release.
-   - Attach `ssdlc_compliance_report.md` to the release.
+   - Attach `etc/ssdlc_compliance_report.md` to the release.
 
 - If this is a new minor release (e.g. `x.y.0`):
    - File a DOCSP ticket to update the installation instructions on [Install libmongocrypt](https://www.mongodb.com/docs/manual/core/csfle/reference/libmongocrypt/). ([Example](https://jira.mongodb.org/browse/DOCSP-36863))
-   - Create a new Silk asset group. Use the newly created release branch (e.g. `rx.y`) as the `--branch` argument:
+   - Generate a new unique SBOM serial number for the next release:
      ```bash
-     ./.evergreen/earthly.sh \
-        --secret silk_client_id=${silk_client_id} \
-        --secret silk_client_secret=${silk_client_secret} \
-        +silk-create-asset-group \
-        --branch <branch>
+     ./.evergreen/earthly.sh +sbom-generate-new-serial-number
      ```
    - Create a new Snyk reference target. The following instructions use the example branch `rx.y`:
 
@@ -141,6 +114,10 @@ Do the following when releasing:
       --remote-repo-url=https://github.com/mongodb/libmongocrypt.git
      ```
      Snyk reference targets for older release branches may be removed if no further releases are expected on the branch.
+   - Update the [Github Webhook](https://wiki.corp.mongodb.com/display/INTX/Githook) to include the new branch.
+     - Navigate to the [Webhook Settings](https://github.com/mongodb/libmongocrypt/settings/hooks).
+     - Click `Edit` on the hook for `https://githook.mongodb.com/`.
+     - Add the new release branch to the `Payload URL`. Remove unmaintained release branches.
 - Make a PR to apply the "Update CHANGELOG.md for x.y.z" commit to the `master` branch.
 - Update the release on the [Jira releases page](https://jira.mongodb.org/projects/MONGOCRYPT/versions).
 - Record the release on [C/C++ Release Info](https://docs.google.com/spreadsheets/d/1yHfGmDnbA5-Qt8FX4tKWC5xk9AhzYZx1SKF4AD36ecY/edit?usp=sharing). This is done to meet SSDLC reporting requirements.
@@ -150,4 +127,24 @@ Do the following when releasing:
 Submit a PR to update the Homebrew package https://github.com/mongodb/homebrew-brew/blob/master/Formula/libmongocrypt.rb. ([Example](https://github.com/mongodb/homebrew-brew/pull/208)). If not on macOS, request a team member to do this step.
 
 ## Debian steps ##
-Refer to the [Debian](https://github.com/mongodb/mongo-c-driver/blob/master/docs/dev/debian.rst) steps. If you are not a Debian maintainer on the team, request a team member to do this step.
+If you are not a Debian maintainer on the team, request a team member to do the steps in this section.
+
+Refer to the [Debian](https://github.com/mongodb/mongo-c-driver/blob/master/docs/dev/debian.rst) steps.
+
+For a minor release (e.g. x.y.0), submit a merge request to the [extrepo-data](https://salsa.debian.org/extrepo-team/extrepo-data) project in Debian to update the PPA. The change would look something like this:
+
+```
+diff --git a/repos/debian/libmongocrypt.yaml b/repos/debian/libmongocrypt.yaml
+index 609dc0b..f7530a9 100644
+--- a/repos/debian/libmongocrypt.yaml
++++ b/repos/debian/libmongocrypt.yaml
+@@ -4,7 +4,7 @@ libmongocrypt:
+   source:
+     Types: deb
+     URIs: https://libmongocrypt.s3.amazonaws.com/apt/debian
+-    Suites: <SUITE>/libmongocrypt/1.11
++    Suites: <SUITE>/libmongocrypt/1.12
+     Components: main
+     Architectures: amd64 arm64
+   suites:
+```

data/ext/libmongocrypt/libmongocrypt/etc/cyclonedx.sbom.json

@@ -1,16 +1,16 @@
 {
   "components": [
     {
-      "bom-ref": "pkg:github/mongodb/mongo-c-driver@v1.27.1#src/libbson",
+      "bom-ref": "pkg:github/mongodb/mongo-c-driver@v1.30.3#src/libbson",
       "copyright": "Copyright 2009-present MongoDB, Inc.",
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://github.com/mongodb/mongo-c-driver/archive/refs/tags/v1.27.1.tar.gz"
+          "url": "https://github.com/mongodb/mongo-c-driver/archive/refs/tags/v1.30.3.tar.gz"
         },
         {
           "type": "website",
-          "url": "https://github.com/mongodb/mongo-c-driver/tree/v1.27.1"
+          "url": "https://github.com/mongodb/mongo-c-driver/tree/v1.30.3"
         }
       ],
       "group": "mongodb",
@@ -22,9 +22,9 @@
         }
       ],
       "name": "mongo-c-driver",
-      "purl": "pkg:github/mongodb/mongo-c-driver@v1.27.1#src/libbson",
+      "purl": "pkg:github/mongodb/mongo-c-driver@v1.30.3#src/libbson",
       "type": "library",
-      "version": "v1.27.1"
+      "version": "v1.30.3"
     },
     {
       "bom-ref": "pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz",
@@ -53,11 +53,11 @@
       "ref": "pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz"
     },
     {
-      "ref": "pkg:github/mongodb/mongo-c-driver@v1.27.1#src/libbson"
+      "ref": "pkg:github/mongodb/mongo-c-driver@v1.30.3#src/libbson"
     }
   ],
   "metadata": {
-    "timestamp": "2024-05-10T12:07:55.084050+00:00",
+    "timestamp": "2025-04-08T13:06:37.750496+00:00",
     "tools": [
       {
         "externalReferences": [
@@ -100,9 +100,10 @@
       }
     ]
   },
-  "serialNumber": "urn:uuid:879e1b41-08d8-4505-8c89-2285bc3e442c",
+  "serialNumber": "urn:uuid:1eeadd7e-be33-4e55-960c-02bac1da4cf7",
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5"
+  "specVersion": "1.5",
+  "vulnerabilities": []
 }

data/ext/libmongocrypt/libmongocrypt/etc/format.sh

@@ -9,8 +9,6 @@ if ! run_python -c ''; then
   fail "No Python found?"
 fi
 
-# Check that we have a pipx of the proper version:
-run_python -c 'import pkg_resources; pkg_resources.require("pipx>=0.17.0,<2.0")'
 
 # Give default clang-format an empty string on stdin if there are no inputs files
 printf '' | run_python -m pipx run "clang-format==${CLANG_FORMAT_VERSION:?}" "$@"