libmongocrypt-helper 1.11.0.0.1001 → 1.13.2.0.1001

data/ext/libmongocrypt/libmongocrypt/etc/libbson-remove-GCC-diagnostic-in-functions.patch

@@ -0,0 +1,158 @@
+diff --git a/src/libmongoc/src/mongoc/mongoc-collection.c b/src/libmongoc/src/mongoc/mongoc-collection.c
+index d21a043788..ac0194e477 100644
+--- a/src/libmongoc/src/mongoc/mongoc-collection.c
++++ b/src/libmongoc/src/mongoc/mongoc-collection.c
+@@ -681,6 +681,7 @@ mongoc_collection_command_simple (mongoc_collection_t *collection,
+  *--------------------------------------------------------------------------
+  */
+ 
++BEGIN_IGNORE_DEPRECATIONS
+ int64_t
+ mongoc_collection_count (mongoc_collection_t *collection,       /* IN */
+                          mongoc_query_flags_t flags,            /* IN */
+@@ -705,13 +706,12 @@ mongoc_collection_count (mongoc_collection_t *collection,       /* IN */
+    /* Server Selection Spec: "may-use-secondary" commands SHOULD take a read
+     * preference argument and otherwise MUST use the default read preference
+     * from client, database or collection configuration. */
+-   BEGIN_IGNORE_DEPRECATIONS
+    ret = mongoc_collection_count_with_opts (collection, flags, query, skip, limit, &opts, read_prefs, error);
+-   END_IGNORE_DEPRECATIONS
+ 
+    bson_destroy (&opts);
+    return ret;
+ }
++END_IGNORE_DEPRECATIONS
+ 
+ 
+ int64_t
+@@ -1231,6 +1231,7 @@ mongoc_collection_keys_to_index_string (const bson_t *keys)
+ }
+ 
+ 
++BEGIN_IGNORE_DEPRECATIONS
+ bool
+ mongoc_collection_create_index (mongoc_collection_t *collection,
+                                 const bson_t *keys,
+@@ -1240,15 +1241,14 @@ mongoc_collection_create_index (mongoc_collection_t *collection,
+    bson_t reply;
+    bool ret;
+ 
+-   BEGIN_IGNORE_DEPRECATIONS
+ 
+    ret = mongoc_collection_create_index_with_opts (collection, keys, opt, NULL, &reply, error);
+ 
+-   END_IGNORE_DEPRECATIONS
+ 
+    bson_destroy (&reply);
+    return ret;
+ }
++END_IGNORE_DEPRECATIONS
+ 
+ static bool
+ _mongoc_collection_index_keys_equal (const bson_t *expected, const bson_t *actual)
+@@ -1578,16 +1578,16 @@ done:
+ }
+ 
+ 
++BEGIN_IGNORE_DEPRECATIONS
+ bool
+ mongoc_collection_ensure_index (mongoc_collection_t *collection,
+                                 const bson_t *keys,
+                                 const mongoc_index_opt_t *opt,
+                                 bson_error_t *error)
+ {
+-   BEGIN_IGNORE_DEPRECATIONS
+    return mongoc_collection_create_index (collection, keys, opt, error);
+-   END_IGNORE_DEPRECATIONS
+ }
++END_IGNORE_DEPRECATIONS
+ 
+ 
+ mongoc_cursor_t *
+@@ -2317,6 +2317,7 @@ mongoc_collection_replace_one (mongoc_collection_t *collection,
+  *--------------------------------------------------------------------------
+  */
+ 
++BEGIN_IGNORE_DEPRECATIONS
+ bool
+ mongoc_collection_save (mongoc_collection_t *collection,
+                         const bson_t *document,
+@@ -2330,7 +2331,6 @@ mongoc_collection_save (mongoc_collection_t *collection,
+    BSON_ASSERT_PARAM (collection);
+    BSON_ASSERT_PARAM (document);
+ 
+-   BEGIN_IGNORE_DEPRECATIONS
+    if (!bson_iter_init_find (&iter, document, "_id")) {
+       return mongoc_collection_insert (collection, MONGOC_INSERT_NONE, document, write_concern, error);
+    }
+@@ -2350,12 +2350,12 @@ mongoc_collection_save (mongoc_collection_t *collection,
+ 
+    ret = mongoc_collection_update (
+       collection, MONGOC_UPDATE_UPSERT | MONGOC_UPDATE_NO_VALIDATE, &selector, document, write_concern, error);
+-   END_IGNORE_DEPRECATIONS
+ 
+    bson_destroy (&selector);
+ 
+    return ret;
+ }
++END_IGNORE_DEPRECATIONS
+ 
+ 
+ bool
+diff --git a/src/libmongoc/src/mongoc/mongoc-stream-tls.c b/src/libmongoc/src/mongoc/mongoc-stream-tls.c
+index 744fdc4089..252d6209f3 100644
+--- a/src/libmongoc/src/mongoc/mongoc-stream-tls.c
++++ b/src/libmongoc/src/mongoc/mongoc-stream-tls.c
+@@ -187,6 +187,7 @@ mongoc_stream_tls_check_cert (mongoc_stream_t *stream, const char *host)
+  *--------------------------------------------------------------------------
+  */
+ 
++BEGIN_IGNORE_DEPRECATIONS
+ mongoc_stream_t *
+ mongoc_stream_tls_new_with_hostname (mongoc_stream_t *base_stream, const char *host, mongoc_ssl_opt_t *opt, int client)
+ {
+@@ -208,9 +209,7 @@ mongoc_stream_tls_new_with_hostname (mongoc_stream_t *base_stream, const char *h
+ #if defined(MONGOC_ENABLE_SSL_OPENSSL)
+    return mongoc_stream_tls_openssl_new (base_stream, host, opt, client);
+ #elif defined(MONGOC_ENABLE_SSL_LIBRESSL)
+-   BEGIN_IGNORE_DEPRECATIONS
+    return mongoc_stream_tls_libressl_new (base_stream, host, opt, client);
+-   END_IGNORE_DEPRECATIONS
+ #elif defined(MONGOC_ENABLE_SSL_SECURE_TRANSPORT)
+    return mongoc_stream_tls_secure_transport_new (base_stream, host, opt, client);
+ #elif defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
+@@ -219,6 +218,7 @@ mongoc_stream_tls_new_with_hostname (mongoc_stream_t *base_stream, const char *h
+ #error "Don't know how to create TLS stream"
+ #endif
+ }
++END_IGNORE_DEPRECATIONS
+ 
+ #if defined(MONGOC_ENABLE_SSL_OPENSSL) && OPENSSL_VERSION_NUMBER >= 0x10100000L
+ /*
+diff --git a/src/libmongoc/src/mongoc/mongoc-write-concern.c b/src/libmongoc/src/mongoc/mongoc-write-concern.c
+index 82ac8d3c32..10b8585c1c 100644
+--- a/src/libmongoc/src/mongoc/mongoc-write-concern.c
++++ b/src/libmongoc/src/mongoc/mongoc-write-concern.c
+@@ -492,6 +492,7 @@ mongoc_write_concern_append (mongoc_write_concern_t *write_concern, bson_t *comm
+  * Returns: A newly allocated mongoc_write_concern_t. This should be freed
+  *    with mongoc_write_concern_destroy().
+  */
++BEGIN_IGNORE_DEPRECATIONS
+ mongoc_write_concern_t *
+ _mongoc_write_concern_new_from_iter (const bson_iter_t *iter, bson_error_t *error)
+ {
+@@ -532,9 +533,7 @@ _mongoc_write_concern_new_from_iter (const bson_iter_t *iter, bson_error_t *erro
+          if (!BSON_ITER_HOLDS_BOOL (&inner)) {
+             goto fail;
+          }
+-         BEGIN_IGNORE_DEPRECATIONS
+          mongoc_write_concern_set_fsync (write_concern, bson_iter_bool (&inner));
+-         END_IGNORE_DEPRECATIONS
+       } else if (BSON_ITER_IS_KEY (&inner, "j")) {
+          if (!BSON_ITER_HOLDS_BOOL (&inner)) {
+             goto fail;
+@@ -560,3 +559,4 @@ fail:
+    mongoc_write_concern_destroy (write_concern);
+    return NULL;
+ }
++END_IGNORE_DEPRECATIONS

data/ext/libmongocrypt/libmongocrypt/etc/libbson-remove-GCC-diagnostic-pragma.patch

@@ -1,7 +1,7 @@
-diff --git a/src/common/bson-dsl.h b/src/common/bson-dsl.h
+diff --git a/src/common/src/common-bson-dsl-private.h b/src/common/src/common-bson-dsl-private.h
 index 58a14e28e..3341e603f 100644
---- a/src/common/bson-dsl.h
-+++ b/src/common/bson-dsl.h
+--- a/src/common/src/common-bson-dsl-private.h
++++ b/src/common/src/common-bson-dsl-private.h
 @@ -29,6 +29,13 @@ enum {
     BSON_IF_WINDOWS (__declspec (selectany)) \
     BSON_IF_POSIX (__attribute__ ((weak)))

data/ext/libmongocrypt/libmongocrypt/etc/purls.txt

@@ -8,7 +8,7 @@
 # `copyright` property. This information can be manually added.
 
 # libbson is obtained via `cmake/FetchMongoC.cmake`.
-pkg:github/mongodb/mongo-c-driver@v1.27.1?#src/libbson
+pkg:github/mongodb/mongo-c-driver@v1.30.3?#src/libbson
 
 # IntelDFP is obtained via `cmake/IntelDFP.cmake`
 pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz

data/ext/libmongocrypt/libmongocrypt/integrating.md

@@ -9,6 +9,24 @@ There are two major parts to integrating libmongocrypt into your driver:
 -   Writing a language-specific binding to libmongocrypt
 -   Using the binding in your driver to support client side encryption
 
+## Design Rationale
+
+### Simple interface
+
+The library interface is intended to be used with multiple languages.
+
+The API tries to be minimal. Most structs are opaque. Global initialization
+is lazy.
+
+Much of the API passes and returns BSON since all drivers can produce and parse
+BSON.
+
+### No I/O
+
+libmongocrypt deliberately does not do I/O to avoid poor behavior with some
+language runtimes. Example: in Go a blocking C call may block an OS thread,
+rather than a goroutine.
+
 ## Part 1: Writing a Language-Specific Binding ##
 
 The binding is the glue between your driver\'s native language and
@@ -30,7 +48,7 @@ in the main public header
 [mongocrypt.h](https://github.com/10gen/libmongocrypt/blob/master/src/mongocrypt.h).
 
 There are many types and functions in mongocrypt.h to bind. Consider as
-a first step binding to only `mongocrypt_version` ([JNA example](https://github.com/10gen/libmongocrypt/blob/fbb9f59bf32019373232dc1a1fd85a00d6ab95de/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/CAPI.java#L106-L113)).
+a first step binding to only `mongocrypt_version`.
 Once you have that working, proceed to write bindings for the remaining
 API. Here are a few things to keep in mind:
 
@@ -63,7 +81,7 @@ Seek help in the slack channel \#drivers-fle.
 After you have a binding, integrate libmongocrypt in your driver to
 support client side encryption.
 
-See the [driver spec](https://github.com/mongodb/specifications/blob/master/source/client-side-encryption/client-side-encryption.rst)
+See the [driver spec](https://github.com/mongodb/specifications/blob/master/source/client-side-encryption/client-side-encryption.md)
 for a reference of the user-facing API. libmongocrypt is needed for:
 
 -   Automatic encryption/decryption
@@ -122,6 +140,15 @@ All contexts.
 
 #### State: `MONGOCRYPT_CTX_NEED_MONGO_COLLINFO` ####
 
+> [!IMPORTANT]
+> <a name="multi-collection-commands"></a> **Multi-collection commands**: prior to 1.13.0, drivers were expected to pass _at most one result_ from `listCollections`. In 1.13.0, drivers are expected to pass _all results_ from `listCollections` to support multi-collection commands (e.g. aggregate with `$lookup`).
+>
+> Drivers must call `mongocrypt_setopt_enable_multiple_collinfo` to indicate the new behavior is implemented and opt-in to support for multi-collection commands. This opt-in is to prevent the following bug scenario:
+> > A driver upgrades to 1.13.0, but does not update prior behavior which passes at most one result of a multi-collection command.
+> > A multi-collection command requests schemas for both `db.c1` and `db.c2`.
+> > The driver only passes the result for `db.c1` even though `db.c2` also has a result.
+> > Therefore, libmongocrypt incorrectly believes `db.c2` has no schema.
+
 **libmongocrypt needs**...
 
 A result from a listCollections cursor.
@@ -130,7 +157,7 @@ A result from a listCollections cursor.
 
 1.  Run listCollections on the encrypted MongoClient with the filter
     provided by `mongocrypt_ctx_mongo_op`
-2.  Return the first result (if any) with `mongocrypt_ctx_mongo_feed` or proceed to the next step if nothing was returned.
+2.  Pass all results (if any) with calls to `mongocrypt_ctx_mongo_feed` or proceed to the next step if nothing was returned. Results may be passed in any order.
 3.  Call `mongocrypt_ctx_mongo_done`
 
 **Applies to...**
@@ -139,6 +166,8 @@ auto encrypt
 
 #### State: `MONGOCRYPT_CTX_NEED_MONGO_COLLINFO_WITH_DB` ####
 
+See [note](#multi-collection-commands) about multi-collection commands.
+
 **libmongocrypt needs**...
 
 Results from a listCollections cursor from a specified database.
@@ -147,7 +176,7 @@ Results from a listCollections cursor from a specified database.
 
 1.  Run listCollections on the encrypted MongoClient with the filter
     provided by `mongocrypt_ctx_mongo_op` on the database provided by `mongocrypt_ctx_mongo_db`.
-2.  Return the first result (if any) with `mongocrypt_ctx_mongo_feed` or proceed to the next step if nothing was returned.
+2.  Pass all results (if any) with calls to `mongocrypt_ctx_mongo_feed` or proceed to the next step if nothing was returned. Results may be passed in any order.
 3.  Call `mongocrypt_ctx_mongo_done`
 
 **Applies to...**
@@ -195,28 +224,37 @@ All contexts except for create data key.
 
 **libmongocrypt needs**...
 
-The responses from one or more HTTP messages to KMS.
+The responses from one or more messages to KMS.
+
+Ensure `mongocrypt_setopt_retry_kms` is called on the `mongocrypt_t` to enable retry.
 
 **Driver needs to...**
 
-1.  Iterate all KMS requests using `mongocrypt_ctx_next_kms_ctx`.
-    (Note, the driver MAY fan out all HTTP requests at the same time).
-2.  For each context:
+1.  For each context returned by `mongocrypt_ctx_next_kms_ctx`:
 
-    a.  Create/reuse a TLS socket connected to the endpoint indicated by
+    a.  Delay the message by the time in microseconds indicated by
+        `mongocrypt_kms_ctx_usleep` if returned value is greater than 0.
+
+    b.  Create/reuse a TLS socket connected to the endpoint indicated by
         `mongocrypt_kms_ctx_endpoint`. The endpoint string is a host name with
         a port number separated by a colon. E.g.
         "kms.us-east-1.amazonaws.com:443". A port number will always be
         included. Drivers may assume the host name is not an IP address or IP
         literal.
 
-    b.  Write the message from `mongocrypt_kms_ctx_message` to the
+    c.  Write the message from `mongocrypt_kms_ctx_message` to the
         > socket.
 
-    c.  Feed the reply back with `mongocrypt_kms_ctx_feed`. Repeat
+    d.  Feed the reply back with `mongocrypt_kms_ctx_feed`. Repeat
         > until `mongocrypt_kms_ctx_bytes_needed` returns 0.
 
-3.  When done feeding all replies, call `mongocrypt_ctx_kms_done`.
+    If any step encounters a network error, call `mongocrypt_kms_ctx_fail`.
+    If `mongocrypt_kms_ctx_fail` returns true, continue to the next KMS context.
+    If `mongocrypt_kms_ctx_fail` returns false, abort and report an error. Consider wrapping the error reported in `mongocrypt_kms_ctx_status` to include the last network error.
+
+2.  When done feeding all replies, call `mongocrypt_ctx_kms_done`.
+
+Note, the driver MAY fan out KMS requests in parallel. More KMS requests may be added when processing responses to retry.
 
 **Applies to...**
 
@@ -236,7 +274,7 @@ Credentials for one or more KMS providers.
 
 **Driver needs to...**
 
-Fetch credentials for supported KMS providers. See the [Client Side Encryption specification](https://github.com/mongodb/specifications/blob/master/source/client-side-encryption/client-side-encryption.rst#automatic-credentials) for details.
+Fetch credentials for supported KMS providers. See the [Client Side Encryption specification](https://github.com/mongodb/specifications/blob/master/source/client-side-encryption/client-side-encryption.md#automatic-credentials) for details.
 
 Pass credentials to libmongocrypt using `mongocrypt_ctx_provide_kms_providers`.
 

data/ext/libmongocrypt/libmongocrypt/kms-message/README.md

@@ -11,7 +11,7 @@ implements the request format.
 - `test_kms_azure_online` makes live requests, and has additional requirements (must have working credentials).
 
 ### Requirements
-- A complete installation of the C driver. (libbson is needed for parsing JSON, and libmongoc is used for creating TLS streams). See http://mongoc.org/libmongoc/current/installing.html for installation instructions. For macOS, `brew install mongo-c-driver` will suffice.
+- A complete installation of the C driver. (libbson is needed for parsing JSON, and libmongoc is used for creating TLS streams). See the [C Driver Manual](https://www.mongodb.com/docs/languages/c/c-driver/current/libmongoc/tutorials/obtaining-libraries/) for installation instructions. For macOS, `brew install mongo-c-driver` will suffice.
 - An Azure key vault, and a service principal with an access policy allowing encrypt / decrypt key operations. The following environment variables must be set:
     - AZURE_TENANT_ID
     - AZURE_CLIENT_ID

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_crypto_windows.c

@@ -168,7 +168,7 @@ kms_sign_rsaes_pkcs1_v1_5 (void *unused_ctx,
 
    success = CryptDecodeObjectEx (X509_ASN_ENCODING,
                                   PKCS_PRIVATE_KEY_INFO,
-                                  private_key,
+                                  (BYTE*) private_key,
                                   (DWORD) private_key_len,
                                   0,
                                   NULL,
@@ -182,7 +182,7 @@ kms_sign_rsaes_pkcs1_v1_5 (void *unused_ctx,
 
    success = CryptDecodeObjectEx (X509_ASN_ENCODING,
                                   PKCS_PRIVATE_KEY_INFO,
-                                  private_key,
+                                  (BYTE*) private_key,
                                   (DWORD) private_key_len,
                                   0,
                                   NULL,

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_message/kms_response_parser.h

@@ -57,6 +57,9 @@ kms_response_parser_error (kms_response_parser_t *parser);
 KMS_MSG_EXPORT (void)
 kms_response_parser_destroy (kms_response_parser_t *parser);
 
+KMS_MSG_EXPORT (void)
+kms_response_parser_reset (kms_response_parser_t *parser);
+
 #ifdef __cplusplus
 } /* extern "C" */
 #endif

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_message.c

@@ -24,7 +24,7 @@
 #include <stdio.h>
 
 void
-set_error (char *error, size_t size, const char *fmt, ...)
+kms_set_error (char *error, size_t size, const char *fmt, ...)
 {
    va_list va;
 

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_message_private.h

@@ -125,12 +125,12 @@ struct _kms_response_parser_t {
    } while (0)
 
 void
-set_error (char *error, size_t size, const char *fmt, ...);
+kms_set_error (char *error, size_t size, const char *fmt, ...);
 
 #define KMS_ERROR(obj, ...)                                     \
    do {                                                         \
       obj->failed = true;                                       \
-      set_error (obj->error, sizeof (obj->error), __VA_ARGS__); \
+      kms_set_error (obj->error, sizeof (obj->error), __VA_ARGS__); \
    } while (0)
 
 #define KMS_ASSERT(stmt)                      \

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_request.c

@@ -789,7 +789,7 @@ kms_request_get_signed (kms_request_t *request)
    }
 
    if (!check_and_prohibit_kmip (request)) {
-      return false;
+      return NULL;
    }
 
    if (!finalize (request)) {
@@ -857,11 +857,11 @@ kms_request_to_string (kms_request_t *request)
    size_t i;
 
    if (!finalize (request)) {
-      return false;
+      return NULL;
    }
 
    if (!check_and_prohibit_kmip (request)) {
-      return false;
+      return NULL;
    }
 
    if (request->to_string) {

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_response_parser.c

@@ -38,6 +38,14 @@ _parser_init (kms_response_parser_t *parser)
    parser->kmip = NULL;
 }
 
+void
+kms_response_parser_reset (kms_response_parser_t *parser)
+{
+   KMS_ASSERT(!parser->kmip); // KMIP is not-yet supported.  
+   _parser_destroy(parser);  
+   _parser_init(parser);  
+}
+
 kms_response_parser_t *
 kms_response_parser_new (void)
 {

data/ext/libmongocrypt/libmongocrypt/kms-message/test/test_kmip_reader_writer.c

@@ -42,11 +42,11 @@ kms_kmip_writer_test_evaluate (kmip_writer_t *writer,
    actual_hex = data_to_hex (actual_buf, actual_len);
 
    if (0 != strcmp (expected_hex, actual_hex)) {
-      fprintf (stderr,
-               "expected '%s' but got '%s' for test description: %s\n",
-               expected_hex,
-               actual_hex,
-               desc);
+      TEST_STDERR_PRINTF (
+         "expected '%s' but got '%s' for test description: %s\n",
+         expected_hex,
+         actual_hex,
+         desc);
       abort ();
    }
 

data/ext/libmongocrypt/libmongocrypt/kms-message/test/test_kms_assert.h

@@ -23,14 +23,31 @@
 #include <stdio.h>
 #include <string.h>
 
-#define TEST_ERROR(...)                                                        \
-   do {                                                                        \
-      fprintf (                                                                \
-         stderr, "test error %s:%d %s(): ", __FILE__, __LINE__, __FUNCTION__); \
-      fprintf (stderr, __VA_ARGS__);                                           \
-      fprintf (stderr, "\n");                                                  \
-      fflush (stderr);                                                         \
-      abort ();                                                                \
+// TEST_PRINTF ensures stdout and stderr are flushed.
+#define TEST_PRINTF(...)             \
+   if (1) {                          \
+      fflush (stderr);               \
+      fprintf (stdout, __VA_ARGS__); \
+      fflush (stdout);               \
+   } else                            \
+      ((void) 0)
+
+// TEST_STDERR_PRINTF ensures stdout and stderr are flushed.
+#define TEST_STDERR_PRINTF(...)      \
+   if (1) {                          \
+      fflush (stdout);               \
+      fprintf (stderr, __VA_ARGS__); \
+      fflush (stderr);               \
+   } else                            \
+      ((void) 0)
+
+#define TEST_ERROR(...)                                                \
+   do {                                                                \
+      TEST_STDERR_PRINTF (                                             \
+         "test error %s:%d %s(): ", __FILE__, __LINE__, __FUNCTION__); \
+      TEST_STDERR_PRINTF (__VA_ARGS__);                                \
+      TEST_STDERR_PRINTF ("\n");                                       \
+      abort ();                                                        \
    } while (0)
 
 #define ASSERT(stmt)                             \

data/ext/libmongocrypt/libmongocrypt/kms-message/test/test_kms_azure_online.c

@@ -56,8 +56,8 @@ test_getenv (const char *key)
 {
    char *value = getenv (key);
    if (!value) {
-      fprintf (
-         stderr, "Environment variable: %s not set (@@ctest-skip@@)", key);
+      TEST_STDERR_PRINTF ("Environment variable: %s not set (@@ctest-skip@@)\n",
+                          key);
       exit (2);
    }
    TEST_TRACE ("Env: %s = %s", key, value);

data/ext/libmongocrypt/libmongocrypt/kms-message/test/test_kms_gcp_online.c

@@ -56,8 +56,8 @@ test_getenv (const char *key)
 {
    char *value = getenv (key);
    if (!value) {
-      fprintf (
-         stderr, "Environment variable: %s not set (@@ctest-skip@@)", key);
+      TEST_STDERR_PRINTF ("Environment variable: %s not set (@@ctest-skip@@)\n",
+                          key);
       exit (2);
    }
    TEST_TRACE ("Env: %s = %s", key, value);
@@ -185,7 +185,7 @@ test_gcp (void)
                                       opt);
    ASSERT (req);
    if (kms_request_get_error (req)) {
-      printf ("error: %s\n", kms_request_get_error (req));
+      TEST_STDERR_PRINTF ("error: %s\n", kms_request_get_error (req));
       ASSERT (false);
    }
    req_str = kms_request_to_string (req);

data/ext/libmongocrypt/libmongocrypt/kms-message/test/test_kms_request.c

@@ -15,7 +15,9 @@
  */
 
 /* Needed for strptime */
+#if !defined(_GNU_SOURCE)
 #define _GNU_SOURCE
+#endif
 
 #include "kms_message/kms_message.h"
 #include "kms_message_private.h"
@@ -383,7 +385,7 @@ all_aws_sig_v4_tests (const char *path, const char *selected)
    }
 
    if (skip_aws_test (test_name) && !selected) {
-      printf ("SKIP: %s\n", test_name);
+      TEST_PRINTF ("SKIP: %s\n", test_name);
       goto done;
    }
 
@@ -407,7 +409,7 @@ all_aws_sig_v4_tests (const char *path, const char *selected)
          continue;
       }
 
-      printf ("%s\n", path);
+      TEST_PRINTF ("%s\n", path);
       aws_sig_v4_test (path);
       ran_tests = true;
    }
@@ -903,7 +905,7 @@ parser_testcase_run (parser_testcase_t *testcase)
       size_t ret = fread (buf, 1, (size_t) bytes_to_read, response_file);
 
       if (!kms_response_parser_feed (parser, buf, (int) ret)) {
-         printf ("feed error: %s\n", parser->error);
+         TEST_PRINTF ("feed error: %s\n", parser->error);
          ASSERT (false);
       }
    }
@@ -945,7 +947,7 @@ kms_response_parser_files (void)
    size_t i;
 
    for (i = 0; i < sizeof (tests) / sizeof (tests[0]); i++) {
-      printf (" parser testcase: %d\n", (int) i);
+      TEST_PRINTF (" parser testcase: %d\n", (int) i);
       parser_testcase_run (tests + i);
    }
 }
@@ -1081,8 +1083,8 @@ kms_signature_test (void)
    signature_b64 = kms_message_raw_to_b64 (signature_raw, 256);
 
    if (0 != strcmp (signature_b64, expected_signature)) {
-      printf ("generated signature: %s\n", signature_b64);
-      printf ("but expected signature: %s\n", expected_signature);
+      TEST_PRINTF ("generated signature: %s\n", signature_b64);
+      TEST_PRINTF ("but expected signature: %s\n", expected_signature);
       abort ();
    }
 
@@ -1197,7 +1199,7 @@ test_request_newlines (void)
 #define RUN_TEST(_func)                                          \
    do {                                                          \
       if (!selector || 0 == kms_strcasecmp (#_func, selector)) { \
-         printf ("%s\n", #_func);                                \
+         TEST_PRINTF ("%s\n", #_func);                           \
          _func ();                                               \
          ran_tests = true;                                       \
       }                                                          \
@@ -1232,7 +1234,7 @@ main (int argc, char *argv[])
    help = "Usage: test_kms_request [TEST_NAME]";
 
    if (argc > 2) {
-      fprintf (stderr, "%s\n", help);
+      TEST_STDERR_PRINTF ("%s\n", help);
       abort ();
    } else if (argc == 2) {
       selector = argv[1];
@@ -1240,7 +1242,7 @@ main (int argc, char *argv[])
 
    int ret = kms_message_init ();
    if (ret != 0) {
-      printf ("kms_message_init failed: 0x%x\n", ret);
+      TEST_PRINTF ("kms_message_init failed: 0x%x\n", ret);
       abort ();
    }
 
@@ -1292,7 +1294,7 @@ main (int argc, char *argv[])
 
    if (!ran_tests) {
       KMS_ASSERT (argc == 2);
-      fprintf (stderr, "No such test: \"%s\"\n", argv[1]);
+      TEST_STDERR_PRINTF ("No such test: \"%s\"\n", argv[1]);
       abort ();
    }