libmongocrypt-helper 1.12.0.0.1001 → 1.13.2.0.1001

data/ext/libmongocrypt/libmongocrypt/bindings/python/test/test_mongocrypt.py

@@ -607,7 +607,7 @@ class TestMongoCryptCallback(unittest.TestCase):
         encrypter = AutoEncrypter(callback, opts)
         self.addCleanup(encrypter.close)
 
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             data = {"access_token": "foo"}
             url = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"
             router.add(
@@ -748,7 +748,7 @@ if sys.version_info >= (3, 8, 0):  # noqa: UP036
             encrypter = AsyncAutoEncrypter(callback, opts)
             self.addAsyncCleanup(encrypter.close)
 
-            with respx.mock() as router:
+            with respx.mock(using="httpx") as router:
                 data = {"access_token": "foo"}
                 url = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"
                 router.add(
@@ -1019,7 +1019,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_success(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             data = {"access_token": "foo", "expires_in": 4000}
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
@@ -1034,7 +1034,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_empty_json(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
                 respx.get(url=url).mock(return_value=httpx.Response(200, json={}))
@@ -1048,7 +1048,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_bad_json(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
                 respx.get(url=url).mock(return_value=httpx.Response(200, text="a'"))
@@ -1062,7 +1062,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_http_404(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(respx.get(url=url).mock(return_value=httpx.Response(404)))
             with self.assertRaisesRegex(
@@ -1074,7 +1074,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_http_500(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(respx.get(url=url).mock(return_value=httpx.Response(500)))
             with self.assertRaisesRegex(
@@ -1086,7 +1086,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_slow_response(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
                 respx.get(url=url).mock(side_effect=httpx._exceptions.ConnectTimeout)
@@ -1100,7 +1100,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_cache(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             data = {"access_token": "foo", "expires_in": 4000}
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
@@ -1121,7 +1121,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_cache_expires_soon(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             data = {"access_token": "foo", "expires_in": 10}
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
@@ -1137,7 +1137,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
         # Should not use the cached value.
         encrypter = self.get_encrypter(False)
         self.assertIsNotNone(pymongocrypt.synchronous.credentials._azure_creds_cache)
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
                 respx.get(url=url).mock(side_effect=httpx._exceptions.ConnectTimeout)

data/ext/libmongocrypt/libmongocrypt/cmake/FetchMongoC.cmake

@@ -1,8 +1,8 @@
 include (FetchContent)
 
 # Set the tag that we will fetch.
-# When updating the version of libbson, also update the version in etc/purls.txt
-set (MONGOC_FETCH_TAG_FOR_LIBBSON "1.28.1" CACHE STRING "The Git tag of mongo-c-driver that will be fetched to obtain libbson")
+# When updating the version of libbson, also update the version in etc/purls.txt and .evergreen/prep_c_driver_source.sh
+set (MONGOC_FETCH_TAG_FOR_LIBBSON "1.30.3" CACHE STRING "The Git tag of mongo-c-driver that will be fetched to obtain libbson")
 
 # Add an option to disable patching if a patch command is unavailable.
 option (LIBBSON_PATCH_ENABLED "Whether to apply patches to the libbson library" ON)
@@ -18,6 +18,8 @@ make_patch_command (patch_command
     DISABLED "${patch_disabled}"
     PATCHES
         ${PROJECT_SOURCE_DIR}/etc/libbson-remove-GCC-diagnostic-pragma.patch
+        # Fix old GCC error: "#pragma GCC diagnostic not allowed inside functions". Remove patch after libbson 2.0.0:
+        ${PROJECT_SOURCE_DIR}/etc/libbson-remove-GCC-diagnostic-in-functions.patch
     )
 
 # Fetch the source archive for the requested tag from GitHub

data/ext/libmongocrypt/libmongocrypt/cmake/ImportBSON.cmake

@@ -56,9 +56,9 @@ cmake_push_check_state ()
    # extra-alignment enabled. We want to match that setting as our default, for convenience
    # purposes only.
    find_path (SYSTEM_BSON_INCLUDE_DIR bson/bson.h PATH_SUFFIXES libbson-1.0)
+   set (_extra_alignment_default OFF)
    if (SYSTEM_BSON_INCLUDE_DIR AND NOT DEFINED ENABLE_EXTRA_ALIGNMENT)
       set (CMAKE_REQUIRED_INCLUDES "${SYSTEM_BSON_INCLUDE_DIR}")
-      set (_extra_alignment_default OFF)
       check_c_source_compiles ([[
          #include <bson/bson.h>
 
@@ -140,10 +140,8 @@ function (_import_bson)
       set (ENABLE_SNAPPY OFF CACHE BOOL "Toggle snappy for the mongoc subproject (not required by libmongocrypt)")
       # Disable deprecated automatic init and cleanup. (May be overridden by the user)
       set (ENABLE_AUTOMATIC_INIT_AND_CLEANUP OFF CACHE BOOL "Enable automatic init and cleanup (GCC only)")
-      if (DEFINED _extra_alignment_default)
-         # Disable over-alignment of bson types. (May be overridden by the user)
-         set (ENABLE_EXTRA_ALIGNMENT ${_extra_alignment_default} CACHE BOOL "Toggle extra alignment of bson_t")
-      endif ()
+      # Disable over-alignment of bson types. (May be overridden by the user)
+      set (ENABLE_EXTRA_ALIGNMENT ${_extra_alignment_default} CACHE BOOL "Toggle extra alignment of bson_t")
       # We don't want the subproject to find libmongocrypt
       set (ENABLE_CLIENT_SIDE_ENCRYPTION OFF CACHE BOOL "Disable client-side encryption for the libmongoc subproject")
       # Clear `BUILD_VERSION` so C driver does not use a `BUILD_VERSION` meant for libmongocrypt.

data/ext/libmongocrypt/libmongocrypt/doc/releasing.md

@@ -44,18 +44,15 @@ snyk monitor \
 
 Check the updated reference targets in Snyk for detected vulnerabilities.
 
-#### Check Silk
+#### Check the Augmented SBOM
 
-Get credentials for Silk from the `drivers/libmongocrypt` vault in [AWS Secrets Manager](https://wiki.corp.mongodb.com/display/DRIVERS/Using+AWS+Secrets+Manager+to+Store+Testing+Secrets).
+Examine the Augmented SBOM from a recent execution of the `sbom` task in an Evergreen patch or commit build.
+
+Evergreen CLI may be used to schedule only the `sbom` task:
 
-Download the Augmented SBOM using:
 ```bash
-./.evergreen/earthly.sh \
-   --secret silk_client_id=${silk_client_id} \
-   --secret silk_client_secret=${silk_client_secret} \
-   +sbom-download \
-   --out cyclonedx.augmented.sbom.json \
-   --branch <branch>
+# Ensure `-p` matches the correct Evergreen project for the current branch!
+evergreen patch -y -p libmongocrypt -t all -v sbom -f
 ```
 
 Check the contents of the "vulnerabilities" field (if present) in the Augmented SBOM.
@@ -83,29 +80,16 @@ Do the following when releasing:
       - If the `publish-packages` tasks fail with an error like `[curator] 2024/01/02 13:56:17 [p=emergency]: problem submitting repobuilder job: 404 (Not Found)`, this suggests the published path does not yet exist. Barque (the Linux package publishing service) has protection to avoid unintentional publishes. File a DEVPROD ticket ([example](https://jira.mongodb.org/browse/DEVPROD-4053)) and assign to the team called Release Infrastructure to request the path be created. Then re-run the failing `publish-packages` task. Ask in the slack channel `#devprod-release-tools` for further help with `Barque` or `curator`.
 - Create the release from the GitHub releases page from the new tag.
    - Attach the tarball and signature file from the Files tab of the `windows-upload-release` task. [Example](https://github.com/mongodb/libmongocrypt/releases/tag/1.10.0).
-   - Attach the Augmented SBOM file. Download the Augmented SBOM using:
-     ```bash
-     ./.evergreen/earthly.sh \
-        --secret silk_client_id=${silk_client_id} \
-        --secret silk_client_secret=${silk_client_secret} \
-        +sbom-download \
-        --out cyclonedx.augmented.sbom.json \
-        --branch <branch>
-     ```
-     For a new minor release, use `master` for `--branch`. For a patch release, use the release branch (e.g. `rx.y`).
-     Secrets can be obtained from [AWS Secrets Manager](https://wiki.corp.mongodb.com/display/DRIVERS/Using+AWS+Secrets+Manager+to+Store+Testing+Secrets) under `drivers/libmongocrypt`.
+   - Attach the Augmented SBOM file to the release as `cyclonedx.augmented.sbom.json`.
+     Download the Augmented SBOM from a recent execution of the `sbom` task in an Evergreen patch or commit build.
    - Attach `etc/third_party_vulnerabilities.md` to the release.
    - Attach `etc/ssdlc_compliance_report.md` to the release.
 
 - If this is a new minor release (e.g. `x.y.0`):
    - File a DOCSP ticket to update the installation instructions on [Install libmongocrypt](https://www.mongodb.com/docs/manual/core/csfle/reference/libmongocrypt/). ([Example](https://jira.mongodb.org/browse/DOCSP-36863))
-   - Create a new Silk asset group. Use the newly created release branch (e.g. `rx.y`) as the `--branch` argument:
+   - Generate a new unique SBOM serial number for the next release:
      ```bash
-     ./.evergreen/earthly.sh \
-        --secret silk_client_id=${silk_client_id} \
-        --secret silk_client_secret=${silk_client_secret} \
-        +silk-create-asset-group \
-        --branch <branch>
+     ./.evergreen/earthly.sh +sbom-generate-new-serial-number
      ```
    - Create a new Snyk reference target. The following instructions use the example branch `rx.y`:
 
@@ -130,6 +114,10 @@ Do the following when releasing:
       --remote-repo-url=https://github.com/mongodb/libmongocrypt.git
      ```
      Snyk reference targets for older release branches may be removed if no further releases are expected on the branch.
+   - Update the [Github Webhook](https://wiki.corp.mongodb.com/display/INTX/Githook) to include the new branch.
+     - Navigate to the [Webhook Settings](https://github.com/mongodb/libmongocrypt/settings/hooks).
+     - Click `Edit` on the hook for `https://githook.mongodb.com/`.
+     - Add the new release branch to the `Payload URL`. Remove unmaintained release branches.
 - Make a PR to apply the "Update CHANGELOG.md for x.y.z" commit to the `master` branch.
 - Update the release on the [Jira releases page](https://jira.mongodb.org/projects/MONGOCRYPT/versions).
 - Record the release on [C/C++ Release Info](https://docs.google.com/spreadsheets/d/1yHfGmDnbA5-Qt8FX4tKWC5xk9AhzYZx1SKF4AD36ecY/edit?usp=sharing). This is done to meet SSDLC reporting requirements.
@@ -160,4 +148,3 @@ index 609dc0b..f7530a9 100644
      Architectures: amd64 arm64
    suites:
 ```
-

data/ext/libmongocrypt/libmongocrypt/etc/cyclonedx.sbom.json

@@ -1,16 +1,16 @@
 {
   "components": [
     {
-      "bom-ref": "pkg:github/mongodb/mongo-c-driver@v1.28.1#src/libbson",
+      "bom-ref": "pkg:github/mongodb/mongo-c-driver@v1.30.3#src/libbson",
       "copyright": "Copyright 2009-present MongoDB, Inc.",
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://github.com/mongodb/mongo-c-driver/archive/refs/tags/v1.28.1.tar.gz"
+          "url": "https://github.com/mongodb/mongo-c-driver/archive/refs/tags/v1.30.3.tar.gz"
         },
         {
           "type": "website",
-          "url": "https://github.com/mongodb/mongo-c-driver/tree/v1.28.1"
+          "url": "https://github.com/mongodb/mongo-c-driver/tree/v1.30.3"
         }
       ],
       "group": "mongodb",
@@ -22,9 +22,9 @@
         }
       ],
       "name": "mongo-c-driver",
-      "purl": "pkg:github/mongodb/mongo-c-driver@v1.28.1#src/libbson",
+      "purl": "pkg:github/mongodb/mongo-c-driver@v1.30.3#src/libbson",
       "type": "library",
-      "version": "v1.28.1"
+      "version": "v1.30.3"
     },
     {
       "bom-ref": "pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz",
@@ -53,11 +53,11 @@
       "ref": "pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz"
     },
     {
-      "ref": "pkg:github/mongodb/mongo-c-driver@v1.28.1#src/libbson"
+      "ref": "pkg:github/mongodb/mongo-c-driver@v1.30.3#src/libbson"
     }
   ],
   "metadata": {
-    "timestamp": "2024-10-10T20:09:56.207649+00:00",
+    "timestamp": "2025-04-08T13:06:37.750496+00:00",
     "tools": [
       {
         "externalReferences": [
@@ -100,8 +100,8 @@
       }
     ]
   },
-  "serialNumber": "urn:uuid:879e1b41-08d8-4505-8c89-2285bc3e442c",
-  "version": 2,
+  "serialNumber": "urn:uuid:1eeadd7e-be33-4e55-960c-02bac1da4cf7",
+  "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",

data/ext/libmongocrypt/libmongocrypt/etc/format.sh

@@ -9,8 +9,6 @@ if ! run_python -c ''; then
   fail "No Python found?"
 fi
 
-# Check that we have a pipx of the proper version:
-run_python -c 'import pkg_resources; pkg_resources.require("pipx>=0.17.0,<2.0")'
 
 # Give default clang-format an empty string on stdin if there are no inputs files
 printf '' | run_python -m pipx run "clang-format==${CLANG_FORMAT_VERSION:?}" "$@"

data/ext/libmongocrypt/libmongocrypt/etc/libbson-remove-GCC-diagnostic-in-functions.patch

@@ -0,0 +1,158 @@
+diff --git a/src/libmongoc/src/mongoc/mongoc-collection.c b/src/libmongoc/src/mongoc/mongoc-collection.c
+index d21a043788..ac0194e477 100644
+--- a/src/libmongoc/src/mongoc/mongoc-collection.c
++++ b/src/libmongoc/src/mongoc/mongoc-collection.c
+@@ -681,6 +681,7 @@ mongoc_collection_command_simple (mongoc_collection_t *collection,
+  *--------------------------------------------------------------------------
+  */
+ 
++BEGIN_IGNORE_DEPRECATIONS
+ int64_t
+ mongoc_collection_count (mongoc_collection_t *collection,       /* IN */
+                          mongoc_query_flags_t flags,            /* IN */
+@@ -705,13 +706,12 @@ mongoc_collection_count (mongoc_collection_t *collection,       /* IN */
+    /* Server Selection Spec: "may-use-secondary" commands SHOULD take a read
+     * preference argument and otherwise MUST use the default read preference
+     * from client, database or collection configuration. */
+-   BEGIN_IGNORE_DEPRECATIONS
+    ret = mongoc_collection_count_with_opts (collection, flags, query, skip, limit, &opts, read_prefs, error);
+-   END_IGNORE_DEPRECATIONS
+ 
+    bson_destroy (&opts);
+    return ret;
+ }
++END_IGNORE_DEPRECATIONS
+ 
+ 
+ int64_t
+@@ -1231,6 +1231,7 @@ mongoc_collection_keys_to_index_string (const bson_t *keys)
+ }
+ 
+ 
++BEGIN_IGNORE_DEPRECATIONS
+ bool
+ mongoc_collection_create_index (mongoc_collection_t *collection,
+                                 const bson_t *keys,
+@@ -1240,15 +1241,14 @@ mongoc_collection_create_index (mongoc_collection_t *collection,
+    bson_t reply;
+    bool ret;
+ 
+-   BEGIN_IGNORE_DEPRECATIONS
+ 
+    ret = mongoc_collection_create_index_with_opts (collection, keys, opt, NULL, &reply, error);
+ 
+-   END_IGNORE_DEPRECATIONS
+ 
+    bson_destroy (&reply);
+    return ret;
+ }
++END_IGNORE_DEPRECATIONS
+ 
+ static bool
+ _mongoc_collection_index_keys_equal (const bson_t *expected, const bson_t *actual)
+@@ -1578,16 +1578,16 @@ done:
+ }
+ 
+ 
++BEGIN_IGNORE_DEPRECATIONS
+ bool
+ mongoc_collection_ensure_index (mongoc_collection_t *collection,
+                                 const bson_t *keys,
+                                 const mongoc_index_opt_t *opt,
+                                 bson_error_t *error)
+ {
+-   BEGIN_IGNORE_DEPRECATIONS
+    return mongoc_collection_create_index (collection, keys, opt, error);
+-   END_IGNORE_DEPRECATIONS
+ }
++END_IGNORE_DEPRECATIONS
+ 
+ 
+ mongoc_cursor_t *
+@@ -2317,6 +2317,7 @@ mongoc_collection_replace_one (mongoc_collection_t *collection,
+  *--------------------------------------------------------------------------
+  */
+ 
++BEGIN_IGNORE_DEPRECATIONS
+ bool
+ mongoc_collection_save (mongoc_collection_t *collection,
+                         const bson_t *document,
+@@ -2330,7 +2331,6 @@ mongoc_collection_save (mongoc_collection_t *collection,
+    BSON_ASSERT_PARAM (collection);
+    BSON_ASSERT_PARAM (document);
+ 
+-   BEGIN_IGNORE_DEPRECATIONS
+    if (!bson_iter_init_find (&iter, document, "_id")) {
+       return mongoc_collection_insert (collection, MONGOC_INSERT_NONE, document, write_concern, error);
+    }
+@@ -2350,12 +2350,12 @@ mongoc_collection_save (mongoc_collection_t *collection,
+ 
+    ret = mongoc_collection_update (
+       collection, MONGOC_UPDATE_UPSERT | MONGOC_UPDATE_NO_VALIDATE, &selector, document, write_concern, error);
+-   END_IGNORE_DEPRECATIONS
+ 
+    bson_destroy (&selector);
+ 
+    return ret;
+ }
++END_IGNORE_DEPRECATIONS
+ 
+ 
+ bool
+diff --git a/src/libmongoc/src/mongoc/mongoc-stream-tls.c b/src/libmongoc/src/mongoc/mongoc-stream-tls.c
+index 744fdc4089..252d6209f3 100644
+--- a/src/libmongoc/src/mongoc/mongoc-stream-tls.c
++++ b/src/libmongoc/src/mongoc/mongoc-stream-tls.c
+@@ -187,6 +187,7 @@ mongoc_stream_tls_check_cert (mongoc_stream_t *stream, const char *host)
+  *--------------------------------------------------------------------------
+  */
+ 
++BEGIN_IGNORE_DEPRECATIONS
+ mongoc_stream_t *
+ mongoc_stream_tls_new_with_hostname (mongoc_stream_t *base_stream, const char *host, mongoc_ssl_opt_t *opt, int client)
+ {
+@@ -208,9 +209,7 @@ mongoc_stream_tls_new_with_hostname (mongoc_stream_t *base_stream, const char *h
+ #if defined(MONGOC_ENABLE_SSL_OPENSSL)
+    return mongoc_stream_tls_openssl_new (base_stream, host, opt, client);
+ #elif defined(MONGOC_ENABLE_SSL_LIBRESSL)
+-   BEGIN_IGNORE_DEPRECATIONS
+    return mongoc_stream_tls_libressl_new (base_stream, host, opt, client);
+-   END_IGNORE_DEPRECATIONS
+ #elif defined(MONGOC_ENABLE_SSL_SECURE_TRANSPORT)
+    return mongoc_stream_tls_secure_transport_new (base_stream, host, opt, client);
+ #elif defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
+@@ -219,6 +218,7 @@ mongoc_stream_tls_new_with_hostname (mongoc_stream_t *base_stream, const char *h
+ #error "Don't know how to create TLS stream"
+ #endif
+ }
++END_IGNORE_DEPRECATIONS
+ 
+ #if defined(MONGOC_ENABLE_SSL_OPENSSL) && OPENSSL_VERSION_NUMBER >= 0x10100000L
+ /*
+diff --git a/src/libmongoc/src/mongoc/mongoc-write-concern.c b/src/libmongoc/src/mongoc/mongoc-write-concern.c
+index 82ac8d3c32..10b8585c1c 100644
+--- a/src/libmongoc/src/mongoc/mongoc-write-concern.c
++++ b/src/libmongoc/src/mongoc/mongoc-write-concern.c
+@@ -492,6 +492,7 @@ mongoc_write_concern_append (mongoc_write_concern_t *write_concern, bson_t *comm
+  * Returns: A newly allocated mongoc_write_concern_t. This should be freed
+  *    with mongoc_write_concern_destroy().
+  */
++BEGIN_IGNORE_DEPRECATIONS
+ mongoc_write_concern_t *
+ _mongoc_write_concern_new_from_iter (const bson_iter_t *iter, bson_error_t *error)
+ {
+@@ -532,9 +533,7 @@ _mongoc_write_concern_new_from_iter (const bson_iter_t *iter, bson_error_t *erro
+          if (!BSON_ITER_HOLDS_BOOL (&inner)) {
+             goto fail;
+          }
+-         BEGIN_IGNORE_DEPRECATIONS
+          mongoc_write_concern_set_fsync (write_concern, bson_iter_bool (&inner));
+-         END_IGNORE_DEPRECATIONS
+       } else if (BSON_ITER_IS_KEY (&inner, "j")) {
+          if (!BSON_ITER_HOLDS_BOOL (&inner)) {
+             goto fail;
+@@ -560,3 +559,4 @@ fail:
+    mongoc_write_concern_destroy (write_concern);
+    return NULL;
+ }
++END_IGNORE_DEPRECATIONS

data/ext/libmongocrypt/libmongocrypt/etc/libbson-remove-GCC-diagnostic-pragma.patch

@@ -1,7 +1,7 @@
-diff --git a/src/common/bson-dsl.h b/src/common/bson-dsl.h
+diff --git a/src/common/src/common-bson-dsl-private.h b/src/common/src/common-bson-dsl-private.h
 index 58a14e28e..3341e603f 100644
---- a/src/common/bson-dsl.h
-+++ b/src/common/bson-dsl.h
+--- a/src/common/src/common-bson-dsl-private.h
++++ b/src/common/src/common-bson-dsl-private.h
 @@ -29,6 +29,13 @@ enum {
     BSON_IF_WINDOWS (__declspec (selectany)) \
     BSON_IF_POSIX (__attribute__ ((weak)))

data/ext/libmongocrypt/libmongocrypt/etc/purls.txt

@@ -8,7 +8,7 @@
 # `copyright` property. This information can be manually added.
 
 # libbson is obtained via `cmake/FetchMongoC.cmake`.
-pkg:github/mongodb/mongo-c-driver@v1.28.1?#src/libbson
+pkg:github/mongodb/mongo-c-driver@v1.30.3?#src/libbson
 
 # IntelDFP is obtained via `cmake/IntelDFP.cmake`
 pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz

data/ext/libmongocrypt/libmongocrypt/integrating.md

@@ -9,6 +9,24 @@ There are two major parts to integrating libmongocrypt into your driver:
 -   Writing a language-specific binding to libmongocrypt
 -   Using the binding in your driver to support client side encryption
 
+## Design Rationale
+
+### Simple interface
+
+The library interface is intended to be used with multiple languages.
+
+The API tries to be minimal. Most structs are opaque. Global initialization
+is lazy.
+
+Much of the API passes and returns BSON since all drivers can produce and parse
+BSON.
+
+### No I/O
+
+libmongocrypt deliberately does not do I/O to avoid poor behavior with some
+language runtimes. Example: in Go a blocking C call may block an OS thread,
+rather than a goroutine.
+
 ## Part 1: Writing a Language-Specific Binding ##
 
 The binding is the glue between your driver\'s native language and
@@ -30,7 +48,7 @@ in the main public header
 [mongocrypt.h](https://github.com/10gen/libmongocrypt/blob/master/src/mongocrypt.h).
 
 There are many types and functions in mongocrypt.h to bind. Consider as
-a first step binding to only `mongocrypt_version` ([JNA example](https://github.com/10gen/libmongocrypt/blob/fbb9f59bf32019373232dc1a1fd85a00d6ab95de/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/CAPI.java#L106-L113)).
+a first step binding to only `mongocrypt_version`.
 Once you have that working, proceed to write bindings for the remaining
 API. Here are a few things to keep in mind:
 
@@ -122,6 +140,15 @@ All contexts.
 
 #### State: `MONGOCRYPT_CTX_NEED_MONGO_COLLINFO` ####
 
+> [!IMPORTANT]
+> <a name="multi-collection-commands"></a> **Multi-collection commands**: prior to 1.13.0, drivers were expected to pass _at most one result_ from `listCollections`. In 1.13.0, drivers are expected to pass _all results_ from `listCollections` to support multi-collection commands (e.g. aggregate with `$lookup`).
+>
+> Drivers must call `mongocrypt_setopt_enable_multiple_collinfo` to indicate the new behavior is implemented and opt-in to support for multi-collection commands. This opt-in is to prevent the following bug scenario:
+> > A driver upgrades to 1.13.0, but does not update prior behavior which passes at most one result of a multi-collection command.
+> > A multi-collection command requests schemas for both `db.c1` and `db.c2`.
+> > The driver only passes the result for `db.c1` even though `db.c2` also has a result.
+> > Therefore, libmongocrypt incorrectly believes `db.c2` has no schema.
+
 **libmongocrypt needs**...
 
 A result from a listCollections cursor.
@@ -130,7 +157,7 @@ A result from a listCollections cursor.
 
 1.  Run listCollections on the encrypted MongoClient with the filter
     provided by `mongocrypt_ctx_mongo_op`
-2.  Return the first result (if any) with `mongocrypt_ctx_mongo_feed` or proceed to the next step if nothing was returned.
+2.  Pass all results (if any) with calls to `mongocrypt_ctx_mongo_feed` or proceed to the next step if nothing was returned. Results may be passed in any order.
 3.  Call `mongocrypt_ctx_mongo_done`
 
 **Applies to...**
@@ -139,6 +166,8 @@ auto encrypt
 
 #### State: `MONGOCRYPT_CTX_NEED_MONGO_COLLINFO_WITH_DB` ####
 
+See [note](#multi-collection-commands) about multi-collection commands.
+
 **libmongocrypt needs**...
 
 Results from a listCollections cursor from a specified database.
@@ -147,7 +176,7 @@ Results from a listCollections cursor from a specified database.
 
 1.  Run listCollections on the encrypted MongoClient with the filter
     provided by `mongocrypt_ctx_mongo_op` on the database provided by `mongocrypt_ctx_mongo_db`.
-2.  Return the first result (if any) with `mongocrypt_ctx_mongo_feed` or proceed to the next step if nothing was returned.
+2.  Pass all results (if any) with calls to `mongocrypt_ctx_mongo_feed` or proceed to the next step if nothing was returned. Results may be passed in any order.
 3.  Call `mongocrypt_ctx_mongo_done`
 
 **Applies to...**
@@ -195,13 +224,13 @@ All contexts except for create data key.
 
 **libmongocrypt needs**...
 
-The responses from one or more HTTP messages to KMS.
+The responses from one or more messages to KMS.
+
+Ensure `mongocrypt_setopt_retry_kms` is called on the `mongocrypt_t` to enable retry.
 
 **Driver needs to...**
 
-1.  Iterate all KMS requests using `mongocrypt_ctx_next_kms_ctx`.
-    (Note, the driver MAY fan out all HTTP requests at the same time).
-2.  For each context:
+1.  For each context returned by `mongocrypt_ctx_next_kms_ctx`:
 
     a.  Delay the message by the time in microseconds indicated by
         `mongocrypt_kms_ctx_usleep` if returned value is greater than 0.
@@ -219,11 +248,13 @@ The responses from one or more HTTP messages to KMS.
     d.  Feed the reply back with `mongocrypt_kms_ctx_feed`. Repeat
         > until `mongocrypt_kms_ctx_bytes_needed` returns 0.
 
-    If any step encounters a network error, continue to the next KMS context if
-    `mongocrypt_kms_ctx_fail` returns true. Otherwise, abort and report an
-    error.
+    If any step encounters a network error, call `mongocrypt_kms_ctx_fail`.
+    If `mongocrypt_kms_ctx_fail` returns true, continue to the next KMS context.
+    If `mongocrypt_kms_ctx_fail` returns false, abort and report an error. Consider wrapping the error reported in `mongocrypt_kms_ctx_status` to include the last network error.
+
+2.  When done feeding all replies, call `mongocrypt_ctx_kms_done`.
 
-3.  When done feeding all replies, call `mongocrypt_ctx_kms_done`.
+Note, the driver MAY fan out KMS requests in parallel. More KMS requests may be added when processing responses to retry.
 
 **Applies to...**
 

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_crypto_windows.c

@@ -168,7 +168,7 @@ kms_sign_rsaes_pkcs1_v1_5 (void *unused_ctx,
 
    success = CryptDecodeObjectEx (X509_ASN_ENCODING,
                                   PKCS_PRIVATE_KEY_INFO,
-                                  private_key,
+                                  (BYTE*) private_key,
                                   (DWORD) private_key_len,
                                   0,
                                   NULL,
@@ -182,7 +182,7 @@ kms_sign_rsaes_pkcs1_v1_5 (void *unused_ctx,
 
    success = CryptDecodeObjectEx (X509_ASN_ENCODING,
                                   PKCS_PRIVATE_KEY_INFO,
-                                  private_key,
+                                  (BYTE*) private_key,
                                   (DWORD) private_key_len,
                                   0,
                                   NULL,

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_message.c

@@ -24,7 +24,7 @@
 #include <stdio.h>
 
 void
-set_error (char *error, size_t size, const char *fmt, ...)
+kms_set_error (char *error, size_t size, const char *fmt, ...)
 {
    va_list va;
 

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_message_private.h

@@ -125,12 +125,12 @@ struct _kms_response_parser_t {
    } while (0)
 
 void
-set_error (char *error, size_t size, const char *fmt, ...);
+kms_set_error (char *error, size_t size, const char *fmt, ...);
 
 #define KMS_ERROR(obj, ...)                                     \
    do {                                                         \
       obj->failed = true;                                       \
-      set_error (obj->error, sizeof (obj->error), __VA_ARGS__); \
+      kms_set_error (obj->error, sizeof (obj->error), __VA_ARGS__); \
    } while (0)
 
 #define KMS_ASSERT(stmt)                      \

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_request.c

@@ -789,7 +789,7 @@ kms_request_get_signed (kms_request_t *request)
    }
 
    if (!check_and_prohibit_kmip (request)) {
-      return false;
+      return NULL;
    }
 
    if (!finalize (request)) {
@@ -857,11 +857,11 @@ kms_request_to_string (kms_request_t *request)
    size_t i;
 
    if (!finalize (request)) {
-      return false;
+      return NULL;
    }
 
    if (!check_and_prohibit_kmip (request)) {
-      return false;
+      return NULL;
    }
 
    if (request->to_string) {