libmongocrypt-helper 1.12.0.0.1001 → 1.14.0.0.1001

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cf00b6a450f6aa77d228d83130381cf15bb20b0d82ae51dbcd82e7b336cd2fd4
-  data.tar.gz: 537ccd4a814e42d8f629d87de31dd031b3b3ef9b5172143b758fe08bd9752b1f
+  metadata.gz: 197853e4c5046361f1d1de43cfb17680ebbc2ffb124fb28335987dae0ef1a574
+  data.tar.gz: 96bccae1037132b830c908db7a5664f6d019dd16e173dcdd615e91a9b41bd1e7
 SHA512:
-  metadata.gz: 5f05b0d6482958635e20eb894f18f5920ee554b5d6a9dff45014360bcb7253f58b63a3e7a92094d5a12f1ce37aa628625127bd66dcf11844d637a0dfaeed59ac
-  data.tar.gz: aea6e38f174a6befc37016dd379cc20e92683f0c0400dcb014e4906ab5380edf3f89c6de9ff99fd4ff17bd5e1c6c2af62e4ff263286e48715b738e57cc3a6af5
+  metadata.gz: 76e6da0aa60bcc18568e4d0fde151a064887789ade68ef0e98da3d51b1c408f5ea9b6311f95a4a77422df1a7fd74c3550c0335e2d8b352b8c14d7af7a7dddad4
+  data.tar.gz: 4c61332a072aafdfc09034fa3f305637ffd8e3276186101261b6d4a09ea7340966d783093f43ed5067ec3489f23e42eea04436e51eb49ae69bdf098c8a0be38b

data/ext/libmongocrypt/libmongocrypt/CHANGELOG.md

@@ -1,10 +1,37 @@
 # ChangeLog
+## 1.14.0
+### Fixed
+- Fix building against libbson with extra alignment enabled (`ENABLE_EXTRA_ALIGNMENT=ON`).
+- Retry KMS encrypt request for context created by `mongocrypt_ctx_rewrap_many_datakey_init`.
+### Improvements
+- Improve performance of OpenSSL crypto operations.
+- Improve error for incorrect path to crypt_shared library.
+
+## 1.13.2
+### Notes
+- Bump downloaded libbson version from 1.28.1 to 1.30.3. Fixes a CMake configure error on macOS with CMake 4.
+## 1.13.1
+### Fixed
+- Fix possible double free on parse error of malformed payload.
+- Fix build failure when configuring with `ENABLE_TRACE=ON`.
+- Fix possible redefinition of `_GNU_SOURCE`.
+
+## 1.13.0
+### New features
+- Support automatic encryption for `$lookup` stages in `aggregate` pipelines on MongoDB server 8.1+.
+### Fixed
+- Restore default behavior to disable extra alignment when importing libbson. This was the default behavior in 1.11. This can be overridden by setting the CMake option `ENABLE_EXTRA_ALIGNMENT=ON`.
+### Removed
+- Support for macOS versions older than 11. libmongocrypt is supported and tested with macOS 11+.
+
 ## 1.12.0
 ### New features
 - Add option to configure Data Encryption Key cache lifetime (`mongocrypt_setopt_key_expiration`)
 - Add opt-in retry behavior for KMS operations (`mongocrypt_setopt_retry_kms`)
 ### Removed
 - libmongocrypt is no longer published in the MongoDB package repository for RHEL 6. libmongocrypt may instead be built from source on RHEL 6, but support for RHEL 6 will be dropped in a future release.
+### Notes
+- This release unintentionally changes the default behavior of extra alignment with importing libbson. See 1.13.0 release notes.
 
 ## 1.11.0
 ### New features

data/ext/libmongocrypt/libmongocrypt/CMakeLists.txt

@@ -108,6 +108,7 @@ set (MONGOCRYPT_SOURCES
    src/mc-fle2-encryption-placeholder.c
    src/mc-fle2-find-equality-payload.c
    src/mc-fle2-find-equality-payload-v2.c
+   src/mc-fle2-find-text-payload.c
    src/mc-fle2-payload-iev.c
    src/mc-fle2-payload-iev-v2.c
    src/mc-fle2-payload-uev.c
@@ -115,11 +116,15 @@ set (MONGOCRYPT_SOURCES
    src/mc-fle2-payload-uev-v2.c
    src/mc-fle2-rfds.c
    src/mc-fle2-tag-and-encrypted-metadata-block.c
+   src/mc-parse-utils.c
    src/mc-range-edge-generation.c
    src/mc-range-mincover.c
    src/mc-range-encoding.c
    src/mc-rangeopts.c
    src/mc-reader.c
+   src/mc-schema-broker.c
+   src/mc-str-encode-string-sets.c
+   src/mc-text-search-str-encode.c
    src/mc-tokens.c
    src/mc-writer.c
    src/mongocrypt-binary.c
@@ -151,6 +156,9 @@ set (MONGOCRYPT_SOURCES
    src/os_posix/os_mutex.c
    src/os_win/os_dll.c
    src/os_posix/os_dll.c
+   src/unicode/case-fold-map.c
+   src/unicode/diacritic-fold-map.c
+   src/unicode/fold.c
    )
 
 # If MONGOCRYPT_CRYPTO is not set, choose a system default.
@@ -460,8 +468,10 @@ set (TEST_MONGOCRYPT_SOURCES
    test/test-gcp-auth.c
    test/test-mc-cmp.c
    test/test-mc-efc.c
+   test/test-mc-fle2-encryption-placeholder.c
    test/test-mc-fle2-find-equality-payload-v2.c
    test/test-mc-fle2-find-range-payload-v2.c
+   test/test-mc-fle2-find-text-payload.c
    test/test-mc-fle2-payload-iev.c
    test/test-mc-fle2-payload-iev-v2.c
    test/test-mc-fle2-payload-iup.c
@@ -474,6 +484,8 @@ set (TEST_MONGOCRYPT_SOURCES
    test/test-mc-range-mincover.c
    test/test-mc-rangeopts.c
    test/test-mc-reader.c
+   test/test-mc-text-search-str-encode.c
+   test/test-mc-schema-broker.c
    test/test-mc-tokens.c
    test/test-mc-range-encoding.c
    test/test-mc-writer.c
@@ -510,6 +522,7 @@ set (TEST_MONGOCRYPT_SOURCES
    test/test-mongocrypt-util.c
    test/test-mongocrypt.c
    test/test-named-kms-providers.c
+   test/test-unicode-fold.c
    )
 
 # Define test-mongocrypt
@@ -523,6 +536,8 @@ target_compile_definitions (test-mongocrypt PRIVATE
    "TEST_MONGOCRYPT_OUTPUT_PATH=\"$<TARGET_FILE:test-mongocrypt>\""
    # Tell test-mongocrypt whether we have a real csfle library for testing
    TEST_MONGOCRYPT_HAVE_REAL_CRYPT_SHARED_LIB=$<BOOL:${MONGOCRYPT_TESTING_CRYPT_SHARED_FILE}>
+   # Tell test-mongocrypt the path of the libmongocrypt shared library for testing.
+   "TEST_MONGOCRYPT_MONGOCRYPT_SHARED_PATH=\"$<TARGET_FILE:mongocrypt>\""
    )
 
 add_test (
@@ -702,4 +717,3 @@ install (
    COMPONENT
       Devel
 )
-

data/ext/libmongocrypt/libmongocrypt/CODEOWNERS

@@ -1,7 +1,7 @@
 # Code Owners will automatically be added as reviewers on PRs
 
+# Listing code owners is required by DRIVERS-3098
+* @mongodb/dbx-c-cxx
+
 # Python Bindings
 bindings/python @mongodb/dbx-python
-
-# Java Bindings
-bindings/java @jyemin @rozza

data/ext/libmongocrypt/libmongocrypt/CONTRIBUTING.md

@@ -0,0 +1,14 @@
+# Formatting
+
+To format, install `pipx` and run:
+```bash
+./etc/format-all.sh
+```
+
+To use a specified python install, set `MONGOCRYPT_PYTHON`:
+
+```bash
+# Set MONGOCRYPT_PYTHON to a python install with pipx installed.
+export MONGOCRYPT_PYTHON=python
+./etc/format-all.sh
+```

data/ext/libmongocrypt/libmongocrypt/Earthfile

@@ -50,15 +50,16 @@
     #   • sles15 - OpenSUSE Leap 15.0
     #   • alpine - Alpine Linux 3.18
     #
-    # When adding new environments, always pull from a fully-qualified image ID:
+    # When adding new environments, prefer an unqualified image ID with a version:
     #   • DO NOT: "ubuntu"
     #   • DO NOT: "ubuntu:latest"
-    #   • DO NOT: "ubuntu:22.10"
-    #   • DO: "docker.io/library/ubuntu:22.10"
+    #   • DO NOT: "docker.io/library/ubuntu:22.10"
+    #   • DO: "ubuntu:22.10"
+    # Use of an unqualified image ID may enable separate registry in CI and local development.
 # ###
 
 VERSION --use-cache-command 0.6
-FROM docker.io/library/alpine:3.16
+FROM alpine:3.16
 WORKDIR /s
 
 init:
@@ -125,24 +126,24 @@ ALPINE_SETUP:
 
 env.c6:
     # A CentOS 6 environment.
-    FROM +init --base=docker.io/library/centos:6
+    FROM +init --base=centos:6
     DO +CENTOS6_SETUP
 
 env.c7:
     # A CentOS 7 environment.
-    FROM +init --base=docker.io/library/centos:7
+    FROM +init --base=centos:7
     DO +REDHAT_SETUP
 
 env.rl8:
     # CentOS 8 is cancelled. Use RockyLinux 8 for our RHEL 8 environment.
-    FROM +init --base=docker.io/library/rockylinux:8
+    FROM +init --base=rockylinux:8
     DO +REDHAT_SETUP
 
 # Utility command for Ubuntu environments
 ENV_UBUNTU:
     COMMAND
     ARG --required version
-    FROM +init --base=docker.io/library/ubuntu:$version
+    FROM +init --base=ubuntu:$version
     DO +DEBIAN_SETUP
 
 env.u14:
@@ -167,19 +168,19 @@ env.u22:
 
 env.amzn1:
     # An Amazon "1" environment. (AmazonLinux 2018)
-    FROM +init --base=docker.io/library/amazonlinux:2018.03
+    FROM +init --base=amazonlinux:2018.03
     DO +AMZ_SETUP
 
 env.amzn2:
     # An AmazonLinux 2 environment
-    FROM +init --base=docker.io/library/amazonlinux:2
+    FROM +init --base=amazonlinux:2
     DO +AMZ_SETUP
 
 # Utility command for Debian setup
 ENV_DEBIAN:
     COMMAND
     ARG --required version
-    FROM +init --base=docker.io/library/debian:$version
+    FROM +init --base=debian:$version
     IF [ $version = "9.2" ]
         # Update source list for archived Debian stretch packages.
         # Refer: https://unix.stackexchange.com/a/743865/260858
@@ -208,11 +209,11 @@ env.deb12:
 
 env.sles15:
     # An OpenSUSE Leap 15.0 environment.
-    FROM +init --base=docker.io/opensuse/leap:15.0
+    FROM +init --base=opensuse/leap:15.0
     DO +SLES_SETUP
 
 env.alpine:
-    FROM +init --base=docker.io/library/alpine:3.18
+    FROM +init --base=alpine:3.18
     DO +ALPINE_SETUP
 
 # Utility: Warm-up obtaining CMake and Ninja for the build. This is usually
@@ -325,7 +326,7 @@ deb-build:
 
 deb-install-runtime:
     # Install the runtime deb package
-    FROM +init --base=docker.io/library/debian:unstable
+    FROM +init --base=debian:unstable
     COPY +deb-build/debs/libmongocrypt0*.deb /tmp/lmc.deb
     RUN __install /tmp/lmc.deb
 
@@ -354,7 +355,8 @@ packaging-full-test:
     BUILD +rpm-runtime-test
 
 check-format:
-    FROM python:3.11.2-slim-buster
+    FROM +init --base=python:3.11.2-slim-buster
+    RUN __install build-essential # To install `make` to install clang-format.
     RUN pip install pipx
     COPY etc/format* /X/etc/
     COPY .evergreen/init.sh /X/.evergreen/
@@ -461,16 +463,15 @@ sign:
 #
 # See https://docs.devprod.prod.corp.mongodb.com/mms/python/src/sbom/silkbomb/ for documentation of silkbomb.
 silkbomb:
-    FROM artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:1.0
-    # Alias the silkbom executable to a simpler name:
+    FROM artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0
+    # Alias the silkbomb executable to a simpler name:
     RUN ln -s /python/src/sbom/silkbomb/bin /usr/local/bin/silkbomb
 
 # sbom-generate:
 #   Generate/update the etc/cyclonedx.sbom.json file from the etc/purls.txt file.
 #
 # This target will update the existing etc/cyclonedx.sbom.json file in-place based
-# on the content of etc/purls.txt.
-#
+# on the content of etc/purls.txt and etc/cyclonedx.sbom.json.
 sbom-generate:
     FROM +silkbomb
     # Copy in the relevant files:
@@ -478,45 +479,44 @@ sbom-generate:
     COPY etc/purls.txt etc/cyclonedx.sbom.json /s/
     # Update the SBOM file:
     RUN silkbomb update \
+        --refresh \
+        --no-update-sbom-version \
         --purls purls.txt \
         --sbom-in cyclonedx.sbom.json \
         --sbom-out cyclonedx.sbom.json
     # Save the result back to the host:
     SAVE ARTIFACT /s/cyclonedx.sbom.json AS LOCAL etc/cyclonedx.sbom.json
 
-# sbom-download:
-#   Download the Augmented SBOM file from Silk.
-#
-# See https://wiki.corp.mongodb.com/display/DRIVERS/Using+AWS+Secrets+Manager+to+Store+Testing+Secrets for instructions to get secrets from AWS Secrets Manager. Secrets are available under `drivers/libmongocrypt`.
+# sbom-generate-new-serial-number:
+#   Equivalent to +sbom-generate but includes the --generate-new-serial-number
+#   flag to generate a new unique serial number and reset the SBOM version to 1.
 #
-sbom-download:
-    ARG --required out
-    ARG --required branch
+# This target will update the existing etc/cyclonedx.sbom.json file in-place based
+# on the content of etc/purls.txt and etc/cyclonedx.sbom.json.
+sbom-generate-new-serial-number:
     FROM +silkbomb
+    # Copy in the relevant files:
     WORKDIR /s
-    # Download the Augmented SBOM file:
-    RUN --no-cache --secret silk_client_id --secret silk_client_secret \
-        SILK_CLIENT_ID=${silk_client_id} \
-        SILK_CLIENT_SECRET=${silk_client_secret} \
-        silkbomb download \
-        --sbom-out cyclonedx.augmented.sbom.json \
-        --silk-asset-group libmongocrypt-${branch}
+    COPY etc/purls.txt etc/cyclonedx.sbom.json /s/
+    # Update the SBOM file:
+    RUN silkbomb update \
+        --refresh \
+        --generate-new-serial-number \
+        --purls purls.txt \
+        --sbom-in cyclonedx.sbom.json \
+        --sbom-out cyclonedx.sbom.json
     # Save the result back to the host:
-    SAVE ARTIFACT /s/cyclonedx.augmented.sbom.json AS LOCAL ${out}
-    RUN echo "Augmented SBOM saved to ${out}"
+    SAVE ARTIFACT /s/cyclonedx.sbom.json AS LOCAL etc/cyclonedx.sbom.json
 
-# silk-create-asset-group:
-#   Create an asset group for Silk.
-#
-# See https://wiki.corp.mongodb.com/display/DRIVERS/Using+AWS+Secrets+Manager+to+Store+Testing+Secrets for instructions to get secrets from AWS Secrets Manager. Secrets are available under `drivers/libmongocrypt`.
-#
-silk-create-asset-group:
-    ARG --required branch
-    FROM +env.alpine
-    RUN __install curl jq
-    COPY etc/silk-create-asset-group.sh /s/silk-create-asset-group.sh
-    RUN --no-cache --secret silk_client_id --secret silk_client_secret \
-        silk_client_id=${silk_client_id} \
-        silk_client_secret=${silk_client_secret} \
-        branch=${branch} \
-            /s/silk-create-asset-group.sh
+# sbom-validate:
+#   Validate the SBOM Lite for the given branch.
+sbom-validate:
+    FROM +silkbomb
+    # Copy in the relevant files:
+    WORKDIR /s
+    COPY etc/purls.txt etc/cyclonedx.sbom.json /s/
+    # Run the SilkBomb tool to download the artifact that matches the requested branch
+    RUN silkbomb validate \
+        --purls purls.txt \
+        --sbom-in cyclonedx.sbom.json \
+        --exclude jira

data/ext/libmongocrypt/libmongocrypt/README.md

@@ -95,15 +95,6 @@ If there are errors with cmake configuration, send the set of steps you performe
 
 If there are compilation or linker errors, run `make` again, setting `VERBOSE=1` in the environment or on the command line (which shows exact compile and link commands), and send the output to the maintainers of this project.
 
-### Design Principles ###
-The design of libmongocrypt adheres to these principles.
-
-#### Easy to integrate ####
-The main reason behind creating a C library is to make it easier for drivers to support FLE. Some consequences of this principle: the API is minimal, structs are opaque, and global initialization is lazy.
-
-#### Lightweight ####
-We decided against the "have libmongocrypt do everything" approach because it complicated integration, especially with async drivers. Because of this we decided no I/O occurs in libmongocrypt.
-
 ### Releasing ###
 
 See [releasing](./doc/releasing.md).
@@ -112,7 +103,7 @@ See [releasing](./doc/releasing.md).
 Distribution packages (i.e., .deb/.rpm) are built and published for several Linux distributions.  The installation of these packages for supported platforms is documented here.
 
 ### Unstable Development Distribution Packages ###
-To install the latest unstable development package, change `1.12` to `development` in the package URLs listed in the subsequent instructions. For example, `https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/1.12` in the instructions would become `https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/development`. Do not use the unstable version of libmongocrypt in a production environment.
+To install the latest unstable development package, change `1.14` to `development` in the package URLs listed in the subsequent instructions. For example, `https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/1.14` in the instructions would become `https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/development`. Do not use the unstable version of libmongocrypt in a production environment.
 
 ### .deb Packages (Debian and Ubuntu) ###
 
@@ -153,13 +144,13 @@ sudo sh -c 'curl -s --location https://pgp.mongodb.com/libmongocrypt.asc | gpg -
 Second, create a list entry for the repository.  For Ubuntu systems (be sure to change `<release>` to `xenial`, `bionic`, `focal`, or `jammy`, as appropriate to your system):
 
 ```
-echo "deb https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/1.12 universe" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list
+echo "deb https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/1.14 universe" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list
 ```
 
 For Debian systems (be sure to change `<release>` to `stretch`, `buster`, `bullseye`, or `bookworm` as appropriate to your system):
 
 ```
-echo "deb https://libmongocrypt.s3.amazonaws.com/apt/debian <release>/libmongocrypt/1.12 main" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list
+echo "deb https://libmongocrypt.s3.amazonaws.com/apt/debian <release>/libmongocrypt/1.14 main" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list
 ```
 
 #### Package installation ####
@@ -181,7 +172,7 @@ Create the file `/etc/yum.repos.d/libmongocrypt.repo` with contents:
 ```
 [libmongocrypt]
 name=libmongocrypt repository
-baseurl=https://libmongocrypt.s3.amazonaws.com/yum/redhat/$releasever/libmongocrypt/1.12/x86_64
+baseurl=https://libmongocrypt.s3.amazonaws.com/yum/redhat/$releasever/libmongocrypt/1.14/x86_64
 gpgcheck=1
 enabled=1
 gpgkey=https://pgp.mongodb.com/libmongocrypt.asc
@@ -200,7 +191,7 @@ Create the file `/etc/yum.repos.d/libmongocrypt.repo` with contents:
 ```
 [libmongocrypt]
 name=libmongocrypt repository
-baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2023/libmongocrypt/1.12/x86_64
+baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2023/libmongocrypt/1.14/x86_64
 gpgcheck=1
 enabled=1
 gpgkey=https://pgp.mongodb.com/libmongocrypt.asc
@@ -219,7 +210,7 @@ Create the file `/etc/yum.repos.d/libmongocrypt.repo` with contents:
 ```
 [libmongocrypt]
 name=libmongocrypt repository
-baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2/libmongocrypt/1.12/x86_64
+baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2/libmongocrypt/1.14/x86_64
 gpgcheck=1
 enabled=1
 gpgkey=https://pgp.mongodb.com/libmongocrypt.asc
@@ -238,7 +229,7 @@ Create the file `/etc/yum.repos.d/libmongocrypt.repo` with contents:
 ```
 [libmongocrypt]
 name=libmongocrypt repository
-baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2013.03/libmongocrypt/1.12/x86_64
+baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2013.03/libmongocrypt/1.14/x86_64
 gpgcheck=1
 enabled=1
 gpgkey=https://pgp.mongodb.com/libmongocrypt.asc
@@ -261,7 +252,7 @@ sudo rpm --import https://pgp.mongodb.com/libmongocrypt.asc
 Second, add the repository (be sure to change `<release>` to `12` or `15`, as appropriate to your system):
 
 ```
-sudo zypper addrepo --gpgcheck "https://libmongocrypt.s3.amazonaws.com/zypper/suse/<release>/libmongocrypt/1.12/x86_64" libmongocrypt
+sudo zypper addrepo --gpgcheck "https://libmongocrypt.s3.amazonaws.com/zypper/suse/<release>/libmongocrypt/1.14/x86_64" libmongocrypt
 ```
 
 Finally, install the libmongocrypt packages:

data/ext/libmongocrypt/libmongocrypt/bindings/python/CHANGELOG.rst

@@ -1,6 +1,19 @@
 Changelog
 =========
 
+Changes in Version 1.13.0
+-------------------------
+
+- Bundle libmongocrypt 1.13.1 in release wheels.
+- Add support for the ``key_expiration_ms`` option to ``MongoCryptOptions``.
+- Add support for ``$lookup`` in CSFLE and QE.
+
+Changes in Version 1.12.0
+-------------------------
+
+- Bundle libmongocrypt 1.12.0 in release wheels.
+- Add support for kms retries.
+
 Changes in Version 1.11.0
 -------------------------
 

data/ext/libmongocrypt/libmongocrypt/bindings/python/CONTRIBUTING.md

@@ -0,0 +1,34 @@
+# Contributing to PyMongoCrypt
+
+## Asyncio considerations
+PyMongoCrypt adds asyncio capability by modifying the source files in */asynchronous to */synchronous using [unasync](https://github.com/python-trio/unasync/) and some custom transforms.
+
+Where possible, edit the code in `*/asynchronous/*.py` and not the synchronous files. You can run `pre-commit run --all-files synchro` before running tests if you are testing synchronous code.
+
+To prevent the synchro hook from accidentally overwriting code, it first checks to see whether a sync version of a file is changing and not its async counterpart, and will fail. In the unlikely scenario that you want to override this behavior, first export `OVERRIDE_SYNCHRO_CHECK=1`.
+
+Sometimes, the synchro hook will fail and introduce changes many previously unmodified files. This is due to static Python errors, such as missing imports, incorrect syntax, or other fatal typos. To resolve these issues, run `pre-commit run --all-files --hook-stage manual ruff` and fix all reported errors before running the synchro hook again.
+
+## Updating the libmongocrypt bindings
+
+To update the libmongocrypt bindings in `pymongocrypt/binding.py`, run the following script:
+
+```bash
+python scripts/update_binding.py
+```
+
+## Update the bundled version of libmongocrypt
+
+To update the bundled version of libmongocrypt, run the following script:
+
+```bash
+bash script/update-version.sh <new-version>
+```
+
+This will set the version in `scripts/libmongocrypt-version.sh` and update `sbom.json` to reflect
+the new vendored version of `libmongocrypt`.
+
+## Building wheels
+
+To build wheels, run `scripts/release.sh`.  It will build the appropriate wheel for the current system
+on Windows and MacOS.  If docker is available on Linux or MacOS, it will build the manylinux wheels.

data/ext/libmongocrypt/libmongocrypt/bindings/python/README.rst

@@ -34,7 +34,7 @@ Please open a case in our issue management tool, JIRA:
 - Navigate to `the PYTHON project <https://jira.mongodb.org/browse/PYTHON>`_.
 - Click **Create Issue** - Please provide as much information as possible about the issue type and how to reproduce it.
 
-Bug reports in JIRA for all driver projects (i.e. PYTHON, CSHARP, JAVA) and the
+Bug reports in JIRA for all driver projects (i.e. PYTHON, CSHARP) and the
 Core Server (i.e. SERVER) project are **public**.
 
 How To Ask For Help

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/asynchronous/state_machine.py

@@ -46,7 +46,7 @@ class AsyncMongoCryptCallback(ABC):
           - `filter`: The filter to pass to listCollections.
 
         :Returns:
-          The first document from the listCollections command response as BSON.
+          The all or first document from the listCollections command response as BSON.
         """
 
     @abstractmethod
@@ -125,7 +125,11 @@ async def run_state_machine(ctx, callback):
             list_colls_filter = ctx.mongo_operation()
             coll_info = await callback.collection_info(ctx.database, list_colls_filter)
             if coll_info:
-                ctx.add_mongo_operation_result(coll_info)
+                if isinstance(coll_info, list):
+                    for i in coll_info:
+                        ctx.add_mongo_operation_result(i)
+                else:
+                    ctx.add_mongo_operation_result(coll_info)
             ctx.complete_mongo_operation()
         elif state == lib.MONGOCRYPT_CTX_NEED_MONGO_MARKINGS:
             mongocryptd_cmd = ctx.mongo_operation()

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/binding.py

@@ -29,9 +29,10 @@ def _parse_version(version):
 
 ffi = cffi.FFI()
 
-# Generated with strip_header.py
+# Start embedding from update_binding.py
 ffi.cdef(
-    """/*
+    """
+/*
  * Copyright 2019-present MongoDB, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -312,6 +313,27 @@ mongocrypt_t *mongocrypt_new(void);
  */
 bool mongocrypt_setopt_log_handler(mongocrypt_t *crypt, mongocrypt_log_fn_t log_fn, void *log_ctx);
 
+/**
+ * Enable or disable KMS retry behavior.
+ *
+ * @param[in] crypt The @ref mongocrypt_t object.
+ * @param[in] enable A boolean indicating whether to retry operations.
+ * @pre @ref mongocrypt_init has not been called on @p crypt.
+ * @returns A boolean indicating success. If false, an error status is set.
+ * Retrieve it with @ref mongocrypt_ctx_status
+ */
+bool mongocrypt_setopt_retry_kms(mongocrypt_t *crypt, bool enable);
+
+/**
+ * Enable support for multiple collection schemas. Required to support $lookup.
+ *
+ * @param[in] crypt The @ref mongocrypt_t object.
+ * @pre @ref mongocrypt_init has not been called on @p crypt.
+ * @returns A boolean indicating success. If false, an error status is set.
+ * Retrieve it with @ref mongocrypt_ctx_status
+ */
+bool mongocrypt_setopt_enable_multiple_collinfo(mongocrypt_t *crypt);
+
 /**
  * Configure an AWS KMS provider on the @ref mongocrypt_t object.
  *
@@ -1042,6 +1064,8 @@ typedef struct _mongocrypt_kms_ctx_t mongocrypt_kms_ctx_t;
  * If KMS handles are being handled synchronously, the driver can reuse the same
  * TLS socket to send HTTP requests and receive responses.
  *
+ * The returned KMS handle does not outlive `ctx`.
+ *
  * @param[in] ctx A @ref mongocrypt_ctx_t.
  * @returns a new @ref mongocrypt_kms_ctx_t or NULL.
  */
@@ -1086,6 +1110,14 @@ bool mongocrypt_kms_ctx_endpoint(mongocrypt_kms_ctx_t *kms, const char **endpoin
  */
 uint32_t mongocrypt_kms_ctx_bytes_needed(mongocrypt_kms_ctx_t *kms);
 
+/**
+ * Indicates how long to sleep before sending this request.
+ *
+ * @param[in] kms The @ref mongocrypt_kms_ctx_t.
+ * @returns How long to sleep in microseconds.
+ */
+int64_t mongocrypt_kms_ctx_usleep(mongocrypt_kms_ctx_t *kms);
+
 /**
  * Feed bytes from the HTTP response.
  *
@@ -1100,6 +1132,14 @@ uint32_t mongocrypt_kms_ctx_bytes_needed(mongocrypt_kms_ctx_t *kms);
  */
 bool mongocrypt_kms_ctx_feed(mongocrypt_kms_ctx_t *kms, mongocrypt_binary_t *bytes);
 
+/**
+ * Indicate a network-level failure.
+ *
+ * @param[in] kms The @ref mongocrypt_kms_ctx_t.
+ * @return A boolean indicating whether the failed request may be retried.
+ */
+bool mongocrypt_kms_ctx_fail(mongocrypt_kms_ctx_t *kms);
+
 /**
  * Get the status associated with a @ref mongocrypt_kms_ctx_t object.
  *
@@ -1413,7 +1453,7 @@ bool mongocrypt_ctx_setopt_query_type(mongocrypt_ctx_t *ctx, const char *query_t
  * {
  *    "min": Optional<BSON value>,
  *    "max": Optional<BSON value>,
- *    "sparsity": Int64,
+ *    "sparsity": Optional<Int64>,
  *    "precision": Optional<Int32>,
  *    "trimFactor": Optional<Int32>
  * }
@@ -1426,10 +1466,24 @@ bool mongocrypt_ctx_setopt_query_type(mongocrypt_ctx_t *ctx, const char *query_t
  */
 bool mongocrypt_ctx_setopt_algorithm_range(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *opts);
 
+/**
+ * Set the expiration time for the data encryption key cache. Defaults to 60 seconds if not set.
+ *
+ * @param[in] ctx The @ref mongocrypt_ctx_t object.
+ * @param[in] cache_expiration_ms The cache expiration time in milliseconds. If zero, the cache
+ * never expires.
+ */
+bool mongocrypt_setopt_key_expiration(mongocrypt_t *crypt, uint64_t cache_expiration_ms);
+
 /// String constants for setopt_query_type
 // DEPRECATED: Support "rangePreview" has been removed in favor of "range".
+/// NOTE: "substringPreview" is experimental and may be removed in a future non-major release.
+/// NOTE: "suffixPreview" is experimental and may be removed in a future non-major release.
+/// NOTE: "prefixPreview" is experimental and may be removed in a future non-major release.
+
 """
 )
+# End embedding from update_binding.py
 
 
 def _to_string(cdata):