libmongocrypt-helper 1.12.0.0.1001 → 1.14.0.0.1001

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/mongocrypt.py

@@ -96,6 +96,9 @@ class MongoCrypt:
         if self.__opts.bypass_query_analysis:
             lib.mongocrypt_setopt_bypass_query_analysis(self.__crypt)
 
+        if self.__opts.enable_multiple_collinfo:
+            lib.mongocrypt_setopt_enable_multiple_collinfo(self.__crypt)
+
         # Prefer using the native crypto binding when we know it's available.
         try:
             crypto_available = lib.mongocrypt_is_crypto_available()
@@ -149,6 +152,19 @@ class MongoCrypt:
         if any([on_demand_aws, on_demand_gcp, on_demand_azure]):
             lib.mongocrypt_setopt_use_need_kms_credentials_state(self.__crypt)
 
+        # Enable KMS retry and key_expiration_ms when available, libmongocrypt >= 1.12.0,
+        try:
+            if not lib.mongocrypt_setopt_retry_kms(self.__crypt, True):
+                self.__raise_from_status()
+            if self.__opts.key_expiration_ms is not None:
+                if not lib.mongocrypt_setopt_key_expiration(
+                    self.__crypt, self.__opts.key_expiration_ms
+                ):
+                    self.__raise_from_status()
+        except AttributeError:
+            # libmongocrypt < 1.12
+            pass
+
         if not lib.mongocrypt_init(self.__crypt):
             self.__raise_from_status()
 
@@ -670,6 +686,30 @@ class MongoCryptKmsContext:
             if not lib.mongocrypt_kms_ctx_feed(self.__ctx, binary.bin):
                 self.__raise_from_status()
 
+    @property
+    def usleep(self):
+        """Indicates how long to sleep in microseconds before sending this request.
+
+        .. versionadded:: 1.12
+        """
+        try:
+            return lib.mongocrypt_kms_ctx_usleep(self.__ctx)
+        except AttributeError:
+            # libmongocrypt < 1.12
+            return 0
+
+    def fail(self):
+        """Indicate a network-level failure.
+
+        .. versionadded:: 1.12
+        """
+        try:
+            if not lib.mongocrypt_kms_ctx_fail(self.__ctx):
+                self.__raise_from_status()
+        except AttributeError:
+            # libmongocrypt < 1.12
+            pass
+
     def __raise_from_status(self):
         status = lib.mongocrypt_status_new()
         try:

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/options.py

@@ -11,6 +11,8 @@ class MongoCryptOptions:
         crypt_shared_lib_path=None,
         crypt_shared_lib_required=False,
         bypass_encryption=False,
+        key_expiration_ms=None,
+        enable_multiple_collinfo=False,
     ):
         """Options for :class:`MongoCrypt`.
 
@@ -53,6 +55,11 @@ class MongoCryptOptions:
           - `crypt_shared_lib_required`: Whether to require a crypt_shared
             library.
           - `bypass_encryption`: Whether to bypass encryption.
+          - `key_expiration_ms` (int): The cache expiration time for data
+            encryption keys. Defaults to 60000. 0 means keys never expire.
+
+        .. versionadded:: 1.13
+           Added the ``key_expiration_ms`` parameter.
 
         .. versionremoved:: 1.11
            Removed the ``enable_range_v2`` parameter.
@@ -136,6 +143,11 @@ class MongoCryptOptions:
             encrypted_fields_map, bytes
         ):
             raise TypeError("encrypted_fields_map must be bytes or None")
+        if key_expiration_ms is not None:
+            if not isinstance(key_expiration_ms, int):
+                raise TypeError("key_expiration_ms must be int or None")
+            if key_expiration_ms < 0:
+                raise ValueError("key_expiration_ms must be >=0 or None")
 
         self.kms_providers = kms_providers
         self.schema_map = schema_map
@@ -144,6 +156,8 @@ class MongoCryptOptions:
         self.crypt_shared_lib_path = crypt_shared_lib_path
         self.crypt_shared_lib_required = crypt_shared_lib_required
         self.bypass_encryption = bypass_encryption
+        self.key_expiration_ms = key_expiration_ms
+        self.enable_multiple_collinfo = enable_multiple_collinfo
 
 
 class ExplicitEncryptOpts:

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/synchronous/state_machine.py

@@ -46,7 +46,7 @@ class MongoCryptCallback(ABC):
           - `filter`: The filter to pass to listCollections.
 
         :Returns:
-          The first document from the listCollections command response as BSON.
+          The all or first document from the listCollections command response as BSON.
         """
 
     @abstractmethod
@@ -125,7 +125,11 @@ def run_state_machine(ctx, callback):
             list_colls_filter = ctx.mongo_operation()
             coll_info = callback.collection_info(ctx.database, list_colls_filter)
             if coll_info:
-                ctx.add_mongo_operation_result(coll_info)
+                if isinstance(coll_info, list):
+                    for i in coll_info:
+                        ctx.add_mongo_operation_result(i)
+                else:
+                    ctx.add_mongo_operation_result(coll_info)
             ctx.complete_mongo_operation()
         elif state == lib.MONGOCRYPT_CTX_NEED_MONGO_MARKINGS:
             mongocryptd_cmd = ctx.mongo_operation()

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/version.py

@@ -12,6 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-__version__ = "1.12.0.dev0"
+__version__ = "1.14.0.dev0"
 
 _MIN_LIBMONGOCRYPT_VERSION = "1.8.0"

data/ext/libmongocrypt/libmongocrypt/bindings/python/sbom.json

@@ -1,31 +1,31 @@
 {
   "components": [
     {
-      "bom-ref": "pkg:github/mongodb/libmongocrypt@1.11.0",
+      "bom-ref": "pkg:github/mongodb/libmongocrypt@1.13.1",
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://github.com/mongodb/libmongocrypt/archive/refs/tags/1.11.0.tar.gz"
+          "url": "https://github.com/mongodb/libmongocrypt/archive/refs/tags/1.13.1.tar.gz"
         },
         {
           "type": "website",
-          "url": "https://github.com/mongodb/libmongocrypt/tree/1.11.0"
+          "url": "https://github.com/mongodb/libmongocrypt/tree/1.13.1"
         }
       ],
       "group": "mongodb",
       "name": "libmongocrypt",
-      "purl": "pkg:github/mongodb/libmongocrypt@1.11.0",
+      "purl": "pkg:github/mongodb/libmongocrypt@1.13.1",
       "type": "library",
-      "version": "1.11.0"
+      "version": "1.13.1"
     }
   ],
   "dependencies": [
     {
-      "ref": "pkg:github/mongodb/libmongocrypt@1.11.0"
+      "ref": "pkg:github/mongodb/libmongocrypt@1.13.1"
     }
   ],
   "metadata": {
-    "timestamp": "2024-08-08T02:35:36.986098+00:00",
+    "timestamp": "2025-04-01T19:53:54.393395+00:00",
     "tools": [
       {
         "externalReferences": [
@@ -68,7 +68,7 @@
       }
     ]
   },
-  "serialNumber": "urn:uuid:14e22848-7554-4f82-bcd1-76d2891b4c66",
+  "serialNumber": "urn:uuid:a5e0a753-031f-43e3-ac20-f39b878c46e1",
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",

data/ext/libmongocrypt/libmongocrypt/bindings/python/scripts/libmongocrypt-version.txt

@@ -0,0 +1 @@
+1.13.1

data/ext/libmongocrypt/libmongocrypt/bindings/python/{release.sh → scripts/release.sh}

@@ -15,14 +15,19 @@
 set -o xtrace   # Write all commands first to stderr
 set -o errexit  # Exit the script with error if any of the commands fail
 
+SCRIPT_DIR=$(dirname ${BASH_SOURCE:-$0})
+
 # The libmongocrypt git revision release to embed in our wheels.
-LIBMONGOCRYPT_VERSION=$(cat ./libmongocrypt-version.txt)
+LIBMONGOCRYPT_VERSION=$(cat $SCRIPT_DIR/libmongocrypt-version.txt)
 REVISION=$(git rev-list -n 1 $LIBMONGOCRYPT_VERSION)
 # The libmongocrypt release branch.
-BRANCH="r1.11"
+MINOR_VERSION=$(echo $LIBMONGOCRYPT_VERSION | cut -d. -f1,2)
+BRANCH="r${MINOR_VERSION}"
 # The python executable to use.
 PYTHON=${PYTHON:-python}
 
+pushd $SCRIPT_DIR/..
+
 # Clean slate.
 rm -rf dist .venv build libmongocrypt pymongocrypt/*.so pymongocrypt/*.dll pymongocrypt/*.dylib
 
@@ -48,7 +53,7 @@ function build_wheel() {
 function build_manylinux_wheel() {
     python -m pip install unasync
     docker pull $1
-    docker run --rm -v `pwd`:/python $1 /python/build-manylinux-wheel.sh
+    docker run --rm -v `pwd`:/python $1 /python/scripts/build-manylinux-wheel.sh
     # Sudo is needed to remove the files created by docker.
     sudo rm -rf build libmongocrypt pymongocrypt/*.so pymongocrypt/*.dll pymongocrypt/*.dylib
 }
@@ -126,3 +131,4 @@ if [ $(command -v docker) ]; then
 fi
 
 ls -ltr dist
+popd

data/ext/libmongocrypt/libmongocrypt/bindings/python/{synchro.py → scripts/synchro.py}

@@ -12,6 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import os
+import sys
 from os import listdir
 from pathlib import Path
 
@@ -27,12 +29,14 @@ replacements = {
     "aclose": "close",
 }
 
-_base = "pymongocrypt"
+ROOT = Path(__file__).absolute().parent.parent
+
+_base = ROOT / "pymongocrypt"
 
 async_files = [
-    f"./{_base}/asynchronous/{f}"
-    for f in listdir("pymongocrypt/asynchronous")
-    if (Path(_base) / "asynchronous" / f).is_file()
+    f"{_base}/asynchronous/{f}"
+    for f in listdir(f"{_base}/asynchronous")
+    if (_base / "asynchronous" / f).is_file()
 ]
 
 
@@ -40,20 +44,23 @@ unasync_files(
     async_files,
     [
         Rule(
-            fromdir="/pymongocrypt/asynchronous/",
-            todir="/pymongocrypt/synchronous/",
+            fromdir=f"{_base}/asynchronous/",
+            todir=f"{_base}/synchronous/",
             additional_replacements=replacements,
         )
     ],
 )
 
 sync_files = [
-    f"./{_base}/synchronous/{f}"
-    for f in listdir("pymongocrypt/synchronous")
-    if (Path(_base) / "synchronous" / f).is_file()
+    f"{_base}/synchronous/{f}"
+    for f in listdir(f"{_base}/synchronous")
+    if (_base / "synchronous" / f).is_file()
 ]
 
+modified_files = [f"./{f}" for f in sys.argv[1:]]
 for file in sync_files:
+    if file in modified_files and "OVERRIDE_SYNCHRO_CHECK" not in os.environ:
+        raise ValueError(f"Refusing to overwrite {file}")
     with open(file, "r+") as f:
         lines = f.readlines()
         for i in range(len(lines)):

data/ext/libmongocrypt/libmongocrypt/bindings/python/scripts/synchro.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+
+set -eu
+
+SCRIPT_DIR=$(dirname ${BASH_SOURCE:-$0})
+
+python $SCRIPT_DIR/synchro.py "$@"
+python -m ruff check $SCRIPT_DIR/../pymongocrypt/synchronous --fix --silent

data/ext/libmongocrypt/libmongocrypt/bindings/python/scripts/update-version.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+
+set -eu
+
+SCRIPT_DIR=$(dirname ${BASH_SOURCE:-$0})
+
+if [ -z "${1:-}" ]; then
+    echo "Provide the new version of libmongocrypt!"
+    exit 1
+fi
+
+LIBMONGOCRYPT_VERSION=$1
+
+echo $LIBMONGOCRYPT_VERSION > $SCRIPT_DIR/libmongocrypt-version.txt
+
+pushd $SCRIPT_DIR/..
+if [ $(command -v podman) ]; then
+    DOCKER=podman
+else
+    DOCKER=docker
+fi
+
+echo "pkg:github/mongodb/libmongocrypt@$LIBMONGOCRYPT_VERSION" > purls.txt
+$DOCKER run --platform="linux/amd64" -it --rm -v $(pwd):$(pwd) artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0 update --purls=$(pwd)/purls.txt -o $(pwd)/sbom.json
+rm purls.txt
+
+popd

data/ext/libmongocrypt/libmongocrypt/bindings/python/scripts/update_binding.py

@@ -0,0 +1,78 @@
+# Copyright 2019-present MongoDB, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Update pymongocrypt/bindings.py using mongocrypt.h.
+"""
+
+import re
+from pathlib import Path
+
+DROP_RE = re.compile(r"^\s*(#|MONGOCRYPT_EXPORT)")
+HERE = Path(__file__).absolute().parent
+
+
+# itertools.pairwise backport for Python 3.9 support.
+def pairwise(iterable):
+    # pairwise('ABCDEFG') → AB BC CD DE EF FG
+
+    iterator = iter(iterable)
+    a = next(iterator, None)
+
+    for b in iterator:
+        yield a, b
+        a = b
+
+
+def strip_file(content):
+    fold = content.replace("\\\n", " ")
+    all_lines = [*fold.split("\n"), ""]
+    keep_lines = (line for line in all_lines if not DROP_RE.match(line))
+    fin = ""
+    for line, peek in pairwise(keep_lines):
+        if peek == "" and line == "":
+            # Drop adjacent empty lines
+            continue
+        yield line
+        fin = peek
+    yield fin
+
+
+def update_bindings():
+    header_file = HERE.parent.parent.parent / "src/mongocrypt.h"
+    with header_file.open(encoding="utf-8") as fp:
+        header_lines = strip_file(fp.read())
+
+    target = HERE.parent / "pymongocrypt/binding.py"
+    source_lines = target.read_text().splitlines()
+    new_lines = []
+    skip = False
+    for line in source_lines:
+        if not skip:
+            new_lines.append(line)
+        if line.strip() == "# Start embedding from update_binding.py":
+            skip = True
+            new_lines.append("ffi.cdef(")
+            new_lines.append('"""')
+            new_lines.extend(header_lines)
+        if line.strip() == "# End embedding from update_binding.py":
+            new_lines.append('"""')
+            new_lines.append(")")
+            new_lines.append(line)
+            skip = False
+    with target.open("w") as f:
+        f.write("\n".join(new_lines))
+
+
+if __name__ == "__main__":
+    update_bindings()

data/ext/libmongocrypt/libmongocrypt/bindings/python/test/data/compact/success/encrypted-field-config-map.json

@@ -1,7 +1,6 @@
 {
     "db.test": {
         "escCollection": "esc",
-        "eccCollection": "ecc",
         "ecocCollection": "ecoc",
         "fields": [
             {

data/ext/libmongocrypt/libmongocrypt/bindings/python/test/data/encrypted-field-config-map.json

@@ -1,7 +1,6 @@
 {
     "test.test": {
         "escCollection": "fle2.basic.esc",
-        "eccCollection": "fle2.basic.ecc",
         "ecocCollection": "fle2.basic.ecoc",
         "fields": [
             {
@@ -24,7 +23,6 @@
     },
     "test.test2": {
         "escCollection": "fle2.basic.esc",
-        "eccCollection": "fle2.basic.ecc",
         "ecocCollection": "fle2.basic.ecoc",
         "fields": [
             {

data/ext/libmongocrypt/libmongocrypt/bindings/python/test/test_mongocrypt.py

@@ -143,6 +143,11 @@ class TestMongoCryptOptions(unittest.TestCase):
         )
         self.assertEqual(opts.encrypted_fields_map, encrypted_fields_map)
         self.assertTrue(opts.bypass_query_analysis)
+        for expiration in [0, 1, 1000000]:
+            opts = MongoCryptOptions(
+                valid[0][0], schema_map, key_expiration_ms=expiration
+            )
+            self.assertEqual(opts.key_expiration_ms, expiration)
 
     def test_mongocrypt_options_validation(self):
         with self.assertRaisesRegex(
@@ -192,6 +197,12 @@ class TestMongoCryptOptions(unittest.TestCase):
             TypeError, "encrypted_fields_map must be bytes or None"
         ):
             MongoCryptOptions(valid_kms, encrypted_fields_map={})
+        with self.assertRaisesRegex(TypeError, "key_expiration_ms must be int or None"):
+            MongoCryptOptions(valid_kms, key_expiration_ms="123")
+        with self.assertRaisesRegex(
+            ValueError, "key_expiration_ms must be >=0 or None"
+        ):
+            MongoCryptOptions(valid_kms, key_expiration_ms=-1)
 
 
 class TestMongoCrypt(unittest.TestCase):
@@ -507,6 +518,8 @@ class TestMongoCryptCallback(unittest.TestCase):
         os.getenv("TEST_CRYPT_SHARED"), "this test requires TEST_CRYPT_SHARED=1"
     )
     def test_crypt_shared(self):
+        if sys.platform == "darwin":
+            raise unittest.SkipTest("Skipping due to SERVER-101020")
         kms_providers = {
             "aws": {"accessKeyId": "example", "secretAccessKey": "example"},
             "local": {"key": b"\x00" * 96},
@@ -607,7 +620,7 @@ class TestMongoCryptCallback(unittest.TestCase):
         encrypter = AutoEncrypter(callback, opts)
         self.addCleanup(encrypter.close)
 
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             data = {"access_token": "foo"}
             url = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"
             router.add(
@@ -638,6 +651,8 @@ if sys.version_info >= (3, 8, 0):  # noqa: UP036
             os.getenv("TEST_CRYPT_SHARED"), "this test requires TEST_CRYPT_SHARED=1"
         )
         async def test_crypt_shared(self):
+            if sys.platform == "darwin":
+                raise unittest.SkipTest("Skipping due to SERVER-101020")
             kms_providers = {
                 "aws": {"accessKeyId": "example", "secretAccessKey": "example"},
                 "local": {"key": b"\x00" * 96},
@@ -748,7 +763,7 @@ if sys.version_info >= (3, 8, 0):  # noqa: UP036
             encrypter = AsyncAutoEncrypter(callback, opts)
             self.addAsyncCleanup(encrypter.close)
 
-            with respx.mock() as router:
+            with respx.mock(using="httpx") as router:
                 data = {"access_token": "foo"}
                 url = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"
                 router.add(
@@ -1019,7 +1034,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_success(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             data = {"access_token": "foo", "expires_in": 4000}
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
@@ -1034,7 +1049,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_empty_json(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
                 respx.get(url=url).mock(return_value=httpx.Response(200, json={}))
@@ -1048,7 +1063,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_bad_json(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
                 respx.get(url=url).mock(return_value=httpx.Response(200, text="a'"))
@@ -1062,7 +1077,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_http_404(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(respx.get(url=url).mock(return_value=httpx.Response(404)))
             with self.assertRaisesRegex(
@@ -1074,7 +1089,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_http_500(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(respx.get(url=url).mock(return_value=httpx.Response(500)))
             with self.assertRaisesRegex(
@@ -1086,7 +1101,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_slow_response(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
                 respx.get(url=url).mock(side_effect=httpx._exceptions.ConnectTimeout)
@@ -1100,7 +1115,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_cache(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             data = {"access_token": "foo", "expires_in": 4000}
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
@@ -1121,7 +1136,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
 
     def test_cache_expires_soon(self):
         encrypter = self.get_encrypter()
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             data = {"access_token": "foo", "expires_in": 10}
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
@@ -1137,7 +1152,7 @@ class TestNeedKMSAzureCredentials(unittest.TestCase):
         # Should not use the cached value.
         encrypter = self.get_encrypter(False)
         self.assertIsNotNone(pymongocrypt.synchronous.credentials._azure_creds_cache)
-        with respx.mock() as router:
+        with respx.mock(using="httpx") as router:
             url = "http://169.254.169.254/metadata/identity/oauth2/token"
             router.add(
                 respx.get(url=url).mock(side_effect=httpx._exceptions.ConnectTimeout)

data/ext/libmongocrypt/libmongocrypt/cmake/FetchMongoC.cmake

@@ -1,8 +1,8 @@
 include (FetchContent)
 
 # Set the tag that we will fetch.
-# When updating the version of libbson, also update the version in etc/purls.txt
-set (MONGOC_FETCH_TAG_FOR_LIBBSON "1.28.1" CACHE STRING "The Git tag of mongo-c-driver that will be fetched to obtain libbson")
+# When updating the version of libbson, also update the version in etc/purls.txt and .evergreen/prep_c_driver_source.sh
+set (MONGOC_FETCH_TAG_FOR_LIBBSON "1.30.3" CACHE STRING "The Git tag of mongo-c-driver that will be fetched to obtain libbson")
 
 # Add an option to disable patching if a patch command is unavailable.
 option (LIBBSON_PATCH_ENABLED "Whether to apply patches to the libbson library" ON)
@@ -18,6 +18,8 @@ make_patch_command (patch_command
     DISABLED "${patch_disabled}"
     PATCHES
         ${PROJECT_SOURCE_DIR}/etc/libbson-remove-GCC-diagnostic-pragma.patch
+        # Fix old GCC error: "#pragma GCC diagnostic not allowed inside functions". Remove patch after libbson 2.0.0:
+        ${PROJECT_SOURCE_DIR}/etc/libbson-remove-GCC-diagnostic-in-functions.patch
     )
 
 # Fetch the source archive for the requested tag from GitHub

data/ext/libmongocrypt/libmongocrypt/cmake/ImportBSON.cmake

@@ -56,9 +56,9 @@ cmake_push_check_state ()
    # extra-alignment enabled. We want to match that setting as our default, for convenience
    # purposes only.
    find_path (SYSTEM_BSON_INCLUDE_DIR bson/bson.h PATH_SUFFIXES libbson-1.0)
+   set (_extra_alignment_default OFF)
    if (SYSTEM_BSON_INCLUDE_DIR AND NOT DEFINED ENABLE_EXTRA_ALIGNMENT)
       set (CMAKE_REQUIRED_INCLUDES "${SYSTEM_BSON_INCLUDE_DIR}")
-      set (_extra_alignment_default OFF)
       check_c_source_compiles ([[
          #include <bson/bson.h>
 
@@ -140,10 +140,8 @@ function (_import_bson)
       set (ENABLE_SNAPPY OFF CACHE BOOL "Toggle snappy for the mongoc subproject (not required by libmongocrypt)")
       # Disable deprecated automatic init and cleanup. (May be overridden by the user)
       set (ENABLE_AUTOMATIC_INIT_AND_CLEANUP OFF CACHE BOOL "Enable automatic init and cleanup (GCC only)")
-      if (DEFINED _extra_alignment_default)
-         # Disable over-alignment of bson types. (May be overridden by the user)
-         set (ENABLE_EXTRA_ALIGNMENT ${_extra_alignment_default} CACHE BOOL "Toggle extra alignment of bson_t")
-      endif ()
+      # Disable over-alignment of bson types. (May be overridden by the user)
+      set (ENABLE_EXTRA_ALIGNMENT ${_extra_alignment_default} CACHE BOOL "Toggle extra alignment of bson_t")
       # We don't want the subproject to find libmongocrypt
       set (ENABLE_CLIENT_SIDE_ENCRYPTION OFF CACHE BOOL "Disable client-side encryption for the libmongoc subproject")
       # Clear `BUILD_VERSION` so C driver does not use a `BUILD_VERSION` meant for libmongocrypt.