libmongocrypt-helper 1.12.0.0.1001 → 1.14.0.0.1001

data/ext/libmongocrypt/libmongocrypt/doc/releasing.md

@@ -19,7 +19,7 @@ Go to [Snyk](https://app.snyk.io/) and select the `dev-prod` organization. If ac
 
 ##### Update Snyk
 
-Update the Snyk reference target tracking the to-be-released branch. For a patch release (e.g. x.y.z), check-out the `rx.y` branch and update the `rx.y` reference target. For a minor release (e.g. x.y.0), check out the `master` branch update the `master` reference target.
+Update the Snyk reference target tracking the to-be-released branch. For a patch release (e.g. x.y.z), check-out the `rx.y` branch and update the `rx.y` reference target. For a non-patch release (e.g. x.y.0), check out the `master` branch and update the `master` reference target.
 
 Run `cmake` to ensure generated source files are present:
 ```bash
@@ -44,18 +44,15 @@ snyk monitor \
 
 Check the updated reference targets in Snyk for detected vulnerabilities.
 
-#### Check Silk
+#### Check the Augmented SBOM
 
-Get credentials for Silk from the `drivers/libmongocrypt` vault in [AWS Secrets Manager](https://wiki.corp.mongodb.com/display/DRIVERS/Using+AWS+Secrets+Manager+to+Store+Testing+Secrets).
+Examine the Augmented SBOM from a recent execution of the `sbom` task in an Evergreen patch or commit build.
+
+Evergreen CLI may be used to schedule only the `sbom` task:
 
-Download the Augmented SBOM using:
 ```bash
-./.evergreen/earthly.sh \
-   --secret silk_client_id=${silk_client_id} \
-   --secret silk_client_secret=${silk_client_secret} \
-   +sbom-download \
-   --out cyclonedx.augmented.sbom.json \
-   --branch <branch>
+# Ensure `-p` matches the correct Evergreen project for the current branch!
+evergreen patch -y -p libmongocrypt -t all -v sbom -f
 ```
 
 Check the contents of the "vulnerabilities" field (if present) in the Augmented SBOM.
@@ -64,14 +61,14 @@ Check the contents of the "vulnerabilities" field (if present) in the Augmented
 
 Do the following when releasing:
 - If this is a feature release (e.g. `x.y.0` or `x.0.0`), follow these steps: [Creating SSDLC static analysis reports](https://docs.google.com/document/d/1rkFL8ymbkc0k8Apky9w5pTPbvKRm68wj17mPJt2_0yo/edit).
-- Check out the release branch. For a release `x.y.z`, the release branch is `rx.y`. If this is a new minor release (`x.y.0`), create the release branch.
+- Check out the release branch. For a release `x.y.z`, the release branch is `rx.y`. If this is a new non-patch release (`x.y.0`), create the release branch.
 - Update CHANGELOG.md with the version being released.
 - Ensure `etc/purls.txt` is up-to-date.
 - Update `etc/third_party_vulnerabilities.md` with any updates to new or known vulnerabilities for third party dependencies that must be reported.
-- If this is a new minor release (e.g. `x.y.0`):
+- If this is a new non-patch release (e.g. `x.y.0`):
    - Update the Linux distribution package installation instructions in [README.md](../README.md) to refer to the new version `x.y`.
    - Update the [libmongocrypt-release](https://spruce.mongodb.com/project/libmongocrypt-release/settings/general) Evergreen project (requires auth) to set `Branch Name` to `rx.y`.
-- Commit the changes on the `rx.y` branch with a message like "Update CHANGELOG.md for x.y.z".
+- Commit the changes on the `rx.y` branch with a message like "Release x.y.z".
 - Tag the commit with `git tag -a <tag>`.
    - Push both the branch ref and tag ref in the same command: `git push origin master 1.8.0-alpha0` or `git push origin r1.8 1.8.4`
    - Pushing the branch ref and the tag ref in the same command eliminates the possibility of a race condition in Evergreen (for building resources based on the presence of a release tag)
@@ -80,33 +77,20 @@ Do the following when releasing:
    - `upload-all`
    - `windows-upload-release`
    - All `publish-packages` tasks.
-      - If the `publish-packages` tasks fail with an error like `[curator] 2024/01/02 13:56:17 [p=emergency]: problem submitting repobuilder job: 404 (Not Found)`, this suggests the published path does not yet exist. Barque (the Linux package publishing service) has protection to avoid unintentional publishes. File a DEVPROD ticket ([example](https://jira.mongodb.org/browse/DEVPROD-4053)) and assign to the team called Release Infrastructure to request the path be created. Then re-run the failing `publish-packages` task. Ask in the slack channel `#devprod-release-tools` for further help with `Barque` or `curator`.
+      - If the `publish-packages` tasks fail with an error like `[curator] 2024/01/02 13:56:17 [p=emergency]: problem submitting repobuilder job: 404 (Not Found)`, this suggests the published path does not yet exist. Barque (the Linux package publishing service) has protection to avoid unintentional publishes. File a DEVPROD ticket ([example](https://jira.mongodb.org/browse/DEVPROD-15320)) and assign to the team called Release Infrastructure to request the path be created. Then re-run the failing `publish-packages` task. Ask in the slack channel `#ask-devprod-release-tools` for further help with `Barque` or `curator`.
 - Create the release from the GitHub releases page from the new tag.
-   - Attach the tarball and signature file from the Files tab of the `windows-upload-release` task. [Example](https://github.com/mongodb/libmongocrypt/releases/tag/1.10.0).
-   - Attach the Augmented SBOM file. Download the Augmented SBOM using:
-     ```bash
-     ./.evergreen/earthly.sh \
-        --secret silk_client_id=${silk_client_id} \
-        --secret silk_client_secret=${silk_client_secret} \
-        +sbom-download \
-        --out cyclonedx.augmented.sbom.json \
-        --branch <branch>
-     ```
-     For a new minor release, use `master` for `--branch`. For a patch release, use the release branch (e.g. `rx.y`).
-     Secrets can be obtained from [AWS Secrets Manager](https://wiki.corp.mongodb.com/display/DRIVERS/Using+AWS+Secrets+Manager+to+Store+Testing+Secrets) under `drivers/libmongocrypt`.
+   - Attach the tarball and signature file from the Files tab of the `windows-upload-release` task. [Example](https://github.com/mongodb/libmongocrypt/releases/tag/1.13.0).
+   - Attach the Augmented SBOM file to the release as `cyclonedx.augmented.sbom.json`.
+     Download the Augmented SBOM from a recent execution of the `sbom` task in an Evergreen patch or commit build.
    - Attach `etc/third_party_vulnerabilities.md` to the release.
    - Attach `etc/ssdlc_compliance_report.md` to the release.
-
-- If this is a new minor release (e.g. `x.y.0`):
-   - File a DOCSP ticket to update the installation instructions on [Install libmongocrypt](https://www.mongodb.com/docs/manual/core/csfle/reference/libmongocrypt/). ([Example](https://jira.mongodb.org/browse/DOCSP-36863))
-   - Create a new Silk asset group. Use the newly created release branch (e.g. `rx.y`) as the `--branch` argument:
-     ```bash
-     ./.evergreen/earthly.sh \
-        --secret silk_client_id=${silk_client_id} \
-        --secret silk_client_secret=${silk_client_secret} \
-        +silk-create-asset-group \
-        --branch <branch>
-     ```
+- Check out the release branch (`rx.y`). Generate a new unique SBOM serial number for the next upcoming patch release (e.g. for `1.13.1` following the release of `1.13.0`):
+   ```bash
+   ./.evergreen/earthly.sh +sbom-generate-new-serial-number
+   ```
+   Commit resulting `etc/cyclonedx.sbom.json` and push to `rx.y`.
+- If this is a new non-patch release (e.g. `x.y.0`):
+   - File a DOCSP ticket to update the installation instructions on [Install libmongocrypt](https://www.mongodb.com/docs/manual/core/csfle/reference/libmongocrypt/). ([Example](https://jira.mongodb.org/browse/DOCSP-47954))
    - Create a new Snyk reference target. The following instructions use the example branch `rx.y`:
 
      Run `cmake` to ensure generated source files are present:
@@ -130,20 +114,31 @@ Do the following when releasing:
       --remote-repo-url=https://github.com/mongodb/libmongocrypt.git
      ```
      Snyk reference targets for older release branches may be removed if no further releases are expected on the branch.
-- Make a PR to apply the "Update CHANGELOG.md for x.y.z" commit to the `master` branch.
+   - Update the [Github Webhook](https://wiki.corp.mongodb.com/display/INTX/Githook) to include the new branch.
+     - Navigate to the [Webhook Settings](https://github.com/mongodb/libmongocrypt/settings/hooks).
+     - Click `Edit` on the hook for `https://githook.mongodb.com/`.
+     - Add the new release branch to the `Payload URL`. Remove unmaintained release branches.
+- Make a PR to to the `master` branch:
+   - Apply changes from the "Release x.y.z" commit.
+   - If this was a non-patch release (e.g. `x.y.0`), generate a new unique SBOM serial number for the next upcoming non-patch release (e.g. for `1.14.0` following the release of `1.13.0`):
+     ```bash
+     ./.evergreen/earthly.sh +sbom-generate-new-serial-number
+     ```
+     Commit resulting `etc/cyclonedx.sbom.json`.
 - Update the release on the [Jira releases page](https://jira.mongodb.org/projects/MONGOCRYPT/versions).
 - Record the release on [C/C++ Release Info](https://docs.google.com/spreadsheets/d/1yHfGmDnbA5-Qt8FX4tKWC5xk9AhzYZx1SKF4AD36ecY/edit?usp=sharing). This is done to meet SSDLC reporting requirements.
 - Add a link to the Evergreen waterfall for the tagged commit to [libmongocrypt Security Testing Summary](https://docs.google.com/document/d/1dc7uvBzu3okAIsA8LSW5sVQGkYIvwpBVdg5v4wb4c4s/edit#heading=h.5t79jwe4p0ss).
 
 ## Homebrew steps ##
-Submit a PR to update the Homebrew package https://github.com/mongodb/homebrew-brew/blob/master/Formula/libmongocrypt.rb. ([Example](https://github.com/mongodb/homebrew-brew/pull/208)). If not on macOS, request a team member to do this step.
+Submit a PR to update the Homebrew package https://github.com/mongodb/homebrew-brew/blob/master/Formula/libmongocrypt.rb. ([Example](https://github.com/mongodb/homebrew-brew/pull/234)). If not on macOS, request a team member to do this step.
+Request review by posting in #ask-devprod-build.
 
 ## Debian steps ##
 If you are not a Debian maintainer on the team, request a team member to do the steps in this section.
 
 Refer to the [Debian](https://github.com/mongodb/mongo-c-driver/blob/master/docs/dev/debian.rst) steps.
 
-For a minor release (e.g. x.y.0), submit a merge request to the [extrepo-data](https://salsa.debian.org/extrepo-team/extrepo-data) project in Debian to update the PPA. The change would look something like this:
+For a non-patch release (e.g. x.y.0), submit a merge request to the [extrepo-data](https://salsa.debian.org/extrepo-team/extrepo-data) project in Debian to update the PPA. The change would look something like this:
 
 ```
 diff --git a/repos/debian/libmongocrypt.yaml b/repos/debian/libmongocrypt.yaml
@@ -154,10 +149,9 @@ index 609dc0b..f7530a9 100644
    source:
      Types: deb
      URIs: https://libmongocrypt.s3.amazonaws.com/apt/debian
--    Suites: <SUITE>/libmongocrypt/1.11
-+    Suites: <SUITE>/libmongocrypt/1.12
+-    Suites: <SUITE>/libmongocrypt/1.12
++    Suites: <SUITE>/libmongocrypt/1.13
      Components: main
      Architectures: amd64 arm64
    suites:
 ```
-

data/ext/libmongocrypt/libmongocrypt/etc/calc_release_version.py

@@ -38,19 +38,45 @@ import datetime
 import re
 import subprocess
 import sys
-try:
-    # Prefer newer `packaging` over deprecated packages.
-    from packaging.version import Version as Version
-    from packaging.version import parse as parse_version
-except ImportError:
-    # Fallback to deprecated pkg_resources.
-    try:
-        from pkg_resources.extern.packaging.version import Version
-        from pkg_resources import parse_version
-    except ImportError:
-        # Fallback to deprecated distutils.
-        from distutils.version import LooseVersion as Version
-        from distutils.version import LooseVersion as parse_version
+
+class Version:
+    def __init__(self, s):
+        pat = r'(\d+)\.(\d+)\.(\d+)(\-\S+)?'
+        match = re.match(pat, s)
+        assert match, "Unrecognized version string %s" % s
+        self.major, self.minor, self.micro = (
+            map(int, (match.group(1), match.group(2), match.group(3))))
+
+        if match.group(4):
+            self.prerelease = match.group(4)[1:]
+        else:
+            self.prerelease = ''
+
+    def __lt__(self, other):
+        if self.major != other.major:
+            return self.major < other.major
+        if self.minor != other.minor:
+            return self.minor < other.minor
+        if self.micro != other.micro:
+            return self.micro < other.micro
+        if self.prerelease != other.prerelease:
+            if self.prerelease != '' and other.prerelease == '':
+                # Consider a prerelease less than non-prerelease.
+                return True
+            # For simplicity, compare prerelease versions lexicographically.
+            return self.prerelease < other.prerelease
+
+        # Versions are equal.
+        return False
+
+    def __eq__(self, other):
+        self_tuple = self.major, self.minor, self.micro, self.prerelease
+        other_tuple = other.major, other.minor, other.micro, other.prerelease
+        return self_tuple == other_tuple
+
+
+def parse_version(ver):
+    return Version(ver)
 
 DEBUG = len(sys.argv) > 1 and '-d' in sys.argv
 if DEBUG:

data/ext/libmongocrypt/libmongocrypt/etc/calc_release_version_selftest.sh

@@ -66,7 +66,7 @@ echo "Test next minor version ... begin"
     # failed, then it is probably because a new major/minor release was made.
     # Update the expected output to represent the correct next version.
     # XXX NOTE XXX NOTE XXX
-    assert_eq "$got" "1.9.0-$DATE+git$CURRENT_SHORTREF"
+    assert_eq "$got" "1.14.0-$DATE+git$CURRENT_SHORTREF"
 }
 echo "Test next minor version ... end"
 

data/ext/libmongocrypt/libmongocrypt/etc/cyclonedx.sbom.json

@@ -1,16 +1,16 @@
 {
   "components": [
     {
-      "bom-ref": "pkg:github/mongodb/mongo-c-driver@v1.28.1#src/libbson",
+      "bom-ref": "pkg:github/mongodb/mongo-c-driver@v1.30.3#src/libbson",
       "copyright": "Copyright 2009-present MongoDB, Inc.",
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://github.com/mongodb/mongo-c-driver/archive/refs/tags/v1.28.1.tar.gz"
+          "url": "https://github.com/mongodb/mongo-c-driver/archive/refs/tags/v1.30.3.tar.gz"
         },
         {
           "type": "website",
-          "url": "https://github.com/mongodb/mongo-c-driver/tree/v1.28.1"
+          "url": "https://github.com/mongodb/mongo-c-driver/tree/v1.30.3"
         }
       ],
       "group": "mongodb",
@@ -22,9 +22,9 @@
         }
       ],
       "name": "mongo-c-driver",
-      "purl": "pkg:github/mongodb/mongo-c-driver@v1.28.1#src/libbson",
+      "purl": "pkg:github/mongodb/mongo-c-driver@v1.30.3#src/libbson",
       "type": "library",
-      "version": "v1.28.1"
+      "version": "v1.30.3"
     },
     {
       "bom-ref": "pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz",
@@ -53,11 +53,11 @@
       "ref": "pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz"
     },
     {
-      "ref": "pkg:github/mongodb/mongo-c-driver@v1.28.1#src/libbson"
+      "ref": "pkg:github/mongodb/mongo-c-driver@v1.30.3#src/libbson"
     }
   ],
   "metadata": {
-    "timestamp": "2024-10-10T20:09:56.207649+00:00",
+    "timestamp": "2025-04-08T15:21:23.237097+00:00",
     "tools": [
       {
         "externalReferences": [
@@ -100,8 +100,8 @@
       }
     ]
   },
-  "serialNumber": "urn:uuid:879e1b41-08d8-4505-8c89-2285bc3e442c",
-  "version": 2,
+  "serialNumber": "urn:uuid:9e8a6b86-64aa-4438-bd54-80fd66afce96",
+  "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",

data/ext/libmongocrypt/libmongocrypt/etc/format.sh

@@ -9,8 +9,6 @@ if ! run_python -c ''; then
   fail "No Python found?"
 fi
 
-# Check that we have a pipx of the proper version:
-run_python -c 'import pkg_resources; pkg_resources.require("pipx>=0.17.0,<2.0")'
 
 # Give default clang-format an empty string on stdin if there are no inputs files
 printf '' | run_python -m pipx run "clang-format==${CLANG_FORMAT_VERSION:?}" "$@"

data/ext/libmongocrypt/libmongocrypt/etc/libbson-remove-GCC-diagnostic-in-functions.patch

@@ -0,0 +1,158 @@
+diff --git a/src/libmongoc/src/mongoc/mongoc-collection.c b/src/libmongoc/src/mongoc/mongoc-collection.c
+index d21a043788..ac0194e477 100644
+--- a/src/libmongoc/src/mongoc/mongoc-collection.c
++++ b/src/libmongoc/src/mongoc/mongoc-collection.c
+@@ -681,6 +681,7 @@ mongoc_collection_command_simple (mongoc_collection_t *collection,
+  *--------------------------------------------------------------------------
+  */
+ 
++BEGIN_IGNORE_DEPRECATIONS
+ int64_t
+ mongoc_collection_count (mongoc_collection_t *collection,       /* IN */
+                          mongoc_query_flags_t flags,            /* IN */
+@@ -705,13 +706,12 @@ mongoc_collection_count (mongoc_collection_t *collection,       /* IN */
+    /* Server Selection Spec: "may-use-secondary" commands SHOULD take a read
+     * preference argument and otherwise MUST use the default read preference
+     * from client, database or collection configuration. */
+-   BEGIN_IGNORE_DEPRECATIONS
+    ret = mongoc_collection_count_with_opts (collection, flags, query, skip, limit, &opts, read_prefs, error);
+-   END_IGNORE_DEPRECATIONS
+ 
+    bson_destroy (&opts);
+    return ret;
+ }
++END_IGNORE_DEPRECATIONS
+ 
+ 
+ int64_t
+@@ -1231,6 +1231,7 @@ mongoc_collection_keys_to_index_string (const bson_t *keys)
+ }
+ 
+ 
++BEGIN_IGNORE_DEPRECATIONS
+ bool
+ mongoc_collection_create_index (mongoc_collection_t *collection,
+                                 const bson_t *keys,
+@@ -1240,15 +1241,14 @@ mongoc_collection_create_index (mongoc_collection_t *collection,
+    bson_t reply;
+    bool ret;
+ 
+-   BEGIN_IGNORE_DEPRECATIONS
+ 
+    ret = mongoc_collection_create_index_with_opts (collection, keys, opt, NULL, &reply, error);
+ 
+-   END_IGNORE_DEPRECATIONS
+ 
+    bson_destroy (&reply);
+    return ret;
+ }
++END_IGNORE_DEPRECATIONS
+ 
+ static bool
+ _mongoc_collection_index_keys_equal (const bson_t *expected, const bson_t *actual)
+@@ -1578,16 +1578,16 @@ done:
+ }
+ 
+ 
++BEGIN_IGNORE_DEPRECATIONS
+ bool
+ mongoc_collection_ensure_index (mongoc_collection_t *collection,
+                                 const bson_t *keys,
+                                 const mongoc_index_opt_t *opt,
+                                 bson_error_t *error)
+ {
+-   BEGIN_IGNORE_DEPRECATIONS
+    return mongoc_collection_create_index (collection, keys, opt, error);
+-   END_IGNORE_DEPRECATIONS
+ }
++END_IGNORE_DEPRECATIONS
+ 
+ 
+ mongoc_cursor_t *
+@@ -2317,6 +2317,7 @@ mongoc_collection_replace_one (mongoc_collection_t *collection,
+  *--------------------------------------------------------------------------
+  */
+ 
++BEGIN_IGNORE_DEPRECATIONS
+ bool
+ mongoc_collection_save (mongoc_collection_t *collection,
+                         const bson_t *document,
+@@ -2330,7 +2331,6 @@ mongoc_collection_save (mongoc_collection_t *collection,
+    BSON_ASSERT_PARAM (collection);
+    BSON_ASSERT_PARAM (document);
+ 
+-   BEGIN_IGNORE_DEPRECATIONS
+    if (!bson_iter_init_find (&iter, document, "_id")) {
+       return mongoc_collection_insert (collection, MONGOC_INSERT_NONE, document, write_concern, error);
+    }
+@@ -2350,12 +2350,12 @@ mongoc_collection_save (mongoc_collection_t *collection,
+ 
+    ret = mongoc_collection_update (
+       collection, MONGOC_UPDATE_UPSERT | MONGOC_UPDATE_NO_VALIDATE, &selector, document, write_concern, error);
+-   END_IGNORE_DEPRECATIONS
+ 
+    bson_destroy (&selector);
+ 
+    return ret;
+ }
++END_IGNORE_DEPRECATIONS
+ 
+ 
+ bool
+diff --git a/src/libmongoc/src/mongoc/mongoc-stream-tls.c b/src/libmongoc/src/mongoc/mongoc-stream-tls.c
+index 744fdc4089..252d6209f3 100644
+--- a/src/libmongoc/src/mongoc/mongoc-stream-tls.c
++++ b/src/libmongoc/src/mongoc/mongoc-stream-tls.c
+@@ -187,6 +187,7 @@ mongoc_stream_tls_check_cert (mongoc_stream_t *stream, const char *host)
+  *--------------------------------------------------------------------------
+  */
+ 
++BEGIN_IGNORE_DEPRECATIONS
+ mongoc_stream_t *
+ mongoc_stream_tls_new_with_hostname (mongoc_stream_t *base_stream, const char *host, mongoc_ssl_opt_t *opt, int client)
+ {
+@@ -208,9 +209,7 @@ mongoc_stream_tls_new_with_hostname (mongoc_stream_t *base_stream, const char *h
+ #if defined(MONGOC_ENABLE_SSL_OPENSSL)
+    return mongoc_stream_tls_openssl_new (base_stream, host, opt, client);
+ #elif defined(MONGOC_ENABLE_SSL_LIBRESSL)
+-   BEGIN_IGNORE_DEPRECATIONS
+    return mongoc_stream_tls_libressl_new (base_stream, host, opt, client);
+-   END_IGNORE_DEPRECATIONS
+ #elif defined(MONGOC_ENABLE_SSL_SECURE_TRANSPORT)
+    return mongoc_stream_tls_secure_transport_new (base_stream, host, opt, client);
+ #elif defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
+@@ -219,6 +218,7 @@ mongoc_stream_tls_new_with_hostname (mongoc_stream_t *base_stream, const char *h
+ #error "Don't know how to create TLS stream"
+ #endif
+ }
++END_IGNORE_DEPRECATIONS
+ 
+ #if defined(MONGOC_ENABLE_SSL_OPENSSL) && OPENSSL_VERSION_NUMBER >= 0x10100000L
+ /*
+diff --git a/src/libmongoc/src/mongoc/mongoc-write-concern.c b/src/libmongoc/src/mongoc/mongoc-write-concern.c
+index 82ac8d3c32..10b8585c1c 100644
+--- a/src/libmongoc/src/mongoc/mongoc-write-concern.c
++++ b/src/libmongoc/src/mongoc/mongoc-write-concern.c
+@@ -492,6 +492,7 @@ mongoc_write_concern_append (mongoc_write_concern_t *write_concern, bson_t *comm
+  * Returns: A newly allocated mongoc_write_concern_t. This should be freed
+  *    with mongoc_write_concern_destroy().
+  */
++BEGIN_IGNORE_DEPRECATIONS
+ mongoc_write_concern_t *
+ _mongoc_write_concern_new_from_iter (const bson_iter_t *iter, bson_error_t *error)
+ {
+@@ -532,9 +533,7 @@ _mongoc_write_concern_new_from_iter (const bson_iter_t *iter, bson_error_t *erro
+          if (!BSON_ITER_HOLDS_BOOL (&inner)) {
+             goto fail;
+          }
+-         BEGIN_IGNORE_DEPRECATIONS
+          mongoc_write_concern_set_fsync (write_concern, bson_iter_bool (&inner));
+-         END_IGNORE_DEPRECATIONS
+       } else if (BSON_ITER_IS_KEY (&inner, "j")) {
+          if (!BSON_ITER_HOLDS_BOOL (&inner)) {
+             goto fail;
+@@ -560,3 +559,4 @@ fail:
+    mongoc_write_concern_destroy (write_concern);
+    return NULL;
+ }
++END_IGNORE_DEPRECATIONS

data/ext/libmongocrypt/libmongocrypt/etc/libbson-remove-GCC-diagnostic-pragma.patch

@@ -1,7 +1,7 @@
-diff --git a/src/common/bson-dsl.h b/src/common/bson-dsl.h
+diff --git a/src/common/src/common-bson-dsl-private.h b/src/common/src/common-bson-dsl-private.h
 index 58a14e28e..3341e603f 100644
---- a/src/common/bson-dsl.h
-+++ b/src/common/bson-dsl.h
+--- a/src/common/src/common-bson-dsl-private.h
++++ b/src/common/src/common-bson-dsl-private.h
 @@ -29,6 +29,13 @@ enum {
     BSON_IF_WINDOWS (__declspec (selectany)) \
     BSON_IF_POSIX (__attribute__ ((weak)))

data/ext/libmongocrypt/libmongocrypt/etc/purls.txt

@@ -8,7 +8,7 @@
 # `copyright` property. This information can be manually added.
 
 # libbson is obtained via `cmake/FetchMongoC.cmake`.
-pkg:github/mongodb/mongo-c-driver@v1.28.1?#src/libbson
+pkg:github/mongodb/mongo-c-driver@v1.30.3?#src/libbson
 
 # IntelDFP is obtained via `cmake/IntelDFP.cmake`
 pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz

data/ext/libmongocrypt/libmongocrypt/integrating.md

@@ -9,6 +9,24 @@ There are two major parts to integrating libmongocrypt into your driver:
 -   Writing a language-specific binding to libmongocrypt
 -   Using the binding in your driver to support client side encryption
 
+## Design Rationale
+
+### Simple interface
+
+The library interface is intended to be used with multiple languages.
+
+The API tries to be minimal. Most structs are opaque. Global initialization
+is lazy.
+
+Much of the API passes and returns BSON since all drivers can produce and parse
+BSON.
+
+### No I/O
+
+libmongocrypt deliberately does not do I/O to avoid poor behavior with some
+language runtimes. Example: in Go a blocking C call may block an OS thread,
+rather than a goroutine.
+
 ## Part 1: Writing a Language-Specific Binding ##
 
 The binding is the glue between your driver\'s native language and
@@ -30,7 +48,7 @@ in the main public header
 [mongocrypt.h](https://github.com/10gen/libmongocrypt/blob/master/src/mongocrypt.h).
 
 There are many types and functions in mongocrypt.h to bind. Consider as
-a first step binding to only `mongocrypt_version` ([JNA example](https://github.com/10gen/libmongocrypt/blob/fbb9f59bf32019373232dc1a1fd85a00d6ab95de/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/CAPI.java#L106-L113)).
+a first step binding to only `mongocrypt_version`.
 Once you have that working, proceed to write bindings for the remaining
 API. Here are a few things to keep in mind:
 
@@ -122,6 +140,15 @@ All contexts.
 
 #### State: `MONGOCRYPT_CTX_NEED_MONGO_COLLINFO` ####
 
+> [!IMPORTANT]
+> <a name="multi-collection-commands"></a> **Multi-collection commands**: prior to 1.13.0, drivers were expected to pass _at most one result_ from `listCollections`. In 1.13.0, drivers are expected to pass _all results_ from `listCollections` to support multi-collection commands (e.g. aggregate with `$lookup`).
+>
+> Drivers must call `mongocrypt_setopt_enable_multiple_collinfo` to indicate the new behavior is implemented and opt-in to support for multi-collection commands. This opt-in is to prevent the following bug scenario:
+> > A driver upgrades to 1.13.0, but does not update prior behavior which passes at most one result of a multi-collection command.
+> > A multi-collection command requests schemas for both `db.c1` and `db.c2`.
+> > The driver only passes the result for `db.c1` even though `db.c2` also has a result.
+> > Therefore, libmongocrypt incorrectly believes `db.c2` has no schema.
+
 **libmongocrypt needs**...
 
 A result from a listCollections cursor.
@@ -130,7 +157,7 @@ A result from a listCollections cursor.
 
 1.  Run listCollections on the encrypted MongoClient with the filter
     provided by `mongocrypt_ctx_mongo_op`
-2.  Return the first result (if any) with `mongocrypt_ctx_mongo_feed` or proceed to the next step if nothing was returned.
+2.  Pass all results (if any) with calls to `mongocrypt_ctx_mongo_feed` or proceed to the next step if nothing was returned. Results may be passed in any order.
 3.  Call `mongocrypt_ctx_mongo_done`
 
 **Applies to...**
@@ -139,6 +166,8 @@ auto encrypt
 
 #### State: `MONGOCRYPT_CTX_NEED_MONGO_COLLINFO_WITH_DB` ####
 
+See [note](#multi-collection-commands) about multi-collection commands.
+
 **libmongocrypt needs**...
 
 Results from a listCollections cursor from a specified database.
@@ -147,7 +176,7 @@ Results from a listCollections cursor from a specified database.
 
 1.  Run listCollections on the encrypted MongoClient with the filter
     provided by `mongocrypt_ctx_mongo_op` on the database provided by `mongocrypt_ctx_mongo_db`.
-2.  Return the first result (if any) with `mongocrypt_ctx_mongo_feed` or proceed to the next step if nothing was returned.
+2.  Pass all results (if any) with calls to `mongocrypt_ctx_mongo_feed` or proceed to the next step if nothing was returned. Results may be passed in any order.
 3.  Call `mongocrypt_ctx_mongo_done`
 
 **Applies to...**
@@ -195,13 +224,13 @@ All contexts except for create data key.
 
 **libmongocrypt needs**...
 
-The responses from one or more HTTP messages to KMS.
+The responses from one or more messages to KMS.
+
+Ensure `mongocrypt_setopt_retry_kms` is called on the `mongocrypt_t` to enable retry.
 
 **Driver needs to...**
 
-1.  Iterate all KMS requests using `mongocrypt_ctx_next_kms_ctx`.
-    (Note, the driver MAY fan out all HTTP requests at the same time).
-2.  For each context:
+1.  For each context returned by `mongocrypt_ctx_next_kms_ctx`:
 
     a.  Delay the message by the time in microseconds indicated by
         `mongocrypt_kms_ctx_usleep` if returned value is greater than 0.
@@ -219,11 +248,13 @@ The responses from one or more HTTP messages to KMS.
     d.  Feed the reply back with `mongocrypt_kms_ctx_feed`. Repeat
         > until `mongocrypt_kms_ctx_bytes_needed` returns 0.
 
-    If any step encounters a network error, continue to the next KMS context if
-    `mongocrypt_kms_ctx_fail` returns true. Otherwise, abort and report an
-    error.
+    If any step encounters a network error, call `mongocrypt_kms_ctx_fail`.
+    If `mongocrypt_kms_ctx_fail` returns true, continue to the next KMS context.
+    If `mongocrypt_kms_ctx_fail` returns false, abort and report an error. Consider wrapping the error reported in `mongocrypt_kms_ctx_status` to include the last network error.
+
+2.  When done feeding all replies, call `mongocrypt_ctx_kms_done`.
 
-3.  When done feeding all replies, call `mongocrypt_ctx_kms_done`.
+Note, the driver MAY fan out KMS requests in parallel. More KMS requests may be added when processing responses to retry.
 
 **Applies to...**
 

data/ext/libmongocrypt/libmongocrypt/kms-message/CMakeLists.txt

@@ -4,7 +4,7 @@ project (kms_message
    LANGUAGES C
 )
 
-set (CMAKE_C_STANDARD 90)
+set (CMAKE_C_STANDARD 99)
 
 include (CheckCCompilerFlag)
 # All targets obey visibility, not just library targets.

data/ext/libmongocrypt/libmongocrypt/kms-message/src/hexlify.c

@@ -14,7 +14,12 @@
  * limitations under the License.
  */
 
+#include "hexlify.h"
+
+//
+
 #include "kms_message_private.h"
+
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>

data/ext/libmongocrypt/libmongocrypt/kms-message/src/hexlify.h

@@ -21,4 +21,4 @@ char *
 hexlify (const uint8_t *buf, size_t len);
 
 int
-unhexlify (const char *in, size_t len);
+unhexlify (const char *in, size_t len);

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_azure_request.c

@@ -216,4 +216,4 @@ kms_azure_request_unwrapkey_new (const char *host,
                                ciphertext,
                                ciphertext_len,
                                opt);
-}
+}

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_crypto_windows.c

@@ -168,7 +168,7 @@ kms_sign_rsaes_pkcs1_v1_5 (void *unused_ctx,
 
    success = CryptDecodeObjectEx (X509_ASN_ENCODING,
                                   PKCS_PRIVATE_KEY_INFO,
-                                  private_key,
+                                  (BYTE*) private_key,
                                   (DWORD) private_key_len,
                                   0,
                                   NULL,
@@ -182,7 +182,7 @@ kms_sign_rsaes_pkcs1_v1_5 (void *unused_ctx,
 
    success = CryptDecodeObjectEx (X509_ASN_ENCODING,
                                   PKCS_PRIVATE_KEY_INFO,
-                                  private_key,
+                                  (BYTE*) private_key,
                                   (DWORD) private_key_len,
                                   0,
                                   NULL,

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_gcp_request.c

@@ -283,4 +283,4 @@ kms_gcp_request_decrypt_new (const char *host,
                                    ciphertext,
                                    ciphertext_len,
                                    opt);
-}
+}