RubyGems - libmongocrypt-helper - Versions diffs - 1.6.1.0.1001 → 1.7.4.0.1000 - Mend

libmongocrypt-helper 1.6.1.0.1001 → 1.7.4.0.1000

Files changed (991) hide show

data/ext/libmongocrypt/libmongocrypt/etc/print-marking.py ADDED Viewed

@@ -0,0 +1,36 @@
+instructions = """
+Print the contents of a marking from mongocryptd.
+Usage:
+python print-marking.py <base64 representation of marking>
+Example:
+python ./etc/print-marking.py ADgAAAAQYQABAAAABWtpABAAAAAEYWFhYWFhYWFhYWFhYWFhYQJ2AAwAAAA0NTctNTUtNTQ2MgAA
+"""
+import sys
+import base64
+import bson
+from bson import BSON
+from bson import json_util
+from bson.codec_options import CodecOptions
+if len(sys.argv) != 2:
+    print(instructions)
+    sys.exit(1)
+marking = base64.b64decode(sys.argv[1])
+codec_options = CodecOptions(uuid_representation=bson.binary.STANDARD)
+json_options = json_util.JSONOptions(json_mode=json_util.JSONMode.CANONICAL, uuid_representation=bson.binary.STANDARD)
+if marking[0] != 0:
+    print("Invalid first byte: {}".format(marking[0]))
+marking_bson = BSON(marking[1:]).decode(codec_options=codec_options)
+print(json_util.dumps(marking_bson, indent=4, json_options=json_options))
+if "a" in marking_bson:
+    if marking_bson["a"] == 1:
+        print ("Algorithm is deterministic")
+    elif marking_bson["a"] == 2:
+        print ("Algorithm is random")

data/ext/libmongocrypt/libmongocrypt/etc/repo_config.yaml ADDED Viewed

@@ -0,0 +1,257 @@
+services:
+  notary_url: "http://notary-service.build.10gen.cc:5000"
+templates:
+  deb:
+    org: |
+      Origin: libmongocrypt
+      Label: libmongocrypt
+      Suite: {{ .CodeName }}
+      Codename: {{ .CodeName }}/libmongocrypt
+      Architectures: {{ .Architectures }}
+      Components: {{ .Component }}
+      Description: libmongocrypt packages
+  index_page: |
+    <!DOCTYPE html>
+    <html>
+     <head>
+       <title>{{ .Title }}</title>
+     </head>
+     <body>
+       <table>
+        <tr><td>
+          <h1>{{ .Title }}</h1>
+        </td></tr>
+        <tr><td>
+          <hr>
+        </td></tr>
+        <tr><td>
+          <a href='..'>Parent Directory</a>
+        </td></tr>
+        {{ range $fn := .Files }}
+        <tr><td>
+          <a href='{{ $fn }}'>{{ $fn }}</a>
+        </td></tr>
+        {{ end }}
+        <tr><td>
+          <hr>
+        </td></tr>
+        <tr><td>
+          <address>{{ .RepoName }}</address>
+        </td></tr>
+      </table>
+     </body>
+    </html>
+repos:
+  - name: rhel62
+    type: rpm
+    edition: org
+    bucket: libmongocrypt
+    region: us-east-1
+    repos:
+      - yum/redhat/6/libmongocrypt
+      - yum/redhat/6Server/libmongocrypt
+  - name: rhel67
+    type: rpm
+    edition: org
+    bucket: libmongocrypt
+    region: us-east-1
+    repos:
+      - yum/redhat/6/libmongocrypt
+      - yum/redhat/6Server/libmongocrypt
+  - name: rhel70
+    type: rpm
+    edition: org
+    bucket: libmongocrypt
+    region: us-east-1
+    repos:
+      - yum/redhat/7/libmongocrypt
+      - yum/redhat/7Server/libmongocrypt
+  - name: rhel71
+    type: rpm
+    edition: org
+    bucket: libmongocrypt
+    region: us-east-1
+    repos:
+      - yum/redhat/7/libmongocrypt
+      - yum/redhat/7Server/libmongocrypt
+  - name: rhel72
+    type: rpm
+    edition: org
+    bucket: libmongocrypt
+    region: us-east-1
+    repos:
+      - yum/redhat/7/libmongocrypt
+      - yum/redhat/7Server/libmongocrypt
+  - name: rhel80
+    type: rpm
+    edition: org
+    bucket: libmongocrypt
+    region: us-east-1
+    repos:
+      - yum/redhat/8/libmongocrypt
+      - yum/redhat/8Server/libmongocrypt
+  - name: amazon
+    type: rpm
+    edition: org
+    bucket: libmongocrypt
+    region: us-east-1
+    repos:
+      - yum/amazon/2013.03/libmongocrypt
+  - name: amazon2
+    type: rpm
+    edition: org
+    bucket: libmongocrypt
+    region: us-east-1
+    repos:
+      - yum/amazon/2/libmongocrypt
+  - name: suse12
+    type: rpm
+    edition: org
+    bucket: libmongocrypt
+    region: us-east-1
+    repos:
+      - zypper/suse/12/libmongocrypt
+  - name: suse15
+    type: rpm
+    edition: org
+    bucket: libmongocrypt
+    region: us-east-1
+    repos:
+      - zypper/suse/15/libmongocrypt
+  - name: debian81
+    type: deb
+    code_name: "jessie"
+    bucket: libmongocrypt
+    region: us-east-1
+    edition: org
+    component: main
+    architectures:
+      - amd64
+      - i386
+    repos:
+      - apt/debian/dists/jessie/libmongocrypt
+  - name: debian92
+    type: deb
+    code_name: "stretch"
+    bucket: libmongocrypt
+    region: us-east-1
+    edition: org
+    component: main
+    architectures:
+      - amd64
+    repos:
+      - apt/debian/dists/stretch/libmongocrypt
+  - name: debian10
+    type: deb
+    code_name: "buster"
+    bucket: libmongocrypt
+    region: us-east-1
+    edition: org
+    component: main
+    architectures:
+      - amd64
+    repos:
+      - apt/debian/dists/buster/libmongocrypt
+  - name: debian11
+    type: deb
+    code_name: "bullseye"
+    bucket: libmongocrypt
+    region: us-east-1
+    edition: org
+    component: main
+    architectures:
+      - amd64
+    repos:
+      - apt/debian/dists/bullseye/libmongocrypt
+  - name: ubuntu1404
+    type: deb
+    code_name: "trusty"
+    edition: org
+    bucket: libmongocrypt
+    region: us-east-1
+    component: universe
+    architectures:
+      - amd64
+      - i386
+    repos:
+      - apt/ubuntu/dists/trusty/libmongocrypt
+  - name: ubuntu1604
+    type: deb
+    code_name: "xenial"
+    edition: org
+    bucket: libmongocrypt
+    region: us-east-1
+    component: universe
+    architectures:
+      - amd64
+      - arm64
+      - i386
+    repos:
+      - apt/ubuntu/dists/xenial/libmongocrypt
+  - name: ubuntu1804
+    type: deb
+    code_name: "bionic"
+    edition: org
+    bucket: libmongocrypt
+    region: us-east-1
+    component: universe
+    architectures:
+      - amd64
+      - i386
+      - arm64
+    repos:
+      - apt/ubuntu/dists/bionic/libmongocrypt
+  - name: ubuntu2004
+    type: deb
+    code_name: "focal"
+    edition: org
+    bucket: libmongocrypt
+    region: us-east-1
+    component: universe
+    architectures:
+      - amd64
+      - i386
+      - arm64
+    repos:
+      - apt/ubuntu/dists/focal/libmongocrypt
+  - name: ubuntu2204
+    type: deb
+    code_name: "jammy"
+    edition: org
+    bucket: libmongocrypt
+    region: us-east-1
+    component: universe
+    architectures:
+      - amd64
+      - i386
+      - arm64
+    repos:
+      - apt/ubuntu/dists/jammy/libmongocrypt

data/ext/libmongocrypt/libmongocrypt/etc/requirements.txt ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ boto3
2	+ pymongo

data/ext/libmongocrypt/libmongocrypt/etc/rewrite.py ADDED Viewed

@@ -0,0 +1,16 @@
+help = """
+Script to rewrite \n to \r\n
+Usage: python3 rewrite.py file-in.txt file-out.txt
+file-in.txt will be rewritten to have \n replaced with \r\n.
+"""
+import sys
+if len(sys.argv) != 3:
+    print (help)
+    sys.exit(1)
+src = open (sys.argv[1], "r")
+dst = open (sys.argv[2], "w")
+for line in src:
+    print (line)
+    dst.write(line.strip() + "\r\n")
+dst.close()

data/ext/libmongocrypt/libmongocrypt/etc/rpm/libmongocrypt.spec ADDED Viewed

@@ -0,0 +1,67 @@
+Name: libmongocrypt
+Prefix: /usr
+Version: %{dynamic_version}
+Release: %{dynamic_release}%{?dist}
+Summary: library to perform field-level encryption
+License: Apache License 2.0
+URL: https://github.com/mongodb/libmongocrypt
+Group: Development/Libraries
+Requires: libmongocrypt-devel = %{version}, libmongocrypt-libs = %{version}
+Source0: %{name}-%{version}.tar.gz
+BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
+%description
+libmongocrypt facilitates the encryption and decryption, at the field
+level, of data stored in MongoDB.
+%package devel
+Summary: library to perform field-level encryption - dev files
+Group: Development/Libraries
+Requires: libmongocrypt-libs = %{version}
+%description devel
+ libmongocrypt facilitates the encryption and decryption, at the field
+ level, of data stored in MongoDB.
+ .
+ This package contains the libmongocrypt and libkms_message development
+ headers and libraries.
+%package libs
+Summary: library to perform field-level encryption - runtime files
+Group: Development/Libraries
+%description libs
+ This package contains the libmongocrypt and libkms_message runtime
+ libraries.
+%prep
+%setup
+%build
+%install
+mkdir -p $RPM_BUILD_ROOT/usr
+cp -rv lib* $RPM_BUILD_ROOT/usr
+cp -rv include $RPM_BUILD_ROOT/usr
+find $RPM_BUILD_ROOT/usr -name '*.pc' -exec sed -i -e 's|^prefix=.*|prefix=/usr|' {} \;
+%clean
+rm -rf $RPM_BUILD_ROOT
+%files
+%files devel
+%{_includedir}/*
+%{_prefix}/lib*/*.a
+%{_prefix}/lib*/lib*.so
+%{_prefix}/lib*/pkgconfig/*
+%{_prefix}/lib*/cmake/*
+%files libs
+%{_prefix}/lib*/lib*.so.*
+%changelog
+* Tue Aug 06 2019 Roberto C. Sanchez <roberto@connexer.com>
+- Initial release

data/ext/libmongocrypt/libmongocrypt/etc/rpm/tweak.awk ADDED Viewed

@@ -0,0 +1,19 @@
+# This script is used to tweak the upstream libmongocrypt.spec file such that
+# the rpm build will build from a copy of the source tree instead of by
+# unpacking an archive of the sources
+# Drop the gcc-13 patch.
+/Patch.*gcc-13/ { next }
+# Drop the source. We're bringing our own
+/Source0/ { next }
+# Replace the autosetup with one that copies the source tree into place
+/%autosetup/ {
+    print "cp -rf %{_sourcedir}/. %{_builddir}/\n" \
+          "%autopatch 0 -p1"
+    next
+}
+# Print every other line as-is
+{ print }

data/ext/libmongocrypt/libmongocrypt/integrating.md ADDED Viewed

@@ -0,0 +1,251 @@
+# The guide to integrating libmongocrypt #
+libmongocrypt is a C library meant to assist drivers in supporting
+client side encryption. libmongocrypt acts as a state machine and the
+driver is responsible for I/O between mongod, mongocryptd, and KMS.
+There are two major parts to integrating libmongocrypt into your driver:
+-   Writing a language-specific binding to libmongocrypt
+-   Using the binding in your driver to support client side encryption
+## Part 1: Writing a Language-Specific Binding ##
+The binding is the glue between your driver\'s native language and
+libmongocrypt.
+The binding uses the native language\'s foreign function interface to C.
+For example, Java can accomplish this with
+[JNA](https://github.com/java-native-access/jna), CPython with
+[extensions](https://docs.python.org/3/extending/extending.html),
+NodeJS with [add-ons](https://nodejs.org/api/addons.html), etc.
+The libmongocrypt library files (.so/.dll) are pre-built on its
+[Evergreen project](https://evergreen.mongodb.com/waterfall/libmongocrypt). Click
+the variant\'s \"built-and-test-and-upload\" tasks to download the
+attached files.
+libmongocrypt describes all API that needs to be called from your driver
+in the main public header
+[mongocrypt.h](https://github.com/10gen/libmongocrypt/blob/master/src/mongocrypt.h).
+There are many types and functions in mongocrypt.h to bind. Consider as
+a first step binding to only `mongocrypt_version` ([JNA example](https://github.com/10gen/libmongocrypt/blob/fbb9f59bf32019373232dc1a1fd85a00d6ab95de/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/CAPI.java#L106-L113)).
+Once you have that working, proceed to write bindings for the remaining
+API. Here are a few things to keep in mind:
+-   \"ctx\" is short for context, and is a generic term indicating that
+    the object stores state.
+-   By C convention, functions are named like:
+    `mongocrypt_<type>_<method>`. For example `mongocrypt_ctx_id`
+    can be thought of as a class method \"id\" on the class \"ctx\".
+-   `mongocrypt_binary_t` is a non-owning view of data. Calling
+    `mongocrypt_binary_destroy` frees the view, but does nothing to the
+    underlying data. When a `mongocrypt_binary_t` is returned (e.g.
+    `mongocrypt_ctx_mongo_op`), the lifetime of the data is tied to the
+    type that returned it (so the data returned will be freed when the
+    `mongocrypt_ctx_t`) is freed.
+Once you have full bindings for the API, it\'s time to do a sanity
+check. The crux of libmongocrypt\'s API is the state machine represented
+by `mongocrypt_ctx_t`. This state machine is exercised in the
+[example-state-machine](https://github.com/10gen/libmongocrypt/blob/master/test/example-state-machine.c)
+executable included with libmongocrypt. It uses mock responses from
+mongod, mongocryptd, and KMS. Reimplement the state machine loop
+(`_run_state_machine`) in example-state-machine with your binding.
+To debug, configure with the cmake option `-DENABLE_TRACE=ON`, and set the environment variable `MONGOCRYPT_TRACE=ON` to log the arguments to mongocrypt functions. Note, this is insecure and should only be used for debugging.
+Seek help in the slack channel \#drivers-fle.
+## Part 2: Integrate into Driver ##
+After you have a binding, integrate libmongocrypt in your driver to
+support client side encryption.
+See the [driver spec](https://github.com/mongodb/specifications/blob/master/source/client-side-encryption/client-side-encryption.rst)
+for a reference of the user-facing API. libmongocrypt is needed for:
+-   Automatic encryption/decryption
+-   Explicit encryption/decryption
+-   KeyVault (explicit encryption/decryption + createDataKey)
+It is recommended to start by integrating libmongocrypt to support
+automatic encryption/decryption. Then reuse the implementation to
+implement the KeyVault.
+A MongoClient enabled with client side encryption MUST have one shared
+`mongocrypt_t` handle (important because keys + JSON Schemas are cached
+in this handle). Each KeyVault also has its own `mongocrypt_t`.
+Any encryption or decryption operation is done by creating a
+`mongocrypt_ctx_t` and initializing it for the appropriate operation.
+`mongocrypt_ctx_t` is a state machine, and each state requires the
+driver to perform some action. This may be performing I/O on one of the
+following:
+-   the encrypted MongoClient to which the operation is occurring (for
+    auto encrypt).
+-   the key vault MongoClient (which may be the same as the encrypted
+    MongoClient).
+-   KMS (via a TLS socket).
+-   the MongoClient to the local mongocryptd process.
+### Initializing ###
+There are five different types of `mongocrypt_ctx_t`\'s, distinguished
+by how they are initialized:
+-   auto encrypt (`mongocrypt_ctx_encrypt_init`)
+-   auto decrypt (`mongocrypt_ctx_decrypt_init`)
+-   explicit encrypt (`mongocrypt_ctx_explicit_encrypt_init`)
+-   explicit decrypt (`mongocrypt_ctx_explicit_decrypt_init`)
+-   create data key (`mongocrypt_ctx_datakey_init`)
+### State Machine ###
+Below is a list of the various states a mongocrypt ctx can be in. For
+each state, there is a description of what the driver is expected to do
+to advance the state machine. Not all states will be entered for all
+types of contexts. But one state machine runner can be used for all
+types of contexts.
+#### State: `MONGOCRYPT_CTX_ERROR` ####
+**Driver needs to...**
+Throw an exception based on the status from `mongocrypt_ctx_status`.
+**Applies to...**
+All contexts.
+#### State: `MONGOCRYPT_CTX_NEED_MONGO_COLLINFO` ####
+**libmongocrypt needs**...
+A result from a listCollections cursor.
+**Driver needs to...**
+1.  Run listCollections on the encrypted MongoClient with the filter
+    provided by `mongocrypt_ctx_mongo_op`
+2.  Return the first result (if any) with `mongocrypt_ctx_mongo_feed` or proceed to the next step if nothing was returned.
+3.  Call `mongocrypt_ctx_mongo_done`
+**Applies to...**
+auto encrypt
+#### State: `MONGOCRYPT_CTX_NEED_MONGO_MARKINGS` ####
+**libmongocrypt needs**...
+A reply from mongocryptd indicating which values in a command need to be
+encrypted.
+**Driver needs to...**
+1.  Use db.runCommand to run the command provided by `mongocrypt_ctx_mongo_op`
+    on the MongoClient connected to mongocryptd.
+2.  Feed the reply back with `mongocrypt_ctx_mongo_feed`.
+3.  Call `mongocrypt_ctx_mongo_done`.
+**Applies to...**
+auto encrypt
+#### State: `MONGOCRYPT_CTX_NEED_MONGO_KEYS` ####
+**libmongocrypt needs**...
+Documents from the key vault collection.
+**Driver needs to...**
+1.  Use MongoCollection.find on the MongoClient connected to the key
+    vault client (which may be the same as the encrypted client). Use
+    the filter provided by `mongocrypt_ctx_mongo_op`.
+2.  Feed all resulting documents back (if any) with repeated calls to
+    `mongocrypt_ctx_mongo_feed`.
+3.  Call `mongocrypt_ctx_mongo_done`.
+**Applies to...**
+All contexts except for create data key.
+#### State: `MONGOCRYPT_CTX_NEED_KMS` ####
+**libmongocrypt needs**...
+The responses from one or more HTTP messages to KMS.
+**Driver needs to...**
+1.  Iterate all KMS requests using `mongocrypt_ctx_next_kms_ctx`.
+    (Note, the driver MAY fan out all HTTP requests at the same time).
+2.  For each context:
+    a.  Create/reuse a TLS socket connected to the endpoint indicated by
+        `mongocrypt_kms_ctx_endpoint`. The endpoint string is a host name with
+        a port number separated by a colon. E.g.
+        "kms.us-east-1.amazonaws.com:443". A port number will always be
+        included. Drivers may assume the host name is not an IP address or IP
+        literal.
+    b.  Write the message from `mongocrypt_kms_ctx_message` to the
+        > socket.
+    c.  Feed the reply back with `mongocrypt_kms_ctx_feed`. Repeat
+        > until `mongocrypt_kms_ctx_bytes_needed` returns 0.
+3.  When done feeding all replies, call `mongocrypt_ctx_kms_done`.
+**Applies to...**
+All contexts.
+#### State: `MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS` ####
+`MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS` was added in libmongocrypt 1.4.0 as part of [MONGOCRYPT-382](https://jira.mongodb.org/browse/MONGOCRYPT-382).
+`MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS` can only be entered if `mongocrypt_setopt_use_need_kms_credentials_state` is called. This prevents breaking drivers that do not handle the `MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS` state.
+If a KMS provider is configured with an empty document (e.g. `{ "aws": {} }`), the `MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS` is entered before KMS requests are made.
+**libmongocrypt needs**...
+Credentials for one or more KMS providers.
+**Driver needs to...**
+Fetch credentials for supported KMS providers. See the [Client Side Encryption specification](https://github.com/mongodb/specifications/blob/master/source/client-side-encryption/client-side-encryption.rst#automatic-credentials) for details.
+Pass credentials to libmongocrypt using `mongocrypt_ctx_provide_kms_providers`.
+**Applies to...**
+All contexts.
+#### State: `MONGOCRYPT_CTX_READY` ####
+**Driver needs to...**
+Call `mongocrypt_ctx_finalize` to perform the encryption/decryption and
+get the final result.
+**Applies to...**
+All contexts except for create data key.
+#### State: `MONGOCRYPT_CTX_DONE` ####
+**Driver needs to...**
+Exit the state machine loop.
+**Applies to...**
+All contexts.
+Seek help in the slack channel \#drivers-fle.