libmongocrypt-helper 1.7.4.0.1002 → 1.11.0.0.1001

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/synchronous/explicit_encrypter.py

@@ -0,0 +1,156 @@
+# Copyright 2024-present MongoDB, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from pymongocrypt.mongocrypt import MongoCrypt
+from pymongocrypt.options import DataKeyOpts, ExplicitEncryptOpts
+from pymongocrypt.synchronous.state_machine import run_state_machine
+
+
+class ExplicitEncrypter:
+    def __init__(self, callback, mongo_crypt_opts):
+        """Encrypts and decrypts BSON values.
+
+        This class is used by a driver to support explicit encryption and
+        decryption of individual fields in a BSON document.
+
+        :Parameters:
+          - `callback`: A :class:`MongoCryptCallback`.
+          - `mongo_crypt_opts`: A :class:`MongoCryptOptions`.
+        """
+        self.callback = callback
+        if mongo_crypt_opts.schema_map is not None:
+            raise ValueError("mongo_crypt_opts.schema_map must be None")
+        self.mongocrypt = MongoCrypt(mongo_crypt_opts, callback)
+
+    def create_data_key(
+        self, kms_provider, master_key=None, key_alt_names=None, key_material=None
+    ):
+        """Creates a data key used for explicit encryption.
+
+        :Parameters:
+          - `kms_provider`: The KMS provider to use. Supported values are
+            "aws", "azure", "gcp", "kmip", "local", or a named provider like
+            "kmip:name".
+          - `master_key`: See class:`DataKeyOpts`.
+          - `key_alt_names` (optional): An optional list of string alternate
+            names used to reference a key. If a key is created with alternate
+            names, then encryption may refer to the key by the unique
+            alternate name instead of by ``_id``.
+          - `key_material`: (optional) See class:`DataKeyOpts`.
+
+        :Returns:
+          The _id of the created data key document.
+        """
+        # CDRIVER-3275 each key_alt_name needs to be wrapped in a bson
+        # document.
+        encoded_names = []
+        if key_alt_names is not None:
+            for name in key_alt_names:
+                encoded_names.append(self.callback.bson_encode({"keyAltName": name}))
+
+        if key_material is not None:
+            key_material = self.callback.bson_encode({"keyMaterial": key_material})
+
+        opts = DataKeyOpts(master_key, encoded_names, key_material)
+        with self.mongocrypt.data_key_context(kms_provider, opts) as ctx:
+            key = run_state_machine(ctx, self.callback)
+        return self.callback.insert_data_key(key)
+
+    def rewrap_many_data_key(self, filter, provider=None, master_key=None):
+        """Decrypts and encrypts all matching data keys with a possibly new `master_key` value.
+
+        :Parameters:
+          - `filter`: A document used to filter the data keys.
+          - `provider`: (optional) The name of a different kms provider.
+          - `master_key`: Optional document for the given provider.
+
+        :Returns:
+          A binary document with the rewrap data.
+        """
+        with self.mongocrypt.rewrap_many_data_key_context(
+            filter, provider, master_key
+        ) as ctx:
+            return run_state_machine(ctx, self.callback)
+
+    def encrypt(
+        self,
+        value,
+        algorithm,
+        key_id=None,
+        key_alt_name=None,
+        query_type=None,
+        contention_factor=None,
+        range_opts=None,
+        is_expression=False,
+    ):
+        """Encrypts a BSON value.
+
+        Note that exactly one of ``key_id`` or  ``key_alt_name`` must be
+        provided.
+
+        :Parameters:
+          - `value` (bytes): The BSON value to encrypt.
+          - `algorithm` (string): The encryption algorithm to use. See
+            :class:`Algorithm` for some valid options.
+          - `key_id` (bytes): The bytes of the binary subtype 4 ``_id`` data
+            key. For example, ``uuid.bytes`` or ``bytes(bson_binary)``.
+          - `key_alt_name` (string): Identifies a key vault document by
+            'keyAltName'.
+          - `query_type` (str): The query type to execute.
+          - `contention_factor` (int): The contention factor to use
+            when the algorithm is "Indexed".
+          - `range_opts` (bytes): Options for explicit encryption
+            with the "range" algorithm encoded as a BSON document.
+          - `is_expression` (boolean): True if this is an encryptExpression()
+            context. Defaults to False.
+
+        :Returns:
+          The encrypted BSON value.
+
+        .. versionchanged:: 1.3
+           Added the `query_type` and `contention_factor` parameters.
+        .. versionchanged:: 1.5
+           Added the `range_opts` and `is_expression` parameters.
+        """
+        # CDRIVER-3275 key_alt_name needs to be wrapped in a bson document.
+        if key_alt_name is not None:
+            key_alt_name = self.callback.bson_encode({"keyAltName": key_alt_name})
+        opts = ExplicitEncryptOpts(
+            algorithm,
+            key_id,
+            key_alt_name,
+            query_type,
+            contention_factor,
+            range_opts,
+            is_expression,
+        )
+        with self.mongocrypt.explicit_encryption_context(value, opts) as ctx:
+            return run_state_machine(ctx, self.callback)
+
+    def decrypt(self, value):
+        """Decrypts a BSON value.
+
+        :Parameters:
+          - `value`: The encoded document to decrypt, which must be in the
+            form { "v" : encrypted BSON value }}.
+
+        :Returns:
+          The decrypted BSON value.
+        """
+        with self.mongocrypt.explicit_decryption_context(value) as ctx:
+            return run_state_machine(ctx, self.callback)
+
+    def close(self):
+        """Cleanup resources."""
+        self.mongocrypt.close()

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/synchronous/state_machine.py

@@ -0,0 +1,149 @@
+# Copyright 2024-present MongoDB, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from abc import abstractmethod
+
+from pymongocrypt.binding import lib
+from pymongocrypt.compat import ABC
+from pymongocrypt.errors import MongoCryptError
+from pymongocrypt.synchronous.credentials import _ask_for_kms_credentials
+
+
+class MongoCryptCallback(ABC):
+    """Callback ABC to perform I/O on behalf of libbmongocrypt."""
+
+    @abstractmethod
+    def kms_request(self, kms_context):
+        """Complete a KMS request.
+
+        :Parameters:
+          - `kms_context`: A :class:`MongoCryptKmsContext`.
+
+        :Returns:
+          None
+        """
+
+    @abstractmethod
+    def collection_info(self, database, filter):
+        """Get the collection info for a namespace.
+
+        The returned collection info is passed to libmongocrypt which reads
+        the JSON schema.
+
+        :Parameters:
+          - `database`: The database on which to run listCollections.
+          - `filter`: The filter to pass to listCollections.
+
+        :Returns:
+          The first document from the listCollections command response as BSON.
+        """
+
+    @abstractmethod
+    def mark_command(self, database, cmd):
+        """Mark a command for encryption.
+
+        :Parameters:
+          - `database`: The database on which to run this command.
+          - `cmd`: The BSON command to run.
+
+        :Returns:
+          The marked command response from mongocryptd.
+        """
+
+    @abstractmethod
+    def fetch_keys(self, filter):
+        """Yields one or more keys from the key vault.
+
+        :Parameters:
+          - `filter`: The filter to pass to find.
+
+        :Returns:
+          A generator which yields the requested keys from the key vault.
+        """
+
+    @abstractmethod
+    def insert_data_key(self, data_key):
+        """Insert a data key into the key vault.
+
+        :Parameters:
+          - `data_key`: The data key document to insert.
+
+        :Returns:
+          The _id of the inserted data key document.
+        """
+
+    @abstractmethod
+    def bson_encode(self, doc):
+        """Encode a document to BSON.
+
+        A document can be any mapping type (like :class:`dict`).
+
+        :Parameters:
+          - `doc`: mapping type representing a document
+
+        :Returns:
+          The encoded BSON bytes.
+        """
+
+    @abstractmethod
+    def close(self):
+        """Release resources."""
+
+
+def run_state_machine(ctx, callback):
+    """Run the libmongocrypt state machine until completion.
+
+    :Parameters:
+      - `ctx`: A :class:`MongoCryptContext`.
+      - `callback`: A :class:`MongoCryptCallback`.
+
+    :Returns:
+      The completed libmongocrypt operation.
+    """
+    while True:
+        state = ctx.state
+        # Check for terminal states first.
+        if state == lib.MONGOCRYPT_CTX_ERROR:
+            ctx._raise_from_status()
+        elif state == lib.MONGOCRYPT_CTX_READY:
+            return ctx.finish()
+        elif state == lib.MONGOCRYPT_CTX_DONE:
+            return None
+
+        if state == lib.MONGOCRYPT_CTX_NEED_MONGO_COLLINFO:
+            list_colls_filter = ctx.mongo_operation()
+            coll_info = callback.collection_info(ctx.database, list_colls_filter)
+            if coll_info:
+                ctx.add_mongo_operation_result(coll_info)
+            ctx.complete_mongo_operation()
+        elif state == lib.MONGOCRYPT_CTX_NEED_MONGO_MARKINGS:
+            mongocryptd_cmd = ctx.mongo_operation()
+            result = callback.mark_command(ctx.database, mongocryptd_cmd)
+            ctx.add_mongo_operation_result(result)
+            ctx.complete_mongo_operation()
+        elif state == lib.MONGOCRYPT_CTX_NEED_MONGO_KEYS:
+            key_filter = ctx.mongo_operation()
+            for key in callback.fetch_keys(key_filter):
+                ctx.add_mongo_operation_result(key)
+            ctx.complete_mongo_operation()
+        elif state == lib.MONGOCRYPT_CTX_NEED_KMS:
+            for kms_ctx in ctx.kms_contexts():
+                with kms_ctx:
+                    callback.kms_request(kms_ctx)
+            ctx.complete_kms()
+        elif state == lib.MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS:
+            creds = _ask_for_kms_credentials(ctx.kms_providers)
+            ctx.provide_kms_providers(callback.bson_encode(creds))
+        else:
+            raise MongoCryptError(f"unknown state: {state}")

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/version.py

@@ -12,6 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-__version__ = '1.4.2.dev0'
+__version__ = "1.11.0.dev0"
 
-_MIN_LIBMONGOCRYPT_VERSION = '1.7.0-alpha1'
+_MIN_LIBMONGOCRYPT_VERSION = "1.8.0"

data/ext/libmongocrypt/libmongocrypt/bindings/python/pyproject.toml

@@ -0,0 +1,118 @@
+[build-system]
+requires = ["hatchling>1.24","hatch-requirements-txt>=0.4.1"]
+build-backend = "hatchling.build"
+
+[project]
+name = "pymongocrypt"
+dynamic = ["version", "dependencies", "optional-dependencies"]
+description = "Python bindings for libmongocrypt"
+readme = "README.rst"
+license = {file="LICENSE"}
+requires-python = ">=3.8"
+authors = [
+    { name = "Shane Harvey", email = "mongodb-user@googlegroups.com" },
+]
+keywords = [
+    "bson",
+    "mongo",
+    "mongocrypt",
+    "mongodb",
+    "pymongo",
+    "pymongocrypt",
+]
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: Apache Software License",
+    "Operating System :: MacOS :: MacOS X",
+    "Operating System :: Microsoft :: Windows",
+    "Operating System :: POSIX",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.8",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: Implementation :: CPython",
+    "Programming Language :: Python :: Implementation :: PyPy",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Database",
+]
+
+[project.urls]
+Homepage = "https://github.com/mongodb/libmongocrypt/tree/master/bindings/python"
+
+[tool.hatch.version]
+path = "pymongocrypt/version.py"
+validate-bump = false
+
+# Used to call hatch_build.py
+[tool.hatch.build.hooks.custom]
+
+[tool.hatch.metadata.hooks.requirements_txt]
+files = ["requirements.txt"]
+
+[tool.hatch.metadata.hooks.requirements_txt.optional-dependencies]
+test = ["requirements-test.txt"]
+
+[tool.ruff.lint]
+select = [
+  "E", "F", "W", # flake8
+  "B",           # flake8-bugbear
+  "I",           # isort
+  "ARG",         # flake8-unused-arguments
+  "C4",          # flake8-comprehensions
+  "EM",          # flake8-errmsg
+  "ICN",         # flake8-import-conventions
+  "G",           # flake8-logging-format
+  "PGH",         # pygrep-hooks
+  "PIE",         # flake8-pie
+  "PL",          # pylint
+  "PT",          # flake8-pytest-style
+  "PTH",         # flake8-use-pathlib
+  "RET",         # flake8-return
+  "RUF",         # Ruff-specific
+  "S",           # flake8-bandit
+  "SIM",         # flake8-simplify
+  "T20",         # flake8-print
+  "UP",          # pyupgrade
+  "YTT",         # flake8-2020
+  "EXE",         # flake8-executable
+]
+ignore = [
+  "PLR",    # Design related pylint codes
+  "E501",   # Line too long
+  "PT004",  # Use underscore for non-returning fixture (use usefixture instead)
+  "UP007",  # Use `X | Y` for type annotation
+  "EM101",  # Exception must not use a string literal, assign to variable first
+  "EM102",  # Exception must not use an f-string literal, assign to variable first
+  "G004",   # Logging statement uses f-string"
+  "UP006",  # Use `type` instead of `Type` for type annotation"
+  "RET505", # Unnecessary `elif` after `return` statement"
+  "RET506", # Unnecessary `elif` after `raise` statement
+  "SIM108", # Use ternary operator"
+  "PTH123", # `open()` should be replaced by `Path.open()`"
+  "SIM102", # Use a single `if` statement instead of nested `if` statements
+  "SIM105", # Use `contextlib.suppress(OSError)` instead of `try`-`except`-`pass`
+  "ARG002", # Unused method argument:
+  "S101",   # Use of `assert` detected
+  "SIM114", # Combine `if` branches using logical `or` operator
+  "PGH003", # Use specific rule codes when ignoring type issues
+  "RUF012", # Mutable class attributes should be annotated with `typing.ClassVar`
+  "EM103",  # Exception must not use a `.format()` string directly, assign to variable first
+  "C408",   # Unnecessary `dict` call (rewrite as a literal)
+  "SIM117", # Use a single `with` statement with multiple contexts instead of nested `with` statements
+  "PLW0603", # Using the global statement to update is discouraged
+  "F403" # Unable to detect undefined names
+]
+unfixable = [
+  "RUF100", # Unused noqa
+  "T20",  # Removes print statements
+  "F841", # Removes unused variables
+]
+
+[tool.ruff.lint.per-file-ignores]
+"test/*.py" = ["PT", "E402", "PLW", "SIM", "E741", "PTH", "S", "B904", "E722", "T201",
+    "RET", "ARG", "F405", "B028", "PGH001", "B018", "F403", "RUF015", "E731", "B007",
+    "UP031", "F401", "B023", "F811"]
+"pymongocrypt/crypto.py" = ["ARG001"]

data/ext/libmongocrypt/libmongocrypt/bindings/python/release.sh

@@ -1,92 +1,128 @@
 #!/bin/bash -ex
 
 # This script should be run on macOS and Cygwin on Windows.
-# On macOS it will create the following distributions:
+# On macOS it will create the following distributions
 # pymongocrypt-<version>.tar.gz
-# pymongocrypt-<version>-py2.py3-none-manylinux2010_x86_64.whl
-# pymongocrypt-<version>-py2.py3-none-manylinux_2_12_x86_64.manylinux2010_x86_64.whl
-# pymongocrypt-<version>-py2.py3-none-macosx_10_9_x86_64.whl
+# pymongocrypt-<version>-py3-none-macosx_11_0_universal2.whl
+# pymongocrypt-<version>-py3-none-macosx_10_14_intel.whl
 #
 # On Windows it will create the following distribution:
-# pymongocrypt-<version>-py2.py3-none-win_amd64.whl
+# pymongocrypt-<version>-py3-none-win_amd64.whl
+#
+# If docker is available on Linux or MacOS, it will also produce the following:
+# pymongocrypt-<Version>-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
 
 set -o xtrace   # Write all commands first to stderr
 set -o errexit  # Exit the script with error if any of the commands fail
 
 # The libmongocrypt git revision release to embed in our wheels.
-REVISION=$(git rev-list -n 1 1.7.0-alpha1)
+LIBMONGOCRYPT_VERSION=$(cat ./libmongocrypt-version.txt)
+REVISION=$(git rev-list -n 1 $LIBMONGOCRYPT_VERSION)
 # The libmongocrypt release branch.
-BRANCH="master"
-MACOS_TARGET=${MACOS_TARGET:="macos"}
+BRANCH="r1.10"
+# The python executable to use.
+PYTHON=${PYTHON:-python}
 
-if [ "Windows_NT" = "$OS" ]; then # Magic variable in cygwin
-    rm -rf venv37
-    virtualenv -p C:\\python\\Python37\\python.exe venv37 && . ./venv37/Scripts/activate
+# Clean slate.
+rm -rf dist .venv build libmongocrypt pymongocrypt/*.so pymongocrypt/*.dll pymongocrypt/*.dylib
 
-    # Build the Windows wheel.
+function get_libmongocrypt() {
+    TARGET=$1
+    MONGOCRYPT_SO=$2
     rm -rf build libmongocrypt pymongocrypt/*.so pymongocrypt/*.dll pymongocrypt/*.dylib
-    curl -O https://s3.amazonaws.com/mciuploads/libmongocrypt/windows-test/${BRANCH}/${REVISION}/libmongocrypt.tar.gz
+    curl -O https://s3.amazonaws.com/mciuploads/libmongocrypt-release/$TARGET/${BRANCH}/${REVISION}/libmongocrypt.tar.gz
     mkdir libmongocrypt
     tar xzf libmongocrypt.tar.gz -C ./libmongocrypt
-    NOCRYPTO_SO=libmongocrypt/nocrypto/bin/mongocrypt.dll
-    chmod +x ${NOCRYPTO_SO}
-    cp ${NOCRYPTO_SO} pymongocrypt/
+    chmod +x ${MONGOCRYPT_SO}
+    cp ${MONGOCRYPT_SO} pymongocrypt/
     rm -rf ./libmongocrypt libmongocrypt.tar.gz
+}
 
-    # Ensure updated deps.
-    python -m pip install --upgrade pip setuptools wheel
-
-    python setup.py bdist_wheel
+function build_wheel() {
+    python -m pip install unasync
+    python -m pip install --upgrade pip build
+    python -m build --wheel
     rm -rf build libmongocrypt pymongocrypt/*.so pymongocrypt/*.dll pymongocrypt/*.dylib
-    ls dist
-elif [ "Darwin" = "$(uname -s)" ]; then
-    # Build the mac wheel.
-    PYTHON=${PYTHON:="/Library/Frameworks/Python.framework/Versions/3.10/bin/python3"}
+}
 
-    # Ensure updated deps.
-    $PYTHON -m pip install --upgrade pip setuptools wheel
+function build_manylinux_wheel() {
+    python -m pip install unasync
+    docker pull $1
+    docker run --rm -v `pwd`:/python $1 /python/build-manylinux-wheel.sh
+    # Sudo is needed to remove the files created by docker.
+    sudo rm -rf build libmongocrypt pymongocrypt/*.so pymongocrypt/*.dll pymongocrypt/*.dylib
+}
 
-    rm -rf build libmongocrypt pymongocrypt/*.so pymongocrypt/*.dll pymongocrypt/*.dylib
+function test_dist() {
+    python -m pip uninstall -y pymongocrypt
+    python -m pip install $1
+    pushd ..
+    python -c "from pymongocrypt.binding import libmongocrypt_version, lib"
+    popd
+}
 
-    # Install the sdist.
-    $PYTHON setup.py sdist
+# Handle Windows dist.
+if [ "Windows_NT" = "$OS" ]; then # Magic variable in cygwin
+    $PYTHON -m venv .venv
+    # Workaround https://bugs.python.org/issue32451:
+    # .venv/Scripts/activate: line 3: $'\r': command not found
+    dos2unix .venv/Scripts/activate || true
+    . ./.venv/Scripts/activate
 
-    curl -O https://s3.amazonaws.com/mciuploads/libmongocrypt/${MACOS_TARGET}/${BRANCH}/${REVISION}/libmongocrypt.tar.gz
-    mkdir libmongocrypt
-    tar xzf libmongocrypt.tar.gz -C ./libmongocrypt
-    NOCRYPTO_SO=libmongocrypt/nocrypto/lib/libmongocrypt.dylib
-    chmod +x ${NOCRYPTO_SO}
-    cp ${NOCRYPTO_SO} pymongocrypt/
-    rm -rf ./libmongocrypt libmongocrypt.tar.gz
+    # Use crypto-enabled libmongocrypt.
+    get_libmongocrypt windows-test libmongocrypt/bin/mongocrypt.dll
+    build_wheel
+    test_dist dist/*.whl
+fi
 
-    $PYTHON setup.py bdist_wheel
-    rm -rf build libmongocrypt pymongocrypt/*.so pymongocrypt/*.dll pymongocrypt/*.dylib
-    ls dist
+# Handle MacOS dists.
+if [ "Darwin" = "$(uname -s)" ]; then
+    $PYTHON -m venv .venv
+    . .venv/bin/activate
+
+    # Build universal2 wheel.
+    get_libmongocrypt macos libmongocrypt/lib/libmongocrypt.dylib
+    export MACOSX_DEPLOYMENT_TARGET=11.0
+    export _PYTHON_HOST_PLATFORM=macosx-11.0-universal2
+    build_wheel
+    if [ "$(uname -m)" == "arm64" ]; then
+        test_dist dist/*universal2.whl
+    fi
+
+    # Build and test sdist.
+    python -m build --sdist
+    test_dist dist/*.tar.gz
 fi
 
+# Handle manylinux dists.
 if [ $(command -v docker) ]; then
-    # Build the manylinux2010 wheels.
-    rm -rf build libmongocrypt pymongocrypt/*.so pymongocrypt/*.dll pymongocrypt/*.dylib
-    curl -O https://s3.amazonaws.com/mciuploads/libmongocrypt/rhel-62-64-bit/${BRANCH}/${REVISION}/libmongocrypt.tar.gz
-    mkdir libmongocrypt
-    tar xzf libmongocrypt.tar.gz -C ./libmongocrypt
-    NOCRYPTO_SO=libmongocrypt/nocrypto/lib64/libmongocrypt.so
-    chmod +x ${NOCRYPTO_SO}
-    cp ${NOCRYPTO_SO} pymongocrypt/
-    rm -rf ./libmongocrypt libmongocrypt.tar.gz
+    if [ "Windows_NT" = "$OS" ]; then
+        # docker: Error response from daemon: Windows does not support privileged mode
+        # would be raised by the qemu command below.
+        echo "Not supported on Windows"
+        exit 0
+    fi
 
-    # 2021-05-05-1ac6ef3 was the last release to generate pip < 20.3 compatible
-    # wheels. After that auditwheel was upgraded to v4 which produces PEP 600
-    # manylinux_x_y wheels which requires pip >= 20.3. We use the older docker
-    # image to support older pip versions.
-    images=(quay.io/pypa/manylinux2010_x86_64:2021-05-05-1ac6ef3 \
-            quay.io/pypa/manylinux2010_x86_64)
-    for image in "${images[@]}"; do
-        docker pull $image
-        docker run --rm -v `pwd`:/python $image /python/build-manylinux-wheel.sh
-    done
+    # Set up qemu support using the method used in docker/setup-qemu-action
+    # https://github.com/docker/setup-qemu-action/blob/2b82ce82d56a2a04d2637cd93a637ae1b359c0a7/README.md?plain=1#L46
+    docker run --rm --privileged tonistiigi/binfmt:latest --install all
 
-    # Sudo is needed to remove the files created by docker.
-    sudo rm -rf build libmongocrypt pymongocrypt/*.so pymongocrypt/*.dll pymongocrypt/*.dylib
-    ls dist
+    # Build the manylinux2014 x86_64 wheel.
+    # https://github.com/pypa/manylinux
+    # Supports CentOS 7 rh-python38, CentOS 8 python38, Fedora 32+, Ubuntu 20.04+.
+    # When the rhel7 images go EOL we'll have to switch to the manylinux_x_y variants
+    # and use rhel8.
+    get_libmongocrypt rhel-70-64-bit libmongocrypt/nocrypto/lib64/libmongocrypt.so
+    build_manylinux_wheel quay.io/pypa/manylinux2014_x86_64:2023-12-05-e9f0345
+    if [ "Linux" = "$(uname -s)" ]; then
+        $PYTHON -m venv .venv
+        . .venv/bin/activate
+        test_dist dist/*linux*.whl
+    fi
+
+    # Build the manylinux_2_28 aarch64 wheel.
+    get_libmongocrypt rhel-82-arm64 libmongocrypt/nocrypto/lib64/libmongocrypt.so
+    build_manylinux_wheel quay.io/pypa/manylinux_2_28_aarch64:2024-01-01-0e91b08
 fi
+
+ls -ltr dist

data/ext/libmongocrypt/libmongocrypt/bindings/python/requirements-test.txt

@@ -0,0 +1,7 @@
+pymongo[aws]>=4
+cffi>=1.12.0,<2
+cryptography>=2
+pytest>=7.0
+unasync
+respx
+setuptools

data/ext/libmongocrypt/libmongocrypt/bindings/python/requirements.txt

@@ -0,0 +1,4 @@
+cffi>=1.12.0,<2
+cryptography>=40
+packaging>=21.0
+httpx>=0.25.0