libmongocrypt-helper 1.7.4.0.1002 → 1.11.0.0.1001

data/ext/libmongocrypt/libmongocrypt/doc/releasing.md

@@ -0,0 +1,153 @@
+# Releasing libmongocrypt
+
+These steps describe releasing the libmongocrypt C library (not the language bindings).
+
+## Version number scheme ##
+Version numbers of libmongocrypt must follow the format 1.[0-9].[0-9] for releases and 1.[0-9].[0-9]-(alpha|beta|rc)[0-9] for pre-releases.  This ensures that Linux distribution packages built from each commit are published to the correct location.
+
+## Steps to release ##
+
+### Check for Vulnerabilities
+
+Snyk and Silk are used to satisfy vulnerability scanning requirements of [DRIVERS-714](https://jira.mongodb.org/browse/DRIVERS-714). Prior to releasing, ensure necessary reported vulnerabilities meet requirements described in: [MongoDB Software Security Development Lifecycle Policy](https://docs.google.com/document/d/1u0m4Kj2Ny30zU74KoEFCN4L6D_FbEYCaJ3CQdCYXTMc/edit?tab=t.0#bookmark=id.l09k96qt24jm).
+
+#### Check Snyk
+
+Go to [Snyk](https://app.snyk.io/) and select the `dev-prod` organization. If access is needed, see [Snyk Onboarding](https://docs.google.com/document/d/1A38HvDvVFOwLtJQfQwIGcy5amAIpDwHUkNInwezLwXY/edit#heading=h.9ayipd2nt7xg). Check the CLI target named `mongodb/libmongocrypt`. The CLI targets may be identified by this icon: ![CLI icon](img/cli-icon.png). There are reference targets for each tracked branch:
+
+![Reference Targets](img/reference-targets.png)
+
+Copy the organization ID from [Snyk settings](https://app.snyk.io/org/dev-prod/manage/settings).
+
+##### Update Snyk
+
+Update the Snyk reference target tracking the to-be-released branch. For a patch release (e.g. x.y.z), check-out the `rx.y` branch and update the `rx.y` reference target. For a minor release (e.g. x.y.0), check out the `master` branch update the `master` reference target.
+
+Run `cmake` to ensure generated source files are present:
+```bash
+cmake -S. -Bcmake-build -D BUILD_TESTING=OFF
+cmake --build cmake-build --target mongocrypt
+```
+
+Print dependencies found by Snyk and verify libbson is found:
+```bash
+snyk test --unmanaged --print-dep-paths
+```
+
+Copy the organization ID from [Snyk settings](https://app.snyk.io/org/dev-prod/manage/settings). Create the new Snyk reference target to track the newly created release branch:
+```bash
+snyk auth
+snyk monitor \
+--org=$ORGANIZATION_ID \
+--target-reference="<rx.y or master>" \
+--unmanaged \
+--remote-repo-url=https://github.com/mongodb/libmongocrypt.git
+```
+
+```bash
+snyk auth
+snyk monitor \
+--org=$ORGANIZATION_ID \
+--target-reference=<rx.y or master> \
+--unmanaged \
+--remote-repo-url=https://github.com/mongodb/libmongocrypt.git
+```
+
+Check the updated reference targets in Snyk for detected vulnerabilities.
+
+#### Check Silk
+
+Get credentials for Silk from the `drivers/libmongocrypt` vault in [AWS Secrets Manager](https://wiki.corp.mongodb.com/display/DRIVERS/Using+AWS+Secrets+Manager+to+Store+Testing+Secrets).
+
+Download the Augmented SBOM using:
+```bash
+./.evergreen/earthly.sh \
+   --secret silk_client_id=${silk_client_id} \
+   --secret silk_client_secret=${silk_client_secret} \
+   +sbom-download \
+   --out cyclonedx.augmented.sbom.json \
+   --branch <branch>
+```
+
+Check the contents of the "vulnerabilities" field (if present) in the Augmented SBOM.
+
+### Release
+
+Do the following when releasing:
+- If this is a feature release (e.g. `x.y.0` or `x.0.0`), follow these steps: [Creating SSDLC static analysis reports](https://docs.google.com/document/d/1rkFL8ymbkc0k8Apky9w5pTPbvKRm68wj17mPJt2_0yo/edit).
+- Check out the release branch. For a release `x.y.z`, the release branch is `rx.y`. If this is a new minor release (`x.y.0`), create the release branch.
+- Update CHANGELOG.md with the version being released.
+- Ensure `etc/purls.txt` is up-to-date.
+- Update `etc/third_party_vulnerabilities.md` with any updates to new or known vulnerabilities for third party dependencies that must be reported.
+- If this is a new minor release (e.g. `x.y.0`):
+   - Update the Linux distribution package installation instructions in the below sections to refer to the new version `x.y`.
+   - Update the [libmongocrypt-release](https://spruce.mongodb.com/project/libmongocrypt-release/settings/general) Evergreen project (requires auth) to set `Branch Name` to `rx.y`.
+- Commit the changes on the `rx.y` branch with a message like "Update CHANGELOG.md for x.y.z".
+- Tag the commit with `git tag -a <tag>`.
+   - Push both the branch ref and tag ref in the same command: `git push origin master 1.8.0-alpha0` or `git push origin r1.8 1.8.4`
+   - Pushing the branch ref and the tag ref in the same command eliminates the possibility of a race condition in Evergreen (for building resources based on the presence of a release tag)
+   - Note that in the future (e.g., if we move to a PR-based workflow for releases, or if we simply want to take better advantage of advanced Evergreen features), it is possible to use Evergreen's "Trigger Versions With Git Tags" feature by updating both `config.yml` and the project's settings in Evergreen
+- Ensure the version on Evergreen with the tagged commit is scheduled. The following tasks must pass to complete the release:
+   - `upload-all`
+   - `windows-upload-release`
+   - All `publish-packages` tasks.
+      - If the `publish-packages` tasks fail with an error like `[curator] 2024/01/02 13:56:17 [p=emergency]: problem submitting repobuilder job: 404 (Not Found)`, this suggests the published path does not yet exist. Barque (the Linux package publishing service) has protection to avoid unintentional publishes. File a DEVPROD ticket ([example](https://jira.mongodb.org/browse/DEVPROD-4053)) and assign to the team called Release Infrastructure to request the path be created. Then re-run the failing `publish-packages` task. Ask in the slack channel `#devprod-release-tools` for further help with `Barque` or `curator`.
+- Create the release from the GitHub releases page from the new tag.
+   - Attach the tarball and signature file from the Files tab of the `windows-upload-release` task. [Example](https://github.com/mongodb/libmongocrypt/releases/tag/1.10.0).
+   - Attach the Augmented SBOM file. Download the Augmented SBOM using:
+     ```bash
+     ./.evergreen/earthly.sh \
+        --secret silk_client_id=${silk_client_id} \
+        --secret silk_client_secret=${silk_client_secret} \
+        +sbom-download \
+        --out cyclonedx.augmented.sbom.json \
+        --branch <branch>
+     ```
+     For a new minor release, use `master` for `--branch`. For a patch release, use the release branch (e.g. `rx.y`).
+     Secrets can be obtained from [AWS Secrets Manager](https://wiki.corp.mongodb.com/display/DRIVERS/Using+AWS+Secrets+Manager+to+Store+Testing+Secrets) under `drivers/libmongocrypt`.
+   - Attach `etc/third_party_vulnerabilities.md` to the release.
+   - Attach `ssdlc_compliance_report.md` to the release.
+
+- If this is a new minor release (e.g. `x.y.0`):
+   - File a DOCSP ticket to update the installation instructions on [Install libmongocrypt](https://www.mongodb.com/docs/manual/core/csfle/reference/libmongocrypt/). ([Example](https://jira.mongodb.org/browse/DOCSP-36863))
+   - Create a new Silk asset group. Use the newly created release branch (e.g. `rx.y`) as the `--branch` argument:
+     ```bash
+     ./.evergreen/earthly.sh \
+        --secret silk_client_id=${silk_client_id} \
+        --secret silk_client_secret=${silk_client_secret} \
+        +silk-create-asset-group \
+        --branch <branch>
+     ```
+   - Create a new Snyk reference target. The following instructions use the example branch `rx.y`:
+
+     Run `cmake` to ensure generated source files are present:
+     ```bash
+     cmake -S. -Bcmake-build -D BUILD_TESTING=OFF
+     cmake --build cmake-build --target mongocrypt
+     ```
+
+     Print dependencies found by Snyk and verify libbson is found:
+     ```bash
+     snyk test --unmanaged --print-dep-paths
+     ```
+
+     Copy the organization ID from [Snyk settings](https://app.snyk.io/org/dev-prod/manage/settings). Create the new Snyk reference target to track the newly created release branch:
+     ```bash
+     snyk auth
+     snyk monitor \
+      --org=$ORGANIZATION_ID \
+      --target-reference=rx.y \
+      --unmanaged \
+      --remote-repo-url=https://github.com/mongodb/libmongocrypt.git
+     ```
+     Snyk reference targets for older release branches may be removed if no further releases are expected on the branch.
+- Make a PR to apply the "Update CHANGELOG.md for x.y.z" commit to the `master` branch.
+- Update the release on the [Jira releases page](https://jira.mongodb.org/projects/MONGOCRYPT/versions).
+- Record the release on [C/C++ Release Info](https://docs.google.com/spreadsheets/d/1yHfGmDnbA5-Qt8FX4tKWC5xk9AhzYZx1SKF4AD36ecY/edit?usp=sharing). This is done to meet SSDLC reporting requirements.
+- Add a link to the Evergreen waterfall for the tagged commit to [libmongocrypt Security Testing Summary](https://docs.google.com/document/d/1dc7uvBzu3okAIsA8LSW5sVQGkYIvwpBVdg5v4wb4c4s/edit#heading=h.5t79jwe4p0ss).
+
+## Homebrew steps ##
+Submit a PR to update the Homebrew package https://github.com/mongodb/homebrew-brew/blob/master/Formula/libmongocrypt.rb. ([Example](https://github.com/mongodb/homebrew-brew/pull/208)). If not on macOS, request a team member to do this step.
+
+## Debian steps ##
+Refer to the [Debian](https://github.com/mongodb/mongo-c-driver/blob/master/docs/dev/debian.rst) steps. If you are not a Debian maintainer on the team, request a team member to do this step.

data/ext/libmongocrypt/libmongocrypt/etc/c6-vault.repo

@@ -0,0 +1,39 @@
+[C6.10-base]
+name=CentOS-6.10 - Base
+baseurl=http://vault.centos.org/6.10/os/$basearch/
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6
+enabled=1
+metadata_expire=never
+
+[C6.10-updates]
+name=CentOS-6.10 - Updates
+baseurl=http://vault.centos.org/6.10/updates/$basearch/
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6
+enabled=1
+metadata_expire=never
+
+[C6.10-extras]
+name=CentOS-6.10 - Extras
+baseurl=http://vault.centos.org/6.10/extras/$basearch/
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6
+enabled=1
+metadata_expire=never
+
+[C6.10-contrib]
+name=CentOS-6.10 - Contrib
+baseurl=http://vault.centos.org/6.10/contrib/$basearch/
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6
+enabled=0
+metadata_expire=never
+
+[C6.10-centosplus]
+name=CentOS-6.10 - CentOSPlus
+baseurl=http://vault.centos.org/6.10/centosplus/$basearch/
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6
+enabled=0
+metadata_expire=never

data/ext/libmongocrypt/libmongocrypt/etc/calc_release_version.py

@@ -22,11 +22,35 @@ branch and/or recent tags in history) to assign to a tarball generated from the
 current Git commit.
 """
 
+# XXX NOTE XXX NOTE XXX NOTE XXX
+# After modifying this script it is advisable to execute the self-test.
+#
+# This is done by starting in the directory containing this script and then
+# executing a separate self-test script, like this:
+#
+# $ bash ./calc_release_version_selftest.sh
+#
+# The self-test script will emit diagnostic output. If tracing of the execution
+# of each command is desired, then add the -x option to the bash invocation.
+# XXX NOTE XXX NOTE XXX NOTE XXX
+
 import datetime
 import re
 import subprocess
 import sys
-from distutils.version import LooseVersion
+try:
+    # Prefer newer `packaging` over deprecated packages.
+    from packaging.version import Version as Version
+    from packaging.version import parse as parse_version
+except ImportError:
+    # Fallback to deprecated pkg_resources.
+    try:
+        from pkg_resources.extern.packaging.version import Version
+        from pkg_resources import parse_version
+    except ImportError:
+        # Fallback to deprecated distutils.
+        from distutils.version import LooseVersion as Version
+        from distutils.version import LooseVersion as parse_version
 
 DEBUG = len(sys.argv) > 1 and '-d' in sys.argv
 if DEBUG:
@@ -70,7 +94,8 @@ def check_head_tag():
     """
 
     found_tag = False
-    version_loose = LooseVersion('0.0.0')
+    version_str = '0.0.0'
+    version_parsed = parse_version(version_str)
 
     # have git tell us if any tags that look like release tags point at HEAD;
     # based on our policy, a commit should never have more than one release tag
@@ -83,17 +108,19 @@ def check_head_tag():
 
     release_tag_match = RELEASE_TAG_RE.match(tag)
     if release_tag_match:
-        new_version_loose = LooseVersion(release_tag_match.group('ver'))
-        if new_version_loose > version_loose:
+        new_version_str = release_tag_match.group('ver')
+        new_version_parsed = parse_version(new_version_str)
+        if new_version_parsed > version_parsed:
             if DEBUG:
-                print('HEAD release tag: ' + release_tag_match.group('ver'))
-            version_loose = new_version_loose
+                print('HEAD release tag: ' + new_version_str)
+            version_str = new_version_str
+            version_parsed = new_version_parsed
             found_tag = True
 
     if found_tag:
         if DEBUG:
-            print('Calculated version: ' + str(version_loose))
-        return str(version_loose)
+            print('Calculated version: ' + version_str)
+        return version_str
 
     return None
 
@@ -106,7 +133,8 @@ def get_next_minor(prerelease_marker):
         - Append a pre-release marker. (e.g. 1.22.0 becomes 1.22.0-20220201+gitf6e6a7025d)
     """
 
-    version_loose = LooseVersion('0.0.0')
+    version_str = '0.0.0'
+    version_parsed = parse_version(version_str)
 
     version_new = {}
     # Use refs (not branches) to get local branches plus remote branches
@@ -119,17 +147,19 @@ def get_next_minor(prerelease_marker):
             version_new['minor'] = int(release_branch_match.group('vermin')) + 1
             version_new['patch'] = 0
             version_new['prerelease'] = prerelease_marker
-            new_version_loose = LooseVersion(str(version_new['major']) + '.' +
-                                             str(version_new['minor']) + '.' +
-                                             str(version_new['patch']) + '-' +
-                                             version_new['prerelease'])
-            if new_version_loose > version_loose:
-                version_loose = new_version_loose
+            new_version_str = str(version_new['major']) + '.' + \
+                              str(version_new['minor']) + '.' + \
+                              str(version_new['patch']) + '-' + \
+                              version_new['prerelease']
+            new_version_parsed = parse_version(new_version_str)
+            if new_version_parsed > version_parsed:
+                version_str = new_version_str
+                version_parsed = new_version_parsed
                 if DEBUG:
-                    print('Found new best version "' + str(version_loose) \
+                    print('Found new best version "' + version_str \
                             + '" based on branch "' \
                             + release_branch_match.group('brname') + '"')
-    return str(version_loose)
+    return version_str
 
 def get_branch_tags(active_branch_name):
     """
@@ -167,7 +197,7 @@ def get_branch_tags(active_branch_name):
 def process_and_sort_tags(tags):
     """
     Given a string (as returned from get_branch_tags), return a sorted list of
-    zero or more tags (sorted based on the LooseVersion comparison) which meet
+    zero or more tags (sorted based on the Version comparison) which meet
     the following criteria:
         - a final release tag (i.e., 1.x.y without any pre-release suffix)
         - a pre-release tag which is not superseded by a release tag (i.e.,
@@ -190,7 +220,7 @@ def process_and_sort_tags(tags):
         tag_parts = tag.split('-')
         if len(tag_parts) >= 2 and tag_parts[0] not in processed_and_sorted_tags:
             processed_and_sorted_tags.append(tag)
-    processed_and_sorted_tags.sort(key=LooseVersion)
+    processed_and_sorted_tags.sort(key=Version)
 
     return processed_and_sorted_tags
 
@@ -211,7 +241,8 @@ def main():
            patch version, and append a new pre-release marker
     """
 
-    version_loose = LooseVersion('0.0.0')
+    version_str = '0.0.0'
+    version_parsed = parse_version(version_str)
     head_commit_short = check_output(['git', 'rev-parse', '--revs-only',
                                       '--short=10', 'HEAD^{commit}']).strip()
     prerelease_marker = datetime.date.today().strftime('%Y%m%d') \
@@ -246,17 +277,19 @@ def main():
         version_new['minor'] = int(release_tag_match.group('vermin'))
         version_new['patch'] = int(release_tag_match.group('verpatch')) + 1
         version_new['prerelease'] = prerelease_marker
-        new_version_loose = LooseVersion(str(version_new['major']) + '.' +
-                                         str(version_new['minor']) + '.' +
-                                         str(version_new['patch']) + '-' +
-                                         version_new['prerelease'])
-        if new_version_loose > version_loose:
-            version_loose = new_version_loose
+        new_version_str = str(version_new['major']) + '.' + \
+                          str(version_new['minor']) + '.' + \
+                          str(version_new['patch']) + '-' + \
+                          version_new['prerelease']
+        new_version_parsed = parse_version(new_version_str)
+        if new_version_parsed > version_parsed:
+            version_str = new_version_str
+            version_parsed = new_version_parsed
             if DEBUG:
-                print('Found new best version "' + str(version_loose) \
+                print('Found new best version "' + version_str \
                         + '" from tag "' + release_tag_match.group('ver') + '"')
 
-    return str(version_loose)
+    return version_str
 
 RELEASE_VER = main()
 

data/ext/libmongocrypt/libmongocrypt/etc/calc_release_version_selftest.sh

@@ -0,0 +1,73 @@
+#!/bin/bash
+# calc_release_version_selftest.sh is used to test output of calc_release_version.py.
+# run with:
+# cd etc
+# ./calc_release_version_selftest.sh
+
+set -o errexit
+set -o pipefail
+
+function assert_eq () {
+    a="$1"
+    b="$2"
+    if [[ "$a" != "$b" ]]; then
+        echo "Assertion failed: $a != $b"
+        # Print caller
+        caller
+        exit 1
+    fi
+}
+
+SAVED_REF=$(git rev-parse HEAD)
+
+function cleanup () {
+    [[ -e calc_release_version_test.py ]] && rm calc_release_version_test.py
+    git checkout $SAVED_REF --quiet
+}
+
+trap cleanup EXIT
+
+: ${PYTHON_INTERP:=python}
+if [[ -z $(command -v "${PYTHON_INTERP}") ]]; then
+    echo "Python interpreter '${PYTHON_INTERP}' is not valid."
+    echo "Set the PYTHON_INTERP environment variable to a valid interpreter."
+    exit 1
+fi
+
+# copy calc_release_version.py to a separate file not tracked by git so it does not change on `git checkout`
+cp calc_release_version.py calc_release_version_test.py
+
+echo "Test a tagged commit ... begin"
+{
+    git checkout 1.8.1 --quiet
+    got=$("${PYTHON_INTERP}" calc_release_version_test.py)
+    assert_eq "$got" "1.8.1"
+    git checkout - --quiet
+}
+echo "Test a tagged commit ... end"
+
+DATE=$(date +%Y%m%d)
+echo "Test an untagged commit ... begin"
+{
+    # b7f8a1f1502d28a5ef440e642fddda8da8f873a1 is commit before 1.8.1
+    git checkout b7f8a1f1502d28a5ef440e642fddda8da8f873a1 --quiet
+    got=$("${PYTHON_INTERP}" calc_release_version_test.py)
+    assert_eq "$got" "1.8.1-$DATE+gitb7f8a1f150"
+    git checkout - --quiet
+}
+echo "Test an untagged commit ... end"
+
+echo "Test next minor version ... begin"
+{
+    CURRENT_SHORTREF=$(git rev-parse --revs-only --short=10 HEAD)
+    got=$("${PYTHON_INTERP}" calc_release_version_test.py --next-minor)
+    # XXX NOTE XXX NOTE XXX
+    # If you find yourself looking at this line because the assertion below
+    # failed, then it is probably because a new major/minor release was made.
+    # Update the expected output to represent the correct next version.
+    # XXX NOTE XXX NOTE XXX
+    assert_eq "$got" "1.9.0-$DATE+git$CURRENT_SHORTREF"
+}
+echo "Test next minor version ... end"
+
+echo "All tests passed"

data/ext/libmongocrypt/libmongocrypt/etc/cyclonedx.sbom.json

@@ -0,0 +1,108 @@
+{
+  "components": [
+    {
+      "bom-ref": "pkg:github/mongodb/mongo-c-driver@v1.27.1#src/libbson",
+      "copyright": "Copyright 2009-present MongoDB, Inc.",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://github.com/mongodb/mongo-c-driver/archive/refs/tags/v1.27.1.tar.gz"
+        },
+        {
+          "type": "website",
+          "url": "https://github.com/mongodb/mongo-c-driver/tree/v1.27.1"
+        }
+      ],
+      "group": "mongodb",
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "mongo-c-driver",
+      "purl": "pkg:github/mongodb/mongo-c-driver@v1.27.1#src/libbson",
+      "type": "library",
+      "version": "v1.27.1"
+    },
+    {
+      "bom-ref": "pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz",
+      "copyright": "Copyright (c) 2018, Intel Corp.",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "BSD-3-Clause"
+          }
+        }
+      ],
+      "name": "IntelRDFPMathLib",
+      "purl": "pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz",
+      "type": "library",
+      "version": "20U2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz"
+    },
+    {
+      "ref": "pkg:github/mongodb/mongo-c-driver@v1.27.1#src/libbson"
+    }
+  ],
+  "metadata": {
+    "timestamp": "2024-05-10T12:07:55.084050+00:00",
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "6.4.4"
+      }
+    ]
+  },
+  "serialNumber": "urn:uuid:879e1b41-08d8-4505-8c89-2285bc3e442c",
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}

data/ext/libmongocrypt/libmongocrypt/etc/fle2_aead_generate_tests.py

@@ -1,4 +1,5 @@
-# fle2_aead_generate_tests.py is used to generate the test file: ./test/data/fle2-aead.cstructs
+# fle2_aead_generate_tests.py is used to generate the test file: ./test/data/roundtrip/fle2aead-generated.json
+import json
 import os
 import itertools
 import fle2_crypto
@@ -6,18 +7,7 @@ import fle2_crypto
 # Generate test cases by taking the cross-product of AD (associated data) and plaintext (M) lengths.
 AD_lens = [5, 10, 20]
 M_lens = [1, 16, 64, 100]
-
-tmpl = """{{
-    .testname = "{testname}",
-    .iv = "{iv}",
-    .associated_data = "{associated_data}",
-    .key = "{key}",
-    .plaintext = "{plaintext}",
-    .ciphertext = "{ciphertext}",
-    .bytes_written_expected = {bytes_written_expected}
-}},"""
-
-print("/* This file is generated by ./etc/fle2_aead_generate_tests.py. */")
+out = []
 for (AD_len, M_len) in itertools.product(AD_lens, M_lens):
     M = os.urandom(M_len)
     AD = os.urandom(AD_len)
@@ -28,14 +18,15 @@ for (AD_len, M_len) in itertools.product(AD_lens, M_lens):
 
     # Create the 96 byte data encryption key. The last 32 are unused.
     key = Ke + Km + (b"\x00" * 32)
-    args = {
-        "testname": "generated test. AD length={}, M length={}".format(AD_len, M_len),
-        "iv": IV.hex(),
-        "associated_data": AD.hex(),
-        "key": key.hex(),
-        "plaintext": M.hex(),
-        "ciphertext": C.hex(),
-        "bytes_written_expected": len(C)
-    }
-    testcase = tmpl.format(**args)
-    print(testcase)
+    out.append({
+      'name': "generated test. AD length={}, M length={}".format(AD_len, M_len),
+      'origin': "etc/fle2_aead_generate_tests.py",
+      'algo': 'AES-256-CTR/SHA-256',
+      'iv': IV.hex(),
+      'aad': AD.hex(),
+      'key': key.hex(),
+      'plaintext': M.hex(),
+      'ciphertext': C.hex()
+   })
+
+print(json.JSONEncoder(indent=3).encode(out))