libmongocrypt-helper 1.8.0.0.1001 → 1.11.0.0.1001

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3ae10db4e420e2a2ec71ccedbb7024d15a87141ce15c0af424045482558aff11
-  data.tar.gz: 87fd8a2506d70a72f870c1be0e26c409d3e8e1b4ec11353faf275a2d467dab5a
+  metadata.gz: d52da7e268e39f57d0f06e5056eac9ca78cbc90d7f4088a4c905d72e3f8997e2
+  data.tar.gz: 5d68d759ad42dc16bd8c3818850561ce294bd08615c2938d5ade40a8b755d5d6
 SHA512:
-  metadata.gz: e962ba2224249acd36da0a9957e7dc2adabb7194253e0340461f7fde40e48a3ff5ee4bca30b642464479aacbb99121d2c9e8655e51bd630ec1395700ae87f625
-  data.tar.gz: 77f27ffb1c4277c9c9d45d967af1d7dafadcb8c4127b1691e6ecfe4c22c6e9a3cd7e258bcad334fe36baaa4f010f0dfa7a4c41f4f189f097b2e578acdaf0f50a
+  metadata.gz: 01a3dbefc3f7621c0acf918e2651f19057334f4acbdc20246e7e8dac7c2119269208202716fd19738a087d8688f38befad44ef85b1594da237f3bfd9be4c9744
+  data.tar.gz: 53c3fc9028f38a3a42844989e6783d36db4f714bd5eb0b837120ae9fb25d51dfad3b1e8f2ab7e69d027ed57648daeaf7c6781370e0021c300bec2cdcd37ba48e

data/ext/libmongocrypt/libmongocrypt/CHANGELOG.md

@@ -1,4 +1,37 @@
 # ChangeLog
+## 1.11.0
+### New features
+- Support `range` algorithm as stable.
+### Deprecated
+- The Windows download URLs for [stable](https://s3.amazonaws.com/mciuploads/libmongocrypt/windows/latest_release/libmongocrypt.tar.gz) and [unstable](https://s3.amazonaws.com/mciuploads/libmongocrypt/windows/latest_release/libmongocrypt_unstable.tar.gz) are now deprecated. See the GitHub Release page for Windows downloads.
+## 1.10.1
+## Fixed
+- Document `range` algorithm as unstable.
+## 1.10.0
+### New features
+- Support KMIP `delegated` option.
+- Support processing `bulkWrite` command.
+- Support `range` algorithm.
+## 1.9.1
+### New features
+- Add Debian 12 packages
+## 1.9.0
+### New features
+- Support named KMS providers.
+- Add `arm64` Debian packages
+## Fixed
+- Fix `arm64` Alpine build.
+## 1.8.4
+### Fixed
+- Fix `aarch64` packages for RHEL 8, RHEL 9, Amazon 2023, and Amazon 2
+## 1.8.3
+### Improvements
+- Include packages for RHEL 8, RHEL 9, and Amazon 2023
+## 1.8.2
+### Fixed
+- Fix possible leaks in Queryable Encryption in errors on malformed data.
+## 1.8.1
+- Bypass search index management commands in automatic encryption
 ## 1.8.0
 This release adds stable support of the Queryable Encryption (QE) feature for the "Indexed" and "Unindexed" algorithms.
 ## 1.8.0-alpha1

data/ext/libmongocrypt/libmongocrypt/CMakeLists.txt

@@ -7,6 +7,10 @@ elseif (DEFINED CMAKE_MSVC_RUNTIME_LIBRARY)
    message (WARNING "The CMAKE_MSVC_RUNTIME_LIBRARY variable is set, but CMake is too old to understand it")
 endif ()
 
+if (POLICY CMP0135)
+   cmake_policy (SET CMP0135 NEW)
+endif ()
+
 project (mongocrypt C)
 
 # Used for the csfle-markup util:
@@ -20,7 +24,7 @@ option (ENABLE_PIC
    ON
 )
 option (ENABLE_BUILD_FOR_PPA "Maintainer-only option for preparing PPA build" OFF)
-option (ENABLE_ONLINE_TESTS "Enable online tests and the csfle utility" ON)
+option (ENABLE_ONLINE_TESTS "Enable online tests and the csfle utility. Requires libmongoc." ON)
 
 if (ENABLE_WINDOWS_STATIC_RUNTIME)
    if (POLICY CMP0091)
@@ -69,6 +73,7 @@ if (ENABLE_MORE_WARNINGS_AS_ERRORS)
       msvc:/W3 msvc:/WX msvc:/wd4996 msvc:/wd4359
       gnu-like:-Wall gnu-like:-Werror
       gnu-like:-Wswitch-enum gnu-like:-Wswitch-default
+      gnu-like:-Wsign-compare
       )
    add_link_options (
       # Enable link-time warnings. VS 2015 sees LNK4099 spuriously, but it is a
@@ -420,6 +425,9 @@ if (BUILD_TESTING)
       INCLUDE_DIRECTORIES "${CMAKE_CURRENT_SOURCE_DIR}/src"
       LINK_LIBRARIES _mongocrypt::libbson_for_static
       COMPILE_FEATURES cxx_std_11
+      # Define `__STDC_LIMIT_MACROS` in libbson to define integer macros (e.g. SIZE_MAX) when including in C++ code.
+      # C99 standard notes: "C++ implementations should define these macros only when __STDC_LIMIT_MACROS is defined before <stdint.h> is included."
+      COMPILE_DEFINITIONS __STDC_LIMIT_MACROS
       PREFIX ""
       )
 
@@ -473,6 +481,7 @@ set (TEST_MONGOCRYPT_SOURCES
    test/test-mongocrypt-cache.c
    test/test-mongocrypt-cache-oauth.c
    test/test-mongocrypt-ciphertext.c
+   test/test-mongocrypt-cleanup.c
    test/test-mongocrypt-compact.c
    test/test-mongocrypt-crypto.c
    test/test-mongocrypt-crypto-hooks.c
@@ -494,10 +503,12 @@ set (TEST_MONGOCRYPT_SOURCES
    test/test-mongocrypt-local-kms.c
    test/test-mongocrypt-log.c
    test/test-mongocrypt-marking.c
+   test/test-mongocrypt-opts.c
    test/test-mongocrypt-status.c
    test/test-mongocrypt-traverse-util.c
    test/test-mongocrypt-util.c
    test/test-mongocrypt.c
+   test/test-named-kms-providers.c
    )
 
 # Define test-mongocrypt

data/ext/libmongocrypt/libmongocrypt/CODEOWNERS

@@ -1,10 +1,7 @@
 # Code Owners will automatically be added as reviewers on PRs
 
-# NodeJS Bindings
-bindings/node @nbbeeken @durran @baileympearson @dariakp @addaleax
-
 # Python Bindings
-bindings/python @ShaneHarvey @blink1073 @juliusgeo
+bindings/python @mongodb/dbx-python
 
 # Java Bindings
 bindings/java @jyemin @rozza

data/ext/libmongocrypt/libmongocrypt/Earthfile

@@ -46,6 +46,7 @@
     #   • deb9 - Debian 9.2
     #   • deb10 - Debian 10.0
     #   • deb11 - Debian 11.0
+    #   • deb12 - Debian 12.0
     #   • sles15 - OpenSUSE Leap 15.0
     #   • alpine - Alpine Linux 3.18
     #
@@ -179,6 +180,11 @@ ENV_DEBIAN:
     COMMAND
     ARG --required version
     FROM +init --base=docker.io/library/debian:$version
+    IF [ $version = "9.2" ]
+        # Update source list for archived Debian stretch packages.
+        # Refer: https://unix.stackexchange.com/a/743865/260858
+        RUN echo "deb http://archive.debian.org/debian stretch main" > /etc/apt/sources.list
+    END
     DO +DEBIAN_SETUP
 
 env.deb9:
@@ -196,13 +202,17 @@ env.deb11:
     # A Debian 11.0 environment
     DO +ENV_DEBIAN --version 11.0
 
+env.deb12:
+    # A Debian 12.0 environment
+    DO +ENV_DEBIAN --version 12.0
+
 env.sles15:
     # An OpenSUSE Leap 15.0 environment.
     FROM +init --base=docker.io/opensuse/leap:15.0
     DO +SLES_SETUP
 
 env.alpine:
-    FROM +init --base=docker.io/library/alpine:3.17
+    FROM +init --base=docker.io/library/alpine:3.18
     DO +ALPINE_SETUP
 
 # Utility: Warm-up obtaining CMake and Ninja for the build. This is usually
@@ -249,7 +259,7 @@ BUILD_EXAMPLE_STATE_MACHINE:
     RUN cd /s && /s/example-state-machine
 
 rpm-build:
-    FROM +init --base fedora:rawhide
+    FROM +init --base fedora:38
     GIT CLONE https://src.fedoraproject.org/rpms/libmongocrypt.git /R
     # Install the packages listed by "BuildRequires" and rpm-build:
     RUN __install $(awk '/^BuildRequires:/ { print $2 }' /R/libmongocrypt.spec) \
@@ -265,7 +275,7 @@ rpm-build:
 
 rpm-install-runtime:
     # Install the runtime RPM
-    FROM +init --base fedora:rawhide
+    FROM +init --base fedora:38
     COPY +rpm-build/RPMS /tmp/libmongocrypt-rpm/
     RUN dnf makecache
     RUN __install $(find /tmp/libmongocrypt-rpm/ -name 'libmongocrypt-1.*.rpm')
@@ -372,3 +382,141 @@ build:
         CACHE /s/libmongocrypt/cmake-build
     END
     RUN env USE_NINJA=1 bash libmongocrypt/.evergreen/build_all.sh
+    SAVE ARTIFACT /s/install /libmongocrypt-install
+
+# `create-deb-packages-and-repos` creates the .deb packages and repo directories intended for the PPA on debian-like distros. Options:
+#   • --env=[...]
+#     · Set the environment for the build. Only debian-like environments are supported.
+#   • --packager_distro=[...] is passed to `create-packages-and-repos.sh`
+#   • --packager_arch=[...] is passed to `create-packages-and-repos.sh`
+create-deb-packages-and-repos:
+    ARG env
+    FROM +env.$env
+    DO +CACHE_WARMUP
+    DO +COPY_SOURCE
+    WORKDIR /s
+    RUN __install dh-make dpkg-dev apt-utils
+    ARG packager_distro
+    ARG packager_arch
+    RUN env \
+        WORKDIR=/s \
+        PYTHON=python3 \
+        HAS_PACKAGES=true \
+        PACKAGER_DISTRO=$packager_distro \
+        PACKAGER_ARCH=$packager_arch \
+        bash libmongocrypt/.evergreen/create-packages-and-repos.sh
+    SAVE ARTIFACT libmongocrypt/repo AS LOCAL repo
+
+# `test-deb-packages-from-ppa` tests Debian and Ubuntu packages installed on the PPA.
+#   • --env=[...] (default "deb11")
+#     · Set the environment for the build. Only debian-like environments are supported.
+#   • --distro=[...] (default "debian bullseye")
+#     · Has the form: "(debian|ubuntu) (name)". Must match distro set for `--env`.
+#   • --version=[...] (default "development"). The libmongocrypt package version.
+#     · May refer to a release branch (e.g. "1.8"). Release branch packages are updated on a tagged release.
+#     · "development" packages are updated by the `publish-packages` tasks every commit.
+test-deb-packages-from-ppa:
+    ARG env="deb11"
+    ARG distro="debian bullseye"
+    ARG version="development"
+    FROM +env.$env
+    WORKDIR /s
+    RUN __install apt-transport-https
+    # Install libmongocrypt following install steps described in README.md:
+    RUN curl -s --location https://pgp.mongodb.com/libmongocrypt.asc | gpg --dearmor >/etc/apt/trusted.gpg.d/libmongocrypt.gpg
+    RUN echo "deb https://libmongocrypt.s3.amazonaws.com/apt/$distro/libmongocrypt/$version main" | tee /etc/apt/sources.list.d/libmongocrypt.list
+    # Test using libmongocrypt:
+    RUN __install libmongocrypt-dev gcc
+    RUN echo "
+        #include <stdio.h>
+        #include <mongocrypt/mongocrypt.h>
+        int main(void) {
+            const char *ver = mongocrypt_version(NULL);
+            printf (\"Using libmongocrypt %s\", ver);
+        }" > test.c
+    RUN gcc -o test.out test.c $(pkg-config --libs --cflags libmongocrypt)
+    RUN ./test.out
+
+# `sign` uses Garasign to sign a file with the libmongocrypt key.
+# Requires prior authentication with Artifactory.
+# See: https://docs.devprod.prod.corp.mongodb.com/release-tools-container-images/garasign/garasign_signing/.
+sign:
+    ARG --required file_to_sign
+    ARG --required output_file
+    FROM artifactory.corp.mongodb.com/release-tools-container-registry-local/garasign-gpg
+    WORKDIR /s
+    COPY ${file_to_sign} /s/file
+    RUN --secret garasign_username --secret garasign_password \
+        GRS_CONFIG_USER1_USERNAME=${garasign_username} \
+        GRS_CONFIG_USER1_PASSWORD=${garasign_password} \
+        /bin/bash -c "gpgloader && gpg --yes -v --armor -o /s/file.asc --detach-sign /s/file"
+    # Verify the signature
+    RUN touch /keyring
+    RUN curl -sS https://pgp.mongodb.com/libmongocrypt.pub | gpg -q --no-default-keyring --keyring "/keyring" --import -
+    RUN gpgv --keyring "/keyring" "/s/file.asc" "/s/file"
+    SAVE ARTIFACT /s/file.asc AS LOCAL ${output_file}
+
+# silkbomb:
+#   An environment with the `silkbomb` command.
+#
+# See https://docs.devprod.prod.corp.mongodb.com/mms/python/src/sbom/silkbomb/ for documentation of silkbomb.
+silkbomb:
+    FROM artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:1.0
+    # Alias the silkbom executable to a simpler name:
+    RUN ln -s /python/src/sbom/silkbomb/bin /usr/local/bin/silkbomb
+
+# sbom-generate:
+#   Generate/update the etc/cyclonedx.sbom.json file from the etc/purls.txt file.
+#
+# This target will update the existing etc/cyclonedx.sbom.json file in-place based
+# on the content of etc/purls.txt.
+#
+sbom-generate:
+    FROM +silkbomb
+    # Copy in the relevant files:
+    WORKDIR /s
+    COPY etc/purls.txt etc/cyclonedx.sbom.json /s/
+    # Update the SBOM file:
+    RUN silkbomb update \
+        --purls purls.txt \
+        --sbom-in cyclonedx.sbom.json \
+        --sbom-out cyclonedx.sbom.json
+    # Save the result back to the host:
+    SAVE ARTIFACT /s/cyclonedx.sbom.json AS LOCAL etc/cyclonedx.sbom.json
+
+# sbom-download:
+#   Download the Augmented SBOM file from Silk.
+#
+# See https://wiki.corp.mongodb.com/display/DRIVERS/Using+AWS+Secrets+Manager+to+Store+Testing+Secrets for instructions to get secrets from AWS Secrets Manager. Secrets are available under `drivers/libmongocrypt`.
+#
+sbom-download:
+    ARG --required out
+    ARG --required branch
+    FROM +silkbomb
+    WORKDIR /s
+    # Download the Augmented SBOM file:
+    RUN --no-cache --secret silk_client_id --secret silk_client_secret \
+        SILK_CLIENT_ID=${silk_client_id} \
+        SILK_CLIENT_SECRET=${silk_client_secret} \
+        silkbomb download \
+        --sbom-out cyclonedx.augmented.sbom.json \
+        --silk-asset-group libmongocrypt-${branch}
+    # Save the result back to the host:
+    SAVE ARTIFACT /s/cyclonedx.augmented.sbom.json AS LOCAL ${out}
+    RUN echo "Augmented SBOM saved to ${out}"
+
+# silk-create-asset-group:
+#   Create an asset group for Silk.
+#
+# See https://wiki.corp.mongodb.com/display/DRIVERS/Using+AWS+Secrets+Manager+to+Store+Testing+Secrets for instructions to get secrets from AWS Secrets Manager. Secrets are available under `drivers/libmongocrypt`.
+#
+silk-create-asset-group:
+    ARG --required branch
+    FROM +env.alpine
+    RUN __install curl jq
+    COPY etc/silk-create-asset-group.sh /s/silk-create-asset-group.sh
+    RUN --no-cache --secret silk_client_id --secret silk_client_secret \
+        silk_client_id=${silk_client_id} \
+        silk_client_secret=${silk_client_secret} \
+        branch=${branch} \
+            /s/silk-create-asset-group.sh

data/ext/libmongocrypt/libmongocrypt/README.md

@@ -72,12 +72,10 @@ find_package (mongocrypt)
 ```
 
 ## Installing libmongocrypt on Windows ##
-For Windows, there is a fixed URL to download the DLL and includes directory:
-https://s3.amazonaws.com/mciuploads/libmongocrypt/windows/latest_release/libmongocrypt.tar.gz
+A Windows DLL for x86_64 is available on the Github Releases page. See the [latest release](https://github.com/mongodb/libmongocrypt/releases/latest).
+
+Use `gpg` to verify the signature. The public key for `libmongocrypt` is available on https://pgp.mongodb.com/.
 
-To download the latest unstable release, download from this URL:
-https://s3.amazonaws.com/mciuploads/libmongocrypt/windows/latest_release/libmongocrypt_unstable.tar.gz
-Do not use the unstable version of libmongocrypt in a production environment.
 
 ### Testing ###
 `test-mongocrypt` mocks all I/O with files stored in the `test/data` and `test/example` directories. Run `test-mongocrypt` from the source directory:
@@ -108,53 +106,32 @@ We decided against the "have libmongocrypt do everything" approach because it co
 
 ### Releasing ###
 
-#### Version number scheme ####
-Version numbers of libmongocrypt must follow the format 1.[0-9].[0-9] for releases and 1.[0-9].[0-9]-(alpha|beta|rc)[0-9] for pre-releases.  This ensures that Linux distribution packages built from each commit are published to the correct location.
-
-#### Steps to release ####
-Do the following when releasing:
-- Update CHANGELOG.md with the version being released.
-- If this is a new minor release (e.g. `x.y.0`):
-   - Update the Linux distribution package installation instructions in the below sections to refer to the new version x.y.
-   - Commit these changes (on `master`) so that both the `master` branch and the new branch you are about to create refer to the new branch (note that this means you will commit changes to this file, and `CHANGELOG.md`)
-   - Create a branch named `rx.y`.
-   - Update the [libmongocrypt-release](https://evergreen.mongodb.com/projects##libmongocrypt-release) Evergreen project (requires auth) to set `Branch Name` to `rx.y`.
-- Commit, create a new git tag, like `1.0.0-rc123` or `1.0.0`, and push.
-   - Push both the branch ref and tag ref in the same command: `git push origin master 1.0.0-rc123` or `git push origin r1.0 1.0.0`
-   - Pushing the branch ref and the tag ref in the same command eliminates the possibility of a race condition in Evergreen (for building resources based on the presence of a release tag)
-   - Note that in the future (e.g., if we move to a PR-based workflow for releases, or if we simply want to take better advantage of advanced Evergreen features), it is possible to use Evergreen's "Trigger Versions With Git Tags" feature by updating both `config.yml` and the project's settings in Evergreen
-- Ensure the version on Evergreen with the tagged commit is scheduled. The following tasks must pass to complete the release:
-   - `upload-all`
-   - `windows-upload`. It is scheduled from the `windows-upload-check` task.
-- Create the release from the GitHub releases page from the new tag.
-- Submit a PR to update the Homebrew package https://github.com/mongodb/homebrew-brew/blob/master/Formula/libmongocrypt.rb. ([Example](https://github.com/mongodb/homebrew-brew/pull/135)).
-- If this is a new minor release (e.g. `x.y.0`), file a DOCSP ticket to update the installation instructions on [Install libmongocrypt](https://www.mongodb.com/docs/manual/core/csfle/reference/libmongocrypt/). ([Example](https://jira.mongodb.org/browse/DOCSP-26877))
-- Update the release on the [Jira releases page](https://jira.mongodb.org/projects/MONGOCRYPT/versions).
+See [releasing](./doc/releasing.md).
 
 ## Installing libmongocrypt From Distribution Packages ##
 Distribution packages (i.e., .deb/.rpm) are built and published for several Linux distributions.  The installation of these packages for supported platforms is documented here.
 
 ### Unstable Development Distribution Packages ###
-To install the latest unstable development package, change `1.8` to `development` in the package URLs listed in the subsequent instructions. For example, `https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/1.8` in the instructions would become `https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/development`. Do not use the unstable version of libmongocrypt in a production environment.
+To install the latest unstable development package, change `1.11` to `development` in the package URLs listed in the subsequent instructions. For example, `https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/1.11` in the instructions would become `https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/development`. Do not use the unstable version of libmongocrypt in a production environment.
 
 ### .deb Packages (Debian and Ubuntu) ###
 
 First, import the public key used to sign the package repositories:
 
 ```
-sudo sh -c 'curl -s --location https://www.mongodb.org/static/pgp/libmongocrypt.asc | gpg --dearmor >/etc/apt/trusted.gpg.d/libmongocrypt.gpg'
+sudo sh -c 'curl -s --location https://pgp.mongodb.com/libmongocrypt.asc | gpg --dearmor >/etc/apt/trusted.gpg.d/libmongocrypt.gpg'
 ```
 
 Second, create a list entry for the repository.  For Ubuntu systems (be sure to change `<release>` to `xenial`, `bionic`, `focal`, or `jammy`, as appropriate to your system):
 
 ```
-echo "deb https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/1.8 universe" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list
+echo "deb https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/1.11 universe" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list
 ```
 
-For Debian systems (be sure to change `<release>` to `stretch`, `buster`, or `bullseye`, as appropriate to your system):
+For Debian systems (be sure to change `<release>` to `stretch`, `buster`, `bullseye`, or `bookworm` as appropriate to your system):
 
 ```
-echo "deb https://libmongocrypt.s3.amazonaws.com/apt/debian <release>/libmongocrypt/1.8 main" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list
+echo "deb https://libmongocrypt.s3.amazonaws.com/apt/debian <release>/libmongocrypt/1.11 main" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list
 ```
 
 Third, update the package cache:
@@ -179,10 +156,29 @@ Create the file `/etc/yum.repos.d/libmongocrypt.repo` with contents:
 ```
 [libmongocrypt]
 name=libmongocrypt repository
-baseurl=https://libmongocrypt.s3.amazonaws.com/yum/redhat/$releasever/libmongocrypt/1.8/x86_64
+baseurl=https://libmongocrypt.s3.amazonaws.com/yum/redhat/$releasever/libmongocrypt/1.11/x86_64
+gpgcheck=1
+enabled=1
+gpgkey=https://pgp.mongodb.com/libmongocrypt.asc
+```
+
+Then install the libmongocrypt packages:
+
+```
+sudo yum install -y libmongocrypt
+```
+
+#### Amazon Linux 2023 ####
+
+Create the file `/etc/yum.repos.d/libmongocrypt.repo` with contents:
+
+```
+[libmongocrypt]
+name=libmongocrypt repository
+baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2023/libmongocrypt/1.11/x86_64
 gpgcheck=1
 enabled=1
-gpgkey=https://www.mongodb.org/static/pgp/libmongocrypt.asc
+gpgkey=https://pgp.mongodb.com/libmongocrypt.asc
 ```
 
 Then install the libmongocrypt packages:
@@ -198,10 +194,10 @@ Create the file `/etc/yum.repos.d/libmongocrypt.repo` with contents:
 ```
 [libmongocrypt]
 name=libmongocrypt repository
-baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2/libmongocrypt/1.8/x86_64
+baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2/libmongocrypt/1.11/x86_64
 gpgcheck=1
 enabled=1
-gpgkey=https://www.mongodb.org/static/pgp/libmongocrypt.asc
+gpgkey=https://pgp.mongodb.com/libmongocrypt.asc
 ```
 
 Then install the libmongocrypt packages:
@@ -217,10 +213,10 @@ Create the file `/etc/yum.repos.d/libmongocrypt.repo` with contents:
 ```
 [libmongocrypt]
 name=libmongocrypt repository
-baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2013.03/libmongocrypt/1.8/x86_64
+baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2013.03/libmongocrypt/1.11/x86_64
 gpgcheck=1
 enabled=1
-gpgkey=https://www.mongodb.org/static/pgp/libmongocrypt.asc
+gpgkey=https://pgp.mongodb.com/libmongocrypt.asc
 ```
 
 Then install the libmongocrypt packages:
@@ -234,13 +230,13 @@ sudo yum install -y libmongocrypt
 First, import the public key used to sign the package repositories:
 
 ```
-sudo rpm --import https://www.mongodb.org/static/pgp/libmongocrypt.asc
+sudo rpm --import https://pgp.mongodb.com/libmongocrypt.asc
 ```
 
 Second, add the repository (be sure to change `<release>` to `12` or `15`, as appropriate to your system):
 
 ```
-sudo zypper addrepo --gpgcheck "https://libmongocrypt.s3.amazonaws.com/zypper/suse/<release>/libmongocrypt/1.8/x86_64" libmongocrypt
+sudo zypper addrepo --gpgcheck "https://libmongocrypt.s3.amazonaws.com/zypper/suse/<release>/libmongocrypt/1.11/x86_64" libmongocrypt
 ```
 
 Finally, install the libmongocrypt packages:

data/ext/libmongocrypt/libmongocrypt/bindings/cs/CMakeLists.txt

@@ -1,5 +1,6 @@
 
 configure_file(cs.sln cs.sln COPYONLY)
+configure_file(MongoDB.Driver.snk MongoDB.Driver.snk COPYONLY)
 
 configure_file(MongoDB.Libmongocrypt/MongoDB.Libmongocrypt.csproj MongoDB.Libmongocrypt/MongoDB.Libmongocrypt.csproj COPYONLY)
 configure_file(MongoDB.Libmongocrypt/Package.include.template.csproj MongoDB.Libmongocrypt/Package.csproj.include)

data/ext/libmongocrypt/libmongocrypt/bindings/cs/MongoDB.Libmongocrypt/AssemblyInfo.cs

@@ -1,4 +1,4 @@
 using System.Runtime.CompilerServices;
 
-[assembly: InternalsVisibleTo("MongoDB.Libmongocrypt.Test")]
-[assembly: InternalsVisibleTo("MongoDB.Libmongocrypt.Test32")]
+[assembly: InternalsVisibleTo("MongoDB.Libmongocrypt.Test, PublicKey=002400000480000094000000060200000024000052534131000400000100010035287f0d3883c0a075c88e0cda3ce93b621003ecbd5e920d4a8c7238564f4d2f4f68116aca28c9b21341dc3a877679c14556192b2b2f5fe2c11d624e0894d308ff7b94bf6fd72aef1b41017ffe2572e99019d1c61963e68cd0ed67734a42cb333b808e3867cbe631937214e32e409fb1fa62fdb69d494c2530e64a40e417d6ee")]
+[assembly: InternalsVisibleTo("MongoDB.Libmongocrypt.Test32, PublicKey=002400000480000094000000060200000024000052534131000400000100010035287f0d3883c0a075c88e0cda3ce93b621003ecbd5e920d4a8c7238564f4d2f4f68116aca28c9b21341dc3a877679c14556192b2b2f5fe2c11d624e0894d308ff7b94bf6fd72aef1b41017ffe2572e99019d1c61963e68cd0ed67734a42cb333b808e3867cbe631937214e32e409fb1fa62fdb69d494c2530e64a40e417d6ee")]

data/ext/libmongocrypt/libmongocrypt/bindings/cs/MongoDB.Libmongocrypt/Binary.cs

@@ -48,7 +48,14 @@ namespace MongoDB.Libmongocrypt
         /// </value>
         public IntPtr Data
         {
-            get { return Library.mongocrypt_binary_data(_handle); }
+            get
+            {
+                if (!_handle.IsInvalid)
+                {
+                    return Marshal.ReadIntPtr(_handle.DangerousGetHandle());
+                }
+                return IntPtr.Zero;
+            }
         }
 
         /// <summary>
@@ -59,7 +66,14 @@ namespace MongoDB.Libmongocrypt
         /// </value>
         public uint Length
         {
-            get { return Library.mongocrypt_binary_len(_handle); }
+            get
+            {
+                if (!_handle.IsInvalid)
+                {
+                    return (uint)Marshal.ReadInt32(_handle.DangerousGetHandle(), IntPtr.Size);
+                }
+                return 0;
+            }
         }
 
         internal BinarySafeHandle Handle => _handle;

data/ext/libmongocrypt/libmongocrypt/bindings/cs/MongoDB.Libmongocrypt/CryptClientFactory.cs

@@ -15,6 +15,7 @@
  */
 
 using System;
+using System.Linq;
 
 namespace MongoDB.Libmongocrypt
 {
@@ -34,6 +35,9 @@ namespace MongoDB.Libmongocrypt
         private static Library.Delegates.RandomCallback __randomCallback = new Library.Delegates.RandomCallback(SecureRandomCallback.GenerateRandom);
         private static Library.Delegates.CryptoHmacCallback __signRsaesPkcs1HmacCallback = new Library.Delegates.CryptoHmacCallback(SigningRSAESPKCSCallback.RsaSign);
 
+        // mongocrypt_is_crypto_available is only available in libmongocrypt version >= 1.9
+        private static readonly Version __mongocryptIsCryptoAvailableMinVersion = Version.Parse("1.9");
+
         /// <summary>Creates a CryptClient with the specified options.</summary>
         /// <param name="options">The options.</param>
         /// <returns>A CryptClient</returns>
@@ -42,14 +46,14 @@ namespace MongoDB.Libmongocrypt
             MongoCryptSafeHandle handle = null;
             Status status = null;
 
+            var cryptoAvailable = Version.Parse(Library.Version.Split('-', '+').First()) >= __mongocryptIsCryptoAvailableMinVersion && Library.mongocrypt_is_crypto_available();
+
             try
             {
                 handle = Library.mongocrypt_new();
                 status = new Status();
-
-                // The below code can be avoided on Windows. So, we don't call it on this system 
-                // to avoid restrictions on target frameworks that present in some of below
-                if (OperatingSystemHelper.CurrentOperatingSystem != OperatingSystemPlatform.Windows)
+                
+                if (!cryptoAvailable)
                 {
                     handle.Check(
                         status,

data/ext/libmongocrypt/libmongocrypt/bindings/cs/MongoDB.Libmongocrypt/Library.cs

@@ -48,6 +48,9 @@ namespace MongoDB.Libmongocrypt
             _mongocrypt_ctx_setopt_key_encryption_key = new Lazy<Delegates.mongocrypt_ctx_setopt_key_encryption_key>(
                 () => __loader.Value.GetFunction<Delegates.mongocrypt_ctx_setopt_key_encryption_key>(
                     ("mongocrypt_ctx_setopt_key_encryption_key")), true);
+            
+            _mongocrypt_is_crypto_available = new Lazy<Delegates.mongocrypt_is_crypto_available>(
+                () => __loader.Value.GetFunction<Delegates.mongocrypt_is_crypto_available>("mongocrypt_is_crypto_available"), true);
 
             _mongocrypt_setopt_aes_256_ecb = new Lazy<Delegates.mongocrypt_setopt_aes_256_ecb>(
                 () => __loader.Value.GetFunction<Delegates.mongocrypt_setopt_aes_256_ecb>(
@@ -229,6 +232,8 @@ namespace MongoDB.Libmongocrypt
         internal static Delegates.mongocrypt_setopt_log_handler mongocrypt_setopt_log_handler => _mongocrypt_setopt_log_handler.Value;
         internal static Delegates.mongocrypt_setopt_kms_providers mongocrypt_setopt_kms_providers => _mongocrypt_setopt_kms_providers.Value;
         internal static Delegates.mongocrypt_ctx_setopt_key_encryption_key mongocrypt_ctx_setopt_key_encryption_key => _mongocrypt_ctx_setopt_key_encryption_key.Value;
+        
+        internal static Delegates.mongocrypt_is_crypto_available mongocrypt_is_crypto_available => _mongocrypt_is_crypto_available.Value;
 
         internal static Delegates.mongocrypt_setopt_aes_256_ecb mongocrypt_setopt_aes_256_ecb => _mongocrypt_setopt_aes_256_ecb.Value;
         internal static Delegates.mongocrypt_setopt_bypass_query_analysis mongocrypt_setopt_bypass_query_analysis => _mongocrypt_setopt_bypass_query_analysis.Value;
@@ -306,6 +311,8 @@ namespace MongoDB.Libmongocrypt
 
         private static readonly Lazy<Delegates.mongocrypt_setopt_kms_providers> _mongocrypt_setopt_kms_providers;
         private static readonly Lazy<Delegates.mongocrypt_ctx_setopt_key_encryption_key> _mongocrypt_ctx_setopt_key_encryption_key;
+        
+        private static readonly Lazy<Delegates.mongocrypt_is_crypto_available> _mongocrypt_is_crypto_available;
 
         private static readonly Lazy<Delegates.mongocrypt_setopt_aes_256_ecb> _mongocrypt_setopt_aes_256_ecb;
         private static readonly Lazy<Delegates.mongocrypt_setopt_bypass_query_analysis> _mongocrypt_setopt_bypass_query_analysis;
@@ -399,6 +406,9 @@ namespace MongoDB.Libmongocrypt
 
             public delegate MongoCryptSafeHandle mongocrypt_new();
 
+            [return: MarshalAs(UnmanagedType.I1)]
+            public delegate bool mongocrypt_is_crypto_available();
+
             public delegate void LogCallback([MarshalAs(UnmanagedType.I4)] LogLevel level, IntPtr messasge,
                 uint message_length, IntPtr context);