libmongocrypt-helper 1.20.5.0.1001 → 1.21.0.0.1001

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b483fc7b479e693858209265fa305b4bd51e34592b452bbbd36c32c13f262802
-  data.tar.gz: 352d1052b07f14081865b5c02fe8b33ce2b0a739550db43a6e57d6c26cd1a08b
+  metadata.gz: cfbe6382cb548a1982646c49a58ea796bf4dcfbc1c69279035744fea2863f799
+  data.tar.gz: 94417181701f8f1c02d4cdbc1120aefd3ffc8228195df488be240508403cae35
 SHA512:
-  metadata.gz: 945910ccf2515b64cbd9dd1d97a9de2822562a2544533006e3aa5fa7837107697f6b38e5f43d0da1ce3218fa98d36362a9f883362d9e1efb16bb90fbee7d5236
-  data.tar.gz: ef89918bdf09d579c60cce8aa5ecdd779a655edffc7223fef5a97fc00fa63ef787c3d5b360ce880812dc3d96562c1ebda7ca158ba4968377e1fd95fcb9c9a81c
+  metadata.gz: 6e25030a91d60887c6215da9ed953391c8ef5c2b7561bf7d2e4cb686b7efa3b646b036cc5d1d6ed574f6508f27a7b0a2fe078658a122ab12223d3eece7483a17
+  data.tar.gz: cfe9d46be634bd5c3a449d38539069e5e357811eac73dc6d34152b2e9e7fed573137cc9d5ac49c4de05c2cbac87236c1375af745efd6ba7dbd7d6bf23f716495

data/ext/libmongocrypt/libmongocrypt/AGENTS.md

@@ -0,0 +1,156 @@
+# AGENTS.md
+
+This file provides guidance to AI coding agents working with code in this repository.
+
+## What this is
+
+libmongocrypt is a C library that assists MongoDB Client Libraries in implementing **In-Use Encryption**. The Client Library behavior it helps support is defined by the Client-Side Encryption specification: <https://github.com/mongodb/specifications/blob/master/source/client-side-encryption/client-side-encryption.md>.
+
+### Naming (from the spec)
+
+The public feature is **In-Use Encryption**, consisting of **Client-Side Field Level Encryption (CSFLE)** and **Queryable Encryption (QE)**. Internally, In-Use Encryption is sometimes called **Field Level Encryption (FLE)**; CSFLE is sometimes called Client Side Encryption (as in the spec title); and CSFLE and QE are sometimes called **FLE1** and **FLE2** respectively. So the `mc-fle2-*` payload files under `src/` implement **Queryable Encryption**, not CSFLE.
+
+Separately (and confusingly), **`csfle`** is sometimes used within libmongocrypt to mean the **crypt_shared** library — an older name for it, unrelated to the CSFLE feature above. For example, `crypt->csfle` is the crypt_shared vtable.
+
+## Build System
+
+This project uses CMake.
+
+Use `cmake-build/` as the CMake binary directory unless otherwise specified by the user. When the user specifies a custom binary directory, always use that directory - do not fall back to `cmake-build/`.
+
+> [!IMPORTANT]
+> Despite `build/` being a common choice for a CMake binary directory name, that is not recommended in this repository because the `build/` directory is not ignored by Git.
+
+The typical configure and build steps (for release and installation):
+
+```bash
+cmake -D CMAKE_BUILD_TYPE=RelWithDebInfo -B cmake-build
+cmake --build cmake-build
+```
+
+The optional install step:
+
+```bash
+cmake --install cmake-build
+```
+
+Key CMake configuration options for this project (given `option=(default|alternatives...)`):
+
+- `-D CMAKE_INSTALL_PREFIX:PATH=<install-prefix>`: install directory used by `install()`. Use `cmake-build/install/` when system modification is undesirable or disallowed by the user.
+- `-D MONGOCRYPT_CRYPTO:STRING=(OpenSSL|CommonCrypto|CNG|none)`: crypto backend. Defaults to the platform native (OpenSSL on Linux, CommonCrypto on macOS, CNG on Windows).
+- `-D DISABLE_NATIVE_CRYPTO:BOOL=(OFF|ON)`: shortcut for `MONGOCRYPT_CRYPTO=none` — build with no crypto backend; a driver then supplies crypto at runtime via `mongocrypt_setopt_crypto_hooks`.
+- `-D OPENSSL_ROOT_DIR:PATH=<dir>`: OpenSSL location, if not on a default path.
+- `-D USE_SHARED_LIBBSON:BOOL=(OFF|ON)`: link an installed libbson instead of the bundled static one.
+- `-D ENABLE_STATIC:BOOL=(ON|OFF)`: build and install static libraries.
+- `-D BUILD_TESTING:BOOL=(ON|OFF)`: required to enable test targets including `test-mongocrypt` (see [Running Tests](#running-tests)).
+- `-D ENABLE_ONLINE_TESTS:BOOL=(ON|OFF)`: required to enable test targets requiring external servers and the `csfle` utility (requires libmongoc).
+
+> [!NOTE]
+> `.evergreen/build_all.sh` is the authoritative reference for CI configure-build-install routines. Consult for platform-specific options and flags.
+
+> [!NOTE]
+> For local development and testing, use the Debug configure in the [Running Tests](#running-tests) section instead of the release configure above.
+
+## Dependencies
+
+- **libbson** (BSON support): *fetched* at configure time by `cmake/FetchMongoC.cmake`, which downloads the mongo-c-driver source archive at a pinned tag and builds libbson, statically linked into libmongocrypt by default. See comments in `cmake/FetchMongoC.cmake` to bump the pinned tag. Set `-D USE_SHARED_LIBBSON=ON` to instead link an installed libbson found via `find_package(bson)` (set `CMAKE_PREFIX_PATH`). 
+- **Intel DFP** (Decimal128 math; target `mongocrypt::intel_dfp`): built at configure time from a *vendored tarball* under `third-party/`. Enabled by `MONGOCRYPT_ENABLE_DECIMAL128` (default ON). Set `-D MONGOCRYPT_DFP_DIR=USE-SYSTEM` to instead use a system install.
+- **kms-message** (KMS request/response): a separate subproject under `kms-message/`, statically compiled into libmongocrypt. The MongoDB C Driver also vendors kms-message.
+- **Crypto backend**: OpenSSL / CommonCrypto / CNG, selected by `MONGOCRYPT_CRYPTO` (see above). On Linux the system OpenSSL is used by default; `DISABLE_NATIVE_CRYPTO=ON` removes the backend entirely.
+
+## Running Tests
+
+The typical configure and build steps (for testing and development):
+
+```bash
+cmake -D CMAKE_BUILD_TYPE=Debug -B cmake-build
+cmake --build cmake-build
+```
+
+> [!TIP]
+> For development, prefer the Ninja generator (`-G Ninja`) when available: it builds in parallel across all cores by default, for the fastest edit-build-test loop.
+
+Test targets build by default (`BUILD_TESTING=ON`). The suite is a single executable, `test-mongocrypt`, at the top of the binary directory. Run it **from the source root** (it reads `test/data` and `test/example` via relative paths):
+
+```bash
+./cmake-build/test-mongocrypt                              # whole suite
+./cmake-build/test-mongocrypt _test_setopt_kms_providers   # a single test, by function name
+```
+
+A few tests need a real crypt_shared library; download one with the `mongodl.py` script from drivers-evergreen-tools: <https://github.com/mongodb-labs/drivers-evergreen-tools/blob/master/.evergreen/mongodl.py>
+
+```bash
+python /path/to/mongodl.py --component crypt_shared <out-dir>
+```
+
+CI runs on Evergreen. Submit a patch build to test across supported platforms:
+
+```bash
+evergreen patch --project=libmongocrypt --auto-description --yes --finalize \
+    --rv ".*" -t "build-and-test-and-upload"
+```
+
+### The kms-message subproject
+
+`kms-message` is a self-contained subproject with its own tests, configured and built from its own directory:
+
+```bash
+cd kms-message
+../cmake-build/kms-message/test_kms_request
+```
+
+## Adding a unit test
+
+Tests are C files, not auto-discovered. Two steps are required:
+
+1. Add the file to the `TEST_MONGOCRYPT_SOURCES` list in `CMakeLists.txt`.
+2. In `test/test-mongocrypt.c`, add an `_mongocrypt_tester_install_*(&tester)` call in `main`, and register each test function inside that installer via `_mongocrypt_tester_install(tester, "_test_name", fn, CRYPTO_REQUIRED)` (or `CRYPTO_OPTIONAL`).
+
+## Architecture
+
+### Components
+
+- Client Library (E.g. pymongo, sometimes referred to as a Driver)
+    - libmongocrypt acts as a **state machine** and does no I/O.
+    - libmongocrypt provides a C interface to the Client Library.
+    - Most APIs pass and returns BSON, most structs are opaque, and global init is lazy.
+    - See `integrating.md` and the public API in `src/mongocrypt.h`.
+- MongoDB server (mongod / mongos)
+    - To send the final commands.
+    - To fetch remote schemas.
+- KMS
+    - To encrypt/decrypt Data Encryption Keys (DEK) using a backing Key Encryption Key (KEK).
+- mongocryptd / crypt_shared
+    - Required for automatic encryption only (not used by explicit encryption, explicit decryption, or automatic decryption)
+    - Interchangeable: both do query analysis for automatic encryption.
+        - mongocryptd is a daemon that libmongocrypt talks to via the Client Library over TCP using the same wire protocol as a MongoDB server.
+        - crypt_shared is a library libmongocrypt loads and calls directly.
+    - Only permitted for enterprise or Atlas. This makes automatic encryption an enterprise / Atlas feature.
+
+### Source layout & naming
+
+`src/mongocrypt.h` is the only header consumers are expected to directly include. Any header that is not installed is private.
+
+Public functions follow `mongocrypt_<type>_<method>` (e.g. `mongocrypt_ctx_id`). `mc_*` is a shorthand for internal components.
+
+Other top-level areas: `kms-message/` (vendored KMS request/response library), `bindings/` (language bindings — currently only `python`/PyMongoCrypt, which is released separately from the C library), `etc/` (dev/release scripts), `.evergreen/` (CI), `doc/`.
+
+### C standard
+
+Uses C99. Contributions shall not use features from newer standards.
+
+### Core objects & state machine
+
+- **`mongocrypt_t`** — the top-level handle; **thread-safe**, and expected to be owned by a Client Library's `MongoClient` / `ClientEncryption` object.
+- **`mongocrypt_ctx_t`** — a single operation (encrypt, decrypt, data-key creation, …); **not thread-safe**, and expected to handle one operation. The Client Library drives it as a state machine, performing the I/O the library requests at each state. See `integrating.md` for the state machine.
+- **`mongocrypt_binary_t`** is a non-owning view; `_destroy` frees the view, not the underlying data.
+
+## Before Committing
+
+Format with `./etc/format-all.sh` (requires `uv`; see `CONTRIBUTING.md`). The `kms-message` subproject is not auto-formatted — leave its style as-is.
+
+## Conventions
+
+- SemVer. User-visible changes go in `CHANGELOG.md`.
+- Bugs/features are tracked in the Jira **MONGOCRYPT** project; use `MONGOCRYPT-NNN <summary>` in PR titles.
+- Develop test-first (red-green-refactor).

data/ext/libmongocrypt/libmongocrypt/CHANGELOG.md

@@ -1,5 +1,14 @@
 # ChangeLog
 
+## 1.21.0
+
+### Changed
+- Bump downloaded libbson version from 2.3.3 to 2.5.6.
+
+### Removed
+- Discontinue builds for EOL Debian releases (version 11, 10, and 9) and remove corresponding CI tasks.
+- Remove support for the `prefixPreview`, `suffixPreview`, and `substringPreview` query types. Setting them with `mongocrypt_ctx_setopt_query_type` or using them in encryptedFields is now an error.
+
 ## 1.20.5
 
 ### Fixed
@@ -15,7 +24,8 @@
 ## 1.20.3
 
 ### Fixed
-- Validate database and collection name arguments against "." and NUL bytes
+- Validate database and collection name arguments against "." and NUL bytes.
+
 ## 1.20.2
 
 ### Changed
@@ -23,7 +33,7 @@
 
 ## 1.20.1
 
-## Changed
+### Changed
 - Bump downloaded libbson version from 2.3.0 to 2.3.3 to address configuration error with CMake 4.4.0.
 
 ## 1.20.0
@@ -31,6 +41,9 @@
 ### Added
 - Stable support for substring queries.
 
+### Removed
+- RHEL 6.2 builds. Use the `linux-x86_64-glibc_2_7-nocrypto` build instead as it has an equivalent glibc requirement.
+
 ## 1.19.2
 
 ### Added

data/ext/libmongocrypt/libmongocrypt/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

data/ext/libmongocrypt/libmongocrypt/CMakeLists.txt

@@ -560,7 +560,7 @@ if ("cxx_std_20" IN_LIST CMAKE_CXX_COMPILE_FEATURES)
 endif ()
 
 # Exclude example-state-machine since it requires native crypto.
-if (NOT MONGOCRYPT_CRYPTO STREQUAL none)
+if (BUILD_TESTING AND NOT MONGOCRYPT_CRYPTO STREQUAL none)
    # Define example-state-machine
    add_executable (example-state-machine test/example-state-machine.c)
    target_link_libraries (example-state-machine PRIVATE mongocrypt _mongocrypt::libbson_for_shared)
@@ -592,6 +592,31 @@ if (NOT MONGOCRYPT_CRYPTO STREQUAL none)
    endif ()
 endif ()
 
+option (ENABLE_FUZZING "Build fuzzing targets. Requires a compiler supporting -fsanitize=fuzzer." OFF)
+if (ENABLE_FUZZING)
+   include (CheckCCompilerFlag)
+   set (CMAKE_TRY_COMPILE_TARGET_TYPE STATIC_LIBRARY)
+   check_c_compiler_flag ("-fsanitize=fuzzer-no-link" COMPILER_SUPPORTS_FUZZER)
+   unset (CMAKE_TRY_COMPILE_TARGET_TYPE)
+   if (NOT COMPILER_SUPPORTS_FUZZER)
+      message (FATAL_ERROR
+         "ENABLE_FUZZING is ON but the compiler does not support -fsanitize=fuzzer. "
+      )
+   endif ()
+
+   add_executable (fuzz_mongocrypt EXCLUDE_FROM_ALL test/fuzz_mongocrypt.c)
+   target_include_directories (fuzz_mongocrypt PRIVATE ./src)
+   target_link_libraries (fuzz_mongocrypt PRIVATE mongocrypt_static _mongocrypt::libbson_for_static)
+   target_compile_options (fuzz_mongocrypt PRIVATE -fsanitize=fuzzer)
+   target_link_options (fuzz_mongocrypt PRIVATE -fsanitize=fuzzer)
+
+   add_executable (fuzz_kms EXCLUDE_FROM_ALL test/fuzz_kms.c)
+   target_include_directories (fuzz_kms PRIVATE ./src ./kms-message ./kms-message/src)
+   target_link_libraries (fuzz_kms PRIVATE mongocrypt_static kms_message_static _mongocrypt::libbson_for_static)
+   target_compile_options (fuzz_kms PRIVATE -fsanitize=fuzzer)
+   target_link_options (fuzz_kms PRIVATE -fsanitize=fuzzer)
+endif ()
+
 if (ENABLE_STATIC)
    set (TARGETS_TO_INSTALL mongocrypt mongocrypt_static)
 else ()

data/ext/libmongocrypt/libmongocrypt/CONTRIBUTING.md

@@ -1,14 +1,6 @@
 # Formatting
 
-To format, install `pipx` and run:
+To format, install [uv](https://docs.astral.sh/uv/) and run:
 ```bash
 ./etc/format-all.sh
 ```
-
-To use a specified python install, set `MONGOCRYPT_PYTHON`:
-
-```bash
-# Set MONGOCRYPT_PYTHON to a python install with pipx installed.
-export MONGOCRYPT_PYTHON=python
-./etc/format-all.sh
-```

data/ext/libmongocrypt/libmongocrypt/README.md

@@ -1,6 +1,6 @@
 # libmongocrypt #
 
-The companion C library for client side encryption in drivers.
+The companion C library for driver support of [In-Use Encryption](https://www.mongodb.com/docs/manual/core/security-in-use-encryption/).
 
 This project uses [Semantic Versioning](https://semver.org/).
 
@@ -12,98 +12,42 @@ If you have encountered a bug, or would like to see a new feature in libmongocry
 - Navigate to [the MONGOCRYPT project](https://jira.mongodb.org/projects/MONGOCRYPT).
 - Click **Create Issue** - Please provide as much information as possible about the issue type and how to reproduce it.
 
-## Documentation ##
-See [The Integration Guide](integrating.md) to integrate with your driver.
+## Security Vulnerabilities ##
 
-See [mongocrypt.h](src/mongocrypt.h) for the public API reference.
+If you’ve identified a security vulnerability, please report it according to the [instructions here](https://www.mongodb.com/docs/manual/tutorial/create-a-vulnerability-report).
 
-## Building libmongocrypt ##
+# Installing #
 
-On Windows and macOS, libmongocrypt can use the platform's default encryption
-APIs as its encryption backend. On other systems, one will want to install the
-OpenSSL development libraries, which libmongocrypt will use as the default
-encryption backend.
+## Installing libmongocrypt from source ##
 
-Then build libmongocrypt:
+To build:
 
+```bash
+cmake -D CMAKE_BUILD_TYPE=RelWithDebInfo -B cmake-build
+cmake --build cmake-build
 ```
-git clone https://github.com/mongodb/libmongocrypt
-cd libmongocrypt
-mkdir cmake-build && cd cmake-build
-cmake ../
-make
+
+To install:
+
+```bash
+cmake --install cmake-build
 ```
 
-This builds libmongocrypt.dylib and test-libmongocrypt, in the cmake-build
-directory.
+libmongocrypt performs crypto by default with platform crypto APIs on macOS/Windows and OpenSSL on other platforms. Configure with `DISABLE_NATIVE_CRYPTO=ON` to disable the crypto dependency and supply runtime crypto hooks.
 
 ## Installing libmongocrypt on macOS ##
 Install the latest release of libmongocrypt with the following.
-```
+```bash
 brew install mongodb/brew/libmongocrypt
 ```
 
 To install the latest unstable development version of libmongocrypt, use `brew install mongodb/brew/libmongocrypt --HEAD`. Do not use the unstable version of libmongocrypt in a production environment.
 
-## Building libmongocrypt from source on macOS ##
-
-First install [Homebrew according to its own instructions](https://brew.sh/).
-
-Install the XCode Command Line Tools:
-```
-xcode-select --install
-```
-
-Then clone and build libmongocrypt:
-```
-git clone https://github.com/mongodb/libmongocrypt.git
-cd libmongocrypt
-cmake .
-cmake --build . --target install
-```
-
-Then, libmongocrypt can be used with pkg-config:
-```
-pkg-config libmongocrypt --libs --cflags
-```
-
-Or use cmake's `find_package`:
-```
-find_package (mongocrypt)
-# Then link against mongo::mongocrypt
-```
-
 ## Installing libmongocrypt on Windows ##
 A Windows DLL for x86_64 is available on the Github Releases page. See the [latest release](https://github.com/mongodb/libmongocrypt/releases/latest).
 
 Use `gpg` to verify the signature. The public key for `libmongocrypt` is available on https://pgp.mongodb.com/.
 
-## Python Releases ##
-Python releases and tags are signed using the MongoDB Python driver PGP key. Use `gpg` to verify the signature. The public key is available at https://pgp.mongodb.com/python-driver.pub.
-
-
-### Testing ###
-`test-mongocrypt` mocks all I/O with files stored in the `test/data` and `test/example` directories. Run `test-mongocrypt` from the source directory:
-
-```
-cd libmongocrypt
-./cmake-build/test-mongocrypt
-```
-
-libmongocrypt is continuously built and published on evergreen. Submit patch builds to this evergreen project when making changes to test on supported platforms.
-The latest tarball containing libmongocrypt built on all supported variants is [published here](https://s3.amazonaws.com/mciuploads/libmongocrypt/all/master/latest/libmongocrypt-all.tar.gz).
-
-### Troubleshooting ###
-If OpenSSL is installed in a non-default directory, pass `-DOPENSSL_ROOT_DIR=/path/to/openssl` to the cmake command for libmongocrypt.
-
-If there are errors with cmake configuration, send the set of steps you performed to the maintainers of this project.
-
-If there are compilation or linker errors, run `make` again, setting `VERBOSE=1` in the environment or on the command line (which shows exact compile and link commands), and send the output to the maintainers of this project.
-
-### Releasing ###
-
-See [releasing](./doc/releasing.md).
-
 ## Installing libmongocrypt From Distribution Packages ##
 Distribution packages (i.e., .deb/.rpm) are built and published for several Linux distributions.  The installation of these packages for supported platforms is documented here.
 
@@ -122,23 +66,23 @@ The repository containing the Debian and Ubuntu .deb packages can be configured
 
 #### Repository configuration with extrepo ####
 
-Extrepo is available on Debian 11 and newer, as well as Ubuntu 22.04 and newer.
+Extrepo is available on Debian 13 and newer, as well as Ubuntu 22.04 and newer. Note that while extrepo in older Debian and Ubuntu releases may list the libmongocrypt PPA, the packages available for those older releases are most likely outdated and may contain security vulnerabilities.
 
 First, install the extrepo package:
 
-```
+```bash
 sudo apt install extrepo
 ```
 
 If you would like to see the information about the repository, it can be viewed with the search command:
 
-```
+```bash
 extrepo search libmongocrypt
 ```
 
 In order to enable the repository, execute this command:
 
-```
+```bash
 sudo extrepo enable libmongocrypt-release
 ```
 
@@ -148,19 +92,19 @@ Once the repository is configured, continue with package installation.
 
 First, import the public key used to sign the package repositories:
 
-```
+```bash
 sudo sh -c 'curl -s --location https://pgp.mongodb.com/libmongocrypt.asc | gpg --dearmor >/etc/apt/trusted.gpg.d/libmongocrypt.gpg'
 ```
 
 Second, create a list entry for the repository.  For Ubuntu systems (be sure to change `<release>` to `jammy` or `noble` as appropriate to your system):
 
-```
+```bash
 echo "deb https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/<channel> universe" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list
 ```
 
-For Debian systems (be sure to change `<release>` to `bullseye`, `bookworm`, or `trixie` as appropriate to your system):
+For Debian systems (be sure to change `<release>` to `bookworm`, or `trixie` as appropriate to your system):
 
-```
+```bash
 echo "deb https://libmongocrypt.s3.amazonaws.com/apt/debian <release>/libmongocrypt/<channel> main" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list
 ```
 
@@ -168,7 +112,7 @@ echo "deb https://libmongocrypt.s3.amazonaws.com/apt/debian <release>/libmongocr
 
 Finally, update the package cache and install the libmongocrypt packages:
 
-```
+```bash
 sudo apt-get update
 sudo apt-get install -y libmongocrypt-dev
 ```
@@ -192,7 +136,7 @@ gpgkey=https://pgp.mongodb.com/libmongocrypt.asc
 
 Then install the libmongocrypt packages:
 
-```
+```bash
 sudo yum install -y libmongocrypt
 ```
 
@@ -211,7 +155,7 @@ gpgkey=https://pgp.mongodb.com/libmongocrypt.asc
 
 Then install the libmongocrypt packages:
 
-```
+```bash
 sudo yum install -y libmongocrypt
 ```
 
@@ -230,7 +174,7 @@ gpgkey=https://pgp.mongodb.com/libmongocrypt.asc
 
 Then install the libmongocrypt packages:
 
-```
+```bash
 sudo yum install -y libmongocrypt
 ```
 
@@ -249,7 +193,7 @@ gpgkey=https://pgp.mongodb.com/libmongocrypt.asc
 
 Then install the libmongocrypt packages:
 
-```
+```bash
 sudo yum install -y libmongocrypt
 ```
 
@@ -257,18 +201,44 @@ sudo yum install -y libmongocrypt
 
 First, import the public key used to sign the package repositories:
 
-```
+```bash
 sudo rpm --import https://pgp.mongodb.com/libmongocrypt.asc
 ```
 
 Second, add the repository (be sure to change `<release>` to `12` or `15`, as appropriate to your system):
 
-```
+```bash
 sudo zypper addrepo --gpgcheck "https://libmongocrypt.s3.amazonaws.com/zypper/suse/<release>/libmongocrypt/<channel>/x86_64" libmongocrypt
 ```
 
 Finally, install the libmongocrypt packages:
 
-```
+```bash
 sudo zypper -n install libmongocrypt
 ```
+
+# Development #
+
+## Documentation ##
+
+The [Client-Side Encryption](https://github.com/mongodb/specifications/blob/master/source/client-side-encryption/client-side-encryption.md) driver specification.
+
+See [The Integration Guide](integrating.md) to integrate with your driver.
+
+See [mongocrypt.h](src/mongocrypt.h) for the public API reference.
+
+## Testing ##
+`test-mongocrypt` mocks all I/O with files stored in the `test/data` and `test/example` directories. Run `test-mongocrypt` from the source directory:
+
+```bash
+./cmake-build/test-mongocrypt
+```
+
+libmongocrypt is continuously built and published on evergreen. Submit patch builds to this evergreen project when making changes to test on supported platforms.
+
+## Releasing ##
+
+See [releasing](./doc/releasing.md).
+
+### Python Releases ###
+Python releases and tags are signed using the MongoDB Python driver PGP key. Use `gpg` to verify the signature. The public key is available at https://pgp.mongodb.com/python-driver.pub.

data/ext/libmongocrypt/libmongocrypt/bindings/python/CHANGELOG.rst

@@ -1,6 +1,23 @@
 Changelog
 =========
 
+Changes in Version 1.20.0
+-------------------------
+
+- Bundle libmongocrypt 1.20.5 in release wheels.
+
+Changes in Version 1.19.0
+-------------------------
+
+- Bundle libmongocrypt 1.20.4 in release wheels.
+- Renamed the ``text_opts`` parameter of ``ExplicitEncryptOpts`` and
+  ``ExplicitEncrypter.encrypt`` to ``string_opts``, matching the "string"
+  algorithm it configures. This is a breaking change.
+- The "textPreview" algorithm has been removed. Use "string" instead.
+- The "prefixPreview", "suffixPreview", and "substringPreview" query types are
+  now deprecated aliases of "prefix", "suffix", and "substring". Prefer the new
+  names, as a future release removes the aliases.
+
 Changes in Version 1.18.1
 -------------------------
 

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/asynchronous/explicit_encrypter.py

@@ -93,7 +93,7 @@ class AsyncExplicitEncrypter:
         contention_factor=None,
         range_opts=None,
         is_expression=False,
-        text_opts=None,
+        string_opts=None,
     ):
         """Encrypts a BSON value.
 
@@ -115,8 +115,8 @@ class AsyncExplicitEncrypter:
             with the "range" algorithm encoded as a BSON document.
           - `is_expression` (boolean): True if this is an encryptExpression()
             context. Defaults to False.
-          - `text_opts` (bytes): Options for explicit encryption
-            with the "textPreview" algorithm encoded as a BSON document.
+          - `string_opts` (bytes): Options for explicit encryption
+            with the "string" algorithm encoded as a BSON document.
 
         :Returns:
           The encrypted BSON value.
@@ -127,6 +127,8 @@ class AsyncExplicitEncrypter:
            Added the `range_opts` and `is_expression` parameters.
         .. versionchanged:: 1.16
            Added the `text_opts` parameter.
+        .. versionchanged:: 1.19
+           Renamed the `text_opts` parameter to `string_opts`.
         """
         # CDRIVER-3275 key_alt_name needs to be wrapped in a bson document.
         if key_alt_name is not None:
@@ -139,7 +141,7 @@ class AsyncExplicitEncrypter:
             contention_factor,
             range_opts,
             is_expression,
-            text_opts,
+            string_opts,
         )
         with self.mongocrypt.explicit_encryption_context(value, opts) as ctx:
             return await run_state_machine(ctx, self.callback)

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/binding.py

@@ -431,6 +431,10 @@ bool mongocrypt_setopt_encrypted_field_config_map(mongocrypt_t *crypt, mongocryp
  * the path string is literal "$SYSTEM", then libmongocrypt will defer to the
  * system's library resolution mechanism to find the crypt_shared library.
  *
+ * @warning Use of "$SYSTEM" will search system directories for the
+ * mongo_crypt_v1.(dll,so,dylib) following the search behavior of LoadLibrary
+ * on Windows and dlopen on Unix. Ensure secure deployment of the library.
+ *
  * @note If no crypt_shared dynamic library is found in any of the directories
  * specified by the search paths loaded here, @ref mongocrypt_init() will still
  * succeed and continue to operate without crypt_shared.
@@ -687,7 +691,8 @@ bool mongocrypt_ctx_setopt_algorithm(mongocrypt_ctx_t *ctx, const char *algorith
 /// String constant for setopt_algorithm "Indexed" explicit encryption
 /// String constant for setopt_algorithm "Unindexed" explicit encryption
 // DEPRECATED: support "RangePreview" has been removed in favor of "range".
-/// NOTE: "textPreview" is experimental only and may be removed in a future non-major release.
+/// DEPRECATED: "textPreview" has been removed. Use "string".
+// String constant for setopt_algorithm "string" explicit encryption.
 
 /**
  * Identify the AWS KMS master key to use for creating a data key.
@@ -1485,9 +1490,8 @@ bool mongocrypt_ctx_setopt_query_type(mongocrypt_ctx_t *ctx, const char *query_t
 bool mongocrypt_ctx_setopt_algorithm_range(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *opts);
 
 /**
- * Set options for explicit encryption with the "textPreview" algorithm.
+ * Set options for explicit encryption with the "string" algorithm.
  *
- * NOTE: "textPreview" is experimental only and may be removed in a future non-major release.
  * @p opts is a BSON document of the form:
  * {
  *   "caseSensitive": bool,
@@ -1508,6 +1512,8 @@ bool mongocrypt_ctx_setopt_algorithm_range(mongocrypt_ctx_t *ctx, mongocrypt_bin
  * }
  *
  * "prefix" and "suffix" can both be set.
+ *
+ * NOTE: Driver public APIs should use the name "string" rather than "text" to refer to options.
  */
 bool mongocrypt_ctx_setopt_algorithm_text(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *opts);
 
@@ -1522,9 +1528,9 @@ bool mongocrypt_setopt_key_expiration(mongocrypt_t *crypt, uint64_t cache_expira
 
 /// String constants for setopt_query_type
 // DEPRECATED: Support "rangePreview" has been removed in favor of "range".
-/// NOTE: "substringPreview" is experimental and may be removed in a future non-major release.
-/// NOTE: "suffixPreview" is experimental and may be removed in a future non-major release.
-/// NOTE: "prefixPreview" is experimental and may be removed in a future non-major release.
+/// DEPRECATED: Support for "substringPreview" has been removed in favor of "substring"
+/// DEPRECATED: Support for "suffixPreview" has been removed in favor of "suffix"
+/// DEPRECATED: Support for "prefixPreview" has been removed in favor of "prefix"
 
 """
 )

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/mongocrypt.py

@@ -501,9 +501,11 @@ class ExplicitEncryptionContext(MongoCryptContext):
                     ):
                         self._raise_from_status()
 
-            if opts.text_opts is not None:
-                with MongoCryptBinaryIn(opts.text_opts) as text_opts:
-                    if not lib.mongocrypt_ctx_setopt_algorithm_text(ctx, text_opts.bin):
+            if opts.string_opts is not None:
+                with MongoCryptBinaryIn(opts.string_opts) as string_opts:
+                    if not lib.mongocrypt_ctx_setopt_algorithm_text(
+                        ctx, string_opts.bin
+                    ):
                         self._raise_from_status()
 
             with MongoCryptBinaryIn(value) as binary: