mongo 2.19.1 → 2.21.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 624436394458300bf64df3d0b424b75ea03746b8f1a53987c18be7e33f5d4f74
-  data.tar.gz: da54416a85f4a3e6318ec6833ae14997a864a5d490c8e0fe451aa2c0acd4fe71
+  metadata.gz: 5e7f3e9918313d274cc9e065268b75d760d24491b959f7b04cdad49dd0ff38f4
+  data.tar.gz: 5071ce689f3c0027ce39c93cd662b355235a2b1728f6308c716eecbaa7b55420
 SHA512:
-  metadata.gz: a4c15fae18c57a1c33f45cde07bf325f7d2c45f2fafdf99d521900d0277feb395f0947d422939eda0572d7f0a17819a94ba1e906b1939d83e1aaefc4b662b2a0
-  data.tar.gz: e0cc5f507b02f8e787c1793b8cb708cd17090505e6ac239db7ed02cd54367d9a0079a6f64f23bf2d661820c6bbbc2df82467a15b90e884a8d9bee88a84065abb
+  metadata.gz: d8c716a1754d4d2c704a3dd8ed6fcdc5815a0818168598fbe885886f6962f07182333ce8a68ada32cf0bd5d4664d102c301d97e611bac5a126201b6c3e986597
+  data.tar.gz: 1365727e6aa93fa15ab46c058f6d3d553a16e8f06b400f915f37c326f9a3393cbf90c6a585a37c8e9a5b9f8e625fcf8443adc487bb0b29b617ffdf71c9991b75

data/README.md

@@ -5,7 +5,43 @@ MongoDB Ruby Driver
 
 The officially supported Ruby driver for [MongoDB](https://www.mongodb.org/).
 
-The Ruby driver supports Ruby 2.5-3.0 and JRuby 9.2.
+The Ruby driver supports Ruby 2.7-3.3 and JRuby 9.3-9.4.
+
+## Installation
+
+Install via RubyGems, either via the command-line for ad-hoc uses:
+
+  $ gem install mongo
+
+Or via a Gemfile for more general use:
+
+  gem 'mongo'
+
+### Release Integrity
+
+Each release of the MongoDB Ruby driver after version 2.20.0 has been automatically built and signed using the team's GPG key.
+
+To verify the driver's gem file:
+
+1. [Download the GPG key](https://pgp.mongodb.com/ruby-driver.asc).
+2. Import the key into your GPG keyring with `gpg --import ruby-driver.asc`.
+3. Download the gem file (if you don't already have it). You can download it from RubyGems with `gem fetch mongo`, or you can download it from the [releases page](https://github.com/mongodb/mongo-ruby-driver/releases) on GitHub.
+4. Download the corresponding detached signature file from the [same release](https://github.com/mongodb/mongo-ruby-driver/releases). Look at the bottom of the release that corresponds to the gem file, under the 'Assets' list, for a `.sig` file with the same version number as the gem you wish to install.
+5. Verify the gem with `gpg --verify mongo-X.Y.Z.gem.sig mongo-X.Y.Z.gem` (replacing `X.Y.Z` with the actual version number).
+
+You are looking for text like "Good signature from "MongoDB Ruby Driver Release Signing Key <packaging@mongodb.com>" in the output. If you see that, the signature was found to correspond to the given gem file.
+
+(Note that other output, like "This key is not certified with a trusted signature!", is related to *web of trust* and depends on how strongly you, personally, trust the `ruby-driver.asc` key that you downloaded from us. To learn more, see https://www.gnupg.org/gph/en/manual/x334.html)
+
+### Why not use RubyGems' gem-signing functionality?
+
+RubyGems' own gem signing is problematic, most significantly because there is no established chain of trust related to the keys used to sign gems. RubyGems' own documentation admits that "this method of signing gems is not widely used" (see https://guides.rubygems.org/security/). Discussions about this in the RubyGems community have been off-and-on for more than a decade, and while a solution will eventually arrive, we have settled on using GPG instead for the following reasons:
+
+1. Many of the other driver teams at MongoDB are using GPG to sign their product releases. Consistency with the other teams means that we can reuse existing tooling for our own product releases.
+2. GPG is widely available and has existing tools and procedures for dealing with web of trust (though they are admittedly quite arcane and intimidating to the uninitiated, unfortunately).
+
+Ultimately, most users do not bother to verify gems, and will not be impacted by our choice of GPG over RubyGems' native method.
+
 
 ## Documentation
 
@@ -17,6 +53,9 @@ API documentation for the most recent release can be found
 To build API documentation for the master branch, check out the
 repository locally and run `rake docs`.
 
+High-level driver documentation including tutorials and the reference that were in the docs folder can now be found
+at the docs-ruby repository, [here](https://github.com/mongodb/docs-ruby)
+
 ## Support
 
 Commercial support for the driver is available through the

data/Rakefile

@@ -2,17 +2,12 @@
 # rubocop:todo all
 
 require 'bundler'
-require 'bundler/gem_tasks'
 require 'rspec/core/rake_task'
-# TODO move the mongo require into the individual tasks that actually need it
-require 'mongo'
 
 ROOT = File.expand_path(File.join(File.dirname(__FILE__)))
 
 $: << File.join(ROOT, 'spec/shared/lib')
 
-require 'mrss/spec_organizer'
-
 CLASSIFIERS = [
   [%r,^mongo/server,, :unit_server],
   [%r,^mongo,, :unit],
@@ -26,15 +21,12 @@ CLASSIFIERS = [
   [%r,^spec_tests,, :spec],
 ]
 
-RUN_PRIORITY = %i(
+RUN_PRIORITY = (ENV['RUN_PRIORITY'] || %(
   tx_examples
   unit unit_server
   integration sdam_integration cursor_reaping query_cache
   spec spec_sdam_integration
-)
-
-tasks = Rake.application.instance_variable_get('@tasks')
-tasks['release:do'] = tasks.delete('release')
+)).split.map(&:to_sym)
 
 RSpec::Core::RakeTask.new(:spec) do |t|
   #t.rspec_opts = "--profile 5" if ENV['CI']
@@ -42,9 +34,61 @@ end
 
 task :default => ['spec:prepare', :spec]
 
+# stands in for the Bundler-provided `build` task, which builds the
+# gem for this project. Our release process builds the gems in a
+# particular way, in a GitHub action. This task is just to help remind
+# developers of that fact.
+task :build do
+  abort <<~WARNING
+    `rake build` does nothing in this project. The gem must be built via
+    the `Driver Release` action on GitHub, which is triggered manually when
+    a new release is ready.
+  WARNING
+end
+
+# `rake version` is used by the deployment system so get the release version
+# of the product beng deployed. It must do nothing more than just print the
+# product version number.
+# 
+# See the mongodb-labs/driver-github-tools/ruby/publish Github action.
+desc "Print the current value of Mongo::VERSION"
+task :version do
+  require 'mongo/version'
+
+  puts Mongo::VERSION
+end
+
+# overrides the default Bundler-provided `release` task, which also
+# builds the gem. Our release process assumes the gem has already
+# been built (and signed via GPG), so we just need `rake release` to
+# push the gem to rubygems.
+task :release do
+  require 'mongo/version'
+
+  if ENV['GITHUB_ACTION'].nil?
+    abort <<~WARNING
+      `rake release` must be invoked from the `Driver Release` GitHub action,
+      and must not be invoked locally. This ensures the gem is properly signed
+      and distributed by the appropriate user.
+
+      Note that it is the `rubygems/release-gem@v1` step in the `Driver Release`
+      action that invokes this task. Do not rename or remove this task, or the
+      release-gem step will fail. Reimplement this task with caution.
+
+      mongo-#{Mongo::VERSION}.gem was NOT pushed to RubyGems.
+    WARNING
+  end
+
+  system 'gem', 'push', "mongo-#{Mongo::VERSION}.gem"
+end
+
+task :mongo do
+  require 'mongo'
+end
+
 namespace :spec do
   desc 'Creates necessary user accounts in the cluster'
-  task :prepare do
+  task prepare: :mongo do
     $: << File.join(File.dirname(__FILE__), 'spec')
 
     require 'support/utils'
@@ -53,7 +97,7 @@ namespace :spec do
   end
 
   desc 'Waits for sessions to be available in the deployment'
-  task :wait_for_sessions do
+  task wait_for_sessions: :mongo do
     $: << File.join(File.dirname(__FILE__), 'spec')
 
     require 'support/utils'
@@ -77,7 +121,7 @@ namespace :spec do
   end
 
   desc 'Prints configuration used by the test suite'
-  task :config do
+  task config: :mongo do
     $: << File.join(File.dirname(__FILE__), 'spec')
 
     # Since this task is usually used for troubleshooting of test suite
@@ -90,6 +134,8 @@ namespace :spec do
   end
 
   def spec_organizer
+    require 'mrss/spec_organizer'
+
     Mrss::SpecOrganizer.new(
       root: ROOT,
       classifiers: CLASSIFIERS,
@@ -109,15 +155,31 @@ namespace :spec do
   end
 end
 
-namespace :release do
-  task :check_private_key do
-    unless File.exist?('gem-private_key.pem')
-      raise "No private key present, cannot release"
-    end
+desc 'Build and validate the evergreen config'
+task eg: %w[ eg:build eg:validate ]
+
+# 'eg' == 'evergreen', but evergreen is too many letters for convenience
+namespace :eg do
+  desc 'Builds the .evergreen/config.yml file from the templates'
+  task :build do
+    ruby '.evergreen/update-evergreen-configs'
+  end
+
+  desc 'Validates the .evergreen/config.yml file'
+  task :validate do
+    system 'evergreen validate --project mongo-ruby-driver .evergreen/config.yml'
   end
-end
 
-task :release => ['release:check_private_key', 'release:do']
+  desc 'Updates the evergreen executable to the latest available version'
+  task :update do
+    system 'evergreen get-update --install'
+  end
+
+  desc 'Runs the current branch as an evergreen patch'
+  task :patch do
+    system 'evergreen patch --uncommitted --project mongo-ruby-driver --browse --auto-description --yes'
+  end
+end
 
 desc "Generate all documentation"
 task :docs => 'docs:yard'
@@ -131,157 +193,4 @@ namespace :docs do
   end
 end
 
-require_relative "profile/benchmarking"
-
-# Some require data files, available from the drivers team. See the comments above each task for details."
-namespace :benchmark do
-  desc "Run the driver benchmark tests."
-
-  namespace :micro do
-    desc "Run the common driver micro benchmarking tests"
-
-    namespace :flat do
-      desc "Benchmarking for flat bson documents."
-
-      # Requirement: A file in Mongo::Benchmarking::DATA_PATH, called flat_bson.json.
-      task :encode do
-        puts "MICRO BENCHMARK:: FLAT:: ENCODE"
-        Mongo::Benchmarking::Micro.run(:flat, :encode)
-      end
-
-      # Requirement: A file in Mongo::Benchmarking::DATA_PATH, called flat_bson.json.
-      task :decode do
-        puts "MICRO BENCHMARK:: FLAT:: DECODE"
-        Mongo::Benchmarking::Micro.run(:flat, :decode)
-      end
-    end
-
-    namespace :deep do
-      desc "Benchmarking for deep bson documents."
-
-      # Requirement: A file in Mongo::Benchmarking::DATA_PATH, called deep_bson.json.
-      task :encode do
-        puts "MICRO BENCHMARK:: DEEP:: ENCODE"
-        Mongo::Benchmarking::Micro.run(:deep, :encode)
-      end
-
-      # Requirement: A file in Mongo::Benchmarking::DATA_PATH, called deep_bson.json.
-      task :decode do
-        puts "MICRO BENCHMARK:: DEEP:: DECODE"
-        Mongo::Benchmarking::Micro.run(:deep, :decode)
-      end
-    end
-
-    namespace :full do
-      desc "Benchmarking for full bson documents."
-
-      # Requirement: A file in Mongo::Benchmarking::DATA_PATH, called full_bson.json.
-      task :encode do
-        puts "MICRO BENCHMARK:: FULL:: ENCODE"
-        Mongo::Benchmarking::Micro.run(:full, :encode)
-      end
-
-      # Requirement: A file in Mongo::Benchmarking::DATA_PATH, called full_bson.json.
-      task :decode do
-        puts "MICRO BENCHMARK:: FULL:: DECODE"
-        Mongo::Benchmarking::Micro.run(:full, :decode)
-      end
-    end
-  end
-
-  namespace :single_doc do
-    desc "Run the common driver single-document benchmarking tests"
-    task :command do
-      puts "SINGLE DOC BENCHMARK:: COMMAND"
-      Mongo::Benchmarking::SingleDoc.run(:command)
-    end
-
-    # Requirement: A file in Mongo::Benchmarking::DATA_PATH, called TWEET.json.
-    task :find_one do
-      puts "SINGLE DOC BENCHMARK:: FIND ONE BY ID"
-      Mongo::Benchmarking::SingleDoc.run(:find_one)
-    end
-
-    # Requirement: A file in Mongo::Benchmarking::DATA_PATH, called SMALL_DOC.json.
-    task :insert_one_small do
-      puts "SINGLE DOC BENCHMARK:: INSERT ONE SMALL DOCUMENT"
-      Mongo::Benchmarking::SingleDoc.run(:insert_one_small)
-    end
-
-    # Requirement: A file in Mongo::Benchmarking::DATA_PATH, called LARGE_DOC.json.
-    task :insert_one_large do
-      puts "SINGLE DOC BENCHMARK:: INSERT ONE LARGE DOCUMENT"
-      Mongo::Benchmarking::SingleDoc.run(:insert_one_large)
-    end
-  end
-
-  namespace :multi_doc do
-    desc "Run the common driver multi-document benchmarking tests"
-
-    # Requirement: A file in Mongo::Benchmarking::DATA_PATH, called TWEET.json.
-    task :find_many do
-      puts "MULTI DOCUMENT BENCHMARK:: FIND MANY"
-      Mongo::Benchmarking::MultiDoc.run(:find_many)
-    end
-
-    # Requirement: A file in Mongo::Benchmarking::DATA_PATH, called SMALL_DOC.json.
-    task :bulk_insert_small do
-      puts "MULTI DOCUMENT BENCHMARK:: BULK INSERT SMALL"
-      Mongo::Benchmarking::MultiDoc.run(:bulk_insert_small)
-    end
-
-    # Requirement: A file in Mongo::Benchmarking::DATA_PATH, called LARGE_DOC.json.
-    task :bulk_insert_large do
-      puts "MULTI DOCUMENT BENCHMARK:: BULK INSERT LARGE"
-      Mongo::Benchmarking::MultiDoc.run(:bulk_insert_large)
-    end
-
-    # Requirement: A file in Mongo::Benchmarking::DATA_PATH, called GRIDFS_LARGE.
-    task :gridfs_upload do
-      puts "MULTI DOCUMENT BENCHMARK:: GRIDFS UPLOAD"
-      Mongo::Benchmarking::MultiDoc.run(:gridfs_upload)
-    end
-
-    # Requirement: A file in Mongo::Benchmarking::DATA_PATH, called GRIDFS_LARGE.
-    task :gridfs_download do
-      puts "MULTI DOCUMENT BENCHMARK:: GRIDFS DOWNLOAD"
-      Mongo::Benchmarking::MultiDoc.run(:gridfs_download)
-    end
-  end
-
-  namespace :parallel do
-    desc "Run the common driver paralell ETL benchmarking tests"
-
-    # Requirement: A directory in Mongo::Benchmarking::DATA_PATH, called LDJSON_MULTI,
-    # with the files used in this task.
-    task :import do
-      puts "PARALLEL ETL BENCHMARK:: IMPORT"
-      Mongo::Benchmarking::Parallel.run(:import)
-    end
-
-    # Requirement: A directory in Mongo::Benchmarking::DATA_PATH, called LDJSON_MULTI,
-    # with the files used in this task.
-    # Requirement: Another directory in "#{Mongo::Benchmarking::DATA_PATH}/LDJSON_MULTI"
-    # called 'output'.
-    task :export do
-      puts "PARALLEL ETL BENCHMARK:: EXPORT"
-      Mongo::Benchmarking::Parallel.run(:export)
-    end
-
-    # Requirement: A directory in Mongo::Benchmarking::DATA_PATH, called GRIDFS_MULTI,
-    # with the files used in this task.
-    task :gridfs_upload do
-      puts "PARALLEL ETL BENCHMARK:: GRIDFS UPLOAD"
-      Mongo::Benchmarking::Parallel.run(:gridfs_upload)
-    end
-
-    # Requirement: A directory in Mongo::Benchmarking::DATA_PATH, called GRIDFS_MULTI,
-    # with the files used in this task.
-    # Requirement: Another directory in "#{Mongo::Benchmarking::DATA_PATH}/GRIDFS_MULTI"
-    # called 'output'.
-    task :gridfs_download do
-      puts "PARALLEL ETL BENCHMARK:: GRIDFS DOWNLOAD"
-      Mongo::Benchmarking::Parallel.run(:gridfs_download)
-    end
-  end
-end
+load 'profile/driver_bench/rake/tasks.rake'

data/lib/mongo/address.rb

@@ -178,6 +178,9 @@ module Mongo
     # @param [ Hash ] opts The options.
     #
     # @option opts [ Float ] :connect_timeout Connect timeout.
+    # @option opts [ Boolean ] :csot Whether the client-side operation timeout
+    #   should be considered when connecting the socket. This option influences
+    #   only what errors will be raised if timeout expires.
     # @option opts [ true | false ] :ssl Whether to use SSL.
     # @option opts [ String ] :ssl_ca_cert
     #   Same as the corresponding Client/Socket::SSL option.
@@ -214,11 +217,12 @@ module Mongo
     # @since 2.0.0
     # @api private
     def socket(socket_timeout, opts = {})
+      csot = !!opts[:csot]
       opts = {
         connect_timeout: Server::CONNECT_TIMEOUT,
       }.update(options).update(Hash[opts.map { |k, v| [k.to_sym, v] }])
 
-      map_exceptions do
+      map_exceptions(csot) do
         if seed.downcase =~ Unix::MATCH
           specific_address = Unix.new(seed.downcase)
           return specific_address.socket(socket_timeout, opts)
@@ -281,11 +285,26 @@ module Mongo
       end
     end
 
-    def map_exceptions
+    # Maps some errors to different ones, mostly low-level errors to driver
+    # level errors
+    #
+    # @param [ Boolean ] csot Whether the client-side operation timeout
+    #   should be considered when connecting the socket.
+    def map_exceptions(csot)
       begin
         yield
       rescue Errno::ETIMEDOUT => e
-        raise Error::SocketTimeoutError, "#{e.class}: #{e} (for #{self})"
+        if csot
+          raise Error::TimeoutError, "#{e.class}: #{e} (for #{self})"
+        else
+          raise Error::SocketTimeoutError, "#{e.class}: #{e} (for #{self})"
+        end
+      rescue Error::SocketTimeoutError => e
+        if csot
+          raise Error::TimeoutError, "#{e.class}: #{e} (for #{self})"
+        else
+          raise e
+        end
       rescue IOError, SystemCallError => e
         raise Error::SocketError, "#{e.class}: #{e} (for #{self})"
       rescue OpenSSL::SSL::SSLError => e

data/lib/mongo/auth/aws/credentials_retriever.rb

@@ -69,20 +69,24 @@ module Mongo
         # Retrieves a valid set of credentials, if possible, or raises
         # Auth::InvalidConfiguration.
         #
+        # @param [ CsotTimeoutHolder | nil ] timeout_holder CSOT timeout, if any.
+        #
         # @return [ Auth::Aws::Credentials ] A valid set of credentials.
         #
         # @raise Auth::InvalidConfiguration if a source contains an invalid set
         #   of credentials.
         # @raise Auth::Aws::CredentialsNotFound if credentials could not be
         #   retrieved from any source.
-        def credentials
+        # @raise Error::TimeoutError if credentials cannot be retrieved within
+        #   the timeout defined on the operation context.
+        def credentials(timeout_holder = nil)
           credentials = credentials_from_user(user)
           return credentials unless credentials.nil?
 
           credentials = credentials_from_environment
           return credentials unless credentials.nil?
 
-          credentials = @credentials_cache.fetch { obtain_credentials_from_endpoints }
+          credentials = @credentials_cache.fetch { obtain_credentials_from_endpoints(timeout_holder) }
           return credentials unless credentials.nil?
 
           raise Auth::Aws::CredentialsNotFound
@@ -127,17 +131,21 @@ module Mongo
 
         # Returns credentials from the AWS metadata endpoints.
         #
+        # @param [ CsotTimeoutHolder ] timeout_holder CSOT timeout.
+        #
         # @return [ Auth::Aws::Credentials | nil ] A set of credentials, or nil
         #   if retrieval failed or the obtained credentials are invalid.
         #
         # @raise Auth::InvalidConfiguration if a source contains an invalid set
         #   of credentials.
-        def obtain_credentials_from_endpoints
-          if (credentials = web_identity_credentials) && credentials_valid?(credentials, 'Web identity token')
+        # @ raise Error::TimeoutError if credentials cannot be retrieved within
+        #   the timeout defined on the operation context.
+        def obtain_credentials_from_endpoints(timeout_holder = nil)
+          if (credentials = web_identity_credentials(timeout_holder)) && credentials_valid?(credentials, 'Web identity token')
             credentials
-          elsif (credentials = ecs_metadata_credentials) && credentials_valid?(credentials, 'ECS task metadata')
+          elsif (credentials = ecs_metadata_credentials(timeout_holder)) && credentials_valid?(credentials, 'ECS task metadata')
             credentials
-          elsif (credentials = ec2_metadata_credentials) && credentials_valid?(credentials, 'EC2 instance metadata')
+          elsif (credentials = ec2_metadata_credentials(timeout_holder)) && credentials_valid?(credentials, 'EC2 instance metadata')
             credentials
           end
         end
@@ -145,21 +153,26 @@ module Mongo
         # Returns credentials from the EC2 metadata endpoint. The credentials
         # could be empty, partial or invalid.
         #
+        # @param [ CsotTimeoutHolder ] timeout_holder CSOT timeout.
+        #
         # @return [ Auth::Aws::Credentials | nil ] A set of credentials, or nil
         #   if retrieval failed.
-        def ec2_metadata_credentials
+        # @ raise Error::TimeoutError if credentials cannot be retrieved within
+        #   the timeout.
+        def ec2_metadata_credentials(timeout_holder = nil)
+          timeout_holder&.check_timeout!
           http = Net::HTTP.new('169.254.169.254')
           req = Net::HTTP::Put.new('/latest/api/token',
             # The TTL is required in order to obtain the metadata token.
             {'x-aws-ec2-metadata-token-ttl-seconds' => '30'})
-          resp = ::Timeout.timeout(METADATA_TIMEOUT) do
+          resp = with_timeout(timeout_holder) do
             http.request(req)
           end
           if resp.code != '200'
             return nil
           end
           metadata_token = resp.body
-          resp = ::Timeout.timeout(METADATA_TIMEOUT) do
+          resp = with_timeout(timeout_holder) do
             http_get(http, '/latest/meta-data/iam/security-credentials', metadata_token)
           end
           if resp.code != '200'
@@ -167,7 +180,7 @@ module Mongo
           end
           role_name = resp.body
           escaped_role_name = CGI.escape(role_name).gsub('+', '%20')
-          resp = ::Timeout.timeout(METADATA_TIMEOUT) do
+          resp = with_timeout(timeout_holder) do
             http_get(http, "/latest/meta-data/iam/security-credentials/#{escaped_role_name}", metadata_token)
           end
           if resp.code != '200'
@@ -189,7 +202,17 @@ module Mongo
           return nil
         end
 
-        def ecs_metadata_credentials
+        # Returns credentials from the ECS metadata endpoint. The credentials
+        # could be empty, partial or invalid.
+        #
+        # @param [ CsotTimeoutHolder | nil ] timeout_holder CSOT timeout.
+        #
+        # @return [ Auth::Aws::Credentials | nil ] A set of credentials, or nil
+        #   if retrieval failed.
+        # @ raise Error::TimeoutError if credentials cannot be retrieved within
+        #   the timeout defined on the operation context.
+        def ecs_metadata_credentials(timeout_holder = nil)
+          timeout_holder&.check_timeout!
           relative_uri = ENV['AWS_CONTAINER_CREDENTIALS_RELATIVE_URI']
           if relative_uri.nil? || relative_uri.empty?
             return nil
@@ -203,7 +226,7 @@ module Mongo
           # a leading slash must be added by the driver, but this is not
           # in fact needed.
           req = Net::HTTP::Get.new(relative_uri)
-          resp = ::Timeout.timeout(METADATA_TIMEOUT) do
+          resp = with_timeout(timeout_holder) do
             http.request(req)
           end
           if resp.code != '200'
@@ -225,13 +248,15 @@ module Mongo
         # inside EKS. See https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html
         # for further details.
         #
+        # @param [ CsotTimeoutHolder | nil ] timeout_holder CSOT timeout.
+        #
         # @return [ Auth::Aws::Credentials | nil ] A set of credentials, or nil
         #   if retrieval failed.
-        def web_identity_credentials
+        def web_identity_credentials(timeout_holder = nil)
           web_identity_token, role_arn, role_session_name = prepare_web_identity_inputs
           return nil if web_identity_token.nil?
           response = request_web_identity_credentials(
-            web_identity_token, role_arn, role_session_name
+            web_identity_token, role_arn, role_session_name, timeout_holder
           )
           return if response.nil?
           credentials_from_web_identity_response(response)
@@ -266,10 +291,15 @@ module Mongo
         #   that the caller is assuming.
         # @param [ String ] role_session_name An identifier for the assumed
         #   role session.
+        # @param [ CsotTimeoutHolder | nil ] timeout_holder CSOT timeout.
         #
         # @return [ Net::HTTPResponse | nil ] AWS API response if successful,
         #   otherwise nil.
-        def request_web_identity_credentials(token, role_arn, role_session_name)
+        #
+        # @ raise Error::TimeoutError if credentials cannot be retrieved within
+        #   the timeout defined on the operation context.
+        def request_web_identity_credentials(token, role_arn, role_session_name, timeout_holder)
+          timeout_holder&.check_timeout!
           uri = URI('https://sts.amazonaws.com/')
           params = {
             'Action' => 'AssumeRoleWithWebIdentity',
@@ -281,8 +311,10 @@ module Mongo
           uri.query = ::URI.encode_www_form(params)
           req = Net::HTTP::Post.new(uri)
           req['Accept'] = 'application/json'
-          resp = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |https|
-            https.request(req)
+          resp = with_timeout(timeout_holder) do
+            Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |https|
+              https.request(req)
+            end
           end
           if resp.code != '200'
             return nil
@@ -351,6 +383,27 @@ module Mongo
 
           true
         end
+
+        # Execute the given block considering the timeout defined on the context,
+        # or the default timeout value.
+        #
+        # We use +Timeout.timeout+ here because there is no other acceptable easy
+        # way to time limit http requests.
+        #
+        # @param [ CsotTimeoutHolder | nil ] timeout_holder CSOT timeout.
+        #
+        # @ raise Error::TimeoutError if deadline exceeded.
+        def with_timeout(timeout_holder)
+          timeout = timeout_holder&.remaining_timeout_sec! || METADATA_TIMEOUT
+          exception_class = if timeout_holder&.csot?
+                              Error::TimeoutError
+                            else
+                              nil
+                            end
+          ::Timeout.timeout(timeout, exception_class) do
+            yield
+          end
+        end
       end
     end
   end

data/lib/mongo/auth/base.rb

@@ -117,7 +117,7 @@ module Mongo
         else
           nil
         end
-        result = Operation::Result.new(reply, connection.description, connection_global_id)
+        result = Operation::Result.new(reply, connection.description, connection_global_id, context: context)
         connection.update_cluster_time(result)
         reply_document
       end