mongo 2.20.1 → 2.20.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1a641cd6128fd246b0ac9999f00167631548206573a22989968f2a7a132bc0ae
-  data.tar.gz: d5526d1ca34219ac644191f1e2c7177877c70063cc5a97992379e8e86065d0ca
+  metadata.gz: 8ccd08d09b5ee60c5da82105ce4bb165f1324e475e9f476f956d08a677a503b9
+  data.tar.gz: d055b854eb8f822e37ca7002bef5e3625c6ddf7052c06113c0568b0ca275eae6
 SHA512:
-  metadata.gz: 4c23fd9abff5c29517b2cf0c0094bedfbbe667a96f2494b36e6465d8bbfbe113cd08f05e72d15b6db17ef35a211c4aaa040c20dc99eb65417c3c3690b7712c59
-  data.tar.gz: 54ffbc332168455337aa4de863db0ca179084a35c271e9f21dbfe2425556bd00e02b2fd46a5c2581aa15d5e9a11b84d9a0c231889774adb129f2ad38b997f4f4
+  metadata.gz: 291abbb2324d615f2061a7f924e31c7020c7da0541ff5a5b115a9c3edb7b4a74a921ff3e226a50bb6c74fb9f8f79f8343f14ea17f701b6796fde2dc774f0c915
+  data.tar.gz: 792ed0dd04ed391c9b644fa13e65d4282182cac3e54af1f1a4830a20d6ed30c6f6eecef0c0e8d3cbab0c02bef907065a70568fa44b346bb8d947cc02a6a5abb6

data/Rakefile

@@ -4,6 +4,10 @@
 require 'bundler'
 require 'rspec/core/rake_task'
 
+if File.exist?('./spec/shared/lib/tasks/candidate.rake')
+  load 'spec/shared/lib/tasks/candidate.rake'
+end
+
 ROOT = File.expand_path(File.join(File.dirname(__FILE__)))
 
 $: << File.join(ROOT, 'spec/shared/lib')
@@ -34,16 +38,12 @@ end
 
 task :default => ['spec:prepare', :spec]
 
-# stands in for the Bundler-provided `build` task, which builds the
-# gem for this project. Our release process builds the gems in a
-# particular way, in a GitHub action. This task is just to help remind
-# developers of that fact.
+desc 'Build the gem'
 task :build do
-  abort <<~WARNING
-    `rake build` does nothing in this project. The gem must be built via
-    the `Driver Release` action on GitHub, which is triggered manually when
-    a new release is ready.
-  WARNING
+  command = %w[ gem build ]
+  command << "--output=#{ENV['GEM_FILE_NAME']}" if ENV['GEM_FILE_NAME']
+  command << (ENV['GEMSPEC'] || 'mongo.gemspec')
+  system(*command)
 end
 
 # `rake version` is used by the deployment system so get the release version

data/lib/mongo/socket/ssl.rb

@@ -23,6 +23,7 @@ module Mongo
     # @since 2.0.0
     class SSL < Socket
       include OpenSSL
+      include Loggable
 
       # Initializes a new TLS socket.
       #
@@ -363,12 +364,15 @@ module Mongo
       end
 
       def verify_ocsp_endpoint!(socket)
-        unless verify_ocsp_endpoint?
-          return
-        end
+        return unless verify_ocsp_endpoint?
 
         cert = socket.peer_cert
-        ca_cert = socket.peer_cert_chain.last
+        ca_cert = find_issuer(cert, socket.peer_cert_chain)
+
+        unless ca_cert
+          log_warn("TLS certificate of '#{host_name}' could not be definitively verified via OCSP: issuer certificate not found in the chain.")
+          return
+        end
 
         verifier = OcspVerifier.new(@host_name, cert, ca_cert, context.cert_store,
           **Utils.shallow_symbolize_keys(options))
@@ -411,6 +415,11 @@ module Mongo
           end
         end
       end
+
+      # Find the issuer certificate in the chain.
+      def find_issuer(cert, cert_chain)
+        cert_chain.find { |c| c.subject == cert.issuer }
+      end
     end
   end
 end

data/lib/mongo/version.rb

@@ -1,20 +1,9 @@
 # frozen_string_literal: true
 
-# Copyright (C) 2014-2020 MongoDB Inc.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
 module Mongo
   # The current version of the driver.
-  VERSION = '2.20.1'
+  #
+  # Note that this file is automatically updated via `rake candidate:create`.
+  # Manual changes to this file will be overwritten by that rake task.
+  VERSION = '2.20.2'
 end

data/spec/integration/ocsp_verifier_spec.rb

@@ -9,6 +9,21 @@ describe Mongo::Socket::OcspVerifier do
   with_openssl_debug
   retry_test sleep: 5
 
+  def self.with_ocsp_responder(port = 8100, path = '/', &setup)
+    around do |example|
+      server = WEBrick::HTTPServer.new(Port: port)
+      server.mount_proc path, &setup
+      Thread.new { server.start }
+      begin
+        example.run
+      ensure
+        server.shutdown
+      end
+
+      ::Utils.wait_for_port_free(port, 5)
+    end
+  end
+
   shared_examples 'verifies' do
     context 'mri' do
       fails_on_jruby
@@ -173,21 +188,10 @@ describe Mongo::Socket::OcspVerifier do
 
     context 'one time' do
 
-      around do |example|
-        server = WEBrick::HTTPServer.new(Port: 8100)
-        server.mount_proc '/' do |req, res|
-          res.status = 303
-          res['locAtion'] = "http://localhost:8101#{req.path}"
-          res.body = "See http://localhost:8101#{req.path}"
-        end
-        Thread.new { server.start }
-        begin
-          example.run
-        ensure
-          server.shutdown
-        end
-
-        ::Utils.wait_for_port_free(8100, 5)
+      with_ocsp_responder do |req, res|
+        res.status = 303
+        res['locAtion'] = "http://localhost:8101#{req.path}"
+        res.body = "See http://localhost:8101#{req.path}"
       end
 
       include_context 'verifier', algorithm: algorithm
@@ -248,21 +252,10 @@ describe Mongo::Socket::OcspVerifier do
         port: 8101,
       )
 
-      around do |example|
-        server = WEBrick::HTTPServer.new(Port: 8100)
-        server.mount_proc '/' do |req, res|
-          res.status = 303
-          res['locAtion'] = req.path
-          res.body = "See #{req.path} indefinitely"
-        end
-        Thread.new { server.start }
-        begin
-          example.run
-        ensure
-          server.shutdown
-        end
-
-        ::Utils.wait_for_port_free(8100, 5)
+      with_ocsp_responder do |req, res|
+        res.status = 303
+        res['locAtion'] = req.path
+        res.body = "See #{req.path} indefinitely"
       end
 
       include_context 'verifier', algorithm: algorithm
@@ -274,85 +267,23 @@ describe Mongo::Socket::OcspVerifier do
 
     include_context 'verifier', algorithm: 'rsa'
 
-    context '40x / 50x' do
-      around do |example|
-        server = WEBrick::HTTPServer.new(Port: 8100)
-        server.mount_proc '/' do |req, res|
+    [400, 404, 500, 503].each do |code|
+      context "code #{code}" do
+        with_ocsp_responder do |req, res|
           res.status = code
           res.body = "HTTP #{code}"
         end
-        Thread.new { server.start }
-        begin
-          example.run
-        ensure
-          server.shutdown
-        end
-
-        ::Utils.wait_for_port_free(8100, 5)
-      end
-
-      [400, 404, 500, 503].each do |_code|
-        context "code #{_code}" do
-          let(:code) { _code }
-          include_examples 'does not verify'
-        end
-      end
-    end
-
-    context '204' do
-      around do |example|
-        server = WEBrick::HTTPServer.new(Port: 8100)
-        server.mount_proc '/' do |req, res|
-          res.status = 204
-        end
-        Thread.new { server.start }
-        begin
-          example.run
-        ensure
-          server.shutdown
-        end
 
-        ::Utils.wait_for_port_free(8100, 5)
-      end
-
-      context "code 204" do
-        let(:code) { 204 }
         include_examples 'does not verify'
       end
     end
-  end
-
-  context 'responder URI has no path' do
-    require_external_connectivity
-
-    # https://github.com/jruby/jruby-openssl/issues/210
-    fails_on_jruby
 
-    include_context 'basic verifier'
-
-    # The fake certificates all have paths in them for use with the ocsp mock.
-    # Use real certificates retrieved from Atlas for this test as they don't
-    # have a path in the OCSP URI (which the test also asserts).
-    # Note that these certificates expire in 3 months and need to be replaced
-    # with a more permanent solution.
-    # Use the spec/support/certificates/retrieve-atlas-cert script to retrieve
-    # current certificates from Atlas.
-    let(:cert_path) { File.join(File.dirname(__FILE__), '../support/certificates/atlas-ocsp.crt') }
-    let(:ca_cert_path) { File.join(File.dirname(__FILE__), '../support/certificates/atlas-ocsp-ca.crt') }
-    let(:cert_store) do
-      OpenSSL::X509::Store.new.tap do |store|
-        store.set_default_paths
+    context 'code 204' do
+      with_ocsp_responder do |req, res|
+        res.status = 204
       end
-    end
-
-    before do
-      verifier.ocsp_uris.length.should > 0
-      URI.parse(verifier.ocsp_uris.first).path.should == ''
-    end
 
-    it 'verifies' do
-      # TODO This test will fail if the certificate expires
-      expect(verifier.verify).to be(true), "If atlas-ocsp certificates have expired, run spec/support/certificates/retrieve-atlas-cert to get a new ones"
+      include_examples 'does not verify'
     end
   end
 end

data/spec/integration/reconnect_spec.rb

@@ -111,6 +111,10 @@ describe 'Client after reconnect' do
       # thread.kill should've similarly failed, but it doesn't.
       fails_on_jruby
 
+      # odd failures related to async on ruby <= 3.1, I suspect something
+      # with how fibers worked in those versions.
+      minimum_mri_version '3.2.0'
+
       it 'recreates SRV monitor' do
         wait_for_discovery
 
@@ -151,6 +155,10 @@ describe 'Client after reconnect' do
       # NotImplementedError: recvmsg_nonblock is not implemented
       fails_on_jruby
 
+      # odd failures related to async on ruby <= 3.1, I suspect something
+      # with how fibers worked in those versions.
+      minimum_mri_version '3.2.0'
+
       let(:uri) do
         "mongodb+srv://test-fake.test.build.10gen.cc/"
       end
@@ -181,8 +189,6 @@ describe 'Client after reconnect' do
       end
 
       around do |example|
-        require 'support/dns'
-
         rules = [
           ['_mongodb._tcp.test-fake.test.build.10gen.cc', :srv,
             [0, 0, 2799, 'localhost.test.build.10gen.cc'],

data/spec/integration/srv_monitoring_spec.rb

@@ -76,9 +76,8 @@ describe 'SRV Monitoring' do
     # NotImplementedError: recvmsg_nonblock is not implemented
     fails_on_jruby
 
-    before(:all) do
-      require 'support/dns'
-    end
+    # mock dns implementation doesn't play nice with 2.7, etc.
+    minimum_mri_version '3.0.0'
 
     around do |example|
       # Speed up the tests by listening on the fake ports we are using.

data/spec/integration/srv_spec.rb

@@ -12,10 +12,6 @@ describe 'SRV lookup' do
     # NotImplementedError: recvmsg_nonblock is not implemented
     fails_on_jruby
 
-    before(:all) do
-      require 'support/dns'
-    end
-
     let(:uri) do
       "mongodb+srv://test-fake.test.build.10gen.cc/?tls=#{SpecConfig.instance.ssl?}&tlsInsecure=true"
     end

data/spec/shared/CANDIDATE.md

@@ -0,0 +1,28 @@
+# Candidate Tasks
+
+When using the `candidate` rake tasks, you must make sure:
+
+1. You are using at least `git` version 2.49.0.
+2. You have the `gh` CLI tool installed.
+3. You are logged into `gh` with an account that has collaborator access to the repository.
+4. You have run `gh repo set-default` from the root of your local checkout to set the default repository to the canonical MongoDB repo.
+5. The `origin` remote for your local checkout is set to your own fork.
+6. The `upstream` remote for your local checkout is set to the canonical
+   MongoDB repo.
+
+Once configured, you can use the following commands:
+
+1. `rake candidate:prs` - This will list all pull requests that will be included in the next release. Any with `[?]` are unlabelled (or are not labelled with a recognized label). Otherwise, `[b]` means `bug`, `[f]` means `feature`, and `[x]` means `bcbreak`.
+2. `rake candidate:preview` - This will generate and display the release notes for the next release, based on the associated pull requests.
+3. `rake candidate:create` - This will create a new PR against the default repository, using the generated release notes as the description. The new PR will be given the `release-candidate` label.
+
+Then, after the release candidate PR is approved and merged, the release process will automatically bundle, sign, and release the new version.
+
+Once you've merged the PR, you can switch to the "Actions" tab for the repository on GitHub and look for the "Release" workflow (might be named differently), which should have triggered automatically. You can monitor the progress of the release there. If there are any problems, the workflow is generally safe to re-run after you've addressed them.
+
+Things to do after the release succeeds:
+
+1. Copy the release notes from the PR and create a new release announcement on the forums (https://www.mongodb.com/community/forums/c/announcements/driver-releases/110).
+2. If the release was not automatically announced in #ruby, copy a link to the GitHub release or MongoDB forum post there.
+3. Close the release in Jira.
+

data/spec/shared/LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) 2020 MongoDB, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/spec/shared/bin/get-mongodb-download-url

@@ -0,0 +1,17 @@
+#!/usr/bin/env ruby
+
+desired_version, arch = ARGV
+if arch.nil?
+  STDERR.puts "Usage: get-mongodb-download-url desired-version arch"
+  exit 1
+end
+
+$: << File.join(File.dirname(__FILE__), '../lib')
+require 'mrss/server_version_registry'
+
+begin
+  puts Mrss::ServerVersionRegistry.new(desired_version, arch).download_url
+rescue Mrss::ServerVersionRegistry::Error => exc
+  STDERR.puts "Error: #{exc}"
+  exit 2
+end

data/spec/shared/bin/s3-copy

@@ -0,0 +1,45 @@
+#!/usr/bin/env ruby
+
+require 'optparse'
+require 'aws-sdk-s3'
+
+options = {}
+OptionParser.new do |opts|
+  opts.banner = "Usage: s3-copy options"
+
+  opts.on("-r", "--region=REGION", "AWS region to use (default us-east-1)") do |v|
+    options[:region] = v
+  end
+
+  opts.on("-p", "--param=KEY=VALUE", "Specify parameter for new files") do |v|
+    options[:params] ||= {}
+    k, v = v.split('=', 2)
+    options[:params][k.to_sym] = v
+  end
+
+  opts.on("-f", "--from=BUCKET:PATH", "Bucket name and key (or path) to copy from") do |v|
+    options[:from] = v
+  end
+
+  opts.on("-t", "--to=BUCKET:PATH", "Bucket name and key (or path) to write to (may be specified more than once)") do |v|
+    options[:to] ||= []
+    options[:to] << v
+  end
+end.parse!
+
+ENV['AWS_REGION'] ||= options[:region] || 'us-east-1'
+
+bucket, key = options.fetch(:from).split(':', 2)
+
+s3 = Aws::S3::Client.new
+
+options.fetch(:to).each do |dest|
+  STDERR.puts "Copying to #{dest}"
+  dbucket, dkey = dest.split(':', 2)
+  s3.copy_object(
+    bucket: dbucket,
+    key: dkey,
+    copy_source: "/#{bucket}/#{key}",
+    **options[:params] || {},
+  )
+end

data/spec/shared/bin/s3-upload

@@ -0,0 +1,69 @@
+#!/usr/bin/env ruby
+
+require 'optparse'
+require 'aws-sdk-s3'
+
+options = {}
+OptionParser.new do |opts|
+  opts.banner = "Usage: s3-upload options"
+
+  opts.on("-r", "--region=REGION", "AWS region to use (default us-east-1)") do |v|
+    options[:region] = v
+  end
+
+  opts.on("-p", "--param=KEY=VALUE", "Specify parameter for S3 upload") do |v|
+    options[:params] ||= {}
+    k, v = v.split('=', 2)
+    options[:params][k.to_sym] = v
+  end
+
+  opts.on("-f", "--file=PATH", "Path to the file to upload, - to upload standard input") do |v|
+    options[:file] = v
+  end
+
+  opts.on("-w", "--write=BUCKET:PATH", "Bucket name and key (or path) to upload to") do |v|
+    options[:write] = v
+  end
+
+  opts.on("-c", "--copy=BUCKET:PATH", "Bucket name and key (or path) to copy to (may be specified more than once)") do |v|
+    options[:copy] ||= []
+    options[:copy] << v
+  end
+end.parse!
+
+ENV['AWS_REGION'] ||= options[:region] || 'us-east-1'
+
+def upload(f, options)
+  s3 = Aws::S3::Client.new
+  write = options.fetch(:write)
+  STDERR.puts "Writing #{write}"
+  bucket, key = write.split(':', 2)
+  s3.put_object(
+    body: f.read,
+    bucket: bucket,
+    key: key,
+    **options[:params] || {},
+  )
+  if copy = options[:copy]
+    copy.each do |dest|
+      STDERR.puts "Copying to #{dest}"
+      dbucket, dkey = dest.split(':', 2)
+      s3.copy_object(
+        bucket: dbucket,
+        key: dkey,
+        copy_source: "/#{bucket}/#{key}",
+        **options[:params] || {},
+      )
+    end
+  end
+end
+
+if options[:file] == '-'
+  upload(STDIN, options)
+elsif options[:file]
+  File.open(options[:file]) do |f|
+    upload(f, options)
+  end
+else
+  upload(STDIN, options)
+end

data/spec/shared/lib/mrss/child_process_helper.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+# encoding: utf-8
+
+autoload :ChildProcess, 'childprocess'
+autoload :Tempfile, 'tempfile'
+
+module Mrss
+  module ChildProcessHelper
+    class SpawnError < StandardError; end
+
+    module_function def call(cmd, env: nil, cwd: nil)
+      process = ChildProcess.new(*cmd)
+      process.io.inherit!
+      if cwd
+        process.cwd = cwd
+      end
+      if env
+        env.each do |k, v|
+          process.environment[k.to_s] = v
+        end
+      end
+      process.start
+      process.wait
+      process
+    end
+
+    module_function def check_call(cmd, env: nil, cwd: nil)
+      process = call(cmd, env: env, cwd: cwd)
+      unless process.exit_code == 0
+        raise SpawnError, "Failed to execute: #{cmd}"
+      end
+    end
+
+    module_function def get_output(cmd, env: nil, cwd: nil)
+      process = ChildProcess.new(*cmd)
+      process.io.inherit!
+      if cwd
+        process.cwd = cwd
+      end
+      if env
+        env.each do |k, v|
+          process.environment[k.to_s] = v
+        end
+      end
+
+      output = ''
+      r, w = IO.pipe
+
+      begin
+        process.io.stdout = w
+        process.start
+        w.close
+
+        thread = Thread.new do
+          begin
+            loop do
+              output << r.readpartial(16384)
+            end
+          rescue EOFError
+          end
+        end
+
+        process.wait
+        thread.join
+      ensure
+        r.close
+      end
+
+      [process, output]
+    end
+
+    module_function def check_output(*args)
+      process, output = get_output(*args)
+      unless process.exit_code == 0
+        raise SpawnError,"Failed to execute: #{args}"
+      end
+      output
+    end
+  end
+end