From dda86b33270e2650c99e120e211059c1706dc314 Mon Sep 17 00:00:00 2001 From: Dmitry Rybakov Date: Tue, 20 May 2025 11:24:32 +0200 Subject: [PATCH] Libmongocrypt version 1.13.2 --- .../.evergreen/benchmark-java.sh | 26 - .../libmongocrypt/.evergreen/config.yml | 249 +- .../.evergreen/create-packages-and-repos.sh | 4 +- .../.evergreen/debian_package_build.sh | 3 + .../libmongocrypt/.evergreen/earthly.sh | 2 +- .../libmongocrypt/.evergreen/init.sh | 1 + .../libmongocrypt/.evergreen/linker-tests.sh | 19 +- .../.evergreen/pkgconfig-tests.sh | 38 +- .../.evergreen/prep_c_driver_source.sh | 2 +- .../libmongocrypt/.evergreen/sbom.sh | 45 + .../.github/workflows/codeql-actions.yml | 44 + .../{codeql.yml => codeql-python.yml} | 6 +- .../.github/workflows/dist-python.yml | 6 +- .../.github/workflows/release-python.yml | 53 +- .../.github/workflows/test-python.yml | 3 + .../.github/workflows/zizmor.yml | 33 + .../libmongocrypt/.lsan-suppressions | 1 + ext/libmongocrypt/libmongocrypt/CHANGELOG.md | 19 + .../libmongocrypt/CMakeLists.txt | 10 + ext/libmongocrypt/libmongocrypt/CODEOWNERS | 5 +- .../libmongocrypt/CONTRIBUTING.md | 14 + ext/libmongocrypt/libmongocrypt/Earthfile | 82 +- ext/libmongocrypt/libmongocrypt/README.md | 25 +- .../java/mongocrypt/.evergreen/publish.sh | 27 - .../java/mongocrypt/.evergreen/test.sh | 24 - .../bindings/java/mongocrypt/.gitignore | 39 - .../bindings/java/mongocrypt/README.md | 36 - .../mongocrypt/benchmarks/build.gradle.kts | 28 - .../crypt/benchmark/BenchmarkRunner.java | 217 -- .../src/main/resources/keyDocument.json | 24 - .../bindings/java/mongocrypt/build.gradle.kts | 354 -- .../gradle/wrapper/gradle-wrapper.jar | Bin 59821 -> 0 bytes .../gradle/wrapper/gradle-wrapper.properties | 5 - .../bindings/java/mongocrypt/gradlew | 234 -- .../bindings/java/mongocrypt/gradlew.bat | 89 - .../java/mongocrypt/settings.gradle.kts | 1 - .../com/mongodb/crypt/capi/BinaryHolder.java | 45 - .../java/com/mongodb/crypt/capi/CAPI.java | 1165 ------- .../com/mongodb/crypt/capi/CAPIHelper.java | 96 - .../mongodb/crypt/capi/CipherCallback.java | 92 - .../mongodb/crypt/capi/DisposableMemory.java | 31 - .../com/mongodb/crypt/capi/JULLogger.java | 130 - .../java/com/mongodb/crypt/capi/Logger.java | 144 - .../java/com/mongodb/crypt/capi/Loggers.java | 50 - .../com/mongodb/crypt/capi/MacCallback.java | 60 - .../crypt/capi/MessageDigestCallback.java | 55 - .../capi/MongoAwsKmsProviderOptions.java | 104 - .../com/mongodb/crypt/capi/MongoCrypt.java | 100 - .../mongodb/crypt/capi/MongoCryptContext.java | 137 - .../crypt/capi/MongoCryptContextImpl.java | 164 - .../crypt/capi/MongoCryptException.java | 67 - .../mongodb/crypt/capi/MongoCryptImpl.java | 423 --- .../mongodb/crypt/capi/MongoCryptOptions.java | 284 -- .../com/mongodb/crypt/capi/MongoCrypts.java | 38 - .../crypt/capi/MongoDataKeyOptions.java | 125 - .../capi/MongoExplicitEncryptOptions.java | 227 -- .../mongodb/crypt/capi/MongoKeyDecryptor.java | 76 - .../crypt/capi/MongoKeyDecryptorImpl.java | 105 - .../capi/MongoLocalKmsProviderOptions.java | 83 - .../capi/MongoRewrapManyDataKeyOptions.java | 104 - .../com/mongodb/crypt/capi/SLF4JLogger.java | 110 - .../crypt/capi/SecureRandomCallback.java | 51 - .../crypt/capi/SigningRSAESPKCSCallback.java | 76 - .../com/mongodb/crypt/capi/package-info.java | 18 - .../META-INF/native-image/jni-config.json | 180 - .../META-INF/native-image/reflect-config.json | 134 - .../mongodb/crypt/capi/MongoCryptTest.java | 389 --- .../src/test/resources/command-reply.json | 13 - .../src/test/resources/command.json | 6 - .../resources/encrypted-command-reply.json | 16 - .../src/test/resources/encrypted-command.json | 11 - .../src/test/resources/encrypted-value.json | 6 - .../int32/encrypted-payload.json | 26 - .../int32/key-filter.json | 19 - .../int32/rangeopts.json | 14 - .../int32/value-to-encrypt.json | 20 - .../src/test/resources/json-schema.json | 15 - .../src/test/resources/key-document.json | 36 - .../test/resources/key-filter-keyAltName.json | 14 - .../src/test/resources/key-filter.json | 19 - .../src/test/resources/kms-reply.txt | 6 - .../resources/list-collections-filter.json | 3 - .../test/resources/mongocryptd-command.json | 22 - .../src/test/resources/mongocryptd-reply.json | 18 - .../bindings/python/.evergreen/integ-setup.sh | 2 + .../bindings/python/.evergreen/integ-test.sh | 16 +- .../bindings/python/.evergreen/test.sh | 4 +- .../bindings/python/CHANGELOG.rst | 6 + .../libmongocrypt/bindings/python/README.rst | 2 +- .../bindings/python/libmongocrypt-version.txt | 2 +- .../bindings/python/pymongocrypt/binding.py | 40 +- .../python/pymongocrypt/mongocrypt.py | 32 + .../bindings/python/pymongocrypt/version.py | 2 +- .../libmongocrypt/bindings/python/release.sh | 2 +- .../libmongocrypt/bindings/python/sbom.json | 16 +- .../success/encrypted-field-config-map.json | 1 - .../test/data/encrypted-field-config-map.json | 2 - .../bindings/python/test/test_mongocrypt.py | 22 +- .../bindings/python/update-sbom.sh | 2 +- .../libmongocrypt/cmake/FetchMongoC.cmake | 6 +- .../libmongocrypt/cmake/ImportBSON.cmake | 8 +- .../libmongocrypt/doc/releasing.md | 37 +- .../libmongocrypt/etc/cyclonedx.sbom.json | 18 +- ext/libmongocrypt/libmongocrypt/etc/format.sh | 2 - ...n-remove-GCC-diagnostic-in-functions.patch | 158 + ...libbson-remove-GCC-diagnostic-pragma.patch | 6 +- ext/libmongocrypt/libmongocrypt/etc/purls.txt | 2 +- .../etc/ssdlc_compliance_report.md | 2 +- .../etc/third_party_vulnerabilities.md | 2 +- .../libmongocrypt/integrating.md | 53 +- .../kms-message/src/kms_crypto_windows.c | 4 +- .../kms-message/src/kms_message.c | 2 +- .../kms-message/src/kms_message_private.h | 4 +- .../kms-message/src/kms_request.c | 6 +- .../test/test_kmip_reader_writer.c | 10 +- .../kms-message/test/test_kms_assert.h | 33 +- .../kms-message/test/test_kms_azure_online.c | 4 +- .../kms-message/test/test_kms_gcp_online.c | 6 +- .../kms-message/test/test_kms_request.c | 22 +- .../libmongocrypt/src/mc-efc-private.h | 5 + ext/libmongocrypt/libmongocrypt/src/mc-efc.c | 36 +- .../src/mc-fle-blob-subtype-private.h | 5 +- .../mc-fle2-encryption-placeholder-private.h | 79 + .../src/mc-fle2-encryption-placeholder.c | 228 +- .../src/mc-fle2-find-equality-payload-v2.c | 1 - .../src/mc-fle2-find-equality-payload.c | 1 - ...mc-fle2-insert-update-payload-private-v2.h | 34 + .../src/mc-fle2-insert-update-payload-v2.c | 166 +- .../src/mc-fle2-insert-update-payload.c | 1 - .../src/mc-fle2-payload-iev-private-v2.h | 112 +- .../src/mc-fle2-payload-iev-v2.c | 451 ++- ...tag-and-encrypted-metadata-block-private.h | 9 +- ...mc-fle2-tag-and-encrypted-metadata-block.c | 17 + .../src/mc-schema-broker-private.h | 126 + .../libmongocrypt/src/mc-schema-broker.c | 1075 ++++++ .../src/mc-str-encode-string-sets-private.h | 95 + .../src/mc-str-encode-string-sets.c | 304 ++ .../src/mc-text-search-str-encode-private.h | 45 + .../src/mc-text-search-str-encode.c | 248 ++ .../libmongocrypt/src/mc-tokens-private.h | 114 +- .../libmongocrypt/src/mc-tokens.c | 168 +- .../libmongocrypt/src/mlib/windows-lean.h | 2 + .../src/mongocrypt-buffer-private.h | 11 + .../libmongocrypt/src/mongocrypt-buffer.c | 39 +- .../src/mongocrypt-ctx-decrypt.c | 12 +- .../src/mongocrypt-ctx-encrypt.c | 1287 +++----- .../src/mongocrypt-ctx-private.h | 24 +- .../libmongocrypt/src/mongocrypt-kms-ctx.c | 2 +- .../libmongocrypt/src/mongocrypt-marking.c | 1039 +++--- .../src/mongocrypt-opts-private.h | 4 - .../libmongocrypt/src/mongocrypt-private.h | 19 +- .../src/mongocrypt-traverse-util.c | 2 +- .../libmongocrypt/src/mongocrypt-util.c | 4 +- .../libmongocrypt/src/mongocrypt.c | 15 +- .../libmongocrypt/src/mongocrypt.h | 17 + .../libmongocrypt/src/os_posix/os_dll.c | 4 +- .../libmongocrypt/src/unicode/case-fold-map.c | 1434 ++++++++ .../src/unicode/diacritic-fold-map.c | 2884 +++++++++++++++++ .../libmongocrypt/src/unicode/fold.c | 139 + .../libmongocrypt/src/unicode/fold.h | 58 + .../test/data/bulkWrite/jsonSchema/cmd.json | 20 - .../data/bulkWrite/unencrypted/payload.json | 4 +- .../data/cleanup/missing-key-id/collinfo.json | 1 + .../test/data/cleanup/no-fields/collinfo.json | 1 + .../test/data/cleanup/success/collinfo.json | 1 + .../test/data/collection-info-no-schema.json | 19 - .../data/compact/anchor-pad/collinfo.json | 2 +- .../encrypted-payload-range-v2.json | 41 +- .../data/compact/missing-key-id/collinfo.json | 4 +- .../test/data/compact/no-fields/collinfo.json | 2 +- .../test/data/compact/no-range/collinfo.json | 2 +- .../no-range/encrypted-field-config-map.json | 47 - .../test/data/compact/success/collinfo.json | 2 +- .../success/encrypted-field-config-map.json | 1 - .../success/encrypted-payload-range-v2.json | 41 +- .../dollardb/omitted/cmd-to-mongocryptd.json | 3 +- .../test/data/dollardb/omitted/collinfo.json | 4 +- .../dollardb/omitted/encrypted-payload.json | 5 +- .../dollardb/omitted/mongocryptd-reply.json | 3 +- .../preserved/cmd-to-mongocryptd.json | 3 +- .../data/dollardb/preserved/collinfo.json | 4 +- .../dollardb/preserved/encrypted-payload.json | 5 +- .../dollardb/preserved/mongocryptd-reply.json | 3 +- .../preserved_empty/cmd-to-mongocryptd.json | 3 +- .../dollardb/preserved_empty/collinfo.json | 4 +- .../preserved_empty/mongocryptd-reply.json | 3 +- .../dollardb/preserved_fle1/collinfo.json | 3 +- .../test/data/efc/efc-extraField.json | 1 - .../test/data/efc/efc-missingKeyId.json | 1 - .../data/efc/efc-oneField-badVersionSet.json | 23 + .../data/efc/efc-oneField-goodVersionSet.json | 23 + .../test/data/efc/efc-oneField.json | 1 - .../efc-textSearchFields-badVersionSet.json | 48 + .../efc-textSearchFields-goodVersionSet.json | 48 + .../test/data/efc/efc-textSearchFields.json | 47 + .../test/data/efc/efc-twoFields.json | 1 - .../test/data/encrypted-field-config-map.json | 4 +- .../FLE1DeterministicEncryptedValue.json | 8 + .../FLE1EncryptionPlaceholder.json | 8 + .../FLE1RandomEncryptedValue.json | 8 + .../FLE2EncryptionPlaceholder.json | 8 + .../FLE2EqualityIndexedValueV2.json | 8 + .../FLE2FindEqualityPayload.json} | 0 .../FLE2FindEqualityPayloadV2.json | 8 + .../FLE2IndexedEqualityEncryptedValue.json | 8 + .../FLE2IndexedEqualityEncryptedValueV2.json | 8 + .../FLE2IndexedRangeEncryptedValue.json | 8 + .../FLE2IndexedRangeEncryptedValueV2.json | 8 + ...FLE2InsertUpdatePayload-with-edges-V2.json | 8 + .../FLE2InsertUpdatePayload-with-edges.json | 8 + .../FLE2InsertUpdatePayload.json} | 2 +- .../FLE2InsertUpdatePayloadV2.json | 8 + .../FLE2RangeIndexedValueV2.json | 8 + .../FLE2UnindexedEncryptedValue.json | 8 + .../FLE2UnindexedEncryptedValueV2.json | 8 + .../data/find-with-encryptionInformation.json | 1 - .../test/data/fle1-collMod/insert/cmd.json | 8 - .../data/fle1-collMod/insert/collinfo.json | 9 - .../fle1-explain/with-csfle/collinfo.json | 3 +- .../with-mongocryptd/collinfo.json | 3 +- .../bad-collinfo.json | 26 + .../bad-create-cmd-mongocryptd-reply.json | 51 + .../bad-create-cmd-to-mongocryptd.json | 45 + .../bad-create-cmd.json | 18 + .../bad-encrypted-field-config-map.json} | 19 +- .../encrypted-payload.json | 8 +- .../cmd-to-mongocryptd.json | 45 + .../mongocryptd-reply.json | 51 + .../cmd-to-mongocryptd.json | 46 + .../cmd.json | 18 + .../encrypted-field-config-map.json | 25 + .../encrypted-payload.json | 18 + .../mongocryptd-reply.json | 52 + .../cmd-to-mongocryptd.json | 44 + .../fle2-create-encrypted-collection/cmd.json | 17 + .../encrypted-field-config-map.json} | 17 +- .../encrypted-payload.json | 17 + .../mongocryptd-reply.json | 50 + .../data/fle2-create/cmd-to-mongocryptd.json | 3 +- .../encrypted-field-config-map.json | 3 +- .../fle2-create/ismaster-to-mongocryptd.json | 3 - .../test/data/fle2-delete/empty/collinfo.json | 2 +- .../empty/encrypted-field-config-map.json | 1 - .../empty/encrypted-payload-v2.json | 116 +- .../fle2-delete/empty/encrypted-payload.json | 91 - .../fle2-delete/empty/mongocryptd-reply.json | 127 +- .../data/fle2-delete/success/collinfo.json | 2 +- .../success/encrypted-field-config-map.json | 1 - .../success/encrypted-payload-v2.json | 130 +- .../success/encrypted-payload.json | 98 - .../success/mongocryptd-reply.json | 139 +- .../fle2-explain/with-csfle/collinfo.json | 2 +- .../with-csfle/encrypted-payload.json | 3 +- .../with-mongocryptd/cmd-to-mongocryptd.json | 3 +- .../with-mongocryptd/collinfo.json | 4 +- .../with-mongocryptd/encrypted-payload.json | 5 +- .../with-mongocryptd/mongocryptd-reply.json | 3 +- .../find-indexed-contentionFactor1.json | 8 - .../insert-indexed-contentionFactor1.json | 8 - ...nsert-indexed-same-user-and-index-key.json | 8 - .../test/data/fle2-find-equality/cmd.json | 6 - .../fle2-find-equality/encrypted-payload.json | 41 - .../fle2-find-equality/mongocryptd-reply.json | 19 - .../cmd-to-mongocryptd.json | 1 - .../fle2-find-explicit/cmd-to-mongod.json | 1 - .../reply-from-mongocryptd.json | 1 - .../double-precision/encrypted-payload.json | 26 - .../double/encrypted-payload.json | 26 - .../int32-nominmax/encrypted-payload-v2.json | 26 - .../int32-openinterval/encrypted-payload.json | 16 - .../int32/encrypted-payload.json | 26 - .../test/data/fle2-find-range/date/cmd.json | 10 - .../date/encrypted-payload.json | 42 - .../date/mongocryptd-reply.json | 50 - .../decimal128-precision/cmd.json | 6 - .../encrypted-field-map.json | 31 - .../encrypted-payload.json | 51 - .../mongocryptd-reply.json | 59 - .../data/fle2-find-range/decimal128/cmd.json | 6 - .../decimal128/encrypted-field-map.json | 28 - .../decimal128/encrypted-payload.json | 42 - .../decimal128/mongocryptd-reply.json | 50 - .../fle2-find-range/double-precision/cmd.json | 8 - .../double-precision/encrypted-field-map.json | 31 - .../double-precision/encrypted-payload.json | 45 - .../double-precision/mongocryptd-reply.json | 53 - .../test/data/fle2-find-range/double/cmd.json | 8 - .../double/encrypted-payload.json | 42 - .../double/mongocryptd-reply.json | 50 - .../test/data/fle2-find-range/int32/cmd.json | 8 - .../int32/encrypted-payload.json | 42 - .../int32/mongocryptd-reply.json | 50 - .../test/data/fle2-find-range/int64/cmd.json | 8 - .../int64/encrypted-field-map.json | 28 - .../int64/encrypted-payload.json | 42 - .../int64/mongocryptd-reply.json | 50 - .../double-precision/encrypted-payload.json | 8 - .../double/encrypted-payload.json | 8 - .../int32-nominmax/encrypted-payload-v2.json | 8 - .../sparsity-2/encrypted-payload.json | 8 - .../test/data/fle2-insert-range/date/cmd.json | 13 - .../date/encrypted-field-map.json | 28 - .../date/encrypted-payload.json | 45 - .../date/mongocryptd-reply.json | 53 - .../decimal128-precision/cmd.json | 9 - .../encrypted-field-map.json | 31 - .../encrypted-payload.json | 54 - .../mongocryptd-reply.json | 62 - .../fle2-insert-range/decimal128/cmd.json | 9 - .../decimal128/encrypted-field-map.json | 28 - .../decimal128/encrypted-payload.json | 45 - .../decimal128/mongocryptd-reply.json | 53 - .../double-precision/cmd.json | 11 - .../double-precision/encrypted-field-map.json | 31 - .../double-precision/encrypted-payload.json | 48 - .../double-precision/mongocryptd-reply.json | 56 - .../data/fle2-insert-range/double/cmd.json | 11 - .../double/encrypted-field-map.json | 28 - .../double/encrypted-payload.json | 45 - .../double/mongocryptd-reply.json | 53 - .../int32/encrypted-field-map.json | 1 - .../int32/encrypted-payload.json | 45 - .../int32/mongocryptd-reply.json | 53 - .../data/fle2-insert-range/int64/cmd.json | 11 - .../int64/encrypted-field-map.json | 28 - .../int64/encrypted-payload.json | 45 - .../int64/mongocryptd-reply.json | 53 - .../cmd.json | 0 .../encrypted-field-map.json | 22 +- .../encrypted-payload.json | 47 + .../mongocryptd-reply.json | 55 + .../data/fle2-insert-text-search/cmd.json | 9 + .../encrypted-field-map.json | 19 +- .../encrypted-payload.json | 47 + .../mongocryptd-reply.json | 55 + .../test/data/fle2-insert-unindexed/cmd.json | 9 - .../encrypted-payload.json | 14 - .../mongocryptd-reply.json | 46 - .../cmd.json | 9 + .../encrypted-field-map.json | 4 +- .../encrypted-payload.json | 40 + .../mongocryptd-reply.json | 4 +- .../cmd-to-mongocryptd.json | 56 + .../cmd.json | 23 + .../encrypted-field-config-map.json | 30 + .../encrypted-payload.json | 23 + .../mongocryptd-reply.json | 62 + .../cmd-to-mongocryptd.json | 55 + .../cmd.json | 22 + .../encrypted-field-config-map.json | 29 + .../encrypted-payload.json | 23 + .../mongocryptd-reply.json | 61 + .../iev-v2/FLECrudTest-insertOneText.json | 20 + .../FLECrudTest-insertOneTextLarge.json | 930 ++++++ .../test/data/lookup/csfle-facet/cmd.json | 20 + .../test/data/lookup/csfle-mismatch/cmd.json | 14 + .../lookup/csfle-mismatch/collInfo-c1.json} | 24 +- .../lookup/csfle-mismatch/collInfo-c3.json | 39 + .../test/data/lookup/csfle-nested/cmd.json | 24 + .../cmd-to-mongocryptd.json | 60 + .../data/lookup/csfle-only-schemaMap/cmd.json | 14 + .../csfle-only-schemaMap/schemaMap.json | 40 + .../csfle-schemaMap/cmd-to-mongocryptd.json | 60 + .../test/data/lookup/csfle-schemaMap/cmd.json | 14 + .../lookup/csfle-schemaMap/collInfo-c1.json | 39 + .../lookup/csfle-schemaMap/schemaMap.json | 21 + .../lookup/csfle-self/cmd-to-mongocryptd.json | 34 + .../test/data/lookup/csfle-self/cmd.json | 14 + .../data/lookup/csfle-self/collInfo-c1.json | 39 + .../csfle-sibling/cmd-to-mongocryptd.json | 49 + .../test/data/lookup/csfle-sibling/cmd.json | 14 + .../lookup/csfle-sibling/collInfo-c1.json | 39 + .../lookup/csfle-sibling/collInfo-c2.json | 29 + .../csfle-sibling/reply-from-mongocryptd.json | 18 + .../test/data/lookup/csfle-unionWith/cmd.json | 21 + .../test/data/lookup/csfle-view/cmd.json | 14 + .../data/lookup/csfle-view/collInfo-c1.json | 39 + .../data/lookup/csfle-view/collInfo-v1.json | 11 + .../data/lookup/csfle/cmd-to-mongocryptd.json | 60 + .../test/data/lookup/csfle/cmd.json | 14 + .../test/data/lookup/csfle/collInfo-c1.json | 39 + .../test/data/lookup/csfle/collInfo-c2.json | 39 + .../mixed/csfle/csfle/cmd-to-mongocryptd.json | 65 + .../mixed/csfle/csfle/cmd-to-mongod.json | 26 + .../data/lookup/mixed/csfle/csfle/cmd.json | 19 + .../lookup/mixed/csfle/csfle/collInfo-c1.json | 39 + .../lookup/mixed/csfle/csfle/collInfo-c2.json | 39 + .../lookup/mixed/csfle/csfle/key-doc.json} | 8 +- .../csfle/csfle/reply-from-mongocryptd.json | 33 + .../csfle/no-schema/cmd-to-mongocryptd.json | 47 + .../mixed/csfle/no-schema/cmd-to-mongod.json | 26 + .../lookup/mixed/csfle/no-schema/cmd.json | 19 + .../mixed/csfle/no-schema/collInfo-c1.json | 39 + .../mixed/csfle/no-schema/collInfo-c2.json | 17 + .../lookup/mixed/csfle/no-schema/key-doc.json | 30 + .../no-schema/reply-from-mongocryptd.json | 33 + .../mixed/csfle/qe/cmd-to-mongocryptd.json | 70 + .../test/data/lookup/mixed/csfle/qe/cmd.json | 19 + .../lookup/mixed/csfle/qe/collInfo-c1.json | 39 + .../lookup/mixed/csfle/qe/collInfo-c2.json | 42 + .../no-schema/csfle/cmd-to-mongocryptd.json | 47 + .../mixed/no-schema/csfle/cmd-to-mongod.json | 26 + .../lookup/mixed/no-schema/csfle/cmd.json | 19 + .../mixed/no-schema/csfle/collInfo-c1.json | 17 + .../mixed/no-schema/csfle/collInfo-c2.json | 39 + .../lookup/mixed/no-schema/csfle/key-doc.json | 30 + .../csfle/reply-from-mongocryptd.json | 33 + .../no-schema/cmd-to-mongocryptd.json | 29 + .../no-schema/no-schema/cmd-to-mongod.json | 19 + .../lookup/mixed/no-schema/no-schema/cmd.json | 19 + .../no-schema/no-schema/collInfo-c1.json | 17 + .../no-schema/no-schema/collInfo-c2.json | 17 + .../no-schema/reply-from-mongocryptd.json | 26 + .../no-schema/qe/cmd-to-mongocryptd.json | 53 + .../mixed/no-schema/qe/cmd-to-mongod.json | 58 + .../data/lookup/mixed/no-schema/qe/cmd.json | 19 + .../mixed/no-schema/qe/collInfo-c1.json | 17 + .../mixed/no-schema/qe/collInfo-c2.json | 42 + .../lookup/mixed/no-schema/qe/key-doc.json | 30 + .../no-schema/qe/reply-from-mongocryptd.json | 65 + .../mixed/qe/csfle/cmd-to-mongocryptd.json | 70 + .../test/data/lookup/mixed/qe/csfle/cmd.json | 19 + .../lookup/mixed/qe/csfle/collInfo-c1.json | 42 + .../lookup/mixed/qe/csfle/collInfo-c2.json | 39 + .../qe/no-schema/cmd-to-mongocryptd.json | 53 + .../mixed/qe/no-schema/cmd-to-mongod.json | 56 + .../data/lookup/mixed/qe/no-schema/cmd.json | 19 + .../mixed/qe/no-schema/collInfo-c1.json | 42 + .../mixed/qe/no-schema/collInfo-c2.json | 17 + .../lookup/mixed/qe/no-schema/key-doc.json | 30 + .../qe/no-schema/reply-from-mongocryptd.json | 63 + .../mixed/qe/qe/cmd-to-mongocryptd.json | 66 + .../lookup/mixed/qe/qe/cmd-to-mongod.json | 71 + .../test/data/lookup/mixed/qe/qe/cmd.json | 19 + .../data/lookup/mixed/qe/qe/collInfo-c1.json | 42 + .../data/lookup/mixed/qe/qe/collInfo-c2.json | 42 + .../test/data/lookup/mixed/qe/qe/key-doc.json | 30 + .../mixed/qe/qe/reply-from-mongocryptd.json | 78 + .../cmd-to-mongocryptd.json | 66 + .../qe-encryptedFieldsMap/cmd-to-mongod.json | 71 + .../lookup/qe-encryptedFieldsMap/cmd.json | 19 + .../qe-encryptedFieldsMap/collInfo-c1.json | 42 + .../encryptedFieldsMap.json} | 13 +- .../lookup/qe-encryptedFieldsMap/key-doc.json | 30 + .../reply-from-mongocryptd.json | 78 + .../lookup/qe-self/cmd-to-mongocryptd.json | 46 + .../data/lookup/qe-self/cmd-to-mongod.json | 53 + .../test/data/lookup/qe-self/cmd.json | 19 + .../test/data/lookup/qe-self/collInfo-c1.json | 42 + .../test/data/lookup/qe-self/key-doc.json | 30 + .../qe-self/reply-from-mongocryptd.json | 58 + .../qe-with-payload/cmd-to-mongocryptd.json | 66 + .../lookup/qe-with-payload/cmd-to-mongod.json | 75 + .../test/data/lookup/qe-with-payload/cmd.json | 19 + .../lookup/qe-with-payload/collInfo-c1.json | 42 + .../lookup/qe-with-payload/collInfo-c2.json | 42 + .../data/lookup/qe-with-payload/key-doc.json | 30 + .../reply-from-mongocryptd.json | 78 + .../data/lookup/qe/cmd-to-mongocryptd.json | 61 + .../test/data/lookup/qe/cmd-to-mongod.json | 14 + .../test/data/lookup/qe/cmd.json | 14 + .../test/data/lookup/qe/collInfo-c1.json | 42 + .../test/data/lookup/qe/collInfo-c2.json | 42 + .../lookup/qe/reply-from-mongocryptd.json | 68 + ...ster.json => mongocryptd-ismaster-17.json} | 2 +- .../test/data/mongocryptd-ismaster-26.json | 12 + .../collinfo-encryptedFields.json | 42 + .../collinfo-encryptedFields2.json | 42 + .../schema-broker/collinfo-jsonSchema.json | 43 + .../data/schema-broker/collinfo-noSchema.json | 21 + .../schema-broker/create-with-jsonSchema.json | 24 + .../data/schema-broker/encryptedFields.json | 20 + .../data/schema-broker/encryptedFields2.json | 20 + .../schema-broker/encryptedFieldsMap.json | 42 + .../test/data/schema-broker/jsonSchema.json | 19 + .../test/data/schema-broker/jsonSchema2.json | 19 + .../test/data/schema-broker/schemaMap.json | 40 + .../libmongocrypt/test/data/schema.json | 19 - .../libmongocrypt/test/data/tokens/mc.json | 30 +- .../test/data/tokens/server.json | 30 +- .../libmongocrypt/test/test-mc-efc.c | 70 + .../test-mc-fle2-encryption-placeholder.c | 468 +++ .../test-mc-fle2-find-equality-payload-v2.c | 21 +- .../test/test-mc-fle2-payload-iev-v2.c | 310 +- .../test/test-mc-fle2-payload-iev.c | 2 +- .../test/test-mc-fle2-payload-iup-v2.c | 24 +- .../test/test-mc-fle2-payload-iup.c | 25 +- .../test/test-mc-fle2-payload-uev.c | 4 +- .../libmongocrypt/test/test-mc-fle2-rfds.c | 4 +- ...mc-fle2-tag-and-encrypted-metadata-block.c | 37 +- .../test/test-mc-range-edge-generation.c | 13 +- .../test/test-mc-range-encoding.c | 65 +- .../test/test-mc-range-mincover.c | 124 +- .../libmongocrypt/test/test-mc-rangeopts.c | 4 +- .../test/test-mc-schema-broker.c | 1124 +++++++ .../test/test-mc-text-search-str-encode.c | 1207 +++++++ .../libmongocrypt/test/test-mc-tokens.c | 181 +- .../test/test-mongocrypt-assert-match-bson.c | 27 +- .../test/test-mongocrypt-assert.h | 25 +- .../test/test-mongocrypt-buffer.c | 25 + .../test/test-mongocrypt-cache.c | 5 +- .../test/test-mongocrypt-crypto-hooks.c | 2 +- .../test/test-mongocrypt-crypto.c | 44 +- .../test/test-mongocrypt-csfle-lib.c | 21 + .../test/test-mongocrypt-ctx-decrypt.c | 372 ++- .../test/test-mongocrypt-ctx-encrypt.c | 2530 ++++++++------- .../libmongocrypt/test/test-mongocrypt-kek.c | 2 +- .../test/test-mongocrypt-key-cache.c | 12 +- .../test/test-mongocrypt-kms-responses.c | 4 +- .../test/test-mongocrypt-marking.c | 850 ++++- .../libmongocrypt/test/test-mongocrypt.c | 152 +- .../libmongocrypt/test/test-mongocrypt.h | 31 +- .../libmongocrypt/test/test-unicode-fold.c | 97 + lib/libmongocrypt_helper/version.rb | 4 +- sbom.json | 16 +- 515 files changed, 23085 insertions(+), 12654 deletions(-) delete mode 100755 ext/libmongocrypt/libmongocrypt/.evergreen/benchmark-java.sh create mode 100755 ext/libmongocrypt/libmongocrypt/.evergreen/sbom.sh create mode 100644 ext/libmongocrypt/libmongocrypt/.github/workflows/codeql-actions.yml rename ext/libmongocrypt/libmongocrypt/.github/workflows/{codeql.yml => codeql-python.yml} (88%) create mode 100644 ext/libmongocrypt/libmongocrypt/.github/workflows/zizmor.yml create mode 100644 ext/libmongocrypt/libmongocrypt/CONTRIBUTING.md delete mode 100755 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/.evergreen/publish.sh delete mode 100755 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/.evergreen/test.sh delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/.gitignore delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/README.md delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/benchmarks/build.gradle.kts delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/benchmarks/src/main/java/com/mongodb/crypt/benchmark/BenchmarkRunner.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/benchmarks/src/main/resources/keyDocument.json delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/build.gradle.kts delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/gradle/wrapper/gradle-wrapper.jar delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/gradle/wrapper/gradle-wrapper.properties delete mode 100755 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/gradlew delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/gradlew.bat delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/settings.gradle.kts delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/BinaryHolder.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/CAPI.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/CAPIHelper.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/CipherCallback.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/DisposableMemory.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/JULLogger.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/Logger.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/Loggers.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MacCallback.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MessageDigestCallback.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoAwsKmsProviderOptions.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCrypt.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptContext.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptContextImpl.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptException.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptImpl.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptOptions.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCrypts.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoDataKeyOptions.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoExplicitEncryptOptions.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoKeyDecryptor.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoKeyDecryptorImpl.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoLocalKmsProviderOptions.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoRewrapManyDataKeyOptions.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/SLF4JLogger.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/SecureRandomCallback.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/SigningRSAESPKCSCallback.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/package-info.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/resources/META-INF/native-image/jni-config.json delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/resources/META-INF/native-image/reflect-config.json delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/java/com/mongodb/crypt/capi/MongoCryptTest.java delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/command-reply.json delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/command.json delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/encrypted-command-reply.json delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/encrypted-command.json delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/encrypted-value.json delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/fle2-find-range-explicit-v2/int32/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/fle2-find-range-explicit-v2/int32/key-filter.json delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/fle2-find-range-explicit-v2/int32/rangeopts.json delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/fle2-find-range-explicit-v2/int32/value-to-encrypt.json delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/json-schema.json delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/key-document.json delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/key-filter-keyAltName.json delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/key-filter.json delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/kms-reply.txt delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/list-collections-filter.json delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/mongocryptd-command.json delete mode 100644 ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/mongocryptd-reply.json create mode 100644 ext/libmongocrypt/libmongocrypt/etc/libbson-remove-GCC-diagnostic-in-functions.patch create mode 100644 ext/libmongocrypt/libmongocrypt/src/mc-schema-broker-private.h create mode 100644 ext/libmongocrypt/libmongocrypt/src/mc-schema-broker.c create mode 100644 ext/libmongocrypt/libmongocrypt/src/mc-str-encode-string-sets-private.h create mode 100644 ext/libmongocrypt/libmongocrypt/src/mc-str-encode-string-sets.c create mode 100644 ext/libmongocrypt/libmongocrypt/src/mc-text-search-str-encode-private.h create mode 100644 ext/libmongocrypt/libmongocrypt/src/mc-text-search-str-encode.c create mode 100644 ext/libmongocrypt/libmongocrypt/src/unicode/case-fold-map.c create mode 100644 ext/libmongocrypt/libmongocrypt/src/unicode/diacritic-fold-map.c create mode 100644 ext/libmongocrypt/libmongocrypt/src/unicode/fold.c create mode 100644 ext/libmongocrypt/libmongocrypt/src/unicode/fold.h delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/bulkWrite/jsonSchema/cmd.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/collection-info-no-schema.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/compact/no-range/encrypted-field-config-map.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/efc/efc-oneField-badVersionSet.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/efc/efc-oneField-goodVersionSet.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/efc/efc-textSearchFields-badVersionSet.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/efc/efc-textSearchFields-goodVersionSet.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/efc/efc-textSearchFields.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/explicit-decrypt/FLE1DeterministicEncryptedValue.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/explicit-decrypt/FLE1EncryptionPlaceholder.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/explicit-decrypt/FLE1RandomEncryptedValue.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/explicit-decrypt/FLE2EncryptionPlaceholder.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/explicit-decrypt/FLE2EqualityIndexedValueV2.json rename ext/libmongocrypt/libmongocrypt/test/data/{fle2-explicit/find-indexed.json => explicit-decrypt/FLE2FindEqualityPayload.json} (100%) create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/explicit-decrypt/FLE2FindEqualityPayloadV2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/explicit-decrypt/FLE2IndexedEqualityEncryptedValue.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/explicit-decrypt/FLE2IndexedEqualityEncryptedValueV2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/explicit-decrypt/FLE2IndexedRangeEncryptedValue.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/explicit-decrypt/FLE2IndexedRangeEncryptedValueV2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/explicit-decrypt/FLE2InsertUpdatePayload-with-edges-V2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/explicit-decrypt/FLE2InsertUpdatePayload-with-edges.json rename ext/libmongocrypt/libmongocrypt/test/data/{fle2-explicit/insert-indexed.json => explicit-decrypt/FLE2InsertUpdatePayload.json} (99%) create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/explicit-decrypt/FLE2InsertUpdatePayloadV2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/explicit-decrypt/FLE2RangeIndexedValueV2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/explicit-decrypt/FLE2UnindexedEncryptedValue.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/explicit-decrypt/FLE2UnindexedEncryptedValueV2.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle1-collMod/insert/cmd.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle1-collMod/insert/collinfo.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-bad-str-encode-version/bad-collinfo.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-bad-str-encode-version/bad-create-cmd-mongocryptd-reply.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-bad-str-encode-version/bad-create-cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-bad-str-encode-version/bad-create-cmd.json rename ext/libmongocrypt/libmongocrypt/test/data/{fle2-find-range/int32/encrypted-field-map.json => fle2-bad-str-encode-version/bad-encrypted-field-config-map.json} (52%) rename ext/libmongocrypt/libmongocrypt/test/data/{fle2-insert => fle2-bad-str-encode-version}/encrypted-payload.json (63%) create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-create-encrypted-collection-encrypted-fields-unset-str-encode-version/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-create-encrypted-collection-encrypted-fields-unset-str-encode-version/mongocryptd-reply.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-create-encrypted-collection-with-str-encode-version/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-create-encrypted-collection-with-str-encode-version/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-create-encrypted-collection-with-str-encode-version/encrypted-field-config-map.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-create-encrypted-collection-with-str-encode-version/encrypted-payload.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-create-encrypted-collection-with-str-encode-version/mongocryptd-reply.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-create-encrypted-collection/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-create-encrypted-collection/cmd.json rename ext/libmongocrypt/libmongocrypt/test/data/{fle2-find-equality/encrypted-field-map.json => fle2-create-encrypted-collection/encrypted-field-config-map.json} (57%) create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-create-encrypted-collection/encrypted-payload.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-create-encrypted-collection/mongocryptd-reply.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-create/ismaster-to-mongocryptd.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-delete/empty/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-delete/success/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-explicit/find-indexed-contentionFactor1.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-explicit/insert-indexed-contentionFactor1.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-explicit/insert-indexed-same-user-and-index-key.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-equality/cmd.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-equality/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-equality/mongocryptd-reply.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range-explicit/double-precision/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range-explicit/double/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range-explicit/int32-nominmax/encrypted-payload-v2.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range-explicit/int32-openinterval/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range-explicit/int32/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/date/cmd.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/date/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/date/mongocryptd-reply.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/decimal128-precision/cmd.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/decimal128-precision/encrypted-field-map.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/decimal128-precision/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/decimal128-precision/mongocryptd-reply.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/decimal128/cmd.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/decimal128/encrypted-field-map.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/decimal128/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/decimal128/mongocryptd-reply.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/double-precision/cmd.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/double-precision/encrypted-field-map.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/double-precision/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/double-precision/mongocryptd-reply.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/double/cmd.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/double/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/double/mongocryptd-reply.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/int32/cmd.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/int32/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/int32/mongocryptd-reply.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/int64/cmd.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/int64/encrypted-field-map.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/int64/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-find-range/int64/mongocryptd-reply.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range-explicit/double-precision/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range-explicit/double/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range-explicit/int32-nominmax/encrypted-payload-v2.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range-explicit/sparsity-2/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/date/cmd.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/date/encrypted-field-map.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/date/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/date/mongocryptd-reply.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/decimal128-precision/cmd.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/decimal128-precision/encrypted-field-map.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/decimal128-precision/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/decimal128-precision/mongocryptd-reply.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/decimal128/cmd.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/decimal128/encrypted-field-map.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/decimal128/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/decimal128/mongocryptd-reply.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/double-precision/cmd.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/double-precision/encrypted-field-map.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/double-precision/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/double-precision/mongocryptd-reply.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/double/cmd.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/double/encrypted-field-map.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/double/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/double/mongocryptd-reply.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/int32/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/int32/mongocryptd-reply.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/int64/cmd.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/int64/encrypted-field-map.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/int64/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-range/int64/mongocryptd-reply.json rename ext/libmongocrypt/libmongocrypt/test/data/{fle2-insert => fle2-insert-text-search-with-str-encode-version}/cmd.json (100%) rename ext/libmongocrypt/libmongocrypt/test/data/{fle2-find-range/date => fle2-insert-text-search-with-str-encode-version}/encrypted-field-map.json (51%) create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-text-search-with-str-encode-version/encrypted-payload.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-text-search-with-str-encode-version/mongocryptd-reply.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-text-search/cmd.json rename ext/libmongocrypt/libmongocrypt/test/data/{fle2-find-range/double => fle2-insert-text-search}/encrypted-field-map.json (54%) create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-text-search/encrypted-payload.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-text-search/mongocryptd-reply.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-unindexed/cmd.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-unindexed/encrypted-payload.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-unindexed/mongocryptd-reply.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-v2-with-str-encode-version/cmd.json rename ext/libmongocrypt/libmongocrypt/test/data/{fle2-insert => fle2-insert-v2-with-str-encode-version}/encrypted-field-map.json (91%) create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-insert-v2-with-str-encode-version/encrypted-payload.json rename ext/libmongocrypt/libmongocrypt/test/data/{fle2-insert => fle2-insert-v2-with-str-encode-version}/mongocryptd-reply.json (95%) create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-text-search-create-encrypted-collection-with-str-encode-version/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-text-search-create-encrypted-collection-with-str-encode-version/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-text-search-create-encrypted-collection-with-str-encode-version/encrypted-field-config-map.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-text-search-create-encrypted-collection-with-str-encode-version/encrypted-payload.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-text-search-create-encrypted-collection-with-str-encode-version/mongocryptd-reply.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-text-search-create-encrypted-collection/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-text-search-create-encrypted-collection/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-text-search-create-encrypted-collection/encrypted-field-config-map.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-text-search-create-encrypted-collection/encrypted-payload.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/fle2-text-search-create-encrypted-collection/mongocryptd-reply.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/iev-v2/FLECrudTest-insertOneText.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/iev-v2/FLECrudTest-insertOneTextLarge.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-facet/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-mismatch/cmd.json rename ext/libmongocrypt/libmongocrypt/{bindings/java/mongocrypt/src/test/resources/collection-info.json => test/data/lookup/csfle-mismatch/collInfo-c1.json} (50%) create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-mismatch/collInfo-c3.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-nested/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-only-schemaMap/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-only-schemaMap/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-only-schemaMap/schemaMap.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-schemaMap/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-schemaMap/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-schemaMap/collInfo-c1.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-schemaMap/schemaMap.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-self/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-self/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-self/collInfo-c1.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-sibling/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-sibling/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-sibling/collInfo-c1.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-sibling/collInfo-c2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-sibling/reply-from-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-unionWith/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-view/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-view/collInfo-c1.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle-view/collInfo-v1.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle/collInfo-c1.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/csfle/collInfo-c2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/csfle/csfle/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/csfle/csfle/cmd-to-mongod.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/csfle/csfle/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/csfle/csfle/collInfo-c1.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/csfle/csfle/collInfo-c2.json rename ext/libmongocrypt/libmongocrypt/{bindings/java/mongocrypt/src/test/resources/keys/ABCDEFAB123498761234123456789012-local-document.json => test/data/lookup/mixed/csfle/csfle/key-doc.json} (50%) create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/csfle/csfle/reply-from-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/csfle/no-schema/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/csfle/no-schema/cmd-to-mongod.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/csfle/no-schema/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/csfle/no-schema/collInfo-c1.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/csfle/no-schema/collInfo-c2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/csfle/no-schema/key-doc.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/csfle/no-schema/reply-from-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/csfle/qe/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/csfle/qe/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/csfle/qe/collInfo-c1.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/csfle/qe/collInfo-c2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/no-schema/csfle/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/no-schema/csfle/cmd-to-mongod.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/no-schema/csfle/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/no-schema/csfle/collInfo-c1.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/no-schema/csfle/collInfo-c2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/no-schema/csfle/key-doc.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/no-schema/csfle/reply-from-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/no-schema/no-schema/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/no-schema/no-schema/cmd-to-mongod.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/no-schema/no-schema/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/no-schema/no-schema/collInfo-c1.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/no-schema/no-schema/collInfo-c2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/no-schema/no-schema/reply-from-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/no-schema/qe/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/no-schema/qe/cmd-to-mongod.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/no-schema/qe/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/no-schema/qe/collInfo-c1.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/no-schema/qe/collInfo-c2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/no-schema/qe/key-doc.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/no-schema/qe/reply-from-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/qe/csfle/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/qe/csfle/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/qe/csfle/collInfo-c1.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/qe/csfle/collInfo-c2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/qe/no-schema/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/qe/no-schema/cmd-to-mongod.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/qe/no-schema/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/qe/no-schema/collInfo-c1.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/qe/no-schema/collInfo-c2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/qe/no-schema/key-doc.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/qe/no-schema/reply-from-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/qe/qe/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/qe/qe/cmd-to-mongod.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/qe/qe/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/qe/qe/collInfo-c1.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/qe/qe/collInfo-c2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/qe/qe/key-doc.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/mixed/qe/qe/reply-from-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe-encryptedFieldsMap/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe-encryptedFieldsMap/cmd-to-mongod.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe-encryptedFieldsMap/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe-encryptedFieldsMap/collInfo-c1.json rename ext/libmongocrypt/libmongocrypt/test/data/{fle2-insert-unindexed/encrypted-field-map.json => lookup/qe-encryptedFieldsMap/encryptedFieldsMap.json} (60%) create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe-encryptedFieldsMap/key-doc.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe-encryptedFieldsMap/reply-from-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe-self/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe-self/cmd-to-mongod.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe-self/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe-self/collInfo-c1.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe-self/key-doc.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe-self/reply-from-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe-with-payload/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe-with-payload/cmd-to-mongod.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe-with-payload/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe-with-payload/collInfo-c1.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe-with-payload/collInfo-c2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe-with-payload/key-doc.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe-with-payload/reply-from-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe/cmd-to-mongocryptd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe/cmd-to-mongod.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe/cmd.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe/collInfo-c1.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe/collInfo-c2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/lookup/qe/reply-from-mongocryptd.json rename ext/libmongocrypt/libmongocrypt/test/data/{fle2-create/mongocryptd-ismaster.json => mongocryptd-ismaster-17.json} (99%) create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/mongocryptd-ismaster-26.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/schema-broker/collinfo-encryptedFields.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/schema-broker/collinfo-encryptedFields2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/schema-broker/collinfo-jsonSchema.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/schema-broker/collinfo-noSchema.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/schema-broker/create-with-jsonSchema.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/schema-broker/encryptedFields.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/schema-broker/encryptedFields2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/schema-broker/encryptedFieldsMap.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/schema-broker/jsonSchema.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/schema-broker/jsonSchema2.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/data/schema-broker/schemaMap.json delete mode 100644 ext/libmongocrypt/libmongocrypt/test/data/schema.json create mode 100644 ext/libmongocrypt/libmongocrypt/test/test-mc-fle2-encryption-placeholder.c create mode 100644 ext/libmongocrypt/libmongocrypt/test/test-mc-schema-broker.c create mode 100644 ext/libmongocrypt/libmongocrypt/test/test-mc-text-search-str-encode.c create mode 100644 ext/libmongocrypt/libmongocrypt/test/test-unicode-fold.c diff --git a/ext/libmongocrypt/libmongocrypt/.evergreen/benchmark-java.sh b/ext/libmongocrypt/libmongocrypt/.evergreen/benchmark-java.sh deleted file mode 100755 index 5c1ea0f..0000000 --- a/ext/libmongocrypt/libmongocrypt/.evergreen/benchmark-java.sh +++ /dev/null @@ -1,26 +0,0 @@ -#!/usr/bin/env bash - -. "$(dirname "${BASH_SOURCE[0]}")/init.sh" - -if test "$OS_NAME" != "linux"; then - log "Warning: Script is expected only to run on distro: rhel90-dbx-perf-large" - log "More changes may be needed to run on other distros."; -fi - -MONGOCRYPT_INSTALL_PREFIX=$LIBMONGOCRYPT_DIR/.install - -# Install libmongocrypt. -build_dir="$LIBMONGOCRYPT_DIR/cmake-build" -run_cmake \ - -DCMAKE_INSTALL_PREFIX="$MONGOCRYPT_INSTALL_PREFIX" \ - -DCMAKE_BUILD_TYPE="RelWithDebInfo" \ - -B"$build_dir" -run_cmake --build "$build_dir" --target install - -# Run Java benchmarks. Do not use JDK 8 to avoid hang in gradle observed in MONGOCRYPT-590. -export JAVA_HOME=/opt/java/jdk17 -# Include path to installed libmongocrypt.so -export LD_LIBRARY_PATH="$MONGOCRYPT_INSTALL_PREFIX/lib64" -cd bindings/java/mongocrypt -./gradlew --version -./gradlew clean benchmarks:run --info diff --git a/ext/libmongocrypt/libmongocrypt/.evergreen/config.yml b/ext/libmongocrypt/libmongocrypt/.evergreen/config.yml index f48216a..d228ae9 100755 --- a/ext/libmongocrypt/libmongocrypt/.evergreen/config.yml +++ b/ext/libmongocrypt/libmongocrypt/.evergreen/config.yml @@ -14,6 +14,40 @@ functions: rm -rf ~/.aws ~/.notary_env.sh exit 0 + "fetch drivers-evergreen-tools": + - command: subprocess.exec + type: setup + params: + binary: bash + args: + - -c + - | + if [[ ! -d drivers-evergreen-tools ]]; then + git clone --depth=1 https://github.com/mongodb-labs/drivers-evergreen-tools.git + fi + - command: subprocess.exec + type: setup + params: + binary: bash + working_dir: drivers-evergreen-tools + args: + - -c + - find .evergreen -type f -name "*.sh" -exec chmod +rx "{}" \; + - command: subprocess.exec + type: setup + params: + binary: bash + args: + - -c + - | + set -o errexit + . drivers-evergreen-tools/.evergreen/find-python3.sh + echo "PYTHON3_BINARY: $(find_python3)" >|python3_binary.yml + - command: expansions.update + type: setup + params: + file: python3_binary.yml + "fetch source": - command: git.get_project params: {directory: libmongocrypt} @@ -89,7 +123,7 @@ functions: shell: bash script: | env "WORKDIR=${workdir}" \ - "PYTHON=${python|}" \ + "PYTHON=${PYTHON3_BINARY|}" \ "HAS_PACKAGES=${has_packages|false}" \ "PACKAGER_DISTRO=${packager_distro}" \ "PACKAGER_ARCH=${packager_arch}" \ @@ -122,13 +156,6 @@ functions: bash libmongocrypt/.evergreen/build_all.sh ./libmongocrypt/.evergreen/clang-tidy.sh - "test java": - - command: "shell.exec" - params: - script: |- - export GIT_REVISION="${revision}" - cd ./libmongocrypt/bindings/java/mongocrypt && ${test_env|} ./.evergreen/test.sh - "test python": - command: "shell.exec" params: @@ -188,32 +215,6 @@ functions: params: file: ${PYMONGO_DIR}/xunit-results/TEST-*.xml - "publish java": - - command: git.get_project - params: {directory: libmongocrypt} - - command: shell.exec - params: - script: |- - set -o errexit - chmod u+x libmongocrypt/.evergreen/*.sh - ./libmongocrypt/.evergreen/print-env-info.sh - - command: shell.exec - params: - include_expansions_in_env: - - nexus_username - - nexus_password - - signing_password - - signing_keyId - - ring_file_gpg_base64 - - script: |- - if [ "${is_patch}" = "true" ]; then - echo "Patch build detected, skipping" - exit 0 - fi - export PROJECT_DIRECTORY=${project_directory} - cd ./libmongocrypt/bindings/java/mongocrypt && ${test_env|} ./.evergreen/publish.sh - "download tarball": - command: s3.get params: @@ -379,7 +380,62 @@ functions: params: shell: bash working_dir: ${working_dir|libmongocrypt} - script: bash ${workdir}/libmongocrypt/.evergreen/earthly.sh ${args} + script: | + # Authenticate to artifactory. + echo "${artifactory_password}" | docker login --password-stdin --username "${artifactory_username}" artifactory.corp.mongodb.com + # TODO(MONGOCRYPT-747): remove `--persist-build=false`. + # Pass `--persist-build=false` to avoid using Docker Hub. + # Earthly hardcodes use of docker/dockerfile-copy:v0.1.9 for the CACHE command. + bash ${workdir}/libmongocrypt/.evergreen/earthly.sh ${args} --persist-build=false + + sbom: + - command: ec2.assume_role + type: setup + params: + role_arn: ${kondukto_role_arn} + - command: subprocess.exec + type: setup + params: + binary: bash + include_expansions_in_env: + - AWS_ACCESS_KEY_ID + - AWS_SECRET_ACCESS_KEY + - AWS_SESSION_TOKEN + args: + - -c + - | + set -o errexit + set -o pipefail + kondukto_token="$(aws secretsmanager get-secret-value --secret-id "kondukto-token" --region "us-east-1" --query 'SecretString' --output text)" + printf "KONDUKTO_TOKEN: %s\n" "$kondukto_token" >|expansions.kondukto.yml + - command: expansions.update + type: setup + params: + file: expansions.kondukto.yml + - command: subprocess.exec + type: test + params: + binary: bash + working_dir: libmongocrypt + include_expansions_in_env: + - artifactory_password + - artifactory_username + - branch_name + - KONDUKTO_TOKEN + args: + - -c + - .evergreen/sbom.sh + - command: s3.put + type: test + params: + display_name: Augmented SBOM + aws_key: ${aws_key} + aws_secret: ${aws_secret} + bucket: mciuploads + content_type: application/json + local_file: libmongocrypt/cyclonedx.augmented.sbom.json + permissions: public-read + remote_file: ${project}/${build_variant}/${branch_name}/${libmongocrypt_s3_suffix}/sbom/cyclonedx.augmented.sbom.json tasks: - name: build-and-test-and-upload @@ -387,6 +443,7 @@ tasks: - func: "fetch source" - func: "build and test" - func: "tar and upload libmongocrypt libraries" + - func: "fetch drivers-evergreen-tools" # Set PYTHON3_BINARY. - func: "create packages and repos" - func: "upload packages and repos" @@ -430,10 +487,10 @@ tasks: - func: "fetch source" - func: "build and test" vars: + # Add detect_odr_violation=0 to ASAN_OPTIONS to ignore odr-violation in IntelDFP symbol: __dpml_bid_globals_table compile_env: >- ${compile_env|} LIBMONGOCRYPT_EXTRA_CFLAGS="-fsanitize=address -pthread" - # Add detect_odr_violation=0 to ASAN_OPTIONS to ignore odr-violation in IntelDFP symbol: __dpml_bid_globals_table ASAN_OPTIONS="detect_leaks=1 detect_odr_violation=0" - name: build-and-test-ubsan @@ -451,25 +508,10 @@ tasks: commands: - func: "fetch source" - func: "build and test" + # Exclude leak detection. clang on macos-11-amd64 reports: "detect_leaks is not supported on this platform" vars: compile_env: ${compile_env|} LIBMONGOCRYPT_EXTRA_CFLAGS="-fsanitize=address" -- name: build-and-test-asan-s390x - commands: - - func: "fetch source" - - func: "build and test" - vars: - compile_env: ${compile_env|} LIBMONGOCRYPT_EXTRA_CFLAGS="-fsanitize=address" - -- name: test-java - depends_on: - - variant: ubuntu2004-64 - name: upload-java - commands: - - func: "fetch source" - - func: "test java" - vars: { variant_name: "${build_variant}" } - - name: test-python depends_on: - build-and-test-and-upload @@ -540,13 +582,6 @@ tasks: commands: - func: "download and merge python releases" -- name: publish-java - depends_on: - - variant: ubuntu2004-64 - name: upload-java - commands: - - func: "publish java" - - name: upload-java depends_on: - variant: rhel-62-64-bit @@ -773,6 +808,15 @@ tasks: # the "fetch source" step detected a release tag on HEAD, so we # prepare a local file for upload to a location based on the tag cp -a libmongocrypt-all.tar.gz libmongocrypt-all-${tag_upload_location}.tar.gz + + if [[ "$tag_upload_location" = *-* ]]; then + # Unstable release, like 1.1.0-beta1 or 1.0.1-rc0. + mkdir unstable + cp -a libmongocrypt-all.tar.gz unstable/libmongocrypt-all-${tag_upload_location}.tar.gz + else + mkdir stable + cp -a libmongocrypt-all.tar.gz stable/libmongocrypt-all-${tag_upload_location}.tar.gz + fi fi - command: s3.put params: @@ -799,10 +843,32 @@ tasks: remote_file: 'libmongocrypt/all/${tag_upload_location}/libmongocrypt-all.tar.gz' bucket: mciuploads permissions: public-read - optional: true + optional: true # Do not fail task if `local_file` does not exist. `local_file` only exists for tagged release. display_name: 'libmongocrypt-all-${tag_upload_location}.tar.gz' local_file: 'libmongocrypt-all-${tag_upload_location}.tar.gz' content_type: '${content_type|application/x-gzip}' + - command: s3.put + params: + aws_key: '${aws_key}' + aws_secret: '${aws_secret}' + remote_file: 'libmongocrypt/all/latest/stable/libmongocrypt-all.tar.gz' + bucket: mciuploads + permissions: public-read + optional: true # Do not fail task if `local_file` does not exist. `local_file` only exists for stable release. + display_name: 'stable/libmongocrypt-all-${tag_upload_location}.tar.gz' + local_file: 'stable/libmongocrypt-all-${tag_upload_location}.tar.gz' + content_type: '${content_type|application/x-gzip}' + - command: s3.put + params: + aws_key: '${aws_key}' + aws_secret: '${aws_secret}' + remote_file: 'libmongocrypt/all/latest/unstable/libmongocrypt-all.tar.gz' + bucket: mciuploads + permissions: public-read + optional: true # Do not fail task if `local_file` does not exist. `local_file` only exists for unstable release. + display_name: 'unstable/libmongocrypt-all-${tag_upload_location}.tar.gz' + local_file: 'unstable/libmongocrypt-all-${tag_upload_location}.tar.gz' + content_type: '${content_type|application/x-gzip}' - name: publish-packages depends_on: build-and-test-and-upload @@ -975,11 +1041,8 @@ tasks: tags: [packaging] run_on: &docker-distros # * The RHEL76-docker distro runs an old and unsupported version of Docker. - # * (We requires the --mount parameter) - - ubuntu2004-small - - ubuntu2004 - - ubuntu1804 - - ubuntu1804-medium + # * (We require the --mount parameter) + - ubuntu2204-large - debian10 - debian11 - amazon2 @@ -998,19 +1061,6 @@ tasks: vars: args: +check-format -- name: benchmark-java - commands: - - func: "fetch source" - - command: "subprocess.exec" - params: - binary: bash - working_dir: "./libmongocrypt" - args: - - "./.evergreen/benchmark-java.sh" - - command: "perf.send" - params: - file: libmongocrypt/bindings/java/mongocrypt/benchmarks/results.json - - name: benchmark-python commands: - func: "fetch source" @@ -1024,6 +1074,11 @@ tasks: params: file: libmongocrypt/bindings/python/results.json +- name: sbom + commands: + - func: fetch source + - func: sbom + pre: # Update the evergreen expansion to dynamically set the ${libmongocrypt_s3_suffix} and ${libmongocrypt_s3_suffix_copy} expansions. - command: "shell.exec" @@ -1075,18 +1130,16 @@ buildvariants: - build-and-test-and-upload - build-and-test-shared-bson - build-and-test-asan - - test-java - name: publish-packages distros: - ubuntu2004-small - name: macos_x86_64 - display_name: "macOS (x86_64) 10.14" - run_on: macos-1014 + display_name: "macOS (x86_64) 11" + run_on: macos-1100 tasks: - build-and-test-and-upload - build-and-test-shared-bson - build-and-test-asan-mac - - test-java - name: rhel72-zseries-test display_name: "RHEL 7.2 on zSeries" run_on: rhel72-zseries-test @@ -1097,7 +1150,6 @@ buildvariants: tasks: - build-and-test-and-upload - build-and-test-shared-bson - - test-java - name: publish-packages distros: - rhel70-small @@ -1126,7 +1178,6 @@ buildvariants: tasks: - build-and-test-and-upload - build-and-test-shared-bson - - test-java - name: windows-test-python display_name: "Windows Python" run_on: windows-64-vsMulti-small @@ -1148,7 +1199,6 @@ buildvariants: tasks: - build-and-test-and-upload - build-and-test-shared-bson - - test-java - name: publish-packages distros: - rhel70-small @@ -1163,7 +1213,6 @@ buildvariants: - build-and-test-and-upload - build-and-test-shared-bson - build-and-test-asan - - test-java - name: publish-packages distros: - rhel70-small @@ -1216,7 +1265,6 @@ buildvariants: - build-and-test-and-upload - build-and-test-shared-bson - build-and-test-asan - - test-java - name: publish-packages distros: - ubuntu2004-small @@ -1227,7 +1275,6 @@ buildvariants: has_packages: true packager_distro: debian12 packager_arch: x86_64 - python: python3 tasks: - build-and-test-and-upload - name: publish-packages @@ -1244,7 +1291,6 @@ buildvariants: - build-and-test-and-upload - build-and-test-shared-bson - build-and-test-asan - - test-java - name: publish-packages distros: - ubuntu2004-small @@ -1259,7 +1305,6 @@ buildvariants: - build-and-test-and-upload - build-and-test-shared-bson - build-and-test-asan - - test-java - name: publish-packages distros: - ubuntu2004-small @@ -1269,7 +1314,6 @@ buildvariants: tasks: - build-and-test-and-upload - build-and-test-shared-bson - - test-java - name: rhel-70-64-bit display_name: "RHEL 7.0 64-bit" run_on: rhel70-small @@ -1280,7 +1324,6 @@ buildvariants: tasks: - build-and-test-and-upload - build-and-test-shared-bson - - test-java - name: publish-packages distros: - rhel70-small @@ -1294,7 +1337,6 @@ buildvariants: tasks: - build-and-test-and-upload - build-and-test-shared-bson - - test-java - name: publish-packages distros: - rhel70-small @@ -1308,7 +1350,6 @@ buildvariants: tasks: - build-and-test-and-upload - build-and-test-shared-bson - - test-java - test-python - test-python-integ - name: publish-packages @@ -1401,7 +1442,6 @@ buildvariants: - build-and-test-and-upload - build-and-test-shared-bson - build-and-test-asan - - test-java - name: publish-packages distros: - rhel70-small @@ -1416,7 +1456,6 @@ buildvariants: - build-and-test-and-upload - build-and-test-shared-bson - build-and-test-asan - - test-java - name: publish-packages distros: - ubuntu2004-small @@ -1431,7 +1470,6 @@ buildvariants: - build-and-test-and-upload - build-and-test-shared-bson - build-and-test-asan - - test-java - name: publish-packages distros: - ubuntu2004-small @@ -1456,7 +1494,6 @@ buildvariants: - build-and-test-and-upload - build-and-test-shared-bson - build-and-test-asan - - test-java - name: publish-packages distros: - ubuntu2004-small @@ -1472,7 +1509,6 @@ buildvariants: - build-and-test-and-upload - build-and-test-shared-bson - build-and-test-asan - - test-java - upload-java - publish-packages - name: ubuntu2004-arm64 @@ -1503,7 +1539,6 @@ buildvariants: - build-and-test-shared-bson - build-and-test-asan - build-and-test-ubsan - - test-java - upload-java - name: publish-packages distros: @@ -1529,11 +1564,6 @@ buildvariants: tasks: - name: "upload-java" - name: "upload-all" -- name: java-release - display_name: Java Release - run_on: ubuntu2004-small - tasks: - - "publish-java" - name: packaging display_name: "Linux Distro Packaging" tasks: [.packaging] @@ -1548,7 +1578,6 @@ buildvariants: tasks: - build-and-test-and-upload - test-python - - test-java - name: windows-vs2017-32bit # Test Windows 32 bit builds for PHPC. PHPC builds libmongocrypt from source. See MONGOCRYPT-391. display_name: "Windows VS 2017 32-bit compile" @@ -1565,7 +1594,6 @@ buildvariants: # rhel90-dbx-perf-large is the dedicated performance distro referenced in DRIVERS-2666. run_on: rhel90-dbx-perf-large tasks: - - benchmark-java - benchmark-python - name: alpine-amd64-earthly @@ -1643,3 +1671,10 @@ buildvariants: - name: publish-deb-packages-with-earthly # Use a distro suitable for running curator to publish .deb packages. run_on: ubuntu2004-small + +- name: sbom + display_name: SBOM + tasks: + - name: sbom + # Just for high host availability. Not platform-specific. + run_on: rhel80 diff --git a/ext/libmongocrypt/libmongocrypt/.evergreen/create-packages-and-repos.sh b/ext/libmongocrypt/libmongocrypt/.evergreen/create-packages-and-repos.sh index 0e8a709..43fbbcb 100644 --- a/ext/libmongocrypt/libmongocrypt/.evergreen/create-packages-and-repos.sh +++ b/ext/libmongocrypt/libmongocrypt/.evergreen/create-packages-and-repos.sh @@ -22,7 +22,9 @@ if test -d "$WORKDIR/venv"; then fi python=python else - python="${PYTHON:-/opt/mongodbtoolchain/v3/bin/python3}" + # Require PYTHON be set: + : "${PYTHON:?}" + python="${PYTHON}" fi export PYTHONPATH diff --git a/ext/libmongocrypt/libmongocrypt/.evergreen/debian_package_build.sh b/ext/libmongocrypt/libmongocrypt/.evergreen/debian_package_build.sh index fa6d562..85d2321 100644 --- a/ext/libmongocrypt/libmongocrypt/.evergreen/debian_package_build.sh +++ b/ext/libmongocrypt/libmongocrypt/.evergreen/debian_package_build.sh @@ -31,6 +31,7 @@ for arg in "$@"; do done on_exit () { + sudo umount ./unstable-chroot/proc ./unstable-chroot/sys if [ -e ./unstable-chroot/debootstrap/debootstrap.log ]; then echo "Dumping debootstrap.log" cat ./unstable-chroot/debootstrap/debootstrap.log @@ -64,6 +65,8 @@ _dbs_args+=(unstable) git clone https://salsa.debian.org/installer-team/debootstrap.git debootstrap.git export DEBOOTSTRAP_DIR=`pwd`/debootstrap.git sudo -E ./debootstrap.git/debootstrap "${_dbs_args[@]}" ./unstable-chroot/ http://cdn-aws.deb.debian.org/debian +sudo mount sysfs ./unstable-chroot/sys -t sysfs +sudo mount proc ./unstable-chroot/proc -t proc cp -a libmongocrypt ./unstable-chroot/tmp/ sudo chroot ./unstable-chroot /bin/bash -c '(set -o xtrace && \ apt-get install -y build-essential git-buildpackage fakeroot debhelper cmake curl ca-certificates libssl-dev pkg-config libbson-dev libintelrdfpmath-dev python3-packaging && \ diff --git a/ext/libmongocrypt/libmongocrypt/.evergreen/earthly.sh b/ext/libmongocrypt/libmongocrypt/.evergreen/earthly.sh index 3b66e25..a0189a3 100755 --- a/ext/libmongocrypt/libmongocrypt/.evergreen/earthly.sh +++ b/ext/libmongocrypt/libmongocrypt/.evergreen/earthly.sh @@ -48,4 +48,4 @@ fi chmod a+x "$exe_path" -"$exe_path" "$@" +"$exe_path" --buildkit-image "artifactory.corp.mongodb.com/dockerhub/earthly/buildkitd:v${EARTHLY_VERSION}" "$@" diff --git a/ext/libmongocrypt/libmongocrypt/.evergreen/init.sh b/ext/libmongocrypt/libmongocrypt/.evergreen/init.sh index 8642378..5a70946 100644 --- a/ext/libmongocrypt/libmongocrypt/.evergreen/init.sh +++ b/ext/libmongocrypt/libmongocrypt/.evergreen/init.sh @@ -222,6 +222,7 @@ run_ctest() { run_python() { pys=( + "${MONGOCRYPT_PYTHON:-}" py python3.14 python3.13 diff --git a/ext/libmongocrypt/libmongocrypt/.evergreen/linker-tests.sh b/ext/libmongocrypt/libmongocrypt/.evergreen/linker-tests.sh index 222f096..bb0898c 100755 --- a/ext/libmongocrypt/libmongocrypt/.evergreen/linker-tests.sh +++ b/ext/libmongocrypt/libmongocrypt/.evergreen/linker-tests.sh @@ -25,7 +25,7 @@ linker_tests_deps_root="$EVG_DIR/linker_tests_deps" rm -rf -- "$linker_tests_root" mkdir -p "$linker_tests_root"/{install,libmongocrypt-cmake-build,app-cmake-build} -# Make libbson1 +echo "Make libbson1 ..." run_chdir "$linker_tests_root" bash "$EVG_DIR/prep_c_driver_source.sh" MONGOC_DIR="$linker_tests_root/mongo-c-driver" @@ -40,8 +40,11 @@ if [ "${MACOS_UNIVERSAL-}" = "ON" ]; then ADDITIONAL_CMAKE_FLAGS="$ADDITIONAL_CMAKE_FLAGS -DCMAKE_OSX_ARCHITECTURES='arm64;x86_64'" fi +# Disable extra alignment in libbson and libmongocrypt to ensure agreement. +# libmongocrypt disables by default, but may enable if a system install of libbson is detected with extra alignment. common_cmake_args=( $ADDITIONAL_CMAKE_FLAGS + -DENABLE_EXTRA_ALIGNMENT=OFF -DCMAKE_BUILD_TYPE=RelWithDebInfo ) @@ -56,8 +59,9 @@ if is_true USE_NINJA; then fi run_chdir "$MONGOC_DIR" git apply --ignore-whitespace "$linker_tests_deps_root/bson_patches/libbson1.patch" -# Apply patch to fix compile on RHEL 6.2. TODO: try to remove once RHEL 6.2 is dropped (MONGOCRYPT-688). +# Apply patches to fix compile on RHEL 6.2. TODO: try to remove once RHEL 6.2 is dropped (MONGOCRYPT-688). run_chdir "$MONGOC_DIR" git apply "$LIBMONGOCRYPT_DIR/etc/libbson-remove-GCC-diagnostic-pragma.patch" +run_chdir "$MONGOC_DIR" git apply "$LIBMONGOCRYPT_DIR/etc/libbson-remove-GCC-diagnostic-in-functions.patch" BUILD_PATH="$MONGOC_DIR/cmake-build" BSON1_INSTALL_PATH="$linker_tests_root/install/bson1" @@ -69,15 +73,18 @@ run_cmake \ "-H$SRC_PATH" \ "-B$BUILD_PATH" run_cmake --build "$BUILD_PATH" --target install --config RelWithDebInfo +echo "Make libbson1 ... done" -# Prepare libbson2 +echo "Prepare libbson2 ..." run_chdir "$MONGOC_DIR" git reset --hard run_chdir "$MONGOC_DIR" git apply --ignore-whitespace "$linker_tests_deps_root/bson_patches/libbson2.patch" # Apply patch to fix compile on RHEL 6.2. TODO: try to remove once RHEL 6.2 is dropped (MONGOCRYPT-688). run_chdir "$MONGOC_DIR" git apply "$LIBMONGOCRYPT_DIR/etc/libbson-remove-GCC-diagnostic-pragma.patch" +run_chdir "$MONGOC_DIR" git apply "$LIBMONGOCRYPT_DIR/etc/libbson-remove-GCC-diagnostic-in-functions.patch" LIBBSON2_SRC_DIR="$MONGOC_DIR" +echo "Prepare libbson2 ... done" -# Build libmongocrypt, static linking against libbson2 +echo "Build libmongocrypt, static linking against libbson2 ..." BUILD_DIR="$linker_tests_root/libmongocrypt-cmake-build" LMC_INSTALL_PATH="$linker_tests_root/install/libmongocrypt" SRC_PATH="$LIBMONGOCRYPT_DIR" @@ -88,8 +95,9 @@ run_cmake \ "-H$SRC_PATH" \ "-B$BUILD_DIR" run_cmake --build "$BUILD_DIR" --target install --config RelWithDebInfo +echo "Build libmongocrypt, static linking against libbson2 ... done" -echo "Test case: Modelling libmongoc's use" +echo "Test case: Model libmongoc's use ..." # app links against libbson1.so # app links against libmongocrypt.so BUILD_DIR="$linker_tests_root/app-cmake-build" @@ -118,4 +126,5 @@ check_output () { echo "ok" } check_output ".calling bson_malloc0..from libbson1..calling mongocrypt_binary_new..from libbson2." +echo "Test case: Model libmongoc's use ... done" exit 0 diff --git a/ext/libmongocrypt/libmongocrypt/.evergreen/pkgconfig-tests.sh b/ext/libmongocrypt/libmongocrypt/.evergreen/pkgconfig-tests.sh index 9f8d34c..c0b3a3e 100755 --- a/ext/libmongocrypt/libmongocrypt/.evergreen/pkgconfig-tests.sh +++ b/ext/libmongocrypt/libmongocrypt/.evergreen/pkgconfig-tests.sh @@ -25,8 +25,11 @@ if [ "$MACOS_UNIVERSAL" = "ON" ]; then ADDITIONAL_CMAKE_FLAGS="$ADDITIONAL_CMAKE_FLAGS -DCMAKE_OSX_ARCHITECTURES='arm64;x86_64'" fi +# Disable extra alignment in libbson and libmongocrypt to ensure agreement. +# libmongocrypt disables by default, but may enable if a system install of libbson is detected with extra alignment. common_cmake_args=( -DCMAKE_BUILD_TYPE=RelWithDebInfo + -DENABLE_EXTRA_ALIGNMENT=OFF $ADDITIONAL_CMAKE_FLAGS ) @@ -40,6 +43,7 @@ if is_true USE_NINJA; then bash "$EVG_DIR/ensure-ninja.sh" fi +echo "Building libbson ..." libbson_install_dir="$pkgconfig_tests_root/install/libbson" build_dir="$mongoc_src_dir/_build" run_cmake -DENABLE_MONGOC=OFF \ @@ -49,8 +53,9 @@ run_cmake -DENABLE_MONGOC=OFF \ -B"$build_dir" run_cmake --build "$build_dir" --target install --config RelWithDebInfo libbson_pkg_config_path="$(native_path "$(dirname "$(find "$libbson_install_dir" -name libbson-1.0.pc)")")" +echo "Building libbson ... done" -# Build libmongocrypt, static linking against libbson and configured for the PPA +echo "Build libmongocrypt, static linking against libbson and configured for the PPA ..." mongocrypt_install_dir="$pkgconfig_tests_root/install/libmongocrypt" build_dir=$pkgconfig_tests_root/mongocrypt-build run_cmake -DUSE_SHARED_LIBBSON=OFF \ @@ -60,6 +65,7 @@ run_cmake -DUSE_SHARED_LIBBSON=OFF \ -H"$LIBMONGOCRYPT_DIR" \ -B"$build_dir" run_cmake --build "$build_dir" --target install --config RelWithDebInfo +echo "Build libmongocrypt, static linking against libbson and configured for the PPA ... done" # To validate the pkg-config scripts, we don't want the libbson script to be visible mongocrypt_pkg_config_path="$(native_path "$(dirname "$(find "$mongocrypt_install_dir" -name libmongocrypt.pc)")")" @@ -67,25 +73,28 @@ mongocrypt_pkg_config_path="$(native_path "$(dirname "$(find "$mongocrypt_instal export PKG_CONFIG_PATH PKG_CONFIG_PATH="$mongocrypt_pkg_config_path:$libbson_pkg_config_path" -echo "Validating pkg-config scripts" +echo "Validating pkg-config scripts ..." pkg-config --debug --print-errors --exists libmongocrypt-static pkg-config --debug --print-errors --exists libmongocrypt +echo "Validating pkg-config scripts ... done" -# Build example-state-machine, static linking against libmongocrypt +echo "Build example-state-machine, static linking against libmongocrypt ..." gcc $(pkg-config --cflags libmongocrypt-static libbson-static-1.0) \ -o "$pkgconfig_tests_root/example-state-machine" \ "$LIBMONGOCRYPT_DIR/test/example-state-machine.c" \ $(pkg-config --libs libmongocrypt-static) run_chdir "$LIBMONGOCRYPT_DIR" "$pkgconfig_tests_root/example-state-machine" +echo "Build example-state-machine, static linking against libmongocrypt ... done" -# Build example-no-bson, static linking against libmongocrypt +echo "Build example-no-bson, static linking against libmongocrypt ..." gcc $(pkg-config --cflags libmongocrypt-static) \ -o "$pkgconfig_tests_root/example-no-bson" \ "$LIBMONGOCRYPT_DIR/test/example-no-bson.c" \ $(pkg-config --libs libmongocrypt-static) command "$pkgconfig_tests_root/example-no-bson" +echo "Build example-no-bson, static linking against libmongocrypt ... done" -# Build example-state-machine, dynamic linking against libmongocrypt +echo "Build example-state-machine, dynamic linking against libmongocrypt ..." gcc $(pkg-config --cflags libmongocrypt libbson-static-1.0) \ -o "$pkgconfig_tests_root/example-state-machine" \ "$LIBMONGOCRYPT_DIR/test/example-state-machine.c" \ @@ -93,19 +102,21 @@ gcc $(pkg-config --cflags libmongocrypt libbson-static-1.0) \ run_chdir "$LIBMONGOCRYPT_DIR" \ env LD_LIBRARY_PATH="$mongocrypt_install_dir/lib:$mongocrypt_install_dir/lib64" \ "$pkgconfig_tests_root/example-state-machine" +echo "Build example-state-machine, dynamic linking against libmongocrypt ... done" -# Build example-no-bson, dynamic linking against libmongocrypt +echo "Build example-no-bson, dynamic linking against libmongocrypt ..." gcc $(pkg-config --cflags libmongocrypt) \ -o "$pkgconfig_tests_root/example-no-bson" \ "$LIBMONGOCRYPT_DIR/test/example-no-bson.c" \ $(pkg-config --libs libmongocrypt) env LD_LIBRARY_PATH="$mongocrypt_install_dir/lib:$mongocrypt_install_dir/lib64" \ "$pkgconfig_tests_root/example-no-bson" +echo "Build example-no-bson, dynamic linking against libmongocrypt ... done" # Clean up prior to next execution rm -r "$mongocrypt_install_dir" -# Build libmongocrypt, dynamic linking against libbson +echo "Build libmongocrypt, dynamic linking against libbson ..." run_cmake -DUSE_SHARED_LIBBSON=ON \ -DENABLE_BUILD_FOR_PPA=OFF \ "${common_cmake_args[@]}" \ @@ -113,8 +124,9 @@ run_cmake -DUSE_SHARED_LIBBSON=ON \ -H"$LIBMONGOCRYPT_DIR" \ -B"$build_dir" run_cmake --build "$build_dir" --target install --config RelWithDebInfo +echo "Build libmongocrypt, dynamic linking against libbson ... done" -# Build example-state-machine, static linking against libmongocrypt +echo "Build example-state-machine, static linking against libmongocrypt ..." gcc $(pkg-config --cflags libmongocrypt-static libbson-static-1.0) \ -o "$pkgconfig_tests_root/example-state-machine" \ "$LIBMONGOCRYPT_DIR/test/example-state-machine.c" \ @@ -122,16 +134,18 @@ gcc $(pkg-config --cflags libmongocrypt-static libbson-static-1.0) \ run_chdir "$LIBMONGOCRYPT_DIR" \ env LD_LIBRARY_PATH="$libbson_install_dir/lib:/$libbson_install_dir/lib64" \ "$pkgconfig_tests_root/example-state-machine" +echo "Build example-state-machine, static linking against libmongocrypt ..." -# Build example-no-bson, static linking against libmongocrypt +echo "Build example-no-bson, static linking against libmongocrypt ..." gcc $(pkg-config --cflags libmongocrypt-static) \ -o "$pkgconfig_tests_root/example-no-bson" \ "$LIBMONGOCRYPT_DIR/test/example-no-bson.c" \ $(pkg-config --libs libmongocrypt-static) env LD_LIBRARY_PATH="$libbson_install_dir/lib:/$libbson_install_dir/lib64" \ "$pkgconfig_tests_root/example-no-bson" +echo "Build example-no-bson, static linking against libmongocrypt ... done" -# Build example-state-machine, dynamic linking against libmongocrypt +echo "Build example-state-machine, dynamic linking against libmongocrypt ..." gcc $(pkg-config --cflags libmongocrypt libbson-static-1.0) \ -o "$pkgconfig_tests_root/example-state-machine" \ "$LIBMONGOCRYPT_DIR/test/example-state-machine.c" \ @@ -139,13 +153,15 @@ gcc $(pkg-config --cflags libmongocrypt libbson-static-1.0) \ run_chdir "$LIBMONGOCRYPT_DIR" \ env LD_LIBRARY_PATH="$mongocrypt_install_dir/lib:$mongocrypt_install_dir/lib64:$libbson_install_dir/lib:$libbson_install_dir/lib64" \ "$pkgconfig_tests_root/example-state-machine" +echo "Build example-state-machine, dynamic linking against libmongocrypt ... done" -# Build example-no-bson, dynamic linking against libmongocrypt +echo "Build example-no-bson, dynamic linking against libmongocrypt ..." gcc $(pkg-config --cflags libmongocrypt) \ -o "$pkgconfig_tests_root/example-no-bson" \ "$LIBMONGOCRYPT_DIR/test/example-no-bson.c" \ $(pkg-config --libs libmongocrypt) env LD_LIBRARY_PATH="$mongocrypt_install_dir/lib:$mongocrypt_install_dir/lib64:$libbson_install_dir/lib:$libbson_install_dir/lib64" \ "$pkgconfig_tests_root/example-no-bson" +echo "Build example-no-bson, dynamic linking against libmongocrypt ... done" echo "pkg-config tests PASS" diff --git a/ext/libmongocrypt/libmongocrypt/.evergreen/prep_c_driver_source.sh b/ext/libmongocrypt/libmongocrypt/.evergreen/prep_c_driver_source.sh index 5858a01..5e0677d 100755 --- a/ext/libmongocrypt/libmongocrypt/.evergreen/prep_c_driver_source.sh +++ b/ext/libmongocrypt/libmongocrypt/.evergreen/prep_c_driver_source.sh @@ -3,7 +3,7 @@ set -euxo pipefail # Clone mongo-c-driver and check out to a tagged version. -MONGO_C_DRIVER_VERSION=1.28.1 +MONGO_C_DRIVER_VERSION=1.30.3 # Force checkout with lf endings since .sh must have lf, not crlf on Windows git clone https://github.com/mongodb/mongo-c-driver.git --config core.eol=lf --config core.autocrlf=false --depth=1 --branch $MONGO_C_DRIVER_VERSION diff --git a/ext/libmongocrypt/libmongocrypt/.evergreen/sbom.sh b/ext/libmongocrypt/libmongocrypt/.evergreen/sbom.sh new file mode 100755 index 0000000..158c261 --- /dev/null +++ b/ext/libmongocrypt/libmongocrypt/.evergreen/sbom.sh @@ -0,0 +1,45 @@ +#!/usr/bin/env bash + +set -o errexit +set -o pipefail + +: "${artifactory_username:?}" +: "${artifactory_password:?}" +: "${branch_name:?}" +: "${KONDUKTO_TOKEN:?}" + +command -v podman >/dev/null || { + echo "missing required program podman" 1>&2 + exit 1 +} + +podman login --password-stdin --username "${artifactory_username:?}" artifactory.corp.mongodb.com <<<"${artifactory_password:?}" + +silkbomb="artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0" + +# Ensure latest version of SilkBomb is being used. +podman pull "${silkbomb:?}" + +silkbomb_augment_flags=( + --repo mongodb/libmongocrypt + --branch "${branch_name:?}" + --sbom-in /pwd/etc/cyclonedx.sbom.json + --sbom-out /pwd/cyclonedx.augmented.sbom.json + + # Any notable updates to the Augmented SBOM version should be done manually after careful inspection. + # Otherwise, it should be equal to the SBOM Lite version, which should normally be `1`. + --no-update-sbom-version +) + +# First validate the SBOM Lite. +podman run -it --rm -v "$(pwd):/pwd" "${silkbomb:?}" \ + validate --purls /pwd/etc/purls.txt --sbom-in /pwd/etc/cyclonedx.sbom.json --exclude jira + +# Then download the Augmented SBOM. Allow the timestamp to be updated. +podman run -it --rm -v "$(pwd):/pwd" --env 'KONDUKTO_TOKEN' "${silkbomb:?}" \ + augment "${silkbomb_augment_flags[@]:?}" + +[[ -f ./cyclonedx.augmented.sbom.json ]] || { + echo "failed to download Augmented SBOM" 1>&2 + exit 1 +} diff --git a/ext/libmongocrypt/libmongocrypt/.github/workflows/codeql-actions.yml b/ext/libmongocrypt/libmongocrypt/.github/workflows/codeql-actions.yml new file mode 100644 index 0000000..fecb95d --- /dev/null +++ b/ext/libmongocrypt/libmongocrypt/.github/workflows/codeql-actions.yml @@ -0,0 +1,44 @@ +name: "CodeQL GitHub Actions" + +on: + push: + branches: [ "master"] + tags: ['*'] + pull_request: + paths: + - .github/workflows/*.yml + workflow_dispatch: + schedule: + - cron: '17 10 * * 2' + +jobs: + analyze-python: + name: Analyze GitHub Actions + if: github.repository_owner == 'mongodb' || github.event_name == 'workflow_dispatch' + runs-on: "ubuntu-latest" + timeout-minutes: 360 + permissions: + # required for all workflows + security-events: write + # required to fetch internal or private CodeQL packs + packages: read + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + fetch-depth: 0 + persist-credentials: false + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: actions + build-mode: none + # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs + queries: security-extended + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:actions" diff --git a/ext/libmongocrypt/libmongocrypt/.github/workflows/codeql.yml b/ext/libmongocrypt/libmongocrypt/.github/workflows/codeql-python.yml similarity index 88% rename from ext/libmongocrypt/libmongocrypt/.github/workflows/codeql.yml rename to ext/libmongocrypt/libmongocrypt/.github/workflows/codeql-python.yml index 9c7ef77..b8964e2 100644 --- a/ext/libmongocrypt/libmongocrypt/.github/workflows/codeql.yml +++ b/ext/libmongocrypt/libmongocrypt/.github/workflows/codeql-python.yml @@ -1,4 +1,4 @@ -name: "CodeQL" +name: "CodeQL Python" on: push: @@ -11,6 +11,7 @@ on: - .github/workflows/*python.yml schedule: - cron: '17 10 * * 2' + workflow_dispatch: workflow_call: inputs: ref: @@ -20,12 +21,12 @@ on: jobs: analyze-python: name: Analyze Python + if: github.repository_owner == 'mongodb' || (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') runs-on: "macos-latest" timeout-minutes: 360 permissions: # required for all workflows security-events: write - # required to fetch internal or private CodeQL packs packages: read steps: @@ -34,6 +35,7 @@ jobs: with: fetch-depth: 0 ref: ${{ inputs.ref }} + persist-credentials: false - uses: actions/setup-python@v5 with: python-version: 3.x diff --git a/ext/libmongocrypt/libmongocrypt/.github/workflows/dist-python.yml b/ext/libmongocrypt/libmongocrypt/.github/workflows/dist-python.yml index 8cf035e..dd278d4 100644 --- a/ext/libmongocrypt/libmongocrypt/.github/workflows/dist-python.yml +++ b/ext/libmongocrypt/libmongocrypt/.github/workflows/dist-python.yml @@ -15,9 +15,6 @@ on: workflow_dispatch: workflow_call: inputs: - force: - required: true - type: boolean ref: required: true type: string @@ -33,7 +30,7 @@ defaults: jobs: build_dist: - if: github.repository_owner == 'mongodb' || inputs.force == true + if: github.repository_owner == 'mongodb' || (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') runs-on: ${{ matrix.os }} strategy: matrix: @@ -46,6 +43,7 @@ jobs: with: fetch-depth: 0 ref: ${{ inputs.ref }} + persist-credentials: false - uses: actions/setup-python@v5 with: diff --git a/ext/libmongocrypt/libmongocrypt/.github/workflows/release-python.yml b/ext/libmongocrypt/libmongocrypt/.github/workflows/release-python.yml index 5dbd3c7..730500d 100644 --- a/ext/libmongocrypt/libmongocrypt/.github/workflows/release-python.yml +++ b/ext/libmongocrypt/libmongocrypt/.github/workflows/release-python.yml @@ -8,18 +8,23 @@ on: required: true following_version: description: "The post (dev) version to set" - required: true dry_run: description: "Dry Run?" default: false type: boolean + schedule: + - cron: '30 5 * * *' env: # Changes per repo PRODUCT_NAME: PyMongoCrypt - # Changes per branch - SILK_ASSET_GROUP: pymongocrypt EVERGREEN_PROJECT: libmongocrypt + # Constant + # inputs will be empty on a scheduled run. so, we only set dry_run + # to 'false' when the input is set to 'false'. + DRY_RUN: ${{ ! contains(inputs.dry_run, 'false') }} + FOLLOWING_VERSION: ${{ inputs.following_version || '' }} + VERSION: ${{ inputs.version || '10.10.10.10' }} defaults: run: @@ -28,6 +33,7 @@ defaults: jobs: pre-publish: environment: release-python + if: github.repository_owner == 'mongodb' || github.event_name == 'workflow_dispatch' runs-on: ubuntu-latest permissions: id-token: write @@ -48,9 +54,9 @@ jobs: - uses: mongodb-labs/drivers-github-tools/python/pre-publish@v2 id: pre-publish with: - version: ${{ inputs.version }} + version: ${{ env.VERSION }} working_directory: ./bindings/python - dry_run: ${{ inputs.dry_run }} + dry_run: ${{ env.DRY_RUN }} tag_template: "pymongocrypt-${VERSION}" tag_message_template: "Release PyMongoCrypt ${VERSION}" @@ -58,17 +64,39 @@ jobs: needs: [pre-publish] uses: ./.github/workflows/dist-python.yml with: - force: true ref: ${{ needs.pre-publish.outputs.version }} static-scan: needs: [pre-publish] - uses: ./.github/workflows/codeql.yml + uses: ./.github/workflows/codeql-python.yml with: ref: ${{ needs.pre-publish.outputs.version }} publish: needs: [build-dist, static-scan] + name: Upload release to PyPI + runs-on: ubuntu-latest + environment: release-python + permissions: + id-token: write + steps: + - name: Download all the dists + uses: actions/download-artifact@v4 + with: + name: all-dist-${{ github.run_id }} + path: dist/ + - name: Publish package distributions to TestPyPI + uses: pypa/gh-action-pypi-publish@release/v1 + with: + repository-url: https://test.pypi.org/legacy/ + skip-existing: true + attestations: ${{ env.DRY_RUN }} + - name: Publish package distributions to PyPI + if: startsWith(env.DRY_RUN, 'false') + uses: pypa/gh-action-pypi-publish@release/v1 + + post-publish: + needs: [publish] runs-on: ubuntu-latest environment: release-python permissions: @@ -87,14 +115,15 @@ jobs: aws_region_name: ${{ vars.AWS_REGION_NAME }} aws_secret_id: ${{ secrets.AWS_SECRET_ID }} artifactory_username: ${{ vars.ARTIFACTORY_USERNAME }} - - uses: mongodb-labs/drivers-github-tools/python/publish@v2 + - uses: mongodb-labs/drivers-github-tools/python/post-publish@v2 with: - version: ${{ inputs.version }} - following_version: ${{ inputs.following_version }} + version: ${{ env.VERSION }} + following_version: ${{ env.FOLLOWING_VERSION }} working_directory: ./bindings/python product_name: ${{ env.PRODUCT_NAME }} - silk_asset_group: ${{ env.SILK_ASSET_GROUP }} + sbom_in_path: bindings/python/sbom.json + kondukto_sub_project: pymongocrypt evergreen_project: ${{ env.EVERGREEN_PROJECT }} tag_template: "pymongocrypt-${VERSION}" token: ${{ github.token }} - dry_run: ${{ inputs.dry_run }} \ No newline at end of file + dry_run: ${{ env.DRY_RUN }} \ No newline at end of file diff --git a/ext/libmongocrypt/libmongocrypt/.github/workflows/test-python.yml b/ext/libmongocrypt/libmongocrypt/.github/workflows/test-python.yml index 23c4094..9611273 100644 --- a/ext/libmongocrypt/libmongocrypt/.github/workflows/test-python.yml +++ b/ext/libmongocrypt/libmongocrypt/.github/workflows/test-python.yml @@ -24,6 +24,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 + with: + persist-credentials: false - uses: actions/setup-python@v5 - name: "Run pre-commit" working-directory: . @@ -46,6 +48,7 @@ jobs: - uses: actions/checkout@v4 with: fetch-depth: 0 + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@v5 with: diff --git a/ext/libmongocrypt/libmongocrypt/.github/workflows/zizmor.yml b/ext/libmongocrypt/libmongocrypt/.github/workflows/zizmor.yml new file mode 100644 index 0000000..36c084a --- /dev/null +++ b/ext/libmongocrypt/libmongocrypt/.github/workflows/zizmor.yml @@ -0,0 +1,33 @@ +name: GitHub Actions Security Analysis with zizmor + +on: + push: + branches: ["master"] + pull_request: + branches: ["**"] + +jobs: + zizmor: + name: zizmor latest via Cargo + if: github.repository_owner == 'mongodb' + runs-on: ubuntu-latest + permissions: + security-events: write + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + persist-credentials: false + - name: Setup Rust + uses: actions-rust-lang/setup-rust-toolchain@v1 + - name: Get zizmor + run: cargo install zizmor + - name: Run zizmor + run: zizmor --format sarif . > results.sarif + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: results.sarif + category: zizmor diff --git a/ext/libmongocrypt/libmongocrypt/.lsan-suppressions b/ext/libmongocrypt/libmongocrypt/.lsan-suppressions index a64c939..0dc5491 100644 --- a/ext/libmongocrypt/libmongocrypt/.lsan-suppressions +++ b/ext/libmongocrypt/libmongocrypt/.lsan-suppressions @@ -3,3 +3,4 @@ leak:ccrng_cryptographic_generate leak:CRYPTO_zalloc # Ignore leak reported in dlopen error. leak:_dlerror_run +leak:_dlerror diff --git a/ext/libmongocrypt/libmongocrypt/CHANGELOG.md b/ext/libmongocrypt/libmongocrypt/CHANGELOG.md index 8e22114..587a431 100644 --- a/ext/libmongocrypt/libmongocrypt/CHANGELOG.md +++ b/ext/libmongocrypt/libmongocrypt/CHANGELOG.md @@ -1,10 +1,29 @@ # ChangeLog +## 1.13.2 +### Notes +- Bump downloaded libbson version from 1.28.1 to 1.30.3. Fixes a CMake configure error on macOS with CMake 4. +## 1.13.1 +### Fixed +- Fix possible double free on parse error of malformed payload. +- Fix build failure when configuring with `ENABLE_TRACE=ON`. +- Fix possible redefinition of `_GNU_SOURCE`. + +## 1.13.0 +### New features +- Support automatic encryption for `$lookup` stages in `aggregate` pipelines on MongoDB server 8.1+. +### Fixed +- Restore default behavior to disable extra alignment when importing libbson. This was the default behavior in 1.11. This can be overridden by setting the CMake option `ENABLE_EXTRA_ALIGNMENT=ON`. +### Removed +- Support for macOS versions older than 11. libmongocrypt is supported and tested with macOS 11+. + ## 1.12.0 ### New features - Add option to configure Data Encryption Key cache lifetime (`mongocrypt_setopt_key_expiration`) - Add opt-in retry behavior for KMS operations (`mongocrypt_setopt_retry_kms`) ### Removed - libmongocrypt is no longer published in the MongoDB package repository for RHEL 6. libmongocrypt may instead be built from source on RHEL 6, but support for RHEL 6 will be dropped in a future release. +### Notes +- This release unintentionally changes the default behavior of extra alignment with importing libbson. See 1.13.0 release notes. ## 1.11.0 ### New features diff --git a/ext/libmongocrypt/libmongocrypt/CMakeLists.txt b/ext/libmongocrypt/libmongocrypt/CMakeLists.txt index 5fe90aa..9b35079 100644 --- a/ext/libmongocrypt/libmongocrypt/CMakeLists.txt +++ b/ext/libmongocrypt/libmongocrypt/CMakeLists.txt @@ -120,6 +120,9 @@ set (MONGOCRYPT_SOURCES src/mc-range-encoding.c src/mc-rangeopts.c src/mc-reader.c + src/mc-schema-broker.c + src/mc-str-encode-string-sets.c + src/mc-text-search-str-encode.c src/mc-tokens.c src/mc-writer.c src/mongocrypt-binary.c @@ -151,6 +154,9 @@ set (MONGOCRYPT_SOURCES src/os_posix/os_mutex.c src/os_win/os_dll.c src/os_posix/os_dll.c + src/unicode/case-fold-map.c + src/unicode/diacritic-fold-map.c + src/unicode/fold.c ) # If MONGOCRYPT_CRYPTO is not set, choose a system default. @@ -460,6 +466,7 @@ set (TEST_MONGOCRYPT_SOURCES test/test-gcp-auth.c test/test-mc-cmp.c test/test-mc-efc.c + test/test-mc-fle2-encryption-placeholder.c test/test-mc-fle2-find-equality-payload-v2.c test/test-mc-fle2-find-range-payload-v2.c test/test-mc-fle2-payload-iev.c @@ -474,6 +481,8 @@ set (TEST_MONGOCRYPT_SOURCES test/test-mc-range-mincover.c test/test-mc-rangeopts.c test/test-mc-reader.c + test/test-mc-text-search-str-encode.c + test/test-mc-schema-broker.c test/test-mc-tokens.c test/test-mc-range-encoding.c test/test-mc-writer.c @@ -510,6 +519,7 @@ set (TEST_MONGOCRYPT_SOURCES test/test-mongocrypt-util.c test/test-mongocrypt.c test/test-named-kms-providers.c + test/test-unicode-fold.c ) # Define test-mongocrypt diff --git a/ext/libmongocrypt/libmongocrypt/CODEOWNERS b/ext/libmongocrypt/libmongocrypt/CODEOWNERS index d1db98f..9ffca16 100644 --- a/ext/libmongocrypt/libmongocrypt/CODEOWNERS +++ b/ext/libmongocrypt/libmongocrypt/CODEOWNERS @@ -1,7 +1,4 @@ # Code Owners will automatically be added as reviewers on PRs # Python Bindings -bindings/python @mongodb/dbx-python - -# Java Bindings -bindings/java @jyemin @rozza +bindings/python @mongodb/dbx-python \ No newline at end of file diff --git a/ext/libmongocrypt/libmongocrypt/CONTRIBUTING.md b/ext/libmongocrypt/libmongocrypt/CONTRIBUTING.md new file mode 100644 index 0000000..f9fe332 --- /dev/null +++ b/ext/libmongocrypt/libmongocrypt/CONTRIBUTING.md @@ -0,0 +1,14 @@ +# Formatting + +To format, install `pipx` and run: +```bash +./etc/format-all.sh +``` + +To use a specified python install, set `MONGOCRYPT_PYTHON`: + +```bash +# Set MONGOCRYPT_PYTHON to a python install with pipx installed. +export MONGOCRYPT_PYTHON=python +./etc/format-all.sh +``` diff --git a/ext/libmongocrypt/libmongocrypt/Earthfile b/ext/libmongocrypt/libmongocrypt/Earthfile index 5403638..5c4707e 100644 --- a/ext/libmongocrypt/libmongocrypt/Earthfile +++ b/ext/libmongocrypt/libmongocrypt/Earthfile @@ -54,11 +54,11 @@ # • DO NOT: "ubuntu" # • DO NOT: "ubuntu:latest" # • DO NOT: "ubuntu:22.10" - # • DO: "docker.io/library/ubuntu:22.10" + # • DO: "artifactory.corp.mongodb.com/dockerhub/library/ubuntu:22.10" # ### VERSION --use-cache-command 0.6 -FROM docker.io/library/alpine:3.16 +FROM artifactory.corp.mongodb.com/dockerhub/library/alpine:3.16 WORKDIR /s init: @@ -125,24 +125,24 @@ ALPINE_SETUP: env.c6: # A CentOS 6 environment. - FROM +init --base=docker.io/library/centos:6 + FROM +init --base=artifactory.corp.mongodb.com/dockerhub/library/centos:6 DO +CENTOS6_SETUP env.c7: # A CentOS 7 environment. - FROM +init --base=docker.io/library/centos:7 + FROM +init --base=artifactory.corp.mongodb.com/dockerhub/library/centos:7 DO +REDHAT_SETUP env.rl8: # CentOS 8 is cancelled. Use RockyLinux 8 for our RHEL 8 environment. - FROM +init --base=docker.io/library/rockylinux:8 + FROM +init --base=artifactory.corp.mongodb.com/dockerhub/library/rockylinux:8 DO +REDHAT_SETUP # Utility command for Ubuntu environments ENV_UBUNTU: COMMAND ARG --required version - FROM +init --base=docker.io/library/ubuntu:$version + FROM +init --base=artifactory.corp.mongodb.com/dockerhub/library/ubuntu:$version DO +DEBIAN_SETUP env.u14: @@ -167,19 +167,19 @@ env.u22: env.amzn1: # An Amazon "1" environment. (AmazonLinux 2018) - FROM +init --base=docker.io/library/amazonlinux:2018.03 + FROM +init --base=artifactory.corp.mongodb.com/dockerhub/library/amazonlinux:2018.03 DO +AMZ_SETUP env.amzn2: # An AmazonLinux 2 environment - FROM +init --base=docker.io/library/amazonlinux:2 + FROM +init --base=artifactory.corp.mongodb.com/dockerhub/library/amazonlinux:2 DO +AMZ_SETUP # Utility command for Debian setup ENV_DEBIAN: COMMAND ARG --required version - FROM +init --base=docker.io/library/debian:$version + FROM +init --base=artifactory.corp.mongodb.com/dockerhub/library/debian:$version IF [ $version = "9.2" ] # Update source list for archived Debian stretch packages. # Refer: https://unix.stackexchange.com/a/743865/260858 @@ -208,11 +208,11 @@ env.deb12: env.sles15: # An OpenSUSE Leap 15.0 environment. - FROM +init --base=docker.io/opensuse/leap:15.0 + FROM +init --base=artifactory.corp.mongodb.com/dockerhub/opensuse/leap:15.0 DO +SLES_SETUP env.alpine: - FROM +init --base=docker.io/library/alpine:3.18 + FROM +init --base=artifactory.corp.mongodb.com/dockerhub/library/alpine:3.18 DO +ALPINE_SETUP # Utility: Warm-up obtaining CMake and Ninja for the build. This is usually @@ -259,7 +259,7 @@ BUILD_EXAMPLE_STATE_MACHINE: RUN cd /s && /s/example-state-machine rpm-build: - FROM +init --base fedora:38 + FROM +init --base artifactory.corp.mongodb.com/dockerhub/fedora:38 GIT CLONE https://src.fedoraproject.org/rpms/libmongocrypt.git /R # Install the packages listed by "BuildRequires" and rpm-build: RUN __install $(awk '/^BuildRequires:/ { print $2 }' /R/libmongocrypt.spec) \ @@ -275,7 +275,7 @@ rpm-build: rpm-install-runtime: # Install the runtime RPM - FROM +init --base fedora:38 + FROM +init --base artifactory.corp.mongodb.com/dockerhub/fedora:38 COPY +rpm-build/RPMS /tmp/libmongocrypt-rpm/ RUN dnf makecache RUN __install $(find /tmp/libmongocrypt-rpm/ -name 'libmongocrypt-1.*.rpm') @@ -325,7 +325,7 @@ deb-build: deb-install-runtime: # Install the runtime deb package - FROM +init --base=docker.io/library/debian:unstable + FROM +init --base=artifactory.corp.mongodb.com/dockerhub/library/debian:unstable COPY +deb-build/debs/libmongocrypt0*.deb /tmp/lmc.deb RUN __install /tmp/lmc.deb @@ -354,7 +354,8 @@ packaging-full-test: BUILD +rpm-runtime-test check-format: - FROM python:3.11.2-slim-buster + FROM +init --base=artifactory.corp.mongodb.com/dockerhub/python:3.11.2-slim-buster + RUN __install build-essential # To install `make` to install clang-format. RUN pip install pipx COPY etc/format* /X/etc/ COPY .evergreen/init.sh /X/.evergreen/ @@ -462,15 +463,14 @@ sign: # See https://docs.devprod.prod.corp.mongodb.com/mms/python/src/sbom/silkbomb/ for documentation of silkbomb. silkbomb: FROM artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0 - # Alias the silkbom executable to a simpler name: + # Alias the silkbomb executable to a simpler name: RUN ln -s /python/src/sbom/silkbomb/bin /usr/local/bin/silkbomb # sbom-generate: # Generate/update the etc/cyclonedx.sbom.json file from the etc/purls.txt file. # # This target will update the existing etc/cyclonedx.sbom.json file in-place based -# on the content of etc/purls.txt. -# +# on the content of etc/purls.txt and etc/cyclonedx.sbom.json. sbom-generate: FROM +silkbomb # Copy in the relevant files: @@ -478,30 +478,44 @@ sbom-generate: COPY etc/purls.txt etc/cyclonedx.sbom.json /s/ # Update the SBOM file: RUN silkbomb update \ + --refresh \ + --no-update-sbom-version \ --purls purls.txt \ --sbom-in cyclonedx.sbom.json \ --sbom-out cyclonedx.sbom.json # Save the result back to the host: SAVE ARTIFACT /s/cyclonedx.sbom.json AS LOCAL etc/cyclonedx.sbom.json -# sbom-augment: -# Augment the SBOM file with vulnerability information from Kondukto. -# -# See https://wiki.corp.mongodb.com/display/DRIVERS/Using+AWS+Secrets+Manager+to+Store+Testing+Secrets for instructions to get secrets from AWS Secrets Manager. Secrets are available under `drivers/libmongocrypt`. +# sbom-generate-new-serial-number: +# Equivalent to +sbom-generate but includes the --generate-new-serial-number +# flag to generate a new unique serial number and reset the SBOM version to 1. # -sbom-augment: - ARG --required out - ARG --required branch +# This target will update the existing etc/cyclonedx.sbom.json file in-place based +# on the content of etc/purls.txt and etc/cyclonedx.sbom.json. +sbom-generate-new-serial-number: FROM +silkbomb + # Copy in the relevant files: WORKDIR /s - COPY etc/cyclonedx.sbom.json /s/ - # Download the Augmented SBOM file: - RUN --no-cache --secret kondukto_token KONDUKTO_TOKEN=${kondukto_token} \ - silkbomb augment \ + COPY etc/purls.txt etc/cyclonedx.sbom.json /s/ + # Update the SBOM file: + RUN silkbomb update \ + --refresh \ + --generate-new-serial-number \ + --purls purls.txt \ --sbom-in cyclonedx.sbom.json \ - --sbom-out cyclonedx.augmented.sbom.json \ - --repo mongodb/libmongocrypt-helper-ruby \ - --branch ${branch} + --sbom-out cyclonedx.sbom.json # Save the result back to the host: - SAVE ARTIFACT /s/cyclonedx.augmented.sbom.json AS LOCAL ${out} - RUN echo "Augmented SBOM saved to ${out}" + SAVE ARTIFACT /s/cyclonedx.sbom.json AS LOCAL etc/cyclonedx.sbom.json + +# sbom-validate: +# Validate the SBOM Lite for the given branch. +sbom-validate: + FROM +silkbomb + # Copy in the relevant files: + WORKDIR /s + COPY etc/purls.txt etc/cyclonedx.sbom.json /s/ + # Run the SilkBomb tool to download the artifact that matches the requested branch + RUN silkbomb validate \ + --purls purls.txt \ + --sbom-in cyclonedx.sbom.json \ + --exclude jira diff --git a/ext/libmongocrypt/libmongocrypt/README.md b/ext/libmongocrypt/libmongocrypt/README.md index 6516946..4361f5c 100644 --- a/ext/libmongocrypt/libmongocrypt/README.md +++ b/ext/libmongocrypt/libmongocrypt/README.md @@ -95,15 +95,6 @@ If there are errors with cmake configuration, send the set of steps you performe If there are compilation or linker errors, run `make` again, setting `VERBOSE=1` in the environment or on the command line (which shows exact compile and link commands), and send the output to the maintainers of this project. -### Design Principles ### -The design of libmongocrypt adheres to these principles. - -#### Easy to integrate #### -The main reason behind creating a C library is to make it easier for drivers to support FLE. Some consequences of this principle: the API is minimal, structs are opaque, and global initialization is lazy. - -#### Lightweight #### -We decided against the "have libmongocrypt do everything" approach because it complicated integration, especially with async drivers. Because of this we decided no I/O occurs in libmongocrypt. - ### Releasing ### See [releasing](./doc/releasing.md). @@ -112,7 +103,7 @@ See [releasing](./doc/releasing.md). Distribution packages (i.e., .deb/.rpm) are built and published for several Linux distributions. The installation of these packages for supported platforms is documented here. ### Unstable Development Distribution Packages ### -To install the latest unstable development package, change `1.12` to `development` in the package URLs listed in the subsequent instructions. For example, `https://libmongocrypt.s3.amazonaws.com/apt/ubuntu /libmongocrypt/1.12` in the instructions would become `https://libmongocrypt.s3.amazonaws.com/apt/ubuntu /libmongocrypt/development`. Do not use the unstable version of libmongocrypt in a production environment. +To install the latest unstable development package, change `1.13` to `development` in the package URLs listed in the subsequent instructions. For example, `https://libmongocrypt.s3.amazonaws.com/apt/ubuntu /libmongocrypt/1.13` in the instructions would become `https://libmongocrypt.s3.amazonaws.com/apt/ubuntu /libmongocrypt/development`. Do not use the unstable version of libmongocrypt in a production environment. ### .deb Packages (Debian and Ubuntu) ### @@ -153,13 +144,13 @@ sudo sh -c 'curl -s --location https://pgp.mongodb.com/libmongocrypt.asc | gpg - Second, create a list entry for the repository. For Ubuntu systems (be sure to change `` to `xenial`, `bionic`, `focal`, or `jammy`, as appropriate to your system): ``` -echo "deb https://libmongocrypt.s3.amazonaws.com/apt/ubuntu /libmongocrypt/1.12 universe" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list +echo "deb https://libmongocrypt.s3.amazonaws.com/apt/ubuntu /libmongocrypt/1.13 universe" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list ``` For Debian systems (be sure to change `` to `stretch`, `buster`, `bullseye`, or `bookworm` as appropriate to your system): ``` -echo "deb https://libmongocrypt.s3.amazonaws.com/apt/debian /libmongocrypt/1.12 main" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list +echo "deb https://libmongocrypt.s3.amazonaws.com/apt/debian /libmongocrypt/1.13 main" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list ``` #### Package installation #### @@ -181,7 +172,7 @@ Create the file `/etc/yum.repos.d/libmongocrypt.repo` with contents: ``` [libmongocrypt] name=libmongocrypt repository -baseurl=https://libmongocrypt.s3.amazonaws.com/yum/redhat/$releasever/libmongocrypt/1.12/x86_64 +baseurl=https://libmongocrypt.s3.amazonaws.com/yum/redhat/$releasever/libmongocrypt/1.13/x86_64 gpgcheck=1 enabled=1 gpgkey=https://pgp.mongodb.com/libmongocrypt.asc @@ -200,7 +191,7 @@ Create the file `/etc/yum.repos.d/libmongocrypt.repo` with contents: ``` [libmongocrypt] name=libmongocrypt repository -baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2023/libmongocrypt/1.12/x86_64 +baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2023/libmongocrypt/1.13/x86_64 gpgcheck=1 enabled=1 gpgkey=https://pgp.mongodb.com/libmongocrypt.asc @@ -219,7 +210,7 @@ Create the file `/etc/yum.repos.d/libmongocrypt.repo` with contents: ``` [libmongocrypt] name=libmongocrypt repository -baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2/libmongocrypt/1.12/x86_64 +baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2/libmongocrypt/1.13/x86_64 gpgcheck=1 enabled=1 gpgkey=https://pgp.mongodb.com/libmongocrypt.asc @@ -238,7 +229,7 @@ Create the file `/etc/yum.repos.d/libmongocrypt.repo` with contents: ``` [libmongocrypt] name=libmongocrypt repository -baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2013.03/libmongocrypt/1.12/x86_64 +baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2013.03/libmongocrypt/1.13/x86_64 gpgcheck=1 enabled=1 gpgkey=https://pgp.mongodb.com/libmongocrypt.asc @@ -261,7 +252,7 @@ sudo rpm --import https://pgp.mongodb.com/libmongocrypt.asc Second, add the repository (be sure to change `` to `12` or `15`, as appropriate to your system): ``` -sudo zypper addrepo --gpgcheck "https://libmongocrypt.s3.amazonaws.com/zypper/suse//libmongocrypt/1.12/x86_64" libmongocrypt +sudo zypper addrepo --gpgcheck "https://libmongocrypt.s3.amazonaws.com/zypper/suse//libmongocrypt/1.13/x86_64" libmongocrypt ``` Finally, install the libmongocrypt packages: diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/.evergreen/publish.sh b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/.evergreen/publish.sh deleted file mode 100755 index 61945f3..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/.evergreen/publish.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/bin/bash - -# DO NOT ECHO COMMANDS AS THEY CONTAIN SECRETS! - -set -o errexit # Exit the script with error if any of the commands fail - -############################################ -# Main Program # -############################################ - -echo ${ring_file_gpg_base64} | base64 -d > ${PROJECT_DIRECTORY}/secring.gpg - -trap "rm ${PROJECT_DIRECTORY}/secring.gpg; exit" EXIT HUP - -export ORG_GRADLE_PROJECT_nexusUsername=${nexus_username} -export ORG_GRADLE_PROJECT_nexusPassword=${nexus_password} -export ORG_GRADLE_PROJECT_signing_keyId=${signing_keyId} -export ORG_GRADLE_PROJECT_signing_password=${signing_password} -export ORG_GRADLE_PROJECT_signing_secretKeyRingFile=${PROJECT_DIRECTORY}/secring.gpg - -echo "Publishing snapshot with jdk11" -export JAVA_HOME="/opt/java/jdk11" - -SYSTEM_PROPERTIES="-Dorg.gradle.internal.publish.checksums.insecure=true -Dorg.gradle.internal.http.connectionTimeout=120000 -Dorg.gradle.internal.http.socketTimeout=120000" - -./gradlew -version -./gradlew ${SYSTEM_PROPERTIES} --stacktrace --info publishToSonatype diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/.evergreen/test.sh b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/.evergreen/test.sh deleted file mode 100755 index 3274e26..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/.evergreen/test.sh +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/bash - -# Test the Java bindings for libmongocrypt - -set -o xtrace # Write all commands first to stderr -set -o errexit # Exit the script with error if any of the commands fail - - -if [ "Windows_NT" = "$OS" ]; then - export JDK8="/cygdrive/c/java/jdk8" - export JDK11="/cygdrive/c/java/jdk11" -else - export JDK8="/opt/java/jdk8" - export JDK11="/opt/java/jdk11" -fi - -if [ -d "$JDK11" ]; then - export JAVA_HOME=$JDK11 -else - export JAVA_HOME=$JDK8 -fi - -./gradlew -version -./gradlew clean downloadJnaLibs check --info -DgitRevision=${GIT_REVISION} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/.gitignore b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/.gitignore deleted file mode 100644 index 64e5adb..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/.gitignore +++ /dev/null @@ -1,39 +0,0 @@ -*~ -.#* -.git -*# - -# os x stuff -*Thumbs.db* -*.DS_Store - -# Build artifacts -build -out - -# Eclipse files -.classpath -.project -.settings - -# Intellij IDEA files -*.ipr -*.iws -*.iml -*.idea -workspace.xml -atlassian-ide-plugin.xml - -# gradle -.gradle - -# local settings -**/gradle.properties -local.properties - -# jenv -.java-version - -# bin -/bin -/benchmarks/bin diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/README.md b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/README.md deleted file mode 100644 index cd69444..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/README.md +++ /dev/null @@ -1,36 +0,0 @@ -# mongocrypt Java Wrapper # -The Java wrapper for the companion C library for client side encryption in drivers. - -### Testing ### -`./gradlew check` runs the java test suite. By default it expects that libmongocrypt is in `./build/jnaLibs//` - where is the current platform architecture: eg: `linux-x86-64`. - -To test against a local build: -`/gradlew check -DjnaLibsPath=../../../../libmongocrypt/cmake-build` - -Note: libmongocrypt and the java library are continuously built on evergreen. Submit patch builds to this evergreen project when making changes to test on supported platforms. - -### Publishing #### - -First check the build artifacts locally (~/.m2/repository/org/mongodb/mongocrypt): `./gradlew clean downloadJnaLibs publishToMavenLocal` - -**Sonatype** - -`./gradlew publishToSonatype` -Will push the latest snapshot or release version to sonatype repository. - -### Custom gradle flags ### - -* `jnaLibsPath`: Custom local JNA library path for inclusion into the build (rather than downloading from s3)
- Usage: `./gradlew publishToSonatype -DjnaLibsPath=../../../cmake-build-nocrypto` -* `gitRevision`: Sets the Git Revision to download the built resources for from s3.
- Usage: `./gradlew publishToSonatype -DgitRevision=` - -These flags can be combined with the `downloadJnaLibs` task: - -* Test without compiling libmongocrypt locally:
`./gradlew clean downloadJnaLibs test -DgitRevision=` -* Test using a custom libmongocrypt path:
`./gradlew clean test -DjnaLibsPath=` - - -### Debugging errors ### - -* Use the info and jna debug flags to output debugging information when running tasks:
`./gradlew --info -Djna.debug_load=true` diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/benchmarks/build.gradle.kts b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/benchmarks/build.gradle.kts deleted file mode 100644 index e499381..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/benchmarks/build.gradle.kts +++ /dev/null @@ -1,28 +0,0 @@ -/* - * Copyright 2023-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -plugins { - id("application") -} - -application { - mainClass.set("com.mongodb.crypt.benchmark.BenchmarkRunner") -} - -dependencies { - implementation(project(":")) // Reference to the parent project -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/benchmarks/src/main/java/com/mongodb/crypt/benchmark/BenchmarkRunner.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/benchmarks/src/main/java/com/mongodb/crypt/benchmark/BenchmarkRunner.java deleted file mode 100644 index e520557..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/benchmarks/src/main/java/com/mongodb/crypt/benchmark/BenchmarkRunner.java +++ /dev/null @@ -1,217 +0,0 @@ -/* - * Copyright 2023-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.benchmark; - -import com.mongodb.crypt.capi.*; -import org.bson.*; - -import java.io.*; -import java.net.URL; -import java.nio.ByteBuffer; -import java.nio.charset.StandardCharsets; -import java.nio.file.Files; -import java.nio.file.Paths; -import java.time.ZoneOffset; -import java.time.ZonedDateTime; -import java.time.format.DateTimeFormatter; -import java.util.*; -import java.util.concurrent.*; - -public class BenchmarkRunner { - static final int NUM_FIELDS = 1500; - static final int NUM_WARMUP_SECS = 2; - static final int NUM_SECS = 10; - static final byte[] LOCAL_MASTER_KEY = new byte[]{ - -99, -108, 75, 13, -109, -48, -59, 68, -91, 114, -3, 50, 27, -108, 48, -112, 35, 53, - 115, 124, -16, -10, -62, -12, -38, 35, 86, -25, -113, 4, -52, -6, -34, 117, -76, 81, - -121, -13, -117, -105, -41, 75, 68, 59, -84, 57, -94, -58, 77, -111, 0, 62, -47, -6, 74, - 48, -63, -46, -58, 94, -5, -84, 65, -14, 72, 19, 60, -101, 80, -4, -89, 36, 122, 46, 2, - 99, -93, -58, 22, 37, 81, 80, 120, 62, 15, -40, 110, -124, -90, -20, -115, 45, 36, 71, - -27, -81 - }; - - private static String getFileAsString(final String fileName) { - try { - URL resource = BenchmarkRunner.class.getResource("/" + fileName); - if (resource == null) { - throw new RuntimeException("Could not find file " + fileName); - } - return new String(Files.readAllBytes(Paths.get(resource.toURI()))); - } catch (Throwable t) { - throw new RuntimeException("Could not parse file " + fileName, t); - } - } - - private static BsonDocument getResourceAsDocument(final String fileName) { - return BsonDocument.parse(getFileAsString(fileName)); - } - - private static MongoCrypt createMongoCrypt() { - return MongoCrypts.create(MongoCryptOptions - .builder() - .localKmsProviderOptions(MongoLocalKmsProviderOptions.builder() - .localMasterKey(ByteBuffer.wrap(LOCAL_MASTER_KEY)) - .build()) - .build()); - } - - // DecryptTask decrypts a document repeatedly for a specified number of seconds and records ops/sec. - private static class DecryptTask implements Runnable { - public DecryptTask (MongoCrypt mongoCrypt, BsonDocument toDecrypt, int numSecs, CountDownLatch doneSignal) { - this.mongoCrypt = mongoCrypt; - this.toDecrypt = toDecrypt; - this.opsPerSecs = new ArrayList(numSecs); - this.numSecs = numSecs; - this.doneSignal = doneSignal; - } - public void run() { - for (int i = 0; i < numSecs; i++) { - long opsPerSec = 0; - long start = System.nanoTime(); - // Run for one second. - while (System.nanoTime() - start < 1_000_000_000) { - try (MongoCryptContext ctx = mongoCrypt.createDecryptionContext(toDecrypt)) { - assert ctx.getState() == MongoCryptContext.State.READY; - ctx.finish(); - opsPerSec++; - } - } - opsPerSecs.add(opsPerSec); - } - doneSignal.countDown(); - } - public long getMedianOpsPerSecs () { - if (opsPerSecs.size() == 0) { - throw new IllegalStateException("opsPerSecs is empty. Was `run` called?"); - } - Collections.sort(opsPerSecs); - return opsPerSecs.get(numSecs / 2); - } - private MongoCrypt mongoCrypt; - private BsonDocument toDecrypt; - private ArrayList opsPerSecs; - private int numSecs; - private CountDownLatch doneSignal; - } - public static void main(String[] args) throws IOException, InterruptedException, ExecutionException { - System.out.printf("BenchmarkRunner is using libmongocrypt version=%s, NUM_WARMUP_SECS=%d, NUM_SECS=%d%n", CAPI.mongocrypt_version(null).toString(), NUM_WARMUP_SECS, NUM_SECS); - // `keyDocument` is a Data Encryption Key (DEK) encrypted with the Key Encryption Key (KEK) `LOCAL_MASTER_KEY`. - BsonDocument keyDocument = getResourceAsDocument("keyDocument.json"); - try (MongoCrypt mongoCrypt = createMongoCrypt()) { - // `encrypted` will contain encrypted fields. - BsonDocument encrypted = new BsonDocument(); - { - for (int i = 0; i < NUM_FIELDS; i++) { - MongoExplicitEncryptOptions options = MongoExplicitEncryptOptions.builder() - .keyId(new BsonBinary(BsonBinarySubType.UUID_STANDARD, Base64.getDecoder().decode("YWFhYWFhYWFhYWFhYWFhYQ=="))) - .algorithm("AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic") - .build(); - BsonDocument toEncrypt = new BsonDocument("v", new BsonString(String.format("value %04d", i))); - try (MongoCryptContext ctx = mongoCrypt.createExplicitEncryptionContext(toEncrypt, options)) { - // If mongocrypt_t has not yet cached the DEK, supply it. - if (MongoCryptContext.State.NEED_MONGO_KEYS == ctx.getState()) { - ctx.addMongoOperationResult(keyDocument); - ctx.completeMongoOperation(); - } - assert ctx.getState() == MongoCryptContext.State.READY; - RawBsonDocument result = ctx.finish(); - BsonValue encryptedValue = result.get("v"); - String key = String.format("key%04d", i); - encrypted.append(key, encryptedValue); - } - } - } - - // Warm up benchmark and discard the result. - DecryptTask warmup = new DecryptTask(mongoCrypt, encrypted, NUM_WARMUP_SECS, new CountDownLatch(1)); - warmup.run(); - - // Decrypt `encrypted` and measure ops/sec. - // Check with varying thread counts to measure impact of a shared pool of Cipher instances. - int[] threadCounts = {1,2,8,64}; - ArrayList totalMedianOpsPerSecs = new ArrayList(threadCounts.length); - ArrayList createdAts = new ArrayList(threadCounts.length); - ArrayList completedAts = new ArrayList(threadCounts.length); - - for (int threadCount : threadCounts) { - ExecutorService executorService = Executors.newFixedThreadPool(threadCount); - CountDownLatch doneSignal = new CountDownLatch(threadCount); - ArrayList decryptTasks = new ArrayList(threadCount); - createdAts.add(ZonedDateTime.now(ZoneOffset.UTC).format(DateTimeFormatter.ISO_INSTANT)); - - for (int i = 0; i < threadCount; i++) { - DecryptTask decryptTask = new DecryptTask(mongoCrypt, encrypted, NUM_SECS, doneSignal); - decryptTasks.add(decryptTask); - executorService.submit(decryptTask); - } - - // Await completion of all tasks. Tasks are expected to complete shortly after NUM_SECS. Time out `await` if time exceeds 2 * NUM_SECS. - boolean ok = doneSignal.await(NUM_SECS * 2, TimeUnit.SECONDS); - assert ok; - completedAts.add(ZonedDateTime.now(ZoneOffset.UTC).format(DateTimeFormatter.ISO_INSTANT)); - // Sum the median ops/secs of all tasks to get total throughput. - long totalMedianOpsPerSec = 0; - for (DecryptTask decryptTask : decryptTasks) { - totalMedianOpsPerSec += decryptTask.getMedianOpsPerSecs(); - } - System.out.printf("threadCount=%d. Decrypting 1500 fields median ops/sec : %d%n", threadCount, totalMedianOpsPerSec); - totalMedianOpsPerSecs.add(totalMedianOpsPerSec); - executorService.shutdown(); - ok = executorService.awaitTermination(NUM_SECS * 2, TimeUnit.SECONDS); - assert ok; - } - - // Print the results in JSON that can be accepted by the `perf.send` command. - // See https://docs.devprod.prod.corp.mongodb.com/evergreen/Project-Configuration/Project-Commands#perfsend for the expected `perf.send` input. - ArrayList resultsArray = new ArrayList(threadCounts.length); - for (int i = 0; i < threadCounts.length; i++) { - int threadCount = threadCounts[i]; - long totalMedianOpsPerSec = totalMedianOpsPerSecs.get(i); - String createdAt = createdAts.get(i); - String completedAt = completedAts.get(i); - - resultsArray.add(new BsonDocument() - .append("info", new BsonDocument() - .append("test_name", new BsonString("java_decrypt_1500")) - .append("args", new BsonDocument() - .append("threadCount", new BsonInt32(threadCount)))) - .append("created_at", new BsonString(createdAt)) - .append("completed_at", new BsonString(completedAt)) - .append("artifacts", new BsonArray()) - .append("metrics", new BsonArray(Arrays.asList( - new BsonDocument() - .append("name", new BsonString("medianOpsPerSec")) - .append("type", new BsonString("THROUGHPUT")) - .append("value", new BsonInt64(totalMedianOpsPerSec)) - ))) - .append("sub_tests", new BsonArray())); - } - - BsonDocument results = new BsonDocument().append("results", new BsonArray(resultsArray)); - String resultsString = results.toJson(); - // Remove the prefix and suffix when writing to a file so only the [ ... ] array is included. - resultsString = resultsString.substring("{\"results\": ".length(), resultsString.length() - 1); - - String resultsFilePath = "results.json"; - try (OutputStreamWriter fileWriter = new OutputStreamWriter(new FileOutputStream(resultsFilePath), StandardCharsets.UTF_8)) { - fileWriter.write(resultsString); - } - System.out.println("Results written to file: " + resultsFilePath); - } - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/benchmarks/src/main/resources/keyDocument.json b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/benchmarks/src/main/resources/keyDocument.json deleted file mode 100644 index 20d631d..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/benchmarks/src/main/resources/keyDocument.json +++ /dev/null @@ -1,24 +0,0 @@ -{ - "_id": { - "$binary": { - "base64": "YWFhYWFhYWFhYWFhYWFhYQ==", - "subType": "04" - } - }, - "keyMaterial": { - "$binary": { - "base64": "ACR7Hm33dDOAAD7l2ubZhSpSUWK8BkALUY+qW3UgBAEcTV8sBwZnaAWnzDsmrX55dgmYHWfynDlJogC/e33u6pbhyXvFTs5ow9OLCuCWBJ39T/Ivm3kMaZJybkejY0V+uc4UEdHvVVz/SbitVnzs2WXdMGmo1/HmDRrxGYZjewFslquv8wtUHF5pyB+QDlQBd/al9M444/8bJZFbMSmtIg==", - "subType": "00" - } - }, - "creationDate": { - "$date": "2023-08-21T14:28:20.875Z" - }, - "updateDate": { - "$date": "2023-08-21T14:28:20.875Z" - }, - "status": 0, - "masterKey": { - "provider": "local" - } -} \ No newline at end of file diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/build.gradle.kts b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/build.gradle.kts deleted file mode 100644 index a58258e..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/build.gradle.kts +++ /dev/null @@ -1,354 +0,0 @@ -/* - * Copyright 2019-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -import de.undercouch.gradle.tasks.download.Download -import java.io.ByteArrayOutputStream -import java.net.URI - -buildscript { - repositories { - mavenCentral() - google() - } - dependencies { - "classpath"(group = "net.java.dev.jna", name = "jna", version = "5.11.0") - } -} - -plugins { - `java-library` - `maven-publish` - signing - id("de.undercouch.download") version "5.0.5" - id("biz.aQute.bnd.builder") version "6.2.0" -} - -allprojects { - repositories { - mavenCentral() - google() - } -} - -group = "org.mongodb" -version = "1.12.0-SNAPSHOT" -description = "MongoDB client-side crypto support" - -java { - sourceCompatibility = JavaVersion.VERSION_1_8 - targetCompatibility = JavaVersion.VERSION_1_8 - - registerFeature("loggingSupport") { - usingSourceSet(sourceSets["main"]) - } -} - - -val bsonRangeVersion = "[3.10,5.0)" -dependencies { - api("org.mongodb:bson:$bsonRangeVersion") - api("net.java.dev.jna:jna:5.11.0") - "loggingSupportImplementation"("org.slf4j:slf4j-api:1.7.36") - - // Tests - testImplementation(platform("org.junit:junit-bom:5.8.2")) - testImplementation("org.junit.jupiter:junit-jupiter") - testRuntimeOnly("ch.qos.logback:logback-classic:1.2.11") -} - -/* - * Git version information - */ - -// Returns a String representing the output of `git describe` -val gitDescribe by lazy { - val describeStdOut = ByteArrayOutputStream() - exec { - commandLine = listOf("git", "describe", "--tags", "--always", "--dirty") - standardOutput = describeStdOut - } - describeStdOut.toString().trim() -} - -val isJavaTag by lazy { gitDescribe.startsWith("java") } -val gitVersion by lazy { gitDescribe.subSequence(gitDescribe.toCharArray().indexOfFirst { it.isDigit() }, gitDescribe.length).toString() } - -val defaultDownloadRevision: String by lazy { - val gitCommandLine = if (gitVersion == version) { - listOf("git", "rev-list", "-n", "1", gitVersion) - } else { - listOf("git", "rev-parse", "HEAD") - } - val describeStdOut = ByteArrayOutputStream() - exec { - commandLine = gitCommandLine - standardOutput = describeStdOut - } - describeStdOut.toString().trim() -} - -/* - * Jna copy or download resources - */ -val jnaDownloadsDir = "$buildDir/jnaLibs/downloads/" -val jnaResourcesDir = "$buildDir/jnaLibs/resources/" -val jnaLibPlatform: String = if (com.sun.jna.Platform.RESOURCE_PREFIX.startsWith("darwin")) "darwin" else com.sun.jna.Platform.RESOURCE_PREFIX -val jnaLibsPath: String = System.getProperty("jnaLibsPath", "${jnaResourcesDir}${jnaLibPlatform}") -val jnaResources: String = System.getProperty("jna.library.path", jnaLibsPath) - -// Download jnaLibs that match the git to jnaResourcesBuildDir -val downloadRevision: String = System.getProperties().computeIfAbsent("gitRevision") { k -> defaultDownloadRevision }.toString() -val downloadUrl: String = "https://mciuploads.s3.amazonaws.com/libmongocrypt/java/$downloadRevision/libmongocrypt-java.tar.gz" - -val jnaMapping: Map = mapOf( - "rhel-62-64-bit" to "linux-x86-64", - "rhel72-zseries-test" to "linux-s390x", - "rhel-71-ppc64el" to "linux-ppc64le", - "ubuntu1604-arm64" to "linux-aarch64", - "windows-test" to "win32-x86-64", - "macos" to "darwin" -) - -tasks.register("downloadJava") { - src(downloadUrl) - dest("${jnaDownloadsDir}/libmongocrypt-java.tar.gz") - overwrite(true) -} - -// The `processResources` task (defined by the `java-library` plug-in) consumes files in the main source set. -// Add a dependency on `unzipJava`. `unzipJava` adds libmongocrypt libraries to the main source set. -tasks.processResources { - mustRunAfter(tasks.named("unzipJava")) -} - -tasks.register("unzipJava") { - outputs.upToDateWhen { false } - from(tarTree(resources.gzip("${jnaDownloadsDir}/libmongocrypt-java.tar.gz"))) - include(jnaMapping.keys.flatMap { - listOf("${it}/nocrypto/**/libmongocrypt.so", "${it}/lib/**/libmongocrypt.dylib", "${it}/bin/**/mongocrypt.dll" ) - }) - eachFile { - path = "${jnaMapping[path.substringBefore("/")]}/${name}" - } - into(jnaResourcesDir) - mustRunAfter("downloadJava") - - doLast { - println("jna.library.path contents: \n ${fileTree(jnaResourcesDir).files.joinToString(",\n ")}") - } -} - -tasks.register("downloadJnaLibs") { - dependsOn("downloadJava", "unzipJava") -} - -tasks.test { - systemProperty("jna.debug_load", "true") - systemProperty("jna.library.path", jnaResources) - useJUnitPlatform() - testLogging { - events("passed", "skipped", "failed") - } - - doFirst { - println("jna.library.path contents:") - println(fileTree(jnaResources) { - this.setIncludes(listOf("*.*")) - }.files.joinToString(",\n ", " ")) - } - mustRunAfter("downloadJnaLibs", "downloadJava", "unzipJava") -} - -tasks.withType { - description = """$description - | System properties: - | ================= - | - | jnaLibsPath : Custom local JNA library path for inclusion into the build (rather than downloading from s3) - | gitRevision : Optional Git Revision to download the built resources for from s3. - """.trimMargin() -} - -tasks.withType { - sourceSets["main"].resources.srcDirs("resources", jnaResourcesDir) -} - -/* - * Publishing - */ -tasks.register("sourcesJar") { - description = "Create the sources jar" - from(sourceSets.main.get().allJava) - archiveClassifier.set("sources") -} - -tasks.register("javadocJar") { - description = "Create the Javadoc jar" - from(tasks.javadoc) - archiveClassifier.set("javadoc") -} - -tasks.jar { - manifest { - attributes( - "-exportcontents" to "com.mongodb.crypt.capi.*;-noimport:=true", - "Automatic-Module-Name" to "com.mongodb.crypt.capi", - "Import-Package" to """org.bson.*;version="$bsonRangeVersion"""", - "Build-Version" to gitVersion, - "Bundle-Version" to gitVersion, - "Bundle-Name" to "MongoCrypt", - "Bundle-SymbolicName" to "com.mongodb.crypt.capi", - "Private-Package" to "" - ) - } -} - -publishing { - publications { - create("mavenJava") { - artifactId = "mongodb-crypt" - from(components["java"]) - suppressPomMetadataWarningsFor("loggingSupportApiElements") - suppressPomMetadataWarningsFor("loggingSupportRuntimeElements") - - artifact(tasks["sourcesJar"]) - artifact(tasks["javadocJar"]) - - pom { - name.set("MongoCrypt") - description.set(project.description) - url.set("http://www.mongodb.org") - licenses { - license { - name.set("The Apache License, Version 2.0") - url.set("http://www.apache.org/licenses/LICENSE-2.0.txt") - } - } - developers { - developer { - id.set("Various") - organization.set("MongoDB") - } - } - scm { - url.set("https://github.com/mongodb/libmongocrypt") - connection.set("scm:https://github.com/mongodb/libmongocrypt") - developerConnection.set("scm:git@github.com:mongodb/libmongocrypt") - } - } - } - } - - repositories { - maven { - val snapshotsRepoUrl = URI("https://oss.sonatype.org/content/repositories/snapshots/") - val releasesRepoUrl = URI("https://oss.sonatype.org/service/local/staging/deploy/maven2/") - url = if (version.toString().endsWith("SNAPSHOT")) snapshotsRepoUrl else releasesRepoUrl - credentials { - val nexusUsername: String? by project - val nexusPassword: String? by project - username = nexusUsername ?: "" - password = nexusPassword ?: "" - } - } - } -} - -signing { - sign(publishing.publications["mavenJava"]) -} - -tasks.javadoc { - if (JavaVersion.current().isJava9Compatible) { - (options as StandardJavadocDocletOptions).addBooleanOption("html5", true) - } -} - -tasks.register("publishToSonatype") { - group = "publishing" - description = """Publishes to Sonatype. - | - | - If the version string ends with SNAPSHOT then publishes to the Snapshots repo. - | Note: Uses the JNA libs from the current build. - | - | - If is a release then publishes the release to maven central staging. - | A release is when the current git tag is prefixed with java (eg: java-1.7.0) - | AND the git tag version matches the version the build.gradle.kts. - | Note: Uses the JNA libs from the associated tag. - | Eg: Tag java-1.7.0 will use the JNA libs created by the 1.7.0 release tag. - | - | To override the JNA library downloaded use -DgitRevision= - """.trimMargin() - val isSnapshot = version.toString().endsWith("-SNAPSHOT") - val isRelease = isSnapshot || (isJavaTag && gitVersion == version) - - doFirst { - if (isSnapshot && isJavaTag) { - throw GradleException(""" - | Invalid Release - | =============== - | - | Version: $version - | GitVersion: $gitVersion - | isJavaTag: $isJavaTag - | - |""".trimMargin()) - } - - if (isRelease) { - println("Publishing: ${project.name} : $gitVersion") - } else { - println(""" - | Not a Java release: - | - | Version: - | ======== - | - | $gitDescribe - | - | The project version does not match the git tag. - |""".trimMargin()) - } - } - - if (isRelease) { - dependsOn("downloadJnaLibs") - finalizedBy(tasks.withType()) - tasks.withType().forEach { t -> t.mustRunAfter("downloadJnaLibs", "downloadJava", "unzipJava") } - } -} - - -/* -For security we allow the signing-related project properties to be passed in as environment variables, which -Gradle enables if they are prefixed with "ORG_GRADLE_PROJECT_". But since environment variables can not contain -the '.' character and the signing-related properties contain '.', here we map signing-related project properties with '_' -to ones with '.' that are expected by the signing plugin. -*/ -gradle.taskGraph.whenReady { - if (allTasks.any { it is Sign }) { - val signing_keyId: String? by project - val signing_secretKeyRingFile: String? by project - val signing_password: String? by project - - allprojects { - signing_keyId?.let { extra["signing.keyId"] = it } - signing_secretKeyRingFile?.let { extra["signing.secretKeyRingFile"] = it } - signing_password?.let { extra["signing.password"] = it } - } - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/gradle/wrapper/gradle-wrapper.jar b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/gradle/wrapper/gradle-wrapper.jar deleted file mode 100644 index 41d9927a4d4fb3f96a785543079b8df6723c946b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 59821 zcma&NV|1p`(k7gaZQHhOJ9%QKV?D8LCmq{1JGRYE(y=?XJw0>InKkE~^UnAEs2gk5 zUVGPCwX3dOb!}xiFmPB95NK!+5D<~S0s;d1zn&lrfAn7 zC?Nb-LFlib|DTEqB8oDS5&$(u1<5;wsY!V`2F7^=IR@I9so5q~=3i_(hqqG<9SbL8Q(LqDrz+aNtGYWGJ2;p*{a-^;C>BfGzkz_@fPsK8{pTT~_VzB$E`P@> z7+V1WF2+tSW=`ZRj3&0m&d#x_lfXq`bb-Y-SC-O{dkN2EVM7@!n|{s+2=xSEMtW7( zz~A!cBpDMpQu{FP=y;sO4Le}Z)I$wuFwpugEY3vEGfVAHGqZ-<{vaMv-5_^uO%a{n zE_Zw46^M|0*dZ`;t%^3C19hr=8FvVdDp1>SY>KvG!UfD`O_@weQH~;~W=fXK_!Yc> z`EY^PDJ&C&7LC;CgQJeXH2 zjfM}2(1i5Syj)Jj4EaRyiIl#@&lC5xD{8hS4Wko7>J)6AYPC-(ROpVE-;|Z&u(o=X z2j!*>XJ|>Lo+8T?PQm;SH_St1wxQPz)b)Z^C(KDEN$|-6{A>P7r4J1R-=R7|FX*@! zmA{Ja?XE;AvisJy6;cr9Q5ovphdXR{gE_7EF`ji;n|RokAJ30Zo5;|v!xtJr+}qbW zY!NI6_Wk#6pWFX~t$rAUWi?bAOv-oL6N#1>C~S|7_e4 zF}b9(&a*gHk+4@J26&xpiWYf2HN>P;4p|TD4f586umA2t@cO1=Fx+qd@1Ae#Le>{-?m!PnbuF->g3u)7(n^llJfVI%Q2rMvetfV5 z6g|sGf}pV)3_`$QiKQnqQ<&ghOWz4_{`rA1+7*M0X{y(+?$|{n zs;FEW>YzUWg{sO*+D2l6&qd+$JJP_1Tm;To<@ZE%5iug8vCN3yH{!6u5Hm=#3HJ6J zmS(4nG@PI^7l6AW+cWAo9sFmE`VRcM`sP7X$^vQY(NBqBYU8B|n-PrZdNv8?K?kUTT3|IE`-A8V*eEM2=u*kDhhKsmVPWGns z8QvBk=BPjvu!QLtlF0qW(k+4i+?H&L*qf262G#fks9}D5-L{yiaD10~a;-j!p!>5K zl@Lh+(9D{ePo_S4F&QXv|q_yT`GIPEWNHDD8KEcF*2DdZD;=J6u z|8ICSoT~5Wd!>g%2ovFh`!lTZhAwpIbtchDc{$N%<~e$E<7GWsD42UdJh1fD($89f2on`W`9XZJmr*7lRjAA8K0!(t8-u>2H*xn5cy1EG{J;w;Q-H8Yyx+WW(qoZZM7p(KQx^2-yI6Sw?k<=lVOVwYn zY*eDm%~=|`c{tUupZ^oNwIr!o9T;H3Fr|>NE#By8SvHb&#;cyBmY1LwdXqZwi;qn8 zK+&z{{95(SOPXAl%EdJ3jC5yV^|^}nOT@M0)|$iOcq8G{#*OH7=DlfOb; z#tRO#tcrc*yQB5!{l5AF3(U4>e}nEvkoE_XCX=a3&A6Atwnr&`r&f2d%lDr8f?hBB zr1dKNypE$CFbT9I?n){q<1zHmY>C=5>9_phi79pLJG)f=#dKdQ7We8emMjwR*qIMF zE_P-T*$hX#FUa%bjv4Vm=;oxxv`B*`weqUn}K=^TXjJG=UxdFMSj-QV6fu~;- z|IsUq`#|73M%Yn;VHJUbt<0UHRzbaF{X@76=8*-IRx~bYgSf*H(t?KH=?D@wk*E{| z2@U%jKlmf~C^YxD=|&H?(g~R9-jzEb^y|N5d`p#2-@?BUcHys({pUz4Zto7XwKq2X zSB~|KQGgv_Mh@M!*{nl~2~VV_te&E7K39|WYH zCxfd|v_4!h$Ps2@atm+gj14Ru)DhivY&(e_`eA)!O1>nkGq|F-#-6oo5|XKEfF4hR z%{U%ar7Z8~B!foCd_VRHr;Z1c0Et~y8>ZyVVo9>LLi(qb^bxVkbq-Jq9IF7!FT`(- zTMrf6I*|SIznJLRtlP)_7tQ>J`Um>@pP=TSfaPB(bto$G1C zx#z0$=zNpP-~R);kM4O)9Mqn@5Myv5MmmXOJln312kq#_94)bpSd%fcEo7cD#&|<` zrcal$(1Xv(nDEquG#`{&9Ci~W)-zd_HbH-@2F6+|a4v}P!w!Q*h$#Zu+EcZeY>u&?hn#DCfC zVuye5@Ygr+T)0O2R1*Hvlt>%rez)P2wS}N-i{~IQItGZkp&aeY^;>^m7JT|O^{`78 z$KaK0quwcajja;LU%N|{`2o&QH@u%jtH+j!haGj;*ZCR*`UgOXWE>qpXqHc?g&vA& zt-?_g8k%ZS|D;()0Lf!>7KzTSo-8hUh%OA~i76HKRLudaNiwo*E9HxmzN4y>YpZNO zUE%Q|H_R_UmX=*f=2g=xyP)l-DP}kB@PX|(Ye$NOGN{h+fI6HVw`~Cd0cKqO;s6aiYLy7sl~%gs`~XaL z^KrZ9QeRA{O*#iNmB7_P!=*^pZiJ5O@iE&X2UmUCPz!)`2G3)5;H?d~3#P|)O(OQ_ zua+ZzwWGkWflk4j^Lb=x56M75_p9M*Q50#(+!aT01y80x#rs9##!;b-BH?2Fu&vx} za%4!~GAEDsB54X9wCF~juV@aU}fp_(a<`Ig0Pip8IjpRe#BR?-niYcz@jI+QY zBU9!8dAfq@%p;FX)X=E7?B=qJJNXlJ&7FBsz;4&|*z{^kEE!XbA)(G_O6I9GVzMAF z8)+Un(6od`W7O!!M=0Z)AJuNyN8q>jNaOdC-zAZ31$Iq%{c_SYZe+(~_R`a@ zOFiE*&*o5XG;~UjsuW*ja-0}}rJdd@^VnQD!z2O~+k-OSF%?hqcFPa4e{mV1UOY#J zTf!PM=KMNAzbf(+|AL%K~$ahX0Ol zbAxKu3;v#P{Qia{_WzHl`!@!8c#62XSegM{tW1nu?Ee{sQq(t{0TSq67YfG;KrZ$n z*$S-+R2G?aa*6kRiTvVxqgUhJ{ASSgtepG3hb<3hlM|r>Hr~v_DQ>|Nc%&)r0A9go z&F3Ao!PWKVq~aWOzLQIy&R*xo>}{UTr}?`)KS&2$3NR@a+>+hqK*6r6Uu-H};ZG^| zfq_Vl%YE1*uGwtJ>H*Y(Q9E6kOfLJRlrDNv`N;jnag&f<4#UErM0ECf$8DASxMFF& zK=mZgu)xBz6lXJ~WZR7OYw;4&?v3Kk-QTs;v1r%XhgzSWVf|`Sre2XGdJb}l1!a~z zP92YjnfI7OnF@4~g*LF>G9IZ5c+tifpcm6#m)+BmnZ1kz+pM8iUhwag`_gqr(bnpy zl-noA2L@2+?*7`ZO{P7&UL~ahldjl`r3=HIdo~Hq#d+&Q;)LHZ4&5zuDNug@9-uk; z<2&m#0Um`s=B}_}9s&70Tv_~Va@WJ$n~s`7tVxi^s&_nPI0`QX=JnItlOu*Tn;T@> zXsVNAHd&K?*u~a@u8MWX17VaWuE0=6B93P2IQ{S$-WmT+Yp!9eA>@n~=s>?uDQ4*X zC(SxlKap@0R^z1p9C(VKM>nX8-|84nvIQJ-;9ei0qs{}X>?f%&E#%-)Bpv_p;s4R+ z;PMpG5*rvN&l;i{^~&wKnEhT!S!LQ>udPzta#Hc9)S8EUHK=%x+z@iq!O{)*XM}aI zBJE)vokFFXTeG<2Pq}5Na+kKnu?Ch|YoxdPb&Z{07nq!yzj0=xjzZj@3XvwLF0}Pa zn;x^HW504NNfLY~w!}5>`z=e{nzGB>t4ntE>R}r7*hJF3OoEx}&6LvZz4``m{AZxC zz6V+^73YbuY>6i9ulu)2`ozP(XBY5n$!kiAE_Vf4}Ih)tlOjgF3HW|DF+q-jI_0p%6Voc^e;g28* z;Sr4X{n(X7eEnACWRGNsHqQ_OfWhAHwnSQ87@PvPcpa!xr9`9+{QRn;bh^jgO8q@v zLekO@-cdc&eOKsvXs-eMCH8Y{*~3Iy!+CANy+(WXYS&6XB$&1+tB?!qcL@@) zS7XQ|5=o1fr8yM7r1AyAD~c@Mo`^i~hjx{N17%pDX?j@2bdBEbxY}YZxz!h#)q^1x zpc_RnoC3`V?L|G2R1QbR6pI{Am?yW?4Gy`G-xBYfebXvZ=(nTD7u?OEw>;vQICdPJBmi~;xhVV zisVvnE!bxI5|@IIlDRolo_^tc1{m)XTbIX^<{TQfsUA1Wv(KjJED^nj`r!JjEA%MaEGqPB z9YVt~ol3%e`PaqjZt&-)Fl^NeGmZ)nbL;92cOeLM2H*r-zA@d->H5T_8_;Jut0Q_G zBM2((-VHy2&eNkztIpHk&1H3M3@&wvvU9+$RO%fSEa_d5-qZ!<`-5?L9lQ1@AEpo* z3}Zz~R6&^i9KfRM8WGc6fTFD%PGdruE}`X$tP_*A)_7(uI5{k|LYc-WY*%GJ6JMmw zNBT%^E#IhekpA(i zcB$!EB}#>{^=G%rQ~2;gbObT9PQ{~aVx_W6?(j@)S$&Ja1s}aLT%A*mP}NiG5G93- z_DaRGP77PzLv0s32{UFm##C2LsU!w{vHdKTM1X)}W%OyZ&{3d^2Zu-zw?fT=+zi*q z^fu6CXQ!i?=ljsqSUzw>g#PMk>(^#ejrYp(C)7+@Z1=Mw$Rw!l8c9}+$Uz;9NUO(kCd#A1DX4Lbis0k; z?~pO(;@I6Ajp}PL;&`3+;OVkr3A^dQ(j?`by@A!qQam@_5(w6fG>PvhO`#P(y~2ue zW1BH_GqUY&>PggMhhi@8kAY;XWmj>y1M@c`0v+l~l0&~Kd8ZSg5#46wTLPo*Aom-5 z>qRXyWl}Yda=e@hJ%`x=?I42(B0lRiR~w>n6p8SHN~B6Y>W(MOxLpv>aB)E<1oEcw z%X;#DJpeDaD;CJRLX%u!t23F|cv0ZaE183LXxMq*uWn)cD_ zp!@i5zsmcxb!5uhp^@>U;K>$B|8U@3$65CmhuLlZ2(lF#hHq-<<+7ZN9m3-hFAPgA zKi;jMBa*59ficc#TRbH_l`2r>z(Bm_XEY}rAwyp~c8L>{A<0@Q)j*uXns^q5z~>KI z)43=nMhcU1ZaF;CaBo>hl6;@(2#9yXZ7_BwS4u>gN%SBS<;j{{+p}tbD8y_DFu1#0 zx)h&?`_`=ti_6L>VDH3>PPAc@?wg=Omdoip5j-2{$T;E9m)o2noyFW$5dXb{9CZ?c z);zf3U526r3Fl+{82!z)aHkZV6GM@%OKJB5mS~JcDjieFaVn}}M5rtPnHQVw0Stn- zEHs_gqfT8(0b-5ZCk1%1{QQaY3%b>wU z7lyE?lYGuPmB6jnMI6s$1uxN{Tf_n7H~nKu+h7=%60WK-C&kEIq_d4`wU(*~rJsW< zo^D$-(b0~uNVgC+$J3MUK)(>6*k?92mLgpod{Pd?{os+yHr&t+9ZgM*9;dCQBzE!V zk6e6)9U6Bq$^_`E1xd}d;5O8^6?@bK>QB&7l{vAy^P6FOEO^l7wK4K=lLA45gQ3$X z=$N{GR1{cxO)j;ZxKI*1kZIT9p>%FhoFbRK;M(m&bL?SaN zzkZS9xMf={o@gpG%wE857u@9dq>UKvbaM1SNtMA9EFOp7$BjJQVkIm$wU?-yOOs{i z1^(E(WwZZG{_#aIzfpGc@g5-AtK^?Q&vY#CtVpfLbW?g0{BEX4Vlk(`AO1{-D@31J zce}#=$?Gq+FZG-SD^z)-;wQg9`qEO}Dvo+S9*PUB*JcU)@S;UVIpN7rOqXmEIerWo zP_lk!@RQvyds&zF$Rt>N#_=!?5{XI`Dbo0<@>fIVgcU*9Y+ z)}K(Y&fdgve3ruT{WCNs$XtParmvV;rjr&R(V&_#?ob1LzO0RW3?8_kSw)bjom#0; zeNllfz(HlOJw012B}rgCUF5o|Xp#HLC~of%lg+!pr(g^n;wCX@Yk~SQOss!j9f(KL zDiI1h#k{po=Irl)8N*KU*6*n)A8&i9Wf#7;HUR^5*6+Bzh;I*1cICa|`&`e{pgrdc zs}ita0AXb$c6{tu&hxmT0faMG0GFc)unG8tssRJd%&?^62!_h_kn^HU_kBgp$bSew zqu)M3jTn;)tipv9Wt4Ll#1bmO2n?^)t^ZPxjveoOuK89$oy4(8Ujw{nd*Rs*<+xFi z{k*9v%sl?wS{aBSMMWdazhs0#gX9Has=pi?DhG&_0|cIyRG7c`OBiVG6W#JjYf7-n zIQU*Jc+SYnI8oG^Q8So9SP_-w;Y00$p5+LZ{l+81>v7|qa#Cn->312n=YQd$PaVz8 zL*s?ZU*t-RxoR~4I7e^c!8TA4g>w@R5F4JnEWJpy>|m5la2b#F4d*uoz!m=i1;`L` zB(f>1fAd~;*wf%GEbE8`EA>IO9o6TdgbIC%+en!}(C5PGYqS0{pa?PD)5?ds=j9{w za9^@WBXMZ|D&(yfc~)tnrDd#*;u;0?8=lh4%b-lFPR3ItwVJp};HMdEw#SXg>f-zU zEiaj5H=jzRSy(sWVd%hnLZE{SUj~$xk&TfheSch#23)YTcjrB+IVe0jJqsdz__n{- zC~7L`DG}-Dgrinzf7Jr)e&^tdQ}8v7F+~eF*<`~Vph=MIB|YxNEtLo1jXt#9#UG5` zQ$OSk`u!US+Z!=>dGL>%i#uV<5*F?pivBH@@1idFrzVAzttp5~>Y?D0LV;8Yv`wAa{hewVjlhhBM z_mJhU9yWz9Jexg@G~dq6EW5^nDXe(sU^5{}qbd0*yW2Xq6G37f8{{X&Z>G~dUGDFu zgmsDDZZ5ZmtiBw58CERFPrEG>*)*`_B75!MDsOoK`T1aJ4GZ1avI?Z3OX|Hg?P(xy zSPgO$alKZuXd=pHP6UZy0G>#BFm(np+dekv0l6gd=36FijlT8^kI5; zw?Z*FPsibF2d9T$_L@uX9iw*>y_w9HSh8c=Rm}f>%W+8OS=Hj_wsH-^actull3c@!z@R4NQ4qpytnwMaY z)>!;FUeY?h2N9tD(othc7Q=(dF zZAX&Y1ac1~0n(z}!9{J2kPPnru1?qteJPvA2m!@3Zh%+f1VQt~@leK^$&ZudOpS!+ zw#L0usf!?Df1tB?9=zPZ@q2sG!A#9 zKZL`2cs%|Jf}wG=_rJkwh|5Idb;&}z)JQuMVCZSH9kkG%zvQO01wBN)c4Q`*xnto3 zi7TscilQ>t_SLij{@Fepen*a(`upw#RJAx|JYYXvP1v8f)dTHv9pc3ZUwx!0tOH?c z^Hn=gfjUyo!;+3vZhxNE?LJgP`qYJ`J)umMXT@b z{nU(a^xFfofcxfHN-!Jn*{Dp5NZ&i9#9r{)s^lUFCzs5LQL9~HgxvmU#W|iNs0<3O z%Y2FEgvts4t({%lfX1uJ$w{JwfpV|HsO{ZDl2|Q$-Q?UJd`@SLBsMKGjFFrJ(s?t^ z2Llf`deAe@YaGJf)k2e&ryg*m8R|pcjct@rOXa=64#V9!sp=6tC#~QvYh&M~zmJ;% zr*A}V)Ka^3JE!1pcF5G}b&jdrt;bM^+J;G^#R08x@{|ZWy|547&L|k6)HLG|sN<~o z?y`%kbfRN_vc}pwS!Zr}*q6DG7;be0qmxn)eOcD%s3Wk`=@GM>U3ojhAW&WRppi0e zudTj{ufwO~H7izZJmLJD3uPHtjAJvo6H=)&SJ_2%qRRECN#HEU_RGa(Pefk*HIvOH zW7{=Tt(Q(LZ6&WX_Z9vpen}jqge|wCCaLYpiw@f_%9+-!l{kYi&gT@Cj#D*&rz1%e z@*b1W13bN8^j7IpAi$>`_0c!aVzLe*01DY-AcvwE;kW}=Z{3RJLR|O~^iOS(dNEnL zJJ?Dv^ab++s2v!4Oa_WFDLc4fMspglkh;+vzg)4;LS{%CR*>VwyP4>1Tly+!fA-k? z6$bg!*>wKtg!qGO6GQ=cAmM_RC&hKg$~(m2LdP{{*M+*OVf07P$OHp*4SSj9H;)1p z^b1_4p4@C;8G7cBCB6XC{i@vTB3#55iRBZiml^jc4sYnepCKUD+~k}TiuA;HWC6V3 zV{L5uUAU9CdoU+qsFszEwp;@d^!6XnX~KI|!o|=r?qhs`(-Y{GfO4^d6?8BC0xonf zKtZc1C@dNu$~+p#m%JW*J7alfz^$x`U~)1{c7svkIgQ3~RK2LZ5;2TAx=H<4AjC8{ z;)}8OfkZy7pSzVsdX|wzLe=SLg$W1+`Isf=o&}npxWdVR(i8Rr{uzE516a@28VhVr zVgZ3L&X(Q}J0R2{V(}bbNwCDD5K)<5h9CLM*~!xmGTl{Mq$@;~+|U*O#nc^oHnFOy z9Kz%AS*=iTBY_bSZAAY6wXCI?EaE>8^}WF@|}O@I#i69ljjWQPBJVk zQ_rt#J56_wGXiyItvAShJpLEMtW_)V5JZAuK#BAp6bV3K;IkS zK0AL(3ia99!vUPL#j>?<>mA~Q!mC@F-9I$9Z!96ZCSJO8FDz1SP3gF~m`1c#y!efq8QN}eHd+BHwtm%M5586jlU8&e!CmOC z^N_{YV$1`II$~cTxt*dV{-yp61nUuX5z?N8GNBuZZR}Uy_Y3_~@Y3db#~-&0TX644OuG^D3w_`?Yci{gTaPWST8`LdE)HK5OYv>a=6B%R zw|}>ngvSTE1rh`#1Rey0?LXTq;bCIy>TKm^CTV4BCSqdpx1pzC3^ca*S3fUBbKMzF z6X%OSdtt50)yJw*V_HE`hnBA)1yVN3Ruq3l@lY;%Bu+Q&hYLf_Z@fCUVQY-h4M3)- zE_G|moU)Ne0TMjhg?tscN7#ME6!Rb+y#Kd&-`!9gZ06o3I-VX1d4b1O=bpRG-tDK0 zSEa9y46s7QI%LmhbU3P`RO?w#FDM(}k8T`&>OCU3xD=s5N7}w$GntXF;?jdVfg5w9OR8VPxp5{uw zD+_;Gb}@7Vo_d3UV7PS65%_pBUeEwX_Hwfe2e6Qmyq$%0i8Ewn%F7i%=CNEV)Qg`r|&+$ zP6^Vl(MmgvFq`Zb715wYD>a#si;o+b4j^VuhuN>+sNOq6Qc~Y;Y=T&!Q4>(&^>Z6* zwliz!_16EDLTT;v$@W(s7s0s zi*%p>q#t)`S4j=Ox_IcjcllyT38C4hr&mlr6qX-c;qVa~k$MG;UqdnzKX0wo0Xe-_)b zrHu1&21O$y5828UIHI@N;}J@-9cpxob}zqO#!U%Q*ybZ?BH#~^fOT_|8&xAs_rX24 z^nqn{UWqR?MlY~klh)#Rz-*%&e~9agOg*fIN`P&v!@gcO25Mec23}PhzImkdwVT|@ zFR9dYYmf&HiUF4xO9@t#u=uTBS@k*97Z!&hu@|xQnQDkLd!*N`!0JN7{EUoH%OD85 z@aQ2(w-N)1_M{;FV)C#(a4p!ofIA3XG(XZ2E#%j_(=`IWlJAHWkYM2&(+yY|^2TB0 z>wfC-+I}`)LFOJ%KeBb1?eNxGKeq?AI_eBE!M~$wYR~bB)J3=WvVlT8ZlF2EzIFZt zkaeyj#vmBTGkIL9mM3cEz@Yf>j=82+KgvJ-u_{bBOxE5zoRNQW3+Ahx+eMGem|8xo zL3ORKxY_R{k=f~M5oi-Z>5fgqjEtzC&xJEDQ@`<)*Gh3UsftBJno-y5Je^!D?Im{j za*I>RQ=IvU@5WKsIr?kC$DT+2bgR>8rOf3mtXeMVB~sm%X7W5`s=Tp>FR544tuQ>9qLt|aUSv^io&z93luW$_OYE^sf8DB?gx z4&k;dHMWph>Z{iuhhFJr+PCZ#SiZ9e5xM$A#0yPtVC>yk&_b9I676n|oAH?VeTe*1 z@tDK}QM-%J^3Ns6=_vh*I8hE?+=6n9nUU`}EX|;Mkr?6@NXy8&B0i6h?7%D=%M*Er zivG61Wk7e=v;<%t*G+HKBqz{;0Biv7F+WxGirONRxJij zon5~(a`UR%uUzfEma99QGbIxD(d}~oa|exU5Y27#4k@N|=hE%Y?Y3H%rcT zHmNO#ZJ7nPHRG#y-(-FSzaZ2S{`itkdYY^ZUvyw<7yMBkNG+>$Rfm{iN!gz7eASN9-B3g%LIEyRev|3)kSl;JL zX7MaUL_@~4ot3$woD0UA49)wUeu7#lj77M4ar8+myvO$B5LZS$!-ZXw3w;l#0anYz zDc_RQ0Ome}_i+o~H=CkzEa&r~M$1GC!-~WBiHiDq9Sdg{m|G?o7g`R%f(Zvby5q4; z=cvn`M>RFO%i_S@h3^#3wImmWI4}2x4skPNL9Am{c!WxR_spQX3+;fo!y(&~Palyjt~Xo0uy6d%sX&I`e>zv6CRSm)rc^w!;Y6iVBb3x@Y=`hl9jft zXm5vilB4IhImY5b->x{!MIdCermpyLbsalx8;hIUia%*+WEo4<2yZ6`OyG1Wp%1s$ zh<|KrHMv~XJ9dC8&EXJ`t3ETz>a|zLMx|MyJE54RU(@?K&p2d#x?eJC*WKO9^d17# zdTTKx-Os3k%^=58Sz|J28aCJ}X2-?YV3T7ee?*FoDLOC214J4|^*EX`?cy%+7Kb3(@0@!Q?p zk>>6dWjF~y(eyRPqjXqDOT`4^Qv-%G#Zb2G?&LS-EmO|ixxt79JZlMgd^~j)7XYQ; z62rGGXA=gLfgy{M-%1gR87hbhxq-fL)GSfEAm{yLQP!~m-{4i_jG*JsvUdqAkoc#q6Yd&>=;4udAh#?xa2L z7mFvCjz(hN7eV&cyFb%(U*30H@bQ8-b7mkm!=wh2|;+_4vo=tyHPQ0hL=NR`jbsSiBWtG ztMPPBgHj(JTK#0VcP36Z`?P|AN~ybm=jNbU=^3dK=|rLE+40>w+MWQW%4gJ`>K!^- zx4kM*XZLd(E4WsolMCRsdvTGC=37FofIyCZCj{v3{wqy4OXX-dZl@g`Dv>p2`l|H^ zS_@(8)7gA62{Qfft>vx71stILMuyV4uKb7BbCstG@|e*KWl{P1$=1xg(7E8MRRCWQ1g)>|QPAZot~|FYz_J0T+r zTWTB3AatKyUsTXR7{Uu) z$1J5SSqoJWt(@@L5a)#Q6bj$KvuC->J-q1!nYS6K5&e7vNdtj- zj9;qwbODLgIcObqNRGs1l{8>&7W?BbDd!87=@YD75B2ep?IY|gE~t)$`?XJ45MG@2 zz|H}f?qtEb_p^Xs$4{?nA=Qko3Lc~WrAS`M%9N60FKqL7XI+v_5H-UDiCbRm`fEmv z$pMVH*#@wQqml~MZe+)e4Ts3Gl^!Z0W3y$;|9hI?9(iw29b7en0>Kt2pjFXk@!@-g zTb4}Kw!@u|V!wzk0|qM*zj$*-*}e*ZXs#Y<6E_!BR}3^YtjI_byo{F+w9H9?f%mnBh(uE~!Um7)tgp2Ye;XYdVD95qt1I-fc@X zXHM)BfJ?^g(s3K|{N8B^hamrWAW|zis$`6|iA>M-`0f+vq(FLWgC&KnBDsM)_ez1# zPCTfN8{s^K`_bum2i5SWOn)B7JB0tzH5blC?|x;N{|@ch(8Uy-O{B2)OsfB$q0@FR z27m3YkcVi$KL;;4I*S;Z#6VfZcZFn!D2Npv5pio)sz-`_H*#}ROd7*y4i(y(YlH<4 zh4MmqBe^QV_$)VvzWgMXFy`M(vzyR2u!xx&%&{^*AcVLrGa8J9ycbynjKR~G6zC0e zlEU>zt7yQtMhz>XMnz>ewXS#{Bulz$6HETn?qD5v3td>`qGD;Y8&RmkvN=24=^6Q@DYY zxMt}uh2cSToMkkIWo1_Lp^FOn$+47JXJ*#q=JaeiIBUHEw#IiXz8cStEsw{UYCA5v_%cF@#m^Y!=+qttuH4u}r6gMvO4EAvjBURtLf& z6k!C|OU@hv_!*qear3KJ?VzVXDKqvKRtugefa7^^MSWl0fXXZR$Xb!b6`eY4A1#pk zAVoZvb_4dZ{f~M8fk3o?{xno^znH1t;;E6K#9?erW~7cs%EV|h^K>@&3Im}c7nm%Y zbLozFrwM&tSNp|46)OhP%MJ(5PydzR>8)X%i3!^L%3HCoCF#Y0#9vPI5l&MK*_ z6G8Y>$`~c)VvQle_4L_AewDGh@!bKkJeEs_NTz(yilnM!t}7jz>fmJb89jQo6~)%% z@GNIJ@AShd&K%UdQ5vR#yT<-goR+D@Tg;PuvcZ*2AzSWN&wW$Xc+~vW)pww~O|6hL zBxX?hOyA~S;3rAEfI&jmMT4f!-eVm%n^KF_QT=>!A<5tgXgi~VNBXqsFI(iI$Tu3x0L{<_-%|HMG4Cn?Xs zq~fvBhu;SDOCD7K5(l&i7Py-;Czx5byV*3y%#-Of9rtz?M_owXc2}$OIY~)EZ&2?r zLQ(onz~I7U!w?B%LtfDz)*X=CscqH!UE=mO?d&oYvtj|(u)^yomS;Cd>Men|#2yuD zg&tf(*iSHyo;^A03p&_j*QXay9d}qZ0CgU@rnFNDIT5xLhC5_tlugv()+w%`7;ICf z>;<#L4m@{1}Og76*e zHWFm~;n@B1GqO8s%=qu)+^MR|jp(ULUOi~v;wE8SB6^mK@adSb=o+A_>Itjn13AF& zDZe+wUF9G!JFv|dpj1#d+}BO~s*QTe3381TxA%Q>P*J#z%( z5*8N^QWxgF73^cTKkkvgvIzf*cLEyyKw)Wf{#$n{uS#(rAA~>TS#!asqQ2m_izXe3 z7$Oh=rR;sdmVx3G)s}eImsb<@r2~5?vcw*Q4LU~FFh!y4r*>~S7slAE6)W3Up2OHr z2R)+O<0kKo<3+5vB}v!lB*`%}gFldc+79iahqEx#&Im@NCQU$@PyCZbcTt?K{;o@4 z312O9GB)?X&wAB}*-NEU zn@6`)G`FhT8O^=Cz3y+XtbwO{5+{4-&?z!esFts-C zypwgI^4#tZ74KC+_IW|E@kMI=1pSJkvg$9G3Va(!reMnJ$kcMiZ=30dTJ%(Ws>eUf z;|l--TFDqL!PZbLc_O(XP0QornpP;!)hdT#Ts7tZ9fcQeH&rhP_1L|Z_ha#JOroe^qcsLi`+AoBWHPM7}gD z+mHuPXd14M?nkp|nu9G8hPk;3=JXE-a204Fg!BK|$MX`k-qPeD$2OOqvF;C(l8wm13?>i(pz7kRyYm zM$IEzf`$}B%ezr!$(UO#uWExn%nTCTIZzq&8@i8sP#6r8 z*QMUzZV(LEWZb)wbmf|Li;UpiP;PlTQ(X4zreD`|`RG!7_wc6J^MFD!A=#K*ze>Jg z?9v?p(M=fg_VB0+c?!M$L>5FIfD(KD5ku*djwCp+5GVIs9^=}kM2RFsxx0_5DE%BF zykxwjWvs=rbi4xKIt!z$&v(`msFrl4n>a%NO_4`iSyb!UiAE&mDa+apc zPe)#!ToRW~rqi2e1bdO1RLN5*uUM@{S`KLJhhY-@TvC&5D(c?a(2$mW-&N%h5IfEM zdFI6`6KJiJQIHvFiG-34^BtO3%*$(-Ht_JU*(KddiUYoM{coadlG&LVvke&*p>Cac z^BPy2Zteiq1@ulw0e)e*ot7@A$RJui0$l^{lsCt%R;$){>zuRv9#w@;m=#d%%TJmm zC#%eFOoy$V)|3*d<OC1iP+4R7D z8FE$E8l2Y?(o-i6wG=BKBh0-I?i3WF%hqdD7VCd;vpk|LFP!Et8$@voH>l>U8BY`Q zC*G;&y6|!p=7`G$*+hxCv!@^#+QD3m>^azyZoLS^;o_|plQaj-wx^ zRV&$HcY~p)2|Zqp0SYU?W3zV87s6JP-@D~$t0 zvd;-YL~JWc*8mtHz_s(cXus#XYJc5zdC=&!4MeZ;N3TQ>^I|Pd=HPjVP*j^45rs(n zzB{U4-44=oQ4rNN6@>qYVMH4|GmMIz#z@3UW-1_y#eNa+Q%(41oJ5i(DzvMO^%|?L z^r_+MZtw0DZ0=BT-@?hUtA)Ijk~Kh-N8?~X5%KnRH7cb!?Yrd8gtiEo!v{sGrQk{X zvV>h{8-DqTyuAxIE(hb}jMVtga$;FIrrKm>ye5t%M;p!jcH1(Bbux>4D#MVhgZGd> z=c=nVb%^9T?iDgM&9G(mV5xShc-lBLi*6RShenDqB%`-2;I*;IHg6>#ovKQ$M}dDb z<$USN%LMqa5_5DR7g7@(oAoQ%!~<1KSQr$rmS{UFQJs5&qBhgTEM_Y7|0Wv?fbP`z z)`8~=v;B)+>Jh`V*|$dTxKe`HTBkho^-!!K#@i{9FLn-XqX&fQcGsEAXp)BV7(`Lk zC{4&+Pe-0&<)C0kAa(MTnb|L;ZB5i|b#L1o;J)+?SV8T*U9$Vxhy}dm3%!A}SK9l_6(#5(e*>8|;4gNKk7o_%m_ zEaS=Z(ewk}hBJ>v`jtR=$pm_Wq3d&DU+6`BACU4%qdhH1o^m8hT2&j<4Z8!v=rMCk z-I*?48{2H*&+r<{2?wp$kh@L@=rj8c`EaS~J>W?)trc?zP&4bsNagS4yafuDoXpi5`!{BVqJ1$ZC3`pf$`LIZ(`0&Ik+!_Xa=NJW`R2 zd#Ntgwz`JVwC4A61$FZ&kP)-{T|rGO59`h#1enAa`cWxRR8bKVvvN6jBzAYePrc&5 z+*zr3en|LYB2>qJp479rEALk5d*X-dfKn6|kuNm;2-U2+P3_rma!nWjZQ-y*q3JS? zBE}zE-!1ZBR~G%v!$l#dZ*$UV4$7q}xct}=on+Ba8{b>Y9h*f-GW0D0o#vJ0%ALg( ztG2+AjWlG#d;myA(i&dh8Gp?y9HD@`CTaDAy?c&0unZ%*LbLIg4;m{Kc?)ws3^>M+ zt5>R)%KIJV*MRUg{0$#nW=Lj{#8?dD$yhjBOrAeR#4$H_Dc(eyA4dNjZEz1Xk+Bqt zB&pPl+?R{w8GPv%VI`x`IFOj320F1=cV4aq0(*()Tx!VVxCjua;)t}gTr=b?zY+U! zkb}xjXZ?hMJN{Hjw?w&?gz8Ow`htX z@}WG*_4<%ff8(!S6bf3)p+8h2!Rory>@aob$gY#fYJ=LiW0`+~l7GI%EX_=8 z{(;0&lJ%9)M9{;wty=XvHbIx|-$g4HFij`J$-z~`mW)*IK^MWVN+*>uTNqaDmi!M8 zurj6DGd)g1g(f`A-K^v)3KSOEoZXImXT06apJum-dO_%oR)z6Bam-QC&CNWh7kLOE zcxLdVjYLNO2V?IXWa-ys30Jbxw(Xm?U1{4kDs9`gZQHh8X{*w9=H&Zz&-6RL?uq#R zxN+k~JaL|gdsdvY_u6}}MHC?a@ElFeipA1Lud#M~)pp2SnG#K{a@tSpvXM;A8gz9> zRVDV5T1%%!LsNRDOw~LIuiAiKcj<%7WpgjP7G6mMU1#pFo6a-1>0I5ZdhxnkMX&#L z=Vm}?SDlb_LArobqpnU!WLQE*yVGWgs^4RRy4rrJwoUUWoA~ZJUx$mK>J6}7{CyC4 zv=8W)kKl7TmAnM%m;anEDPv5tzT{A{ON9#FPYF6c=QIc*OrPp96tiY&^Qs+#A1H>Y z<{XtWt2eDwuqM zQ_BI#UIP;2-olOL4LsZ`vTPv-eILtuB7oWosoSefWdM}BcP>iH^HmimR`G`|+9waCO z&M375o@;_My(qYvPNz;N8FBZaoaw3$b#x`yTBJLc8iIP z--la{bzK>YPP|@Mke!{Km{vT8Z4|#An*f=EmL34?!GJfHaDS#41j~8c5KGKmj!GTh&QIH+DjEI*BdbSS2~6VTt}t zhAwNQNT6%c{G`If3?|~Fp7iwee(LaUS)X9@I29cIb61} z$@YBq4hSplr&liE@ye!y&7+7n$fb+8nS~co#^n@oCjCwuKD61x$5|0ShDxhQES5MP z(gH|FO-s6#$++AxnkQR!3YMgKcF)!&aqr^a3^{gAVT`(tY9@tqgY7@ z>>ul3LYy`R({OY7*^Mf}UgJl(N7yyo$ag;RIpYHa_^HKx?DD`%Vf1D0s^ zjk#OCM5oSzuEz(7X`5u~C-Y~n4B}_3*`5B&8tEdND@&h;H{R`o%IFpIJ4~Kw!kUjehGT8W!CD7?d8sg_$KKp%@*dW)#fI1#R<}kvzBVpaog_2&W%c_jJfP` z6)wE+$3+Hdn^4G}(ymPyasc1<*a7s2yL%=3LgtZLXGuA^jdM^{`KDb%%}lr|ONDsl zy~~jEuK|XJ2y<`R{^F)Gx7DJVMvpT>gF<4O%$cbsJqK1;v@GKXm*9l3*~8^_xj*Gs z=Z#2VQ6`H@^~#5Pv##@CddHfm;lbxiQnqy7AYEH(35pTg^;u&J2xs-F#jGLuDw2%z z`a>=0sVMM+oKx4%OnC9zWdbpq*#5^yM;og*EQKpv`^n~-mO_vj=EgFxYnga(7jO?G z`^C87B4-jfB_RgN2FP|IrjOi;W9AM1qS}9W@&1a9Us>PKFQ9~YE!I~wTbl!m3$Th? z)~GjFxmhyyGxN}t*G#1^KGVXm#o(K0xJyverPe}mS=QgJ$#D}emQDw+dHyPu^&Uv> z4O=3gK*HLFZPBY|!VGq60Of6QrAdj`nj1h!$?&a;Hgaj{oo{l0P3TzpJK_q_eW8Ng zP6QF}1{V;xlolCs?pGegPoCSxx@bshb#3ng4Fkp4!7B0=&+1%187izf@}tvsjZ6{m z4;K>sR5rm97HJrJ`w}Y`-MZN$Wv2N%X4KW(N$v2@R1RkRJH2q1Ozs0H`@ zd5)X-{!{<+4Nyd=hQ8Wm3CCd}ujm*a?L79ztfT7@&(?B|!pU5&%9Rl!`i;suAg0+A zxb&UYpo-z}u6CLIndtH~C|yz&!OV_I*L;H#C7ie_5uB1fNRyH*<^d=ww=gxvE%P$p zRHKI{^{nQlB9nLhp9yj-so1is{4^`{Xd>Jl&;dX;J)#- z=fmE5GiV?-&3kcjM1+XG7&tSq;q9Oi4NUuRrIpoyp*Fn&nVNFdUuGQ_g)g>VzXGdneB7`;!aTUE$t* z5iH+8XPxrYl)vFo~+vmcU-2) zq!6R(T0SsoDnB>Mmvr^k*{34_BAK+I=DAGu){p)(ndZqOFT%%^_y;X(w3q-L``N<6 zw9=M zoQ8Lyp>L_j$T20UUUCzYn2-xdN}{e@$8-3vLDN?GbfJ>7*qky{n!wC#1NcYQr~d51 zy;H!am=EI#*S&TCuP{FA3CO)b0AAiN*tLnDbvKwxtMw-l;G2T@EGH)YU?-B`+Y=!$ zypvDn@5V1Tr~y~U0s$ee2+CL3xm_BmxD3w}d_Pd@S%ft#v~_j;6sC6cy%E|dJy@wj z`+(YSh2CrXMxI;yVy*=O@DE2~i5$>nuzZ$wYHs$y`TAtB-ck4fQ!B8a;M=CxY^Nf{ z+UQhn0jopOzvbl(uZZ1R-(IFaprC$9hYK~b=57@ zAJ8*pH%|Tjotzu5(oxZyCQ{5MAw+6L4)NI!9H&XM$Eui-DIoDa@GpNI=I4}m>Hr^r zZjT?xDOea}7cq+TP#wK1p3}sbMK{BV%(h`?R#zNGIP+7u@dV5#zyMau+w}VC1uQ@p zrFUjrJAx6+9%pMhv(IOT52}Dq{B9njh_R`>&j&5Sbub&r*hf4es)_^FTYdDX$8NRk zMi=%I`)hN@N9>X&Gu2RmjKVsUbU>TRUM`gwd?CrL*0zxu-g#uNNnnicYw=kZ{7Vz3 zULaFQ)H=7%Lm5|Z#k?<{ux{o4T{v-e zTLj?F(_qp{FXUzOfJxEyKO15Nr!LQYHF&^jMMBs z`P-}WCyUYIv>K`~)oP$Z85zZr4gw>%aug1V1A)1H(r!8l&5J?ia1x_}Wh)FXTxZUE zs=kI}Ix2cK%Bi_Hc4?mF^m`sr6m8M(n?E+k7Tm^Gn}Kf= zfnqoyVU^*yLypz?s+-XV5(*oOBwn-uhwco5b(@B(hD|vtT8y7#W{>RomA_KchB&Cd zcFNAD9mmqR<341sq+j+2Ra}N5-3wx5IZqg6Wmi6CNO#pLvYPGNER}Q8+PjvIJ42|n zc5r@T*p)R^U=d{cT2AszQcC6SkWiE|hdK)m{7ul^mU+ED1R8G#)#X}A9JSP_ubF5p z8Xxcl;jlGjPwow^p+-f_-a~S;$lztguPE6SceeUCfmRo=Qg zKHTY*O_ z;pXl@z&7hniVYVbGgp+Nj#XP^Aln2T!D*{(Td8h{8Dc?C)KFfjPybiC`Va?Rf)X>y z;5?B{bAhPtbmOMUsAy2Y0RNDQ3K`v`gq)#ns_C&ec-)6cq)d^{5938T`Sr@|7nLl; zcyewuiSUh7Z}q8iIJ@$)L3)m)(D|MbJm_h&tj^;iNk%7K-YR}+J|S?KR|29K?z-$c z<+C4uA43yfSWBv*%z=-0lI{ev`C6JxJ};A5N;lmoR(g{4cjCEn33 z-ef#x^uc%cM-f^_+*dzE?U;5EtEe;&8EOK^K}xITa?GH`tz2F9N$O5;)`Uof4~l+t z#n_M(KkcVP*yMYlk_~5h89o zlf#^qjYG8Wovx+f%x7M7_>@r7xaXa2uXb?_*=QOEe_>ErS(v5-i)mrT3&^`Oqr4c9 zDjP_6T&NQMD`{l#K&sHTm@;}ed_sQ88X3y`ON<=$<8Qq{dOPA&WAc2>EQ+U8%>yWR zK%(whl8tB;{C)yRw|@Gn4%RhT=bbpgMZ6erACc>l5^p)9tR`(2W-D*?Ph6;2=Fr|G- zdF^R&aCqyxqWy#P7#G8>+aUG`pP*ow93N=A?pA=aW0^^+?~#zRWcf_zlKL8q8-80n zqGUm=S8+%4_LA7qrV4Eq{FHm9#9X15%ld`@UKyR7uc1X*>Ebr0+2yCye6b?i=r{MPoqnTnYnq z^?HWgl+G&@OcVx4$(y;{m^TkB5Tnhx2O%yPI=r*4H2f_6Gfyasq&PN^W{#)_Gu7e= zVHBQ8R5W6j;N6P3O(jsRU;hkmLG(Xs_8=F&xh@`*|l{~0OjUVlgm z7opltSHg7Mb%mYamGs*v1-#iW^QMT**f+Nq*AzIvFT~Ur3KTD26OhIw1WQsL(6nGg znHUo-4e15cXBIiyqN};5ydNYJ6zznECVVR44%(P0oW!yQ!YH)FPY?^k{IrtrLo7Zo`?sg%%oMP9E^+H@JLXicr zi?eoI?LODRPcMLl90MH32rf8btf69)ZE~&4d%(&D{C45egC6bF-XQ;6QKkbmqW>_H z{86XDZvjiN2wr&ZPfi;^SM6W+IP0);50m>qBhzx+docpBkkiY@2bSvtPVj~E`CfEu zhQG5G>~J@dni5M5Jmv7GD&@%UR`k3ru-W$$onI259jM&nZ)*d3QFF?Mu?{`+nVzkx z=R*_VH=;yeU?9TzQ3dP)q;P)4sAo&k;{*Eky1+Z!10J<(cJC3zY9>bP=znA=<-0RR zMnt#<9^X7BQ0wKVBV{}oaV=?JA=>R0$az^XE%4WZcA^Em>`m_obQyKbmf-GA;!S-z zK5+y5{xbkdA?2NgZ0MQYF-cfOwV0?3Tzh8tcBE{u%Uy?Ky4^tn^>X}p>4&S(L7amF zpWEio8VBNeZ=l!%RY>oVGOtZh7<>v3?`NcHlYDPUBRzgg z0OXEivCkw<>F(>1x@Zk=IbSOn+frQ^+jI*&qdtf4bbydk-jgVmLAd?5ImK+Sigh?X zgaGUlbf^b-MH2@QbqCawa$H1Vb+uhu{zUG9268pa{5>O&Vq8__Xk5LXDaR1z$g;s~;+Ae82wq#l;wo08tX(9uUX6NJWq1vZLh3QbP$# zL`udY|Qp*4ER`_;$%)2 zmcJLj|FD`(;ts0bD{}Ghq6UAVpEm#>j`S$wHi0-D_|)bEZ}#6) zIiqH7Co;TB`<6KrZi1SF9=lO+>-_3=Hm%Rr7|Zu-EzWLSF{9d(H1v*|UZDWiiqX3} zmx~oQ6%9~$=KjPV_ejzz7aPSvTo+3@-a(OCCoF_u#2dHY&I?`nk zQ@t8#epxAv@t=RUM09u?qnPr6=Y5Pj;^4=7GJ`2)Oq~H)2V)M1sC^S;w?hOB|0zXT zQdf8$)jslO>Q}(4RQ$DPUF#QUJm-k9ysZFEGi9xN*_KqCs9Ng(&<;XONBDe1Joku? z*W!lx(i&gvfXZ4U(AE@)c0FI2UqrFLOO$&Yic|`L;Vyy-kcm49hJ^Mj^H9uY8Fdm2 z?=U1U_5GE_JT;Tx$2#I3rAAs(q@oebIK=19a$N?HNQ4jw0ljtyGJ#D}z3^^Y=hf^Bb--297h6LQxi0-`TB|QY2QPg92TAq$cEQdWE ze)ltSTVMYe0K4wte6;^tE+^>|a>Hit_3QDlFo!3Jd`GQYTwlR#{<^MzG zK!vW&))~RTKq4u29bc<+VOcg7fdorq-kwHaaCQe6tLB{|gW1_W_KtgOD0^$^|`V4C# z*D_S9Dt_DIxpjk3my5cBFdiYaq||#0&0&%_LEN}BOxkb3v*d$4L|S|z z!cZZmfe~_Y`46v=zul=aixZTQCOzb(jx>8&a%S%!(;x{M2!*$od2!Pwfs>RZ-a%GOZdO88rS)ZW~{$656GgW)$Q=@!x;&Nn~!K)lr4gF*%qVO=hlodHA@2)keS2 zC}7O=_64#g&=zY?(zhzFO3)f5=+`dpuyM!Q)zS&otpYB@hhn$lm*iK2DRt+#1n|L%zjM}nB*$uAY^2JIw zV_P)*HCVq%F))^)iaZD#R9n^{sAxBZ?Yvi1SVc*`;8|F2X%bz^+s=yS&AXjysDny)YaU5RMotF-tt~FndTK ziRve_5b!``^ZRLG_ks}y_ye0PKyKQSsQCJuK5()b2ThnKPFU?An4;dK>)T^4J+XjD zEUsW~H?Q&l%K4<1f5^?|?lyCQe(O3?!~OU{_Wxs#|Ff8?a_WPQUKvP7?>1()Cy6oLeA zjEF^d#$6Wb${opCc^%%DjOjll%N2=GeS6D-w=Ap$Ux2+0v#s#Z&s6K*)_h{KFfgKjzO17@p1nKcC4NIgt+3t}&}F z@cV; zZ1r#~?R@ZdSwbFNV(fFl2lWI(Zf#nxa<6f!nBZD>*K)nI&Fun@ngq@Ge!N$O< zySt*mY&0moUXNPe~Fg=%gIu)tJ;asscQ!-AujR@VJBRoNZNk;z4hs4T>Ud!y=1NwGs-k zlTNeBOe}=)Epw=}+dfX;kZ32h$t&7q%Xqdt-&tlYEWc>>c3(hVylsG{Ybh_M8>Cz0ZT_6B|3!_(RwEJus9{;u-mq zW|!`{BCtnao4;kCT8cr@yeV~#rf76=%QQs(J{>Mj?>aISwp3{^BjBO zLV>XSRK+o=oVDBnbv?Y@iK)MiFSl{5HLN@k%SQZ}yhPiu_2jrnI?Kk?HtCv>wN$OM zSe#}2@He9bDZ27hX_fZey=64#SNU#1~=icK`D>a;V-&Km>V6ZdVNj7d2 z-NmAoOQm_aIZ2lXpJhlUeJ95eZt~4_S zIfrDs)S$4UjyxKSaTi#9KGs2P zfSD>(y~r+bU4*#|r`q+be_dopJzKK5JNJ#rR978ikHyJKD>SD@^Bk$~D0*U38Y*IpYcH>aaMdZq|YzQ-Ixd(_KZK!+VL@MWGl zG!k=<%Y-KeqK%``uhx}0#X^@wS+mX@6Ul@90#nmYaKh}?uw>U;GS4fn3|X%AcV@iY z8v+ePk)HxSQ7ZYDtlYj#zJ?5uJ8CeCg3efmc#|a%2=u>+vrGGRg$S@^mk~0f;mIu! zWMA13H1<@hSOVE*o0S5D8y=}RiL#jQpUq42D}vW$z*)VB*FB%C?wl%(3>ANaY)bO@ zW$VFutemwy5Q*&*9HJ603;mJJkB$qp6yxNOY0o_4*y?2`qbN{m&*l{)YMG_QHXXa2 z+hTmlA;=mYwg{Bfusl zyF&}ib2J;#q5tN^e)D62fWW*Lv;Rnb3GO-JVtYG0CgR4jGujFo$Waw zSNLhc{>P~>{KVZE1Vl1!z)|HFuN@J7{`xIp_)6>*5Z27BHg6QIgqLqDJTmKDM+ON* zK0Fh=EG`q13l z+m--9UH0{ZGQ%j=OLO8G2WM*tgfY}bV~>3Grcrpehjj z6Xe<$gNJyD8td3EhkHjpKk}7?k55Tu7?#;5`Qcm~ki;BeOlNr+#PK{kjV>qfE?1No zMA07}b>}Dv!uaS8Hym0TgzxBxh$*RX+Fab6Gm02!mr6u}f$_G4C|^GSXJMniy^b`G z74OC=83m0G7L_dS99qv3a0BU({t$zHQsB-RI_jn1^uK9ka_%aQuE2+~J2o!7`735Z zb?+sTe}Gd??VEkz|KAPMfj(1b{om89p5GIJ^#Aics_6DD%WnNGWAW`I<7jT|Af|8g zZA0^)`p8i#oBvX2|I&`HC8Pn&0>jRuMF4i0s=}2NYLmgkZb=0w9tvpnGiU-gTUQhJ zR6o4W6ZWONuBZAiN77#7;TR1^RKE(>>OL>YU`Yy_;5oj<*}ac99DI(qGCtn6`949f ziMpY4k>$aVfffm{dNH=-=rMg|u?&GIToq-u;@1-W&B2(UOhC-O2N5_px&cF-C^tWp zXvChm9@GXEcxd;+Q6}u;TKy}$JF$B`Ty?|Y3tP$N@Rtoy(*05Wj-Ks32|2y2ZM>bM zi8v8E1os!yorR!FSeP)QxtjIKh=F1ElfR8U7StE#Ika;h{q?b?Q+>%78z^>gTU5+> zxQ$a^rECmETF@Jl8fg>MApu>btHGJ*Q99(tMqsZcG+dZ6Yikx7@V09jWCiQH&nnAv zY)4iR$Ro223F+c3Q%KPyP9^iyzZsP%R%-i^MKxmXQHnW6#6n7%VD{gG$E;7*g86G< zu$h=RN_L2(YHO3@`B<^L(q@^W_0#U%mLC9Q^XEo3LTp*~(I%?P_klu-c~WJxY1zTI z^PqntLIEmdtK~E-v8yc&%U+jVxW5VuA{VMA4Ru1sk#*Srj0Pk#tZuXxkS=5H9?8eb z)t38?JNdP@#xb*yn=<*_pK9^lx%;&yH6XkD6-JXgdddZty8@Mfr9UpGE!I<37ZHUe z_Rd+LKsNH^O)+NW8Ni-V%`@J_QGKA9ZCAMSnsN>Ych9VW zCE7R_1FVy}r@MlkbxZ*TRIGXu`ema##OkqCM9{wkWQJg^%3H${!vUT&vv2250jAWN zw=h)C!b2s`QbWhBMSIYmWqZ_~ReRW;)U#@C&ThctSd_V!=HA=kdGO-Hl57an|M1XC?~3f0{7pyjWY}0mChU z2Fj2(B*r(UpCKm-#(2(ZJD#Y|Or*Vc5VyLpJ8gO1;fCm@EM~{DqpJS5FaZ5%|ALw) zyumBl!i@T57I4ITCFmdbxhaOYud}i!0YkdiNRaQ%5$T5>*HRBhyB~<%-5nj*b8=i= z(8g(LA50%0Zi_eQe}Xypk|bt5e6X{aI^jU2*c?!p*$bGk=?t z+17R){lx~Z{!B34Zip~|A;8l@%*Gc}kT|kC0*Ny$&fI3@%M! zqk_zvN}7bM`x@jqFOtaxI?*^Im5ix@=`QEv;__i;Tek-&7kGm6yP17QANVL>*d0B=4>i^;HKb$k8?DYFMr38IX4azK zBbwjF%$>PqXhJh=*7{zH5=+gi$!nc%SqFZlwRm zmpctOjZh3bwt!Oc>qVJhWQf>`HTwMH2ibK^eE*j!&Z`-bs8=A`Yvnb^?p;5+U=Fb8 z@h>j_3hhazd$y^Z-bt%3%E3vica%nYnLxW+4+?w{%|M_=w^04U{a6^22>M_?{@mXP zS|Qjcn4&F%WN7Z?u&I3fU(UQVw4msFehxR*80dSb=a&UG4zDQp&?r2UGPy@G?0FbY zVUQ?uU9-c;f9z06$O5FO1TOn|P{pLcDGP?rfdt`&uw|(Pm@$n+A?)8 zP$nG(VG&aRU*(_5z#{+yVnntu`6tEq>%9~n^*ao}`F6ph_@6_8|AfAXtFfWee_14` zKKURYV}4}=UJmxv7{RSz5QlwZtzbYQs0;t3?kx*7S%nf-aY&lJ@h?-BAn%~0&&@j) zQd_6TUOLXErJ`A3vE?DJIbLE;s~s%eVt(%fMzUq^UfZV9c?YuhO&6pwKt>j(=2CkgTNEq7&c zfeGN+%5DS@b9HO>zsoRXv@}(EiA|t5LPi}*R3?(-=iASADny<{D0WiQG>*-BSROk4vI6%$R>q64J&v-T+(D<_(b!LD z9GL;DV;;N3!pZYg23mcg81tx>7)=e%f|i{6Mx0GczVpc}{}Mg(W_^=Wh0Rp+xXgX` z@hw|5=Je&nz^Xa>>vclstYt;8c2PY)87Ap;z&S&`yRN>yQVV#K{4&diVR7Rm;S{6m z6<+;jwbm`==`JuC6--u6W7A@o4&ZpJV%5+H)}toy0afF*!)AaG5=pz_i9}@OG%?$O z2cec6#@=%xE3K8;^ps<2{t4SnqH+#607gAHP-G4^+PBiC1s>MXf&bQ|Pa;WBIiErV z?3VFpR9JFl9(W$7p3#xe(Bd?Z93Uu~jHJFo7U3K_x4Ej-=N#=a@f;kPV$>;hiN9i9 z<6elJl?bLI$o=|d6jlihA4~bG;Fm2eEnlGxZL`#H%Cdes>uJfMJ4>@1SGGeQ81DwxGxy7L5 zm05Ik*WpSgZvHh@Wpv|2i|Y#FG?Y$hbRM5ZF0Z7FB3cY0+ei#km9mDSPI}^!<<`vr zuv$SPg2vU{wa)6&QMY)h1hbbxvR2cc_6WcWR`SH& z&KuUQcgu}!iW2Wqvp~|&&LSec9>t(UR_|f$;f-fC&tSO-^-eE0B~Frttnf+XN(#T) z^PsuFV#(pE#6ztaI8(;ywN%CtZh?w&;_)w_s@{JiA-SMjf&pQk+Bw<}f@Q8-xCQMwfaf zMgHsAPU=>>Kw~uDFS(IVRN{$ak(SV(hrO!UqhJ?l{lNnA1>U24!=>|q_p404Xd>M# z7?lh^C&-IfeIr`Dri9If+bc%oU0?|Rh8)%BND5;_9@9tuM)h5Kcw6}$Ca7H_n)nOf0pd`boCXItb`o11 zb`)@}l6I_h>n+;`g+b^RkYs7;voBz&Gv6FLmyvY|2pS)z#P;t8k;lS>49a$XeVDc4 z(tx2Pe3N%Gd(!wM`E7WRBZy)~vh_vRGt&esDa0NCua)rH#_39*H0!gIXpd>~{rGx+ zJKAeXAZ-z5n=mMVqlM5Km;b;B&KSJlScD8n?2t}kS4Wf9@MjIZSJ2R?&=zQn zs_`=+5J$47&mP4s{Y{TU=~O_LzSrXvEP6W?^pz<#Y*6Fxg@$yUGp31d(h+4x>xpb< zH+R639oDST6F*0iH<9NHC^Ep*8D4-%p2^n-kD6YEI<6GYta6-I;V^ZH3n5}syTD=P z3b6z=jBsdP=FlXcUe@I|%=tY4J_2j!EVNEzph_42iO3yfir|Dh>nFl&Lu9!;`!zJB zCis9?_(%DI?$CA(00pkzw^Up`O;>AnPc(uE$C^a9868t$m?5Q)CR%!crI$YZpiYK6m= z!jv}82He`QKF;10{9@roL2Q7CF)OeY{~dBp>J~X#c-Z~{YLAxNmn~kWQW|2u!Yq00 zl5LKbzl39sVCTpm9eDW_T>Z{x@s6#RH|P zA~_lYas7B@SqI`N=>x50Vj@S)QxouKC(f6Aj zz}7e5e*5n?j@GO;mCYEo^Jp_*BmLt3!N)(T>f#L$XHQWzZEVlJo(>qH@7;c%fy zS-jm^Adju9Sm8rOKTxfTU^!&bg2R!7C_-t+#mKb_K?0R72%26ASF;JWA_prJ8_SVW zOSC7C&CpSrgfXRp8r)QK34g<~!1|poTS7F;)NseFsbwO$YfzEeG3oo!qe#iSxQ2S# z1=Fxc9J;2)pCab-9o-m8%BLjf(*mk#JJX3k9}S7Oq)dV0jG)SOMbw7V^Z<5Q0Cy$< z^U0QUVd4(96W03OA1j|x%{sd&BRqIERDb6W{u1p1{J(a;fd6lnWzjeS`d?L3-0#o7 z{Qv&L7!Tm`9|}u=|IbwS_jgH(_V@o`S*R(-XC$O)DVwF~B&5c~m!zl14ydT6sK+Ly zn+}2hQ4RTC^8YvrQ~vk$f9u=pTN{5H_yTOcza9SVE&nt_{`ZC8zkmFji=UyD`G4~f zUfSTR=Kju>6u+y&|Bylb*W&^P|8fvEbQH3+w*DrKq|9xMzq2OiZyM=;(?>~4+O|jn zC_Et05oc>e%}w4ye2Fm%RIR??VvofwZS-}BL@X=_4jdHp}FlMhW_IW?Zh`4$z*Wr!IzQHa3^?1|);~VaWmsIcmc6 zJs{k0YW}OpkfdoTtr4?9F6IX6$!>hhA+^y_y@vvA_Gr7u8T+i-< zDX(~W5W{8mfbbM-en&U%{mINU#Q8GA`byo)iLF7rMVU#wXXY`a3ji3m{4;x53216i z`zA8ap?>_}`tQj7-%$K78uR}R$|@C2)qgop$}o=g(jOv0ishl!E(R73N=i0~%S)6+ z1xFP7|H0yt3Z_Re*_#C2m3_X{=zi1C&3CM7e?9-Y5lCtAlA%RFG9PDD=Quw1dfYnZ zdUL)#+m`hKx@PT`r;mIx_RQ6Txbti+&;xQorP;$H=R2r)gPMO9>l+!p*Mt04VH$$M zSLwJ81IFjQ5N!S#;MyBD^IS`2n04kuYbZ2~4%3%tp0jn^**BZQ05ELp zY%yntZ=52s6U5Y93Aao)v~M3y?6h7mZcVGp63pK*d&!TRjW99rUU;@s#3kYB76Bs$|LRwkH>L!0Xe zE=dz1o}phhnOVYZFsajQsRA^}IYZnk9Wehvo>gHPA=TPI?2A`plIm8=F1%QiHx*Zn zi)*Y@)$aXW0v1J|#+R2=$ysooHZ&NoA|Wa}htd`=Eud!(HD7JlT8ug|yeBZmpry(W z)pS>^1$N#nuo3PnK*>Thmaxz4pLcY?PP2r3AlhJ7jw(TI8V#c}>Ym;$iPaw+83L+* z!_QWpYs{UWYcl0u z(&(bT0Q*S_uUX9$jC;Vk%oUXw=A-1I+!c18ij1CiUlP@pfP9}CHAVm{!P6AEJ(7Dn z?}u#}g`Q?`*|*_0Rrnu8{l4PP?yCI28qC~&zlwgLH2AkfQt1?B#3AOQjW&10%@@)Q zDG?`6$8?Nz(-sChL8mRs#3z^uOA>~G=ZIG*mgUibWmgd{a|Tn4nkRK9O^37E(()Q% zPR0#M4e2Q-)>}RSt1^UOCGuv?dn|IT3#oW_$S(YR+jxAzxCD_L25p_dt|^>g+6Kgj zJhC8n)@wY;Y7JI6?wjU$MQU|_Gw*FIC)x~^Eq1k41BjLmr}U>6#_wxP0-2Ka?uK14u5M-lAFSX$K1K{WH!M1&q}((MWWUp#Uhl#n_yT5dFs4X`>vmM& z*1!p0lACUVqp&sZG1GWATvZEENs^0_7Ymwem~PlFN3hTHVBv(sDuP;+8iH07a)s(# z%a7+p1QM)YkS7>kbo${k2N1&*%jFP*7UABJ2d||c!eSXWM*<4(_uD7;1XFDod@cT$ zP>IC%^fbC${^QrUXy$f)yBwY^g@}}kngZKa1US!lAa+D=G4wklukaY8AEW%GL zh40pnuv*6D>9`_e14@wWD^o#JvxYVG-~P)+<)0fW zP()DuJN?O*3+Ab!CP-tGr8S4;JN-Ye^9D%(%8d{vb_pK#S1z)nZzE^ezD&%L6nYbZ z*62>?u)xQe(Akd=e?vZbyb5)MMNS?RheZDHU?HK<9;PBHdC~r{MvF__%T)-9ifM#cR#2~BjVJYbA>xbPyl9yNX zX)iFVvv-lfm`d?tbfh^j*A|nw)RszyD<#e>llO8X zou=q3$1|M@Ob;F|o4H0554`&y9T&QTa3{yn=w0BLN~l;XhoslF-$4KGNUdRe?-lcV zS4_WmftU*XpP}*wFM^oKT!D%_$HMT#V*j;9weoOq0mjbl1271$F)`Q(C z76*PAw3_TE{vntIkd=|(zw)j^!@j ^tV@s0U~V+mu)vv`xgL$Z9NQLnuRdZ;95D|1)!0Aybwv}XCE#xz1k?ZC zxAU)v@!$Sm*?)t2mWrkevNFbILU9&znoek=d7jn*k+~ptQ)6z`h6e4B&g?Q;IK+aH z)X(BH`n2DOS1#{AJD-a?uL)@Vl+`B=6X3gF(BCm>Q(9+?IMX%?CqgpsvK+b_de%Q> zj-GtHKf!t@p2;Gu*~#}kF@Q2HMevg~?0{^cPxCRh!gdg7MXsS}BLtG_a0IY0G1DVm z2F&O-$Dzzc#M~iN`!j38gAn`6*~h~AP=s_gy2-#LMFoNZ0<3q+=q)a|4}ur7F#><%j1lnr=F42Mbti zi-LYs85K{%NP8wE1*r4Mm+ZuZ8qjovmB;f##!E*M{*A(4^~vg!bblYi1M@7tq^L8- zH7tf_70iWXqcSQgENGdEjvLiSLicUi3l0H*sx=K!!HLxDg^K|s1G}6Tam|KBV>%YeU)Q>zxQe;ddnDTWJZ~^g-kNeycQ?u242mZs`i8cP)9qW`cwqk)Jf?Re0=SD=2z;Gafh(^X-=WJ$i7Z9$Pao56bTwb+?p>L3bi9 zP|qi@;H^1iT+qnNHBp~X>dd=Us6v#FPDTQLb9KTk%z{&OWmkx3uY(c6JYyK3w|z#Q zMY%FPv%ZNg#w^NaW6lZBU+}Znwc|KF(+X0RO~Q6*O{T-P*fi@5cPGLnzWMSyoOPe3 z(J;R#q}3?z5Ve%crTPZQFLTW81cNY-finw!LH9wr$(C)p_@v?(y#b-R^Pv!}_#7t+A?pHEUMY zoQZIwSETTKeS!W{H$lyB1^!jn4gTD{_mgG?#l1Hx2h^HrpCXo95f3utP-b&%w80F} zXFs@Jp$lbIL64@gc?k*gJ;OForPaapOH7zNMB60FdNP<*9<@hEXJk9Rt=XhHR-5_$Ck-R?+1py&J3Y9^sBBZuj?GwSzua;C@9)@JZpaI zE?x6{H8@j9P06%K_m%9#nnp0Li;QAt{jf-7X%Pd2jHoI4As-9!UR=h6Rjc z!3{UPWiSeLG&>1V5RlM@;5HhQW_&-wL2?%k@dvRS<+@B6Yaj*NG>qE5L*w~1ATP$D zmWu6(OE=*EHqy{($~U4zjxAwpPn42_%bdH9dMphiUU|) z*+V@lHaf%*GcXP079>vy5na3h^>X=n;xc;VFx)`AJEk zYZFlS#Nc-GIHc}j06;cOU@ zAD7Egkw<2a8TOcfO9jCp4U4oI*`|jpbqMWo(={gG3BjuM3QTGDG`%y|xithFck}0J zG}N#LyhCr$IYP`#;}tdm-7^9=72+CBfBsOZ0lI=LC_a%U@(t3J_I1t(UdiJ^@NubM zvvA0mGvTC%{fj53M^|Ywv$KbW;n8B-x{9}Z!K6v-tw&Xe_D2{7tX?eVk$sA*0826( zuGz!K7$O#;K;1w<38Tjegl)PmRso`fc&>fAT5s z7hzQe-_`lx`}2=c)jz6;yn(~F6#M@z_7@Z(@GWbIAo6A2&;aFf&>CVHpqoPh5#~=G zav`rZ3mSL2qwNL+Pg>aQv;%V&41e|YU$!fQ9Ksle!XZERpjAowHtX zi#0lnw{(zmk&}t`iFEMmx-y7FWaE*vA{Hh&>ieZg{5u0-3@a8BY)Z47E`j-H$dadu zIP|PXw1gjO@%aSz*O{GqZs_{ke|&S6hV{-dPkl*V|3U4LpqhG0eVdqfeNX28hrafI zE13WOsRE|o?24#`gQJs@v*EwL{@3>Ffa;knvI4@VEG2I>t-L(KRS0ShZ9N!bwXa}e zI0}@2#PwFA&Y9o}>6(ZaSaz>kw{U=@;d{|dYJ~lyjh~@bBL>n}#@KjvXUOhrZ`DbnAtf5bz3LD@0RpmAyC-4cgu<7rZo&C3~A_jA*0)v|Ctcdu} zt@c7nQ6hSDC@76c4hI&*v|5A0Mj4eQ4kVb0$5j^*$@psB zdouR@B?l6E%a-9%i(*YWUAhxTQ(b@z&Z#jmIb9`8bZ3Um3UW!@w4%t0#nxsc;*YrG z@x$D9Yj3EiA(-@|IIzi@!E$N)j?gedGJpW!7wr*7zKZwIFa>j|cy<(1`VV_GzWN=1 zc%OO)o*RRobvTZE<9n1s$#V+~5u8ZwmDaysD^&^cxynksn!_ypmx)Mg^8$jXu5lMo zK3K_8GJh#+7HA1rO2AM8cK(#sXd2e?%3h2D9GD7!hxOEKJZK&T`ZS0e*c9c36Y-6yz2D0>Kvqy(EuiQtUQH^~M*HY!$e z20PGLb2Xq{3Ceg^sn+99K6w)TkprP)YyNU(+^PGU8}4&Vdw*u;(`Bw!Um76gL_aMT z>*82nmA8Tp;~hwi0d3S{vCwD};P(%AVaBr=yJ zqB?DktZ#)_VFh_X69lAHQw(ZNE~ZRo2fZOIP;N6fD)J*3u^YGdgwO(HnI4pb$H#9) zizJ<>qI*a6{+z=j+SibowDLKYI*Je2Y>~=*fL@i*f&8**s~4l&B&}$~nwhtbOTr=G zFx>{y6)dpJPqv={_@*!q0=jgw3^j`qi@!wiWiT_$1`SPUgaG&9z9u9=m5C8`GpMaM zyMRSv2llS4F}L?233!)f?mvcYIZ~U z7mPng^=p)@Z*Fp9owSYA`Fe4OjLiJ`rdM`-U(&z1B1`S`ufK_#T@_BvenxDQU`deH$X5eMVO=;I4EJjh6?kkG2oc6AYF6|(t)L0$ukG}Zn=c+R`Oq;nC)W^ z{ek!A?!nCsfd_5>d&ozG%OJmhmnCOtARwOq&p!FzWl7M))YjqK8|;6sOAc$w2%k|E z`^~kpT!j+Y1lvE0B)mc$Ez_4Rq~df#vC-FmW;n#7E)>@kMA6K30!MdiC19qYFnxQ* z?BKegU_6T37%s`~Gi2^ewVbciy-m5%1P3$88r^`xN-+VdhhyUj4Kzg2 zlKZ|FLUHiJCZL8&<=e=F2A!j@3D@_VN%z?J;uw9MquL`V*f^kYTrpoWZ6iFq00uO+ zD~Zwrs!e4cqGedAtYxZ76Bq3Ur>-h(m1~@{x@^*YExmS*vw9!Suxjlaxyk9P#xaZK z)|opA2v#h=O*T42z>Mub2O3Okd3GL86KZM2zlfbS z{Vps`OO&3efvt->OOSpMx~i7J@GsRtoOfQ%vo&jZ6^?7VhBMbPUo-V^Znt%-4k{I# z8&X)=KY{3lXlQg4^FH^{jw0%t#2%skLNMJ}hvvyd>?_AO#MtdvH;M^Y?OUWU6BdMX zJ(h;PM9mlo@i)lWX&#E@d4h zj4Z0Czj{+ipPeW$Qtz_A52HA<4$F9Qe4CiNQSNE2Q-d1OPObk4?7-&`={{yod5Iy3kB=PK3%0oYSr`Gca120>CHbC#SqE*ivL2R(YmI1A|nAT?JmK*2qj_3p#?0h)$#ixdmP?UejCg9%AS2 z8I(=_QP(a(s)re5bu-kcNQc-&2{QZ%KE*`NBx|v%K2?bK@Ihz_e<5Y(o(gQ-h+s&+ zjpV>uj~?rfJ!UW5Mop~ro^|FP3Z`@B6A=@f{Wn78cm`)3&VJ!QE+P9&$;3SDNH>hI z_88;?|LHr%1kTX0t*xzG-6BU=LRpJFZucRBQ<^zy?O5iH$t>o}C}Fc+kM1EZu$hm% zTTFKrJkXmCylFgrA;QAA(fX5Sia5TNo z?=Ujz7$Q?P%kM$RKqRQisOexvV&L+bolR%`u`k;~!o(HqgzV9I6w9|g*5SVZN6+kT9H$-3@%h%k7BBnB zPn+wmPYNG)V2Jv`&$LoI*6d0EO^&Nh`E* z&1V^!!Szd`8_uf%OK?fuj~! z%p9QLJ?V*T^)72<6p1ONqpmD?Wm((40>W?rhjCDOz?#Ei^sXRt|GM3ULLnoa8cABQ zA)gCqJ%Q5J%D&nJqypG-OX1`JLT+d`R^|0KtfGQU+jw79la&$GHTjKF>*8BI z0}l6TC@XB6`>7<&{6WX2kX4k+0SaI`$I8{{mMHB}tVo*(&H2SmZLmW* z+P8N>(r}tR?f!O)?)df>HIu>$U~e~tflVmwk*+B1;TuqJ+q_^`jwGwCbCgSevBqj$ z<`Fj*izeO)_~fq%wZ0Jfvi6<3v{Afz;l5C^C7!i^(W>%5!R=Ic7nm(0gJ~9NOvHyA zqWH2-6w^YmOy(DY{VrN6ErvZREuUMko@lVbdLDq*{A+_%F>!@6Z)X9kR1VI1+Ler+ zLUPtth=u~23=CqZoAbQ`uGE_91kR(8Ie$mq1p`q|ilkJ`Y-ob_=Nl(RF=o7k{47*I)F%_XMBz9uwRH8q1o$TkV@8Pwl zzi`^7i;K6Ak7o58a_D-V0AWp;H8pSjbEs$4BxoJkkC6UF@QNL)0$NU;Wv0*5 z0Ld;6tm7eR%u=`hnUb)gjHbE2cP?qpo3f4w%5qM0J*W_Kl6&z4YKX?iD@=McR!gTyhpGGYj!ljQm@2GL^J70`q~4CzPv@sz`s80FgiuxjAZ zLq61rHv1O>>w1qOEbVBwGu4%LGS!!muKHJ#JjfT>g`aSn>83Af<9gM3XBdY)Yql|{ zUds}u*;5wuus)D>HmexkC?;R&*Z`yB4;k;4T*(823M&52{pOd1yXvPJ3PPK{Zs>6w zztXy*HSH0scZHn7qIsZ8y-zftJ*uIW;%&-Ka0ExdpijI&xInDg-Bv-Q#Islcbz+R! zq|xz?3}G5W@*7jSd`Hv9q^5N*yN=4?Lh=LXS^5KJC=j|AJ5Y(f_fC-c4YQNtvAvn|(uP9@5Co{dL z?7|=jqTzD8>(6Wr&(XYUEzT~-VVErf@|KeFpKjh=v51iDYN_`Kg&XLOIG;ZI8*U$@ zKig{dy?1H}UbW%3jp@7EVSD>6c%#abQ^YfcO(`)*HuvNc|j( zyUbYozBR15$nNU$0ZAE%ivo4viW?@EprUZr6oX=4Sc!-WvrpJdF`3SwopKPyX~F>L zJ>N>v=_plttTSUq6bYu({&rkq)d94m5n~Sk_MO*gY*tlkPFd2m=Pi>MK)ObVV@Sgs zmXMNMvvcAuz+<$GLR2!j4w&;{)HEkxl{$B^*)lUKIn&p5_huD6+%WDoH4`p}9mkw$ zXCPw6Y7tc%rn$o_vy>%UNBC`0@+Ih-#T05AT)ooKt?94^ROI5;6m2pIM@@tdT=&WP z{u09xEVdD}{(3v}8AYUyT82;LV%P%TaJa%f)c36?=90z>Dzk5mF2}Gs0jYCmufihid8(VFcZWs8#59;JCn{!tHu5kSBbm zL`F{COgE01gg-qcP2Lt~M9}mALg@i?TZp&i9ZM^G<3`WSDh}+Ceb3Q!QecJ|N;Xrs z{wH{D8wQ2+mEfBX#M8)-32+~q4MRVr1UaSPtw}`iwx@x=1Xv-?UT{t}w}W(J&WKAC zrZ%hssvf*T!rs}}#atryn?LB=>0U%PLwA9IQZt$$UYrSw`7++}WR7tfE~*Qg)vRrM zT;(1>Zzka?wIIz8vfrG86oc^rjM@P7^i8D~b(S23AoKYj9HBC(6kq9g`1gN@|9^xO z{~h zbxGMHqGZ@eJ17bgES?HQnwp|G#7I>@p~o2zxWkgZUYSUeB*KT{1Q z*J3xZdWt`eBsA}7(bAHNcMPZf_BZC(WUR5B8wUQa=UV^e21>|yp+uop;$+#JwXD!> zunhJVCIKgaol0AM_AwJNl}_k&q|uD?aTE@{Q*&hxZ=k_>jcwp}KwG6mb5J*pV@K+- zj*`r0WuEU_8O=m&1!|rj9FG7ad<2px63;Gl z9lJrXx$~mPnuiqIH&n$jSt*ReG}1_?r4x&iV#3e_z+B4QbhHwdjiGu^J3vcazPi`| zaty}NFSWe=TDry*a*4XB)F;KDI$5i9!!(5p@5ra4*iW;FlGFV0P;OZXF!HCQ!oLm1 zsK+rY-FnJ?+yTBd0}{*Y6su|hul)wJ>RNQ{eau*;wWM{vWM`d0dTC-}Vwx6@cd#P? zx$Qyk^2*+_ZnMC}q0)+hE-q)PKoox#;pc%DNJ&D5+if6X4j~p$A7-s&AjDkSEV)aM z(<3UOw*&f)+^5F0Mpzw3zB1ZHl*B?C~Cx) zuNg*>5RM9F5{EpU@a2E7hAE`m<89wbQ2Lz&?Egu-^sglNXG5Q;{9n(%&*kEb0vApd zRHrY@22=pkFN81%x)~acZeu`yvK zovAVJNykgxqkEr^hZksHkpxm>2I8FTu2%+XLs@?ym0n;;A~X>i32{g6NOB@o4lk8{ zB}7Z2MNAJi>9u=y%s4QUXaNdt@SlAZr54!S6^ETWoik6gw=k-itu_}Yl_M9!l+Rbv z(S&WD`{_|SE@@(|Wp7bq1Zq}mc4JAG?mr2WN~6}~u`7M_F@J9`sr0frzxfuqSF~mA z$m$(TWAuCIE99yLSwi%R)8geQhs;6VBlRhJb(4Cx zu)QIF%_W9+21xI45U>JknBRaZ9nYkgAcK6~E|Zxo!B&z9zQhjsi^fgwZI%K@rYbMq znWBXg1uCZ+ljGJrsW7@x3h2 z;kn!J!bwCeOrBx;oPkZ}FeP%wExyf4=XMp)N8*lct~SyfK~4^-75EZFpHYO5AnuRM z!>u?>Vj3+j=uiHc<=cD~JWRphDSwxFaINB42-{@ZJTWe85>-RcQ&U%?wK)vjz z5u5fJYkck##j(bP7W0*RdW#BmAIK`D3=(U~?b`cJ&U2jHj}?w6 z_4BM)#EoJ6)2?pcR4AqBd)qAUn@RtNQq})FIQoBK4ie+GB(Vih2D|Ds>RJo2zE~C- z7mI)7p)5(-O6JRh6a@VZ5~piVC+Xv=O-)=0eTMSJsRE^c1@bPQWlr}E31VqO-%739 zdcmE{`1m;5LH8w|7euK>>>U#Iod8l1yivC>;YWsg=z#07E%cU9x1yw#3l6AcIm%79 zGi^zH6rM#CZMow(S(8dcOq#5$kbHnQV6s?MRsU3et!!YK5H?OV9vf2qy-UHCn>}2d zTwI(A_fzmmCtE@10yAGgU7R&|Fl$unZJ_^0BgCEDE6(B*SzfkapE9#0N6adc>}dtH zJ#nt^F~@JMJg4=Pv}OdUHyPt-<<9Z&c0@H@^4U?KwZM&6q0XjXc$>K3c&3iXLD9_%(?)?2kmZ=Ykb;)M`Tw=%_d=e@9eheGG zk0<`4so}r={C{zr|6+_1mA_=a56(XyJq||g6Es1E6%fPg#l{r+vk9;)r6VB7D84nu zE0Z1EIxH{Y@}hT+|#$0xn+CdMy6Uhh80eK~nfMEIpM z`|G1v!USmx81nY8XkhEOSWto}pc#{Ut#`Pqb}9j$FpzkQ7`0<-@5D_!mrLah98Mpr zz(R7;ZcaR-$aKqUaO!j z=7QT;Bu0cvYBi+LDfE_WZ`e@YaE_8CCxoRc?Y_!Xjnz~Gl|aYjN2&NtT5v4#q3od2 zkCQZHe#bn(5P#J**Fj4Py%SaaAKJsmV6}F_6Z7V&n6QAu8UQ#9{gkq+tB=VF_Q6~^ zf(hXvhJ#tC(eYm6g|I>;55Lq-;yY*COpTp4?J}hGQ42MIVI9CgEC{3hYw#CZfFKVG zgD(steIg8veyqX%pYMoulq zMUmbj8I`t>mC`!kZ@A>@PYXy*@NprM@e}W2Q+s?XIRM-U1FHVLM~c60(yz1<46-*j zW*FjTnBh$EzI|B|MRU11^McTPIGVJrzozlv$1nah_|t4~u}Ht^S1@V8r@IXAkN;lH z_s|WHlN90k4X}*#neR5bX%}?;G`X!1#U~@X6bbhgDYKJK17~oFF0&-UB#()c$&V<0 z7o~Pfye$P@$)Lj%T;axz+G1L_YQ*#(qO zQND$QTz(~8EF1c3<%;>dAiD$>8j@7WS$G_+ktE|Z?Cx<}HJb=!aChR&4z ziD&FwsiZ)wxS4k6KTLn>d~!DJ^78yb>?Trmx;GLHrbCBy|Bip<@sWdAfP0I~;(Ybr zoc-@j?wA!$ zIP0m3;LZy+>dl#&Ymws@7|{i1+OFLYf@+8+)w}n?mHUBCqg2=-Hb_sBb?=q))N7Ej zDIL9%@xQFOA!(EQmchHiDN%Omrr;WvlPIN5gW;u#ByV)x2aiOd2smy&;vA2+V!u|D zc~K(OVI8} z0t|e0OQ7h23e01O;%SJ}Q#yeDh`|jZR7j-mL(T4E;{w^}2hzmf_6PF|`gWVj{I?^2T3MBK>{?nMXed4kgNox2DP!jvP9v`;pa6AV)OD zDt*Vd-x7s{-;E?E5}3p-V;Y#dB-@c5vTWfS7<=>E+tN$ME`Z7K$px@!%{5{uV`cH80|IzU! zDs9=$%75P^QKCRQ`mW7$q9U?mU@vrFMvx)NNDrI(uk>xwO;^($EUvqVev#{W&GdtR z0ew;Iwa}(-5D28zABlC{WnN{heSY5Eq5Fc=TN^9X#R}0z53!xP85#@;2E=&oNYHyo z46~#Sf!1M1X!rh}ioe`>G2SkPH{5nCoP`GT@}rH;-LP1Q7U_ypw4+lwsqiBql80aA zJE<(88yw$`xzNiSnU(hsyJqHGac<}{Av)x9lQ=&py9djsh0uc}6QkmKN3{P!TEy;P zzLDVQj4>+0r<9B0owxBt5Uz`!M_VSS|{(?`_e+qD9b=vZHoo6>?u;!IP zM7sqoyP>kWY|=v06gkhaGRUrO8n@zE?Yh8$om@8%=1}*!2wdIWsbrCg@;6HfF?TEN z+B_xtSvT6H3in#8e~jvD7eE|LTQhO_>3b823&O_l$R$CFvP@3~)L7;_A}JpgN@ax{ z2d9Ra)~Yh%75wsmHK8e87yAn-ZMiLo6#=<&PgdFsJw1bby-j&3%&4=9dQFltFR(VB z@=6XmyNN4yr^^o$ON8d{PQ=!OX17^CrdM~7D-;ZrC!||<+FEOxI_WI3 zCA<35va%4v>gcEX-@h8esj=a4szW7x z{0g$hwoWRQG$yK{@3mqd-jYiVofJE!Wok1*nV7Gm&Ssq#hFuvj1sRyHg(6PFA5U*Q z8Rx>-blOs=lb`qa{zFy&n4xY;sd$fE+<3EI##W$P9M{B3c3Si9gw^jlPU-JqD~Cye z;wr=XkV7BSv#6}DrsXWFJ3eUNrc%7{=^sP>rp)BWKA9<}^R9g!0q7yWlh;gr_TEOD|#BmGq<@IV;ue zg+D2}cjpp+dPf&Q(36sFU&K8}hA85U61faW&{lB`9HUl-WWCG|<1XANN3JVAkRYvr5U z4q6;!G*MTdSUt*Mi=z_y3B1A9j-@aK{lNvxK%p23>M&=KTCgR!Ee8c?DAO2_R?Bkaqr6^BSP!8dHXxj%N1l+V$_%vzHjq zvu7p@%Nl6;>y*S}M!B=pz=aqUV#`;h%M0rUHfcog>kv3UZAEB*g7Er@t6CF8kHDmK zTjO@rejA^ULqn!`LwrEwOVmHx^;g|5PHm#B6~YD=gjJ!043F+&#_;D*mz%Q60=L9O zve|$gU&~As5^uz@2-BfQ!bW)Khn}G+Wyjw-19qI#oB(RSNydn0t~;tAmK!P-d{b-@ z@E5|cdgOS#!>%#Rj6ynkMvaW@37E>@hJP^82zk8VXx|3mR^JCcWdA|t{0nPmYFOxN z55#^-rlqobcr==<)bi?E?SPymF*a5oDDeSdO0gx?#KMoOd&G(2O@*W)HgX6y_aa6i zMCl^~`{@UR`nMQE`>n_{_aY5nA}vqU8mt8H`oa=g0SyiLd~BxAj2~l$zRSDHxvDs; zI4>+M$W`HbJ|g&P+$!U7-PHX4RAcR0szJ*(e-417=bO2q{492SWrqDK+L3#ChUHtz z*@MP)e^%@>_&#Yk^1|tv@j4%3T)diEXATx4K*hcO`sY$jk#jN5WD<=C3nvuVs zRh||qDHnc~;Kf59zr0;c7VkVSUPD%NnnJC_l3F^#f_rDu8l}l8qcAz0FFa)EAt32I zUy_JLIhU_J^l~FRH&6-iv zSpG2PRqzDdMWft>Zc(c)#tb%wgmWN%>IOPmZi-noqS!^Ft zb81pRcQi`X#UhWK70hy4tGW1mz|+vI8c*h@fFGJtW3r>qV>1Z0r|L>7I3un^gcep$ zAAWfZHRvB|E*kktY$qQP_$YG60C z@X~tTQjB3%@`uz!qxtxF+LE!+=nrS^07hn`EgAp!h|r03h7B!$#OZW#ACD+M;-5J!W+{h z|6I;5cNnE(Y863%1(oH}_FTW})8zYb$7czPg~Szk1+_NTm6SJ0MS_|oSz%e(S~P-& zSFp;!k?uFayytV$8HPwuyELSXOs^27XvK-DOx-Dl!P|28DK6iX>p#Yb%3`A&CG0X2 zS43FjN%IB}q(!hC$fG}yl1y9W&W&I@KTg6@K^kpH8=yFuP+vI^+59|3%Zqnb5lTDAykf9S#X`3N(X^SpdMyWQGOQRjhiwlj!0W-yD<3aEj^ z&X%=?`6lCy~?`&WSWt?U~EKFcCG_RJ(Qp7j=$I%H8t)Z@6Vj zA#>1f@EYiS8MRHZphpMA_5`znM=pzUpBPO)pXGYpQ6gkine{ z6u_o!P@Q+NKJ}k!_X7u|qfpAyIJb$_#3@wJ<1SE2Edkfk9C!0t%}8Yio09^F`YGzp zaJHGk*-ffsn85@)%4@`;Fv^8q(-Wk7r=Q8pT&hD`5(f?M{gfzGbbwh8(}G#|#fDuk z7v1W)5H9wkorE0ZZjL0Q1=NRGY>zwgfm81DdoaVwNH;or{{e zSyybt)m<=zXoA^RALYG-2touH|L*BLvmm9cdMmn+KGopyR@4*=&0 z&4g|FLoreZOhRmh=)R0bg~T2(8V_q7~42-zvb)+y959OAv!V$u(O z3)%Es0M@CRFmG{5sovIq4%8Ahjk#*5w{+)+MWQoJI_r$HxL5km1#6(e@{lK3Udc~n z0@g`g$s?VrnQJ$!oPnb?IHh-1qA`Rz$)Ai<6w$-MJW-gKNvOhL+XMbE7&mFt`x1KY z>k4(!KbbpZ`>`K@1J<(#vVbjx@Z@(6Q}MF#Mnbr-f55)vXj=^j+#)=s+ThMaV~E`B z8V=|W_fZWDwiso8tNMTNse)RNBGi=gVwgg%bOg8>mbRN%7^Um-7oj4=6`$|(K7!+t^90a{$1 z8Z>}<#!bm%ZEFQ{X(yBZMc>lCz0f1I2w9SquGh<9<=AO&g6BZte6hn>Qmvv;Rt)*c zJfTr2=~EnGD8P$v3R|&1RCl&7)b+`=QGapiPbLg_pxm`+HZurtFZ;wZ=`Vk*do~$wBxoW&=j0OTbQ=Q%S8XJ%~qoa3Ea|au5 zo}_(P;=!y z-AjFrERh%8la!z6Fn@lR?^E~H12D? z8#ht=1F;7@o4$Q8GDj;sSC%Jfn01xgL&%F2wG1|5ikb^qHv&9hT8w83+yv&BQXOQy zMVJSBL(Ky~p)gU3#%|blG?I zR9rP^zUbs7rOA0X52Ao=GRt@C&zlyjNLv-}9?*x{y(`509qhCV*B47f2hLrGl^<@S zuRGR!KwHei?!CM10pBKpDIoBNyRuO*>3FU?HjipIE#B~y3FSfOsMfj~F9PNr*H?0o zHyYB^G(YyNh{SxcE(Y-`x5jFMKb~HO*m+R%rq|ic4fzJ#USpTm;X7K+E%xsT_3VHK ze?*uc4-FsILUH;kL>_okY(w`VU*8+l>o>JmiU#?2^`>arnsl#)*R&nf_%>A+qwl%o z{l(u)M?DK1^mf260_oteV3#E_>6Y4!_hhVDM8AI6MM2V*^_M^sQ0dmHu11fy^kOqX zqzps-c5efIKWG`=Es(9&S@K@)ZjA{lj3ea7_MBPk(|hBFRjHVMN!sNUkrB;(cTP)T97M$ z0Dtc&UXSec<+q?y>5=)}S~{Z@ua;1xt@=T5I7{`Z=z_X*no8s>mY;>BvEXK%b`a6(DTS6t&b!vf_z#HM{Uoy z_5fiB(zpkF{})ruka$iX*~pq1ZxD?q68dIoIZSVls9kFGsTwvr4{T_LidcWtt$u{k zJlW7moRaH6+A5hW&;;2O#$oKyEN8kx z`LmG)Wfq4ykh+q{I3|RfVpkR&QH_x;t41UwxzRFXt^E2B$domKT@|nNW`EHwyj>&< zJatrLQ=_3X%vd%nHh^z@vIk(<5%IRAa&Hjzw`TSyVMLV^L$N5Kk_i3ey6byDt)F^U zuM+Ub4*8+XZpnnPUSBgu^ijLtQD>}K;eDpe1bNOh=fvIfk`&B61+S8ND<(KC%>y&? z>opCnY*r5M+!UrWKxv0_QvTlJc>X#AaI^xoaRXL}t5Ej_Z$y*|w*$6D+A?Lw-CO-$ zitm^{2Ct82-<0IW)0KMNvJHgBrdsIR0v~=H?n6^}l{D``Me90`^o|q!olsF?UX3YS zq^6Vu>Ijm>>PaZI8G@<^NGw{Cx&%|PwYrfwR!gX_%AR=L3BFsf8LxI|K^J}deh0Zd zV?$3r--FEX`#INxsOG6_=!v)DI>0q|BxT)z-G6kzA01M?rba+G_mwNMQD1mbVbNTW zmBi*{s_v_Ft9m2Avg!^78(QFu&n6mbRJ2bAv!b;%yo{g*9l2)>tsZJOOp}U~8VUH`}$8p_}t*XIOehezolNa-a2x0BS})Y9}& z*TPgua{Ewn-=wVrmJUeU39EKx+%w%=ixQWKDLpwaNJs65#6o7Ln7~~X+p_o2BR1g~ zVCfxLzxA{HlWAI6^H;`juI=&r1jQrUv_q0Z1Ja-tjdktrrP>GOC*#p?*xfQU5MqjM zsBe!9lh(u8)w$e@Z|>aUHI5o;MGw*|Myiz3-f0;pHg~Q#%*Kx8MxH%AluVXjG2C$) zWL-K63@Q`#y9_k_+}eR(x4~dp7oV-ek0H>Igy8p#i4GN{>#v=pFYUQT(g&b$OeTy- zX_#FDgNF8XyfGY6R!>inYn8IR2RDa&O!(6NIHrC0H+Qpam1bNa=(`SRKjixBTtm&e z`j9porEci!zdlg1RI0Jw#b(_Tb@RQK1Zxr_%7SUeH6=TrXt3J@js`4iDD0=I zoHhK~I7^W8^Rcp~Yaf>2wVe|Hh1bXa_A{oZ9eG$he;_xYvTbTD#moBy zY57-f2Ef1TP^lBi&p5_s7WGG9|0T}dlfxOxXvScJO1Cnq`c`~{Dp;{;l<-KkCDE+p zmexJkd}zCgE{eF=)K``-qC~IT6GcRog_)!X?fK^F8UDz$(zFUrwuR$qro5>qqn>+Z z%<5>;_*3pZ8QM|yv9CAtrAx;($>4l^_$_-L*&?(77!-=zvnCVW&kUcZMb6;2!83si z518Y%R*A3JZ8Is|kUCMu`!vxDgaWjs7^0j(iTaS4HhQ)ldR=r)_7vYFUr%THE}cPF z{0H45FJ5MQW^+W>P+eEX2kLp3zzFe*-pFVAdDZRybv?H|>`9f$AKVjFWJ=wegO7hO zOIYCtd?Vj{EYLT*^gl35|HbMX|NAEUf2ra9dy1=O;figB>La=~eA^#>O6n4?EMugV zbbt{Dbfef5l^(;}5kZ@!XaWwF8z0vUr6r|+QN*|WpF z^*osUHzOnE$lHuWYO$G7>}Y)bY0^9UY4eDV`E{s+{}Z$O$2*lMEYl zTA`ki(<0(Yrm~}15V-E^e2W6`*`%ydED-3G@$UFm6$ZtLx z+av`BhsHcAWqdxPWfu2*%{}|Sptax4_=NpDMeWy$* zZM6__s`enB$~0aT1BU^2k`J9F%+n+lL_|8JklWOCVYt*0%o*j4w1CsB_H^tVpYT_LLyKuyk=CV6~1M<7~^FylL*+AIFf3h>J=x$ygY-BG}4LJ z8XxYPY!v7dO3PVwEoY=`)6krokmR^|Mg5ztX_^#QR}ibr^X-|_St#rtv3gukh0(#A=};NPlNz57ZDFJ9hf#NP50zS)+Fo=StX)i@ zWS?W}i6LjB>kAB~lupAPyIjFb)izFgRq*iS*(Jt509jNr3r72{Gj`5DGoj;J&k5G@Rm!dJ($ox>SbxR)fc zz|Phug;~A7!p@?|mMva@rWuf2fSDK_ZxN3vVmlYz>rrf?LpiNs)^z!y{As@`55JC~ zS*GD3#N-ptY!2<613UelAJ;M4EEI$dm)`8#n$|o{ce^dlyoUY3bsy2hgnj-;ovubb zg2h1rZA6Ot}K_cpYBpIuF&CyK~5R0Wv;kG|3A^8K3nk{rw$Be8u@aos#qvKQKJyVU$cX6biw&Ep#+q7upFX z%qo&`WZ){<%zh@BTl{MO@v9#;t+cb7so0Uz49Fmo1e4>y!vUyIHadguZS0T7-x#_drMXz*16*c zymR0u^`ZQpXN}2ofegbpSedL%F9aypdQcrzjzPlBW0j zMlPzC&ePZ@Cq!?d%9oQNEg0`rHALm8l#lUdXMVEqDvb(AID~H(?H9z!e9G98fG@IzhajKr)3{L_Clu1(Bwg`RM!-(MOuZi zbeDsj9I3(~EITsE=3Z)a|l_rn8W92U0DB70gF7YYfO0j!)h?QobY1lSR>0 z_TVw@$eP~3k8r9;%g%RlZzCJ2%f}DvY`rsZ$;ak&^~-`i%B%+O!pnADeVyV!dHj|} zzOj#q4eRx9Q8c2Z7vy9L&fGLj+3_?fp}+8o`Xpwyi(81H|7P8#65%FIS*lOi={o&v z4NV$xu7az4Nb50dRGZv<tdZCx4Ek<_o3!mAT} zL5l*|K3Qr-)W8paaG z&R6{ped_4e2cy}ejD0!dt{*PaC*^L@eB%(1Fmc%Y#4)~!jF#lCGfj#E??4LG-T;!M z>Uha}f;W>ib_ZL-I7-v9KZQls^G!-JmL^w;=^}?!RXK;m4$#MwI2AH-l7M2-0 zVMK8k^+4+>2S0k^N_40EDa#`7c;2!&3-o6MHsnBfRnq@>E@)=hDulVq-g5SQWDWbt zj6H5?QS2gRZ^Zvbs~cW|8jagJV|;^zqC0e=D1oUsQPJ3MCb+eRGw(XgIY9y8v_tXq z9$(xWntWpx_Uronmvho{JfyYdV{L1N$^s^|-Nj`Ll`lUsiWTjm&8fadUGMXreJGw$ zQ**m+Tj|(XG}DyUKY~2?&9&n6SJ@9VKa9Hcayv{ar^pNr0WHy zP$bQv&8O!vd;GoT!pLwod-42qB^`m!b7nP@YTX}^+1hzA$}LSLh}Ln|?`%8xGMazw z8WT!LoYJ-Aq3=2p6ZSP~uMgSSWv3f`&-I06tU}WhZsA^6nr&r17hjQIZE>^pk=yZ% z06}dfR$85MjWJPq)T?OO(RxoaF+E#4{Z7)i9}Xsb;Nf+dzig61HO;@JX1Lf9)R5j9)Oi6vPL{H z&UQ9ln=$Q8jnh6-t;`hKM6pHftdd?$=1Aq16jty4-TF~`Gx=C&R242uxP{Y@Q~%O3 z*(16@x+vJsbW@^3tzY=-5MHi#(kB};CU%Ep`mVY1j$MAPpYJBB3x$ue`%t}wZ-@CG z(lBv36{2HMjxT)2$n%(UtHo{iW9>4HX4>)%k8QNnzIQYXrm-^M%#Qk%9odbUrZDz1YPdY`2Z4w~p!5tb^m(mUfk}kZ9+EsmenQ)5iwiaulcy zCJ#2o4Dz?@%)aAKfVXYMF;3t@aqNh2tBBlBkCdj`F31b=h93y(46zQ-YK@+zX5qM9 z&=KkN&3@Ptp*>UD$^q-WpG|9O)HBXz{D>p!`a36aPKkgz7uxEo0J>-o+4HHVD9!Hn z${LD0d{tuGsW*wvZoHc8mJroAs(3!FK@~<}Pz1+vY|Gw}Lwfxp{4DhgiQ_SSlV)E| zZWZxYZLu2EB1=g_y@(ieCQC_1?WNA0J0*}eMZfxCCs>oL;?kHdfMcKB+A)Qull$v( z2x6(38utR^-(?DG>d1GyU()8>ih3ud0@r&I$`ZSS<*1n6(76=OmP>r_JuNCdS|-8U zxGKXL1)Lc2kWY@`_kVBt^%7t9FyLVYX(g%a6>j=yURS1!V<9ieT$$5R+yT!I>}jI5 z?fem|T=Jq;BfZmsvqz_Ud*m5;&xE66*o*S22vf-L+MosmUPPA}~wy`kntf8rIeP-m;;{`xe}9E~G7J!PYoVH_$q~NzQab?F8vWUja5BJ!T5%5IpyqI#Dkps0B;gQ*z?c#N>spFw|wRE$gY?y4wQbJ zku2sVLh({KQz6e0yo+X!rV#8n8<;bHWd{ZLL_(*9Oi)&*`LBdGWz>h zx+p`Wi00u#V$f=CcMmEmgFjw+KnbK3`mbaKfoCsB{;Q^oJgj*LWnd_(dk9Kcssbj` z?*g8l`%{*LuY!Ls*|Tm`1Gv-tRparW8q4AK(5pfJFY5>@qO( zcY>pt*na>LlB^&O@YBDnWLE$x7>pMdSmb-?qMh79eB+Wa{)$%}^kX@Z3g>fytppz! zl%>pMD(Yw+5=!UgYHLD69JiJ;YhiGeEyZM$Au{ff;i zCBbNQfO{d!b7z^F732XX&qhEsJA1UZtJjJEIPyDq+F`LeAUU_4`%2aTX#3NG3%W8u zC!7OvlB?QJ4s2#Ok^_8SKcu&pBd}L?vLRT8Kow#xARt`5&Cg=ygYuz>>c z4)+Vv$;<$l=is&E{k&4Lf-Lzq#BHuWc;wDfm4Fbd5Sr!40s{UpKT$kzmUi{V0t1yp zPOf%H8ynE$x@dQ_!+ISaI}#%72UcYm7~|D*(Fp8xiFAj$CmQ4oH3C+Q8W=Y_9Sp|B z+k<%5=y{eW=YvTivV(*KvC?qxo)xqcEU9(Te=?ITts~;xA0Jph-vpd4@Zw#?r2!`? zB3#XtIY^wxrpjJv&(7Xjvm>$TIg2ZC&+^j(gT0R|&4cb)=92-2Hti1`& z=+M;*O%_j3>9zW|3h{0Tfh5i)Fa;clGNJpPRcUmgErzC{B+zACiPHbff3SmsCZ&X; zp=tgI=zW-t(5sXFL8;ITHw0?5FL3+*z5F-KcLN130l=jAU6%F=DClRPrzO|zY+HD`zlZ-)JT}X?2g!o zxg4Ld-mx6&*-N0-MQ(z+zJo8c`B39gf{-h2vqH<=^T&o1Dgd>4BnVht+JwLcrjJl1 zsP!8`>3-rSls07q2i1hScM&x0lQyBbk(U=#3hI7Bkh*kj6H*&^p+J?OMiT_3*vw5R zEl&p|QQHZq6f~TlAeDGy(^BC0vUK?V&#ezC0*#R-h}_8Cw8-*${mVfHssathC8%VA zUE^Qd!;Rvym%|f@?-!sEj|73Vg8!$$zj_QBZAOraF5HCFKl=(Ac|_p%-P;6z<2WSf zz(9jF2x7ZR{w+p)ETCW06PVt0YnZ>gW9^sr&~`%a_7j-Ful~*4=o|&TM@k@Px2z>^ t{*Ed16F~3V5p+(suF-++X8+nHtT~NSfJ>UC3v)>lEpV}<+rIR_{{yMcG_L>v diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/gradle/wrapper/gradle-wrapper.properties b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/gradle/wrapper/gradle-wrapper.properties deleted file mode 100644 index 17655d0..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/gradle/wrapper/gradle-wrapper.properties +++ /dev/null @@ -1,5 +0,0 @@ -distributionBase=GRADLE_USER_HOME -distributionPath=wrapper/dists -distributionUrl=https\://services.gradle.org/distributions/gradle-8.6-bin.zip -zipStoreBase=GRADLE_USER_HOME -zipStorePath=wrapper/dists diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/gradlew b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/gradlew deleted file mode 100755 index 1b6c787..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/gradlew +++ /dev/null @@ -1,234 +0,0 @@ -#!/bin/sh - -# -# Copyright © 2015-2021 the original authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# - -############################################################################## -# -# Gradle start up script for POSIX generated by Gradle. -# -# Important for running: -# -# (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is -# noncompliant, but you have some other compliant shell such as ksh or -# bash, then to run this script, type that shell name before the whole -# command line, like: -# -# ksh Gradle -# -# Busybox and similar reduced shells will NOT work, because this script -# requires all of these POSIX shell features: -# * functions; -# * expansions «$var», «${var}», «${var:-default}», «${var+SET}», -# «${var#prefix}», «${var%suffix}», and «$( cmd )»; -# * compound commands having a testable exit status, especially «case»; -# * various built-in commands including «command», «set», and «ulimit». -# -# Important for patching: -# -# (2) This script targets any POSIX shell, so it avoids extensions provided -# by Bash, Ksh, etc; in particular arrays are avoided. -# -# The "traditional" practice of packing multiple parameters into a -# space-separated string is a well documented source of bugs and security -# problems, so this is (mostly) avoided, by progressively accumulating -# options in "$@", and eventually passing that to Java. -# -# Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS, -# and GRADLE_OPTS) rely on word-splitting, this is performed explicitly; -# see the in-line comments for details. -# -# There are tweaks for specific operating systems such as AIX, CygWin, -# Darwin, MinGW, and NonStop. -# -# (3) This script is generated from the Groovy template -# https://github.com/gradle/gradle/blob/master/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt -# within the Gradle project. -# -# You can find Gradle at https://github.com/gradle/gradle/. -# -############################################################################## - -# Attempt to set APP_HOME - -# Resolve links: $0 may be a link -app_path=$0 - -# Need this for daisy-chained symlinks. -while - APP_HOME=${app_path%"${app_path##*/}"} # leaves a trailing /; empty if no leading path - [ -h "$app_path" ] -do - ls=$( ls -ld "$app_path" ) - link=${ls#*' -> '} - case $link in #( - /*) app_path=$link ;; #( - *) app_path=$APP_HOME$link ;; - esac -done - -APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit - -APP_NAME="Gradle" -APP_BASE_NAME=${0##*/} - -# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. -DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"' - -# Use the maximum available, or set MAX_FD != -1 to use that value. -MAX_FD=maximum - -warn () { - echo "$*" -} >&2 - -die () { - echo - echo "$*" - echo - exit 1 -} >&2 - -# OS specific support (must be 'true' or 'false'). -cygwin=false -msys=false -darwin=false -nonstop=false -case "$( uname )" in #( - CYGWIN* ) cygwin=true ;; #( - Darwin* ) darwin=true ;; #( - MSYS* | MINGW* ) msys=true ;; #( - NONSTOP* ) nonstop=true ;; -esac - -CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar - - -# Determine the Java command to use to start the JVM. -if [ -n "$JAVA_HOME" ] ; then - if [ -x "$JAVA_HOME/jre/sh/java" ] ; then - # IBM's JDK on AIX uses strange locations for the executables - JAVACMD=$JAVA_HOME/jre/sh/java - else - JAVACMD=$JAVA_HOME/bin/java - fi - if [ ! -x "$JAVACMD" ] ; then - die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME - -Please set the JAVA_HOME variable in your environment to match the -location of your Java installation." - fi -else - JAVACMD=java - which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. - -Please set the JAVA_HOME variable in your environment to match the -location of your Java installation." -fi - -# Increase the maximum file descriptors if we can. -if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then - case $MAX_FD in #( - max*) - MAX_FD=$( ulimit -H -n ) || - warn "Could not query maximum file descriptor limit" - esac - case $MAX_FD in #( - '' | soft) :;; #( - *) - ulimit -n "$MAX_FD" || - warn "Could not set maximum file descriptor limit to $MAX_FD" - esac -fi - -# Collect all arguments for the java command, stacking in reverse order: -# * args from the command line -# * the main class name -# * -classpath -# * -D...appname settings -# * --module-path (only if needed) -# * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables. - -# For Cygwin or MSYS, switch paths to Windows format before running java -if "$cygwin" || "$msys" ; then - APP_HOME=$( cygpath --path --mixed "$APP_HOME" ) - CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" ) - - JAVACMD=$( cygpath --unix "$JAVACMD" ) - - # Now convert the arguments - kludge to limit ourselves to /bin/sh - for arg do - if - case $arg in #( - -*) false ;; # don't mess with options #( - /?*) t=${arg#/} t=/${t%%/*} # looks like a POSIX filepath - [ -e "$t" ] ;; #( - *) false ;; - esac - then - arg=$( cygpath --path --ignore --mixed "$arg" ) - fi - # Roll the args list around exactly as many times as the number of - # args, so each arg winds up back in the position where it started, but - # possibly modified. - # - # NB: a `for` loop captures its iteration list before it begins, so - # changing the positional parameters here affects neither the number of - # iterations, nor the values presented in `arg`. - shift # remove old arg - set -- "$@" "$arg" # push replacement arg - done -fi - -# Collect all arguments for the java command; -# * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of -# shell script including quotes and variable substitutions, so put them in -# double quotes to make sure that they get re-expanded; and -# * put everything else in single quotes, so that it's not re-expanded. - -set -- \ - "-Dorg.gradle.appname=$APP_BASE_NAME" \ - -classpath "$CLASSPATH" \ - org.gradle.wrapper.GradleWrapperMain \ - "$@" - -# Use "xargs" to parse quoted args. -# -# With -n1 it outputs one arg per line, with the quotes and backslashes removed. -# -# In Bash we could simply go: -# -# readarray ARGS < <( xargs -n1 <<<"$var" ) && -# set -- "${ARGS[@]}" "$@" -# -# but POSIX shell has neither arrays nor command substitution, so instead we -# post-process each arg (as a line of input to sed) to backslash-escape any -# character that might be a shell metacharacter, then use eval to reverse -# that process (while maintaining the separation between arguments), and wrap -# the whole thing up as a single "set" statement. -# -# This will of course break if any of these variables contains a newline or -# an unmatched quote. -# - -eval "set -- $( - printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" | - xargs -n1 | - sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' | - tr '\n' ' ' - )" '"$@"' - -exec "$JAVACMD" "$@" diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/gradlew.bat b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/gradlew.bat deleted file mode 100644 index ac1b06f..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/gradlew.bat +++ /dev/null @@ -1,89 +0,0 @@ -@rem -@rem Copyright 2015 the original author or authors. -@rem -@rem Licensed under the Apache License, Version 2.0 (the "License"); -@rem you may not use this file except in compliance with the License. -@rem You may obtain a copy of the License at -@rem -@rem https://www.apache.org/licenses/LICENSE-2.0 -@rem -@rem Unless required by applicable law or agreed to in writing, software -@rem distributed under the License is distributed on an "AS IS" BASIS, -@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -@rem See the License for the specific language governing permissions and -@rem limitations under the License. -@rem - -@if "%DEBUG%" == "" @echo off -@rem ########################################################################## -@rem -@rem Gradle startup script for Windows -@rem -@rem ########################################################################## - -@rem Set local scope for the variables with windows NT shell -if "%OS%"=="Windows_NT" setlocal - -set DIRNAME=%~dp0 -if "%DIRNAME%" == "" set DIRNAME=. -set APP_BASE_NAME=%~n0 -set APP_HOME=%DIRNAME% - -@rem Resolve any "." and ".." in APP_HOME to make it shorter. -for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi - -@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. -set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m" - -@rem Find java.exe -if defined JAVA_HOME goto findJavaFromJavaHome - -set JAVA_EXE=java.exe -%JAVA_EXE% -version >NUL 2>&1 -if "%ERRORLEVEL%" == "0" goto execute - -echo. -echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. -echo. -echo Please set the JAVA_HOME variable in your environment to match the -echo location of your Java installation. - -goto fail - -:findJavaFromJavaHome -set JAVA_HOME=%JAVA_HOME:"=% -set JAVA_EXE=%JAVA_HOME%/bin/java.exe - -if exist "%JAVA_EXE%" goto execute - -echo. -echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% -echo. -echo Please set the JAVA_HOME variable in your environment to match the -echo location of your Java installation. - -goto fail - -:execute -@rem Setup the command line - -set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar - - -@rem Execute Gradle -"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %* - -:end -@rem End local scope for the variables with windows NT shell -if "%ERRORLEVEL%"=="0" goto mainEnd - -:fail -rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of -rem the _cmd.exe /c_ return code! -if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1 -exit /b 1 - -:mainEnd -if "%OS%"=="Windows_NT" endlocal - -:omega diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/settings.gradle.kts b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/settings.gradle.kts deleted file mode 100644 index 29d8780..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/settings.gradle.kts +++ /dev/null @@ -1 +0,0 @@ -include("benchmarks") diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/BinaryHolder.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/BinaryHolder.java deleted file mode 100644 index 60570bd..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/BinaryHolder.java +++ /dev/null @@ -1,45 +0,0 @@ -/* - * Copyright 2008-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import com.mongodb.crypt.capi.CAPI.mongocrypt_binary_t; - -import static com.mongodb.crypt.capi.CAPI.mongocrypt_binary_destroy; - -// Wrap JNA memory and a mongocrypt_binary_t that references that memory, in order to ensure that the JNA Memory is not GC'd before the -// mongocrypt_binary_t is destroyed -class BinaryHolder implements AutoCloseable { - - private final DisposableMemory memory; - private final mongocrypt_binary_t binary; - - BinaryHolder(final DisposableMemory memory, final mongocrypt_binary_t binary) { - this.memory = memory; - this.binary = binary; - } - - mongocrypt_binary_t getBinary() { - return binary; - } - - @Override - public void close() { - mongocrypt_binary_destroy(binary); - memory.dispose(); - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/CAPI.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/CAPI.java deleted file mode 100644 index 999190b..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/CAPI.java +++ /dev/null @@ -1,1165 +0,0 @@ -/* - * Copyright 2019-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import com.sun.jna.Callback; -import com.sun.jna.Memory; -import com.sun.jna.Native; -import com.sun.jna.Pointer; -import com.sun.jna.PointerType; -import com.sun.jna.ptr.PointerByReference; - -//CHECKSTYLE:OFF - -/** - * For internal use only. Not part of the public API. - */ -@SuppressWarnings("WeakerAccess") -public class CAPI { - - public static class cstring extends PointerType { - public cstring() { - super(); - } - - public cstring(String string) { - Pointer m = new Memory(string.length() + 1); - m.setString(0, string); - setPointer(m); - } - - public String toString() { - return getPointer().getString(0); - } - } - - - /** - * Indicates success or contains error information. - *

- * Functions like @ref mongocrypt_ctx_encrypt_init follow a pattern to expose a - * status. A boolean is returned. True indicates success, and false indicates - * failure. On failure a status on the handle is set, and is accessible with a - * corresponding status function. E.g. @ref mongocrypt_ctx_status. - */ - public static class mongocrypt_status_t extends PointerType { - } - - /** - * Contains all options passed on initialization of a @ref mongocrypt_ctx_t. - */ - public static class mongocrypt_opts_t extends PointerType { - } - - /** - * A non-owning view of a byte buffer. - *

- * Functions returning a mongocrypt_binary_t* expect it to be destroyed with - * mongocrypt_binary_destroy. - */ - public static class mongocrypt_binary_t extends PointerType { - // The `mongocrypt_binary_t` struct layout is part of libmongocrypt's ABI: - // typedef struct _mongocrypt_binary_t { - // void *data; - // uint32_t len; - // } mongocrypt_binary_t; - // To improve performance, fields are read directly using `getPointer` and `getInt`. - // This results in observed performance improvements over using of `mongocrypt_binary_data` and `mongocrypt_binary_len`. Refer: MONGOCRYPT-589. - public mongocrypt_binary_t() { - super(); - } - public Pointer data() { - return this.getPointer().getPointer(0); - } - public int len() { - int len = this.getPointer().getInt(Native.POINTER_SIZE); - // mongocrypt_binary_t represents length as an unsigned `uint32_t`. - // Representing `uint32_t` values greater than INT32_MAX is represented as a negative `int`. - // Throw an exception. mongocrypt_binary_t is not expected to use lengths greater than INT32_MAX. - if (len < 0) { - throw new AssertionError( - String.format("Expected mongocrypt_binary_t length to be non-negative, got: %d", len)); - } - return len; - - } - } - - /** - * The top-level handle to libmongocrypt. - *

- * Create a mongocrypt_t handle to perform operations within libmongocrypt: - * encryption, decryption, registering log callbacks, etc. - *

- * Functions on a mongocrypt_t are thread safe, though functions on derived - * handle (e.g. mongocrypt_encryptor_t) are not and must be owned by a single - * thread. See each handle's documentation for thread-safety considerations. - *

- * Multiple mongocrypt_t handles may be created. - */ - public static class mongocrypt_t extends PointerType { - } - - /** - * Manages the state machine for encryption or decryption. - */ - public static class mongocrypt_ctx_t extends PointerType { - } - - /** - * Manages a single KMS HTTP request/response. - */ - public static class mongocrypt_kms_ctx_t extends PointerType { - } - - /** - * Returns the version string x.y.z for libmongocrypt. - * - * @param len an optional length of the returned string. May be NULL. - * @return the version string x.y.z for libmongocrypt. - */ - public static native cstring - mongocrypt_version(Pointer len); - - - /** - * Create a new non-owning view of a buffer (data + length). - *

- * Use this to create a mongocrypt_binary_t used for output parameters. - * - * @return A new mongocrypt_binary_t. - */ - public static native mongocrypt_binary_t - mongocrypt_binary_new(); - - - /** - * Create a new non-owning view of a buffer (data + length). - * - * @param data A pointer to an array of bytes. This is not copied. data must outlive the binary object. - * @param len The length of the @p data byte array. - * @return A new mongocrypt_binary_t. - */ - public static native mongocrypt_binary_t - mongocrypt_binary_new_from_data(Pointer data, int len); - - - /** - * Get a pointer to the referenced data. - * - * @param binary The @ref mongocrypt_binary_t. - * @return A pointer to the referenced data. - */ - public static native Pointer - mongocrypt_binary_data(mongocrypt_binary_t binary); - - - /** - * Get the length of the referenced data. - * - * @param binary The @ref mongocrypt_binary_t. - * @return The length of the referenced data. - */ - public static native int - mongocrypt_binary_len(mongocrypt_binary_t binary); - - - /** - * Free the @ref mongocrypt_binary_t. - *

- * This does not free the referenced data. Refer to individual function - * documentation to determine the lifetime guarantees of the underlying - * data. - * - * @param binary The mongocrypt_binary_t destroy. - */ - public static native void - mongocrypt_binary_destroy(mongocrypt_binary_t binary); - - - public static final int MONGOCRYPT_STATUS_OK = 0; - public static final int MONGOCRYPT_STATUS_ERROR_CLIENT = 1; - public static final int MONGOCRYPT_STATUS_ERROR_KMS = 2; - - /** - * Create a new status object. - *

- * Use a new status object to retrieve the status from a handle by passing - * this as an out-parameter to functions like @ref mongocrypt_ctx_status. - * When done, destroy it with @ref mongocrypt_status_destroy. - * - * @return A new status object. - */ - public static native mongocrypt_status_t - mongocrypt_status_new(); - - /** - * Set a status object with message, type, and code. - *

- * Use this to set the mongocrypt_status_t given in the crypto hooks. - * - * @param status The status. - * @param type The status type. - * @param code The status code. - * @param message The message. - * @param message_len The length of @p message. Pass -1 to determine the * string length with strlen (must * be NULL terminated). - */ - public static native void - mongocrypt_status_set(mongocrypt_status_t status, - int type, - int code, - cstring message, - int message_len); - - /** - * Indicates success or the type of error. - * - * @param status The status object. - * @return A @ref mongocrypt_status_type_t. - */ - - public static native int - mongocrypt_status_type(mongocrypt_status_t status); - - - /** - * Get an error code or 0. - * - * @param status The status object. - * @return An error code. - */ - public static native int - mongocrypt_status_code(mongocrypt_status_t status); - - - /** - * Get the error message associated with a status, or an empty string. - * - * @param status The status object. - * @param len an optional length of the returned string. May be NULL. - * @return An error message or an empty string. - */ - public static native cstring - mongocrypt_status_message(mongocrypt_status_t status, Pointer len); - - - /** - * Returns true if the status indicates success. - * - * @param status The status to check. - * @return A boolean indicating success. - */ - public static native boolean - mongocrypt_status_ok(mongocrypt_status_t status); - - - /** - * Free the memory for a status object. - * - * @param status The status to destroy. - */ - public static native void - mongocrypt_status_destroy(mongocrypt_status_t status); - - - public static final int MONGOCRYPT_LOG_LEVEL_FATAL = 0; - public static final int MONGOCRYPT_LOG_LEVEL_ERROR = 1; - public static final int MONGOCRYPT_LOG_LEVEL_WARNING = 2; - public static final int MONGOCRYPT_LOG_LEVEL_INFO = 3; - public static final int MONGOCRYPT_LOG_LEVEL_TRACE = 4; - - - /** - * A log callback function. Set a custom log callback with mongocrypt_setopt_log_handler. - */ - public interface mongocrypt_log_fn_t extends Callback { - void log(int level, cstring message, int message_len, Pointer ctx); - } - - public interface mongocrypt_crypto_fn extends Callback { - boolean crypt(Pointer ctx, mongocrypt_binary_t key, mongocrypt_binary_t iv, mongocrypt_binary_t in, - mongocrypt_binary_t out, Pointer bytesWritten, mongocrypt_status_t status); - } - - public interface mongocrypt_hmac_fn extends Callback { - boolean hmac(Pointer ctx, mongocrypt_binary_t key, mongocrypt_binary_t in, mongocrypt_binary_t out, - mongocrypt_status_t status); - } - - public interface mongocrypt_hash_fn extends Callback { - boolean hash(Pointer ctx, mongocrypt_binary_t in, mongocrypt_binary_t out, mongocrypt_status_t status); - } - - public interface mongocrypt_random_fn extends Callback { - boolean random(Pointer ctx, mongocrypt_binary_t out, int count, mongocrypt_status_t status); - } - - /** - * Allocate a new @ref mongocrypt_t object. - *

- * Initialize with @ref mongocrypt_init. When done, free with @ref - * mongocrypt_destroy. - * - * @return A new @ref mongocrypt_t object. - */ - public static native mongocrypt_t - mongocrypt_new(); - - /** - * Set a handler to get called on every log message. - * - * @param crypt The @ref mongocrypt_t object. - * @param log_fn The log callback. - * @param log_ctx A context passed as an argument to the log callback every - * invokation. - * @return A boolean indicating success. - */ - public static native boolean - mongocrypt_setopt_log_handler(mongocrypt_t crypt, - mongocrypt_log_fn_t log_fn, - Pointer log_ctx); - - - public static native boolean - mongocrypt_setopt_crypto_hooks(mongocrypt_t crypt, - mongocrypt_crypto_fn aes_256_cbc_encrypt, - mongocrypt_crypto_fn aes_256_cbc_decrypt, - mongocrypt_random_fn random, - mongocrypt_hmac_fn hmac_sha_512, - mongocrypt_hmac_fn hmac_sha_256, - mongocrypt_hash_fn sha_256, - Pointer ctx); - - /** - * Set a crypto hook for the AES256-CTR operations. - * - * @param crypt The @ref mongocrypt_t object. - * @param aes_256_ctr_encrypt The crypto callback function for encrypt - * operation. - * @param aes_256_ctr_decrypt The crypto callback function for decrypt - * operation. - * @param ctx A context passed as an argument to the crypto callback - * every invocation. - * @return A boolean indicating success. If false, an error status is set. - * Retrieve it with @ref mongocrypt_status - * - */ - public static native boolean - mongocrypt_setopt_aes_256_ctr (mongocrypt_t crypt, - mongocrypt_crypto_fn aes_256_ctr_encrypt, - mongocrypt_crypto_fn aes_256_ctr_decrypt, - Pointer ctx); - - /** - * Set a crypto hook for the RSASSA-PKCS1-v1_5 algorithm with a SHA-256 hash. - * - *

See: https://tools.ietf.org/html/rfc3447#section-8.2

- * - *

Note: this function has the wrong name. It should be: - * mongocrypt_setopt_crypto_hook_sign_rsassa_pkcs1_v1_5

- * - * @param crypt The @ref mongocrypt_t object. - * @param sign_rsaes_pkcs1_v1_5 The crypto callback function. - * @param sign_ctx A context passed as an argument to the crypto callback - * every invocation. - * @return A boolean indicating success. If false, an error status is set. - * Retrieve it with @ref mongocrypt_status - */ - public static native boolean - mongocrypt_setopt_crypto_hook_sign_rsaes_pkcs1_v1_5( - mongocrypt_t crypt, - mongocrypt_hmac_fn sign_rsaes_pkcs1_v1_5, - Pointer sign_ctx); - - /** - * Set a handler to get called on every log message. - * - * @param crypt The @ref mongocrypt_t object. - * @param aws_access_key_id The AWS access key ID used to generate KMS - * messages. - * @param aws_access_key_id_len The string length (in bytes) of @p - * * aws_access_key_id. Pass -1 to determine the string length with strlen (must - * * be NULL terminated). - * @param aws_secret_access_key The AWS secret access key used to generate - * KMS messages. - * @param aws_secret_access_key_len The string length (in bytes) of @p - * aws_secret_access_key. Pass -1 to determine the string length with strlen - * (must be NULL terminated). - * @return A boolean indicating success. - */ - public static native boolean - mongocrypt_setopt_kms_provider_aws(mongocrypt_t crypt, - cstring aws_access_key_id, - int aws_access_key_id_len, - cstring aws_secret_access_key, - int aws_secret_access_key_len); - - /** - * Configure a local KMS provider on the @ref mongocrypt_t object. - * - * @param crypt The @ref mongocrypt_t object. - * @param key A 64 byte master key used to encrypt and decrypt key vault keys. - * @return A boolean indicating success. - */ - public static native boolean - mongocrypt_setopt_kms_provider_local(mongocrypt_t crypt, - mongocrypt_binary_t key); - - /** - * Configure KMS providers with a BSON document. - * - * @param crypt The @ref mongocrypt_t object. - * @param kms_providers A BSON document mapping the KMS provider names to credentials. - * @return A boolean indicating success. If false, an error status is set. - * @since 1.1 - */ - public static native boolean - mongocrypt_setopt_kms_providers(mongocrypt_t crypt, - mongocrypt_binary_t kms_providers); - - /** - * Set a local schema map for encryption. - * - * @param crypt The @ref mongocrypt_t object. - * @param schema_map A BSON document representing the schema map supplied by - * the user. The keys are collection namespaces and values are JSON schemas. - * @return A boolean indicating success. If false, an error status is set. - * Retrieve it with @ref mongocrypt_status - */ - public static native boolean - mongocrypt_setopt_schema_map (mongocrypt_t crypt, mongocrypt_binary_t schema_map); - - /** - * Opt-into setting KMS providers before each KMS request. - * - * If set, before entering the MONGOCRYPT_CTX_NEED_KMS state, - * contexts will enter the MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS state - * and then wait for credentials to be supplied through @ref mongocrypt_ctx_provide_kms_providers. - * - * @param crypt The @ref mongocrypt_t object to update - */ - public static native void - mongocrypt_setopt_use_need_kms_credentials_state (mongocrypt_t crypt); - - - /** - * Set a local EncryptedFieldConfigMap for encryption. - * - * @param crypt The @ref mongocrypt_t object. - * @param encryptedFieldConfigMap A BSON document representing the EncryptedFieldConfigMap - * supplied by the user. The keys are collection namespaces and values are - * EncryptedFieldConfigMap documents. The viewed data copied. It is valid to - * destroy @p efc_map with @ref mongocrypt_binary_destroy immediately after. - * @return A boolean indicating success. If false, an error status is set. - * Retrieve it with @ref mongocrypt_status - */ - public static native boolean - mongocrypt_setopt_encrypted_field_config_map (mongocrypt_t crypt, mongocrypt_binary_t encryptedFieldConfigMap); - - /** - * Opt-into skipping query analysis. - * - *

If opted in: - *

    - *
  • The crypt_shared shared library will not attempt to be loaded.
    • - *
  • A mongocrypt_ctx_t will never enter the MONGOCRYPT_CTX_NEED_MARKINGS state.
    • - *
- * - * @param crypt The @ref mongocrypt_t object to update - * @since 1.5 - */ - public static native void - mongocrypt_setopt_bypass_query_analysis (mongocrypt_t crypt); - - /** - * Set the contention factor used for explicit encryption. - * The contention factor is only used for indexed Queryable Encryption. - * - * @param ctx The @ref mongocrypt_ctx_t object. - * @param contention_factor the contention factor - * @return A boolean indicating success. If false, an error status is set. - * Retrieve it with @ref mongocrypt_ctx_status. - * @since 1.5 - */ - public static native boolean - mongocrypt_ctx_setopt_contention_factor (mongocrypt_ctx_t ctx, long contention_factor); - - /** - * Set the index key id to use for Queryable Encryption explicit encryption. - * - * If the index key id not set, the key id from @ref mongocrypt_ctx_setopt_key_id is used. - * - * @param ctx The @ref mongocrypt_ctx_t object. - * @param key_id The binary corresponding to the _id (a UUID) of the data key to use from - * the key vault collection. Note, the UUID must be encoded with RFC-4122 byte order. - * The viewed data is copied. It is valid to destroy key_id with @ref mongocrypt_binary_destroy immediately after. - * @return A boolean indicating success. If false, an error status is set. - * Retrieve it with @ref mongocrypt_ctx_status - * @since 1.5 - */ - public static native boolean - mongocrypt_ctx_setopt_index_key_id (mongocrypt_ctx_t ctx, mongocrypt_binary_t key_id); - - /** - * Append an additional search directory to the search path for loading - * the crypt_shared dynamic library. - * - * @param crypt The @ref mongocrypt_t object to update - * @param path A null-terminated sequence of bytes for the search path. On - * some filesystems, this may be arbitrary bytes. On other filesystems, this may - * be required to be a valid UTF-8 code unit sequence. If the leading element of - * the path is the literal string "$ORIGIN", that substring will be replaced - * with the directory path containing the executable libmongocrypt module. If - * the path string is literal "$SYSTEM", then libmongocrypt will defer to the - * system's library resolution mechanism to find the crypt_shared library. - * - *

If no crypt_shared dynamic library is found in any of the directories - * specified by the search paths loaded here, @ref mongocrypt_init() will still - * succeed and continue to operate without crypt_shared.

- * - *

The search paths are searched in the order that they are appended. This - * allows one to provide a precedence in how the library will be discovered. For - * example, appending known directories before appending "$SYSTEM" will allow - * one to supersede the system's installed library, but still fall-back to it if - * the library wasn't found otherwise. If one does not ever append "$SYSTEM", - * then the system's library-search mechanism will never be consulted.

- * - *

If an absolute path to the library is specified using @ref mongocrypt_setopt_set_crypt_shared_lib_path_override, - * then paths appended here will have no effect.

- * @since 1.5 - */ - public static native void - mongocrypt_setopt_append_crypt_shared_lib_search_path (mongocrypt_t crypt, cstring path); - - /** - * Set a single override path for loading the crypt_shared dynamic library. - * @param crypt The @ref mongocrypt_t object to update - * @param path A null-terminated sequence of bytes for a path to the crypt_shared - * dynamic library. On some filesystems, this may be arbitrary bytes. On other - * filesystems, this may be required to be a valid UTF-8 code unit sequence. If - * the leading element of the path is the literal string `$ORIGIN`, that - * substring will be replaced with the directory path containing the executable - * libmongocrypt module. - * - *

This function will do no IO nor path validation. All validation will - * occur during the call to @ref mongocrypt_init.

- *

If a crypt_shared library path override is specified here, then no paths given - * to @ref mongocrypt_setopt_append_crypt_shared_lib_search_path will be consulted when - * opening the crypt_shared library.

- *

If a path is provided via this API and @ref mongocrypt_init fails to - * initialize a valid crypt_shared library instance for the path specified, then - * the initialization of mongocrypt_t will fail with an error.

- * @since 1.5 - */ - public static native void - mongocrypt_setopt_set_crypt_shared_lib_path_override(mongocrypt_t crypt, cstring path); - - /** - * Set the query type to use for Queryable Encryption explicit encryption. - * The query type is only used for indexed Queryable Encryption. - * - * @param ctx The @ref mongocrypt_ctx_t object. - * @param query_type the query type - * @param len the length - * @return A boolean indicating success. If false, an error status is set. - * Retrieve it with @ref mongocrypt_ctx_status - */ - public static native boolean - mongocrypt_ctx_setopt_query_type (mongocrypt_ctx_t ctx, cstring query_type, int len); - - /** - * Set options for explicit encryption with the "range" algorithm. - * NOTE: "range" is currently unstable API and subject to backwards breaking changes. - * - * opts is a BSON document of the form: - * { - * "min": Optional<BSON value>, - * "max": Optional<BSON value>, - * "sparsity": Int64, - * "precision": Optional<Int32> - * "trimFactor": Optional<Int32> - * } - * - * @param ctx The @ref mongocrypt_ctx_t object. - * @param opts BSON. - * @return A boolean indicating success. If false, an error status is set. - * @since 1.7 - */ - public static native boolean - mongocrypt_ctx_setopt_algorithm_range (mongocrypt_ctx_t ctx, mongocrypt_binary_t opts); - - /** - * Initialize new @ref mongocrypt_t object. - * - * @param crypt The @ref mongocrypt_t object. - * @return A boolean indicating success. Failure may occur if previously set options are invalid. - */ - public static native boolean - mongocrypt_init(mongocrypt_t crypt); - - - /** - * Get the status associated with a @ref mongocrypt_t object. - * - * @param crypt The @ref mongocrypt_t object. - * @param status Receives the status. - * @return A boolean indicating success. - */ - public static native boolean - mongocrypt_status(mongocrypt_t crypt, mongocrypt_status_t status); - - /** - * Returns true if libmongocrypt was built with native crypto support. - * - *

- * If libmongocrypt was not built with native crypto support, setting crypto hooks is required. - *

- * - * @return true if libmongocrypt was built with native crypto support - */ - public static native boolean - mongocrypt_is_crypto_available(); - - /** - * Destroy the @ref mongocrypt_t object. - * - * @param crypt The @ref mongocrypt_t object to destroy. - */ - public static native void - mongocrypt_destroy(mongocrypt_t crypt); - - /** - * Obtain a nul-terminated version string of the loaded crypt_shared dynamic library, - * if available. - * - * If no crypt_shared was successfully loaded, this function returns NULL. - * - * @param crypt The mongocrypt_t object after a successful call to mongocrypt_init. - * @param len an optional length of the returned string. May be NULL. - * - * @return A nul-terminated string of the dynamically loaded crypt_shared library. - * @since 1.5 - */ - public static native cstring - mongocrypt_crypt_shared_lib_version_string (mongocrypt_t crypt, Pointer len); - - /** - * Call in response to the MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS state - * to set per-context KMS provider settings. These follow the same format - * as @ref mongocrypt_setopt_kms_providers. If no keys are present in the - * BSON input, the KMS provider settings configured for the @ref mongocrypt_t - * at initialization are used. - * - * @param ctx The @ref mongocrypt_ctx_t object. - * @param kms_providers A BSON document mapping the KMS provider names - * to credentials. - * @return A boolean indicating success. If false, an error status is set. - * Retrieve it with @ref mongocrypt_ctx_status. - */ - public static native boolean - mongocrypt_ctx_provide_kms_providers (mongocrypt_ctx_t ctx, - mongocrypt_binary_t kms_providers); - - /** - * Set the key id to use for explicit encryption. - * - * @param ctx The @ref mongocrypt_ctx_t object. - * @param key_id The key_id to use. - * @return A boolean indicating success. - */ - public static native boolean - mongocrypt_ctx_setopt_key_id (mongocrypt_ctx_t ctx, - mongocrypt_binary_t key_id); - - /** - * Set the keyAltName to use for explicit encryption. - * keyAltName should be a binary encoding a bson document - * with the following format: { "keyAltName" : >BSON UTF8 value< } - * - *

It is an error to set both this and the key id.

- * - * @param ctx The @ref mongocrypt_ctx_t object. - * @param key_alt_name The name to use. - * @return A boolean indicating success. If false, an error status is set. - * Retrieve it with @ref mongocrypt_ctx_status - */ - public static native boolean - mongocrypt_ctx_setopt_key_alt_name (mongocrypt_ctx_t ctx, - mongocrypt_binary_t key_alt_name); - - /** - * Set the keyMaterial to use for encrypting data. - * - *

- * Pass the binary encoding of a BSON document like the following: - * { "keyMaterial" : (BSON BINARY value) } - *

- * - * @param ctx The @ref mongocrypt_ctx_t object. - * @param key_material The data encryption key to use. The viewed data is - * copied. It is valid to destroy @p key_material with @ref - * mongocrypt_binary_destroy immediately after. - * @return A boolean indicating success. If false, an error status is set. - * Retrieve it with @ref mongocrypt_ctx_status - */ - public static native boolean - mongocrypt_ctx_setopt_key_material (mongocrypt_ctx_t ctx, mongocrypt_binary_t key_material); - - /** - * Set the algorithm used for encryption to either - * deterministic or random encryption. This value - * should only be set when using explicit encryption. - * - * If -1 is passed in for "len", then "algorithm" is - * assumed to be a null-terminated string. - * - * Valid values for algorithm are: - * "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic" - * "AEAD_AES_256_CBC_HMAC_SHA_512-Randomized" - * - * @param ctx The @ref mongocrypt_ctx_t object. - * @param algorithm A string specifying the algorithm to - * use for encryption. - * @param len The length of the algorithm string. - * @return A boolean indicating success. - */ - public static native boolean - mongocrypt_ctx_setopt_algorithm (mongocrypt_ctx_t ctx, - cstring algorithm, - int len); - - - /** - * Create a new uninitialized @ref mongocrypt_ctx_t. - *

- * Initialize the context with functions like @ref mongocrypt_ctx_encrypt_init. - * When done, destroy it with @ref mongocrypt_ctx_destroy. - * - * @param crypt The @ref mongocrypt_t object. - * @return A new context. - */ - public static native mongocrypt_ctx_t - mongocrypt_ctx_new(mongocrypt_t crypt); - - - /** - * Get the status associated with a @ref mongocrypt_ctx_t object. - * - * @param ctx The @ref mongocrypt_ctx_t object. - * @param status Receives the status. - * @return A boolean indicating success. - */ - - public static native boolean - mongocrypt_ctx_status(mongocrypt_ctx_t ctx, mongocrypt_status_t status); - - - /** - * Identify the AWS KMS master key to use for creating a data key. - * - * @param ctx The @ref mongocrypt_ctx_t object. - * @param region The AWS region. - * @param region_len The string length of @p region. Pass -1 to determine - * the string length with strlen (must be NULL terminated). - * @param cmk The Amazon Resource Name (ARN) of the customer master key - * (CMK). - * @param cmk_len The string length of @p cmk_len. Pass -1 to determine the - * string length with strlen (must be NULL terminated). - * @return A boolean indicating success. - */ - public static native boolean - mongocrypt_ctx_setopt_masterkey_aws (mongocrypt_ctx_t ctx, - cstring region, - int region_len, - cstring cmk, - int cmk_len); - - /** - * Identify a custom AWS endpoint when creating a data key. - * This is used internally to construct the correct HTTP request - * (with the Host header set to this endpoint). This endpoint - * is persisted in the new data key, and will be returned via - * mongocrypt_kms_ctx_endpoint. - * - * @param ctx The @ref mongocrypt_ctx_t object. - * @param endpoint The endpoint. - * @param endpoint_len The string length of @p endpoint. Pass -1 to - * determine the string length with strlen (must be NULL terminated). - * @return A boolean indicating success. If false, an error status is set. - * Retrieve it with @ref mongocrypt_ctx_status - */ - public static native boolean - mongocrypt_ctx_setopt_masterkey_aws_endpoint (mongocrypt_ctx_t ctx, - cstring endpoint, - int endpoint_len); - - - /** - * Set the master key to "local" for creating a data key. - * - * @param ctx The @ref mongocrypt_ctx_t object. - * @return A boolean indicating success. - */ - public static native boolean - mongocrypt_ctx_setopt_masterkey_local (mongocrypt_ctx_t ctx); - - /** - * Set key encryption key document for creating a data key. - * - * @param ctx The @ref mongocrypt_ctx_t object. - * @param keyDocument BSON representing the key encryption key document. - * @return A boolean indicating success. If false, and error status is set. - * @since 1.1 - */ - public static native boolean - mongocrypt_ctx_setopt_key_encryption_key(mongocrypt_ctx_t ctx, - mongocrypt_binary_t keyDocument); - - /** - * Initialize a context to create a data key. - * - * Set options before using @ref mongocrypt_ctx_setopt_masterkey_aws and - * mongocrypt_ctx_setopt_masterkey_local. - * - * @param ctx The @ref mongocrypt_ctx_t object. - * @return A boolean indicating success. - * - * Assumes a master key option has been set, and an associated KMS provider - * has been set on the parent @ref mongocrypt_t. - */ - public static native boolean - mongocrypt_ctx_datakey_init (mongocrypt_ctx_t ctx); - - /** - * Initialize a context for encryption. - * - * Associated options: - * - @ref mongocrypt_ctx_setopt_cache_noblock - * - @ref mongocrypt_ctx_setopt_schema - * - * @param ctx The @ref mongocrypt_ctx_t object. - * @param db The database name. - * @param db_len The byte length of @p db. Pass -1 to determine the string length with strlen (must be NULL terminated). - * @param cmd The BSON command to be encrypted. - * @return A boolean indicating success. If false, an error status is set. - * Retrieve it with @ref mongocrypt_ctx_status - */ - public static native boolean - mongocrypt_ctx_encrypt_init(mongocrypt_ctx_t ctx, - cstring db, - int db_len, - mongocrypt_binary_t cmd); - - /** - * Explicit helper method to encrypt a single BSON object. Contexts - * created for explicit encryption will not go through mongocryptd. - * - * To specify a key_id, algorithm, or iv to use, please use the - * corresponding mongocrypt_setopt methods before calling this. - * - * This method expects the passed-in BSON to be of the form: - * { "v" : BSON value to encrypt } - * - * @param ctx A @ref mongocrypt_ctx_t. - * @param msg A @ref mongocrypt_binary_t the plaintext BSON value. - * @return A boolean indicating success. - */ - public static native boolean - mongocrypt_ctx_explicit_encrypt_init (mongocrypt_ctx_t ctx, - mongocrypt_binary_t msg); - - /** - * Explicit helper method to encrypt a Match Expression or Aggregate Expression. - * Contexts created for explicit encryption will not go through mongocryptd. - * Requires query_type to be "range". - * NOTE: "range" is currently unstable API and subject to backwards breaking changes. - * - * This method expects the passed-in BSON to be of the form: - * { "v" : FLE2RangeFindDriverSpec } - * - * FLE2RangeFindDriverSpec is a BSON document with one of these forms: - * - * 1. A Match Expression of this form: - * {$and: [{<field>: {<op>: <value1>, {<field>: {<op>: <value2> }}]} - * 2. An Aggregate Expression of this form: - * {$and: [{<op>: [<fieldpath>, <value1>]}, {<op>: [<fieldpath>, <value2>]}] - * - * may be $lt, $lte, $gt, or $gte. - * - * The value of "v" is expected to be the BSON value passed to a driver - * ClientEncryption.encryptExpression helper. - * - * Associated options for FLE 1: - * - @ref mongocrypt_ctx_setopt_key_id - * - @ref mongocrypt_ctx_setopt_key_alt_name - * - @ref mongocrypt_ctx_setopt_algorithm - * - * Associated options for Queryable Encryption: - * - @ref mongocrypt_ctx_setopt_key_id - * - @ref mongocrypt_ctx_setopt_index_key_id - * - @ref mongocrypt_ctx_setopt_contention_factor - * - @ref mongocrypt_ctx_setopt_query_type - * - @ref mongocrypt_ctx_setopt_algorithm_range - * - * An error is returned if FLE 1 and Queryable Encryption incompatible options - * are set. - * - * @param ctx A @ref mongocrypt_ctx_t. - * @param msg A @ref mongocrypt_binary_t the plaintext BSON value. - * @return A boolean indicating success. - * @since 1.7 - */ - public static native boolean - mongocrypt_ctx_explicit_encrypt_expression_init (mongocrypt_ctx_t ctx, - mongocrypt_binary_t msg); - - /** - * Initialize a context for decryption. - * - * @param ctx The mongocrypt_ctx_t object. - * @param doc The document to be decrypted. - * @return A boolean indicating success. - */ - public static native boolean - mongocrypt_ctx_decrypt_init(mongocrypt_ctx_t ctx, mongocrypt_binary_t doc); - - - /** - * Explicit helper method to decrypt a single BSON object. - * - * @param ctx A @ref mongocrypt_ctx_t. - * @param msg A @ref mongocrypt_binary_t the encrypted BSON. - * @return A boolean indicating success. - */ - public static native boolean - mongocrypt_ctx_explicit_decrypt_init (mongocrypt_ctx_t ctx, - mongocrypt_binary_t msg); - - /** - * Initialize a context to rewrap datakeys. - * - * Associated options {@link #mongocrypt_ctx_setopt_key_encryption_key(mongocrypt_ctx_t, mongocrypt_binary_t)} - * - * @param ctx The @ref mongocrypt_ctx_t object. - * @param filter The filter to use for the find command on the key vault collection to retrieve datakeys to rewrap. - * @return A boolean indicating success. If false, and error status is set. - * @since 1.5 - */ - public static native boolean - mongocrypt_ctx_rewrap_many_datakey_init (mongocrypt_ctx_t ctx, mongocrypt_binary_t filter); - - - public static final int MONGOCRYPT_CTX_ERROR = 0; - public static final int MONGOCRYPT_CTX_NEED_MONGO_COLLINFO = 1; /* run on main MongoClient */ - public static final int MONGOCRYPT_CTX_NEED_MONGO_MARKINGS = 2; /* run on mongocryptd. */ - public static final int MONGOCRYPT_CTX_NEED_MONGO_KEYS = 3; /* run on key vault */ - public static final int MONGOCRYPT_CTX_NEED_KMS = 4; - public static final int MONGOCRYPT_CTX_READY = 5; /* ready for encryption/decryption */ - public static final int MONGOCRYPT_CTX_DONE = 6; - public static final int MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS = 7; /* fetch/renew KMS credentials */ - - public static final int MONGOCRYPT_INDEX_TYPE_NONE = 1; - public static final int MONGOCRYPT_INDEX_TYPE_EQUALITY = 2; - public static final int MONGOCRYPT_QUERY_TYPE_EQUALITY = 1; - - /** - * Get the current state of a context. - * - * @param ctx The @ref mongocrypt_ctx_t object. - * @return A @ref mongocrypt_ctx_state_t. - */ - public static native int - mongocrypt_ctx_state(mongocrypt_ctx_t ctx); - - - /** - * Get BSON necessary to run the mongo operation when mongocrypt_ctx_t - * is in MONGOCRYPT_CTX_NEED_MONGO_* states. - * - *

- * op_bson is a BSON document to be used for the operation. - * - For MONGOCRYPT_CTX_NEED_MONGO_COLLINFO it is a listCollections filter. - * - For MONGOCRYPT_CTX_NEED_MONGO_KEYS it is a find filter. - * - For MONGOCRYPT_CTX_NEED_MONGO_MARKINGS it is a JSON schema to append. - *

- * - * @param ctx The @ref mongocrypt_ctx_t object. - * @param op_bson A BSON document for the MongoDB operation. - * @return A boolean indicating success. - */ - public static native boolean - mongocrypt_ctx_mongo_op(mongocrypt_ctx_t ctx, mongocrypt_binary_t op_bson); - - - /** - * Feed a BSON reply or result when when mongocrypt_ctx_t is in - * MONGOCRYPT_CTX_NEED_MONGO_* states. This may be called multiple times - * depending on the operation. - *

- * op_bson is a BSON document to be used for the operation. - * - For MONGOCRYPT_CTX_NEED_MONGO_COLLINFO it is a doc from a listCollections - * cursor. - * - For MONGOCRYPT_CTX_NEED_MONGO_KEYS it is a doc from a find cursor. - * - For MONGOCRYPT_CTX_NEED_MONGO_MARKINGS it is a reply from mongocryptd. - * - * @param ctx The @ref mongocrypt_ctx_t object. - * @param reply A BSON document for the MongoDB operation. - * @return A boolean indicating success. - */ - public static native boolean - mongocrypt_ctx_mongo_feed(mongocrypt_ctx_t ctx, mongocrypt_binary_t reply); - - - /** - * Call when done feeding the reply (or replies) back to the context. - * - * @param ctx The @ref mongocrypt_ctx_t object. - * @return A boolean indicating success. - */ - - public static native boolean - mongocrypt_ctx_mongo_done(mongocrypt_ctx_t ctx); - - /** - * Get the next KMS handle. - *

- * Multiple KMS handles may be retrieved at once. Drivers may do this to fan - * out multiple concurrent KMS HTTP requests. Feeding multiple KMS requests - * is thread-safe. - *

- * Is KMS handles are being handled synchronously, the driver can reuse the same - * TLS socket to send HTTP requests and receive responses. - * - * @param ctx A @ref mongocrypt_ctx_t. - * @return a new @ref mongocrypt_kms_ctx_t or NULL. - */ - public static native mongocrypt_kms_ctx_t - mongocrypt_ctx_next_kms_ctx(mongocrypt_ctx_t ctx); - - /** - * Get the KMS provider identifier associated with this KMS request. - * - * This is used to conditionally configure TLS connections based on the KMS - * request. It is useful for KMIP, which authenticates with a client - * certificate. - * - * @param kms The mongocrypt_kms_ctx_t object. - * @param len Receives the length of the returned string. - * - * @return The name of the KMS provider - */ - public static native cstring - mongocrypt_kms_ctx_get_kms_provider(mongocrypt_kms_ctx_t kms, - Pointer len); - - /** - * Get the HTTP request message for a KMS handle. - * - * @param kms A @ref mongocrypt_kms_ctx_t. - * @param msg The HTTP request to send to KMS. - * @return A boolean indicating success. - */ - public static native boolean - mongocrypt_kms_ctx_message(mongocrypt_kms_ctx_t kms, - mongocrypt_binary_t msg); - - /** - * Get the hostname from which to connect over TLS. - *

- * The storage for @p endpoint is not owned by the caller, but - * is valid until calling @ref mongocrypt_ctx_kms_done on the - * parent @ref mongocrypt_ctx_t. - * - * @param kms A @ref mongocrypt_kms_ctx_t. - * @param endpoint The output hostname. - * @return A boolean indicating success. - */ - public static native boolean - mongocrypt_kms_ctx_endpoint(mongocrypt_kms_ctx_t kms, PointerByReference endpoint); - - /** - * Indicates how many bytes to feed into @ref mongocrypt_kms_ctx_feed. - * - * @param kms The @ref mongocrypt_kms_ctx_t. - * @return The number of requested bytes. - */ - public static native int - mongocrypt_kms_ctx_bytes_needed(mongocrypt_kms_ctx_t kms); - - - /** - * Feed bytes from the HTTP response. - *

- * Feeding more bytes than what has been returned in @ref - * mongocrypt_kms_ctx_bytes_needed is an error. - * - * @param kms The @ref mongocrypt_kms_ctx_t. - * @param bytes The bytes to feed. - * @return A boolean indicating success. - */ - public static native boolean - mongocrypt_kms_ctx_feed(mongocrypt_kms_ctx_t kms, mongocrypt_binary_t bytes); - - - /** - * Get the status associated with a @ref mongocrypt_kms_ctx_t object. - * - * @param kms The @ref mongocrypt_kms_ctx_t object. - * @param status Receives the status. - * @return A boolean indicating success. - */ - public static native boolean - mongocrypt_kms_ctx_status(mongocrypt_kms_ctx_t kms, - mongocrypt_status_t status); - - - /** - * Call when done handling all KMS contexts. - * - * @param ctx The @ref mongocrypt_ctx_t object. - * @return A boolean indicating success. - */ - public static native boolean - mongocrypt_ctx_kms_done(mongocrypt_ctx_t ctx); - - - /** - * Perform the final encryption or decryption. - * - * @param ctx A @ref mongocrypt_ctx_t. - * @param out The final BSON to send to the server. - * @return a boolean indicating success. - */ - public static native boolean - mongocrypt_ctx_finalize(mongocrypt_ctx_t ctx, mongocrypt_binary_t out); - - - /** - * Destroy and free all memory associated with a @ref mongocrypt_ctx_t. - * - * @param ctx A @ref mongocrypt_ctx_t. - */ - public static native void - mongocrypt_ctx_destroy(mongocrypt_ctx_t ctx); - - static final String NATIVE_LIBRARY_NAME = "mongocrypt"; - - static { - Native.register(CAPI.class, NATIVE_LIBRARY_NAME); - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/CAPIHelper.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/CAPIHelper.java deleted file mode 100644 index e836210..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/CAPIHelper.java +++ /dev/null @@ -1,96 +0,0 @@ -/* - * Copyright 2019-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import com.mongodb.crypt.capi.CAPI.mongocrypt_binary_t; -import com.sun.jna.Pointer; -import org.bson.BsonBinaryWriter; -import org.bson.BsonDocument; -import org.bson.RawBsonDocument; -import org.bson.codecs.BsonValueCodecProvider; -import org.bson.codecs.Codec; -import org.bson.codecs.EncoderContext; -import org.bson.codecs.configuration.CodecRegistries; -import org.bson.codecs.configuration.CodecRegistry; -import org.bson.io.BasicOutputBuffer; - -import java.nio.ByteBuffer; - -import static com.mongodb.crypt.capi.CAPI.mongocrypt_binary_data; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_binary_len; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_binary_new_from_data; -import static java.lang.String.format; - -final class CAPIHelper { - - private static final CodecRegistry CODEC_REGISTRY = CodecRegistries.fromProviders(new BsonValueCodecProvider()); - - @SuppressWarnings("unchecked") - static BinaryHolder toBinary(final BsonDocument document) { - BasicOutputBuffer buffer = new BasicOutputBuffer(); - BsonBinaryWriter writer = new BsonBinaryWriter(buffer); - ((Codec) CODEC_REGISTRY.get(document.getClass())).encode(writer, document, EncoderContext.builder().build()); - - DisposableMemory memory = new DisposableMemory(buffer.size()); - memory.write(0, buffer.getInternalBuffer(), 0, buffer.size()); - - return new BinaryHolder(memory, mongocrypt_binary_new_from_data(memory, buffer.getSize())); - } - - static RawBsonDocument toDocument(final mongocrypt_binary_t binary) { - ByteBuffer byteBuffer = toByteBuffer(binary); - byte[] bytes = new byte[byteBuffer.remaining()]; - byteBuffer.get(bytes); - return new RawBsonDocument(bytes); - } - - static BinaryHolder toBinary(final ByteBuffer buffer) { - byte[] message = new byte[buffer.remaining()]; - buffer.get(message, 0, buffer.remaining()); - - DisposableMemory memory = new DisposableMemory(message.length); - memory.write(0, message, 0, message.length); - - return new BinaryHolder(memory, mongocrypt_binary_new_from_data(memory, message.length)); - } - - static ByteBuffer toByteBuffer(final mongocrypt_binary_t binary) { - Pointer pointer = binary.data(); - int length = binary.len(); - return pointer.getByteBuffer(0, length); - } - - static byte[] toByteArray(final mongocrypt_binary_t binary) { - ByteBuffer byteBuffer = toByteBuffer(binary); - byte[] byteArray = new byte[byteBuffer.remaining()]; - byteBuffer.get(byteArray); - return byteArray; - } - - static void writeByteArrayToBinary(final mongocrypt_binary_t binary, byte[] bytes) { - if (binary.len() < bytes.length) { - throw new IllegalArgumentException(format("mongocrypt binary of length %d is not large enough to hold %d bytes", - binary.len(), bytes.length)); - } - Pointer outPointer = binary.data(); - outPointer.write(0, bytes, 0, bytes.length); - } - - private CAPIHelper() { - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/CipherCallback.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/CipherCallback.java deleted file mode 100644 index b10c0f2..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/CipherCallback.java +++ /dev/null @@ -1,92 +0,0 @@ -/* - * Copyright 2008-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import com.mongodb.crypt.capi.CAPI.cstring; -import com.mongodb.crypt.capi.CAPI.mongocrypt_binary_t; -import com.mongodb.crypt.capi.CAPI.mongocrypt_crypto_fn; -import com.mongodb.crypt.capi.CAPI.mongocrypt_status_t; -import com.sun.jna.Pointer; - -import javax.crypto.Cipher; -import javax.crypto.NoSuchPaddingException; -import javax.crypto.spec.IvParameterSpec; -import javax.crypto.spec.SecretKeySpec; -import java.security.NoSuchAlgorithmException; -import java.util.concurrent.ConcurrentLinkedDeque; - -import static com.mongodb.crypt.capi.CAPI.MONGOCRYPT_STATUS_ERROR_CLIENT; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_status_set; -import static com.mongodb.crypt.capi.CAPIHelper.toByteArray; -import static com.mongodb.crypt.capi.CAPIHelper.writeByteArrayToBinary; - -class CipherCallback implements mongocrypt_crypto_fn { - private final String algorithm; - private final String transformation; - private final int mode; - private final CipherPool cipherPool; - - CipherCallback(final String algorithm, final String transformation, final int mode) { - this.algorithm = algorithm; - this.transformation = transformation; - this.mode = mode; - this.cipherPool = new CipherPool(); - } - - @Override - public boolean crypt(final Pointer ctx, final mongocrypt_binary_t key, final mongocrypt_binary_t iv, - final mongocrypt_binary_t in, final mongocrypt_binary_t out, - final Pointer bytesWritten, final mongocrypt_status_t status) { - Cipher cipher = null; - try { - IvParameterSpec ivParameterSpec = new IvParameterSpec(toByteArray(iv)); - SecretKeySpec secretKeySpec = new SecretKeySpec(toByteArray(key), algorithm); - cipher = cipherPool.get(); - cipher.init(mode, secretKeySpec, ivParameterSpec); - - byte[] result = cipher.doFinal(toByteArray(in)); - writeByteArrayToBinary(out, result); - bytesWritten.setInt(0, result.length); - - return true; - } catch (Exception e) { - mongocrypt_status_set(status, MONGOCRYPT_STATUS_ERROR_CLIENT, 0, new cstring(e.toString()), -1); - return false; - } finally { - if (cipher != null) { - cipherPool.release(cipher); - } - } - } - - private class CipherPool { - private final ConcurrentLinkedDeque available = new ConcurrentLinkedDeque<>(); - - Cipher get() throws NoSuchAlgorithmException, NoSuchPaddingException { - Cipher cipher = available.pollLast(); - if (cipher != null) { - return cipher; - } - return Cipher.getInstance(transformation); - } - - void release(final Cipher cipher) { - available.addLast(cipher); - } - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/DisposableMemory.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/DisposableMemory.java deleted file mode 100644 index fdcfb26..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/DisposableMemory.java +++ /dev/null @@ -1,31 +0,0 @@ -/* - * Copyright 2008-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import com.sun.jna.Memory; - -// Subclass of JNA's Memory class so that we can call its protected dispose method -class DisposableMemory extends Memory { - DisposableMemory(final int size) { - super(size); - } - - public void dispose() { - super.dispose(); - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/JULLogger.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/JULLogger.java deleted file mode 100644 index 9a53e85..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/JULLogger.java +++ /dev/null @@ -1,130 +0,0 @@ - -/* - * Copyright 2008-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import java.util.logging.Level; - -import static java.util.logging.Level.FINE; -import static java.util.logging.Level.FINER; -import static java.util.logging.Level.INFO; -import static java.util.logging.Level.SEVERE; -import static java.util.logging.Level.WARNING; - -class JULLogger implements Logger { - - private final java.util.logging.Logger delegate; - - JULLogger(final String name) { - this.delegate = java.util.logging.Logger.getLogger(name); - } - - @Override - public String getName() { - return delegate.getName(); - } - - @Override - public boolean isTraceEnabled() { - return isEnabled(FINER); - } - - @Override - public void trace(final String msg) { - log(FINER, msg); - } - - @Override - public void trace(final String msg, final Throwable t) { - log(FINER, msg, t); - } - - @Override - public boolean isDebugEnabled() { - return isEnabled(FINE); - } - - @Override - public void debug(final String msg) { - log(FINE, msg); - } - - @Override - public void debug(final String msg, final Throwable t) { - log(FINE, msg, t); - } - - @Override - public boolean isInfoEnabled() { - return delegate.isLoggable(INFO); - } - - @Override - public void info(final String msg) { - log(INFO, msg); - } - - @Override - public void info(final String msg, final Throwable t) { - log(INFO, msg, t); - } - - @Override - public boolean isWarnEnabled() { - return delegate.isLoggable(WARNING); - } - - @Override - public void warn(final String msg) { - log(WARNING, msg); - } - - @Override - public void warn(final String msg, final Throwable t) { - log(WARNING, msg, t); - } - - - @Override - public boolean isErrorEnabled() { - return delegate.isLoggable(SEVERE); - } - - @Override - public void error(final String msg) { - log(SEVERE, msg); - } - - @Override - public void error(final String msg, final Throwable t) { - log(SEVERE, msg, t); - } - - - private boolean isEnabled(final Level level) { - return delegate.isLoggable(level); - } - - private void log(final Level level, final String msg) { - delegate.log(level, msg); - } - - public void log(final Level level, final String msg, final Throwable t) { - delegate.log(level, msg, t); - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/Logger.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/Logger.java deleted file mode 100644 index 38e82c2..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/Logger.java +++ /dev/null @@ -1,144 +0,0 @@ - -/* - * Copyright 2008-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -/** - * Not part of the public API - */ -public interface Logger { - /** - * Return the name of this Logger instance. - * - * @return name of this logger instance - */ - String getName(); - - /** - * Is the logger instance enabled for the TRACE level? - * - * @return True if this Logger is enabled for the TRACE level, false otherwise. - */ - boolean isTraceEnabled(); - - /** - * Log a message at the TRACE level. - * - * @param msg the message string to be logged - */ - void trace(String msg); - - /** - * Log an exception (throwable) at the TRACE level with an accompanying message. - * - * @param msg the message accompanying the exception - * @param t the exception (throwable) to log - */ - void trace(String msg, Throwable t); - - /** - * Is the logger instance enabled for the DEBUG level? - * - * @return True if this Logger is enabled for the DEBUG level, false otherwise. - */ - boolean isDebugEnabled(); - - - /** - * Log a message at the DEBUG level. - * - * @param msg the message string to be logged - */ - void debug(String msg); - - - /** - * Log an exception (throwable) at the DEBUG level with an accompanying message. - * - * @param msg the message accompanying the exception - * @param t the exception (throwable) to log - */ - void debug(String msg, Throwable t); - - /** - * Is the logger instance enabled for the INFO level? - * - * @return True if this Logger is enabled for the INFO level, false otherwise. - */ - boolean isInfoEnabled(); - - - /** - * Log a message at the INFO level. - * - * @param msg the message string to be logged - */ - void info(String msg); - - /** - * Log an exception (throwable) at the INFO level with an accompanying message. - * - * @param msg the message accompanying the exception - * @param t the exception (throwable) to log - */ - void info(String msg, Throwable t); - - /** - * Is the logger instance enabled for the WARN level? - * - * @return True if this Logger is enabled for the WARN level, false otherwise. - */ - boolean isWarnEnabled(); - - /** - * Log a message at the WARN level. - * - * @param msg the message string to be logged - */ - void warn(String msg); - - /** - * Log an exception (throwable) at the WARN level with an accompanying message. - * - * @param msg the message accompanying the exception - * @param t the exception (throwable) to log - */ - void warn(String msg, Throwable t); - - /** - * Is the logger instance enabled for the ERROR level? - * - * @return True if this Logger is enabled for the ERROR level, false otherwise. - */ - boolean isErrorEnabled(); - - /** - * Log a message at the ERROR level. - * - * @param msg the message string to be logged - */ - void error(String msg); - - /** - * Log an exception (throwable) at the ERROR level with an accompanying message. - * - * @param msg the message accompanying the exception - * @param t the exception (throwable) to log - */ - void error(String msg, Throwable t); -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/Loggers.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/Loggers.java deleted file mode 100644 index c57cd39..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/Loggers.java +++ /dev/null @@ -1,50 +0,0 @@ -/* - * Copyright 2008-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -/** - * This class is not part of the public API. - */ -public final class Loggers { - private static final String NAME = "org.mongodb.driver.crypt"; - - private static final boolean USE_SLF4J = shouldUseSLF4J(); - - /** - * @return the logger - */ - public static Logger getLogger() { - if (USE_SLF4J) { - return new SLF4JLogger(NAME); - } else { - return new JULLogger(NAME); - } - } - - private Loggers() { - } - - private static boolean shouldUseSLF4J() { - try { - Class.forName("org.slf4j.Logger"); - return true; - } catch (ClassNotFoundException e) { - return false; - } - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MacCallback.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MacCallback.java deleted file mode 100644 index 2ea0955..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MacCallback.java +++ /dev/null @@ -1,60 +0,0 @@ -/* - * Copyright 2008-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import com.mongodb.crypt.capi.CAPI.cstring; -import com.mongodb.crypt.capi.CAPI.mongocrypt_binary_t; -import com.mongodb.crypt.capi.CAPI.mongocrypt_hmac_fn; -import com.mongodb.crypt.capi.CAPI.mongocrypt_status_t; -import com.sun.jna.Pointer; - -import javax.crypto.Mac; -import javax.crypto.spec.SecretKeySpec; - -import static com.mongodb.crypt.capi.CAPI.MONGOCRYPT_STATUS_ERROR_CLIENT; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_status_set; -import static com.mongodb.crypt.capi.CAPIHelper.toByteArray; -import static com.mongodb.crypt.capi.CAPIHelper.writeByteArrayToBinary; - -class MacCallback implements mongocrypt_hmac_fn { - private final String algorithm; - - MacCallback(final String algorithm) { - this.algorithm = algorithm; - } - - @Override - public boolean hmac(final Pointer ctx, final mongocrypt_binary_t key, final mongocrypt_binary_t in, - final mongocrypt_binary_t out, final mongocrypt_status_t status) { - try { - Mac mac = Mac.getInstance(algorithm); - SecretKeySpec keySpec = new SecretKeySpec(toByteArray(key), algorithm); - mac.init(keySpec); - - mac.update(toByteArray(in)); - - byte[] result = mac.doFinal(); - writeByteArrayToBinary(out, result); - - return true; - } catch (Exception e) { - mongocrypt_status_set(status, MONGOCRYPT_STATUS_ERROR_CLIENT, 0, new cstring(e.toString()), -1); - return false; - } - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MessageDigestCallback.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MessageDigestCallback.java deleted file mode 100644 index 861290d..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MessageDigestCallback.java +++ /dev/null @@ -1,55 +0,0 @@ -/* - * Copyright 2008-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import com.mongodb.crypt.capi.CAPI.cstring; -import com.mongodb.crypt.capi.CAPI.mongocrypt_binary_t; -import com.mongodb.crypt.capi.CAPI.mongocrypt_hash_fn; -import com.mongodb.crypt.capi.CAPI.mongocrypt_status_t; -import com.sun.jna.Pointer; - -import java.security.MessageDigest; - -import static com.mongodb.crypt.capi.CAPI.MONGOCRYPT_STATUS_ERROR_CLIENT; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_status_set; -import static com.mongodb.crypt.capi.CAPIHelper.toByteArray; -import static com.mongodb.crypt.capi.CAPIHelper.writeByteArrayToBinary; - -class MessageDigestCallback implements mongocrypt_hash_fn { - - private final String algorithm; - - MessageDigestCallback(final String algorithm) { - this.algorithm = algorithm; - } - - @Override - public boolean hash(final Pointer ctx, final mongocrypt_binary_t in, final mongocrypt_binary_t out, - final mongocrypt_status_t status) { - try { - MessageDigest messageDigest = MessageDigest.getInstance(algorithm); - messageDigest.update(toByteArray(in)); - byte[] digest = messageDigest.digest(); - writeByteArrayToBinary(out, digest); - return true; - } catch (Exception e) { - mongocrypt_status_set(status, MONGOCRYPT_STATUS_ERROR_CLIENT, 0, new cstring(e.toString()), -1); - return false; - } - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoAwsKmsProviderOptions.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoAwsKmsProviderOptions.java deleted file mode 100644 index aa8c0bf..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoAwsKmsProviderOptions.java +++ /dev/null @@ -1,104 +0,0 @@ -/* - * Copyright 2019-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import static org.bson.assertions.Assertions.notNull; - -/** - * The options for configuring the AWS KMS provider. - */ -public class MongoAwsKmsProviderOptions { - - private final String accessKeyId; - private final String secretAccessKey; - - /** - * Construct a builder for the options - * - * @return the builder - */ - public static Builder builder() { - return new Builder(); - } - - /** - * Gets the access key id - * - * @return the access key id, which may not be null - */ - public String getAccessKeyId() { - return accessKeyId; - } - - /** - * Gets the secret access key - * - * @return the secret access key, which may not be null - */ - public String getSecretAccessKey() { - return secretAccessKey; - } - - - /** - * The builder for the options - */ - public static class Builder { - private String accessKeyId; - private String secretAccessKey; - - private Builder() { - } - - /** - * Sets the access key id. - * - * @param accessKeyId the access key id - * @return this - */ - public Builder accessKeyId(final String accessKeyId) { - this.accessKeyId = accessKeyId; - return this; - } - - /** - * Sets the secret access key. - * - * @param secretAccessKey the secret access key - * @return this - */ - public Builder secretAccessKey(final String secretAccessKey) { - this.secretAccessKey = secretAccessKey; - return this; - } - - /** - * Build the options. - * - * @return the options - */ - public MongoAwsKmsProviderOptions build() { - return new MongoAwsKmsProviderOptions(this); - } - } - - private MongoAwsKmsProviderOptions(final Builder builder) { - this.accessKeyId = notNull("AWS KMS provider accessKeyId", builder.accessKeyId); - this.secretAccessKey = notNull("AWS KMS provider secretAccessKey", builder.secretAccessKey); - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCrypt.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCrypt.java deleted file mode 100644 index 5022f2f..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCrypt.java +++ /dev/null @@ -1,100 +0,0 @@ -/* - * Copyright 2019-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - - -package com.mongodb.crypt.capi; - -import org.bson.BsonDocument; - -import java.io.Closeable; - -/** - * A context for encryption/decryption operations. - */ -public interface MongoCrypt extends Closeable { - - /** - * Create a context to use for encryption - * - * @param database the namespace - * @param command the document representing the command to encrypt - * @return the context - */ - MongoCryptContext createEncryptionContext(String database, final BsonDocument command); - - /** - * Create a context to use for decryption - * - * @param document the document to decrypt - * @return the context - */ - MongoCryptContext createDecryptionContext(BsonDocument document); - - /** - * Create a context to use for creating a data key - * @param kmsProvider the KMS provider - * @param options the data key options - * @return the context - */ - MongoCryptContext createDataKeyContext(String kmsProvider, MongoDataKeyOptions options); - - /** - * Create a context to use for encryption - * - * @param document the document to encrypt, which must be in the form { "v" : BSON value to encrypt } - * @param options the explicit encryption options - * @return the context - */ - MongoCryptContext createExplicitEncryptionContext(BsonDocument document, MongoExplicitEncryptOptions options); - - /** - * Create a context to use for encryption - * - * @param document the document to encrypt, which must be in the form { "v" : BSON value to encrypt } - * @param options the expression encryption options - * @return the context - * @since 1.7 - */ - MongoCryptContext createEncryptExpressionContext(BsonDocument document, MongoExplicitEncryptOptions options); - - /** - * Create a context to use for encryption - * - * @param document the document to decrypt,which must be in the form { "v" : encrypted BSON value } - * @return the context - */ - MongoCryptContext createExplicitDecryptionContext(BsonDocument document); - - /** - * Create a context to use for encryption - * - * @param filter The filter to use for the find command on the key vault collection to retrieve datakeys to rewrap. - * @param options the rewrap many data key options - * @return the context - * @since 1.5 - */ - MongoCryptContext createRewrapManyDatakeyContext(BsonDocument filter, MongoRewrapManyDataKeyOptions options); - - /** - * @return the version string of the loaded crypt shared dynamic library if available or null - * @since 1.5 - */ - String getCryptSharedLibVersionString(); - - @Override - void close(); -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptContext.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptContext.java deleted file mode 100644 index cd466c4..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptContext.java +++ /dev/null @@ -1,137 +0,0 @@ -/* - * Copyright 2019-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import org.bson.BsonDocument; -import org.bson.RawBsonDocument; - -import java.io.Closeable; - -/** - * An interface representing the lifecycle of an encryption or decryption request. It's modelled as a state machine. - */ -public interface MongoCryptContext extends Closeable { - - /** - * The possible states. - */ - enum State { - /** - * Needs collection information from the cluster encrypting to - */ - NEED_MONGO_COLLINFO(CAPI.MONGOCRYPT_CTX_NEED_MONGO_COLLINFO), - - /** - * Need to mark command with encryption markers - */ - NEED_MONGO_MARKINGS(CAPI.MONGOCRYPT_CTX_NEED_MONGO_MARKINGS), - - /** - * Need keys from the key vault - */ - NEED_MONGO_KEYS(CAPI.MONGOCRYPT_CTX_NEED_MONGO_KEYS), - - /** - * Need the key management service - */ - NEED_KMS(CAPI.MONGOCRYPT_CTX_NEED_KMS), - - /** - * Need to fetch/renew KMS credentials - * @since 1.4 - */ - NEED_KMS_CREDENTIALS(CAPI.MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS), - - /** - * Ready for encryption/decryption - */ - READY(CAPI.MONGOCRYPT_CTX_READY), - - /** - * Done - */ - DONE(CAPI.MONGOCRYPT_CTX_DONE); - - private final int index; - - State(final int index) { - this.index = index; - } - - static State fromIndex(final int index) { - for (State state : State.values()) { - if (state.index == index) { - return state; - } - } - throw new MongoCryptException("Unknown context state " + index); - } - } - - /** - * Gets the current state. - * - * @return the current state - */ - State getState(); - - /** - * - * @return the operation to execute - */ - RawBsonDocument getMongoOperation(); - - /** - * - * @param document a result of the operation - */ - void addMongoOperationResult(BsonDocument document); - - /** - * Signal completion of the operation - */ - void completeMongoOperation(); - - /** - * Provide KMS credentials on demand, in response to NEED_KMS_CREDENTIALS state - * - * @param credentialsDocument document containing all credentials - * @since 1.4 - */ - void provideKmsProviderCredentials(BsonDocument credentialsDocument); - - /** - * - * @return the next key decryptor, or null if there are no more - */ - MongoKeyDecryptor nextKeyDecryptor(); - - /** - * Indicate that all key decryptors have been completed - */ - void completeKeyDecryptors(); - - /** - * - * @return the encrypted or decrypted document - */ - RawBsonDocument finish(); - - @Override - void close(); -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptContextImpl.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptContextImpl.java deleted file mode 100644 index 4df0fa0..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptContextImpl.java +++ /dev/null @@ -1,164 +0,0 @@ -/* - * Copyright 2019-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import com.mongodb.crypt.capi.CAPI.mongocrypt_binary_t; -import com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_t; -import com.mongodb.crypt.capi.CAPI.mongocrypt_kms_ctx_t; -import org.bson.BsonDocument; -import org.bson.RawBsonDocument; - -import static com.mongodb.crypt.capi.CAPI.mongocrypt_binary_destroy; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_binary_new; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_destroy; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_finalize; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_kms_done; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_mongo_done; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_mongo_feed; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_mongo_op; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_next_kms_ctx; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_provide_kms_providers; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_state; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_status; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_status_destroy; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_status_new; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_status_t; -import static com.mongodb.crypt.capi.CAPIHelper.toBinary; -import static com.mongodb.crypt.capi.CAPIHelper.toDocument; -import static org.bson.assertions.Assertions.isTrue; -import static org.bson.assertions.Assertions.notNull; - -class MongoCryptContextImpl implements MongoCryptContext { - private final mongocrypt_ctx_t wrapped; - private volatile boolean closed; - - MongoCryptContextImpl(final mongocrypt_ctx_t wrapped) { - notNull("wrapped", wrapped); - this.wrapped = wrapped; - } - - @Override - public State getState() { - isTrue("open", !closed); - return State.fromIndex(mongocrypt_ctx_state(wrapped)); - } - - @Override - public RawBsonDocument getMongoOperation() { - isTrue("open", !closed); - mongocrypt_binary_t binary = mongocrypt_binary_new(); - - try { - boolean success = mongocrypt_ctx_mongo_op(wrapped, binary); - if (!success) { - throwExceptionFromStatus(); - } - return toDocument(binary); - } finally { - mongocrypt_binary_destroy(binary); - } - } - - @Override - public void addMongoOperationResult(final BsonDocument document) { - isTrue("open", !closed); - - try (BinaryHolder binaryHolder = toBinary(document)) { - boolean success = mongocrypt_ctx_mongo_feed(wrapped, binaryHolder.getBinary()); - if (!success) { - throwExceptionFromStatus(); - } - } - } - - @Override - public void completeMongoOperation() { - isTrue("open", !closed); - boolean success = mongocrypt_ctx_mongo_done(wrapped); - if (!success) { - throwExceptionFromStatus(); - } - } - - @Override - public void provideKmsProviderCredentials(final BsonDocument credentialsDocument) { - try (BinaryHolder binaryHolder = toBinary(credentialsDocument)) { - boolean success = mongocrypt_ctx_provide_kms_providers(wrapped, binaryHolder.getBinary()); - if (!success) { - throwExceptionFromStatus(); - } - } - } - - @Override - public MongoKeyDecryptor nextKeyDecryptor() { - isTrue("open", !closed); - - mongocrypt_kms_ctx_t kmsContext = mongocrypt_ctx_next_kms_ctx(wrapped); - if (kmsContext == null) { - return null; - } - return new MongoKeyDecryptorImpl(kmsContext); - } - - @Override - public void completeKeyDecryptors() { - isTrue("open", !closed); - - boolean success = mongocrypt_ctx_kms_done(wrapped); - if (!success) { - throwExceptionFromStatus(); - } - - } - - @Override - public RawBsonDocument finish() { - isTrue("open", !closed); - - mongocrypt_binary_t binary = mongocrypt_binary_new(); - - try { - boolean success = mongocrypt_ctx_finalize(wrapped, binary); - if (!success) { - throwExceptionFromStatus(); - } - return toDocument(binary); - } finally { - mongocrypt_binary_destroy(binary); - } - } - - @Override - public void close() { - mongocrypt_ctx_destroy(wrapped); - closed = true; - } - - static void throwExceptionFromStatus(final mongocrypt_ctx_t wrapped) { - mongocrypt_status_t status = mongocrypt_status_new(); - mongocrypt_ctx_status(wrapped, status); - MongoCryptException e = new MongoCryptException(status); - mongocrypt_status_destroy(status); - throw e; - } - - private void throwExceptionFromStatus() { - throwExceptionFromStatus(wrapped); - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptException.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptException.java deleted file mode 100644 index ccde7c8..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptException.java +++ /dev/null @@ -1,67 +0,0 @@ -/* - * Copyright 2019-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - - -import com.mongodb.crypt.capi.CAPI.mongocrypt_status_t; - -import static com.mongodb.crypt.capi.CAPI.mongocrypt_status_code; -import static org.bson.assertions.Assertions.isTrue; - -/** - * Top level Exception for all Mongo Crypt CAPI exceptions - */ -public class MongoCryptException extends RuntimeException { - private static final long serialVersionUID = -5524416583514807953L; - private final int code; - - /** - * @param msg the message - */ - public MongoCryptException(final String msg) { - super(msg); - this.code = -1; - } - - /** - * @param msg the message - * @param cause the cause - */ - public MongoCryptException(final String msg, Throwable cause) { - super(msg, cause); - this.code = -1; - } - - /** - * Construct an instance from a {@code mongocrypt_status_t}. - * - * @param status the status - */ - MongoCryptException(final mongocrypt_status_t status) { - super(CAPI.mongocrypt_status_message(status, null).toString()); - isTrue("status not ok", !CAPI.mongocrypt_status_ok(status)); - code = mongocrypt_status_code(status); - } - - /** - * @return the error code for the exception. - */ - public int getCode() { - return code; - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptImpl.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptImpl.java deleted file mode 100644 index 2132f3c..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptImpl.java +++ /dev/null @@ -1,423 +0,0 @@ -/* - * Copyright 2019-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import com.mongodb.crypt.capi.CAPI.cstring; -import com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_t; -import com.mongodb.crypt.capi.CAPI.mongocrypt_log_fn_t; -import com.mongodb.crypt.capi.CAPI.mongocrypt_status_t; -import com.mongodb.crypt.capi.CAPI.mongocrypt_t; -import com.sun.jna.Pointer; -import org.bson.BsonBinary; -import org.bson.BsonDocument; -import org.bson.BsonString; - -import javax.crypto.Cipher; -import java.nio.ByteBuffer; -import java.security.SecureRandom; -import java.util.concurrent.atomic.AtomicBoolean; -import java.util.function.Supplier; - -import static com.mongodb.crypt.capi.CAPI.MONGOCRYPT_LOG_LEVEL_ERROR; -import static com.mongodb.crypt.capi.CAPI.MONGOCRYPT_LOG_LEVEL_FATAL; -import static com.mongodb.crypt.capi.CAPI.MONGOCRYPT_LOG_LEVEL_INFO; -import static com.mongodb.crypt.capi.CAPI.MONGOCRYPT_LOG_LEVEL_TRACE; -import static com.mongodb.crypt.capi.CAPI.MONGOCRYPT_LOG_LEVEL_WARNING; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_crypt_shared_lib_version_string; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_datakey_init; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_decrypt_init; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_encrypt_init; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_explicit_decrypt_init; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_explicit_encrypt_expression_init; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_explicit_encrypt_init; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_new; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_rewrap_many_datakey_init; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_setopt_algorithm; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_setopt_algorithm_range; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_setopt_contention_factor; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_setopt_key_alt_name; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_setopt_key_encryption_key; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_setopt_key_id; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_setopt_key_material; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_ctx_setopt_query_type; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_destroy; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_init; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_is_crypto_available; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_new; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_setopt_aes_256_ctr; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_setopt_append_crypt_shared_lib_search_path; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_setopt_bypass_query_analysis; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_setopt_crypto_hook_sign_rsaes_pkcs1_v1_5; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_setopt_crypto_hooks; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_setopt_encrypted_field_config_map; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_setopt_kms_provider_aws; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_setopt_kms_provider_local; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_setopt_kms_providers; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_setopt_log_handler; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_setopt_schema_map; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_setopt_set_crypt_shared_lib_path_override; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_setopt_use_need_kms_credentials_state; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_status; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_status_destroy; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_status_new; -import static com.mongodb.crypt.capi.CAPIHelper.toBinary; -import static org.bson.assertions.Assertions.isTrue; -import static org.bson.assertions.Assertions.notNull; - -class MongoCryptImpl implements MongoCrypt { - private static final Logger LOGGER = Loggers.getLogger(); - private final mongocrypt_t wrapped; - - // Keep a strong reference to all the callbacks so that they don't get garbage collected - @SuppressWarnings("FieldCanBeLocal") - private final LogCallback logCallback; - - @SuppressWarnings("FieldCanBeLocal") - private final CipherCallback aesCBC256EncryptCallback; - @SuppressWarnings("FieldCanBeLocal") - private final CipherCallback aesCBC256DecryptCallback; - @SuppressWarnings("FieldCanBeLocal") - private final CipherCallback aesCTR256EncryptCallback; - @SuppressWarnings("FieldCanBeLocal") - private final CipherCallback aesCTR256DecryptCallback; - @SuppressWarnings("FieldCanBeLocal") - private final MacCallback hmacSha512Callback; - @SuppressWarnings("FieldCanBeLocal") - private final MacCallback hmacSha256Callback; - @SuppressWarnings("FieldCanBeLocal") - private final MessageDigestCallback sha256Callback; - @SuppressWarnings("FieldCanBeLocal") - private final SecureRandomCallback secureRandomCallback; - @SuppressWarnings("FieldCanBeLocal") - private final SigningRSAESPKCSCallback signingRSAESPKCSCallback; - - private final AtomicBoolean closed; - - MongoCryptImpl(final MongoCryptOptions options) { - closed = new AtomicBoolean(); - wrapped = mongocrypt_new(); - if (wrapped == null) { - throw new MongoCryptException("Unable to create new mongocrypt object"); - } - - logCallback = new LogCallback(); - - configure(() -> mongocrypt_setopt_log_handler(wrapped, logCallback, null)); - - if (mongocrypt_is_crypto_available()) { - LOGGER.debug("libmongocrypt is compiled with cryptography support, so not registering Java callbacks"); - aesCBC256EncryptCallback = null; - aesCBC256DecryptCallback = null; - aesCTR256EncryptCallback = null; - aesCTR256DecryptCallback = null; - hmacSha512Callback = null; - hmacSha256Callback = null; - sha256Callback = null; - secureRandomCallback = null; - signingRSAESPKCSCallback = null; - } else { - LOGGER.debug("libmongocrypt is compiled without cryptography support, so registering Java callbacks"); - // We specify NoPadding here because the underlying C library is responsible for padding prior - // to executing the callback - aesCBC256EncryptCallback = new CipherCallback("AES", "AES/CBC/NoPadding", Cipher.ENCRYPT_MODE); - aesCBC256DecryptCallback = new CipherCallback("AES", "AES/CBC/NoPadding", Cipher.DECRYPT_MODE); - aesCTR256EncryptCallback = new CipherCallback("AES", "AES/CTR/NoPadding", Cipher.ENCRYPT_MODE); - aesCTR256DecryptCallback = new CipherCallback("AES", "AES/CTR/NoPadding", Cipher.DECRYPT_MODE); - - hmacSha512Callback = new MacCallback("HmacSHA512"); - hmacSha256Callback = new MacCallback("HmacSHA256"); - sha256Callback = new MessageDigestCallback("SHA-256"); - secureRandomCallback = new SecureRandomCallback(new SecureRandom()); - - configure(() -> mongocrypt_setopt_crypto_hooks(wrapped, aesCBC256EncryptCallback, aesCBC256DecryptCallback, - secureRandomCallback, hmacSha512Callback, hmacSha256Callback, - sha256Callback, null)); - - signingRSAESPKCSCallback = new SigningRSAESPKCSCallback(); - configure(() -> mongocrypt_setopt_crypto_hook_sign_rsaes_pkcs1_v1_5(wrapped, signingRSAESPKCSCallback, null)); - configure(() -> mongocrypt_setopt_aes_256_ctr(wrapped, aesCTR256EncryptCallback, aesCTR256DecryptCallback, null)); - } - - if (options.getLocalKmsProviderOptions() != null) { - try (BinaryHolder localMasterKeyBinaryHolder = toBinary(options.getLocalKmsProviderOptions().getLocalMasterKey())) { - configure(() -> mongocrypt_setopt_kms_provider_local(wrapped, localMasterKeyBinaryHolder.getBinary())); - } - } - - if (options.getAwsKmsProviderOptions() != null) { - configure(() -> mongocrypt_setopt_kms_provider_aws(wrapped, - new cstring(options.getAwsKmsProviderOptions().getAccessKeyId()), -1, - new cstring(options.getAwsKmsProviderOptions().getSecretAccessKey()), -1)); - } - - if (options.isNeedsKmsCredentialsStateEnabled()) { - mongocrypt_setopt_use_need_kms_credentials_state(wrapped); - } - - if (options.getKmsProviderOptions() != null) { - try (BinaryHolder binaryHolder = toBinary(options.getKmsProviderOptions())) { - configure(() -> mongocrypt_setopt_kms_providers(wrapped, binaryHolder.getBinary())); - } - } - - if (options.getLocalSchemaMap() != null) { - BsonDocument localSchemaMapDocument = new BsonDocument(); - localSchemaMapDocument.putAll(options.getLocalSchemaMap()); - - try (BinaryHolder localSchemaMapBinaryHolder = toBinary(localSchemaMapDocument)) { - configure(() -> mongocrypt_setopt_schema_map(wrapped, localSchemaMapBinaryHolder.getBinary())); - } - } - - if (options.isBypassQueryAnalysis()) { - mongocrypt_setopt_bypass_query_analysis(wrapped); - } - - if (options.getEncryptedFieldsMap() != null) { - BsonDocument localEncryptedFieldsMap = new BsonDocument(); - localEncryptedFieldsMap.putAll(options.getEncryptedFieldsMap()); - - try (BinaryHolder localEncryptedFieldsMapHolder = toBinary(localEncryptedFieldsMap)) { - configure(() -> mongocrypt_setopt_encrypted_field_config_map(wrapped, localEncryptedFieldsMapHolder.getBinary())); - } - } - - options.getSearchPaths().forEach(p -> mongocrypt_setopt_append_crypt_shared_lib_search_path(wrapped, new cstring(p))); - if (options.getExtraOptions().containsKey("cryptSharedLibPath")) { - mongocrypt_setopt_set_crypt_shared_lib_path_override(wrapped, new cstring(options.getExtraOptions().getString("cryptSharedLibPath").getValue())); - } - - configure(() -> mongocrypt_init(wrapped)); - } - - @Override - public MongoCryptContext createEncryptionContext(final String database, final BsonDocument commandDocument) { - isTrue("open", !closed.get()); - notNull("database", database); - notNull("commandDocument", commandDocument); - mongocrypt_ctx_t context = mongocrypt_ctx_new(wrapped); - if (context == null) { - throwExceptionFromStatus(); - } - - try (BinaryHolder commandDocumentBinaryHolder = toBinary(commandDocument)) { - configure(() -> mongocrypt_ctx_encrypt_init(context, new cstring(database), -1, - commandDocumentBinaryHolder.getBinary()), context); - return new MongoCryptContextImpl(context); - } - } - - @Override - public MongoCryptContext createDecryptionContext(final BsonDocument document) { - isTrue("open", !closed.get()); - mongocrypt_ctx_t context = mongocrypt_ctx_new(wrapped); - if (context == null) { - throwExceptionFromStatus(); - } - try (BinaryHolder documentBinaryHolder = toBinary(document)){ - configure(() -> mongocrypt_ctx_decrypt_init(context, documentBinaryHolder.getBinary()), context); - } - return new MongoCryptContextImpl(context); - } - - @Override - public MongoCryptContext createDataKeyContext(final String kmsProvider, final MongoDataKeyOptions options) { - isTrue("open", !closed.get()); - mongocrypt_ctx_t context = mongocrypt_ctx_new(wrapped); - if (context == null) { - throwExceptionFromStatus(); - } - - BsonDocument keyDocument = new BsonDocument("provider", new BsonString(kmsProvider)); - BsonDocument masterKey = options.getMasterKey(); - if (masterKey != null) { - masterKey.forEach(keyDocument::append); - } - try (BinaryHolder masterKeyHolder = toBinary(keyDocument)) { - configure(() -> mongocrypt_ctx_setopt_key_encryption_key(context, masterKeyHolder.getBinary()), context); - } - - if (options.getKeyAltNames() != null) { - for (String cur : options.getKeyAltNames()) { - try (BinaryHolder keyAltNameBinaryHolder = toBinary(new BsonDocument("keyAltName", new BsonString(cur)))) { - configure(() -> mongocrypt_ctx_setopt_key_alt_name(context, keyAltNameBinaryHolder.getBinary()), context); - } - } - } - - if (options.getKeyMaterial() != null) { - try (BinaryHolder keyMaterialBinaryHolder = toBinary(new BsonDocument("keyMaterial", new BsonBinary(options.getKeyMaterial())))) { - configure(() -> mongocrypt_ctx_setopt_key_material(context, keyMaterialBinaryHolder.getBinary()), context); - } - } - - if (!mongocrypt_ctx_datakey_init(context)) { - MongoCryptContextImpl.throwExceptionFromStatus(context); - } - return new MongoCryptContextImpl(context); - } - - @Override - public MongoCryptContext createExplicitEncryptionContext(final BsonDocument document, final MongoExplicitEncryptOptions options) { - isTrue("open", !closed.get()); - mongocrypt_ctx_t context = configureExplicitEncryption(options); - - try (BinaryHolder documentBinaryHolder = toBinary(document)) { - configure(() -> mongocrypt_ctx_explicit_encrypt_init(context, documentBinaryHolder.getBinary()), context); - } - - return new MongoCryptContextImpl(context); - } - - @Override - public MongoCryptContext createEncryptExpressionContext(final BsonDocument document, final MongoExplicitEncryptOptions options) { - isTrue("open", !closed.get()); - mongocrypt_ctx_t context = configureExplicitEncryption(options); - - try (BinaryHolder documentBinaryHolder = toBinary(document)) { - configure(() -> mongocrypt_ctx_explicit_encrypt_expression_init(context, documentBinaryHolder.getBinary()), context); - } - return new MongoCryptContextImpl(context); - } - - @Override - public MongoCryptContext createExplicitDecryptionContext(final BsonDocument document) { - isTrue("open", !closed.get()); - mongocrypt_ctx_t context = mongocrypt_ctx_new(wrapped); - if (context == null) { - throwExceptionFromStatus(); - } - try (BinaryHolder binaryHolder = toBinary(document)) { - configure(() -> mongocrypt_ctx_explicit_decrypt_init(context, binaryHolder.getBinary()), context); - } - return new MongoCryptContextImpl(context); - } - - @Override - public MongoCryptContext createRewrapManyDatakeyContext(final BsonDocument filter, final MongoRewrapManyDataKeyOptions options) { - isTrue("open", !closed.get()); - mongocrypt_ctx_t context = mongocrypt_ctx_new(wrapped); - if (context == null) { - throwExceptionFromStatus(); - } - - if (options != null && options.getProvider() != null) { - BsonDocument keyDocument = new BsonDocument("provider", new BsonString(options.getProvider())); - BsonDocument masterKey = options.getMasterKey(); - if (masterKey != null) { - masterKey.forEach(keyDocument::append); - } - try (BinaryHolder binaryHolder = toBinary(keyDocument)) { - configure(() -> mongocrypt_ctx_setopt_key_encryption_key(context, binaryHolder.getBinary()), context); - } - } - - try (BinaryHolder binaryHolder = toBinary(filter)) { - configure(() -> mongocrypt_ctx_rewrap_many_datakey_init(context, binaryHolder.getBinary()), context); - } - return new MongoCryptContextImpl(context); - } - - @Override - public String getCryptSharedLibVersionString() { - cstring versionString = mongocrypt_crypt_shared_lib_version_string(wrapped, null); - return versionString == null ? null : versionString.toString(); - } - - @Override - public void close() { - if (!closed.getAndSet(true)) { - mongocrypt_destroy(wrapped); - } - } - - private mongocrypt_ctx_t configureExplicitEncryption(final MongoExplicitEncryptOptions options) { - mongocrypt_ctx_t context = mongocrypt_ctx_new(wrapped); - if (context == null) { - throwExceptionFromStatus(); - } - - if (options.getKeyId() != null) { - try (BinaryHolder keyIdBinaryHolder = toBinary(ByteBuffer.wrap(options.getKeyId().getData()))) { - configure(() -> mongocrypt_ctx_setopt_key_id(context, keyIdBinaryHolder.getBinary()), context); - } - } else if (options.getKeyAltName() != null) { - try (BinaryHolder keyAltNameBinaryHolder = toBinary(new BsonDocument("keyAltName", new BsonString(options.getKeyAltName())))) { - configure(() -> mongocrypt_ctx_setopt_key_alt_name(context, keyAltNameBinaryHolder.getBinary()), context); - } - } - - if (options.getAlgorithm() != null) { - configure(() -> mongocrypt_ctx_setopt_algorithm(context, new cstring(options.getAlgorithm()), -1), context); - } - if (options.getQueryType() != null) { - configure(() -> mongocrypt_ctx_setopt_query_type(context, new cstring(options.getQueryType()), -1), context); - } - if (options.getContentionFactor() != null) { - configure(() -> mongocrypt_ctx_setopt_contention_factor(context, options.getContentionFactor()), context); - } - if (options.getRangeOptions() != null) { - try (BinaryHolder rangeOptionsHolder = toBinary(options.getRangeOptions())) { - configure(() -> mongocrypt_ctx_setopt_algorithm_range(context, rangeOptionsHolder.getBinary()), context); - } - } - return context; - } - - - private void configure(final Supplier successSupplier) { - if (!successSupplier.get()) { - throwExceptionFromStatus(); - } - } - - private void configure(final Supplier successSupplier, final mongocrypt_ctx_t context) { - if (!successSupplier.get()) { - MongoCryptContextImpl.throwExceptionFromStatus(context); - } - } - - private void throwExceptionFromStatus() { - mongocrypt_status_t status = mongocrypt_status_new(); - mongocrypt_status(wrapped, status); - MongoCryptException e = new MongoCryptException(status); - mongocrypt_status_destroy(status); - throw e; - } - - static class LogCallback implements mongocrypt_log_fn_t { - @Override - public void log(final int level, final cstring message, final int messageLength, final Pointer ctx) { - if (level == MONGOCRYPT_LOG_LEVEL_FATAL) { - LOGGER.error(message.toString()); - } - if (level == MONGOCRYPT_LOG_LEVEL_ERROR) { - LOGGER.error(message.toString()); - } - if (level == MONGOCRYPT_LOG_LEVEL_WARNING) { - LOGGER.warn(message.toString()); - } - if (level == MONGOCRYPT_LOG_LEVEL_INFO) { - LOGGER.info(message.toString()); - } - if (level == MONGOCRYPT_LOG_LEVEL_TRACE) { - LOGGER.trace(message.toString()); - } - } - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptOptions.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptOptions.java deleted file mode 100644 index a35af76..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCryptOptions.java +++ /dev/null @@ -1,284 +0,0 @@ -/* - * Copyright 2019-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import org.bson.BsonDocument; -import java.util.List; -import java.util.Map; - -import static java.util.Collections.emptyList; -import static org.bson.assertions.Assertions.isTrue; - -/** - * The options for configuring MongoCrypt. - */ -public class MongoCryptOptions { - - private final MongoAwsKmsProviderOptions awsKmsProviderOptions; - private final MongoLocalKmsProviderOptions localKmsProviderOptions; - private final BsonDocument kmsProviderOptions; - private final Map localSchemaMap; - private final boolean needsKmsCredentialsStateEnabled; - private final Map encryptedFieldsMap; - private final BsonDocument extraOptions; - private final boolean bypassQueryAnalysis; - private final List searchPaths; - - - /** - * Construct a builder for the options - * - * @return the builder - */ - public static Builder builder() { - return new Builder(); - } - - /** - * Gets the AWS KMS provider options. - * - * @return the AWS KMS provider options, which may be null - */ - public MongoAwsKmsProviderOptions getAwsKmsProviderOptions() { - return awsKmsProviderOptions; - } - - /** - * Gets the local KMS provider options. - * - * @return the local KMS provider options, which may be null - */ - public MongoLocalKmsProviderOptions getLocalKmsProviderOptions() { - return localKmsProviderOptions; - } - - /** - * Returns the KMS provider options. - * - * @return the KMS provider options, which may be null - * @since 1.1 - */ - public BsonDocument getKmsProviderOptions() { - return kmsProviderOptions; - } - - /** - * Gets the local schema map. - * - * @return the local schema map - */ - public Map getLocalSchemaMap() { - return localSchemaMap; - } - - /** - * Gets whether the MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS is enabled. Defaults to false - * - * @return whether the MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS is enabled - * @since 1.4 - */ - public boolean isNeedsKmsCredentialsStateEnabled() { - return needsKmsCredentialsStateEnabled; - } - - /** - * Gets the encrypted fields map. - * - * @since 1.5 - * @return the encrypted fields map - */ - public Map getEncryptedFieldsMap() { - return encryptedFieldsMap; - } - - /** - * Gets whether automatic analysis of outgoing commands should be disabled. - * - * @since 1.5 - * @return true if bypassing query analysis - */ - public boolean isBypassQueryAnalysis() { - return bypassQueryAnalysis; - } - - /** - * The extraOptions that relate to the mongocryptd process or shared library. - * @return the extra options - * @since 1.5 - */ - public BsonDocument getExtraOptions() { - return extraOptions; - } - - /** - * Gets the search paths - * @return this - * @since 1.5 - */ - public List getSearchPaths() { - return searchPaths; - } - - /** - * The builder for the options - */ - public static class Builder { - private MongoAwsKmsProviderOptions awsKmsProviderOptions; - private MongoLocalKmsProviderOptions localKmsProviderOptions; - private BsonDocument kmsProviderOptions = null; - private Map localSchemaMap = null; - private boolean needsKmsCredentialsStateEnabled; - private Map encryptedFieldsMap = null; - private boolean bypassQueryAnalysis; - private BsonDocument extraOptions = new BsonDocument(); - private List searchPaths = emptyList(); - - private Builder() { - } - - /** - * Sets the AWS KMS provider options. - * - * @param awsKmsProviderOptions the AWS KMS provider options - * @return this - */ - public Builder awsKmsProviderOptions(final MongoAwsKmsProviderOptions awsKmsProviderOptions) { - this.awsKmsProviderOptions = awsKmsProviderOptions; - return this; - } - - /** - * Sets the local KMS provider options. - * - * @param localKmsProviderOptions the local KMS provider options - * @return this - */ - public Builder localKmsProviderOptions(final MongoLocalKmsProviderOptions localKmsProviderOptions) { - this.localKmsProviderOptions = localKmsProviderOptions; - return this; - } - - /** - * Sets the KMS provider options. - * - * @param kmsProviderOptions the KMS provider options document - * @return this - * @since 1.1 - */ - public Builder kmsProviderOptions(final BsonDocument kmsProviderOptions) { - this.kmsProviderOptions = kmsProviderOptions; - return this; - } - - /** - * Sets the local schema map. - * - * @param localSchemaMap local schema map - * @return this - */ - public Builder localSchemaMap(final Map localSchemaMap) { - this.localSchemaMap = localSchemaMap; - return this; - } - - /** - * Sets whether the MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS is enabled. Defaults to false - * - * @param needsKmsCredentialsStateEnabled whether the MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS is enabled - * @return this - * @since 1.4 - */ - public Builder needsKmsCredentialsStateEnabled(final boolean needsKmsCredentialsStateEnabled) { - this.needsKmsCredentialsStateEnabled = needsKmsCredentialsStateEnabled; - return this; - } - - /** - * Sets the encrypted fields map. - * - * @param encryptedFieldsMap the encrypted fields map - * @since 1.5 - * @return this - */ - public Builder encryptedFieldsMap(final Map encryptedFieldsMap) { - this.encryptedFieldsMap = encryptedFieldsMap; - return this; - } - - /** - * Sets whether automatic analysis of outgoing commands should be disabled. - * - *

Set bypassQueryAnalysis to true to use explicit encryption on indexed fields - * without the MongoDB Enterprise Advanced licensed crypt shared library.

- * - * @param bypassQueryAnalysis whether the analysis of outgoing commands should be disabled. - * @since 1.5 - * @return this - */ - public Builder bypassQueryAnalysis(final boolean bypassQueryAnalysis) { - this.bypassQueryAnalysis = bypassQueryAnalysis; - return this; - } - - /** - * The extraOptions that relate to the mongocryptd process or shared library. - * @param extraOptions the extraOptions - * @return this - * @since 1.5 - */ - public Builder extraOptions(final BsonDocument extraOptions) { - this.extraOptions = extraOptions; - return this; - } - - /** - * Sets search paths - * @param searchPaths sets search path - * @return this - * @since 1.5 - */ - public Builder searchPaths(final List searchPaths) { - this.searchPaths = searchPaths; - return this; - } - - /** - * Build the options. - * - * @return the options - */ - public MongoCryptOptions build() { - return new MongoCryptOptions(this); - } - } - - private MongoCryptOptions(final Builder builder) { - isTrue("at least one KMS provider is configured", - builder.awsKmsProviderOptions != null || builder.localKmsProviderOptions != null - || builder.kmsProviderOptions != null ); - this.awsKmsProviderOptions = builder.awsKmsProviderOptions; - this.localKmsProviderOptions = builder.localKmsProviderOptions; - this.kmsProviderOptions = builder.kmsProviderOptions; - this.localSchemaMap = builder.localSchemaMap; - this.needsKmsCredentialsStateEnabled = builder.needsKmsCredentialsStateEnabled; - this.encryptedFieldsMap = builder.encryptedFieldsMap; - this.bypassQueryAnalysis = builder.bypassQueryAnalysis; - this.extraOptions = builder.extraOptions; - this.searchPaths = builder.searchPaths; - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCrypts.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCrypts.java deleted file mode 100644 index 8316f16..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoCrypts.java +++ /dev/null @@ -1,38 +0,0 @@ -/* - * Copyright 2019-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -/** - * The entry point to the MongoCrypt library. - */ -public class MongoCrypts { - - /** - * Create a {@code MongoCrypt} instance. - * - *

- * Make sure that JNA is able to find the shared library, most likely by setting the jna.library.path system property - *

- * - * @param options the options - * @return the instance - */ - public static MongoCrypt create(MongoCryptOptions options) { - return new MongoCryptImpl(options); - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoDataKeyOptions.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoDataKeyOptions.java deleted file mode 100644 index a21d715..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoDataKeyOptions.java +++ /dev/null @@ -1,125 +0,0 @@ -/* - * Copyright 2008-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import org.bson.BsonDocument; - -import java.util.List; - -/** - * The options for creation of a data key - */ -public class MongoDataKeyOptions { - private final List keyAltNames; - private final BsonDocument masterKey; - private final byte[] keyMaterial; - - /** - * Options builder - */ - public static class Builder { - private List keyAltNames; - private BsonDocument masterKey; - private byte[] keyMaterial; - - /** - * Add alternate key names - * @param keyAltNames the alternate key names - * @return this - */ - public Builder keyAltNames(final List keyAltNames) { - this.keyAltNames = keyAltNames; - return this; - } - - /** - * Add the master key. - * - * @param masterKey the master key - * @return this - */ - public Builder masterKey(final BsonDocument masterKey) { - this.masterKey = masterKey; - return this; - } - - /** - * Add the key material - * - * @param keyMaterial the optional custom key material for the data key - * @return this - * @since 1.5 - */ - public Builder keyMaterial(final byte[] keyMaterial) { - this.keyMaterial = keyMaterial; - return this; - } - - /** - * Build the options. - * - * @return the options - */ - public MongoDataKeyOptions build() { - return new MongoDataKeyOptions(this); - } - } - - /** - * Create a builder for the options. - * - * @return the builder - */ - public static Builder builder() { - return new Builder(); - } - - /** - * Gets the alternate key names for the data key. - * - * @return the alternate key names - */ - public List getKeyAltNames() { - return keyAltNames; - } - - /** - * Gets the master key for the data key. - * - * @return the master key - */ - public BsonDocument getMasterKey() { - return masterKey; - } - - /** - * Gets the custom key material if set. - * - * @return the custom key material for the data key or null - * @since 1.5 - */ - public byte[] getKeyMaterial() { - return keyMaterial; - } - - private MongoDataKeyOptions(final Builder builder) { - keyAltNames = builder.keyAltNames; - masterKey = builder.masterKey; - keyMaterial = builder.keyMaterial; - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoExplicitEncryptOptions.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoExplicitEncryptOptions.java deleted file mode 100644 index e96808e..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoExplicitEncryptOptions.java +++ /dev/null @@ -1,227 +0,0 @@ -/* - * Copyright 2008-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import org.bson.BsonBinary; -import org.bson.BsonDocument; - -import java.util.Objects; - -/** - * Options for explicit encryption. - */ -public class MongoExplicitEncryptOptions { - private final BsonBinary keyId; - private final String keyAltName; - private final String algorithm; - private final Long contentionFactor; - private final String queryType; - private final BsonDocument rangeOptions; - - /** - * The builder for the options - */ - public static class Builder { - private BsonBinary keyId; - private String keyAltName; - private String algorithm; - private Long contentionFactor; - private String queryType; - private BsonDocument rangeOptions; - - private Builder() { - } - - /** - * Add the key identifier. - * - * @param keyId the key idenfifier - * @return this - */ - public Builder keyId(final BsonBinary keyId) { - this.keyId = keyId; - return this; - } - - /** - * Add the key alternative name. - * - * @param keyAltName the key alternative name - * @return this - */ - public Builder keyAltName(final String keyAltName) { - this.keyAltName = keyAltName; - return this; - } - - /** - * Add the encryption algorithm. - * - *

To insert or query with an "Indexed" encrypted payload, use a MongoClient configured with {@code AutoEncryptionSettings}. - * {@code AutoEncryptionSettings.bypassQueryAnalysis} may be true. - * {@code AutoEncryptionSettings.bypassAutoEncryption must be false}.

- * - * @param algorithm the encryption algorithm - * @return this - */ - public Builder algorithm(final String algorithm) { - this.algorithm = algorithm; - return this; - } - - /** - * The contention factor. - * - *

It is an error to set contentionFactor when algorithm is not "Indexed". - * @param contentionFactor the contention factor - * @return this - * @since 1.5 - */ - public Builder contentionFactor(final Long contentionFactor) { - this.contentionFactor = contentionFactor; - return this; - } - - /** - * The QueryType. - * - *

It is an error to set queryType when algorithm is not "Indexed".

- * - * @param queryType the query type - * @return this - * @since 1.5 - */ - public Builder queryType(final String queryType) { - this.queryType = queryType; - return this; - } - - /** - * The Range Options. - * - *

It is an error to set rangeOptions when the algorithm is not "range".

- * - * @param rangeOptions the range options - * @return this - * @since 1.7 - */ - public Builder rangeOptions(final BsonDocument rangeOptions) { - this.rangeOptions = rangeOptions; - return this; - } - - /** - * Build the options. - * - * @return the options - */ - public MongoExplicitEncryptOptions build() { - return new MongoExplicitEncryptOptions(this); - } - } - - /** - * Create a builder for the options. - * - * @return the builder - */ - public static Builder builder() { - return new Builder(); - } - - /** - * Gets the key identifier - * @return the key identifier - */ - public BsonBinary getKeyId() { - return keyId; - } - - /** - * Gets the key alternative name - * @return the key alternative name - */ - public String getKeyAltName() { - return keyAltName; - } - - /** - * Gets the encryption algorithm - * @return the encryption algorithm - */ - public String getAlgorithm() { - return algorithm; - } - - /** - * Gets the contention factor - * @return the contention factor - * @since 1.5 - */ - public Long getContentionFactor() { - return contentionFactor; - } - - /** - * Gets the query type - * @return the query type - * @since 1.5 - */ - public String getQueryType() { - return queryType; - } - - /** - * Gets the range options - * @return the range options - * @since 1.7 - */ - public BsonDocument getRangeOptions() { - return rangeOptions; - } - - private MongoExplicitEncryptOptions(Builder builder) { - this.keyId = builder.keyId; - this.keyAltName = builder.keyAltName; - this.algorithm = builder.algorithm; - this.contentionFactor = builder.contentionFactor; - this.queryType = builder.queryType; - this.rangeOptions = builder.rangeOptions; - if (!(Objects.equals(algorithm, "Indexed") || Objects.equals(algorithm, "Range"))) { - if (contentionFactor != null) { - throw new IllegalStateException( - "Invalid configuration, contentionFactor can only be set if algorithm is 'Indexed' or 'Range'"); - } else if (queryType != null) { - throw new IllegalStateException( - "Invalid configuration, queryType can only be set if algorithm is 'Indexed' or 'Range'"); - } - } - } - - @Override - public String toString() { - return "MongoExplicitEncryptOptions{" + - "keyId=" + keyId + - ", keyAltName='" + keyAltName + '\'' + - ", algorithm='" + algorithm + '\'' + - ", contentionFactor=" + contentionFactor + - ", queryType='" + queryType + '\'' + - ", rangeOptions=" + rangeOptions + - '}'; - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoKeyDecryptor.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoKeyDecryptor.java deleted file mode 100644 index 8ba0cc2..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoKeyDecryptor.java +++ /dev/null @@ -1,76 +0,0 @@ -/* - * Copyright 2019-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import java.nio.ByteBuffer; - -/** - * An interface representing a key decryption operation using a key management service. - */ -public interface MongoKeyDecryptor { - - /** - * Gets the name of the KMS provider, e.g. "aws" or "kmip" - * - * @return the KMS provider name - */ - String getKmsProvider(); - - /** - * Gets the host name of the key management service. - * - * @return the host name - */ - String getHostName(); - - /** - * Gets the message to send to the key management service. - * - *

- * Clients should call this method first, and send the message on a TLS connection to a configured KMS server. - *

- * - * @return the message to send - */ - ByteBuffer getMessage(); - - /** - * Gets the number of bytes that should be received from the KMS server. - * - *

- * After sending the message to the KMS server, clients should call this method in a loop, receiving {@code bytesNeeded} from - * the KMS server and feeding those bytes to this decryptor, until {@code bytesNeeded} is 0. - *

- * - * @return the actual number of bytes that clients should be prepared receive - */ - int bytesNeeded(); - - /** - * Feed the received bytes to the decryptor. - * - *

- * After sending the message to the KMS server, clients should call this method in a loop, receiving the number of bytes indicated by - * a call to {@link #bytesNeeded()} from the KMS server and feeding those bytes to this decryptor, until {@link #bytesNeeded()} - * returns 0. - *

- * - * @param bytes the received bytes - */ - void feed(ByteBuffer bytes); -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoKeyDecryptorImpl.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoKeyDecryptorImpl.java deleted file mode 100644 index b509b08..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoKeyDecryptorImpl.java +++ /dev/null @@ -1,105 +0,0 @@ -/* - * Copyright 2019-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import com.mongodb.crypt.capi.CAPI.mongocrypt_binary_t; -import com.mongodb.crypt.capi.CAPI.mongocrypt_kms_ctx_t; -import com.mongodb.crypt.capi.CAPI.mongocrypt_status_t; -import com.sun.jna.Pointer; -import com.sun.jna.ptr.PointerByReference; - -import java.nio.ByteBuffer; - -import static com.mongodb.crypt.capi.CAPI.mongocrypt_binary_destroy; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_binary_new; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_kms_ctx_bytes_needed; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_kms_ctx_endpoint; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_kms_ctx_feed; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_kms_ctx_get_kms_provider; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_kms_ctx_message; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_kms_ctx_status; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_status; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_status_destroy; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_status_new; -import static com.mongodb.crypt.capi.CAPIHelper.toBinary; -import static com.mongodb.crypt.capi.CAPIHelper.toByteBuffer; -import static org.bson.assertions.Assertions.notNull; - -class MongoKeyDecryptorImpl implements MongoKeyDecryptor { - private final mongocrypt_kms_ctx_t wrapped; - - MongoKeyDecryptorImpl(final mongocrypt_kms_ctx_t wrapped) { - notNull("wrapped", wrapped); - this.wrapped = wrapped; - } - - @Override - public String getKmsProvider() { - return mongocrypt_kms_ctx_get_kms_provider(wrapped, null).toString(); - } - - @Override - public String getHostName() { - PointerByReference hostNamePointerByReference = new PointerByReference(); - boolean success = mongocrypt_kms_ctx_endpoint(wrapped, hostNamePointerByReference); - if (!success) { - throwExceptionFromStatus(); - } - Pointer hostNamePointer = hostNamePointerByReference.getValue(); - return hostNamePointer.getString(0); - } - - @Override - public ByteBuffer getMessage() { - mongocrypt_binary_t binary = mongocrypt_binary_new(); - - try { - boolean success = mongocrypt_kms_ctx_message(wrapped, binary); - if (!success) { - throwExceptionFromStatus(); - } - return toByteBuffer(binary); - } finally { - mongocrypt_binary_destroy(binary); - } - } - - @Override - public int bytesNeeded() { - return mongocrypt_kms_ctx_bytes_needed(wrapped); - } - - @Override - public void feed(final ByteBuffer bytes) { - try (BinaryHolder binaryHolder = toBinary(bytes)) { - boolean success = mongocrypt_kms_ctx_feed(wrapped, binaryHolder.getBinary()); - if (!success) { - throwExceptionFromStatus(); - } - } - } - - private void throwExceptionFromStatus() { - mongocrypt_status_t status = mongocrypt_status_new(); - mongocrypt_kms_ctx_status(wrapped, status); - MongoCryptException e = new MongoCryptException(status); - mongocrypt_status_destroy(status); - throw e; - } - -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoLocalKmsProviderOptions.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoLocalKmsProviderOptions.java deleted file mode 100644 index 790fbff..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoLocalKmsProviderOptions.java +++ /dev/null @@ -1,83 +0,0 @@ -/* - * Copyright 2019-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import java.nio.ByteBuffer; - -import static org.bson.assertions.Assertions.notNull; - -/** - * The options for configuring a local KMS provider. - */ -public class MongoLocalKmsProviderOptions { - - private final ByteBuffer localMasterKey; - - /** - * Construct a builder for the options - * - * @return the builder - */ - public static Builder builder() { - return new Builder(); - } - - /** - * Gets the local master key - * - * @return the local master key - */ - public ByteBuffer getLocalMasterKey() { - return localMasterKey; - } - - /** - * The builder for the options - */ - public static class Builder { - private ByteBuffer localMasterKey; - - private Builder() { - } - - /** - * Sets the local master key. - * - * @param localMasterKey the local master key - * @return this - */ - public Builder localMasterKey(final ByteBuffer localMasterKey) { - this.localMasterKey = localMasterKey; - return this; - } - - /** - * Build the options. - * - * @return the options - */ - public MongoLocalKmsProviderOptions build() { - return new MongoLocalKmsProviderOptions(this); - } - } - - private MongoLocalKmsProviderOptions(final Builder builder) { - this.localMasterKey = notNull("Local KMS provider localMasterKey", builder.localMasterKey); - - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoRewrapManyDataKeyOptions.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoRewrapManyDataKeyOptions.java deleted file mode 100644 index d875c8d..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/MongoRewrapManyDataKeyOptions.java +++ /dev/null @@ -1,104 +0,0 @@ -/* - * Copyright 2008-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package com.mongodb.crypt.capi; - -import org.bson.BsonDocument; - -/** - * The rewrap many data key options - * - *

- * The masterKey document MUST have the fields corresponding to the given provider as specified in masterKey. - *

- * - * @since 1.5 - */ -public class MongoRewrapManyDataKeyOptions { - - private final String provider; - private final BsonDocument masterKey; - - /** - * Options builder - */ - public static class Builder { - private String provider; - private BsonDocument masterKey; - - /** - * The provider - * - * @param provider the provider - * @return this - */ - public Builder provider(final String provider) { - this.provider = provider; - return this; - } - - /** - * Add the master key. - * - * @param masterKey the master key - * @return this - */ - public Builder masterKey(final BsonDocument masterKey) { - this.masterKey = masterKey; - return this; - } - - /** - * Build the options. - * - * @return the options - */ - public MongoRewrapManyDataKeyOptions build() { - return new MongoRewrapManyDataKeyOptions(this); - } - } - - /** - * Create a builder for the options. - * - * @return the builder - */ - public static Builder builder() { - return new Builder(); - } - - /** - * @return the provider name - */ - public String getProvider() { - return provider; - } - - /** - * Gets the master key for the data key. - * - * @return the master key - */ - public BsonDocument getMasterKey() { - return masterKey; - } - - private MongoRewrapManyDataKeyOptions(final Builder builder) { - provider = builder.provider; - masterKey = builder.masterKey; - } -} - diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/SLF4JLogger.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/SLF4JLogger.java deleted file mode 100644 index 23064f8..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/SLF4JLogger.java +++ /dev/null @@ -1,110 +0,0 @@ - -/* - * Copyright 2008-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import org.slf4j.LoggerFactory; - -class SLF4JLogger implements Logger { - - private final org.slf4j.Logger delegate; - - SLF4JLogger(final String name) { - this.delegate = LoggerFactory.getLogger(name); - } - - @Override - public String getName() { - return delegate.getName(); - } - - @Override - public boolean isTraceEnabled() { - return delegate.isTraceEnabled(); - } - - @Override - public void trace(final String msg) { - delegate.trace(msg); - } - - @Override - public void trace(final String msg, final Throwable t) { - delegate.trace(msg, t); - } - - @Override - public boolean isDebugEnabled() { - return delegate.isDebugEnabled(); - } - - @Override - public void debug(final String msg) { - delegate.debug(msg); - } - - @Override - public void debug(final String msg, final Throwable t) { - delegate.debug(msg, t); - } - - @Override - public boolean isInfoEnabled() { - return delegate.isInfoEnabled(); - } - - @Override - public void info(final String msg) { - delegate.info(msg); - } - - @Override - public void info(final String msg, final Throwable t) { - delegate.info(msg, t); - } - - @Override - public boolean isWarnEnabled() { - return delegate.isWarnEnabled(); - } - - @Override - public void warn(final String msg) { - delegate.warn(msg); - } - - @Override - public void warn(final String msg, final Throwable t) { - delegate.warn(msg, t); - } - - @Override - public boolean isErrorEnabled() { - return delegate.isErrorEnabled(); - } - - @Override - public void error(final String msg) { - delegate.error(msg); - } - - @Override - public void error(final String msg, final Throwable t) { - delegate.error(msg, t); - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/SecureRandomCallback.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/SecureRandomCallback.java deleted file mode 100644 index 0a2a83c..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/SecureRandomCallback.java +++ /dev/null @@ -1,51 +0,0 @@ -/* - * Copyright 2008-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import com.mongodb.crypt.capi.CAPI.cstring; -import com.mongodb.crypt.capi.CAPI.mongocrypt_binary_t; -import com.mongodb.crypt.capi.CAPI.mongocrypt_random_fn; -import com.mongodb.crypt.capi.CAPI.mongocrypt_status_t; -import com.sun.jna.Pointer; - -import java.security.SecureRandom; - -import static com.mongodb.crypt.capi.CAPI.MONGOCRYPT_STATUS_ERROR_CLIENT; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_status_set; -import static com.mongodb.crypt.capi.CAPIHelper.writeByteArrayToBinary; - -class SecureRandomCallback implements mongocrypt_random_fn { - private final SecureRandom secureRandom; - - SecureRandomCallback(final SecureRandom secureRandom) { - this.secureRandom = secureRandom; - } - - @Override - public boolean random(final Pointer ctx, final mongocrypt_binary_t out, final int count, final mongocrypt_status_t status) { - try { - byte[] randomBytes = new byte[count]; - secureRandom.nextBytes(randomBytes); - writeByteArrayToBinary(out, randomBytes); - return true; - } catch (Exception e) { - mongocrypt_status_set(status, MONGOCRYPT_STATUS_ERROR_CLIENT, 0, new cstring(e.toString()), -1); - return false; - } - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/SigningRSAESPKCSCallback.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/SigningRSAESPKCSCallback.java deleted file mode 100644 index f68b518..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/SigningRSAESPKCSCallback.java +++ /dev/null @@ -1,76 +0,0 @@ -/* - * Copyright 2008-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import com.mongodb.crypt.capi.CAPI.cstring; -import com.mongodb.crypt.capi.CAPI.mongocrypt_binary_t; -import com.mongodb.crypt.capi.CAPI.mongocrypt_hmac_fn; -import com.mongodb.crypt.capi.CAPI.mongocrypt_status_t; -import com.sun.jna.Pointer; - -import javax.crypto.Mac; -import javax.crypto.spec.SecretKeySpec; - -import java.security.InvalidKeyException; -import java.security.KeyFactory; -import java.security.NoSuchAlgorithmException; -import java.security.PrivateKey; -import java.security.Signature; -import java.security.SignatureException; -import java.security.spec.InvalidKeySpecException; -import java.security.spec.KeySpec; -import java.security.spec.PKCS8EncodedKeySpec; - -import static com.mongodb.crypt.capi.CAPI.MONGOCRYPT_STATUS_ERROR_CLIENT; -import static com.mongodb.crypt.capi.CAPI.mongocrypt_status_set; -import static com.mongodb.crypt.capi.CAPIHelper.toByteArray; -import static com.mongodb.crypt.capi.CAPIHelper.writeByteArrayToBinary; - -class SigningRSAESPKCSCallback implements mongocrypt_hmac_fn { - - private static final String KEY_ALGORITHM = "RSA"; - private static final String SIGN_ALGORITHM = "SHA256withRSA"; - - SigningRSAESPKCSCallback() { - } - - @Override - public boolean hmac(final Pointer ctx, final mongocrypt_binary_t key, final mongocrypt_binary_t in, - final mongocrypt_binary_t out, final mongocrypt_status_t status) { - try { - byte[] result = getSignature(toByteArray(key), toByteArray(in)); - writeByteArrayToBinary(out, result); - return true; - } catch (Exception e) { - mongocrypt_status_set(status, MONGOCRYPT_STATUS_ERROR_CLIENT, 0, new cstring(e.toString()), -1); - return false; - } - } - - static byte[] getSignature(final byte[] privateKeyBytes, final byte[] dataToSign) throws NoSuchAlgorithmException, InvalidKeySpecException, InvalidKeyException, SignatureException { - KeySpec keySpec = new PKCS8EncodedKeySpec(privateKeyBytes); - KeyFactory keyFactory = KeyFactory.getInstance(KEY_ALGORITHM); - PrivateKey privateKey = keyFactory.generatePrivate(keySpec); - - Signature privateSignature = Signature.getInstance(SIGN_ALGORITHM); - privateSignature.initSign(privateKey); - privateSignature.update(dataToSign); - - return privateSignature.sign(); - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/package-info.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/package-info.java deleted file mode 100644 index 50f9417..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/java/com/mongodb/crypt/capi/package-info.java +++ /dev/null @@ -1,18 +0,0 @@ -/* - * Copyright 2019-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/resources/META-INF/native-image/jni-config.json b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/resources/META-INF/native-image/jni-config.json deleted file mode 100644 index 44e398c..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/resources/META-INF/native-image/jni-config.json +++ /dev/null @@ -1,180 +0,0 @@ -[ -{ - "name":"com.mongodb.crypt.capi.CAPI$mongocrypt_crypto_fn", - "methods":[{"name":"crypt","parameterTypes":["com.sun.jna.Pointer","com.mongodb.crypt.capi.CAPI$mongocrypt_binary_t","com.mongodb.crypt.capi.CAPI$mongocrypt_binary_t","com.mongodb.crypt.capi.CAPI$mongocrypt_binary_t","com.mongodb.crypt.capi.CAPI$mongocrypt_binary_t","com.sun.jna.Pointer","com.mongodb.crypt.capi.CAPI$mongocrypt_status_t"] }] -}, -{ - "name":"com.mongodb.crypt.capi.CAPI$mongocrypt_hash_fn", - "methods":[{"name":"hash","parameterTypes":["com.sun.jna.Pointer","com.mongodb.crypt.capi.CAPI$mongocrypt_binary_t","com.mongodb.crypt.capi.CAPI$mongocrypt_binary_t","com.mongodb.crypt.capi.CAPI$mongocrypt_status_t"] }] -}, -{ - "name":"com.mongodb.crypt.capi.CAPI$mongocrypt_hmac_fn", - "methods":[{"name":"hmac","parameterTypes":["com.sun.jna.Pointer","com.mongodb.crypt.capi.CAPI$mongocrypt_binary_t","com.mongodb.crypt.capi.CAPI$mongocrypt_binary_t","com.mongodb.crypt.capi.CAPI$mongocrypt_binary_t","com.mongodb.crypt.capi.CAPI$mongocrypt_status_t"] }] -}, -{ - "name":"com.mongodb.crypt.capi.CAPI$mongocrypt_log_fn_t", - "methods":[{"name":"log","parameterTypes":["int","com.mongodb.crypt.capi.CAPI$cstring","int","com.sun.jna.Pointer"] }] -}, -{ - "name":"com.mongodb.crypt.capi.CAPI$mongocrypt_random_fn", - "methods":[{"name":"random","parameterTypes":["com.sun.jna.Pointer","com.mongodb.crypt.capi.CAPI$mongocrypt_binary_t","int","com.mongodb.crypt.capi.CAPI$mongocrypt_status_t"] }] -}, -{ - "name":"com.sun.jna.Callback" -}, -{ - "name":"com.sun.jna.CallbackReference", - "methods":[{"name":"getCallback","parameterTypes":["java.lang.Class","com.sun.jna.Pointer","boolean"] }, {"name":"getFunctionPointer","parameterTypes":["com.sun.jna.Callback","boolean"] }, {"name":"getNativeString","parameterTypes":["java.lang.Object","boolean"] }, {"name":"initializeThread","parameterTypes":["com.sun.jna.Callback","com.sun.jna.CallbackReference$AttachOptions"] }] -}, -{ - "name":"com.sun.jna.CallbackReference$AttachOptions" -}, -{ - "name":"com.sun.jna.FromNativeConverter", - "methods":[{"name":"nativeType","parameterTypes":[] }] -}, -{ - "name":"com.sun.jna.IntegerType", - "fields":[{"name":"value"}] -}, -{ - "name":"com.sun.jna.JNIEnv" -}, -{ - "name":"com.sun.jna.Native", - "methods":[{"name":"dispose","parameterTypes":[] }, {"name":"fromNative","parameterTypes":["com.sun.jna.FromNativeConverter","java.lang.Object","java.lang.reflect.Method"] }, {"name":"fromNative","parameterTypes":["java.lang.Class","java.lang.Object"] }, {"name":"fromNative","parameterTypes":["java.lang.reflect.Method","java.lang.Object"] }, {"name":"nativeType","parameterTypes":["java.lang.Class"] }, {"name":"toNative","parameterTypes":["com.sun.jna.ToNativeConverter","java.lang.Object"] }] -}, -{ - "name":"com.sun.jna.Native$ffi_callback", - "methods":[{"name":"invoke","parameterTypes":["long","long","long"] }] -}, -{ - "name":"com.sun.jna.NativeMapped", - "methods":[{"name":"toNative","parameterTypes":[] }] -}, -{ - "name":"com.sun.jna.Pointer", - "fields":[{"name":"peer"}], - "methods":[{"name":"","parameterTypes":["long"] }] -}, -{ - "name":"com.sun.jna.PointerType", - "fields":[{"name":"pointer"}] -}, -{ - "name":"com.sun.jna.Structure", - "fields":[{"name":"memory"}, {"name":"typeInfo"}], - "methods":[{"name":"autoRead","parameterTypes":[] }, {"name":"autoWrite","parameterTypes":[] }, {"name":"getTypeInfo","parameterTypes":[] }, {"name":"newInstance","parameterTypes":["java.lang.Class","long"] }] -}, -{ - "name":"com.sun.jna.Structure$ByValue" -}, -{ - "name":"com.sun.jna.Structure$FFIType$FFITypes", - "fields":[{"name":"ffi_type_double"}, {"name":"ffi_type_float"}, {"name":"ffi_type_longdouble"}, {"name":"ffi_type_pointer"}, {"name":"ffi_type_sint16"}, {"name":"ffi_type_sint32"}, {"name":"ffi_type_sint64"}, {"name":"ffi_type_sint8"}, {"name":"ffi_type_uint16"}, {"name":"ffi_type_uint32"}, {"name":"ffi_type_uint64"}, {"name":"ffi_type_uint8"}, {"name":"ffi_type_void"}] -}, -{ - "name":"com.sun.jna.WString", - "methods":[{"name":"","parameterTypes":["java.lang.String"] }] -}, -{ - "name":"java.lang.Boolean", - "fields":[{"name":"TYPE"}, {"name":"value"}], - "methods":[{"name":"","parameterTypes":["boolean"] }, {"name":"getBoolean","parameterTypes":["java.lang.String"] }] -}, -{ - "name":"java.lang.Byte", - "fields":[{"name":"TYPE"}, {"name":"value"}], - "methods":[{"name":"","parameterTypes":["byte"] }] -}, -{ - "name":"java.lang.Character", - "fields":[{"name":"TYPE"}, {"name":"value"}], - "methods":[{"name":"","parameterTypes":["char"] }] -}, -{ - "name":"java.lang.Class", - "methods":[{"name":"getComponentType","parameterTypes":[] }] -}, -{ - "name":"java.lang.Double", - "fields":[{"name":"TYPE"}, {"name":"value"}], - "methods":[{"name":"","parameterTypes":["double"] }] -}, -{ - "name":"java.lang.Float", - "fields":[{"name":"TYPE"}, {"name":"value"}], - "methods":[{"name":"","parameterTypes":["float"] }] -}, -{ - "name":"java.lang.Integer", - "fields":[{"name":"TYPE"}, {"name":"value"}], - "methods":[{"name":"","parameterTypes":["int"] }] -}, -{ - "name":"java.lang.Long", - "fields":[{"name":"TYPE"}, {"name":"value"}], - "methods":[{"name":"","parameterTypes":["long"] }] -}, -{ - "name":"java.lang.Object", - "methods":[{"name":"toString","parameterTypes":[] }] -}, -{ - "name":"java.lang.Short", - "fields":[{"name":"TYPE"}, {"name":"value"}], - "methods":[{"name":"","parameterTypes":["short"] }] -}, -{ - "name":"java.lang.String", - "methods":[{"name":"","parameterTypes":["byte[]"] }, {"name":"","parameterTypes":["byte[]","java.lang.String"] }, {"name":"getBytes","parameterTypes":[] }, {"name":"getBytes","parameterTypes":["java.lang.String"] }, {"name":"lastIndexOf","parameterTypes":["int"] }, {"name":"substring","parameterTypes":["int"] }, {"name":"toCharArray","parameterTypes":[] }] -}, -{ - "name":"java.lang.System", - "methods":[{"name":"getProperty","parameterTypes":["java.lang.String"] }, {"name":"setProperty","parameterTypes":["java.lang.String","java.lang.String"] }] -}, -{ - "name":"java.lang.UnsatisfiedLinkError", - "methods":[{"name":"","parameterTypes":["java.lang.String"] }] -}, -{ - "name":"java.lang.Void", - "fields":[{"name":"TYPE"}] -}, -{ - "name":"java.lang.reflect.Method", - "methods":[{"name":"getParameterTypes","parameterTypes":[] }, {"name":"getReturnType","parameterTypes":[] }] -}, -{ - "name":"java.nio.Buffer", - "methods":[{"name":"position","parameterTypes":[] }] -}, -{ - "name":"java.nio.ByteBuffer", - "methods":[{"name":"array","parameterTypes":[] }, {"name":"arrayOffset","parameterTypes":[] }] -}, -{ - "name":"java.nio.CharBuffer", - "methods":[{"name":"array","parameterTypes":[] }, {"name":"arrayOffset","parameterTypes":[] }] -}, -{ - "name":"java.nio.DoubleBuffer", - "methods":[{"name":"array","parameterTypes":[] }, {"name":"arrayOffset","parameterTypes":[] }] -}, -{ - "name":"java.nio.FloatBuffer", - "methods":[{"name":"array","parameterTypes":[] }, {"name":"arrayOffset","parameterTypes":[] }] -}, -{ - "name":"java.nio.IntBuffer", - "methods":[{"name":"array","parameterTypes":[] }, {"name":"arrayOffset","parameterTypes":[] }] -}, -{ - "name":"java.nio.LongBuffer", - "methods":[{"name":"array","parameterTypes":[] }, {"name":"arrayOffset","parameterTypes":[] }] -}, -{ - "name":"java.nio.ShortBuffer", - "methods":[{"name":"array","parameterTypes":[] }, {"name":"arrayOffset","parameterTypes":[] }] -} -] diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/resources/META-INF/native-image/reflect-config.json b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/resources/META-INF/native-image/reflect-config.json deleted file mode 100644 index 4187c0e..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/main/resources/META-INF/native-image/reflect-config.json +++ /dev/null @@ -1,134 +0,0 @@ -[ -{ - "name":"com.mongodb.crypt.capi.CAPI", - "allPublicFields":true, - "queryAllDeclaredMethods":true -}, -{ - "name":"com.mongodb.crypt.capi.CAPI$cstring", - "methods":[{"name":"","parameterTypes":[] }] -}, -{ - "name":"com.mongodb.crypt.capi.CAPI$mongocrypt_binary_t", - "methods":[{"name":"","parameterTypes":[] }] -}, -{ - "name":"com.mongodb.crypt.capi.CAPI$mongocrypt_crypto_fn", - "queryAllDeclaredMethods":true, - "queryAllPublicMethods":true -}, -{ - "name":"com.mongodb.crypt.capi.CAPI$mongocrypt_ctx_t", - "methods":[{"name":"","parameterTypes":[] }] -}, -{ - "name":"com.mongodb.crypt.capi.CAPI$mongocrypt_hash_fn", - "queryAllDeclaredMethods":true, - "queryAllPublicMethods":true -}, -{ - "name":"com.mongodb.crypt.capi.CAPI$mongocrypt_hmac_fn", - "queryAllDeclaredMethods":true, - "queryAllPublicMethods":true -}, -{ - "name":"com.mongodb.crypt.capi.CAPI$mongocrypt_kms_ctx_t", - "methods":[{"name":"","parameterTypes":[] }] -}, -{ - "name":"com.mongodb.crypt.capi.CAPI$mongocrypt_log_fn_t", - "queryAllDeclaredMethods":true, - "queryAllPublicMethods":true -}, -{ - "name":"com.mongodb.crypt.capi.CAPI$mongocrypt_random_fn", - "queryAllDeclaredMethods":true, - "queryAllPublicMethods":true -}, -{ - "name":"com.mongodb.crypt.capi.CAPI$mongocrypt_status_t", - "methods":[{"name":"","parameterTypes":[] }] -}, -{ - "name":"com.mongodb.crypt.capi.CAPI$mongocrypt_t", - "methods":[{"name":"","parameterTypes":[] }] -}, -{ - "name":"com.sun.jna.CallbackProxy", - "methods":[{"name":"callback","parameterTypes":["java.lang.Object[]"] }] -}, -{ - "name":"com.sun.jna.Pointer", - "fields":[{"name":"OPTIONS"}, {"name":"STRING_ENCODING"}, {"name":"STRUCTURE_ALIGNMENT"}, {"name":"TYPE_MAPPER"}] -}, -{ - "name":"com.sun.jna.Structure$FFIType", - "allDeclaredFields":true, - "queryAllPublicConstructors":true, - "fields":[{"name":"OPTIONS"}, {"name":"STRING_ENCODING"}, {"name":"STRUCTURE_ALIGNMENT"}, {"name":"TYPE_MAPPER"}], - "methods":[{"name":"","parameterTypes":[] }] -}, -{ - "name":"com.sun.jna.Structure$FFIType$size_t", - "methods":[{"name":"","parameterTypes":[] }] -}, -{ - "name":"com.sun.jna.ptr.PointerByReference", - "fields":[{"name":"OPTIONS"}, {"name":"STRING_ENCODING"}, {"name":"STRUCTURE_ALIGNMENT"}, {"name":"TYPE_MAPPER"}], - "methods":[{"name":"","parameterTypes":[] }] -}, -{ - "name":"boolean", - "fields":[{"name":"OPTIONS"}, {"name":"STRING_ENCODING"}, {"name":"STRUCTURE_ALIGNMENT"}, {"name":"TYPE_MAPPER"}] -}, -{ - "name":"com.sun.crypto.provider.AESCipher$General", - "methods":[{"name":"","parameterTypes":[] }] -}, -{ - "name":"com.sun.crypto.provider.HmacCore$HmacSHA256", - "methods":[{"name":"","parameterTypes":[] }] -}, -{ - "name":"com.sun.crypto.provider.HmacCore$HmacSHA512", - "methods":[{"name":"","parameterTypes":[] }] -}, -{ - "name":"int", - "fields":[{"name":"OPTIONS"}, {"name":"STRING_ENCODING"}, {"name":"STRUCTURE_ALIGNMENT"}, {"name":"TYPE_MAPPER"}] -}, -{ - "name":"java.lang.Throwable", - "methods":[{"name":"addSuppressed","parameterTypes":["java.lang.Throwable"] }] -}, -{ - "name":"java.lang.reflect.Method", - "methods":[{"name":"isVarArgs","parameterTypes":[] }] -}, -{ - "name":"java.nio.Buffer" -}, -{ - "name":"long", - "fields":[{"name":"OPTIONS"}, {"name":"STRING_ENCODING"}, {"name":"STRUCTURE_ALIGNMENT"}, {"name":"TYPE_MAPPER"}] -}, -{ - "name":"sun.security.provider.NativePRNG", - "methods":[{"name":"","parameterTypes":[] }, {"name":"","parameterTypes":["java.security.SecureRandomParameters"] }] -}, -{ - "name":"sun.security.provider.SHA2$SHA256", - "methods":[{"name":"","parameterTypes":[] }] -}, -{ - "name":"sun.security.provider.SHA5$SHA512", - "methods":[{"name":"","parameterTypes":[] }] -}, -{ - "name":"void", - "fields":[{"name":"OPTIONS"}, {"name":"STRING_ENCODING"}, {"name":"STRUCTURE_ALIGNMENT"}, {"name":"TYPE_MAPPER"}] -}, -{ - "name":"org.slf4j.Logger" -} -] diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/java/com/mongodb/crypt/capi/MongoCryptTest.java b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/java/com/mongodb/crypt/capi/MongoCryptTest.java deleted file mode 100644 index b9424cd..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/java/com/mongodb/crypt/capi/MongoCryptTest.java +++ /dev/null @@ -1,389 +0,0 @@ -/* - * Copyright 2019-present MongoDB, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -package com.mongodb.crypt.capi; - -import com.mongodb.crypt.capi.MongoCryptContext.State; -import org.bson.BsonBinary; -import org.bson.BsonBinarySubType; -import org.bson.BsonDocument; -import org.bson.BsonString; -import org.bson.RawBsonDocument; -import org.junit.jupiter.api.Disabled; -import org.junit.jupiter.api.Test; - -import java.io.BufferedReader; -import java.io.File; -import java.io.IOException; -import java.io.InputStreamReader; -import java.net.URISyntaxException; -import java.net.URL; -import java.nio.ByteBuffer; -import java.nio.charset.StandardCharsets; -import java.nio.file.Files; -import java.util.Arrays; -import java.util.Base64; -import java.util.List; -import java.util.stream.Collectors; - -import static org.junit.jupiter.api.Assertions.assertEquals; -import static org.junit.jupiter.api.Assertions.assertIterableEquals; -import static org.junit.jupiter.api.Assertions.assertNotNull; -import static org.junit.jupiter.api.Assertions.assertNull; -import static org.junit.jupiter.api.Assertions.assertThrows; - - -@SuppressWarnings("SameParameterValue") -public class MongoCryptTest { - @Test - public void testEncrypt() throws URISyntaxException, IOException { - MongoCrypt mongoCrypt = createMongoCrypt(); - assertNotNull(mongoCrypt); - - MongoCryptContext encryptor = mongoCrypt.createEncryptionContext("test", getResourceAsDocument("command.json")); - - assertEquals(State.NEED_MONGO_COLLINFO, encryptor.getState()); - - BsonDocument listCollectionsFilter = encryptor.getMongoOperation(); - assertEquals(getResourceAsDocument("list-collections-filter.json"), listCollectionsFilter); - - encryptor.addMongoOperationResult(getResourceAsDocument("collection-info.json")); - encryptor.completeMongoOperation(); - assertEquals(State.NEED_MONGO_MARKINGS, encryptor.getState()); - - BsonDocument jsonSchema = encryptor.getMongoOperation(); - assertEquals(getResourceAsDocument("mongocryptd-command.json"), jsonSchema); - - encryptor.addMongoOperationResult(getResourceAsDocument("mongocryptd-reply.json")); - encryptor.completeMongoOperation(); - assertEquals(State.NEED_MONGO_KEYS, encryptor.getState()); - - testKeyDecryptor(encryptor); - - assertEquals(State.READY, encryptor.getState()); - - RawBsonDocument encryptedDocument = encryptor.finish(); - assertEquals(State.DONE, encryptor.getState()); - assertEquals(getResourceAsDocument("encrypted-command.json"), encryptedDocument); - - encryptor.close(); - - mongoCrypt.close(); - } - - - @Test - public void testDecrypt() throws IOException, URISyntaxException { - MongoCrypt mongoCrypt = createMongoCrypt(); - assertNotNull(mongoCrypt); - - MongoCryptContext decryptor = mongoCrypt.createDecryptionContext(getResourceAsDocument("encrypted-command-reply.json")); - - assertEquals(State.NEED_MONGO_KEYS, decryptor.getState()); - - testKeyDecryptor(decryptor); - - assertEquals(State.READY, decryptor.getState()); - - RawBsonDocument decryptedDocument = decryptor.finish(); - assertEquals(State.DONE, decryptor.getState()); - assertEquals(getResourceAsDocument("command-reply.json"), decryptedDocument); - - decryptor.close(); - - mongoCrypt.close(); - } - - @Test - public void testEmptyAwsCredentials() throws URISyntaxException, IOException { - MongoCrypt mongoCrypt = MongoCrypts.create(MongoCryptOptions - .builder() - .kmsProviderOptions(new BsonDocument("aws", new BsonDocument())) - .needsKmsCredentialsStateEnabled(true) - .build()); - - MongoCryptContext decryptor = mongoCrypt.createDecryptionContext(getResourceAsDocument("encrypted-command-reply.json")); - - assertEquals(State.NEED_KMS_CREDENTIALS, decryptor.getState()); - - BsonDocument awsCredentials = new BsonDocument(); - awsCredentials.put("accessKeyId", new BsonString("example")); - awsCredentials.put("secretAccessKey", new BsonString("example")); - - decryptor.provideKmsProviderCredentials(new BsonDocument("aws", awsCredentials)); - - assertEquals(State.NEED_MONGO_KEYS, decryptor.getState()); - - mongoCrypt.close(); - } - - @Test - public void testMultipleCloseCalls() { - MongoCrypt mongoCrypt = createMongoCrypt(); - assertNotNull(mongoCrypt); - - mongoCrypt.close(); - mongoCrypt.close(); - } - - @Test - public void testDataKeyCreation() { - MongoCrypt mongoCrypt = createMongoCrypt(); - assertNotNull(mongoCrypt); - - List keyAltNames = Arrays.asList("first", "second"); - MongoCryptContext dataKeyContext = mongoCrypt.createDataKeyContext("local", - MongoDataKeyOptions.builder().masterKey(new BsonDocument()) - .keyAltNames(keyAltNames) - .build()); - assertEquals(State.READY, dataKeyContext.getState()); - - RawBsonDocument dataKeyDocument = dataKeyContext.finish(); - assertEquals(State.DONE, dataKeyContext.getState()); - assertNotNull(dataKeyDocument); - - List actualKeyAltNames = dataKeyDocument.getArray("keyAltNames").stream() - .map(bsonValue -> bsonValue.asString().getValue()) - .sorted() - .collect(Collectors.toList()); - assertIterableEquals(keyAltNames, actualKeyAltNames); - dataKeyContext.close(); - mongoCrypt.close(); - } - - @Test - public void testExplicitEncryptionDecryption() { - MongoCrypt mongoCrypt = createMongoCrypt(); - assertNotNull(mongoCrypt); - - BsonDocument documentToEncrypt = new BsonDocument("v", new BsonString("hello")); - MongoExplicitEncryptOptions options = MongoExplicitEncryptOptions.builder() - .keyId(new BsonBinary(BsonBinarySubType.UUID_STANDARD, Base64.getDecoder().decode("YWFhYWFhYWFhYWFhYWFhYQ=="))) - .algorithm("AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic") - .build(); - MongoCryptContext encryptor = mongoCrypt.createExplicitEncryptionContext(documentToEncrypt, options); - assertEquals(State.NEED_MONGO_KEYS, encryptor.getState()); - - testKeyDecryptor(encryptor); - - assertEquals(State.READY, encryptor.getState()); - - RawBsonDocument encryptedDocument = encryptor.finish(); - assertEquals(State.DONE, encryptor.getState()); - assertEquals(getResourceAsDocument("encrypted-value.json"), encryptedDocument); - - MongoCryptContext decryptor = mongoCrypt.createExplicitDecryptionContext(encryptedDocument); - - assertEquals(State.READY, decryptor.getState()); - - RawBsonDocument decryptedDocument = decryptor.finish(); - assertEquals(State.DONE, decryptor.getState()); - assertEquals(documentToEncrypt, decryptedDocument); - - encryptor.close(); - - mongoCrypt.close(); - } - - - @Test - public void testExplicitExpressionEncryption() { - MongoCrypt mongoCrypt = createMongoCrypt(); - assertNotNull(mongoCrypt); - - BsonDocument valueToEncrypt = getResourceAsDocument("fle2-find-range-explicit-v2/int32/value-to-encrypt.json"); - BsonDocument rangeOptions = getResourceAsDocument("fle2-find-range-explicit-v2/int32/rangeopts.json"); - BsonDocument expectedEncryptedPayload = getResourceAsDocument("fle2-find-range-explicit-v2/int32/encrypted-payload.json"); - - MongoExplicitEncryptOptions options = MongoExplicitEncryptOptions.builder() - .keyId(new BsonBinary(BsonBinarySubType.UUID_STANDARD, Base64.getDecoder().decode("q83vqxI0mHYSNBI0VniQEg=="))) - .algorithm("Range") - .queryType("range") - .contentionFactor(4L) - .rangeOptions(rangeOptions) - .build(); - MongoCryptContext encryptor = mongoCrypt.createEncryptExpressionContext(valueToEncrypt, options); - assertEquals(State.NEED_MONGO_KEYS, encryptor.getState()); - - testKeyDecryptor(encryptor, "fle2-find-range-explicit-v2/int32/key-filter.json", "keys/ABCDEFAB123498761234123456789012-local-document.json"); - - assertEquals(State.READY, encryptor.getState()); - - RawBsonDocument actualEncryptedPayload = encryptor.finish(); - assertEquals(State.DONE, encryptor.getState()); - assertEquals(expectedEncryptedPayload, actualEncryptedPayload); - - encryptor.close(); - mongoCrypt.close(); - } - - @Test - public void testRangePreviewQueryTypeIsNotSupported() { - MongoCrypt mongoCrypt = createMongoCrypt(); - assertNotNull(mongoCrypt); - - BsonDocument valueToEncrypt = getResourceAsDocument("fle2-find-range-explicit-v2/int32/value-to-encrypt.json"); - BsonDocument rangeOptions = getResourceAsDocument("fle2-find-range-explicit-v2/int32/rangeopts.json"); - - MongoExplicitEncryptOptions options = MongoExplicitEncryptOptions.builder() - .keyId(new BsonBinary(BsonBinarySubType.UUID_STANDARD, Base64.getDecoder().decode("q83vqxI0mHYSNBI0VniQEg=="))) - .algorithm("Range") - .queryType("rangePreview") - .contentionFactor(4L) - .rangeOptions(rangeOptions) - .build(); - - MongoCryptException exp = assertThrows(MongoCryptException.class, () -> mongoCrypt.createEncryptExpressionContext(valueToEncrypt, options)); - assertEquals("Query type 'rangePreview' is deprecated, please use 'range'", exp.getMessage()); - mongoCrypt.close(); - } - - @Test - public void testRangePreviewAlgorithmIsNotSupported() { - MongoCrypt mongoCrypt = createMongoCrypt(); - assertNotNull(mongoCrypt); - - BsonDocument rangeOptions = getResourceAsDocument("fle2-find-range-explicit-v2/int32/rangeopts.json"); - - IllegalStateException illegalStateException = assertThrows(IllegalStateException.class, () -> MongoExplicitEncryptOptions.builder() - .keyId(new BsonBinary(BsonBinarySubType.UUID_STANDARD, Base64.getDecoder().decode("q83vqxI0mHYSNBI0VniQEg=="))) - .algorithm("RangePreview") - .queryType("range") - .contentionFactor(4L) - .rangeOptions(rangeOptions) - .build()); - - assertEquals("Invalid configuration, contentionFactor can only be set if algorithm is 'Indexed' or 'Range'", - illegalStateException.getMessage()); - mongoCrypt.close(); - } - - @Test - public void testExplicitEncryptionDecryptionKeyAltName() throws IOException, URISyntaxException { - MongoCrypt mongoCrypt = createMongoCrypt(); - assertNotNull(mongoCrypt); - - BsonDocument documentToEncrypt = new BsonDocument("v", new BsonString("hello")); - MongoExplicitEncryptOptions options = MongoExplicitEncryptOptions.builder() - .keyAltName("altKeyName") - .algorithm("AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic") - .build(); - MongoCryptContext encryptor = mongoCrypt.createExplicitEncryptionContext(documentToEncrypt, options); - - assertEquals(State.NEED_MONGO_KEYS, encryptor.getState()); - testKeyDecryptor(encryptor, "key-filter-keyAltName.json", "key-document.json"); - - assertEquals(State.READY, encryptor.getState()); - - RawBsonDocument encryptedDocument = encryptor.finish(); - assertEquals(State.DONE, encryptor.getState()); - assertEquals(getResourceAsDocument("encrypted-value.json"), encryptedDocument); - - MongoCryptContext decryptor = mongoCrypt.createExplicitDecryptionContext(encryptedDocument); - - assertEquals(State.READY, decryptor.getState()); - - RawBsonDocument decryptedDocument = decryptor.finish(); - assertEquals(State.DONE, decryptor.getState()); - assertEquals(documentToEncrypt, decryptedDocument); - - encryptor.close(); - - mongoCrypt.close(); - } - - private void testKeyDecryptor(final MongoCryptContext context) { - testKeyDecryptor(context, "key-filter.json", "key-document.json"); - } - - private void testKeyDecryptor(final MongoCryptContext context, final String keyFilterPath, final String keyDocumentPath) { - BsonDocument keyFilter = context.getMongoOperation(); - assertEquals(getResourceAsDocument(keyFilterPath), keyFilter); - context.addMongoOperationResult(getResourceAsDocument(keyDocumentPath)); - context.completeMongoOperation(); - if (context.getState() == State.READY) { - return; - } - - assertEquals(State.NEED_KMS, context.getState()); - - MongoKeyDecryptor keyDecryptor = context.nextKeyDecryptor(); - assertEquals("aws", keyDecryptor.getKmsProvider()); - assertEquals("kms.us-east-1.amazonaws.com:443", keyDecryptor.getHostName()); - - ByteBuffer keyDecryptorMessage = keyDecryptor.getMessage(); - assertEquals(790, keyDecryptorMessage.remaining()); - - int bytesNeeded = keyDecryptor.bytesNeeded(); - assertEquals(1024, bytesNeeded); - - keyDecryptor.feed(getHttpResourceAsByteBuffer("kms-reply.txt")); - bytesNeeded = keyDecryptor.bytesNeeded(); - assertEquals(0, bytesNeeded); - - assertNull(context.nextKeyDecryptor()); - - context.completeKeyDecryptors(); - } - - private MongoCrypt createMongoCrypt() { - return MongoCrypts.create(MongoCryptOptions - .builder() - .awsKmsProviderOptions(MongoAwsKmsProviderOptions.builder() - .accessKeyId("example") - .secretAccessKey("example") - .build()) - .localKmsProviderOptions(MongoLocalKmsProviderOptions.builder() - .localMasterKey(ByteBuffer.wrap(new byte[96])) - .build()) - .build()); - } - - private static BsonDocument getResourceAsDocument(final String fileName) { - return BsonDocument.parse(getFileAsString(fileName, System.getProperty("line.separator"))); - } - - private static ByteBuffer getHttpResourceAsByteBuffer(final String fileName) { - return ByteBuffer.wrap(getFileAsString(fileName, "\r\n").getBytes(StandardCharsets.UTF_8)); - } - - private static String getFileAsString(final String fileName, String lineSeparator) { - try { - URL resource = MongoCryptTest.class.getResource("/" + fileName); - if (resource == null) { - throw new RuntimeException("Could not find file " + fileName); - } - File file = new File(resource.toURI()); - StringBuilder stringBuilder = new StringBuilder(); - String line; - try (BufferedReader reader = new BufferedReader( - new InputStreamReader(Files.newInputStream(file.toPath()), StandardCharsets.UTF_8))) { - boolean first = true; - while ((line = reader.readLine()) != null) { - if (!first) { - stringBuilder.append(lineSeparator); - } - first = false; - stringBuilder.append(line); - } - } - return stringBuilder.toString(); - } catch (Throwable t) { - throw new RuntimeException("Could not parse file " + fileName, t); - } - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/command-reply.json b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/command-reply.json deleted file mode 100644 index c110f73..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/command-reply.json +++ /dev/null @@ -1,13 +0,0 @@ -{ - "cursor": { - "firstBatch": [ - { - "_id": 1, - "ssn": "457-55-5462" - } - ], - "id": 0, - "ns": "test.test" - }, - "ok": 1 -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/command.json b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/command.json deleted file mode 100644 index d04bf77..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/command.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "find": "test", - "filter": { - "ssn": "457-55-5462" - } -} \ No newline at end of file diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/encrypted-command-reply.json b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/encrypted-command-reply.json deleted file mode 100644 index 73d4d34..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/encrypted-command-reply.json +++ /dev/null @@ -1,16 +0,0 @@ -{ - "cursor" : { - "firstBatch" : [ - { - "_id": 1, - "ssn": { - "$binary": "AWFhYWFhYWFhYWFhYWFhYWECRTOW9yZzNDn5dGwuqsrJQNLtgMEKaujhs9aRWRp+7Yo3JK8N8jC8P0Xjll6C1CwLsE/iP5wjOMhVv1KMMyOCSCrHorXRsb2IKPtzl2lKTqQ=", - "$type": "06" - } - } - ], - "id" : 0, - "ns" : "test.test" - }, - "ok" : 1 -} \ No newline at end of file diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/encrypted-command.json b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/encrypted-command.json deleted file mode 100644 index 8b8cfaa..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/encrypted-command.json +++ /dev/null @@ -1,11 +0,0 @@ -{ - "filter": { - "ssn": { - "$binary": { - "base64": "AWFhYWFhYWFhYWFhYWFhYWECRTOW9yZzNDn5dGwuqsrJQNLtgMEKaujhs9aRWRp+7Yo3JK8N8jC8P0Xjll6C1CwLsE/iP5wjOMhVv1KMMyOCSCrHorXRsb2IKPtzl2lKTqQ=", - "subType": "06" - } - } - }, - "find": "test" -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/encrypted-value.json b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/encrypted-value.json deleted file mode 100644 index e1a832b..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/encrypted-value.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "v": { - "$binary": "AWFhYWFhYWFhYWFhYWFhYWECW+zDjR/69eS6VtuMD5+O2lZw6JyiWOw3avI7mnUkdpKzPfvy8F/nlZrgZa2cGmQsb0TmLZuk5trldosnGKD91w==", - "$type": "06" - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/fle2-find-range-explicit-v2/int32/encrypted-payload.json b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/fle2-find-range-explicit-v2/int32/encrypted-payload.json deleted file mode 100644 index 7db5540..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/fle2-find-range-explicit-v2/int32/encrypted-payload.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "v": { - "$and": [ - { - "age": { - "$gte": { - "$binary": { - "base64": "DQECAAADcGF5bG9hZACZAQAABGcAhQEAAAMwAH0AAAAFZAAgAAAAAInd0noBhIiJMv8QTjcfgRqnnVhxRJRRACLfvgT+CTR/BXMAIAAAAADm0EjqF/T4EmR6Dw6NaPLrL0OuzS4AFvm90czFluAAygVsACAAAAAA5MXcYWjYlzhPFUDebBEa17B5z2bupmaW9uCdtLjc7RkAAzEAfQAAAAVkACAAAAAA7lkNtT6RLw91aJ07K/blwlFs5wi9pQjqUXDcaCTxe98FcwAgAAAAAPwySffuLQihmF70Ot93KtaUMNU8KpmA+niyPRcvarNMBWwAIAAAAACDv6fJXXwRqwZH3O2kO+hdeLZ36U6bMZSui8kv0PsPtAADMgB9AAAABWQAIAAAAACcMWVTbZC4ox5VdjWeYKLgf4oBjpPlbTTAkucm9JPK0wVzACAAAAAA3tIww4ZTytkxFsUKyJbc3zwQ2w7DhkOqaNvX9g8pi3gFbAAgAAAAAGs9XR3Q1JpxV+HPW8P2GvCuCBF5bGZ8Kl1zHqzZcd5/AAASY20ABAAAAAAAAAAAEHBheWxvYWRJZAAAAAAAEGZpcnN0T3BlcmF0b3IAAgAAABBzZWNvbmRPcGVyYXRvcgAEAAAAEnNwAAEAAAAAAAAAEHRmAAEAAAAQbW4AAAAAABBteADIAAAAAA==", - "subType": "06" - } - } - } - }, - { - "age": { - "$lte": { - "$binary": { - "base64": "DTsAAAAQcGF5bG9hZElkAAAAAAAQZmlyc3RPcGVyYXRvcgACAAAAEHNlY29uZE9wZXJhdG9yAAQAAAAA", - "subType": "06" - } - } - } - } - ] - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/fle2-find-range-explicit-v2/int32/key-filter.json b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/fle2-find-range-explicit-v2/int32/key-filter.json deleted file mode 100644 index 8973647..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/fle2-find-range-explicit-v2/int32/key-filter.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "$or": [ - { - "_id": { - "$in": [ - { - "$binary": "q83vqxI0mHYSNBI0VniQEg==", - "$type": "04" - } - ] - } - }, - { - "keyAltNames": { - "$in": [] - } - } - ] -} \ No newline at end of file diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/fle2-find-range-explicit-v2/int32/rangeopts.json b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/fle2-find-range-explicit-v2/int32/rangeopts.json deleted file mode 100644 index 2e1407f..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/fle2-find-range-explicit-v2/int32/rangeopts.json +++ /dev/null @@ -1,14 +0,0 @@ -{ - "min": { - "$numberInt": "0" - }, - "max": { - "$numberInt": "200" - }, - "sparsity": { - "$numberLong": "1" - }, - "trimFactor": { - "$numberInt": "1" - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/fle2-find-range-explicit-v2/int32/value-to-encrypt.json b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/fle2-find-range-explicit-v2/int32/value-to-encrypt.json deleted file mode 100644 index 4c294e8..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/fle2-find-range-explicit-v2/int32/value-to-encrypt.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "v": { - "$and": [ - { - "age": { - "$gte": { - "$numberInt": "23" - } - } - }, - { - "age": { - "$lte": { - "$numberInt": "35" - } - } - } - ] - } -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/json-schema.json b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/json-schema.json deleted file mode 100644 index 059373d..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/json-schema.json +++ /dev/null @@ -1,15 +0,0 @@ -{ - "properties": { - "ssn": { - "encrypt": { - "keyId": { - "$binary": "YWFhYWFhYWFhYWFhYWFhYQ==", - "$type": "04" - }, - "type": "string", - "algorithm": "AEAD_AES_CBC_HMAC_SHA512-Deterministic" - } - } - }, - "bsonType": "object" -} \ No newline at end of file diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/key-document.json b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/key-document.json deleted file mode 100644 index 5414072..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/key-document.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "status": { - "$numberInt": "1" - }, - "_id": { - "$binary": { - "base64": "YWFhYWFhYWFhYWFhYWFhYQ==", - "subType": "04" - } - }, - "masterKey": { - "region": "us-east-1", - "key": "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0", - "provider": "aws" - }, - "updateDate": { - "$date": { - "$numberLong": "1557827033449" - } - }, - "keyMaterial": { - "$binary": { - "base64": "AQICAHhQNmWG2CzOm1dq3kWLM+iDUZhEqnhJwH9wZVpuZ94A8gEqnsxXlR51T5EbEVezUqqKAAAAwjCBvwYJKoZIhvcNAQcGoIGxMIGuAgEAMIGoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDHa4jo6yp0Z18KgbUgIBEIB74sKxWtV8/YHje5lv5THTl0HIbhSwM6EqRlmBiFFatmEWaeMk4tO4xBX65eq670I5TWPSLMzpp8ncGHMmvHqRajNBnmFtbYxN3E3/WjxmdbOOe+OXpnGJPcGsftc7cB2shRfA4lICPnE26+oVNXT6p0Lo20nY5XC7jyCO", - "subType": "00" - } - }, - "creationDate": { - "$date": { - "$numberLong": "1557827033449" - } - }, - "keyAltNames": [ - "altKeyName", - "another_altname" - ] -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/key-filter-keyAltName.json b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/key-filter-keyAltName.json deleted file mode 100644 index eb53a14..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/key-filter-keyAltName.json +++ /dev/null @@ -1,14 +0,0 @@ -{ - "$or": [ - { - "_id": { - "$in": [] - } - }, - { - "keyAltNames": { - "$in": ["altKeyName"] - } - } - ] -} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/key-filter.json b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/key-filter.json deleted file mode 100644 index 9ad7c70..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/key-filter.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "$or": [ - { - "_id": { - "$in": [ - { - "$binary": "YWFhYWFhYWFhYWFhYWFhYQ==", - "$type": "04" - } - ] - } - }, - { - "keyAltNames": { - "$in": [] - } - } - ] -} \ No newline at end of file diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/kms-reply.txt b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/kms-reply.txt deleted file mode 100644 index c2c52e3..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/kms-reply.txt +++ /dev/null @@ -1,6 +0,0 @@ -HTTP/1.1 200 OK -x-amzn-RequestId: deeb35e5-4ecb-4bf1-9af5-84a54ff0af0e -Content-Type: application/x-amz-json-1.1 -Content-Length: 233 - -{"KeyId": "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0", "Plaintext": "TqhXy3tKckECjy4/ZNykMWG8amBF46isVPzeOgeusKrwheBmYaU8TMG5AHR/NeUDKukqo8hBGgogiQOVpLPkqBQHD8YkLsNbDmHoGOill5QAHnniF/Lz405bGucB5TfR"} \ No newline at end of file diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/list-collections-filter.json b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/list-collections-filter.json deleted file mode 100644 index 2f37dc5..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/list-collections-filter.json +++ /dev/null @@ -1,3 +0,0 @@ -{ - "name": "test" -} \ No newline at end of file diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/mongocryptd-command.json b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/mongocryptd-command.json deleted file mode 100644 index 2ec0612..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/mongocryptd-command.json +++ /dev/null @@ -1,22 +0,0 @@ -{ - "find": "test", - "filter": { - "ssn": "457-55-5462" - }, - "jsonSchema": { - "properties": { - "ssn": { - "encrypt": { - "keyId": { - "$binary": "YWFhYWFhYWFhYWFhYWFhYQ==", - "$type": "04" - }, - "type": "string", - "algorithm": "AEAD_AES_CBC_HMAC_SHA512-Deterministic" - } - } - }, - "bsonType": "object" - }, - "isRemoteSchema": true -} \ No newline at end of file diff --git a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/mongocryptd-reply.json b/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/mongocryptd-reply.json deleted file mode 100644 index 0d1873d..0000000 --- a/ext/libmongocrypt/libmongocrypt/bindings/java/mongocrypt/src/test/resources/mongocryptd-reply.json +++ /dev/null @@ -1,18 +0,0 @@ -{ - "schemaRequiresEncryption": true, - "ok": { - "$numberInt": "1" - }, - "result": { - "filter": { - "ssn": { - "$binary": { - "base64": "ADgAAAAQYQABAAAABWtpABAAAAAEYWFhYWFhYWFhYWFhYWFhYQJ2AAwAAAA0NTctNTUtNTQ2MgAA", - "subType": "06" - } - } - }, - "find": "test" - }, - "hasEncryptedPlaceholders": true -} \ No newline at end of file diff --git a/ext/libmongocrypt/libmongocrypt/bindings/python/.evergreen/integ-setup.sh b/ext/libmongocrypt/libmongocrypt/bindings/python/.evergreen/integ-setup.sh index 60fa5e5..a23ba15 100755 --- a/ext/libmongocrypt/libmongocrypt/bindings/python/.evergreen/integ-setup.sh +++ b/ext/libmongocrypt/libmongocrypt/bindings/python/.evergreen/integ-setup.sh @@ -38,6 +38,8 @@ EOT # Get the secrets bash $DRIVERS_TOOLS/.evergreen/csfle/setup-secrets.sh +# Start the csfle servers +bash $DRIVERS_TOOLS/.evergreen/csfle/start-servers.sh # Clone mongo-python-driver git clone https://github.com/mongodb/mongo-python-driver.git ${PYMONGO_DIR} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/python/.evergreen/integ-test.sh b/ext/libmongocrypt/libmongocrypt/bindings/python/.evergreen/integ-test.sh index 2efdc9a..cbf4e1f 100755 --- a/ext/libmongocrypt/libmongocrypt/bindings/python/.evergreen/integ-test.sh +++ b/ext/libmongocrypt/libmongocrypt/bindings/python/.evergreen/integ-test.sh @@ -11,6 +11,7 @@ BASE_PYTHON=$(find_python3) # MONGOCRYPT_DIR is set by libmongocrypt/.evergreen/config.yml MONGOCRYPT_DIR="$MONGOCRYPT_DIR" CRYPT_SHARED_DIR="$DRIVERS_TOOLS" +MONGODB_BINARIES="$DRIVERS_TOOLS/mongodb/bin" MACHINE=$(uname -m) if [ $MACHINE == "aarch64" ]; then @@ -28,15 +29,20 @@ export PYMONGOCRYPT_LIB createvirtualenv $PYTHON .venv pip install -e . +pip install uv pushd $PYMONGO_DIR pip install -e ".[test,encryption]" source ${DRIVERS_TOOLS}/.evergreen/csfle/secrets-export.sh set -x -TEST_CRYPT_SHARED=1 DYLD_FALLBACK_LIBRARY_PATH=$CRYPT_SHARED_DIR:${DYLD_FALLBACK_LIBRARY_PATH:-} \ - LD_LIBRARY_PATH=$CRYPT_SHARED_DIR:${LD_LIBRARY_PATH-} \ - PATH=$CRYPT_SHARED_DIR:$PATH \ - AUTH=auth SSL=ssl \ - .evergreen/run-tests.sh -m encryption +export DB_USER="bob" +export DB_PASSWORD="pwd123" +export CLIENT_PEM="$DRIVERS_TOOLS/.evergreen/x509gen/client.pem" +export CA_PEM="$DRIVERS_TOOLS/.evergreen/x509gen/ca.pem" +export DYLD_FALLBACK_LIBRARY_PATH=$CRYPT_SHARED_DIR:${DYLD_FALLBACK_LIBRARY_PATH:-} +export LD_LIBRARY_PATH=$CRYPT_SHARED_DIR:${LD_LIBRARY_PATH-} +export PATH=$CRYPT_SHARED_DIR:$MONGODB_BINARIES:$PATH +export TEST_CRYPT_SHARED="1" +pytest --maxfail=10 -v -m encryption popd deactivate diff --git a/ext/libmongocrypt/libmongocrypt/bindings/python/.evergreen/test.sh b/ext/libmongocrypt/libmongocrypt/bindings/python/.evergreen/test.sh index 288ff9a..0e5b682 100755 --- a/ext/libmongocrypt/libmongocrypt/bindings/python/.evergreen/test.sh +++ b/ext/libmongocrypt/libmongocrypt/bindings/python/.evergreen/test.sh @@ -51,12 +51,10 @@ else export CRYPT_SHARED_PATH="../crypt_shared/lib/mongo_crypt_v1.so" MACHINE=$(uname -m) if [ $MACHINE == "aarch64" ]; then - TARGET=rhel82 PYTHONS=("/opt/mongodbtoolchain/v3/bin/python3" "/opt/mongodbtoolchain/v4/bin/python3" ) else - TARGET=rhel80 PYTHONS=("/opt/python/3.8/bin/python3" "/opt/python/3.9/bin/python3" "/opt/python/3.10/bin/python3" @@ -66,7 +64,7 @@ else ) fi /opt/mongodbtoolchain/v3/bin/python3 drivers-evergreen-tools/.evergreen/mongodl.py --component \ - crypt_shared --version latest --out ../crypt_shared/ --target $TARGET + crypt_shared --version latest --out ../crypt_shared/ fi for PYTHON_BINARY in "${PYTHONS[@]}"; do diff --git a/ext/libmongocrypt/libmongocrypt/bindings/python/CHANGELOG.rst b/ext/libmongocrypt/libmongocrypt/bindings/python/CHANGELOG.rst index 0721424..146279f 100644 --- a/ext/libmongocrypt/libmongocrypt/bindings/python/CHANGELOG.rst +++ b/ext/libmongocrypt/libmongocrypt/bindings/python/CHANGELOG.rst @@ -1,6 +1,12 @@ Changelog ========= +Changes in Version 1.12.0 +------------------------- + +- Bundle libmongocrypt 1.12.0 in release wheels. +- Add support for kms retries. + Changes in Version 1.11.0 ------------------------- diff --git a/ext/libmongocrypt/libmongocrypt/bindings/python/README.rst b/ext/libmongocrypt/libmongocrypt/bindings/python/README.rst index 823bfdd..f8f4ca7 100644 --- a/ext/libmongocrypt/libmongocrypt/bindings/python/README.rst +++ b/ext/libmongocrypt/libmongocrypt/bindings/python/README.rst @@ -34,7 +34,7 @@ Please open a case in our issue management tool, JIRA: - Navigate to `the PYTHON project `_. - Click **Create Issue** - Please provide as much information as possible about the issue type and how to reproduce it. -Bug reports in JIRA for all driver projects (i.e. PYTHON, CSHARP, JAVA) and the +Bug reports in JIRA for all driver projects (i.e. PYTHON, CSHARP) and the Core Server (i.e. SERVER) project are **public**. How To Ask For Help diff --git a/ext/libmongocrypt/libmongocrypt/bindings/python/libmongocrypt-version.txt b/ext/libmongocrypt/libmongocrypt/bindings/python/libmongocrypt-version.txt index 1cac385..0eed1a2 100644 --- a/ext/libmongocrypt/libmongocrypt/bindings/python/libmongocrypt-version.txt +++ b/ext/libmongocrypt/libmongocrypt/bindings/python/libmongocrypt-version.txt @@ -1 +1 @@ -1.11.0 +1.12.0 diff --git a/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/binding.py b/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/binding.py index d43ca97..fe371a5 100644 --- a/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/binding.py +++ b/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/binding.py @@ -312,6 +312,17 @@ def _parse_version(version): */ bool mongocrypt_setopt_log_handler(mongocrypt_t *crypt, mongocrypt_log_fn_t log_fn, void *log_ctx); +/** + * Enable or disable KMS retry behavior. + * + * @param[in] crypt The @ref mongocrypt_t object. + * @param[in] enable A boolean indicating whether to retry operations. + * @pre @ref mongocrypt_init has not been called on @p crypt. + * @returns A boolean indicating success. If false, an error status is set. + * Retrieve it with @ref mongocrypt_ctx_status + */ +bool mongocrypt_setopt_retry_kms(mongocrypt_t *crypt, bool enable); + /** * Configure an AWS KMS provider on the @ref mongocrypt_t object. * @@ -1042,6 +1053,8 @@ def _parse_version(version): * If KMS handles are being handled synchronously, the driver can reuse the same * TLS socket to send HTTP requests and receive responses. * + * The returned KMS handle does not outlive `ctx`. + * * @param[in] ctx A @ref mongocrypt_ctx_t. * @returns a new @ref mongocrypt_kms_ctx_t or NULL. */ @@ -1086,6 +1099,14 @@ def _parse_version(version): */ uint32_t mongocrypt_kms_ctx_bytes_needed(mongocrypt_kms_ctx_t *kms); +/** + * Indicates how long to sleep before sending this request. + * + * @param[in] kms The @ref mongocrypt_kms_ctx_t. + * @returns How long to sleep in microseconds. + */ +int64_t mongocrypt_kms_ctx_usleep(mongocrypt_kms_ctx_t *kms); + /** * Feed bytes from the HTTP response. * @@ -1100,6 +1121,14 @@ def _parse_version(version): */ bool mongocrypt_kms_ctx_feed(mongocrypt_kms_ctx_t *kms, mongocrypt_binary_t *bytes); +/** + * Indicate a network-level failure. + * + * @param[in] kms The @ref mongocrypt_kms_ctx_t. + * @return A boolean indicating whether the failed request may be retried. + */ +bool mongocrypt_kms_ctx_fail(mongocrypt_kms_ctx_t *kms); + /** * Get the status associated with a @ref mongocrypt_kms_ctx_t object. * @@ -1413,7 +1442,7 @@ def _parse_version(version): * { * "min": Optional, * "max": Optional, - * "sparsity": Int64, + * "sparsity": Optional, * "precision": Optional, * "trimFactor": Optional * } @@ -1426,6 +1455,15 @@ def _parse_version(version): */ bool mongocrypt_ctx_setopt_algorithm_range(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *opts); +/** + * Set the expiration time for the data encryption key cache. Defaults to 60 seconds if not set. + * + * @param[in] ctx The @ref mongocrypt_ctx_t object. + * @param[in] cache_expiration_ms The cache expiration time in milliseconds. If zero, the cache + * never expires. + */ +bool mongocrypt_setopt_key_expiration(mongocrypt_t *crypt, uint64_t cache_expiration_ms); + /// String constants for setopt_query_type // DEPRECATED: Support "rangePreview" has been removed in favor of "range". """ diff --git a/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/mongocrypt.py b/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/mongocrypt.py index 88dd19c..edd6c2c 100644 --- a/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/mongocrypt.py +++ b/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/mongocrypt.py @@ -149,6 +149,14 @@ def __init(self): if any([on_demand_aws, on_demand_gcp, on_demand_azure]): lib.mongocrypt_setopt_use_need_kms_credentials_state(self.__crypt) + # Enable KMS retry when available, libmongocrypt >= 1.12.0, + try: + if not lib.mongocrypt_setopt_retry_kms(self.__crypt, True): + self.__raise_from_status() + except AttributeError: + # libmongocrypt < 1.12 + pass + if not lib.mongocrypt_init(self.__crypt): self.__raise_from_status() @@ -670,6 +678,30 @@ def feed(self, data): if not lib.mongocrypt_kms_ctx_feed(self.__ctx, binary.bin): self.__raise_from_status() + @property + def usleep(self): + """Indicates how long to sleep in microseconds before sending this request. + + .. versionadded:: 1.12 + """ + try: + return lib.mongocrypt_kms_ctx_usleep(self.__ctx) + except AttributeError: + # libmongocrypt < 1.12 + return 0 + + def fail(self): + """Indicate a network-level failure. + + .. versionadded:: 1.12 + """ + try: + if not lib.mongocrypt_kms_ctx_fail(self.__ctx): + self.__raise_from_status() + except AttributeError: + # libmongocrypt < 1.12 + pass + def __raise_from_status(self): status = lib.mongocrypt_status_new() try: diff --git a/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/version.py b/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/version.py index f32604b..8d6c325 100644 --- a/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/version.py +++ b/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/version.py @@ -12,6 +12,6 @@ # See the License for the specific language governing permissions and # limitations under the License. -__version__ = "1.12.0.dev0" +__version__ = "1.13.0.dev0" _MIN_LIBMONGOCRYPT_VERSION = "1.8.0" diff --git a/ext/libmongocrypt/libmongocrypt/bindings/python/release.sh b/ext/libmongocrypt/libmongocrypt/bindings/python/release.sh index 5ddb51e..684b172 100755 --- a/ext/libmongocrypt/libmongocrypt/bindings/python/release.sh +++ b/ext/libmongocrypt/libmongocrypt/bindings/python/release.sh @@ -19,7 +19,7 @@ set -o errexit # Exit the script with error if any of the commands fail LIBMONGOCRYPT_VERSION=$(cat ./libmongocrypt-version.txt) REVISION=$(git rev-list -n 1 $LIBMONGOCRYPT_VERSION) # The libmongocrypt release branch. -BRANCH="r1.11" +BRANCH="r1.12" # The python executable to use. PYTHON=${PYTHON:-python} diff --git a/ext/libmongocrypt/libmongocrypt/bindings/python/sbom.json b/ext/libmongocrypt/libmongocrypt/bindings/python/sbom.json index c290a9e..5d59e54 100644 --- a/ext/libmongocrypt/libmongocrypt/bindings/python/sbom.json +++ b/ext/libmongocrypt/libmongocrypt/bindings/python/sbom.json @@ -1,31 +1,31 @@ { "components": [ { - "bom-ref": "pkg:github/mongodb/libmongocrypt@1.11.0", + "bom-ref": "pkg:github/mongodb/libmongocrypt@1.12.0", "externalReferences": [ { "type": "distribution", - "url": "https://github.com/mongodb/libmongocrypt/archive/refs/tags/1.11.0.tar.gz" + "url": "https://github.com/mongodb/libmongocrypt/archive/refs/tags/1.12.0.tar.gz" }, { "type": "website", - "url": "https://github.com/mongodb/libmongocrypt/tree/1.11.0" + "url": "https://github.com/mongodb/libmongocrypt/tree/1.12.0" } ], "group": "mongodb", "name": "libmongocrypt", - "purl": "pkg:github/mongodb/libmongocrypt@1.11.0", + "purl": "pkg:github/mongodb/libmongocrypt@1.12.0", "type": "library", - "version": "1.11.0" + "version": "1.12.0" } ], "dependencies": [ { - "ref": "pkg:github/mongodb/libmongocrypt@1.11.0" + "ref": "pkg:github/mongodb/libmongocrypt@1.12.0" } ], "metadata": { - "timestamp": "2024-08-08T02:35:36.986098+00:00", + "timestamp": "2024-12-30T18:25:06.574241+00:00", "tools": [ { "externalReferences": [ @@ -68,7 +68,7 @@ } ] }, - "serialNumber": "urn:uuid:14e22848-7554-4f82-bcd1-76d2891b4c66", + "serialNumber": "urn:uuid:5e81b4d2-1313-43dd-9ec0-b958d0d71bca", "version": 1, "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json", "bomFormat": "CycloneDX", diff --git a/ext/libmongocrypt/libmongocrypt/bindings/python/test/data/compact/success/encrypted-field-config-map.json b/ext/libmongocrypt/libmongocrypt/bindings/python/test/data/compact/success/encrypted-field-config-map.json index f183f7d..a16421e 100644 --- a/ext/libmongocrypt/libmongocrypt/bindings/python/test/data/compact/success/encrypted-field-config-map.json +++ b/ext/libmongocrypt/libmongocrypt/bindings/python/test/data/compact/success/encrypted-field-config-map.json @@ -1,7 +1,6 @@ { "db.test": { "escCollection": "esc", - "eccCollection": "ecc", "ecocCollection": "ecoc", "fields": [ { diff --git a/ext/libmongocrypt/libmongocrypt/bindings/python/test/data/encrypted-field-config-map.json b/ext/libmongocrypt/libmongocrypt/bindings/python/test/data/encrypted-field-config-map.json index 043ecec..9473808 100644 --- a/ext/libmongocrypt/libmongocrypt/bindings/python/test/data/encrypted-field-config-map.json +++ b/ext/libmongocrypt/libmongocrypt/bindings/python/test/data/encrypted-field-config-map.json @@ -1,7 +1,6 @@ { "test.test": { "escCollection": "fle2.basic.esc", - "eccCollection": "fle2.basic.ecc", "ecocCollection": "fle2.basic.ecoc", "fields": [ { @@ -24,7 +23,6 @@ }, "test.test2": { "escCollection": "fle2.basic.esc", - "eccCollection": "fle2.basic.ecc", "ecocCollection": "fle2.basic.ecoc", "fields": [ { diff --git a/ext/libmongocrypt/libmongocrypt/bindings/python/test/test_mongocrypt.py b/ext/libmongocrypt/libmongocrypt/bindings/python/test/test_mongocrypt.py index a9cca34..1160c73 100644 --- a/ext/libmongocrypt/libmongocrypt/bindings/python/test/test_mongocrypt.py +++ b/ext/libmongocrypt/libmongocrypt/bindings/python/test/test_mongocrypt.py @@ -607,7 +607,7 @@ def test_need_kms_gcp_credentials(self): encrypter = AutoEncrypter(callback, opts) self.addCleanup(encrypter.close) - with respx.mock() as router: + with respx.mock(using="httpx") as router: data = {"access_token": "foo"} url = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token" router.add( @@ -748,7 +748,7 @@ async def test_need_kms_gcp_credentials(self): encrypter = AsyncAutoEncrypter(callback, opts) self.addAsyncCleanup(encrypter.close) - with respx.mock() as router: + with respx.mock(using="httpx") as router: data = {"access_token": "foo"} url = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token" router.add( @@ -1019,7 +1019,7 @@ def get_encrypter(self, clear_cache=True): def test_success(self): encrypter = self.get_encrypter() - with respx.mock() as router: + with respx.mock(using="httpx") as router: data = {"access_token": "foo", "expires_in": 4000} url = "http://169.254.169.254/metadata/identity/oauth2/token" router.add( @@ -1034,7 +1034,7 @@ def test_success(self): def test_empty_json(self): encrypter = self.get_encrypter() - with respx.mock() as router: + with respx.mock(using="httpx") as router: url = "http://169.254.169.254/metadata/identity/oauth2/token" router.add( respx.get(url=url).mock(return_value=httpx.Response(200, json={})) @@ -1048,7 +1048,7 @@ def test_empty_json(self): def test_bad_json(self): encrypter = self.get_encrypter() - with respx.mock() as router: + with respx.mock(using="httpx") as router: url = "http://169.254.169.254/metadata/identity/oauth2/token" router.add( respx.get(url=url).mock(return_value=httpx.Response(200, text="a'")) @@ -1062,7 +1062,7 @@ def test_bad_json(self): def test_http_404(self): encrypter = self.get_encrypter() - with respx.mock() as router: + with respx.mock(using="httpx") as router: url = "http://169.254.169.254/metadata/identity/oauth2/token" router.add(respx.get(url=url).mock(return_value=httpx.Response(404))) with self.assertRaisesRegex( @@ -1074,7 +1074,7 @@ def test_http_404(self): def test_http_500(self): encrypter = self.get_encrypter() - with respx.mock() as router: + with respx.mock(using="httpx") as router: url = "http://169.254.169.254/metadata/identity/oauth2/token" router.add(respx.get(url=url).mock(return_value=httpx.Response(500))) with self.assertRaisesRegex( @@ -1086,7 +1086,7 @@ def test_http_500(self): def test_slow_response(self): encrypter = self.get_encrypter() - with respx.mock() as router: + with respx.mock(using="httpx") as router: url = "http://169.254.169.254/metadata/identity/oauth2/token" router.add( respx.get(url=url).mock(side_effect=httpx._exceptions.ConnectTimeout) @@ -1100,7 +1100,7 @@ def test_slow_response(self): def test_cache(self): encrypter = self.get_encrypter() - with respx.mock() as router: + with respx.mock(using="httpx") as router: data = {"access_token": "foo", "expires_in": 4000} url = "http://169.254.169.254/metadata/identity/oauth2/token" router.add( @@ -1121,7 +1121,7 @@ def test_cache(self): def test_cache_expires_soon(self): encrypter = self.get_encrypter() - with respx.mock() as router: + with respx.mock(using="httpx") as router: data = {"access_token": "foo", "expires_in": 10} url = "http://169.254.169.254/metadata/identity/oauth2/token" router.add( @@ -1137,7 +1137,7 @@ def test_cache_expires_soon(self): # Should not use the cached value. encrypter = self.get_encrypter(False) self.assertIsNotNone(pymongocrypt.synchronous.credentials._azure_creds_cache) - with respx.mock() as router: + with respx.mock(using="httpx") as router: url = "http://169.254.169.254/metadata/identity/oauth2/token" router.add( respx.get(url=url).mock(side_effect=httpx._exceptions.ConnectTimeout) diff --git a/ext/libmongocrypt/libmongocrypt/bindings/python/update-sbom.sh b/ext/libmongocrypt/libmongocrypt/bindings/python/update-sbom.sh index e42aa39..e0c9031 100755 --- a/ext/libmongocrypt/libmongocrypt/bindings/python/update-sbom.sh +++ b/ext/libmongocrypt/libmongocrypt/bindings/python/update-sbom.sh @@ -10,5 +10,5 @@ else fi echo "pkg:github/mongodb/libmongocrypt@$LIBMONGOCRYPT_VERSION" > purls.txt -$DOCKER run --platform="linux/amd64" -it --rm -v $(pwd):$(pwd) artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0 update --purls=$(pwd)/purls.txt -o $(pwd)/sbom.json +$DOCKER run --platform="linux/amd64" -it --rm -v $(pwd):$(pwd) artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:1.0 update --purls=$(pwd)/purls.txt -o $(pwd)/sbom.json rm purls.txt diff --git a/ext/libmongocrypt/libmongocrypt/cmake/FetchMongoC.cmake b/ext/libmongocrypt/libmongocrypt/cmake/FetchMongoC.cmake index f43d94d..f4c4698 100644 --- a/ext/libmongocrypt/libmongocrypt/cmake/FetchMongoC.cmake +++ b/ext/libmongocrypt/libmongocrypt/cmake/FetchMongoC.cmake @@ -1,8 +1,8 @@ include (FetchContent) # Set the tag that we will fetch. -# When updating the version of libbson, also update the version in etc/purls.txt -set (MONGOC_FETCH_TAG_FOR_LIBBSON "1.28.1" CACHE STRING "The Git tag of mongo-c-driver that will be fetched to obtain libbson") +# When updating the version of libbson, also update the version in etc/purls.txt and .evergreen/prep_c_driver_source.sh +set (MONGOC_FETCH_TAG_FOR_LIBBSON "1.30.3" CACHE STRING "The Git tag of mongo-c-driver that will be fetched to obtain libbson") # Add an option to disable patching if a patch command is unavailable. option (LIBBSON_PATCH_ENABLED "Whether to apply patches to the libbson library" ON) @@ -18,6 +18,8 @@ make_patch_command (patch_command DISABLED "${patch_disabled}" PATCHES ${PROJECT_SOURCE_DIR}/etc/libbson-remove-GCC-diagnostic-pragma.patch + # Fix old GCC error: "#pragma GCC diagnostic not allowed inside functions". Remove patch after libbson 2.0.0: + ${PROJECT_SOURCE_DIR}/etc/libbson-remove-GCC-diagnostic-in-functions.patch ) # Fetch the source archive for the requested tag from GitHub diff --git a/ext/libmongocrypt/libmongocrypt/cmake/ImportBSON.cmake b/ext/libmongocrypt/libmongocrypt/cmake/ImportBSON.cmake index b967af9..c2ca766 100644 --- a/ext/libmongocrypt/libmongocrypt/cmake/ImportBSON.cmake +++ b/ext/libmongocrypt/libmongocrypt/cmake/ImportBSON.cmake @@ -56,9 +56,9 @@ cmake_push_check_state () # extra-alignment enabled. We want to match that setting as our default, for convenience # purposes only. find_path (SYSTEM_BSON_INCLUDE_DIR bson/bson.h PATH_SUFFIXES libbson-1.0) + set (_extra_alignment_default OFF) if (SYSTEM_BSON_INCLUDE_DIR AND NOT DEFINED ENABLE_EXTRA_ALIGNMENT) set (CMAKE_REQUIRED_INCLUDES "${SYSTEM_BSON_INCLUDE_DIR}") - set (_extra_alignment_default OFF) check_c_source_compiles ([[ #include @@ -140,10 +140,8 @@ function (_import_bson) set (ENABLE_SNAPPY OFF CACHE BOOL "Toggle snappy for the mongoc subproject (not required by libmongocrypt)") # Disable deprecated automatic init and cleanup. (May be overridden by the user) set (ENABLE_AUTOMATIC_INIT_AND_CLEANUP OFF CACHE BOOL "Enable automatic init and cleanup (GCC only)") - if (DEFINED _extra_alignment_default) - # Disable over-alignment of bson types. (May be overridden by the user) - set (ENABLE_EXTRA_ALIGNMENT ${_extra_alignment_default} CACHE BOOL "Toggle extra alignment of bson_t") - endif () + # Disable over-alignment of bson types. (May be overridden by the user) + set (ENABLE_EXTRA_ALIGNMENT ${_extra_alignment_default} CACHE BOOL "Toggle extra alignment of bson_t") # We don't want the subproject to find libmongocrypt set (ENABLE_CLIENT_SIDE_ENCRYPTION OFF CACHE BOOL "Disable client-side encryption for the libmongoc subproject") # Clear `BUILD_VERSION` so C driver does not use a `BUILD_VERSION` meant for libmongocrypt. diff --git a/ext/libmongocrypt/libmongocrypt/doc/releasing.md b/ext/libmongocrypt/libmongocrypt/doc/releasing.md index 9d7c8b9..4df019c 100644 --- a/ext/libmongocrypt/libmongocrypt/doc/releasing.md +++ b/ext/libmongocrypt/libmongocrypt/doc/releasing.md @@ -9,7 +9,7 @@ Version numbers of libmongocrypt must follow the format 1.[0-9].[0-9] for releas ### Check for Vulnerabilities -Snyk and Kondukto are used to satisfy vulnerability scanning requirements of [DRIVERS-714](https://jira.mongodb.org/browse/DRIVERS-714). Prior to releasing, ensure necessary reported vulnerabilities meet requirements described in: [MongoDB Software Security Development Lifecycle Policy](https://docs.google.com/document/d/1u0m4Kj2Ny30zU74KoEFCN4L6D_FbEYCaJ3CQdCYXTMc/edit?tab=t.0#bookmark=id.l09k96qt24jm). +Snyk and Silk are used to satisfy vulnerability scanning requirements of [DRIVERS-714](https://jira.mongodb.org/browse/DRIVERS-714). Prior to releasing, ensure necessary reported vulnerabilities meet requirements described in: [MongoDB Software Security Development Lifecycle Policy](https://docs.google.com/document/d/1u0m4Kj2Ny30zU74KoEFCN4L6D_FbEYCaJ3CQdCYXTMc/edit?tab=t.0#bookmark=id.l09k96qt24jm). #### Check Snyk @@ -44,17 +44,15 @@ snyk monitor \ Check the updated reference targets in Snyk for detected vulnerabilities. -#### Check Kondukto +#### Check the Augmented SBOM -Get credentials for Kondukto from the `drivers/libmongocrypt` vault in [AWS Secrets Manager](https://wiki.corp.mongodb.com/display/DRIVERS/Using+AWS+Secrets+Manager+to+Store+Testing+Secrets). +Examine the Augmented SBOM from a recent execution of the `sbom` task in an Evergreen patch or commit build. + +Evergreen CLI may be used to schedule only the `sbom` task: -Download the Augmented SBOM using: ```bash -./.evergreen/earthly.sh \ - --secret kondukto_token=${kondukto_token} \ - +sbom-augment \ - --out cyclonedx.augmented.sbom.json \ - --branch +# Ensure `-p` matches the correct Evergreen project for the current branch! +evergreen patch -y -p libmongocrypt -t all -v sbom -f ``` Check the contents of the "vulnerabilities" field (if present) in the Augmented SBOM. @@ -82,21 +80,17 @@ Do the following when releasing: - If the `publish-packages` tasks fail with an error like `[curator] 2024/01/02 13:56:17 [p=emergency]: problem submitting repobuilder job: 404 (Not Found)`, this suggests the published path does not yet exist. Barque (the Linux package publishing service) has protection to avoid unintentional publishes. File a DEVPROD ticket ([example](https://jira.mongodb.org/browse/DEVPROD-4053)) and assign to the team called Release Infrastructure to request the path be created. Then re-run the failing `publish-packages` task. Ask in the slack channel `#devprod-release-tools` for further help with `Barque` or `curator`. - Create the release from the GitHub releases page from the new tag. - Attach the tarball and signature file from the Files tab of the `windows-upload-release` task. [Example](https://github.com/mongodb/libmongocrypt/releases/tag/1.10.0). - - Attach the Augmented SBOM file. Download the Augmented SBOM using: - ```bash - ./.evergreen/earthly.sh \ - --secret kondukto_token=${kondukto_token} \ - +sbom-augment \ - --out cyclonedx.augmented.sbom.json \ - --branch - ``` - For a new minor release, use `master` for `--branch`. For a patch release, use the release branch (e.g. `rx.y`). - Secrets can be obtained from [AWS Secrets Manager](https://wiki.corp.mongodb.com/display/DRIVERS/Using+AWS+Secrets+Manager+to+Store+Testing+Secrets) under `drivers/libmongocrypt`. + - Attach the Augmented SBOM file to the release as `cyclonedx.augmented.sbom.json`. + Download the Augmented SBOM from a recent execution of the `sbom` task in an Evergreen patch or commit build. - Attach `etc/third_party_vulnerabilities.md` to the release. - Attach `etc/ssdlc_compliance_report.md` to the release. - If this is a new minor release (e.g. `x.y.0`): - File a DOCSP ticket to update the installation instructions on [Install libmongocrypt](https://www.mongodb.com/docs/manual/core/csfle/reference/libmongocrypt/). ([Example](https://jira.mongodb.org/browse/DOCSP-36863)) + - Generate a new unique SBOM serial number for the next release: + ```bash + ./.evergreen/earthly.sh +sbom-generate-new-serial-number + ``` - Create a new Snyk reference target. The following instructions use the example branch `rx.y`: Run `cmake` to ensure generated source files are present: @@ -120,6 +114,10 @@ Do the following when releasing: --remote-repo-url=https://github.com/mongodb/libmongocrypt.git ``` Snyk reference targets for older release branches may be removed if no further releases are expected on the branch. + - Update the [Github Webhook](https://wiki.corp.mongodb.com/display/INTX/Githook) to include the new branch. + - Navigate to the [Webhook Settings](https://github.com/mongodb/libmongocrypt/settings/hooks). + - Click `Edit` on the hook for `https://githook.mongodb.com/`. + - Add the new release branch to the `Payload URL`. Remove unmaintained release branches. - Make a PR to apply the "Update CHANGELOG.md for x.y.z" commit to the `master` branch. - Update the release on the [Jira releases page](https://jira.mongodb.org/projects/MONGOCRYPT/versions). - Record the release on [C/C++ Release Info](https://docs.google.com/spreadsheets/d/1yHfGmDnbA5-Qt8FX4tKWC5xk9AhzYZx1SKF4AD36ecY/edit?usp=sharing). This is done to meet SSDLC reporting requirements. @@ -150,4 +148,3 @@ index 609dc0b..f7530a9 100644 Architectures: amd64 arm64 suites: ``` - diff --git a/ext/libmongocrypt/libmongocrypt/etc/cyclonedx.sbom.json b/ext/libmongocrypt/libmongocrypt/etc/cyclonedx.sbom.json index 6c9af6d..f03a732 100644 --- a/ext/libmongocrypt/libmongocrypt/etc/cyclonedx.sbom.json +++ b/ext/libmongocrypt/libmongocrypt/etc/cyclonedx.sbom.json @@ -1,16 +1,16 @@ { "components": [ { - "bom-ref": "pkg:github/mongodb/mongo-c-driver@v1.28.1#src/libbson", + "bom-ref": "pkg:github/mongodb/mongo-c-driver@v1.30.3#src/libbson", "copyright": "Copyright 2009-present MongoDB, Inc.", "externalReferences": [ { "type": "distribution", - "url": "https://github.com/mongodb/mongo-c-driver/archive/refs/tags/v1.28.1.tar.gz" + "url": "https://github.com/mongodb/mongo-c-driver/archive/refs/tags/v1.30.3.tar.gz" }, { "type": "website", - "url": "https://github.com/mongodb/mongo-c-driver/tree/v1.28.1" + "url": "https://github.com/mongodb/mongo-c-driver/tree/v1.30.3" } ], "group": "mongodb", @@ -22,9 +22,9 @@ } ], "name": "mongo-c-driver", - "purl": "pkg:github/mongodb/mongo-c-driver@v1.28.1#src/libbson", + "purl": "pkg:github/mongodb/mongo-c-driver@v1.30.3#src/libbson", "type": "library", - "version": "v1.28.1" + "version": "v1.30.3" }, { "bom-ref": "pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz", @@ -53,11 +53,11 @@ "ref": "pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz" }, { - "ref": "pkg:github/mongodb/mongo-c-driver@v1.28.1#src/libbson" + "ref": "pkg:github/mongodb/mongo-c-driver@v1.30.3#src/libbson" } ], "metadata": { - "timestamp": "2024-10-10T20:09:56.207649+00:00", + "timestamp": "2025-04-08T13:06:37.750496+00:00", "tools": [ { "externalReferences": [ @@ -100,8 +100,8 @@ } ] }, - "serialNumber": "urn:uuid:879e1b41-08d8-4505-8c89-2285bc3e442c", - "version": 2, + "serialNumber": "urn:uuid:1eeadd7e-be33-4e55-960c-02bac1da4cf7", + "version": 1, "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.5", diff --git a/ext/libmongocrypt/libmongocrypt/etc/format.sh b/ext/libmongocrypt/libmongocrypt/etc/format.sh index b326b47..4fcd627 100755 --- a/ext/libmongocrypt/libmongocrypt/etc/format.sh +++ b/ext/libmongocrypt/libmongocrypt/etc/format.sh @@ -9,8 +9,6 @@ if ! run_python -c ''; then fail "No Python found?" fi -# Check that we have a pipx of the proper version: -run_python -c 'import pkg_resources; pkg_resources.require("pipx>=0.17.0,<2.0")' # Give default clang-format an empty string on stdin if there are no inputs files printf '' | run_python -m pipx run "clang-format==${CLANG_FORMAT_VERSION:?}" "$@" diff --git a/ext/libmongocrypt/libmongocrypt/etc/libbson-remove-GCC-diagnostic-in-functions.patch b/ext/libmongocrypt/libmongocrypt/etc/libbson-remove-GCC-diagnostic-in-functions.patch new file mode 100644 index 0000000..7d4f600 --- /dev/null +++ b/ext/libmongocrypt/libmongocrypt/etc/libbson-remove-GCC-diagnostic-in-functions.patch @@ -0,0 +1,158 @@ +diff --git a/src/libmongoc/src/mongoc/mongoc-collection.c b/src/libmongoc/src/mongoc/mongoc-collection.c +index d21a043788..ac0194e477 100644 +--- a/src/libmongoc/src/mongoc/mongoc-collection.c ++++ b/src/libmongoc/src/mongoc/mongoc-collection.c +@@ -681,6 +681,7 @@ mongoc_collection_command_simple (mongoc_collection_t *collection, + *-------------------------------------------------------------------------- + */ + ++BEGIN_IGNORE_DEPRECATIONS + int64_t + mongoc_collection_count (mongoc_collection_t *collection, /* IN */ + mongoc_query_flags_t flags, /* IN */ +@@ -705,13 +706,12 @@ mongoc_collection_count (mongoc_collection_t *collection, /* IN */ + /* Server Selection Spec: "may-use-secondary" commands SHOULD take a read + * preference argument and otherwise MUST use the default read preference + * from client, database or collection configuration. */ +- BEGIN_IGNORE_DEPRECATIONS + ret = mongoc_collection_count_with_opts (collection, flags, query, skip, limit, &opts, read_prefs, error); +- END_IGNORE_DEPRECATIONS + + bson_destroy (&opts); + return ret; + } ++END_IGNORE_DEPRECATIONS + + + int64_t +@@ -1231,6 +1231,7 @@ mongoc_collection_keys_to_index_string (const bson_t *keys) + } + + ++BEGIN_IGNORE_DEPRECATIONS + bool + mongoc_collection_create_index (mongoc_collection_t *collection, + const bson_t *keys, +@@ -1240,15 +1241,14 @@ mongoc_collection_create_index (mongoc_collection_t *collection, + bson_t reply; + bool ret; + +- BEGIN_IGNORE_DEPRECATIONS + + ret = mongoc_collection_create_index_with_opts (collection, keys, opt, NULL, &reply, error); + +- END_IGNORE_DEPRECATIONS + + bson_destroy (&reply); + return ret; + } ++END_IGNORE_DEPRECATIONS + + static bool + _mongoc_collection_index_keys_equal (const bson_t *expected, const bson_t *actual) +@@ -1578,16 +1578,16 @@ done: + } + + ++BEGIN_IGNORE_DEPRECATIONS + bool + mongoc_collection_ensure_index (mongoc_collection_t *collection, + const bson_t *keys, + const mongoc_index_opt_t *opt, + bson_error_t *error) + { +- BEGIN_IGNORE_DEPRECATIONS + return mongoc_collection_create_index (collection, keys, opt, error); +- END_IGNORE_DEPRECATIONS + } ++END_IGNORE_DEPRECATIONS + + + mongoc_cursor_t * +@@ -2317,6 +2317,7 @@ mongoc_collection_replace_one (mongoc_collection_t *collection, + *-------------------------------------------------------------------------- + */ + ++BEGIN_IGNORE_DEPRECATIONS + bool + mongoc_collection_save (mongoc_collection_t *collection, + const bson_t *document, +@@ -2330,7 +2331,6 @@ mongoc_collection_save (mongoc_collection_t *collection, + BSON_ASSERT_PARAM (collection); + BSON_ASSERT_PARAM (document); + +- BEGIN_IGNORE_DEPRECATIONS + if (!bson_iter_init_find (&iter, document, "_id")) { + return mongoc_collection_insert (collection, MONGOC_INSERT_NONE, document, write_concern, error); + } +@@ -2350,12 +2350,12 @@ mongoc_collection_save (mongoc_collection_t *collection, + + ret = mongoc_collection_update ( + collection, MONGOC_UPDATE_UPSERT | MONGOC_UPDATE_NO_VALIDATE, &selector, document, write_concern, error); +- END_IGNORE_DEPRECATIONS + + bson_destroy (&selector); + + return ret; + } ++END_IGNORE_DEPRECATIONS + + + bool +diff --git a/src/libmongoc/src/mongoc/mongoc-stream-tls.c b/src/libmongoc/src/mongoc/mongoc-stream-tls.c +index 744fdc4089..252d6209f3 100644 +--- a/src/libmongoc/src/mongoc/mongoc-stream-tls.c ++++ b/src/libmongoc/src/mongoc/mongoc-stream-tls.c +@@ -187,6 +187,7 @@ mongoc_stream_tls_check_cert (mongoc_stream_t *stream, const char *host) + *-------------------------------------------------------------------------- + */ + ++BEGIN_IGNORE_DEPRECATIONS + mongoc_stream_t * + mongoc_stream_tls_new_with_hostname (mongoc_stream_t *base_stream, const char *host, mongoc_ssl_opt_t *opt, int client) + { +@@ -208,9 +209,7 @@ mongoc_stream_tls_new_with_hostname (mongoc_stream_t *base_stream, const char *h + #if defined(MONGOC_ENABLE_SSL_OPENSSL) + return mongoc_stream_tls_openssl_new (base_stream, host, opt, client); + #elif defined(MONGOC_ENABLE_SSL_LIBRESSL) +- BEGIN_IGNORE_DEPRECATIONS + return mongoc_stream_tls_libressl_new (base_stream, host, opt, client); +- END_IGNORE_DEPRECATIONS + #elif defined(MONGOC_ENABLE_SSL_SECURE_TRANSPORT) + return mongoc_stream_tls_secure_transport_new (base_stream, host, opt, client); + #elif defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL) +@@ -219,6 +218,7 @@ mongoc_stream_tls_new_with_hostname (mongoc_stream_t *base_stream, const char *h + #error "Don't know how to create TLS stream" + #endif + } ++END_IGNORE_DEPRECATIONS + + #if defined(MONGOC_ENABLE_SSL_OPENSSL) && OPENSSL_VERSION_NUMBER >= 0x10100000L + /* +diff --git a/src/libmongoc/src/mongoc/mongoc-write-concern.c b/src/libmongoc/src/mongoc/mongoc-write-concern.c +index 82ac8d3c32..10b8585c1c 100644 +--- a/src/libmongoc/src/mongoc/mongoc-write-concern.c ++++ b/src/libmongoc/src/mongoc/mongoc-write-concern.c +@@ -492,6 +492,7 @@ mongoc_write_concern_append (mongoc_write_concern_t *write_concern, bson_t *comm + * Returns: A newly allocated mongoc_write_concern_t. This should be freed + * with mongoc_write_concern_destroy(). + */ ++BEGIN_IGNORE_DEPRECATIONS + mongoc_write_concern_t * + _mongoc_write_concern_new_from_iter (const bson_iter_t *iter, bson_error_t *error) + { +@@ -532,9 +533,7 @@ _mongoc_write_concern_new_from_iter (const bson_iter_t *iter, bson_error_t *erro + if (!BSON_ITER_HOLDS_BOOL (&inner)) { + goto fail; + } +- BEGIN_IGNORE_DEPRECATIONS + mongoc_write_concern_set_fsync (write_concern, bson_iter_bool (&inner)); +- END_IGNORE_DEPRECATIONS + } else if (BSON_ITER_IS_KEY (&inner, "j")) { + if (!BSON_ITER_HOLDS_BOOL (&inner)) { + goto fail; +@@ -560,3 +559,4 @@ fail: + mongoc_write_concern_destroy (write_concern); + return NULL; + } ++END_IGNORE_DEPRECATIONS diff --git a/ext/libmongocrypt/libmongocrypt/etc/libbson-remove-GCC-diagnostic-pragma.patch b/ext/libmongocrypt/libmongocrypt/etc/libbson-remove-GCC-diagnostic-pragma.patch index f556b4c..1e6fe03 100644 --- a/ext/libmongocrypt/libmongocrypt/etc/libbson-remove-GCC-diagnostic-pragma.patch +++ b/ext/libmongocrypt/libmongocrypt/etc/libbson-remove-GCC-diagnostic-pragma.patch @@ -1,7 +1,7 @@ -diff --git a/src/common/bson-dsl.h b/src/common/bson-dsl.h +diff --git a/src/common/src/common-bson-dsl-private.h b/src/common/src/common-bson-dsl-private.h index 58a14e28e..3341e603f 100644 ---- a/src/common/bson-dsl.h -+++ b/src/common/bson-dsl.h +--- a/src/common/src/common-bson-dsl-private.h ++++ b/src/common/src/common-bson-dsl-private.h @@ -29,6 +29,13 @@ enum { BSON_IF_WINDOWS (__declspec (selectany)) \ BSON_IF_POSIX (__attribute__ ((weak))) diff --git a/ext/libmongocrypt/libmongocrypt/etc/purls.txt b/ext/libmongocrypt/libmongocrypt/etc/purls.txt index 241c721..faf8945 100644 --- a/ext/libmongocrypt/libmongocrypt/etc/purls.txt +++ b/ext/libmongocrypt/libmongocrypt/etc/purls.txt @@ -8,7 +8,7 @@ # `copyright` property. This information can be manually added. # libbson is obtained via `cmake/FetchMongoC.cmake`. -pkg:github/mongodb/mongo-c-driver@v1.28.1?#src/libbson +pkg:github/mongodb/mongo-c-driver@v1.30.3?#src/libbson # IntelDFP is obtained via `cmake/IntelDFP.cmake` pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz diff --git a/ext/libmongocrypt/libmongocrypt/etc/ssdlc_compliance_report.md b/ext/libmongocrypt/libmongocrypt/etc/ssdlc_compliance_report.md index 4f4c813..e344015 100644 --- a/ext/libmongocrypt/libmongocrypt/etc/ssdlc_compliance_report.md +++ b/ext/libmongocrypt/libmongocrypt/etc/ssdlc_compliance_report.md @@ -10,7 +10,7 @@ Not available.