Update to libmongocrypt 1.19.0

.github/workflows/release.yml

@@ -2,35 +2,60 @@ name: "Release"
 run-name: "Release for ${{ github.ref }}"
 
 on:
+  push:
+    branches:
+      - master
   workflow_dispatch:
     inputs:
+      pr:
+        description: The PR number to release
+        required: true
+        type: string
       dry_run:
         description: Is this a dry run?
         required: true
         default: true
         type: boolean
 
-env:
-  RELEASE_MESSAGE_TEMPLATE: |
-    Version {0} of the [libmongocrypt helper for Ruby](https://rubygems.org/gems/libmongocrypt-helper) is now available.
-
-    **Release Highlights**
+jobs:
+  pr-check:
+    name: "PR Eligibility Check"
+    runs-on: 'ubuntu-latest'
 
-    TODO: one or more paragraphs describing important changes in this release
+    permissions:
+      contents: read
+      pull-requests: read
 
-    **Documentation**
+    outputs:
+      ref: ${{ steps.pr_check.outputs.ref }}
+      release_message: ${{ steps.pr_check.outputs.message }}
 
-    Documentation is available at [MongoDB.com](https://www.mongodb.com/docs/ruby-driver/current/).
+    steps:
+      - name: "Check PR eligibility"
+        id: pr_check
+        uses: mongodb-labs/drivers-github-tools/ruby/pr-check@v3
 
-    **Installation**
+  build:
+    name: "Build Gem"
+    needs: [pr-check]
+    runs-on: 'ubuntu-latest'
 
-    You may install this version via RubyGems, with:
+    permissions:
+      contents: read
+      id-token: write
 
-    gem install --version {0} libmongocrypt-helper
+    steps:
+      - name: "Build the gem"
+        uses: mongodb-labs/drivers-github-tools/ruby/build@v3
+        with:
+          app_id: ${{ vars.APP_ID }}
+          app_private_key: ${{ secrets.APP_PRIVATE_KEY }}
+          gem_name: libmongocrypt-helper
+          ref: ${{ needs.pr-check.outputs.ref }}
 
-jobs:
   release:
     name: "Release"
+    needs: [pr-check, build]
     environment: release
     runs-on: 'ubuntu-latest'
 
@@ -45,22 +70,22 @@ jobs:
       actions: read
       contents: write
 
-      # required by the mongodb-labs/drivers-github-tools/setup@v2 step
+      # required by the mongodb-labs/drivers-github-tools/setup@v3 step
       # also required by `rubygems/release-gem`
       id-token: write
 
     steps:
       - name: "Run the publish action"
-        uses: mongodb-labs/drivers-github-tools/ruby/publish@v2
+        uses: mongodb-labs/drivers-github-tools/ruby/publish@v3
         with:
           app_id: ${{ vars.APP_ID }}
           app_private_key: ${{ secrets.APP_PRIVATE_KEY }}
           aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
           aws_region_name: ${{ vars.AWS_REGION_NAME }}
           aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
-          dry_run: ${{ inputs.dry_run }}
+          dry_run: ${{ inputs.dry_run || 'false' }}
           gem_name: libmongocrypt-helper
           product_name: Libmongocrypt Helper for Ruby
           product_id: libmongocrypt-helper-ruby
-          release_message_template: ${{ env.RELEASE_MESSAGE_TEMPLATE }}
-          silk_asset_group: libmongocrypt-helper-ruby
+          ref: ${{ needs.pr-check.outputs.ref }}
+          release_message: ${{ needs.pr-check.outputs.release_message }}

AGENTS.md

@@ -14,6 +14,8 @@ The project is organized into the following directories:
 
 Refer to @README.maint.md for instructions on updating the libmongocrypt library.
 
+Design documents and implementation plans are not to be committed to the repository unless explicitly requested.
+
 # Code Reviews
 
 See [.github/code-review.md](.github/code-review.md) for code review guidelines.

README.maint.md

@@ -3,19 +3,28 @@ libmongocrypt Ruby Helper - Maintainer Guide
 
 ## Packaging New libmongocrypt Version
 
-Edit `lib/libmongocrypt_helper/version.rb` and:
+The easy way:
 
-1. Update the `LIBMONGOCRYPT_VERSION` constant to the version of
+```
+$ rake update:all
+```
+
+That command will run the steps outlined below, but if you want to do it manually, here are the steps:
+
+1. Edit `lib/libmongocrypt_helper/version.rb` and update the `LIBMONGOCRYPT_VERSION` constant to the version of
 `libmongocrypt` that you want to package.
 2. Update the `VERSION` constant to the version of the helper, which is
 derived from `libmongocrypt` version as described below.
 3. Download the source code of the corresponding version of `libmongocrypt` from
 <https://github.com/mongodb/libmongocrypt/releases/>, and unpack it to
 `ext/libmongocrypt/libmongocrypt`.
-4. Update the SBOM lite file by running `etc/update-sbom.sh`
+4. Update the SBOM lite file by running `etc/update-sbom.sh` (this requires that you have Docker running locally).
 5. Test the changes by running `gem build *.gemspec && gem install libmongocrypt-helper-VERSION.gem`.
-6. Commit the changes.
-7. Create a PR for the changes. Once approved and merged, run the "Release" action on GitHub to create and publish the new gem.
+
+Whether you use the `rake` task or do it manually, you will then do the following two steps:
+
+1. Commit the changes.
+2. Create a PR for the changes. Make sure the PR is labelled with `release-candidate`. Once approved and merged, the new version of the helper will automatically be built and published to RubyGems.
 
 ## Helper Version Scheme
 

Rakefile

@@ -8,13 +8,22 @@ task :compile do
   end
 end
 
-desc 'NOT USED'
 task :build do
-  abort <<~WARNING
-    `rake build` does nothing in this project. The gem must be built via
-    the `Release` action on GitHub, which is triggered manually when
-    a new release is ready.
-  WARNING
+  gemspec = ENV['GEMSPEC']
+  gem_file_name = ENV['GEM_FILE_NAME']
+
+  unless gemspec && gem_file_name
+    abort <<~WARNING
+      `rake build` is intended to be called from CI only, with GEMSPEC and
+      GEM_FILE_NAME environment variables set. To build the gem manually,
+      run `gem build libmongocrypt-helper.gemspec` directly.
+    WARNING
+  end
+
+  system('gem', 'build', gemspec) or abort('gem build failed')
+
+  built = Dir['*.gem'].first
+  File.rename(built, gem_file_name) if built && built != gem_file_name
 end
 
 # `rake version` is used by the deployment system so get the release version

ext/libmongocrypt/libmongocrypt/.evergreen/benchmark-python.sh

@@ -9,23 +9,26 @@ fi
 
 MONGOCRYPT_INSTALL_PREFIX=$LIBMONGOCRYPT_DIR/.install
 
+. "$(dirname "${BASH_SOURCE[0]}")/install-build-tools.sh"
+install_build_tools
+
 # Install libmongocrypt.
 build_dir="$LIBMONGOCRYPT_DIR/cmake-build"
-run_cmake \
+cmake \
     -DCMAKE_INSTALL_PREFIX="$MONGOCRYPT_INSTALL_PREFIX" \
     -DCMAKE_BUILD_TYPE="RelWithDebInfo" \
     -B"$build_dir"
-run_cmake --build "$build_dir" --target install
+cmake --build "$build_dir" --target install
 
 # Run Python benchmarks.
 # Include path to installed libmongocrypt.so
 export LD_LIBRARY_PATH="$MONGOCRYPT_INSTALL_PREFIX/lib64"
 cd bindings/python/
 
-/opt/mongodbtoolchain/v4/bin/python3 -m venv venv
+uv venv venv
 . ./venv/bin/activate
-python -m pip install --prefer-binary -r requirements-test.txt
-python -m pip install -e .
+uv pip install -r requirements-test.txt
+uv pip install -e .
 
 export OUTPUT_FILE=results.json
 

ext/libmongocrypt/libmongocrypt/.evergreen/build_all.sh

@@ -35,8 +35,14 @@ BUILD_TESTING="${BUILD_TESTING-TRUE}"
 LIBMONGOCRYPT_BUILD_VARIANTS="${LIBMONGOCRYPT_BUILD_VARIANTS:-TRUE}"
 
 # Accumulate arguments that are passed to CMake
-cmake_args=(
-    --fresh
+cmake_args=()
+
+# Temporary workarounds for rhel-62-64-bit and rhel72-zseries-test. To be removed.
+if cmake --help | grep -q -- '--fresh'; then
+  cmake_args+=(--fresh)
+fi
+
+cmake_args+=(
     # Set the build type. CMake 3.22 recognizes this via environment variable
     -D CMAKE_BUILD_TYPE="${CMAKE_BUILD_TYPE}"
     # Set the install prefix. CMake 3.29 recognizes this via environment variable
@@ -67,19 +73,15 @@ for suffix in "dll" "dylib" "so"; do
     fi
 done
 
-if test "${CMAKE_GENERATOR-}" = Ninja; then
-    export NINJA_EXE
-    : "${NINJA_EXE:="$BINARY_DIR/ninja$EXE_SUFFIX"}"
-    cmake_args+=(-DCMAKE_MAKE_PROGRAM="$NINJA_EXE")
-    bash "$EVG_DIR/ensure-ninja.sh"
-fi
+. "$(dirname "${BASH_SOURCE[0]}")/install-build-tools.sh"
+install_build_tools
 
 # A command that prepends our custom compile flags for any CMake execution
 _cmake_with_env() {
     # Prepend our custom C and CXX flags for any possible CMake builds
     CFLAGS="$LIBMONGOCRYPT_COMPILE_FLAGS ${CFLAGS-}" \
     CXXFLAGS="$LIBMONGOCRYPT_COMPILE_FLAGS ${CXXFLAGS-}" \
-        run_cmake "$@"
+        cmake "$@"
 }
 
 # Build and install libmongocrypt.
@@ -113,7 +115,7 @@ if [[ "$release_os_arch" == *glibc* ]]; then
     echo "glibc version check passed: $actual_glibc"
 fi
 
-run_chdir "$BINARY_DIR" run_ctest
+run_chdir "$BINARY_DIR" ctest
 
 # MONGOCRYPT-372, ensure macOS universal builds contain both x86_64 and arm64 architectures.
 if test "${CMAKE_OSX_ARCHITECTURES-}" != ''; then
@@ -143,12 +145,12 @@ _cmake_with_env "${cmake_args[@]}" \
     -DCMAKE_INSTALL_PREFIX="$MONGOCRYPT_INSTALL_PREFIX/nocrypto" \
     -B "$BINARY_DIR" -S "$LIBMONGOCRYPT_DIR"
 _cmake_with_env --build "$BINARY_DIR" --target install
-run_chdir "$BINARY_DIR" run_ctest
+run_chdir "$BINARY_DIR" ctest
 
 # Build and install libmongocrypt without statically linking libbson
 _cmake_with_env "${cmake_args[@]}" \
     -DUSE_SHARED_LIBBSON=ON \
     -DCMAKE_INSTALL_PREFIX="$MONGOCRYPT_INSTALL_PREFIX/sharedbson" \
     -B "$BINARY_DIR" -S "$LIBMONGOCRYPT_DIR"
 _cmake_with_env --build "$BINARY_DIR" --target install
-run_chdir "$BINARY_DIR" run_ctest
+run_chdir "$BINARY_DIR" ctest

ext/libmongocrypt/libmongocrypt/.evergreen/config.yml

@@ -116,7 +116,7 @@ functions:
           export LSAN_OPTIONS="suppressions=$LIBMONGOCRYPT_DIR/.lsan-suppressions"
           export VS_VERSION=${vs_version|}
           export VS_TARGET_ARCH=${vs_target_arch|amd64}
-          export CMAKE_GENERATOR=${CMAKE_GENERATOR|Ninja}
+          export CMAKE_GENERATOR=${CMAKE_GENERATOR|Ninja} # Even on Windows.
           export release_os_arch=${release_os_arch}
           env ${compile_env|} \
             bash "$EVG_DIR/env-run.sh" \
@@ -169,7 +169,6 @@ functions:
     - command: "shell.exec"
       params:
         script: |-
-          if test "$OS_NAME" != "windows"; then export CMAKE_GENERATOR=${CMAKE_GENERATOR|Ninja}; fi
           env ${compile_env|} CONFIGURE_ONLY=ON ${clang_env|CC=clang CXX=clang++} \
               bash libmongocrypt/.evergreen/build_all.sh
           ./libmongocrypt/.evergreen/clang-tidy.sh
@@ -502,7 +501,7 @@ tasks:
   - func: "fetch source"
   - func: "earthly"
     vars:
-      args: +create-deb-packages-and-repos --env=${earthly_env} --packager_distro=${packager_distro} --packager_arch=${packager_arch} --ninja_version=${ninja_version}
+      args: +create-deb-packages-and-repos --env=${earthly_env} --packager_distro=${packager_distro} --packager_arch=${packager_arch}
   - func: "upload packages and repos"
 
 - name: publish-deb-packages-with-earthly
@@ -1059,7 +1058,7 @@ tasks:
           set -o errexit
 
           . .evergreen/init.sh
-          libmongocrypt_release_version=$(run_python ./etc/calc_release_version.py)
+          libmongocrypt_release_version=$(uvx python ./etc/calc_release_version.py)
           case "$libmongocrypt_release_version" in
             *+*)
               # Not a tagged release. Use full release version suffix.
@@ -1983,8 +1982,6 @@ buildvariants:
     compile_env: >-
       CMAKE_OSX_ARCHITECTURES="arm64;x86_64"
       CMAKE=/opt/homebrew/bin/cmake
-    # Disable Ninja to work around error "Bad CPU type in executable"
-    CMAKE_GENERATOR: ''
     release_os_arch: macos-universal
   tasks:
   - build-and-test-and-upload
@@ -2053,7 +2050,6 @@ buildvariants:
     packager_distro: debian13
     packager_arch: arm64
     earthly_env: deb13
-    ninja_version: 1.12.1
   tasks:
   - name: build-deb-packages-with-earthly
     # Use an arm64 distro to match the intended target architecture of .deb packages.