Merge branch 'master' into godriver3615

Author: qingyang-hu

.evergreen/config.yml

@@ -21,10 +21,6 @@ timeout:
       binary: bash
       args: [ls, -la]
 functions:
-  assume-test-secrets-ec2-role:
-    - command: ec2.assume_role
-      params:
-        role_arn: ${aws_test_secrets_role}
   setup-system:
     # Executes clone and applies the submitted patch, if any
     - command: git.get_project
@@ -502,35 +498,6 @@ functions:
       params:
         binary: bash
         args: ["${DRIVERS_TOOLS}/.evergreen/csfle/await-servers.sh"]
-  run-kms-tls-test:
-    - command: subprocess.exec
-      params:
-        binary: "bash"
-        env:
-          GO_BUILD_TAGS: cse
-        include_expansions_in_env: [AUTH, SSL, MONGODB_URI, TOPOLOGY, MONGO_GO_DRIVER_COMPRESSOR]
-        args: [*task-runner, setup-test]
-    - command: subprocess.exec
-      type: test
-      retry_on_failure: true
-      params:
-        binary: "bash"
-        include_expansions_in_env: [KMS_TLS_TESTCASE]
-        args: [*task-runner, evg-test-kms]
-  run-custom-aws-credentials-test:
-    - command: subprocess.exec
-      params:
-        binary: "bash"
-        env:
-          GO_BUILD_TAGS: cse
-        include_expansions_in_env: [AUTH, SSL, MONGODB_URI, TOPOLOGY, MONGO_GO_DRIVER_COMPRESSOR]
-        args: [*task-runner, setup-test]
-    - command: subprocess.exec
-      type: test
-      retry_on_failure: true
-      params:
-        binary: "bash"
-        args: [*task-runner, evg-test-custom-aws-credentials]
   run-kmip-tests:
     - command: subprocess.exec
       params:
@@ -547,23 +514,24 @@ functions:
         env:
           KMS_MOCK_SERVERS_RUNNING: "true"
         args: [*task-runner, evg-test-kmip]
-  run-retry-kms-requests:
+  run-client-side-encryption-test:
     - command: subprocess.exec
       params:
         binary: "bash"
         env:
           GO_BUILD_TAGS: cse
-        include_expansions_in_env: [AUTH, SSL, MONGODB_URI, TOPOLOGY, MONGO_GO_DRIVER_COMPRESSOR]
+        include_expansions_in_env: [AUTH, SSL, MONGODB_URI, TOPOLOGY, MONGO_GO_DRIVER_COMPRESSOR, CRYPT_SHARED_LIB_PATH]
         args: [*task-runner, setup-test]
     - command: subprocess.exec
       type: test
       retry_on_failure: true
       params:
         binary: "bash"
         env:
+          KMS_MOCK_SERVERS_RUNNING: "true"
           KMS_FAILPOINT_CA_FILE: "${DRIVERS_TOOLS}/.evergreen/x509gen/ca.pem"
           KMS_FAILPOINT_SERVER_RUNNING: "true"
-        args: [*task-runner, evg-test-retry-kms-requests]
+        args: [*task-runner, evg-test-client-side-encryption]
   run-fuzz-tests:
     - command: subprocess.exec
       type: test
@@ -1422,46 +1390,6 @@ tasks:
           TOPOLOGY: "server"
           AUTH: "noauth"
           SSL: "nossl"
-  - name: "test-kms-tls-invalid-cert"
-    tags: ["kms-test"]
-    commands:
-      - func: bootstrap-mongo-orchestration
-        vars:
-          TOPOLOGY: "server"
-          AUTH: "noauth"
-          SSL: "nossl"
-      - func: start-cse-servers
-      - func: run-kms-tls-test
-        vars:
-          KMS_TLS_TESTCASE: "INVALID_CERT"
-          TOPOLOGY: "server"
-          AUTH: "noauth"
-          SSL: "nossl"
-  - name: "test-kms-tls-invalid-hostname"
-    tags: ["kms-test"]
-    commands:
-      - func: bootstrap-mongo-orchestration
-        vars:
-          TOPOLOGY: "server"
-          AUTH: "noauth"
-          SSL: "nossl"
-      - func: start-cse-servers
-      - func: run-kms-tls-test
-        vars:
-          KMS_TLS_TESTCASE: "INVALID_HOSTNAME"
-          TOPOLOGY: "server"
-          AUTH: "noauth"
-          SSL: "nossl"
-  - name: "test-custom-aws-credentials"
-    tags: ["kms-test"]
-    commands:
-      - func: bootstrap-mongo-orchestration
-        vars:
-          TOPOLOGY: "server"
-          AUTH: "noauth"
-          SSL: "nossl"
-      - func: start-cse-servers
-      - func: run-custom-aws-credentials-test
   - name: "test-kms-kmip"
     tags: ["kms-kmip"]
     commands:
@@ -1476,16 +1404,20 @@ tasks:
           TOPOLOGY: "server"
           AUTH: "noauth"
           SSL: "nossl"
-  - name: "test-retry-kms-requests"
-    tags: ["kms-test"]
+  - name: "test-client-side-encryption"
+    tags: ["client-side-encryption-test"]
     commands:
       - func: bootstrap-mongo-orchestration
         vars:
-          TOPOLOGY: "server"
+          TOPOLOGY: "replica_set"
           AUTH: "noauth"
           SSL: "nossl"
       - func: start-cse-servers
-      - func: run-retry-kms-requests
+      - func: run-client-side-encryption-test
+        vars:
+          TOPOLOGY: "replica_set"
+          AUTH: "noauth"
+          SSL: "nossl"
   - name: "testgcpkms-task"
     commands:
       - command: subprocess.exec
@@ -1646,7 +1578,7 @@ axes:
       - id: "windows-64"
         display_name: "Windows 64-bit"
         run_on:
-          - windows-vsCurrent-small
+          - windows-2022-latest-small
         variables:
           GCC_PATH: "/cygdrive/c/ProgramData/chocolatey/lib/mingw/tools/install/mingw64/bin"
           GO_DIST: "C:\\golang\\go1.25"
@@ -1676,7 +1608,7 @@ axes:
       - id: "windows-64"
         display_name: "Windows 64-bit"
         run_on:
-          - windows-vsCurrent-small
+          - windows-2022-latest-small
         variables:
           GCC_PATH: "/cygdrive/c/ProgramData/chocolatey/lib/mingw/tools/install/mingw64/bin"
           GO_DIST: "C:\\golang\\go1.25"
@@ -1711,10 +1643,10 @@ axes:
   - id: os-aws-auth
     display_name: OS
     values:
-      - id: "windows-64-vsCurrent-latest-small"
+      - id: "windows-64-2022-latest-small"
         display_name: "Windows 64-bit"
         run_on:
-          - windows-vsCurrent-small
+          - windows-2022-latest-small
         variables:
           GCC_PATH: "/cygdrive/c/ProgramData/chocolatey/lib/mingw/tools/install/mingw64/bin"
           GO_DIST: "C:\\golang\\go1.25"
@@ -2112,11 +2044,11 @@ buildvariants:
     display_name: "API Version ${version} ${os-ssl-40}"
     tasks:
       - name: ".versioned-api"
-  - matrix_name: "kms-test"
-    matrix_spec: {version: ["7.0"], os-ssl-40: ["rhel87-64"]}
-    display_name: "KMS TEST ${os-ssl-40}"
+  - matrix_name: "client-side-encryption-test"
+    matrix_spec: {version: ["latest"], os-ssl-40: ["rhel87-64"]}
+    display_name: "Client Side Encryption Tests ${os-ssl-40}"
     tasks:
-      - name: ".kms-test"
+      - name: ".client-side-encryption-test"
   - matrix_name: "load-balancer-test"
     tags: ["pullrequest"]
     matrix_spec: {version: ["5.0", "6.0", "7.0", "8.0"], os-ssl-40: ["rhel87-64"]}

.golangci.yml

@@ -4,7 +4,7 @@ linters:
   enable:
     - errcheck
     - gocritic
-    # TODO(GODRIVER-3712): Enable gosec in golangci-lint version 2.6.2
+    # TODO(GODRIVER-3712): Enable gosec in golangci-lint version 2.8.0
     #- gosec
     - govet
     - ineffassign
@@ -61,6 +61,10 @@ linters:
       - linters:
           - gosec
         path: _test\.go
+      # Ignore prealloc warnings for test files.
+      - linters:
+          - prealloc
+        path: _test\.go
       # Ignore missing comments for exported variable/function/type for code in
       # the "internal" and "benchmark" directories.
       - path: (internal\/|benchmark\/)

.pre-commit-config.yaml

@@ -53,6 +53,13 @@ repos:
         entry: chmod +x
         language: system
         types: [shell]
+      - id: gofumpt
+        name: gofumpt
+        entry: gofumpt -w
+        language: golang
+        types: [go]
+        exclude: ^vendor/
+        additional_dependencies: [mvdan.cc/gofumpt@v0.9.2]
       - id: golangci-lint
         name: golangci-lint
         language: system

Dockerfile

@@ -43,6 +43,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
   update-ca-certificates && \
   rm -rf /var/lib/apt/lists/*
 
+# Install taskfile
+RUN go install github.com/go-task/task/v3/cmd/task@v3.39.2
 
 COPY etc/docker_entry.sh /root/docker_entry.sh
 COPY --from=libmongocrypt /root/install /root/install

Taskfile.yml

@@ -27,12 +27,15 @@ tasks:
   build-compile-check-all: bash etc/run-compile-check-test.sh
   build-aws-ecs-test: go test -c ./internal/test/aws -o aws.testbin
   check-fmt:
-    deps: [install-lll]
+    deps: [install-lll, install-gofumpt]
     cmds:
       - bash etc/check_fmt.sh
   check-modules: bash etc/check_modules.sh
   doc: godoc -http=:6060 -index
-  fmt: go fmt ./...
+  fmt:
+    deps: [install-gofumpt]
+    cmds:
+      - gofumpt -w .
   api-report: bash etc/api_report.sh
   install-libmongocrypt:
     cmds: [bash etc/install-libmongocrypt.sh]
@@ -90,16 +93,8 @@ tasks:
     - go run -race ./internal/cmd/testoidcauth/main.go
   evg-test-kmip:
     - go test -exec "env PKG_CONFIG_PATH=${PKG_CONFIG_PATH} LD_LIBRARY_PATH=${LD_LIBRARY_PATH} DYLD_LIBRARY_PATH=${MACOS_LIBRARY_PATH}" ${BUILD_TAGS} -v -timeout {{.TEST_TIMEOUT}}s ./internal/integration -run TestClientSideEncryptionSpec/kmipKMS >> test.suite
-    - go test -exec "env PKG_CONFIG_PATH=${PKG_CONFIG_PATH} LD_LIBRARY_PATH=${LD_LIBRARY_PATH} DYLD_LIBRARY_PATH=${MACOS_LIBRARY_PATH}" ${BUILD_TAGS} -v -timeout {{.TEST_TIMEOUT}}s ./internal/integration -run TestClientSideEncryptionProse/data_key_and_double_encryption >> test.suite
-    - go test -exec "env PKG_CONFIG_PATH=${PKG_CONFIG_PATH} LD_LIBRARY_PATH=${LD_LIBRARY_PATH} DYLD_LIBRARY_PATH=${MACOS_LIBRARY_PATH}" ${BUILD_TAGS} -v -timeout {{.TEST_TIMEOUT}}s ./internal/integration -run TestClientSideEncryptionProse/corpus >> test.suite
-    - go test -exec "env PKG_CONFIG_PATH=${PKG_CONFIG_PATH} LD_LIBRARY_PATH=${LD_LIBRARY_PATH} DYLD_LIBRARY_PATH=${MACOS_LIBRARY_PATH}" ${BUILD_TAGS} -v -timeout {{.TEST_TIMEOUT}}s ./internal/integration -run TestClientSideEncryptionProse/custom_endpoint >> test.suite
-    - go test -exec "env PKG_CONFIG_PATH=${PKG_CONFIG_PATH} LD_LIBRARY_PATH=${LD_LIBRARY_PATH} DYLD_LIBRARY_PATH=${MACOS_LIBRARY_PATH}" ${BUILD_TAGS} -v -timeout {{.TEST_TIMEOUT}}s ./internal/integration -run TestClientSideEncryptionProse/kms_tls_options_test >> test.suite
-  evg-test-kms:
-    - go test -exec "env PKG_CONFIG_PATH=${PKG_CONFIG_PATH} LD_LIBRARY_PATH=${LD_LIBRARY_PATH}" ${BUILD_TAGS} -v -timeout {{.TEST_TIMEOUT}}s ./internal/integration -run TestClientSideEncryptionProse/kms_tls_tests >> test.suite
-  evg-test-custom-aws-credentials:
-    - go test -exec "env PKG_CONFIG_PATH=${PKG_CONFIG_PATH} LD_LIBRARY_PATH=${LD_LIBRARY_PATH}" ${BUILD_TAGS} -v -timeout {{.TEST_TIMEOUT}}s ./internal/integration -run TestCustomAwsCredentialsProse >> test.suite
-  evg-test-retry-kms-requests:
-    - go test -exec "env PKG_CONFIG_PATH=${PKG_CONFIG_PATH} LD_LIBRARY_PATH=${LD_LIBRARY_PATH}" ${BUILD_TAGS} -v -timeout {{.TEST_TIMEOUT}}s ./internal/integration -run TestClientSideEncryptionProse/kms_retry_tests >> test.suite
+  evg-test-client-side-encryption:
+    - go test -exec "env PKG_CONFIG_PATH=${PKG_CONFIG_PATH} LD_LIBRARY_PATH=${LD_LIBRARY_PATH} DYLD_LIBRARY_PATH=${MACOS_LIBRARY_PATH}" ${BUILD_TAGS} -v -timeout {{.TEST_TIMEOUT}}s ./internal/integration -run TestClientSideEncryptionProse >> test.suite
   evg-test-load-balancers:
     # Load balancer should be tested with all unified tests as well as tests in the following
     # components: retryable reads, retryable writes, change streams, initial DNS seedlist discovery.
@@ -131,6 +126,12 @@ tasks:
     cmds:
       - go test ./internal/cmd/benchmark -v --fullRun | tee perf.suite
   ### Internal tasks. ###
+  install-gofumpt:
+    internal: true
+    cmds:
+      - go install mvdan.cc/gofumpt@v0.9.2
+    status:
+      - command -v gofumpt
   install-lll:
     internal: true
     cmds:

bson/benchmark_test.go

@@ -451,9 +451,11 @@ type codeNode struct {
 	MeanT    int64       `json:"mean_t"`
 }
 
-var codeJSON []byte
-var codeBSON []byte
-var codeStruct codeResponse
+var (
+	codeJSON   []byte
+	codeBSON   []byte
+	codeStruct codeResponse
+)
 
 func codeInit() {
 	f, err := os.Open("testdata/code.json.gz")

bson/bson_corpus_spec_test.go

@@ -497,5 +497,4 @@ func TestRelaxedUUIDValidation(t *testing.T) {
 			}
 		})
 	}
-
 }

bson/bson_test.go

@@ -299,6 +299,7 @@ func TestMStringer(t *testing.T) {
 
 	assert.Equal(t, want, res, "returned string did not unmarshal to the expected document, returned string: %s", got)
 }
+
 func TestD_MarshalJSON(t *testing.T) {
 	t.Parallel()
 
@@ -562,7 +563,6 @@ func TestMapCodec(t *testing.T) {
 		err = Unmarshal(doc, &got)
 		assert.Nil(t, err, "Unmarshal error: %v", err)
 		assert.Equal(t, mapObj, got, "expected result %v, got %v", mapObj, got)
-
 	})
 
 	t.Run("keys implements encoding.TextMarshaler and encoding.TextUnmarshaler", func(t *testing.T) {
@@ -581,7 +581,6 @@ func TestMapCodec(t *testing.T) {
 		err = Unmarshal(doc, &got)
 		assert.Nil(t, err, "Unmarshal error: %v", err)
 		assert.Equal(t, mapObj, got, "expected result %v, got %v", mapObj, got)
-
 	})
 }
 

bson/bsoncodec.go

@@ -12,9 +12,7 @@ import (
 	"strings"
 )
 
-var (
-	emptyValue = reflect.Value{}
-)
+var emptyValue = reflect.Value{}
 
 // ValueEncoderError is an error returned from a ValueEncoder when the provided value can't be
 // encoded by the ValueEncoder.
@@ -178,8 +176,10 @@ type decodeAdapter struct {
 	typeDecoderFunc
 }
 
-var _ ValueDecoder = decodeAdapter{}
-var _ typeDecoder = decodeAdapter{}
+var (
+	_ ValueDecoder = decodeAdapter{}
+	_ typeDecoder  = decodeAdapter{}
+)
 
 func decodeTypeOrValueWithInfo(vd ValueDecoder, dc DecodeContext, vr ValueReader, t reflect.Type) (reflect.Value, error) {
 	if td, _ := vd.(typeDecoder); td != nil {

bson/codec_cache.go

@@ -22,8 +22,10 @@ func init() {
 }
 
 // statically assert array size
-var _ = (kindEncoderCache{}).entries[reflect.UnsafePointer]
-var _ = (kindDecoderCache{}).entries[reflect.UnsafePointer]
+var (
+	_ = (kindEncoderCache{}).entries[reflect.UnsafePointer]
+	_ = (kindDecoderCache{}).entries[reflect.UnsafePointer]
+)
 
 type typeEncoderCache struct {
 	cache sync.Map // map[reflect.Type]ValueEncoder