CXX-3228 update scripts for SilkBomb 2.0

.evergreen/build_snapshot_rpm.sh

@@ -39,7 +39,7 @@ done
 
 package=mongo-cxx-driver
 spec_file=../mongo-cxx-driver.spec
-config=${MOCK_TARGET_CONFIG:=fedora-39-aarch64}
+config=${MOCK_TARGET_CONFIG:=fedora-40-aarch64}
 
 if [ ! -x /usr/bin/rpmbuild -o ! -x /usr/bin/rpmspec ]; then
   echo "Missing the rpmbuild or rpmspec utility from the rpm-build package"

.evergreen/silk-check-augmented-sbom.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o pipefail
+
+: "${ARTIFACTORY_USER:?}"
+: "${ARTIFACTORY_PASSWORD:?}"
+: "${branch_name:?}"
+: "${KONDUKTO_TOKEN:?}"
+
+command -v podman >/dev/null || {
+  echo "missing required program podman" 1>&2
+  exit 1
+}
+
+command -v jq >/dev/null || {
+  echo "missing required program jq" 1>&2
+  exit 1
+}
+
+podman login --password-stdin --username "${ARTIFACTORY_USER:?}" artifactory.corp.mongodb.com <<<"${ARTIFACTORY_PASSWORD:?}"
+
+silkbomb="artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0"
+
+# Ensure latest version of SilkBomb is being used.
+podman pull "${silkbomb:?}"
+
+silkbomb_augment_flags=(
+  --repo mongodb/mongo-cxx-driver
+  --branch "${branch_name:?}"
+  --sbom-in /pwd/etc/cyclonedx.sbom.json
+  --sbom-out /pwd/etc/augmented.sbom.json.new
+
+  # Any notable updates to the Augmented SBOM version should be done manually after careful inspection.
+  # Otherwise, it should be equal to the SBOM Lite version, which should normally be `1`.
+  --no-update-sbom-version
+)
+
+# Allow the timestamp to be updated in the Augmented SBOM for update purposes.
+podman run -it --rm -v "$(pwd):/pwd" --env 'KONDUKTO_TOKEN' "${silkbomb:?}" augment "${silkbomb_augment_flags[@]:?}"
+
+[[ -f ./etc/augmented.sbom.json.new ]] || {
+  echo "failed to download Augmented SBOM" 1>&2
+  exit 1
+}
+
+echo "Comparing Augmented SBOM..."
+
+# Format for easier diff while ignoring the timestamp field.
+jq -S 'del(.metadata.timestamp)' ./etc/augmented.sbom.json >|old.json
+jq -S 'del(.metadata.timestamp)' ./etc/augmented.sbom.json.new >|new.json
+
+# Allow the task to upload the Augmented SBOM even if the diff failed.
+if ! diff -sty --left-column -W 200 old.json new.json >|diff.txt; then
+  declare status
+  status='{"status":"failed", "type":"test", "should_continue":true, "desc":"detected significant changes in Augmented SBOM"}'
+  curl -sS -d "${status:?}" -H "Content-Type: application/json" -X POST localhost:2285/task_status || true
+fi
+
+cat diff.txt
+
+echo "Comparing Augmented SBOM... done."

.evergreen/silk-upload-sbom-lite.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o pipefail
+
+: "${ARTIFACTORY_USER:?}"
+: "${ARTIFACTORY_PASSWORD:?}"
+: "${branch_name:?}"
+: "${KONDUKTO_TOKEN:?}"
+
+command -v podman >/dev/null || {
+  echo "missing required program podman" 1>&2
+  exit 1
+}
+
+podman login --password-stdin --username "${ARTIFACTORY_USER:?}" artifactory.corp.mongodb.com <<<"${ARTIFACTORY_PASSWORD:?}"
+
+silkbomb="artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0"
+
+# Ensure latest version of SilkBomb is being used.
+podman pull "${silkbomb:?}"
+
+# First validate the SBOM Lite.
+podman run -it --rm -v "$(pwd):/pwd" "${silkbomb:?}" \
+  validate --purls /pwd/etc/purls.txt --sbom-in /pwd/etc/cyclonedx.sbom.json --exclude jira
+
+# Then upload the SBOM Lite.
+podman run -it --rm -v "$(pwd):/pwd" --env 'KONDUKTO_TOKEN' "${silkbomb:?}" \
+  upload --repo mongodb/mongo-cxx-driver --branch "${branch_name:?}" --sbom-in /pwd/etc/cyclonedx.sbom.json

.evergreen/spec.patch

@@ -8,7 +8,7 @@
 +
  Name:           mongo-cxx-driver
 -Version:        3.6.5
-+Version:        3.11.0
++Version:        3.11.1
  Release:        1%{?dist}
  Summary:        A C++ Driver for MongoDB
  License:        ASL 2.0
@@ -36,7 +36,7 @@
  %cmake \
      -DCMAKE_BUILD_TYPE=Release \
      -DBSONCXX_POLY_USE_BOOST=1 \
-+    -DBUILD_VERSION=3.11.0 \
++    -DBUILD_VERSION=3.11.1 \
 +    -DENABLE_UNINSTALL=OFF \
 +    -DENABLE_TESTS=OFF \
      .

.mci.yml

@@ -685,52 +685,139 @@ functions:
             AWS_SECRET_ACCESS_KEY: ${aws_secret}
           args:
             - -c
-            - aws s3 cp scan s3://mciuploads/${project}/${build_variant}/${revision}/${version_id}/${build_id}/scan/ --recursive --acl public-read --region us-east-1
+            - aws s3 cp scan s3://mciuploads/mongo-cxx-driver/${build_variant}/${revision}/${version_id}/${build_id}/scan/ --recursive --acl public-read --region us-east-1
       - command: s3.put
         params:
           aws_key: ${aws_key}
           aws_secret: ${aws_secret}
-          remote_file: ${project}/${build_variant}/${revision}/${version_id}/${build_id}/scan/index.html
+          remote_file: mongo-cxx-driver/${build_variant}/${revision}/${version_id}/${build_id}/scan/index.html
           bucket: mciuploads
           permissions: public-read
           local_file: mongo-cxx-driver/scan.html
           content_type: text/html
           display_name: Scan Build Report
 
-    "check augmented sbom":
+    "upload sbom lite":
+      - command: ec2.assume_role
+        type: setup
+        params:
+          role_arn: ${KONDUKTO_ROLE_ARN}
+      - command: subprocess.exec
+        type: setup
+        params:
+          binary: bash
+          include_expansions_in_env:
+            - AWS_ACCESS_KEY_ID
+            - AWS_SECRET_ACCESS_KEY
+            - AWS_SESSION_TOKEN
+          args:
+            - -c
+            - |
+              set -o errexit
+              set -o pipefail
+              kondukto_token="$(aws secretsmanager get-secret-value --secret-id "kondukto-token" --region "us-east-1" --query 'SecretString' --output text)"
+              printf "KONDUKTO_TOKEN: %s\n" "$kondukto_token" >|expansions.kondukto.yml
+      - command: expansions.update
+        type: setup
+        params:
+          file: expansions.kondukto.yml
       - command: subprocess.exec
         type: test
         params:
-          working_dir: "mongo-cxx-driver"
           binary: bash
+          working_dir: mongo-cxx-driver
           include_expansions_in_env:
             - ARTIFACTORY_USER
             - ARTIFACTORY_PASSWORD
-            - SILK_CLIENT_ID
-            - SILK_CLIENT_SECRET
-          args: [-c, .evergreen/check-augmented-sbom.sh]
+            - branch_name
+            - KONDUKTO_TOKEN
+          args:
+            - -c
+            - .evergreen/scripts/silk-upload-sbom-lite.sh
+
+    "check augmented sbom":
+      - command: ec2.assume_role
+        type: setup
+        params:
+          role_arn: ${KONDUKTO_ROLE_ARN}
+      - command: subprocess.exec
+        type: setup
+        params:
+          binary: bash
+          include_expansions_in_env:
+            - AWS_ACCESS_KEY_ID
+            - AWS_SECRET_ACCESS_KEY
+            - AWS_SESSION_TOKEN
+          args:
+            - -c
+            - |
+              set -o errexit
+              set -o pipefail
+              kondukto_token="$(aws secretsmanager get-secret-value --secret-id "kondukto-token" --region "us-east-1" --query 'SecretString' --output text)"
+              printf "KONDUKTO_TOKEN: %s\n" "$kondukto_token" >|expansions.kondukto.yml
+      - command: expansions.update
+        type: setup
+        params:
+          file: expansions.kondukto.yml
+      - command: subprocess.exec
+        type: test
+        params:
+          binary: bash
+          working_dir: mongo-cxx-driver
+          include_expansions_in_env:
+            - ARTIFACTORY_PASSWORD
+            - ARTIFACTORY_USER
+            - branch_name
+            - KONDUKTO_TOKEN
+          args:
+            - -c
+            - .evergreen/scripts/silk-check-augmented-sbom.sh
 
     "upload augmented sbom":
       - command: s3.put
+        type: system
         params:
+          display_name: Augmented SBOM (Old)
           aws_key: ${aws_key}
           aws_secret: ${aws_secret}
-          remote_file: ${project}/${build_variant}/${revision}/${version_id}/${build_id}/silk/augmented.sbom.json
           bucket: mciuploads
-          permissions: public-read
-          local_file: mongo-cxx-driver/etc/augmented.sbom.json.new
           content_type: application/json
-          display_name: Augmented SBOM
+          local_file: mongo-cxx-driver/old.json
+          permissions: public-read
+          remote_file: mongo-cxx-driver/${build_variant}/${revision}/${version_id}/${build_id}/silk/old.json
       - command: s3.put
+        type: system
         params:
+          display_name: Augmented SBOM (New)
           aws_key: ${aws_key}
           aws_secret: ${aws_secret}
-          remote_file: ${project}/${build_variant}/${revision}/${version_id}/${build_id}/silk/augmented.sbom.json.diff
           bucket: mciuploads
+          content_type: application/json
+          local_file: mongo-cxx-driver/new.json
           permissions: public-read
+          remote_file: mongo-cxx-driver/${build_variant}/${revision}/${version_id}/${build_id}/silk/new.json
+      - command: s3.put
+        type: system
+        params:
+          display_name: Augmented SBOM (Diff)
+          aws_key: ${aws_key}
+          aws_secret: ${aws_secret}
+          bucket: mciuploads
+          content_type: application/json
           local_file: mongo-cxx-driver/diff.txt
+          permissions: public-read
+          remote_file: mongo-cxx-driver/${build_variant}/${revision}/${version_id}/${build_id}/silk/diff.txt
+      - command: s3.put
+        type: system
+        params:
+          display_name: Augmented SBOM (Updated)
+          aws_key: ${aws_key}
+          aws_secret: ${aws_secret}
+          bucket: mciuploads
           content_type: application/json
-          display_name: Augmented SBOM (Diff)
+          local_file: mongo-cxx-driver/etc/augmented.sbom.json.new
+          permissions: public-read
+          remote_file: mongo-cxx-driver/${build_variant}/${revision}/${version_id}/${build_id}/silk/augmented.sbom.json
 
 #######################################
 #              Post Task              #
@@ -1262,13 +1349,21 @@ tasks:
             BSONCXX_POLYFILL: std
         - func: "upload scan artifacts"
 
+    - name: silk-upload-sbom-lite
+      run_on: rhel80-small
+      tags: [silk, rhel80]
+      commands:
+        - func: setup
+        - func: upload sbom lite
+
     - name: silk-check-augmented-sbom
-      run_on: rhel8-latest-small
-      tags: [silk]
+      run_on: rhel80-small
+      tags: [silk, rhel80]
+      depends_on: [{ name: silk-upload-sbom-lite }]
       commands:
-        - func: "setup"
-        - func: "check augmented sbom"
-        - func: "upload augmented sbom"
+        - func: setup
+        - func: check augmented sbom
+        - func: upload augmented sbom
 
 task_groups:
   - name: tg-abi-stability

CHANGELOG.md

@@ -40,12 +40,12 @@ Changes prior to 3.9.0 are documented as [release notes on GitHub](https://githu
 
 ### Deprecated
 
-- Support for MongoDB Server 3.6. See [MongoDB Software Lifecycle Schedules](https://www.mongodb.com/legal/support-policy/lifecycles).
 - The `bsoncxx/util/functor.hpp` header.
 - The `bsoncxx::util` namespace.
 
 ### Removed
 
+- Support for MongoDB Server 3.6. See [MongoDB Software Lifecycle Schedules](https://www.mongodb.com/legal/support-policy/lifecycles).
 - Export of private member functions in the bsoncxx ABI:
   - `bsoncxx::v_noabi::types::bson_value::value::value(const uint8_t*, uint32_t, uint32_t, uint32_t)`
   - `bsoncxx::v_noabi::types::bson_value::view::_init(void*)`