Update libmongocrypt URLs for 1.18.0+

XMLWordPrintableJSON

    • Type: Spec Change
    • Resolution: Done
    • Priority: Unknown
    • None
    • Affects Version/s: None
    • Component/s: Client Side Encryption
    • None
    • Hide

      DRIVERS-3441:
      libmongocrypt 1.18.0 adds signed tarballs to the GitHub release. Previously tarballs were only available on S3 URLs. These tarballs are smaller (only library and headers), include  signatures, and have self-descriptive names.

      Which drivers package libmongocrypt? notes C#, Java, Node, and Python have scripts referring to libmongocrypt binaries. Other drivers may not need any changes.

      Summary of necessary driver changes

      • Update release scripts to use libmongocrypt tarballs attached to GitHub releases.
      • Verify signature of downloaded libmongocrypt tarballs.
        • Example: 
          set -o errexit

# Download libmongocrypt tarball:
curl -LO https://github.com/mongodb/libmongocrypt/releases/download/1.18.0/libmongocrypt-windows-x86_64-1.18.0.tar.gz
curl -LO https://github.com/mongodb/libmongocrypt/releases/download/1.18.0/libmongocrypt-windows-x86_64-1.18.0.asc

# Download the public key, import it, and verify the signature
curl -LO https://pgp.mongodb.com/libmongocrypt.pub
gpg --import libmongocrypt.pub
gpg --verify libmongocrypt-windows-x86_64-1.18.0.asc libmongocrypt-windows-x86_64-1.18.0.tar.gz

      Notes
      The following maps from the previous previous build variant names to the new tarball names:

      • macos => macos-universal
      • alpine-arm64-earthly => linux-arm64-musl_1_2-nocrypto
      • windows-test => windows-x86_64
      • ubuntu1604-arm64 => linux-arm64-glibc_2_17-nocrypto
      • ubuntu1804-arm64 => linux-arm64-glibc_2_17-nocrypto
      • ubuntu1804-64 => linux-x86_64-glibc_2_7-nocrypto
      • rhel-62-64-bit => linux-x86_64-glibc_2_7-nocrypto
      • rhel72-zseries-test => linux-s390x-glibc_2_7-nocrypto
      • rhel-71-ppc64el => linux-ppc64le-glibc_2_17-nocrypto
      • rhel-70-64-bit => linux-x86_64-glibc_2_7-nocrypto
      • rhel82-arm64-small => linux-arm64-glibc_2_17-nocrypto

      Changelog

      • 2026-05-18: Recommend upgrading to 1.18.1 or higher to include the fix for DRIVERS-3470.
      • 2026-05-11: musl (Alpine) arm64 builds added in 1.18.2.
      Show
      DRIVERS-3441 : libmongocrypt 1.18.0 adds signed tarballs to the GitHub release. Previously tarballs were only available on S3 URLs. These tarballs are smaller (only library and headers), include  signatures, and have self-descriptive names. Which drivers package libmongocrypt? notes C#, Java, Node, and Python have scripts referring to libmongocrypt binaries. Other drivers may not need any changes. Summary of necessary driver changes Update release scripts to use libmongocrypt tarballs attached to GitHub releases. Verify signature of downloaded libmongocrypt tarballs. Example: set -o errexit # Download libmongocrypt tarball: curl -LO https://github.com/mongodb/libmongocrypt/releases/download/1.18.0/libmongocrypt-windows-x86_64-1.18.0.tar.gz curl -LO https://github.com/mongodb/libmongocrypt/releases/download/1.18.0/libmongocrypt-windows-x86_64-1.18.0.asc # Download the public key, import it, and verify the signature curl -LO https://pgp.mongodb.com/libmongocrypt.pub gpg --import libmongocrypt.pub gpg --verify libmongocrypt-windows-x86_64-1.18.0.asc libmongocrypt-windows-x86_64-1.18.0.tar.gz Remove documented references to direct libmongocrypt S3 links. Refer users to the mongodb.com install steps to download packages. If needed, refer users to the GitHub release page ( https://github.com/mongodb/libmongocrypt/releases ) to download pre-built binaries. Notes The following maps from the previous previous build variant names to the new tarball names: macos => macos-universal alpine-arm64-earthly => linux-arm64-musl_1_2-nocrypto windows-test => windows-x86_64 ubuntu1604-arm64 => linux-arm64-glibc_2_17-nocrypto ubuntu1804-arm64 => linux-arm64-glibc_2_17-nocrypto ubuntu1804-64 => linux-x86_64-glibc_2_7-nocrypto rhel-62-64-bit => linux-x86_64-glibc_2_7-nocrypto rhel72-zseries-test => linux-s390x-glibc_2_7-nocrypto rhel-71-ppc64el => linux-ppc64le-glibc_2_17-nocrypto rhel-70-64-bit => linux-x86_64-glibc_2_7-nocrypto rhel82-arm64-small => linux-arm64-glibc_2_17-nocrypto Changelog 2026-05-18: Recommend upgrading to 1.18.1 or higher to include the fix for DRIVERS-3470 . 2026-05-11: musl (Alpine) arm64 builds added in 1.18.2.
    • None
    • Hide

      1. What would you like to communicate to the user about this feature?
      2. Would you like the user to see examples of the syntax and/or executable code and its output?
      3. Which versions of the driver/connector does this apply to?

      Show
      1. What would you like to communicate to the user about this feature? 2. Would you like the user to see examples of the syntax and/or executable code and its output? 3. Which versions of the driver/connector does this apply to?
    • None
    • None
    • None
    • None
    • None
    • None

      This ticket was split from DRIVERS-3441, please see that ticket for a detailed description.

      Definition of Done

      The Go driver already uses tarball's from the GitHub release branch for the windows build variant. We should continue building from source for supported platforms (linux, macOS), or push back on the closure of MONGOCRYPT-932 to build tarballs with package files. Therefore, this ticket only requires gpg signing for the windows build variant.

            Assignee:
            Preston Vasquez
            Reporter:
            TPM Jira Automations Bot
            Matt Dale
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: