Download -latest crypt_shared/cryptd artifacts from the private S3 location

ExportXMLWordPrintableJSON

    • Type: Task
    • Resolution: Fixed
    • Priority: Major - P3
    • vNext
    • Affects Version/s: None
    • Component/s: None
    • None
    • Not Needed
    • Developer Tools

      Context

      As part of MONGOSH-3619 / DEVPROD-41867, -latest MongoDB server binaries moved from public downloads.mongodb.

      {org,com}

      to the private S3 bucket s3://origin-mongodb-server-latest, prefixed by Evergreen project (e.g. .../server-latest/mongodb-mongo-master-nightly/).

      mongosh already consumes the -latest server binary from S3: mongodb-download-url >= 2.0.1 (via @mongodb-js/mongodb-downloader 3.0.1) resolves latest-alpha to the private S3 path, and CI assumes the access-to-private-atlas-artifacts role. Verified on the tests_linux-mlatest_n24 variant.

      The crypt_shared and cryptd -latest artifacts are now also published to the same private location (SERVER-134247 / BACKPORT-29642, "save latest cryptd artifacts as well in addition to server latest artifacts") with version-independent filenames.

      Problem

      mongodb-download-url 2.0.1's latest-alpha branch only sets the server archive URL; it does not populate crypt_shared/cryptd. Requesting crypt_shared for latest-alpha therefore throws "No crypt_shared library download for version undefined available". As a result mongosh cannot yet pull the -latest crypt artifacts from S3 (it still uses the pinned 9.0.0-rc4 crypt library from the public cloud.json feed).

      Work

      1. Extend mongodb-download-url's latest-alpha branch to resolve crypt_shared/cryptd to the private S3 paths (mirror the server LATEST_ALPHA_S3_PREFIX handling), publish, and bump the dep in mongosh.
        • Fallback if we don't want to change mongodb-download-url: construct the S3 crypt URL directly in packages/build/src/packaging/download-crypt-library.ts for the latest case.
      2. Make sure the crypt download authenticates against the private bucket (the downloader's S3 client uses the default AWS credential chain; CI already persists the assumed-role creds via .evergreen/persist-assumed-role-credentials.sh).
      3. Use the -latest crypt library where relevant (packaging + tests against the alpha server) and drop the pinned 9.0.0-rc4 override.
      4. Validate in Evergreen on the mlatest variant that the crypt artifact downloads from s3://origin-mongodb-server-latest.

            Assignee:
            Kevin Mas Ruiz
            Reporter:
            Kevin Mas Ruiz
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: