SERVER-107852 SBOM rebuild to v8.1 (#39748)

GitOrigin-RevId: 408d4a18c1a37ca9f4e05c7521d641eca4fcbec7

.prettierignore

@@ -36,6 +36,9 @@ version_expansions.yml
 # Ignore all formatting in third_party/*
 src/third_party
 
+# this file is automatically generated and conforms to formatting requirements
+README.third_party.md
+
 # Ignore anything in the build output directories
 build
 bazel-*

BUILD.bazel

@@ -18,7 +18,6 @@ exports_files([
     ".prettierrc",
     "pyproject.toml",
     "poetry.lock",
-    "symbols.orderfile",
     "codeowners-validator",
 ])
 

README.md

@@ -1,6 +1,6 @@
 # ![Logo](docs/leaf.svg) MongoDB README
 
-Welcome to MongoDB!
+Welcome to MongoDB 8.1!
 
 ## Components
 

README.third_party.md

@@ -21,131 +21,140 @@ not authored by MongoDB, and has a license which requires reproduction,
 a notice will be included in
 `THIRD-PARTY-NOTICES`.
 
-| Name                                                 | License                                                                                             | Vendored Version                         | Emits persisted data | Distributed in Release Binaries |
-| ---------------------------------------------------- | --------------------------------------------------------------------------------------------------- | ---------------------------------------- | -------------------- | ------------------------------- |
-| [Abseil]                                             | Apache-2.0                                                                                          | 20230802.1                               |                      | ✗                               |
-| [arximboldi/immer]                                   | BSL-1.0                                                                                             | Unknown                                  |                      | ✗                               |
-| [Asio C++ Library]                                   | BSL-1.0                                                                                             | 1.12.2                                   |                      | ✗                               |
-| [aws-sdk - the AWS SDK client library]               | Apache-2.0                                                                                          | 1.11.471                                 |                      | ✗                               |
-| [benchmark]                                          | Apache-2.0                                                                                          | v1.5.2                                   |                      |                                 |
-| [Boost C++ Libraries - boost]                        | BSL-1.0                                                                                             | 1.79.0                                   |                      | ✗                               |
-| [c-ares]                                             | MIT                                                                                                 | 1.27.0                                   |                      | ✗                               |
-| [concurrencytest]                                    | GPL-3.0-or-later                                                                                    | 0.1.2                                    | unknown              |                                 |
-| [Cyrus SASL]                                         | BSD-Attribution-HPND-disclaimer                                                                     | 2.1.28                                   | unknown              |                                 |
-| [dcleblanc/SafeInt]                                  | MIT                                                                                                 | 3.0.26                                   |                      | ✗                               |
-| [derickr/timelib]                                    | MIT                                                                                                 | 2022.13                                  |                      | ✗                               |
-| [discover]                                           | BSD-3-Clause                                                                                        | 0.4.0                                    | unknown              |                                 |
-| [fmtlib/fmt]                                         | MIT                                                                                                 | 11.1.3                                   |                      | ✗                               |
-| [google-re2]                                         | BSD-3-Clause                                                                                        | 2023-11-01                               |                      | ✗                               |
-| [google-snappy]                                      | BSD-3-Clause                                                                                        | 1.1.10                                   | ✗                    | ✗                               |
-| [google/s2geometry]                                  | Apache-2.0                                                                                          | Unknown                                  | ✗                    | ✗                               |
-| [gperftools]                                         | BSD-3-Clause                                                                                        | 2.9.1                                    |                      | ✗                               |
-| [grpc]                                               | Apache-2.0                                                                                          | 1.59.5                                   |                      | ✗                               |
-| [ICU for C/C++ (ICU4C)]                              | BSD-3-Clause, MIT v2 with Ad Clause License, Public Domain, BSD-2-Clause                            | 57.1                                     | ✗                    | ✗                               |
-| [Intel Decimal Floating-Point Math Library]          | BSD-3-Clause                                                                                        | v2.0 U1                                  |                      | ✗                               |
-| [jbeder/yaml-cpp]                                    | MIT                                                                                                 | 0.6.3                                    |                      | ✗                               |
-| [JSON-Schema-Test-Suite]                             | Unknown License                                                                                     | Unknown                                  |                      |                                 |
-| [libmongocrypt]                                      | Apache-2.0                                                                                          | 1.12.0                                   | ✗                    | ✗                               |
-| [librdkafka - the Apache Kafka C/C++ client library] | BSD-3-Clause, Xmlproc License, ISC, MIT, Public Domain, Zlib, BSD-2-Clause, Andreas Stolcke License | 2.0.2                                    |                      | ✗                               |
-| [LibTomCrypt]                                        | WTFPL, Public Domain                                                                                | 1.18.2                                   | ✗                    | ✗                               |
-| [libunwind/libunwind]                                | MIT                                                                                                 | v1.8.1                                   |                      | ✗                               |
-| [linenoise]                                          | BSD-2-Clause                                                                                        | Unknown                                  |                      | ✗                               |
-| [MongoDB C Driver]                                   | Apache-2.0                                                                                          | 1.27.6                                   | ✗                    | ✗                               |
-| [Mozilla Firefox]                                    | MPL-2.0                                                                                             | 115.19.0esr                              | unknown              | ✗                               |
-| [nlohmann.json.decomposed]                           | MIT                                                                                                 | 3.10.5                                   | unknown              |                                 |
-| [node]                                               | ISC                                                                                                 | 22.1.0                                   | unknown              |                                 |
-| [ocspbuilder]                                        | MIT                                                                                                 | 0.10.2                                   |                      |                                 |
-| [ocspresponder]                                      | Apache-2.0                                                                                          | 0.5.0                                    |                      |                                 |
-| [opentelemetry-cpp]                                  | Apache-2.0                                                                                          | 1.17                                     | ✗                    |                                 |
-| [opentelemetry-proto]                                | Apache-2.0                                                                                          | 1.3.2                                    | ✗                    |                                 |
-| [PCRE2]                                              | BSD-3-Clause, Public Domain                                                                         | 10.40                                    |                      | ✗                               |
-| [Protobuf]                                           | BSD-3-Clause                                                                                        | v4.25.0                                  |                      | ✗                               |
-| [pyiso8601]                                          | MIT                                                                                                 | 2.1.0                                    | unknown              |                                 |
-| [RoaringBitmap/CRoaring]                             | Unknown License                                                                                     | v3.0.1                                   |                      | ✗                               |
-| [SchemaStore/schemastore]                            | Apache-2.0                                                                                          | Unknown                                  |                      |                                 |
-| [SCons - a Software Construction tool]               | MIT                                                                                                 | 3.1.2                                    |                      | ✗                               |
-| [smhasher]                                           | Unknown License                                                                                     | Unknown                                  | unknown              | ✗                               |
-| [Snowball Stemming Algorithms]                       | BSD-3-Clause                                                                                        | 7b264ffa0f767c579d052fd8142558dc8264d795 | ✗                    | ✗                               |
-| [subunit]                                            | BSD-3-Clause, Apache-2.0                                                                            | 1.4.4                                    | unknown              |                                 |
-| [tcmalloc]                                           | Apache-2.0                                                                                          | 20230227-snapshot-093ba93c               |                      | ✗                               |
-| [testing-cabal/extras]                               | MIT                                                                                                 | 0.0.3                                    | unknown              |                                 |
-| [testscenarios]                                      | BSD-3-Clause, Apache-2.0                                                                            | 0.4                                      | unknown              |                                 |
-| [testtools]                                          | MIT                                                                                                 | 2.7.1                                    | unknown              |                                 |
-| [unicode-data]                                       | Unicode-DFS-2016                                                                                    | 8.0                                      | ✗                    | ✗                               |
-| [valgrind]                                           | GPL-2.0-or-later                                                                                    | Unknown                                  |                      | ✗                               |
-| [zlib]                                               | Zlib                                                                                                | v1.3.1                                   | ✗                    | ✗                               |
-| [zstd]                                               | BSD-3-Clause, GPL-2.0-or-later                                                                      | 1.5.5                                    | ✗                    | ✗                               |
+| Name                                                 | License                           | Vendored Version                         | Emits persisted data | Distributed in Release Binaries |
+| ---------------------------------------------------- | --------------------------------- | ---------------------------------------- | -------------------- | ------------------------------- |
+| [Abseil Common Libraries (C++)]                      | Apache-2.0                        | 20230802.1                               |                      | ✗                               |
+| [Asio C++ Library]                                   | BSL-1.0                           | 1.12.2                                   |                      | ✗                               |
+| [AWS SDK for C++]                                    | Apache-2.0                        | 1.11.471                                 |                      | ✗                               |
+| [benchmark]                                          | Apache-2.0                        | v1.5.2                                   |                      |                                 |
+| [Boost C++ Libraries]                                | BSL-1.0                           | 1.79.0                                   |                      | ✗                               |
+| [c-ares]                                             | MIT                               | 1.27.0                                   |                      | ✗                               |
+| [CRoaring]                                           | Apache-2.0 OR MIT                 | 3.0.1                                    |                      | ✗                               |
+| [Cyrus SASL]                                         | BSD-Attribution-HPND-disclaimer   | 2.1.28                                   |                      |                                 |
+| [fmt]                                                | MIT                               | 11.1.3                                   |                      | ✗                               |
+| [folly]                                              | Apache-2.0                        | v2025.04.21.00                           |                      | ✗                               |
+| [gperftools]                                         | BSD-3-Clause                      | 2.9.1                                    |                      | ✗                               |
+| [gRPC (C++)]                                         | Apache-2.0                        | 1.59.5                                   |                      | ✗                               |
+| [immer]                                              | BSL-1.0                           | 0.8.0                                    |                      | ✗                               |
+| [Intel® Decimal Floating-Point Math Library]         | BSD-3-Clause                      | v2.0U1                                   |                      | ✗                               |
+| [International Components for Unicode C/C++ (ICU4C)] | Unicode-3.0                       | 57.1                                     | ✗                    | ✗                               |
+| [JSON Schema Store]                                  | Apache-2.0                        | 6847cfc3a17a04a7664474212db50c627e1e3408 |                      |                                 |
+| [JSON-Schema-Test-Suite]                             | MIT                               | 728066f9c5c258ba3b1804a22a5b998f2ec77ec0 |                      |                                 |
+| [libmongocrypt]                                      | Apache-2.0                        | 1.12.0                                   | ✗                    | ✗                               |
+| [librdkafka - The Apache Kafka C/C++ library]        | BSD-2-Clause                      | 2.0.2                                    |                      | ✗                               |
+| [LibTomCrypt]                                        | Unlicense                         | 1.18.2                                   | ✗                    | ✗                               |
+| [libunwind]                                          | MIT                               | v1.8.1                                   |                      | ✗                               |
+| [linenoise]                                          | BSD-2-Clause                      | 6cdc775807e57b2c3fd64bd207814f8ee1fe35f3 |                      | ✗                               |
+| [MongoDB C Driver]                                   | Apache-2.0                        | 1.27.6                                   | ✗                    | ✗                               |
+| [Mozilla Firefox ESR]                                | MPL-2.0                           | 128.11.0esr                              |                      | ✗                               |
+| [MurmurHash3]                                        | Public Domain                     | a6bd3ce7be8ad147ea820a7cf6229a975c0c96bb |                      | ✗                               |
+| [nlohmann/json]                                      | MIT                               | 3.10.5                                   |                      |                                 |
+| [nlohmann/json]                                      | MIT                               | 3.11.3                                   | ✗                    |                                 |
+| [node]                                               | ISC                               | 22.1.0                                   |                      |                                 |
+| [opentelemetry-cpp]                                  | Apache-2.0                        | 1.17                                     | ✗                    |                                 |
+| [opentelemetry-proto]                                | Apache-2.0                        | 1.3.2                                    | ✗                    |                                 |
+| [PCRE2 - Perl-Compatible Regular Expressions]        | BSD-3-Clause WITH PCRE2-exception | 10.40                                    |                      | ✗                               |
+| [Protobuf]                                           | BSD-3-Clause                      | v4.25.0                                  |                      | ✗                               |
+| [pypi/asn1crypto]                                    | MIT                               | 1.5.1                                    |                      |                                 |
+| [pypi/concurrencytest]                               | GPL-3.0-or-later                  | 0.1.2                                    |                      |                                 |
+| [pypi/discover]                                      | BSD-3-Clause                      | 0.4.0                                    |                      |                                 |
+| [pypi/extras]                                        | MIT                               | 0.0.3                                    |                      |                                 |
+| [pypi/iso8601]                                       | MIT                               | 2.1.0                                    |                      |                                 |
+| [pypi/ocspbuilder]                                   | MIT                               | 0.10.2                                   |                      |                                 |
+| [pypi/ocspresponder]                                 | Apache-2.0                        | 0.5.0                                    |                      |                                 |
+| [pypi/oscrypto]                                      | MIT                               | 1.3.0                                    |                      |                                 |
+| [pypi/python-subunit]                                | (Apache-2.0 OR BSD-3-Clause)      | 1.4.4                                    |                      |                                 |
+| [pypi/testscenarios]                                 | BSD-3-Clause                      | 0.4                                      |                      |                                 |
+| [pypi/testtools]                                     | MIT                               | 2.7.1                                    |                      |                                 |
+| [re2]                                                | BSD-3-Clause                      | 2023-11-01                               |                      | ✗                               |
+| [S2 Geometry Library]                                | Apache-2.0                        | c872048da5d1                             | ✗                    | ✗                               |
+| [SafeInt]                                            | MIT                               | 3.0.26                                   |                      | ✗                               |
+| [SCons - a Software Construction tool]               | MIT                               | 3.1.2                                    |                      |                                 |
+| [snappy]                                             | BSD-3-Clause                      | 1.1.10                                   | ✗                    | ✗                               |
+| [Snowball Stemming Algorithms (libstemmer)]          | BSD-3-Clause                      | 7b264ffa0f767c579d052fd8142558dc8264d795 | ✗                    | ✗                               |
+| [tcmalloc]                                           | Apache-2.0                        | 093ba93c1bd6dca03b0a8334f06d01b019244291 |                      | ✗                               |
+| [timelib]                                            | MIT                               | 2022.13                                  |                      | ✗                               |
+| [Unicode Character Database]                         | Unicode-DFS-2016                  | 8.0.0                                    | ✗                    | ✗                               |
+| [valgrind.h]                                         | BSD-4-Clause                      | 3.17.0                                   |                      | ✗                               |
+| [WiredTiger]                                         | GPL-2.0-only OR GPL-3.0-only      | mongodb-8.1                              | ✗                    | ✗                               |
+| [yaml-cpp]                                           | MIT                               | 0.6.3                                    |                      | ✗                               |
+| [zlib]                                               | Zlib                              | 1.3.1                                    | ✗                    | ✗                               |
+| [Zstandard (zstd)]                                   | BSD-3-Clause OR GPL-2.0-only      | 1.5.5                                    | ✗                    | ✗                               |
 
-[Abseil]: https://github.com/abseil/abseil-cpp
+[AWS SDK for C++]: https://github.com/aws/aws-sdk-cpp
+[Abseil Common Libraries (C++)]: https://github.com/abseil/abseil-cpp
 [Asio C++ Library]: https://github.com/chriskohlhoff/asio
-[Boost C++ Libraries - boost]: http://www.boost.org/
+[Boost C++ Libraries]: http://www.boost.org/
+[CRoaring]: https://github.com/RoaringBitmap/CRoaring
 [Cyrus SASL]: https://www.cyrusimap.org/sasl/
-[ICU for C/C++ (ICU4C)]: http://site.icu-project.org/download/
-[Intel Decimal Floating-Point Math Library]: https://software.intel.com/en-us/articles/intel-decimal-floating-point-math-library
+[Intel® Decimal Floating-Point Math Library]: https://software.intel.com/en-us/articles/intel-decimal-floating-point-math-library
+[International Components for Unicode C/C++ (ICU4C)]: http://site.icu-project.org/download/
+[JSON Schema Store]: https://www.schemastore.org/json/
 [JSON-Schema-Test-Suite]: https://github.com/json-schema-org/JSON-Schema-Test-Suite
 [LibTomCrypt]: https://github.com/libtom/libtomcrypt/releases
 [MongoDB C Driver]: https://github.com/mongodb/mongo-c-driver
-[Mozilla Firefox]: https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr
-[PCRE2]: http://www.pcre.org/
+[Mozilla Firefox ESR]: https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr
+[MurmurHash3]: https://github.com/aappleby/smhasher/blob/a6bd3ce/
+[PCRE2 - Perl-Compatible Regular Expressions]: http://www.pcre.org/
 [Protobuf]: https://github.com/protocolbuffers/protobuf
-[RoaringBitmap/CRoaring]: https://github.com/RoaringBitmap/CRoaring
+[S2 Geometry Library]: https://github.com/google/s2geometry
 [SCons - a Software Construction tool]: https://github.com/SCons/scons
-[SchemaStore/schemastore]: https://www.schemastore.org/json/
-[Snowball Stemming Algorithms]: https://github.com/snowballstem/snowball
-[arximboldi/immer]: https://github.com/arximboldi/immer
-[aws-sdk - the AWS SDK client library]: https://github.com/aws/aws-sdk-cpp
+[SafeInt]: https://github.com/dcleblanc/SafeInt
+[Snowball Stemming Algorithms (libstemmer)]: https://github.com/snowballstem/snowball
+[Unicode Character Database]: http://www.unicode.org/versions/enumeratedversions.html
+[WiredTiger]: https://source.wiredtiger.com/
+[Zstandard (zstd)]: https://github.com/facebook/zstd
 [benchmark]: https://github.com/google/benchmark
 [c-ares]: https://c-ares.org/
-[concurrencytest]: https://pypi.org/project/concurrencytest/
-[dcleblanc/SafeInt]: https://github.com/dcleblanc/SafeInt
-[derickr/timelib]: https://github.com/derickr/timelib
-[discover]: https://pypi.org/project/discover/
-[fmtlib/fmt]: http://fmtlib.net/
-[google-re2]: https://github.com/google/re2
-[google-snappy]: https://github.com/google/snappy/releases
-[google/s2geometry]: https://github.com/google/s2geometry
+[fmt]: http://fmtlib.net/
+[folly]: https://github.com/facebook/folly
+[gRPC (C++)]: https://github.com/grpc/grpc
 [gperftools]: https://github.com/gperftools/gperftools
-[grpc]: https://github.com/grpc/grpc
-[jbeder/yaml-cpp]: https://github.com/jbeder/yaml-cpp/releases
+[immer]: https://github.com/arximboldi/immer
 [libmongocrypt]: https://github.com/mongodb/libmongocrypt
-[librdkafka - the Apache Kafka C/C++ client library]: https://github.com/confluentinc/librdkafka
-[libunwind/libunwind]: http://www.github.com/libunwind/libunwind
+[librdkafka - The Apache Kafka C/C++ library]: https://github.com/confluentinc/librdkafka
+[libunwind]: http://www.github.com/libunwind/libunwind
 [linenoise]: https://github.com/antirez/linenoise
-[nlohmann-json]: https://github.com/open-telemetry/opentelemetry-proto
-[nlohmann.json.decomposed]: https://www.nuget.org/packages/nlohmann.json.decomposed
+[nlohmann/json]: https://github.com/nlohmann/json
+[nlohmann/json]: https://github.com/open-telemetry/opentelemetry-proto
 [node]: https://nodejs.org/en/blog/release
-[ocspbuilder]: https://github.com/wbond/ocspbuilder
-[ocspresponder]: https://github.com/threema-ch/ocspresponder
 [opentelemetry-cpp]: https://github.com/open-telemetry/opentelemetry-cpp/
 [opentelemetry-proto]: https://github.com/open-telemetry/opentelemetry-proto
-[pyiso8601]: https://pypi.org/project/iso8601/
-[smhasher]: https://github.com/aappleby/smhasher/blob/a6bd3ce/
-[subunit]: https://github.com/testing-cabal/subunit
+[pypi/asn1crypto]: https://github.com/wbond/asn1crypto
+[pypi/concurrencytest]: https://pypi.org/project/concurrencytest/
+[pypi/discover]: https://pypi.org/project/discover/
+[pypi/extras]: https://github.com/testing-cabal/extras
+[pypi/iso8601]: https://pypi.org/project/iso8601/
+[pypi/ocspbuilder]: https://github.com/wbond/ocspbuilder
+[pypi/ocspresponder]: https://github.com/threema-ch/ocspresponder
+[pypi/oscrypto]: https://github.com/wbond/oscrypto
+[pypi/python-subunit]: https://github.com/testing-cabal/subunit
+[pypi/testscenarios]: https://pypi.org/project/testscenarios/
+[pypi/testtools]: https://github.com/testing-cabal/testtools
+[re2]: https://github.com/google/re2
+[snappy]: https://github.com/google/snappy/releases
 [tcmalloc]: https://github.com/google/tcmalloc
-[testing-cabal/extras]: https://github.com/testing-cabal/extras
-[testscenarios]: https://pypi.org/project/testscenarios/
-[testtools]: https://github.com/testing-cabal/testtools
-[unicode-data]: http://www.unicode.org/versions/enumeratedversions.html
-[valgrind]: http://valgrind.org/downloads/current.html
+[timelib]: https://github.com/derickr/timelib
+[valgrind.h]: http://valgrind.org/downloads/current.html
+[yaml-cpp]: https://github.com/jbeder/yaml-cpp/releases
 [zlib]: https://zlib.net/
-[zstd]: https://github.com/facebook/zstd
 
 ## WiredTiger Vendored Test Libraries
 
-The following Python libraries are transitively included by WiredTiger,
+The following libraries are transitively included by WiredTiger,
 and are used by that component for testing. They don't appear in
 released binary artifacts.
 
-| Name                     |
-| ------------------------ |
-| concurrencytest          |
-| discover                 |
-| nlohmann.json.decomposed |
-| pyiso8601                |
-| subunit                  |
-| testing-cabal/extras     |
-| testscenarios            |
-| testtools                |
+| Name                       |
+| -------------------------- |
+| nlohmann/json@3.10.5       |
+| pypi/concurrencytest@0.1.2 |
+| pypi/discover@0.4.0        |
+| pypi/extras@0.0.3          |
+| pypi/iso8601@2.1.0         |
+| pypi/python-subunit@1.4.4  |
+| pypi/testscenarios@0.4     |
+| pypi/testtools@2.7.1       |
 
 ## Dynamically Linked Libraries
 

SConstruct

@@ -4777,7 +4777,7 @@ def doConfigure(myenv):
                 myenv.AppendUnique(
                     CCFLAGS=["-ffunction-sections"],
                     LINKFLAGS=[
-                        "-Wl,--symbol-ordering-file=symbols.orderfile",
+                        "-Wl,--symbol-ordering-file=buildscripts/symbols.orderfile",
                         "-Wl,--no-warn-symbol-ordering",
                     ],
                 )

bazel/BUILD.bazel

@@ -9,6 +9,5 @@ exports_files([
 sh_binary(
     name = "lint",
     srcs = ["lint.sh"],
-    args = ["//..."],
     visibility = ["//visibility:public"],
 )

bazel/config/BUILD.bazel

@@ -2364,12 +2364,40 @@ selects.config_setting_group(
 # symbol reordering options
 # --------------------------------------
 
+selects.config_setting_group(
+    name = "symbol_ordering_file_enabled_al2023",
+    match_all = [
+        "@platforms//os:linux",
+        "//bazel/platforms:amazon_linux_2023",
+        ":opt_any",
+        ":linker_lld",
+    ],
+)
+
+selects.config_setting_group(
+    name = "not_amazon_linux_2023",
+    match_any = [
+        "//bazel/platforms:ubuntu18",
+        "//bazel/platforms:ubuntu20",
+        "//bazel/platforms:ubuntu22",
+        "//bazel/platforms:ubuntu24",
+        "//bazel/platforms:amazon_linux_2",
+        "//bazel/platforms:debian10",
+        "//bazel/platforms:debian12",
+        "//bazel/platforms:rhel8",
+        "//bazel/platforms:rhel9",
+        "//bazel/platforms:suse12",
+        "//bazel/platforms:suse15",
+    ],
+)
+
 selects.config_setting_group(
     name = "symbol_ordering_file_enabled",
     match_all = [
         "@platforms//os:linux",
         ":opt_any",
         ":linker_lld",
+        "//bazel/config:not_amazon_linux_2023",
     ],
 )
 

bazel/coverity/coverity_toolchain.bzl

@@ -1,12 +1,15 @@
 def _coverity_toolchain(ctx):
-    result = ctx.execute([
-        "ls",
-        "/data/cov-sa/bin/cov-build",
-    ])
+    retCode = 1
+    if "COVERITY_INSTALL_ROOT" in ctx.os.environ:
+        result = ctx.execute([
+            "ls",
+            ctx.getenv("COVERITY_INSTALL_ROOT") + "/bin/cov-build",
+        ])
+        retCode = result.return_code
 
-    if result.return_code == 0:
+    if retCode == 0:
         ctx.report_progress("extracting coverity rules...")
-        result = ctx.download_and_extract("file:///data/cov-sa/bazel/rules_coverity.tar.gz")
+        result = ctx.download_and_extract("file://" + ctx.getenv("COVERITY_INSTALL_ROOT") + "/bazel/rules_coverity.tar.gz")
     else:
         ctx.template(
             "coverity/BUILD.bazel",

bazel/lint.sh

@@ -1,2 +1,8 @@
 # placeholder for bazel/wrapper_hook/lint.py
-echo "No linter errors found!"
+if [[ $1 == "ALL_PASSING" ]]; then
+  echo "No linter errors found!"
+  exit 0
+fi
+
+echo "Linter run failed, see details above"
+exit 1

bazel/mongo_src_rules.bzl

@@ -1358,12 +1358,17 @@ THIN_LTO_FLAGS = select({
 
 SYMBOL_ORDER_COPTS = select({
     "//bazel/config:symbol_ordering_file_enabled": ["-ffunction-sections"],
+    "//bazel/config:symbol_ordering_file_enabled_al2023": ["-ffunction-sections"],
     "//conditions:default": [],
 })
 
 SYMBOL_ORDER_LINKFLAGS = select({
     "//bazel/config:symbol_ordering_file_enabled": [
-        "-Wl,--symbol-ordering-file=$(location //:symbols.orderfile)",
+        "-Wl,--symbol-ordering-file=$(location //buildscripts:symbols.orderfile)",
+        "-Wl,--no-warn-symbol-ordering",
+    ],
+    "//bazel/config:symbol_ordering_file_enabled_al2023": [
+        "-Wl,--symbol-ordering-file=$(location //buildscripts:symbols-al2023.orderfile)",
         "-Wl,--no-warn-symbol-ordering",
     ],
     "//conditions:default": [],
@@ -1385,7 +1390,8 @@ SHARED_ARCHIVE_LINKFLAGS = select({
 })
 
 SYMBOL_ORDER_FILES = [
-    "//:symbols.orderfile",
+    "//buildscripts:symbols.orderfile",
+    "//buildscripts:symbols-al2023.orderfile",
 ]
 
 # Passed to both the compiler and linker
@@ -1683,6 +1689,7 @@ def mongo_cc_library(
         no_undefined_ref_DO_NOT_USE = True,
         linkshared = False,
         skip_windows_crt_flags = False,
+        win_def_file = None,
         **kwargs):
     """Wrapper around cc_library.
 
@@ -1952,6 +1959,7 @@ def mongo_cc_library(
         }),
         additional_linker_inputs = additional_linker_inputs + MONGO_GLOBAL_ADDITIONAL_LINKER_INPUTS,
         exec_properties = exec_properties,
+        win_def_file = win_def_file,
     )
 
     shared_library = select({

bazel/wrapper_hook/lint.py

@@ -113,8 +113,6 @@ def list_files_without_targets(
         # TODO(SERVER-101361): Remove the exemptions below once resolved.
         "src/mongo/db/auth/authz_manager_external_state_local.cpp",
         "src/mongo/db/auth/authz_manager_external_state_s.cpp",
-        # TODO(SERVER-101362): Remove the exemptions below once resolved.
-        "src/mongo/db/exec/expression/evaluate_index_test.cpp",
         # TODO(SERVER-101364): Remove the exemptions below once resolved.
         "src/mongo/db/ftdc/ftdc_system_stats_freebsd.cpp",
         "src/mongo/db/ftdc/ftdc_system_stats_macOS.cpp",
@@ -197,25 +195,25 @@ def list_files_without_targets(
     return True
 
 
-def run_rules_lint(bazel_bin, args):
+def run_rules_lint(bazel_bin, args) -> bool:
     if platform.system() == "Windows":
         print("eslint not supported on windows")
-        sys.exit(1)
+        return False
 
     if "--fix" in args:
         create_build_files_in_new_js_dirs()
 
     files_with_targets = list_files_with_targets(bazel_bin)
     if not list_files_without_targets(files_with_targets, "C++", "cpp", ["src/mongo"]):
-        sys.exit(1)
+        return False
 
     if not list_files_without_targets(
         files_with_targets, "javascript", "js", ["src/mongo", "jstests"]
     ):
-        sys.exit(1)
+        return False
 
     if not check_for_missing_test_stubs():
-        exit(1)
+        return False
 
     # Default to linting everything if no path was passed in
     if len([arg for arg in args if not arg.startswith("--")]) == 0:
@@ -324,6 +322,7 @@ def run_rules_lint(bazel_bin, args):
                 )
             else:
                 print(f"ERROR: unknown fix type {fix}", file=sys.stderr)
-                sys.exit(1)
+                return False
     elif failing_reports != 0:
-        sys.exit(1)
+        return False
+    return True

bazel/wrapper_hook/plus_interface.py

@@ -97,7 +97,8 @@ def test_runner_interface(args, autocomplete_query, get_buildozer_output=get_bui
 
     if lint_target:
         command_start_index = args.index("lint") + 1
-        run_rules_lint(args[0], args[command_start_index:])
+        if run_rules_lint(args[0], args[command_start_index:]):
+            return ["run", "lint", "--", "ALL_PASSING"]
         return args[1:command_start_index]
 
     if skip_plus_interface and not autocomplete_query:

buildscripts/BUILD.bazel

@@ -4,6 +4,8 @@ load("@npm//:eslint/package_json.bzl", "bin")
 exports_files([
     "cheetah_source_generator.py",
     "clang_tidy_config_gen.py",
+    "symbols.orderfile",
+    "symbols-al2023.orderfile",
 ])
 
 py_binary(
@@ -254,6 +256,10 @@ py_binary(
             "jsonschema",
             group = "build-metrics",
         ),
+        dependency(
+            "license-expression",
+            group = "lint",
+        ),
     ],
 )
 

buildscripts/evergreen_resmoke_job_count.py

@@ -79,7 +79,6 @@ VARIANT_TASK_FACTOR_OVERRIDES = {
             "factor": 0.25,
         },
         {"task": "embedded_router_jscore_passthrough_with_config_shard", "factor": 0.25},
-        {"task": "embedded_router_sharded_collections_jscore_passthrough", "factor": 0.25},
         {"task": "fcv_upgrade_downgrade_sharded_collections_jscore_passthrough", "factor": 0.25},
         {"task": "fcv_upgrade_downgrade_sharding_jscore_passthrough", "factor": 0.25},
         {"task": "fle2_sharding", "factor": 0.25},

buildscripts/generate_version_expansions.py

@@ -61,8 +61,8 @@ def generate_version_expansions():
             raise ValueError("Unable to parse version from stdin and no version.json provided")
 
     if version_parts[0]:
-        expansions["suffix"] = "latest"
-        expansions["src_suffix"] = "latest"
+        expansions["suffix"] = "v8.1-latest"
+        expansions["src_suffix"] = "v8.1-latest"
         expansions["is_release"] = "false"
     else:
         expansions["suffix"] = version_line

buildscripts/idl/idl/binder.py

@@ -1650,7 +1650,7 @@ def _bind_feature_flags(ctxt, param):
             ctxt.add_feature_flag_default_true_missing_version(param)
             return None
 
-        ast_param.cpp_vartype = "::mongo::LegacyContextUnawareFCVGatedFeatureFlag"
+        ast_param.cpp_vartype = "::mongo::FCVGatedFeatureFlag"
         expr.expr = f'{param.default.literal}, "{param.version or ""}"_sd'
     else:
         # Feature flags that should not be FCV gated must not have a version

buildscripts/idl/tests/test_generator.py

@@ -1348,12 +1348,12 @@ class TestGenerator(testcase.IDLTestcase):
         )
         self.assertStringsInFile(
             header,
-            ["mongo::LegacyContextUnawareFCVGatedFeatureFlag gToaster;"],
+            ["mongo::FCVGatedFeatureFlag gToaster;"],
         )
         self.assertStringsInFile(
             source,
             [
-                'mongo::LegacyContextUnawareFCVGatedFeatureFlag gToaster{false, ""_sd};',
+                'mongo::FCVGatedFeatureFlag gToaster{false, ""_sd};',
                 '<FeatureFlagServerParameter>("featureFlagToaster", gToaster);',
             ],
         )
@@ -1375,12 +1375,12 @@ class TestGenerator(testcase.IDLTestcase):
         )
         self.assertStringsInFile(
             header,
-            ["mongo::LegacyContextUnawareFCVGatedFeatureFlag gToaster;"],
+            ["mongo::FCVGatedFeatureFlag gToaster;"],
         )
         self.assertStringsInFile(
             source,
             [
-                'mongo::LegacyContextUnawareFCVGatedFeatureFlag gToaster{true, "123"_sd};',
+                'mongo::FCVGatedFeatureFlag gToaster{true, "123"_sd};',
                 '<FeatureFlagServerParameter>("featureFlagToaster", gToaster);',
             ],
         )

buildscripts/resmokeconfig/matrix_suites/OWNERS.yml

@@ -1,3 +1,7 @@
 version: 1.0.0
 options:
   no_parent_owners: true
+filters:
+  - "generated_suites/sharding_task_executor_pool_size*":
+    approvers:
+      - 10gen/server-networking-and-observability

buildscripts/resmokeconfig/matrix_suites/generated_suites/aggregation_expression_multiversion_fuzzer_last_continuous.yml

@@ -16,6 +16,7 @@ executor:
           clusterType: standalone
           internalQueryAppendIdToSetWindowFieldsSort: true
           internalQueryMaxAllowedDensifyDocs: 1000
+          mongosBinVersion: last-continuous
           traceExceptions: false
           useRandomBinVersionsWithinReplicaSet: last-continuous
       nodb: ""

buildscripts/resmokeconfig/matrix_suites/generated_suites/aggregation_expression_multiversion_fuzzer_last_lts.yml

@@ -16,6 +16,7 @@ executor:
           clusterType: standalone
           internalQueryAppendIdToSetWindowFieldsSort: true
           internalQueryMaxAllowedDensifyDocs: 1000
+          mongosBinVersion: last-lts
           traceExceptions: false
           useRandomBinVersionsWithinReplicaSet: last-lts
       nodb: ""

buildscripts/resmokeconfig/matrix_suites/generated_suites/aggregation_multiversion_fuzzer_deterministic_last_continuous.yml

@@ -16,6 +16,7 @@ executor:
           clusterType: standalone
           internalQueryAppendIdToSetWindowFieldsSort: true
           internalQueryMaxAllowedDensifyDocs: 1000
+          mongosBinVersion: last-continuous
           traceExceptions: false
           useRandomBinVersionsWithinReplicaSet: last-continuous
       nodb: ""

buildscripts/resmokeconfig/matrix_suites/generated_suites/aggregation_multiversion_fuzzer_deterministic_last_lts.yml

@@ -16,6 +16,7 @@ executor:
           clusterType: standalone
           internalQueryAppendIdToSetWindowFieldsSort: true
           internalQueryMaxAllowedDensifyDocs: 1000
+          mongosBinVersion: last-lts
           traceExceptions: false
           useRandomBinVersionsWithinReplicaSet: last-lts
       nodb: ""

buildscripts/resmokeconfig/matrix_suites/generated_suites/aggregation_multiversion_fuzzer_last_continuous.yml

@@ -16,6 +16,7 @@ executor:
           clusterType: standalone
           internalQueryAppendIdToSetWindowFieldsSort: true
           internalQueryMaxAllowedDensifyDocs: 1000
+          mongosBinVersion: last-continuous
           traceExceptions: false
           useRandomBinVersionsWithinReplicaSet: last-continuous
       nodb: ""

buildscripts/resmokeconfig/matrix_suites/generated_suites/aggregation_multiversion_fuzzer_last_lts.yml

@@ -16,6 +16,7 @@ executor:
           clusterType: standalone
           internalQueryAppendIdToSetWindowFieldsSort: true
           internalQueryMaxAllowedDensifyDocs: 1000
+          mongosBinVersion: last-lts
           traceExceptions: false
           useRandomBinVersionsWithinReplicaSet: last-lts
       nodb: ""

buildscripts/resmokeconfig/matrix_suites/generated_suites/initial_sync_fuzzer_last_continuous.yml

@@ -20,6 +20,7 @@ executor:
               initialSync: 4
               rollback: 0
               verbosity: 3
+          mongosBinVersion: last-continuous
           setParameters:
             numInitialSyncAttempts: 10000000
           useRandomBinVersionsWithinReplicaSet: last-continuous

buildscripts/resmokeconfig/matrix_suites/generated_suites/initial_sync_fuzzer_last_lts.yml

@@ -20,6 +20,7 @@ executor:
               initialSync: 4
               rollback: 0
               verbosity: 3
+          mongosBinVersion: last-lts
           setParameters:
             numInitialSyncAttempts: 10000000
           useRandomBinVersionsWithinReplicaSet: last-lts

buildscripts/resmokeconfig/matrix_suites/generated_suites/replica_sets_last_continuous.yml

@@ -11,6 +11,7 @@ executor:
     shell_options:
       global_vars:
         TestData:
+          mongosBinVersion: last-continuous
           useRandomBinVersionsWithinReplicaSet: last-continuous
       nodb: ""
 matrix_suite: true

buildscripts/resmokeconfig/matrix_suites/generated_suites/replica_sets_last_lts.yml

@@ -11,6 +11,7 @@ executor:
     shell_options:
       global_vars:
         TestData:
+          mongosBinVersion: last-lts
           useRandomBinVersionsWithinReplicaSet: last-lts
       nodb: ""
 matrix_suite: true

buildscripts/resmokeconfig/matrix_suites/generated_suites/sharding_task_executor_pool_size_8.yml

@@ -0,0 +1,26 @@
+##########################################################
+# THIS IS A GENERATED FILE -- DO NOT MODIFY.
+# IF YOU WISH TO MODIFY THIS SUITE, MODIFY THE CORRESPONDING MATRIX SUITE MAPPING FILE
+# AND REGENERATE THE MATRIX SUITES.
+#
+# matrix suite mapping file: buildscripts/resmokeconfig/matrix_suites/mappings/sharding_task_executor_pool_size_8.yml
+# regenerate matrix suites: buildscripts/resmoke.py generate-matrix-suites && bazel run //:format
+##########################################################
+executor:
+  archive:
+    tests:
+      - jstests/sharding/*reshard*.js
+  config:
+    shell_options:
+      global_vars:
+        TestData:
+          setParametersMongos:
+            taskExecutorPoolSize: 8
+      nodb: ""
+matrix_suite: true
+selector:
+  exclude_files:
+    - jstests/sharding/**/libs/**/*.js
+  roots:
+    - jstests/sharding/**/*.js
+test_kind: js_test

buildscripts/resmokeconfig/matrix_suites/mappings/OWNERS.yml

@@ -49,6 +49,9 @@ filters:
   - "sharding_pqs*":
     approvers:
       - 10gen/query-execution-query-settings
+  - "sharding_task_executor_pool_size*":
+    approvers:
+      - 10gen/server-networking-and-observability
   - "update_fuzzer*":
     approvers:
       - 10gen/query-execution-write-exec

buildscripts/resmokeconfig/matrix_suites/mappings/sharding_task_executor_pool_size_8.yml

@@ -0,0 +1,3 @@
+base_suite: sharding
+overrides:
+  - "networking.task_executor_pool_size_8"

buildscripts/resmokeconfig/matrix_suites/overrides/OWNERS.yml

@@ -11,6 +11,9 @@ filters:
   - "multiplan_single_solutions.yml":
     approvers:
       - 10gen/query-optimization
+  - "networking.yml":
+    approvers:
+      - 10gen/server-networking-and-observability
   - "query_settings.yml":
     approvers:
       - 10gen/query-execution-query-settings

buildscripts/resmokeconfig/matrix_suites/overrides/multiversion.yml

@@ -161,6 +161,9 @@
           global_vars:
             TestData:
               useRandomBinVersionsWithinReplicaSet: "last-lts"
+              # Since a test in replica_sets could start up a sharded cluster, we
+              # need to set this variable so that the right version of mongos is chosen.
+              mongosBinVersion: "last-lts"
 
 - name: replica_sets_multiversion_testdata_last_continuous
   value:
@@ -170,6 +173,9 @@
           global_vars:
             TestData:
               useRandomBinVersionsWithinReplicaSet: "last-continuous"
+              # Since a test in replica_sets could start up a sharded cluster, we
+              # need to set this variable so that the right version of mongos is chosen.
+              mongosBinVersion: "last-continuous"
 
 - name: rollback_multiversion_fuzzer_testdata_last_lts
   value:

buildscripts/resmokeconfig/matrix_suites/overrides/networking.yml

@@ -0,0 +1,11 @@
+### Overrides for matrix suites that set networking-related parameters.
+- name: task_executor_pool_size_8
+  value:
+    executor:
+      config:
+        shell_options:
+          nodb: ""
+          global_vars:
+            TestData:
+              setParametersMongos:
+                taskExecutorPoolSize: 8

buildscripts/resmokeconfig/suites/aggregation_unsplittable_collections_on_random_shard_passthrough_with_config_transitions.yml

@@ -91,7 +91,6 @@ selector:
     - jstests/aggregation/expressions/substrbytes.js
     - jstests/aggregation/sources/setWindowFields/set_union.js
     - jstests/aggregation/accumulators/set_union.js
-    - jstests/aggregation/sources/graphLookup/spilling.js
     - jstests/aggregation/expressions/current_date.js
 
     # These tests run larger aggregations that can take a long time and can repeatedly get interrupted by config transitions.

buildscripts/resmokeconfig/suites/concurrency_sharded_with_auto_bootstrap.yml

@@ -36,6 +36,7 @@ selector:
     # mongos has no system.profile collection.
     - requires_profiling
     - assumes_unsharded_collection
+    - config_shard_incompatible
 
 executor:
   archive:

buildscripts/resmokeconfig/suites/concurrency_sharded_with_balancer_and_auto_bootstrap.yml

@@ -46,6 +46,7 @@ selector:
     - requires_profiling
     - assumes_unsharded_collection
     - requires_getmore
+    - config_shard_incompatible
 
 executor:
   archive:

buildscripts/resmokeconfig/suites/embedded_router_sharded_collections_jscore_passthrough.yml

@@ -1,114 +0,0 @@
-test_kind: js_test
-
-selector:
-  roots:
-    - jstests/core/**/*.js
-    - jstests/fle2/**/*.js
-    - src/mongo/db/modules/*/jstests/fle2/**/*.js
-  exclude_files:
-    # These tests are run in embedded_router_jscore_txns.
-    - jstests/core/txns/**/*.js
-
-    # The following tests fail because a certain command or functionality is not supported on
-    # mongos. This command or functionality is placed in a comment next to the failing test.
-    - jstests/core/**/apitest_db.js # serverStatus output doesn't have storageEngine.
-    - jstests/core/**/bypass_doc_validation.js # sharded $out output not permitted
-    - jstests/core/**/check_shard_index.js # checkShardingIndex.
-    - jstests/core/**/compact_keeps_indexes.js # compact.
-    - jstests/core/**/currentop.js # uses fsync.
-    - jstests/core/**/dbhash.js # dbhash.
-    - jstests/core/**/fsync.js # uses fsync.
-    - jstests/core/**/geo_s2cursorlimitskip.js # profiling.
-    - jstests/core/**/geo_update_btree2.js # notablescan.
-    - jstests/core/**/index9.js # "local" database.
-    - jstests/core/**/queryoptimizera.js # "local" database.
-    - jstests/core/**/startup_log.js # "local" database.
-    - jstests/core/**/query/top/top.js # top.
-    - jstests/core/**/explain_missing_database.js # Behavior with no db different on mongos.
-    - jstests/core/**/geo_2d_explain.js # executionSuccess in different spot in explain().
-    - jstests/core/**/geo_s2explain.js # inputStage in different spot in explain().
-    - jstests/core/**/geo_s2sparse.js # keysPerIndex in different spot in validate().
-    - jstests/core/**/operation_latency_histogram.js # Stats are counted differently on mongos, SERVER-24880.
-    - jstests/core/**/or_to_in.js # queryPlanner in different spot in explain()
-
-    # The following tests fail because they count indexes. These counts do not take into account the
-    # additional hashed shard key indexes that are automatically added by this passthrough.
-    - jstests/core/**/apitest_dbcollection.js
-    - jstests/core/**/bad_index_plugin.js
-    - jstests/core/**/create_indexes.js
-    - jstests/core/**/list_indexes_non_existent_ns.js
-    - jstests/core/**/mr_preserve_indexes.js
-
-    # TODO SERVER-29449: Re-enable once 'executionStats.nReturned' is correct for sharded queries
-    # with a limit or for distinct commands.
-    - jstests/core/**/distinct_index1.js
-    - jstests/core/**/explain/explain1.js
-    - jstests/core/**/explain4.js
-    - jstests/core/**/sortk.js
-
-    # TODO SERVER-32563: The implementation of explain for the count command is incorrect on sharded
-    # collections.
-    - jstests/core/**/explain/explain_count.js
-    - jstests/core/**/explain_server_params.js
-
-    # TODO SERVER-32311: These tests use plan stage helpers which can't handle sharded explain output.
-    - jstests/core/**/expr_index_use.js
-    - jstests/core/**/index_multikey.js
-    - jstests/core/**/query/explain/optimized_match_explain.js
-    - jstests/core/**/sort_array.js
-
-    # Embedded router doesn't support correct UpdateMetrics yet.
-    # TODO SERVER-82303 Remove this once we have role-aware metrics.
-    - jstests/core/query/update/update_metrics.js
-    - jstests/core/query/find_and_modify/find_and_modify_metrics.js
-    # Embedded router doesn't support getClusterParameter on router yet.
-    - src/mongo/db/modules/enterprise/jstests/audit/cluster_server_parameters.js
-    - src/mongo/db/modules/enterprise/jstests/audit/audit_config_upgrade_downgrade.js
-    - src/mongo/db/modules/enterprise/jstests/audit/set_audit_config_cluster_parameter.js
-    - src/mongo/db/modules/enterprise/jstests/fcbis/fcbis_cluster_server_parameters.js
-    # Embedded router doesn't support FLE yet.
-    - src/mongo/db/modules/enterprise/jstests/fle2/**/*.js
-
-  exclude_with_any_tags:
-    - assumes_standalone_mongod
-    - assumes_against_mongod_not_mongos
-    # This passthrough implicitly shards the accessed collections. Do not run tests where collections
-    # can't be created on `getCollection` call.
-    - assumes_no_implicit_collection_creation_on_get_collection
-    # Tests tagged with the following will fail because they assume collections are not sharded.
-    - assumes_no_implicit_collection_creation_after_drop
-    - assumes_no_implicit_index_creation
-    - assumes_unsharded_collection
-    - cannot_create_unique_index_when_using_hashed_shard_key
-    # Capped collections cannot be sharded
-    - requires_capped
-    # system.profile collection doesn't exist on mongos.
-    - requires_profiling
-    # Prepare is not a command on mongos.
-    - uses_prepare_transaction
-
-executor:
-  archive:
-    hooks:
-      - CheckReplDBHash
-      - CheckMetadataConsistencyInBackground
-      - ValidateCollections
-  config:
-    shell_options:
-      eval: await import("jstests/libs/override_methods/implicitly_shard_accessed_collections.js")
-  hooks:
-    - class: CheckReplDBHash
-    - class: CheckMetadataConsistencyInBackground
-    - class: ValidateCollections
-    - class: CheckOrphansDeleted
-    - class: CleanEveryN
-      n: 20
-  fixture:
-    class: ShardedClusterFixture
-    mongod_options:
-      set_parameters:
-        enableTestCommands: 1
-        featureFlagRouterPort: 1
-    num_rs_nodes_per_shard: 2
-    num_shards: 2
-    embedded_router: 1

buildscripts/resmokeconfig/suites/no_passthrough.yml

@@ -12,7 +12,6 @@ selector:
     - jstests/libs/property_test_helpers/pbt_self_test.js
     - src/mongo/db/modules/*/jstests/hot_backups/**/*.js
     - src/mongo/db/modules/*/jstests/live_import/*.js
-    - src/mongo/db/modules/*/jstests/live_restore/*.js
     - src/mongo/db/modules/*/jstests/no_passthrough/*.js
 
     # Self-tests for the Concurrency testing framework are run as part of this test suite.
@@ -28,7 +27,6 @@ executor:
       - jstests/noPassthrough/backup*.js
       - jstests/noPassthrough/oplog_writes_only_permitted_on_standalone.js
       - jstests/noPassthrough/wt_unclean_shutdown.js
-      - src/mongo/db/modules/*/jstests/live_restore/*.js
       - src/mongo/db/modules/enterprise/jstests/hot_backups/**/*.js
   config:
     shell_options:

buildscripts/resmokeconfig/suites/read_concern_linearizable_passthrough.yml

@@ -16,6 +16,8 @@ selector:
     # The NoOp write from linearizable getMores will cause awaitdata_getmore_cmd.js to loop
     # indefinitely as it tails the oplog.
     - jstests/core/**/awaitdata_getmore_cmd.js
+    # express_pbt.js takes a long time and consistently times out
+    - jstests/core/index/express_pbt.js
   exclude_with_any_tags:
     ##
     # The next three tags correspond to the special errors thrown by the

buildscripts/resmokeconfig/suites/retryable_writes_jscore_stepdown_passthrough.yml

@@ -49,6 +49,11 @@ selector:
     - jstests/core/**/list_collections_filter.js # Temporary collections are dropped on failover.
     - jstests/core/**/startup_log.js # Checks pid, which is different on each server.
 
+    # TODO (SERVER-102765): Remove once create no longer return a false ok.
+    - jstests/core/catalog/agg_list_cluster_catalog_sharding_fields.js
+    - jstests/core/catalog/agg_list_cluster_catalog_with_match.js
+    - jstests/core/catalog/agg_list_cluster_catalog.js
+
   exclude_with_any_tags:
     - assumes_standalone_mongod
     ##

buildscripts/resmokeconfig/suites/sharding_clustered_collections.yml

@@ -20,6 +20,10 @@ selector:
     # TODO SERVER-85395: remove the following exclusion together with the test
     # Expects the collection creation options not to change.
     - jstests/sharding/create_unsplittable_collection_on_shard.js
+    # TODO SERVER-102058: remove the following exclusion after fixing this ticket
+    # Create is not idempotent when the failpoint `clusterAllCollectionsByDefault` is enabled.
+    - jstests/sharding/mongos_writes_wait_for_write_concern_sharded.js
+    - jstests/sharding/mongos_writes_wait_for_write_concern_unsharded.js
   exclude_with_any_tags:
     - expects_explicit_underscore_id_index
 

buildscripts/resmokeconfig/suites/timeseries_crud_jscore_passthrough.yml

@@ -43,6 +43,7 @@ selector:
     - jstests/core/query/hashed_partial_and_sparse_index.js
     - jstests/core/query/distinct/distinct_with_hashed_index.js
     - jstests/core/query/distinct/distinct_for_passthrough.js
+    - jstests/core/query/index_with_hashed_path_prefix_of_nonhashed_path.js
     - jstests/core/query/internal_hash_eq/**/*.js
     - jstests/core/query/project/projection_with_hashed_index.js
     - jstests/core/query/single_field_hashed_index.js

buildscripts/resmokelib/testing/fixtures/standalone.py

@@ -586,3 +586,4 @@ def _add_testing_set_parameters(suite_set_parameters):
     # The placeholder is needed so older versions don't have this option won't have this value set.
     suite_set_parameters.setdefault("backtraceLogFile", True)
     suite_set_parameters.setdefault("disableTransitionFromLatestToLastContinuous", False)
+    suite_set_parameters.setdefault("oplogApplicationEnforcesSteadyStateConstraints", True)

buildscripts/resmokelib/testing/symbolizer_service.py

@@ -16,7 +16,10 @@ from buildscripts.resmokelib.testing.testcases.interface import TestCase
 
 # This lock prevents different resmoke jobs from symbolizing stacktraces concurrently,
 # which includes downloading the debug symbols, that can be reused by other resmoke jobs
-_lock = Lock()
+_symbolizer_lock = Lock()
+
+# A lock for avoiding concurrent access to PROCESSED_FILES_LIST_FILE_PATH
+_processed_files_lock = Lock()
 
 STACKTRACE_FILE_EXTENSION = ".stacktrace"
 SYMBOLIZE_RETRY_TIMEOUT_SECS = timedelta(minutes=4).total_seconds()
@@ -109,23 +112,23 @@ class ResmokeSymbolizer:
         if dbpath is None:
             return
 
-        with _lock:
-            test.logger.info("Looking for stacktrace files in '%s'", dbpath)
-            files = self.collect_stacktrace_files(dbpath)
-            if not files:
-                test.logger.info("No failure logs/stacktrace files found, skipping symbolization")
-                return
+        test.logger.info("Looking for stacktrace files in '%s'", dbpath)
+        files = self.collect_stacktrace_files(dbpath)
+        if not files:
+            test.logger.info("No failure logs/stacktrace files found, skipping symbolization")
+            return
 
-            test.logger.info("Found stacktrace files: %s", files)
-            # To avoid performing the same actions on these files again, we mark them as processed
-            self.file_service.add_to_processed_files(files)
-            self.file_service.write_processed_files(PROCESSED_FILES_LIST_FILE_PATH)
+        test.logger.info("Found stacktrace files: %s", files)
+        # To avoid performing the same actions on these files again, we mark them as processed
+        self.file_service.add_to_processed_files(files)
+        self.file_service.write_processed_files(PROCESSED_FILES_LIST_FILE_PATH)
 
-            if test.return_code == 0:
-                test.logger.info("Test succeeded, skipping symbolization")
-                return
+        if test.return_code == 0:
+            test.logger.info("Test succeeded, skipping symbolization")
+            return
 
-            test.logger.info("Symbolization process started.")
+        test.logger.info("Starting symbolization once no other tests are being symbolized.")
+        with _symbolizer_lock:
             test.logger.info("\nBEGIN Symbolization")
 
             start_time = time.perf_counter()
@@ -230,9 +233,10 @@ class FileService:
 
         :param: path to a file where we store processed files info.
         """
-        if os.path.exists(file_path):
-            with open(file_path, "r") as file:
-                return {line for line in set(file.readlines()) if line}
+        with _processed_files_lock:
+            if os.path.exists(file_path):
+                with open(file_path, "r") as file:
+                    return {line for line in set(file.readlines()) if line}
         return set()
 
     def add_to_processed_files(self, files: List[str]) -> None:
@@ -252,8 +256,9 @@ class FileService:
         :param file_path: path to a file where we store processed files info
         :return: None
         """
-        with open(file_path, "w") as file:
-            file.write("\n".join(self._processed_files))
+        with _processed_files_lock:
+            with open(file_path, "w") as file:
+                file.write("\n".join(self._processed_files))
 
     def is_processed(self, file: str) -> bool:
         """

buildscripts/sbom_linter.py

@@ -5,6 +5,7 @@ import sys
 from typing import List
 
 import jsonschema
+from license_expression import get_spdx_licensing
 from referencing import Registry, Resource
 
 BOM_SCHEMA_LOCATION = os.path.join("buildscripts", "tests", "sbom_linter", "bom-1.5.schema.json")
@@ -32,6 +33,7 @@ MISSING_TEAM_ERROR = "Component must include a 'internal:team_responsible' prope
 SCHEMA_MATCH_FAILURE = "File did not match the CycloneDX schema"
 MISSING_VERSION_IN_SBOM_COMPONENT_ERROR = "Component must include a version."
 MISSING_VERSION_IN_IMPORT_FILE_ERROR = "Missing version in the import file: "
+MISSING_LICENSE_IN_SBOM_COMPONENT_ERROR = "Component must include a license."
 COULD_NOT_FIND_OR_READ_SCRIPT_FILE_ERROR = "Could not find or read the import script file"
 VERSION_MISMATCH_ERROR = "Version mismatch: "
 
@@ -115,30 +117,48 @@ def strip_extra_prefixes(string_with_prefix: str) -> str:
     return string_with_prefix.removeprefix("mongo/").removeprefix("v")
 
 
-def validate_evidence(component: dict, third_party_libs: set, error_manager: ErrorManager) -> None:
-    if "evidence" not in component or "occurrences" not in component["evidence"]:
-        error_manager.append_full_error_message(MISSING_EVIDENCE_ERROR)
+def validate_license(component: dict, error_manager: ErrorManager) -> None:
+    if "licenses" not in component:
+        error_manager.append_full_error_message(MISSING_LICENSE_IN_SBOM_COMPONENT_ERROR)
         return
 
-    occurrences = component["evidence"]["occurrences"]
-    if not occurrences:
-        error_manager.append_full_error_message(
-            "'evidence.occurrences' field must include at least one location."
-        )
-    for occurrence in occurrences:
-        location = occurrence["location"]
+    valid_license = False
+    for license in component["licenses"]:
+        if "expression" in license:
+            expression = license.get("expression")
+        elif "license" in license:
+            if "id" in license["license"]:
+                # Should be a valid SPDX license ID
+                expression = license["license"].get("id")
+            elif "name" in license["license"]:
+                # If SPDX does not define the license used, the name field may be used to provide the license name
+                valid_license = True
 
-        if not os.path.exists(location) and not SKIP_FILE_CHECKING:
-            error_manager.append_full_error_message("location does not exist in repo.")
+        if not valid_license:
+            licensing_validate = get_spdx_licensing().validate(expression, validate=True)
+            # ExpressionInfo(
+            #   original_expression='',
+            #   normalized_expression='',
+            #   errors=[],
+            #   invalid_symbols=[]
+            # )
+            valid_license = not licensing_validate.errors or not licensing_validate.invalid_symbols
+            if not valid_license:
+                error_manager.append_full_error_message(licensing_validate)
+                return
 
-        if location.startswith(THIRD_PARTY_LOCATION_PREFIX):
-            lib = location.removeprefix(THIRD_PARTY_LOCATION_PREFIX)
-            if lib in third_party_libs:
-                third_party_libs.remove(lib)
+
+def validate_evidence(component: dict, third_party_libs: set, error_manager: ErrorManager) -> None:
+    if component["scope"] == "required":
+        if "evidence" not in component or "occurrences" not in component["evidence"]:
+            error_manager.append_full_error_message(MISSING_EVIDENCE_ERROR)
+            return
+
+    validate_location(component, third_party_libs, error_manager)
 
 
 def validate_properties(component: dict, error_manager: ErrorManager) -> None:
-    has_team_responsible_property = False
+    has_team_responsible_property = False or component["scope"] == "excluded"
     script_path = ""
     if "properties" in component:
         for prop in component["properties"]:
@@ -159,14 +179,26 @@ def validate_properties(component: dict, error_manager: ErrorManager) -> None:
     if comp_version == "Unknown" or script_path == "":
         return
 
+    # Include the .pedigree.descendants[0] version for version matching
+    if (
+        "pedigree" in component
+        and "descendants" in component["pedigree"]
+        and "version" in component["pedigree"]["descendants"][0]
+    ):
+        comp_pedigree_version = component["pedigree"]["descendants"][0]["version"]
+    else:
+        comp_pedigree_version = ""
+
     # At this point a version is attempted to be read from the import script file
     script_version = get_script_version(script_path, "VERSION", error_manager)
     if script_version == "":
         error_manager.append_full_error_message(MISSING_VERSION_IN_IMPORT_FILE_ERROR + script_path)
-    elif strip_extra_prefixes(script_version) != strip_extra_prefixes(comp_version):
+    elif strip_extra_prefixes(script_version) != strip_extra_prefixes(
+        comp_version
+    ) and strip_extra_prefixes(script_version) != strip_extra_prefixes(comp_pedigree_version):
         error_manager.append_full_error_message(
             VERSION_MISMATCH_ERROR
-            + f"\nscript version:{script_version}\nsbom version:{comp_version}"
+            + f"\nscript version:{script_version}\nsbom component version:{comp_version}\nsbom component pedigree version:{comp_pedigree_version}"
         )
 
 
@@ -174,15 +206,37 @@ def validate_component(component: dict, third_party_libs: set, error_manager: Er
     error_manager.update_component_attribute(component["name"])
     if "scope" not in component:
         error_manager.append_full_error_message("component must include a scope.")
-    elif component["scope"] != "optional":
+    else:
         validate_evidence(component, third_party_libs, error_manager)
     validate_properties(component, error_manager)
+    validate_license(component, error_manager)
 
     if "purl" not in component and "cpe" not in component:
         error_manager.append_full_error_message(MISSING_PURL_CPE_ERROR)
     error_manager.update_component_attribute("")
 
 
+def validate_location(component: dict, third_party_libs: set, error_manager: ErrorManager) -> None:
+    if "evidence" in component:
+        if "occurrences" not in component["evidence"]:
+            error_manager.append_full_error_message(
+                "'evidence.occurrences' field must include at least one location."
+            )
+
+        occurrences = component["evidence"]["occurrences"]
+        for occurrence in occurrences:
+            if "location" in occurrence:
+                location = occurrence["location"]
+
+                if not os.path.exists(location) and not SKIP_FILE_CHECKING:
+                    error_manager.append_full_error_message("location does not exist in repo.")
+
+                if location.startswith(THIRD_PARTY_LOCATION_PREFIX):
+                    lib = location.removeprefix(THIRD_PARTY_LOCATION_PREFIX)
+                    if lib in third_party_libs:
+                        third_party_libs.remove(lib)
+
+
 def lint_sbom(
     input_file: str, output_file: str, third_party_libs: set, should_format: bool
 ) -> ErrorManager:
@@ -257,8 +311,6 @@ def main() -> int:
     )
     # the only files in this dir that are not third party libs
     third_party_libs.remove("scripts")
-    # wiredtiger will not be included in the sbom since it is considered part of the server
-    third_party_libs.remove("wiredtiger")
     # the only files in the sasl dir are BUILD files to setup the sasl library in Windows
     third_party_libs.remove("sasl")
     error_manager = lint_sbom(input_file, output_file, third_party_libs, should_format)

buildscripts/sync_repo_with_copybara.py

@@ -171,7 +171,7 @@ def send_failure_message_to_slack(expansions):
 
     evg_api = RetryingEvergreenApi.get_api(config_file=".evergreen.yml")
     evg_api.send_slack_message(
-        target="#sdp-triager",
+        target="#devprod-build-automation",
         msg=error_msg,
     )
 
@@ -481,7 +481,7 @@ def main():
         ):
             return
 
-        # Send a failure message to #sdp-triager if the Copybara sync task fails.
+        # Send a failure message to #devprod-build-automation if the Copybara sync task fails.
         send_failure_message_to_slack(expansions)
 
 

buildscripts/tests/sbom_linter/inputs/sbom_component_empty_version.json

@@ -2,11 +2,11 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
     {
@@ -14,6 +14,11 @@
       "name": "kafka",
       "version": "",
       "scope": "required",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "cpe": "test_cpe",
       "properties": [
         {
@@ -34,4 +39,4 @@
       }
     }
   ]
-}
+}

buildscripts/tests/sbom_linter/inputs/sbom_component_name_missing.json

@@ -2,11 +2,11 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
     {
@@ -14,6 +14,11 @@
       "version": "v2.0.2",
       "scope": "required",
       "cpe": "test_cpe",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "properties": [
         {
           "name": "internal:team_responsible",
@@ -33,4 +38,4 @@
       }
     }
   ]
-}
+}

buildscripts/tests/sbom_linter/inputs/sbom_invalid_format.json

@@ -2,11 +2,11 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
 
@@ -16,6 +16,11 @@
       "name": "kafka",
       "version": "2.0.2",
       "scope": "required",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "cpe": "test_cpe",
       "properties": [
         {
@@ -36,6 +41,13 @@
       "name": "protobuf",
       "version": "v4.25.0",
       "scope": "required",
+      "licenses": [
+        {
+          "license": {
+            "id": "BSD-3-Clause"
+          }
+        }
+      ],
       "purl": "test_purl",
       "properties": [
         {
@@ -58,6 +70,13 @@
       "name": "unicode",
       "version": "8.0",
       "scope": "optional",
+      "licenses": [
+        {
+          "license": {
+            "id": "Unicode-DFS-2016"
+          }
+        }
+      ],
       "purl": "test_purl",
       "properties": [
         {
@@ -67,4 +86,4 @@
       ]
     }
   ]
-}
+}

buildscripts/tests/sbom_linter/inputs/sbom_invalid_license_expression.json

@@ -0,0 +1,43 @@
+{
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "properties": [
+    {
+      "name": "comment",
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+    }
+  ],
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5",
+  "version": 1,
+  "components": [
+    {
+      "type": "library",
+      "name": "kafka",
+      "version": "v2.0.2",
+      "licenses": [
+        {
+          "expression": "xBSD-3-Clause"
+        }
+      ],
+      "scope": "required",
+      "cpe": "test_cpe",
+      "properties": [
+        {
+          "name": "internal:team_responsible",
+          "value": "server_security"
+        },
+        {
+          "name": "import_script_path",
+          "value": "buildscripts/tests/sbom_linter/inputs/kafka_valid_import.sh"
+        }
+      ],
+      "evidence": {
+        "occurrences": [
+          {
+            "location": "src/third_party/librdkafka"
+          }
+        ]
+      }
+    }
+  ]
+}

buildscripts/tests/sbom_linter/inputs/sbom_missing_evidence.json

@@ -2,11 +2,11 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
     {
@@ -14,6 +14,11 @@
       "name": "kafka",
       "scope": "required",
       "cpe": "test_cpe",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "properties": [
         {
           "name": "internal:team_responsible",
@@ -53,4 +58,4 @@
       ]
     }
   ]
-}
+}

buildscripts/tests/sbom_linter/inputs/sbom_missing_license.json

@@ -0,0 +1,74 @@
+{
+  "properties": [
+    {
+      "name": "comment",
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+    }
+  ],
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5",
+  "version": 1,
+  "components": [
+    {
+      "type": "library",
+      "name": "kafka",
+      "version": "v2.0.2",
+      "scope": "required",
+      "cpe": "test_cpe",
+      "properties": [
+        {
+          "name": "internal:team_responsible",
+          "value": "server_security"
+        },
+        {
+          "name": "import_script_path",
+          "value": "buildscripts/tests/sbom_linter/inputs/kafka_valid_import.sh"
+        }
+      ],
+      "evidence": {
+        "occurrences": [
+          {
+            "location": "src/third_party/librdkafka"
+          }
+        ]
+      }
+    },
+    {
+      "type": "library",
+      "name": "protobuf",
+      "version": "v4.25.0",
+      "scope": "required",
+      "purl": "test_purl",
+      "properties": [
+        {
+          "name": "internal:team_responsible",
+          "value": "server_security"
+        },
+        {
+          "name": "import_script_path",
+          "value": "buildscripts/tests/sbom_linter/inputs/import_script_with_mongo_prefix_version.sh"
+        }
+      ],
+      "evidence": {
+        "occurrences": [
+          {
+            "location": "src/third_party/protobuf"
+          }
+        ]
+      }
+    },
+    {
+      "type": "library",
+      "name": "unicode",
+      "version": "8.0",
+      "scope": "optional",
+      "purl": "test_purl",
+      "properties": [
+        {
+          "name": "internal:team_responsible",
+          "value": "server_security"
+        }
+      ]
+    }
+  ]
+}

buildscripts/tests/sbom_linter/inputs/sbom_missing_purl.json

@@ -2,17 +2,22 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
     {
       "type": "library",
       "name": "kafka",
       "scope": "required",
+       "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "cpe": "test_cpe",
       "properties": [
         {
@@ -59,4 +64,4 @@
       ]
     }
   ]
-}
+}

buildscripts/tests/sbom_linter/inputs/sbom_missing_team.json

@@ -2,17 +2,22 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
     {
       "type": "library",
       "name": "kafka",
       "scope": "required",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "cpe": "test_cpe",
       "evidence": {
         "occurrences": [
@@ -54,4 +59,4 @@
       ]
     }
   ]
-}
+}

buildscripts/tests/sbom_linter/inputs/sbom_missing_version.json

@@ -2,17 +2,22 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
     {
       "type": "library",
       "name": "kafka",
       "scope": "required",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "cpe": "test_cpe",
       "properties": [
         {
@@ -29,4 +34,4 @@
       }
     }
   ]
-}
+}

buildscripts/tests/sbom_linter/inputs/sbom_named_license.json

@@ -0,0 +1,51 @@
+{
+  "properties": [
+    {
+      "name": "comment",
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+    }
+  ],
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5",
+  "version": 1,
+  "components": [
+    {
+      "type": "library",
+      "bom-ref": "pkg:github/aappleby/smhasher@a6bd3ce7be8ad147ea820a7cf6229a975c0c96bb",
+      "supplier": {
+        "name": "Austin Appleby"
+      },
+      "author": "Austin Appleby",
+      "group": "aappleby",
+      "name": "MurmurHash3",
+      "version": "a6bd3ce7be8ad147ea820a7cf6229a975c0c96bb",
+      "licenses": [
+        {
+          "license": {
+            "name": "Public Domain"
+          }
+        }
+      ],
+      "copyright": "MurmurHash3 was written by Austin Appleby, and is placed in the public domain. The author hereby disclaims copyright to this source code.",
+      "purl": "pkg:github/aappleby/smhasher@a6bd3ce7be8ad147ea820a7cf6229a975c0c96bb",
+      "properties": [
+        {
+          "name": "internal:team_responsible",
+          "value": "Storage Execution"
+        },
+        {
+          "name": "info_link",
+          "value": "https://github.com/aappleby/smhasher/blob/a6bd3ce/"
+        }
+      ],
+      "evidence": {
+        "occurrences": [
+          {
+            "location": "src/third_party/murmurhash3"
+          }
+        ]
+      },
+      "scope": "required"
+    }
+  ]
+}

buildscripts/tests/sbom_linter/inputs/sbom_pedigree_version_match.json

@@ -0,0 +1,51 @@
+{
+  "properties": [
+    {
+      "name": "comment",
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+    }
+  ],
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5",
+  "version": 1,
+  "components": [
+    {
+      "type": "library",
+      "name": "kafka",
+      "version": "v2.0.0",
+      "scope": "required",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
+      "cpe": "test_cpe",
+      "pedigree": {
+        "descendants": [
+          {
+            "type": "library",
+            "name": "kafka-fork",
+            "version": "v2.0.2"
+          }
+        ]
+      },
+      "properties": [
+        {
+          "name": "internal:team_responsible",
+          "value": "server_security"
+        },
+        {
+          "name": "import_script_path",
+          "value": "buildscripts/tests/sbom_linter/inputs/kafka_valid_import.sh"
+        }
+      ],
+      "evidence": {
+        "occurrences": [
+          {
+            "location": "src/third_party/kafka"
+          }
+        ]
+      }
+    }
+  ]
+}

buildscripts/tests/sbom_linter/inputs/sbom_script_file_missing.json

@@ -2,11 +2,11 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
     {
@@ -14,6 +14,11 @@
       "name": "kafka",
       "version": "2.0.2",
       "scope": "required",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "cpe": "test_cpe",
       "properties": [
         {
@@ -34,4 +39,4 @@
       }
     }
   ]
-}
+}

buildscripts/tests/sbom_linter/inputs/sbom_script_missing_version.json

@@ -2,11 +2,11 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
     {
@@ -14,6 +14,11 @@
       "name": "kafka",
       "version": "2.0.2",
       "scope": "required",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "cpe": "test_cpe",
       "properties": [
         {
@@ -34,4 +39,4 @@
       }
     }
   ]
-}
+}

buildscripts/tests/sbom_linter/inputs/sbom_version_mismatch.json

@@ -2,11 +2,11 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
     {
@@ -14,6 +14,11 @@
       "name": "kafka",
       "version": "v4.25.0",
       "scope": "required",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "cpe": "test_cpe",
       "properties": [
         {
@@ -34,4 +39,4 @@
       }
     }
   ]
-}
+}

buildscripts/tests/sbom_linter/inputs/valid_sbom.json

@@ -2,17 +2,22 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
     {
       "type": "library",
       "name": "kafka",
       "version": "v2.0.2",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "scope": "required",
       "cpe": "test_cpe",
       "properties": [
@@ -38,6 +43,13 @@
       "name": "protobuf",
       "version": "v4.25.0",
       "scope": "required",
+      "licenses": [
+        {
+          "license": {
+            "id": "BSD-3-Clause"
+          }
+        }
+      ],
       "purl": "test_purl",
       "properties": [
         {
@@ -61,6 +73,13 @@
       "type": "library",
       "name": "unicode",
       "version": "8.0",
+      "licenses": [
+        {
+          "license": {
+            "id": "Unicode-DFS-2016"
+          }
+        }
+      ],
       "scope": "optional",
       "purl": "test_purl",
       "properties": [

buildscripts/tests/sbom_linter/test_sbom.py

@@ -103,6 +103,14 @@ class TestSbom(unittest.TestCase):
         error_manager = sbom_linter.lint_sbom(test_file, test_file, third_party_libs, False)
         self.assert_message_in_errors(error_manager, sbom_linter.VERSION_MISMATCH_ERROR)
 
+    def test_pedigree_version_match(self):
+        test_file = os.path.join(self.input_dir, "sbom_pedigree_version_match.json")
+        third_party_libs = {"kafka"}
+        error_manager = sbom_linter.lint_sbom(test_file, test_file, third_party_libs, False)
+        if not error_manager.zero_error():
+            error_manager.print_errors()
+        self.assertTrue(error_manager.zero_error())
+
     def test_schema_match_failure(self):
         test_file = os.path.join(self.input_dir, "sbom_component_name_missing.json")
         third_party_libs = {"librdkafka"}
@@ -116,3 +124,26 @@ class TestSbom(unittest.TestCase):
         self.assert_message_in_errors(
             error_manager, sbom_linter.MISSING_VERSION_IN_SBOM_COMPONENT_ERROR
         )
+
+    def test_missing_license(self):
+        test_file = os.path.join(self.input_dir, "sbom_missing_license.json")
+        third_party_libs = {"librdkafka"}
+        error_manager = sbom_linter.lint_sbom(test_file, test_file, third_party_libs, False)
+        self.assert_message_in_errors(
+            error_manager, sbom_linter.MISSING_LICENSE_IN_SBOM_COMPONENT_ERROR
+        )
+
+    def test_invalid_license_expression(self):
+        test_file = os.path.join(self.input_dir, "sbom_invalid_license_expression.json")
+        third_party_libs = {"librdkafka"}
+        error_manager = sbom_linter.lint_sbom(test_file, test_file, third_party_libs, False)
+        # print(error_manager.errors)
+        self.assert_message_in_errors(error_manager, "ExpressionInfo")
+
+    def test_named_license(self):
+        test_file = os.path.join(self.input_dir, "sbom_named_license.json")
+        third_party_libs = {"murmurhash3"}
+        error_manager = sbom_linter.lint_sbom(test_file, test_file, third_party_libs, False)
+        if not error_manager.zero_error():
+            error_manager.print_errors()
+        self.assertTrue(error_manager.zero_error())

buildscripts/validate_evg_project_config.py

@@ -2,7 +2,6 @@ import os.path
 import re
 import subprocess
 import sys
-from collections import defaultdict
 
 import structlog
 import typer
@@ -16,7 +15,6 @@ DEFAULT_LOCAL_EVG_AUTH_CONFIG = os.path.expanduser("~/.evergreen.yml")
 
 DEFAULT_EVG_PROJECT_NAME = "mongodb-mongo-master"
 DEFAULT_EVG_NIGHTLY_PROJECT_NAME = "mongodb-mongo-master-nightly"
-DEFAULT_EVG_PROJECT_CONFIG = "etc/evergreen.yml"
 DEFAULT_EVG_NIGHTLY_PROJECT_CONFIG = "etc/evergreen_nightly.yml"
 
 ALLOWABLE_EVG_VALIDATE_MESSAGE_REGEXES = [
@@ -41,76 +39,23 @@ def main(
     evg_project_config_map = {evg_project_name: DEFAULT_EVG_NIGHTLY_PROJECT_CONFIG}
     if evg_project_name == DEFAULT_EVG_PROJECT_NAME:
         evg_project_config_map = {
-            DEFAULT_EVG_PROJECT_NAME: DEFAULT_EVG_PROJECT_CONFIG,
             DEFAULT_EVG_NIGHTLY_PROJECT_NAME: DEFAULT_EVG_NIGHTLY_PROJECT_CONFIG,
         }
 
-    shared_evg_validate_messages = []
-    error_on_evg_validate_messages = defaultdict(list)
-
-    num_of_projects = len(evg_project_config_map)
     evergreen_bin = find_evergreen_binary("evergreen")
-    for project, project_config in evg_project_config_map.items():
+    for _, project_config in evg_project_config_map.items():
         cmd = [
             evergreen_bin,
             "--config",
             evg_auth_config,
-            "validate",
-            "--project",
-            project,
+            "evaluate",
             "--path",
             project_config,
         ]
         LOGGER.info(f"Running command: {cmd}")
-        result = subprocess.run(cmd, capture_output=True, text=True)
-        interesting_messages = result.stdout.strip().split("\n")[:-1]
+        subprocess.run(cmd, capture_output=True, text=True, check=True)
 
-        for message in interesting_messages:
-            if num_of_projects > 1 and any(
-                regex.match(message)
-                for regex in ALLOWABLE_IF_NOT_IN_ALL_PROJECTS_EVG_VALIDATE_MESSAGE_REGEXES
-            ):
-                shared_evg_validate_messages.append(message)
-                continue
-            if any(regex.match(message) for regex in ALLOWABLE_EVG_VALIDATE_MESSAGE_REGEXES):
-                continue
-            error_on_evg_validate_messages[project].append(message)
-
-    error_on_shared_evg_validate_messages = []
-    for message in set(shared_evg_validate_messages):
-        if shared_evg_validate_messages.count(message) == num_of_projects:
-            error_on_shared_evg_validate_messages.append(message)
-
-    exit_code = 0
-    all_configs = list(evg_project_config_map.values())
-    all_projects = list(evg_project_config_map.keys())
-
-    for project, errors in error_on_evg_validate_messages.items():
-        if len(errors) > 0:
-            exit_code = 1
-            project_config = evg_project_config_map[project]
-            LOGGER.info(HORIZONTAL_LINE)
-            LOGGER.error(f"Config '{project_config}' for '{project}' evergreen project has errors:")
-            for error in errors:
-                LOGGER.error(error)
-
-    if len(error_on_shared_evg_validate_messages) > 0:
-        exit_code = 1
-        LOGGER.info(HORIZONTAL_LINE)
-        LOGGER.error(
-            f"Configs {all_configs} for evergreen projects {all_projects} have errors"
-            f" (they can be fixed in either config):"
-        )
-        for error in error_on_shared_evg_validate_messages:
-            LOGGER.error(error)
-
-    if exit_code == 0:
-        LOGGER.info(HORIZONTAL_LINE)
-        LOGGER.info(
-            f"Config(s) {all_configs} for evergreen project(s) {all_projects} is(are) valid"
-        )
-
-    sys.exit(exit_code)
+    sys.exit(0)
 
 
 if __name__ == "__main__":

copy.bara.sky

@@ -12,12 +12,12 @@ core.workflow(
     name = "default",
     origin = git.origin(
         url = sourceUrl,
-        ref = "master",
+        ref = "v8.1",
     ),
     destination = git.destination(
         url = destinationUrl,
-        fetch = "master",
-        push = "master",
+        fetch = "v8.1",
+        push = "v8.1",
     ),
     # Change path to the folder you want to publish publicly
     origin_files = glob(["**"], exclude = ["src/mongo/db/modules/**"]),

copy.bara.staging.sky

@@ -7,12 +7,12 @@ core.workflow(
     name = "default",
     origin = git.origin(
         url = sourceUrl,
-        ref = "master",
+        ref = "v8.1",
     ),
     destination = git.destination(
         url = destinationUrl,
-        fetch = "master",
-        push = "master",
+        fetch = "v8.1",
+        push = "v8.1",
     ),
     # Change path to the folder you want to publish publicly
     origin_files = glob(["**"], exclude = ["src/mongo/db/modules/**"]),

debian/mongod.1

@@ -357,7 +357,7 @@ Set \fB\-\-bind_ip_all\f1\f1 to \fBtrue\f1\&.
 \fBmongod \-\-listenBacklog\f1
 .RS
 .PP
-\fIDefault\f1: Target system \fBSOMAXCONN\f1 constant
+\fIDefault\f1: Target system specific maximum value
 .PP
 The maximum number of connections that can exist in the listen
 queue.
@@ -370,8 +370,9 @@ To prevent undefined behavior, specify a value for this
 parameter between \fB1\f1 and the local system \fBSOMAXCONN\f1
 constant.
 .PP
-The default value for the \fBlistenBacklog\f1 parameter is set at
-compile time to the target system \fBSOMAXCONN\f1 constant.
+The default value for the \fBlistenBacklog\f1 parameter depends on the target
+system. On Linux, \fB/proc/sys/net/core/somaxconn\f1 is used. On all other
+target systems, the compile time constant \fBSOMAXCONN\f1 is used.
 \fBSOMAXCONN\f1 is the maximum valid value that is documented for
 the \fIbacklog\f1 parameter to the \fIlisten\f1 system call.
 .PP
@@ -379,7 +380,7 @@ Some systems may interpret \fBSOMAXCONN\f1 symbolically, and others
 numerically. The actual \fIlisten backlog\f1 applied in practice may
 differ from any numeric interpretation of the \fBSOMAXCONN\f1 constant
 or argument to \fB\-\-listenBacklog\f1, and may also be constrained by
-system settings like \fBnet.core.somaxconn\f1 on Linux.
+system settings like \fB/proc/sys/net/core/somaxconn\f1 on Linux.
 .PP
 Passing a value for the \fBlistenBacklog\f1 parameter that exceeds the
 \fBSOMAXCONN\f1 constant for the local system is, by the letter of the

debian/mongos.1

@@ -259,7 +259,7 @@ is, you can specify one or the other, but not both.
 \fBmongos \-\-listenBacklog\f1
 .RS
 .PP
-\fIDefault\f1: Target system \fBSOMAXCONN\f1 constant
+\fIDefault\f1: Target system specific maximum value
 .PP
 The maximum number of connections that can exist in the listen
 queue.
@@ -272,8 +272,9 @@ To prevent undefined behavior, specify a value for this
 parameter between \fB1\f1 and the local system \fBSOMAXCONN\f1
 constant.
 .PP
-The default value for the \fBlistenBacklog\f1 parameter is set at
-compile time to the target system \fBSOMAXCONN\f1 constant.
+The default value for the \fBlistenBacklog\f1 parameter depends on the target
+system. On Linux, \fB/proc/sys/net/core/somaxconn\f1 is used. On all other
+target systems, the compile time constant \fBSOMAXCONN\f1 is used.
 \fBSOMAXCONN\f1 is the maximum valid value that is documented for
 the \fIbacklog\f1 parameter to the \fIlisten\f1 system call.
 .PP
@@ -281,7 +282,7 @@ Some systems may interpret \fBSOMAXCONN\f1 symbolically, and others
 numerically. The actual \fIlisten backlog\f1 applied in practice may
 differ from any numeric interpretation of the \fBSOMAXCONN\f1 constant
 or argument to \fB\-\-listenBacklog\f1, and may also be constrained by
-system settings like \fBnet.core.somaxconn\f1 on Linux.
+system settings like \fB/proc/sys/net/core/somaxconn\f1 on Linux.
 .PP
 Passing a value for the \fBlistenBacklog\f1 parameter that exceeds the
 \fBSOMAXCONN\f1 constant for the local system is, by the letter of the

etc/OWNERS.yml

@@ -3,3 +3,9 @@ filters:
   - "performance_thresholds.yml":
     approvers:
       - 10gen/performance
+  - "/evergreen_yml_components/tasks/release_tasks.yml":
+    approvers:
+      - 10gen/devprod-release-infrastructure
+  - "/evergreen_yml_components/variants/release/release.yml":
+    approvers:
+      - 10gen/devprod-release-infrastructure

etc/backports_required_for_multiversion_tests.yml

@@ -25,6 +25,8 @@ last-continuous:
       ticket: SERVER-97662
     - test_file: jstests/core/query/json_schema/json_schema.js
       ticket: SERVER-98676
+    - test_file: jstests/aggregation/accumulators/group_doing_merge.js
+      ticket: SERVER-99616
     - test_file: jstests/change_streams/change_streams_namespace_match_expressions.js
       ticket: SERVER-100489
     - test_file: jstests/change_streams/change_streams_dynamic_match_expressions.js
@@ -239,8 +241,6 @@ last-continuous:
       ticket: SERVER-91465
     - test_file: jstests/aggregation/sources/addFields/add_fields_adds_to_missing_fields.js
       ticket: SERVER-91784
-    - test_file: jstests/aggregation/group_with_acc_n_to_distinct_scan.js
-      ticket: SERVER-90017
     - test_file: jstests/core/query/query_settings/query_settings_cmds_validation.js
       ticket: SERVER-90965
     - test_file: jstests/core/query/query_settings/query_settings_cmds.js
@@ -305,8 +305,6 @@ last-continuous:
       ticket: SERVER-94151
     - test_file: jstests/core/write/update/upsert_duplicate_key_retry_collation.js
       ticket: SERVER-84089
-    - test_file: jstests/replsets/max_seven_voting_members_allowed.js
-      ticket: SERVER-69418
     - test_file: jstests/core/ddl/create_indexes.js
       ticket: SERVER-90952
     - test_file: jstests/sharding/nested_shard_role_within_router_role_recovery_in_txn.js
@@ -394,6 +392,26 @@ last-continuous:
       ticket: SERVER-98664
     - test_file: jstests/core/timeseries/query/bucket_unpacking_with_limit.js
       ticket: SERVER-100299
+    - test_file: jstests/sharding/check_metadata_consistency.js
+      ticket: SERVER-102084
+    - test_file: jstests/core_sharding/ddl/shard_collection_outside_db_primary_index_compatibility.js
+      ticket: SERVER-100844
+    - test_file: jstests/core/index/express_pbt.js
+      ticket: SERVER-102693
+    - test_file: jstests/core/timeseries/query/timeseries_groupby_reorder.js
+      ticket: SERVER-99773
+    - test_file: jstests/core_sharding/resharding/reshard_collection_atlas_log_ingestion.js
+      ticket: SERVER-100421
+    - test_file: jstests/sharding/conn_pool_stats.js
+      ticket: SERVER-102477
+    - test_file: jstests/noPassthrough/ftdc/ftdc_connection_reuse.js
+      ticket: SERVER-102477
+    - test_file: jstests/noPassthrough/network/set_step_params.js
+      ticket: SERVER-102477
+    - test_file: jstests/sharding/config_shards_on_repl_set_changes.js
+      ticket: SERVER-106614
+    - test_file: jstests/replsets/auth_coordinateCommitTransaction.js
+      ticket: SERVER-103618
   suites: null
 last-lts:
   all:
@@ -401,6 +419,8 @@ last-lts:
       ticket: SERVER-97662
     - test_file: jstests/core/query/json_schema/json_schema.js
       ticket: SERVER-98676
+    - test_file: jstests/aggregation/accumulators/group_doing_merge.js
+      ticket: SERVER-99616
     - test_file: jstests/change_streams/change_streams_namespace_match_expressions.js
       ticket: SERVER-100489
     - test_file: jstests/change_streams/change_streams_dynamic_match_expressions.js
@@ -643,8 +663,6 @@ last-lts:
       ticket: SERVER-91465
     - test_file: jstests/aggregation/sources/addFields/add_fields_adds_to_missing_fields.js
       ticket: SERVER-91784
-    - test_file: jstests/aggregation/group_with_acc_n_to_distinct_scan.js
-      ticket: SERVER-90017
     - test_file: jstests/core/query/query_settings/query_settings_cmds_validation.js
       ticket: SERVER-90965
     - test_file: jstests/core/query/query_settings/query_settings_cmds.js
@@ -713,8 +731,6 @@ last-lts:
       ticket: SERVER-94151
     - test_file: jstests/core/write/update/upsert_duplicate_key_retry_collation.js
       ticket: SERVER-84089
-    - test_file: jstests/replsets/max_seven_voting_members_allowed.js
-      ticket: SERVER-69418
     - test_file: jstests/core/ddl/create_indexes.js
       ticket: SERVER-90952
     - test_file: jstests/sharding/nested_shard_role_within_router_role_recovery_in_txn.js
@@ -837,4 +853,26 @@ last-lts:
       ticket: SERVER-98664
     - test_file: jstests/core/timeseries/query/bucket_unpacking_with_limit.js
       ticket: SERVER-100299
+    - test_file: jstests/sharding/check_metadata_consistency.js
+      ticket: SERVER-102084
+    - test_file: jstests/core_sharding/ddl/shard_collection_outside_db_primary_index_compatibility.js
+      ticket: SERVER-100844
+    - test_file: jstests/core/index/express_pbt.js
+      ticket: SERVER-102693
+    - test_file: jstests/core/timeseries/query/timeseries_groupby_reorder.js
+      ticket: SERVER-99773
+    - test_file: jstests/core_sharding/resharding/reshard_collection_atlas_log_ingestion.js
+      ticket: SERVER-100421
+    - test_file: jstests/sharding/conn_pool_stats.js
+      ticket: SERVER-102477
+    - test_file: jstests/noPassthrough/ftdc/ftdc_connection_reuse.js
+      ticket: SERVER-102477
+    - test_file: jstests/noPassthrough/network/set_step_params.js
+      ticket: SERVER-102477
+    - test_file: jstests/sharding/config_shards_on_repl_set_changes.js
+      ticket: SERVER-106614
+    - test_file: jstests/replsets/sync_source_override_secondary_read_preference.js
+      ticket: SERVER-104343
+    - test_file: jstests/replsets/auth_coordinateCommitTransaction.js
+      ticket: SERVER-103618
   suites: null

etc/coverity.yml

@@ -0,0 +1,57 @@
+# Coverity analysis options that are passed to cov-analyze command line
+analyze:
+  checkers:
+    all: true # Enables all checkers except a few which need to be explicitly enabled. See: https://documentation.blackduck.com/bundle/coverity-docs/page/commands/topics/cov-analyze.html#ariaid-title11
+    rule: true # Enables "rule" checkers. See: https://documentation.blackduck.com/bundle/coverity-docs/page/commands/topics/cov-analyze.html#refsection_dgq_pf2_4qb__list-checkers
+    checker-config:
+      # Explicitly disabled checkers
+      # Add any checker that needs to be disabled below
+      STACK_USE:
+        enabled: false
+      COPY_INSTEAD_OF_MOVE:
+        enabled: false
+      RULE_OF_ZERO_THREE_FIVE:
+        enabled: false
+      MISSING_RETURN:
+        enabled: false
+      SLEEP:
+        enabled: false
+      PASS_BY_VALUE:
+        enabled: false
+      GLOBAL_INIT_ORDER:
+        enabled: false
+      # Explicitly enabled checkers
+      # Add any checker that needs to be explicitly enabled below
+      REVERSE_OVERRUN:
+        enabled: true
+      # Checkers with customized options
+      CHECKED_RETURN:
+        enabled: true
+        options:
+          stat_threshold: 80
+      DEADCODE:
+        enabled: true
+        options:
+          no_dead_default: true
+          report_redundant_tests: true
+      NULL_RETURNS:
+        enabled: true
+        options:
+          stat_threshold: 50
+  # Enables additional filtering of potential defects by using an additional false-path pruner (FPP). More details here https://documentation.blackduck.com/bundle/coverity-docs/page/commands/topics/cov-analyze.html#ariaid-title5
+  constraint-fpp: true
+  # Enables function pointer models if the analysis fails to analyze certain function pointers calls. More details at https://documentation.blackduck.com/bundle/coverity-docs/page/commands/topics/cov-analyze.html#ariaid-title9
+  c-cpp-fnptr: true
+  # Enables full, virtual-call resolution. More details at https://documentation.blackduck.com/bundle/coverity-docs/page/commands/topics/cov-analyze.html#ariaid-title9
+  c-cpp-virtual: true
+  # Enables call graph matrics. The callgraph-metrics files store information about which functions are analyzed. More details at https://documentation.blackduck.com/bundle/coverity-docs/page/commands/topics/cov-analyze.html#ariaid-title20
+  callgraph-metrics: true
+  cov-analyze-args:
+    # Specifies the name for the configuration file, which allows you to change the parse warnings that pass through a warning filter. More details at https://documentation.blackduck.com/bundle/coverity-docs/page/commands/topics/cov-analyze.html#ariaid-title9
+    - --parse-warnings-config
+    - etc/coverity_parse_warnings.conf
+
+commit:
+  connect:
+    stream: mongo.v8.1
+    project: "MongoDB master"

etc/evergreen.yml

@@ -62,6 +62,7 @@ include:
   - filename: etc/evergreen_yml_components/tasks/compile_tasks.yml
   - filename: etc/evergreen_yml_components/tasks/compile_tasks_shared.yml
   - filename: etc/evergreen_yml_components/tasks/misc_tasks.yml
+  - filename: etc/evergreen_yml_components/tasks/release_tasks.yml
 
   - filename: etc/evergreen_yml_components/variants/misc/task_generation.yml
   - filename: etc/evergreen_yml_components/variants/misc/misc.yml

etc/evergreen_lint.yml

@@ -156,7 +156,6 @@ rules:
             "search_end_to_end_single_node",
             # TODO: remove this exception when SERVER-94572 is resolved
             "streams_kafka",
-            "streams_kafka_gwproxy",
             "streams_lambda",
             # TODO: remove these exceptions when SERVER-94573 is resolved
             "selinux_rhel9_enterprise",

etc/evergreen_nightly.yml

@@ -14,49 +14,79 @@ include:
 
   - filename: etc/evergreen_yml_components/variants/misc/task_generation.yml
   ### Uncomment when using this file for a LTS or Rapid release branch. ###
-  # - filename: etc/evergreen_yml_components/variants/misc/misc.yml
+  - filename: etc/evergreen_yml_components/variants/misc/misc.yml
 
   - filename: etc/evergreen_yml_components/variants/amazon/test_release.yml
   ### Uncomment when using this file for a LTS or Rapid release branch. ###
-  # - filename: etc/evergreen_yml_components/variants/amazon/test_dev.yml
+  - filename: etc/evergreen_yml_components/variants/amazon/test_dev.yml
 
   - filename: etc/evergreen_yml_components/variants/debian/test_release.yml
 
   ### Comment out when using this file for a Rapid release branch. ###
-  - filename: etc/evergreen_yml_components/variants/ibm/test_release_master_and_lts_branches_only.yml
+  # - filename: etc/evergreen_yml_components/variants/ibm/test_release_master_and_lts_branches_only.yml
 
   - filename: etc/evergreen_yml_components/variants/macos/test_release.yml
 
   - filename: etc/evergreen_yml_components/variants/rhel/test_release.yml
   ### Uncomment when using this file for a LTS or Rapid release branch. ###
-  # - filename: etc/evergreen_yml_components/variants/rhel/test_dev.yml
+  - filename: etc/evergreen_yml_components/variants/rhel/test_dev.yml
   ### Uncomment when using this file for a LTS release branch. ###
   # - filename: etc/evergreen_yml_components/variants/rhel/test_dev_master_and_lts_branches_only.yml
 
   ### Uncomment when using this file for a LTS or Rapid release branch. ###
-  # - filename: etc/evergreen_yml_components/variants/sanitizer/test_dev.yml
+  - filename: etc/evergreen_yml_components/variants/sanitizer/test_dev.yml
 
   ### Uncomment when using this file for a LTS or Rapid release branch. ###
-  # filename: etc/evergreen_yml_components/variants/mongot/test_dev.yml
+  - filename: etc/evergreen_yml_components/variants/mongot/test_dev.yml
 
   - filename: etc/evergreen_yml_components/variants/suse/test_release.yml
 
   - filename: etc/evergreen_yml_components/variants/ubuntu/test_release.yml
   ### Uncomment when using this file for a LTS release branch. ###
-  # - filename: etc/evergreen_yml_components/variants/ubuntu/test_dev_master_and_lts_branches_only.yml
+  - filename: etc/evergreen_yml_components/variants/ubuntu/test_dev_master_and_lts_branches_only.yml
 
   - filename: etc/evergreen_yml_components/variants/windows/test_release.yml
   ### Uncomment when using this file for a LTS or Rapid release branch. ###
-  # - filename: etc/evergreen_yml_components/variants/windows/test_dev.yml
+  - filename: etc/evergreen_yml_components/variants/windows/test_dev.yml
   ### Uncomment when using this file for a LTS release branch. ###
   # - filename: etc/evergreen_yml_components/variants/windows/test_dev_master_and_lts_branches_only.yml
 
+  - filename: etc/evergreen_yml_components/tasks/coverity_tasks.yml
+  - filename: etc/evergreen_yml_components/variants/coverity.yml
+  - filename: etc/evergreen_yml_components/tasks/release_tasks.yml
+  ### Uncomment when using this file for a LTS or Rapid release branch. ###
+  - filename: etc/evergreen_yml_components/variants/release/release.yml
+
 parameters:
   - key: evergreen_config_file_path
     value: "etc/evergreen_nightly.yml"
     description: "path to this file"
 
+commit_queue_aliases:
+  - variant: "commit-queue"
+    task: "^(bazel_.*|run_.*|compile_.*|lint_.*|jsCore|version_gen_validation|validate_commit_message|resmoke_validation_tests|buildscripts_test)$"
+    variant_tags: []
+    task_tags: []
+  - variant: "^(amazon-linux2-arm64-static-compile|linux-x86-dynamic-compile-required)$"
+    variant_tags: []
+    task_tags: ["clang_tidy"]
+  - variant: "^(al2023-arm64-sep-benchmark)$"
+    variant_tags: []
+    task_tags: ["benchmarks_sep"]
+
 patch_aliases:
+  - alias: required
+    variant_tags: ["required"]
+    task: ".*"
+  - alias: query
+    variant: "^(.*query-patch-only|amazon-linux2-arm64-static-compile)$"
+    task: ".*"
+  - alias: query-quick
+    variant: "^(.*query-quick-patch-only|linux-x86-dynamic-compile)$"
+    task: ".*"
+  - alias: security
+    variant: "^(.*security-patch-only|linux-x86-dynamic-compile|windows-compile-required)$"
+    task: ".*"
   - alias: bazel
     description: "Runs bazel build system tests"
     variant_tags: ["bazel_check"]
@@ -65,3 +95,25 @@ patch_aliases:
     description: "Runs bazel build system tests"
     variant_tags: ["bazel_check"]
     task: ".*"
+  - alias: search
+    description: "Runs all $search, $vectorSearch tests"
+    variant: ".*"
+    task: "^.*search*"
+  - alias: required-and-mongot-e2e-tests
+    description: >
+      This alias selects all tasks in all required variants and all tasks in variants that use a real mongot.
+      Once more e2e tests have been contributed and thus our coverage is better, this alias can be refined
+      to only select tests that use a real mongot.
+    variant_tags: ["required", "mongot_e2e"]
+    task: ".*"
+  - alias: codecoverage
+    description: "Run tests and report code coverage"
+    variant: ".*-coverage"
+    task: ".*"
+  - alias: unittestcoverage
+    description: "Run unit tests and report code coverage"
+    variant: ".*-coverage"
+    task: "^(compile_and_run_unittests_.*|bazel_coverage)$"
+  - alias: cluster_scalability
+    variant_tags: ["cluster_scalability_only"]
+    task_tags: ["cluster_scalability_only"]

etc/evergreen_yml_components/configuration.yml

@@ -78,6 +78,12 @@ modules:
     repo: git@github.com:10gen/mongot.git
     prefix: ${workdir}/src
     branch: master
+  - name: devprod_coverity
+    owner: mongodb-devprod-infrastructure
+    repo: coverity
+    prefix: "${workdir}/devprodCoveritySrc"
+    branch: main
+    auto_update: true
 
 # Pre task steps
 pre:

etc/evergreen_yml_components/definitions.yml

@@ -18,6 +18,7 @@ variables:
       - amazon2023-arm64
       - enterprise-amazon2023
       - enterprise-amazon2023-arm64
+      - enterprise-amazon2023-arm64-grav4
       - debian12
       - enterprise-debian12-64
       - enterprise-rhel-81-ppc64le

etc/evergreen_yml_components/tasks/compile_tasks.yml

@@ -141,6 +141,7 @@ variables:
       - enterprise-amazon2023
       # TODO(SERVER-85904) - enterprise-amazon2023-lto
       - enterprise-amazon2023-arm64
+      - enterprise-amazon2023-arm64-grav4
       # TODO(SERVER-85904) - enterprise-amazon2023-arm64-lto
       - enterprise-debian12-64
       - enterprise-linux-64-amazon-ami

etc/evergreen_yml_components/tasks/compile_tasks_shared.yml

@@ -339,6 +339,14 @@ tasks:
           binary: bash
           args:
             - "src/evergreen/crypt_run_tests.sh"
+      - command: subprocess.exec
+        params:
+          binary: bash
+          add_expansions_to_env: true
+          args:
+            - "src/evergreen/run_python_script.sh"
+            - "evergreen/macos_notary.py"
+            - "mongo-crypt-dev.${ext|tgz}"
       - command: s3.put
         params:
           aws_key: ${aws_key}

etc/evergreen_yml_components/tasks/coverity_tasks.yml

@@ -0,0 +1,94 @@
+functions:
+  f_clone_source:
+    - &clone_source
+      display_name: "Cloning source to analyze"
+      command: git.get_project
+      params:
+        directory: src
+        clone_depth: 1
+        recurse_submodules: true
+
+    - &check
+      display_name: "Checking if project has needed Coverity config"
+      command: subprocess.exec
+      params:
+        add_expansions_to_env: true
+        redirect_standard_error_to_output: true
+        binary: "${module_prefix}/${module_name}/evergreen/coverity.sh"
+        args:
+          - "check"
+
+  f_download_and_extract_coverity:
+    - &assume_role
+      display_name: "Assuming IAM role"
+      command: ec2.assume_role
+      params:
+        role_arn: arn:aws:iam::557821124784:role/evergreen.evergreen.coverity
+
+    - &download_coverity_license
+      display_name: "downloading Coverity license file"
+      command: s3.get
+      params:
+        aws_key: ${AWS_ACCESS_KEY_ID}
+        aws_secret: ${AWS_SECRET_ACCESS_KEY}
+        aws_session_token: ${AWS_SESSION_TOKEN}
+        remote_file: license.dat
+        bucket: evergreen.coverity
+        local_file: license.dat
+
+    - &download_coverity_binary
+      display_name: "downloading Coverity binary"
+      command: s3.get
+      params:
+        aws_key: ${AWS_ACCESS_KEY_ID}
+        aws_secret: ${AWS_SECRET_ACCESS_KEY}
+        aws_session_token: ${AWS_SESSION_TOKEN}
+        remote_file: linux/x86_64/latest/coverity.tar.gz
+        bucket: evergreen.coverity
+        local_file: coverity.tar.gz
+
+    - &extract_coverity_binary
+      display_name: "Extracting Coverity binary tarball"
+      command: subprocess.exec
+      params:
+        add_expansions_to_env: true
+        redirect_standard_error_to_output: true
+        binary: "${module_prefix}/${module_name}/evergreen/coverity.sh"
+        args:
+          - "extract"
+
+  # Analyzes after build
+  f_analyze:
+    - command: subprocess.exec
+      params:
+        add_expansions_to_env: true
+        redirect_standard_error_to_output: true
+        binary: "${module_prefix}/${module_name}/evergreen/coverity.sh"
+        args:
+          - "analyze"
+
+  # Pushes results to Coverity server after a successful analysis
+  f_commit:
+    - command: subprocess.exec
+      params:
+        add_expansions_to_env: true
+        redirect_standard_error_to_output: true
+        binary: "${module_prefix}/${module_name}/evergreen/coverity.sh"
+        args:
+          - "commit"
+
+  # All in one function, from cloning to pushing results to Coverity server
+  f_run_coverity:
+    - *clone_source
+    - *check
+    - *assume_role
+    - *download_coverity_license
+    - *download_coverity_binary
+    - *extract_coverity_binary
+    - command: subprocess.exec
+      params:
+        add_expansions_to_env: true
+        redirect_standard_error_to_output: true
+        binary: "${module_prefix}/${module_name}/evergreen/coverity.sh"
+        args:
+          - "scan"

etc/evergreen_yml_components/tasks/misc_tasks.yml

@@ -631,37 +631,6 @@ tasks:
           target: >-
             //:format -- --check
 
-  # TODO(SERVER-97804): rename if display_name appears on the evergreen UI
-  - name: bazel_run_//:codeowners
-    tags:
-      [
-        "assigned_to_jira_team_devprod_build",
-        "development_critical_single_variant",
-        "lint",
-        "bazel_check",
-      ]
-    depends_on:
-      - name: version_expansions_gen
-        variant: generate-tasks-for-version
-    commands:
-      - command: timeout.update
-        params:
-          # 40 minutes
-          exec_timeout_secs: 2400
-      - func: "f_expansions_write"
-      - command: manifest.load
-      - func: "git get project and add git tag"
-      - func: "f_expansions_write"
-      - func: "kill processes"
-      - func: "cleanup environment"
-      - func: "set up venv"
-      - func: "upload pip requirements"
-      - func: "get engflow creds"
-      - func: "bazel run"
-        vars:
-          target: >-
-            //:codeowners -- --check
-
   # TODO(SERVER-97804): rename if display_name appears on the evergreen UI
   - name: bazel_run_//buildscripts:resmoke
     tags:

etc/evergreen_yml_components/tasks/release_tasks.yml

@@ -0,0 +1,52 @@
+tasks:
+  - name: publish-sast-report
+    tags: ["auxiliary", "assigned_to_jira_team_devprod_release_infrastructure"]
+    depends_on:
+      - name: version_expansions_gen
+        variant: generate-tasks-for-version
+    commands:
+      - command: git.get_project
+        params:
+          directory: src
+          clone_depth: 1
+          recurse_submodules: true
+      - func: "get version expansions"
+      - func: "apply version expansions"
+      - func: "f_expansions_write"
+      - command: subprocess.exec
+        display_name: Write credentials for SAST report generation to file
+        type: setup
+        params:
+          silent: true
+          binary: "${workdir}/src/evergreen/write_sast_report_env_file.sh"
+          env:
+            WORK_DIR: ${workdir}
+            SAST_REPORT_COVERITY_USERNAME: ${SAST_REPORT_COVERITY_USERNAME}
+            SAST_REPORT_COVERITY_PASSWORD: ${SAST_REPORT_COVERITY_PASSWORD}
+            SAST_REPORT_UPLOAD_GOOGLE_CLIENT_ID: ${SAST_REPORT_UPLOAD_GOOGLE_CLIENT_ID}
+            SAST_REPORT_UPLOAD_GOOGLE_CLIENT_REFRESH_TOKEN: ${SAST_REPORT_UPLOAD_GOOGLE_CLIENT_REFRESH_TOKEN}
+            SAST_REPORT_UPLOAD_GOOGLE_CLIENT_SECRET: ${SAST_REPORT_UPLOAD_GOOGLE_CLIENT_SECRET}
+      - command: subprocess.exec
+        display_name: "Generate SAST report and upload to Google Drive"
+        params:
+          binary: "${workdir}/src/evergreen/generate_sast_report.sh"
+          env:
+            WORK_DIR: ${workdir}
+            MODULE_PATH: ${workdir}/devprodCoveritySrc/devprod_coverity
+            TRIGGERED_BY_GIT_TAG: ${triggered_by_git_tag}
+            MONGODB_VERSION: ${version}
+            MONGODB_RELEASE_BRANCH: ${branch_name}
+            SAST_REPORT_TEST_GOOGLE_DRIVE_FOLDER_ID: ${SAST_REPORT_TEST_GOOGLE_DRIVE_FOLDER_ID}
+            SAST_REPORT_RELEASES_GOOGLE_DRIVE_FOLDER_ID: ${SAST_REPORT_RELEASES_GOOGLE_DRIVE_FOLDER_ID}
+      - command: s3.put
+        params:
+          aws_key: ${aws_key}
+          aws_secret: ${aws_secret}
+          bucket: mciuploads
+          content_type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
+          local_files_include_filter_prefix: devprodCoveritySrc/devprod_coverity
+          local_files_include_filter:
+            - "sast_report_*.xlsx"
+          remote_file: ${project}/${build_variant}/${revision}/artifacts/${build_id}/${task_name}/
+          permissions: private
+          visibility: signed

etc/evergreen_yml_components/tasks/resmoke/non_server_teams/tasks.yml

@@ -238,13 +238,6 @@ tasks:
       - func: "do setup"
       - func: "run tests"
 
-  - <<: *task_template
-    name: streams_kafka_gwproxy
-    tags: ["assigned_to_jira_team_streams", "experimental"]
-    commands:
-      - func: "do setup"
-      - func: "run tests"
-
   - <<: *task_template
     name: streams_kafka_benchmark
     tags: ["assigned_to_jira_team_streams", "experimental"]

etc/evergreen_yml_components/tasks/resmoke/server_divisions/clusters_and_integrations/tasks.yml

@@ -628,18 +628,6 @@ tasks:
     commands:
       - func: "generate resmoke tasks"
 
-  - <<: *gen_task_template
-    name: embedded_router_sharded_collections_jscore_passthrough_gen
-    tags:
-      [
-        "assigned_to_jira_team_server_catalog_and_routing",
-        "default",
-        "suggested_excluding_required__for_devprod_mitigation_only",
-        "embedded_router",
-      ]
-    commands:
-      - func: "generate resmoke tasks"
-
   - <<: *gen_task_template
     name: embedded_router_sharded_collections_jscore_txns_gen
     tags:
@@ -1068,12 +1056,18 @@ tasks:
       ]
     commands:
       - func: "generate resmoke tasks"
+        vars:
+          timeout_secs: 7200 # 2 hours
+          exec_timeout_secs: 21600 # 6 hours
 
   - <<: *gen_task_template
     name: auth_gen
     tags: ["assigned_to_jira_team_server_security", "release_critical", "auth"]
     commands:
       - func: "generate resmoke tasks"
+        vars:
+          timeout_secs: 7200 # 2 hours
+          exec_timeout_secs: 21600 # 6 hours
 
   - <<: *task_template
     name: client_encrypt
@@ -2112,6 +2106,21 @@ tasks:
         vars:
           use_large_distro: "true"
 
+  - <<: *gen_task_template
+    name: sharding_task_executor_pool_size_8_gen
+    tags:
+      [
+        "assigned_to_jira_team_server_cluster_scalability",
+        "default",
+        "incompatible_mac",
+        "sharding",
+        "common",
+      ]
+    commands:
+      - func: "generate resmoke tasks"
+        vars:
+          use_large_distro: "true"
+
   - <<: *gen_task_template
     name: sharding_hello_failures_gen
     tags:

etc/evergreen_yml_components/variants/amazon/test_dev.yml

@@ -143,8 +143,8 @@ buildvariants:
 
   - <<: *amazon_linux2_arm64_static_compile_variant_dependency
     name: enterprise-amazon-linux2-arm64
-    display_name: "* Amazon Linux 2 arm64 Atlas Enterprise"
-    tags: ["suggested", "forbid_tasks_tagged_with_experimental"]
+    display_name: "! Amazon Linux 2 arm64 Atlas Enterprise"
+    tags: ["required", "forbid_tasks_tagged_with_experimental"]
     cron: "0 */4 * * *" # From the ${project_required_suggested_cron} parameter
     run_on:
       - amazon2-arm64-atlas-latest-small
@@ -555,6 +555,7 @@ buildvariants:
         --ssl=off
         SHLINKFLAGS_EXTRA="-Wl,-Bsymbolic -Wl,--no-gnu-unique"
         CCFLAGS="-fno-gnu-unique"
+      evergreen_remote_exec: on
     run_on:
       - amazon2-arm64-latest-xlarge
     tasks:
@@ -583,6 +584,7 @@ buildvariants:
         --ssl=off
         SHLINKFLAGS_EXTRA="-Wl,-Bsymbolic -Wl,--no-gnu-unique"
         CCFLAGS="-fno-gnu-unique"
+      evergreen_remote_exec: on
     run_on:
       - amazon2023.3-arm64-xlarge
     tasks:
@@ -628,3 +630,77 @@ buildvariants:
     tasks:
       - name: compile_and_package_serial_no_unittests_TG
       - name: package_supplementary_data
+
+  - name: amazon2023-arm64-grav4
+    display_name: "Amazon Linux 2023 arm64 Graviton 4"
+    tags: ["bazel_check", "forbid_tasks_tagged_with_experimental"]
+    cron: "0 4 * * *" # From the ${project_nightly_cron} parameter.
+    run_on:
+      - amazon2023-arm64-latest-small-m8g
+    expansions:
+      compile_flags: >-
+        --ssl
+        MONGO_DISTMOD=amazon2023
+        -j$(grep -c ^processor /proc/cpuinfo)
+        --variables-files=etc/scons/mongodbtoolchain_stable_gcc.vars
+        BAZEL_FLAGS="--subcommands"
+        --modules=
+      compile_all_but_not_unittests_flags: >-
+        BAZEL_FLAGS="--linkopt=-s"
+      test_flags: >-
+        --excludeWithAnyTags=incompatible_with_amazon_linux,requires_external_data_source
+        --enableEnterpriseTests=off
+      has_packages: false
+      repo_edition: org
+      scons_cache_scope: shared
+      large_distro_name: amazon2023-arm64-latest-small-m8g
+      compile_variant: amazon2023-arm64
+    tasks:
+      - name: compile_test_and_package_serial_TG
+        distros:
+          - amazon2023-arm64-latest-large-m8g
+      - name: .development_critical !.requires_large_host !.incompatible_community
+      - name: .development_critical .requires_large_host !.incompatible_community
+        distros:
+          - amazon2023-arm64-latest-large-m8g
+      - name: .release_critical !.requires_large_host !.incompatible_community !.publish
+      - name: .release_critical .requires_large_host !.incompatible_community !.publish
+        distros:
+          - amazon2023-arm64-latest-large-m8g
+
+  - name: enterprise-amazon2023-arm64-grav4
+    display_name: "Enterprise Amazon Linux 2023 arm64 Graviton 4"
+    tags: ["forbid_tasks_tagged_with_experimental"]
+    cron: "0 4 * * *" # From the ${project_nightly_cron} parameter.
+    run_on:
+      - amazon2023-arm64-latest-small-m8g
+    expansions:
+      additional_package_targets: archive-mongocryptd archive-mongocryptd-debug
+      compile_flags: >-
+        --ssl
+        MONGO_DISTMOD=amazon2023
+        -j$(grep -c ^processor /proc/cpuinfo)
+        --variables-files=etc/scons/mongodbtoolchain_stable_gcc.vars
+      compile_all_but_not_unittests_flags: >-
+        BAZEL_FLAGS="--linkopt=-s"
+      crypt_task_compile_flags: SHLINKFLAGS_EXTRA="-Wl,-Bsymbolic -Wl,--no-gnu-unique" CCFLAGS="-fno-gnu-unique"
+      test_flags: --excludeWithAnyTags=incompatible_with_amazon_linux,requires_ldap_pool,requires_v4_0,requires_external_data_source
+      has_packages: false
+      multiversion_platform: amazon2023
+      multiversion_edition: enterprise
+      multiversion_architecture: aarch64
+      repo_edition: enterprise
+      scons_cache_scope: shared
+      compile_variant: enterprise-amazon2023-arm64-grav4
+    tasks:
+      - name: compile_test_and_package_serial_TG
+        distros:
+          - amazon2023-arm64-latest-large-m8g
+      - name: .development_critical !.requires_large_host
+      - name: .development_critical .requires_large_host
+        distros:
+          - amazon2023-arm64-latest-large-m8g
+      - name: .release_critical !.requires_large_host !.publish !.publish_crypt
+      - name: .release_critical .requires_large_host !.publish !.publish_crypt
+        distros:
+          - amazon2023-arm64-latest-large-m8g

etc/evergreen_yml_components/variants/amazon/test_dev_master_branch_only.yml

@@ -603,7 +603,6 @@ buildvariants:
           - amazon2-latest-large
       - name: streams
       - name: streams_kafka
-      - name: streams_kafka_gwproxy
       - name: streams_https
       - name: streams_lambda
 

etc/evergreen_yml_components/variants/amazon/test_release.yml

@@ -104,6 +104,105 @@ buildvariants:
         distros:
           - amazon2-latest-large
 
+  - name: amazon2-arm64
+    display_name: "Amazon Linux 2 arm64"
+    cron: "0 4 * * *" # From the ${project_nightly_cron} parameter.
+    run_on:
+      - amazon2-arm64-latest-small
+    expansions:
+      test_flags: >-
+        --excludeWithAnyTags=SERVER-34286,incompatible_with_amazon_linux,requires_external_data_source
+        --enableEnterpriseTests=off
+      push_path: linux
+      push_bucket: downloads.mongodb.org
+      push_name: linux
+      push_arch: aarch64-amazon2
+      compile_flags: >-
+        --ssl
+        MONGO_DISTMOD=amazon2
+        -j$(grep -c ^processor /proc/cpuinfo)
+        --variables-files=etc/scons/mongodbtoolchain_stable_gcc.vars
+        --modules=
+      compile_all_but_not_unittests_flags: >-
+        BAZEL_FLAGS="--linkopt=-s"
+      multiversion_platform: amazon2
+      multiversion_edition: targeted
+      has_packages: true
+      packager_script: packager.py
+      packager_arch: aarch64
+      packager_distro: amazon2
+      repo_edition: org
+      scons_cache_scope: shared
+      large_distro_name: amazon2-arm64-latest-large
+      compile_variant: amazon2-arm64
+    tasks:
+      - name: compile_test_and_package_serial_no_unittests_TG
+        distros:
+          - amazon2-arm64-latest-large
+      - name: test_packages
+        distros:
+          - ubuntu2204-arm64-large
+      - name: .development_critical !.incompatible_community !.requires_large_host
+      - name: .development_critical !.incompatible_community .requires_large_host
+        distros:
+          - amazon2-arm64-latest-large
+      - name: .release_critical !.incompatible_community !.requires_large_host
+      - name: .release_critical !.incompatible_community .requires_large_host
+        distros:
+          - amazon2-arm64-latest-large
+
+  - name: enterprise-amazon2-arm64
+    display_name: "Enterprise Amazon Linux 2 arm64"
+    cron: "0 4 * * *" # From the ${project_nightly_cron} parameter.
+    run_on:
+      - amazon2-arm64-latest-small
+    expansions:
+      additional_package_targets: >-
+        archive-mongocryptd
+        archive-mongocryptd-debug
+      test_flags: >-
+        --excludeWithAnyTags=SERVER-34286,incompatible_with_amazon_linux,requires_external_data_source,requires_ldap_pool
+      push_path: linux
+      push_bucket: downloads.10gen.com
+      push_name: linux
+      push_arch: aarch64-enterprise-amazon2
+      compile_flags: >-
+        --ssl
+        MONGO_DISTMOD=amazon2
+        -j$(grep -c ^processor /proc/cpuinfo)
+        --variables-files=etc/scons/mongodbtoolchain_stable_gcc.vars
+      compile_all_but_not_unittests_flags: >-
+        BAZEL_FLAGS="--linkopt=-s"
+      crypt_task_compile_flags: >-
+        SHLINKFLAGS_EXTRA="-Wl,-Bsymbolic -Wl,--no-gnu-unique"
+        CCFLAGS="-fno-gnu-unique"
+      multiversion_platform: amazon2
+      multiversion_edition: enterprise
+      has_packages: true
+      packager_script: packager_enterprise.py
+      packager_arch: aarch64
+      packager_distro: amazon2
+      repo_edition: enterprise
+      scons_cache_scope: shared
+      compile_variant: enterprise-amazon2-arm64
+      core_analyzer_distro_name: amazon2-arm64-latest-large
+      large_distro_name: amazon2-arm64-latest-large
+    tasks:
+      - name: compile_test_and_package_serial_no_unittests_TG
+        distros:
+          - amazon2-arm64-latest-large
+      - name: test_packages
+        distros:
+          - ubuntu2204-arm64-large
+      - name: .development_critical !.requires_large_host
+      - name: .development_critical .requires_large_host
+        distros:
+          - amazon2-arm64-latest-large
+      - name: .release_critical !.requires_large_host
+      - name: .release_critical .requires_large_host
+        distros:
+          - amazon2-arm64-latest-large
+
   - name: amazon2023
     display_name: Amazon Linux 2023.3
     tags: ["bazel_check", "forbid_tasks_tagged_with_experimental"]
@@ -431,7 +530,6 @@ buildvariants:
           - amazon2-latest-large
       - name: streams
       - name: streams_kafka
-      - name: streams_kafka_gwproxy
       - name: streams_kafka_benchmark
       - name: streams_https
       - name: streams_lambda

etc/evergreen_yml_components/variants/coverity.yml

@@ -0,0 +1,77 @@
+buildvariants:
+  - name: bv_coverity_analysis
+    display_name: Coverity Analysis
+    # Don't run Coverity analysis as part of patch builds
+    patchable: false
+    allow_for_git_tag: false
+    # Run at 4 am UTC everyday
+    cron: "0 4 * * *"
+    run_on: ubuntu2404-xlarge
+    modules:
+      - devprod_coverity
+    tasks:
+      - name: run_coverity
+
+functions:
+  f_generate_evergreen_bazelrc:
+    command: subprocess.exec
+    display_name: "generate evergreen bazelrc"
+    params:
+      binary: bash
+      args:
+        - "src/evergreen/generate_evergreen_bazelrc.sh"
+
+  f_setup_python:
+    command: subprocess.exec
+    display_name: "set up venv"
+    params:
+      binary: bash
+      args:
+        - "src/evergreen/functions/venv_setup.sh"
+
+  f_coverity_build:
+    command: subprocess.exec
+    display_name: "Coverity build"
+    params:
+      binary: bash
+      args:
+        - "src/evergreen/coverity_build.sh"
+      env:
+        COVERITY_INSTALL_ROOT: ${workdir}/coverity
+      add_expansions_to_env: true
+
+tasks:
+  - name: run_coverity
+    tags:
+      [
+        "assigned_to_jira_team_devprod_build",
+        "requires_large_host",
+        "auxiliary",
+        "coverity",
+      ]
+    exec_timeout_secs: 28800 # Max scan time of 8 hours
+    commands:
+      - func: f_clone_source
+        vars:
+          module_prefix: ${workdir}/devprodCoveritySrc
+          module_name: devprod_coverity
+      # Functions to prepare for Coverity build
+      - func: f_expansions_write
+      - func: f_setup_python
+      - func: f_expansions_write
+      - func: f_generate_evergreen_bazelrc
+      - func: f_download_and_extract_coverity
+        vars:
+          module_prefix: ${workdir}/devprodCoveritySrc
+          module_name: devprod_coverity
+      - func: f_coverity_build
+        timeout_secs: 10800 # Idle timeout of 3 hours
+      - func: f_analyze
+        vars:
+          module_prefix: ${workdir}/devprodCoveritySrc
+          module_name: devprod_coverity
+        timeout_secs: 10800 # Idle timeout of 3 hours
+      - func: f_commit
+        vars:
+          module_prefix: ${workdir}/devprodCoveritySrc
+          module_name: devprod_coverity

etc/evergreen_yml_components/variants/misc/misc.yml

@@ -18,10 +18,7 @@ buildvariants:
       burn_in_tag_exclude_build_variants: >-
         macos-debug-suggested
         ubuntu2204-arm64-bazel-compile
-      burn_in_tag_include_build_variants: >-
-        enterprise-rhel-8-64-bit-inmem
-        enterprise-rhel-8-64-bit-multiversion
-        amazon-linux2-arm64-try-sbe-engine
+      burn_in_tag_include_build_variants:
       burn_in_tag_compile_task_dependency: archive_dist_test
       compile_variant: &amazon_linux2_arm64_static_compile_variant_name amazon-linux2-arm64-static-compile
     depends_on:
@@ -40,6 +37,18 @@ buildvariants:
     tasks:
       - name: burn_in_tags_gen
 
+  - name: test-release
+    display_name: "Test Release"
+    # tasks may use "Admin Only" variables, so patch runs may only succeed for admins
+    allowed_requesters: ["commit", "patch"]
+    tags: ["assigned_to_jira_team_devprod_release_infrastructure"]
+    activate: true
+    run_on: ubuntu2404-small
+    modules:
+      - devprod_coverity
+    tasks:
+      - name: publish-sast-report
+
   - name: copybara-sync-between-repos
     display_name: "* Copybara Sync Between Repos"
     tags: ["suggested"]

etc/evergreen_yml_components/variants/release/release.yml

@@ -0,0 +1,10 @@
+buildvariants:
+  - name: release
+    display_name: Release
+    allowed_requesters: ["github_tag"]
+    tags: ["release", "assigned_to_jira_team_devprod_release_infrastructure"]
+    run_on: ubuntu2404-small
+    modules:
+      - devprod_coverity
+    tasks:
+      - name: publish-sast-report

etc/evergreen_yml_components/variants/rhel/test_dev_master_branch_only.yml

@@ -333,7 +333,6 @@ buildvariants:
     tasks:
       # TODO(SERVER-90936): Remove this once streams_kafka* and streams_lambda tests can work with the "default" tag.
       - name: streams_kafka
-      - name: streams_kafka_gwproxy
       - name: streams_lambda
       - name: product_limits
         cron: "0 4 * * 0" # From the ${project_weekly_cron} parameter

etc/evergreen_yml_components/variants/sanitizer/test_dev.yml

@@ -319,7 +319,7 @@ buildvariants:
           - rhel8.8-medium
 
   - <<: *linux_debug_aubsan_compile_variant_dependency
-    name: rhel8-debug-aubsan-lite-all-feature-flags-required
+    name: rhel8-debug-aubsan-lite-required
     display_name: "! Shared Library {A,UB}SAN Enterprise RHEL 8 DEBUG (all feature flags)"
     tags: ["required"]
     cron: "0 */4 * * *" # From the ${project_required_suggested_cron} parameter
@@ -330,7 +330,6 @@ buildvariants:
       # To force disable feature flags even on the all feature flags variant, please use this file:
       # buildscripts/resmokeconfig/fully_disabled_feature_flags.yml
       test_flags: >-
-        --runAllFeatureFlagTests
         --excludeWithAnyTags=incompatible_aubsan
     tasks:
       - name: jsCore

etc/evergreen_yml_components/variants/windows/test_dev.yml

@@ -114,7 +114,7 @@ buildvariants:
       - name: run_bazel_TG
 
   - <<: *windows_compile_variant_dependency
-    name: enterprise-windows-all-feature-flags-required
+    name: enterprise-windows-required
     display_name: "! Enterprise Windows Server 2022 (all feature flags) essential tasks"
     tags: ["required", "forbid_tasks_tagged_with_experimental"]
     cron: "0 */4 * * *" # From the ${project_required_suggested_cron} parameter
@@ -136,23 +136,22 @@ buildvariants:
       # To force disable feature flags even on the all feature flags variant, please use this file:
       # buildscripts/resmokeconfig/fully_disabled_feature_flags.yml
       test_flags: >-
-        --runAllFeatureFlagTests
         --excludeWithAnyTags=incompatible_with_windows_tls
       external_auth_jobs_max: 1
     tasks:
-      - name: .development_critical !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.incompatible_all_feature_flags .requires_execution_on_windows_patch_build
-      - name: .development_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.incompatible_all_feature_flags .requires_execution_on_windows_patch_build
+      - name: .development_critical !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.requires_all_feature_flags .requires_execution_on_windows_patch_build
+      - name: .development_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.requires_all_feature_flags .requires_execution_on_windows_patch_build
         distros:
           - windows-2022-xlarge
-      - name: .release_critical !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.incompatible_all_feature_flags .requires_execution_on_windows_patch_build
-      - name: .release_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.incompatible_all_feature_flags .requires_execution_on_windows_patch_build
+      - name: .release_critical !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.requires_all_feature_flags .requires_execution_on_windows_patch_build
+      - name: .release_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.requires_all_feature_flags .requires_execution_on_windows_patch_build
         distros:
           - windows-2022-xlarge
 
   # This Windows build variant exists to run all tasks that have been excluded from running on the required Windows build variant.
   # See SERVER-79037 for how the essential set of tasks was computed.
   - <<: *windows_compile_variant_dependency
-    name: enterprise-windows-all-feature-flags-non-essential
+    name: enterprise-windows-non-essential
     display_name: "* Enterprise Windows Server 2022 (all feature flags) non-essential tasks"
     tags: ["suggested"]
     cron: "0 */4 * * *" # From the ${project_required_suggested_cron} parameter
@@ -162,11 +161,11 @@ buildvariants:
       <<: *windows_essential_expansions
       burn_in_tests_build_variant: enterprise-windows-all-feature-flags-non-essential
     tasks:
-      - name: .development_critical !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.incompatible_all_feature_flags
-      - name: .development_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.incompatible_all_feature_flags
+      - name: .development_critical !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.requires_all_feature_flags
+      - name: .development_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.requires_all_feature_flags
         distros:
           - windows-2022-xlarge
-      - name: .release_critical !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.incompatible_all_feature_flags
-      - name: .release_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.incompatible_all_feature_flags
+      - name: .release_critical !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.requires_all_feature_flags
+      - name: .release_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.requires_all_feature_flags
         distros:
           - windows-2022-xlarge

etc/generate_subtasks_config.yml

@@ -9,6 +9,7 @@ build_variant_large_distro_exceptions:
   - enterprise-amazon2023-toolchain-v5
   # TODO(SERVER-85904) - enterprise-amazon2023-lto
   - enterprise-amazon2023-arm64
+  - enterprise-amazon2023-arm64-grav4
   - enterprise-amazon2023-arm64-toolchain-v5
   # TODO(SERVER-85904) - enterprise-amazon2023-arm64-lto
   - enterprise-debian12-64

etc/system_perf.yml

@@ -13,14 +13,12 @@ include:
   #
   - filename: evergreen/system_perf/master/base.yml
     module: dsi
-  - filename: evergreen/system_perf/master/compiles.yml
-    module: dsi
-  - filename: evergreen/system_perf/master/variants.yml
-    module: dsi
-  - filename: evergreen/system_perf/master/master_variants.yml
-    module: dsi
   - filename: evergreen/system_perf/shared_tasks.yml
     module: dsi
-  - filename: evergreen/system_perf/master/genny_tasks.yml
+  - filename: evergreen/system_perf/8.1/compiles.yml
+    module: dsi
+  - filename: evergreen/system_perf/8.1/variants.yml
+    module: dsi
+  - filename: evergreen/system_perf/8.1/genny_tasks.yml
     module: dsi
   ### lint_yaml trim end ###

evergreen/coverity_build.sh

@@ -0,0 +1,34 @@
+#!/bin/env bash
+
+set -eo pipefail
+
+cd src
+
+. evergreen/prelude_venv.sh
+activate_venv
+python buildscripts/install_bazel.py
+bazel_bin="$HOME/.local/bin/bazelisk"
+# number of parallel jobs to use for build.
+# Even with scale=0 (the default), bc command adds decimal digits in case of multiplication. Division by 1 gives us a whole number with scale=0
+bazel_jobs=$(bc <<< "$(grep -c '^processor' /proc/cpuinfo) * .85 / 1")
+build_config="--config=local --jobs=$bazel_jobs --compiler_type=gcc --opt=off --dbg=False --allocator=system"
+bazel_query='mnemonic("CppCompile|LinkCompile", filter(//src/mongo, deps(//:install-core)) except //src/mongo/db/modules/enterprise/src/streams/third_party/...)'
+bazel_cache="--output_user_root=$workdir/bazel_cache"
+
+python bazel/coverity/generate_coverity_command.py --bazel_executable=$bazel_bin --bazel_cache=$bazel_cache --bazel_query="$bazel_query" $build_config --noinclude_artifacts
+$bazel_bin $bazel_cache build $build_config --build_tag_filters=gen_source //src/...
+bazelBuildCommand="$bazel_bin $bazel_cache build $build_config //src/mongo/db/modules/enterprise/coverity:enterprise_coverity_build"
+echo "Bazel Build Command: $bazelBuildCommand"
+covIdir="$workdir/covIdir"
+if [ -d "$covIdir" ]; then
+  echo "covIdir already exists, meaning idir extracted after download from S3"
+else
+  mkdir $workdir/covIdir
+fi
+$workdir/coverity/bin/cov-build --dir "$covIdir" --verbose 0 -j $bazel_jobs --return-emit-failures --parse-error-threshold=99 --bazel $bazelBuildCommand
+ret=$?
+if [ $ret -ne 0 ]; then
+  echo "cov-build faild with exit code $ret"
+else
+  echo "cov-build was successful"
+fi

evergreen/download_db_contrib_tool.py

@@ -2,6 +2,7 @@ import gzip
 import os
 import pathlib
 import platform
+import re
 import stat
 import sys
 from urllib.request import urlretrieve
@@ -12,7 +13,7 @@ mongo_path = pathlib.Path(__file__).parents[1]
 sys.path.append(str(mongo_path))
 from buildscripts.util.expansions import get_expansion
 
-DB_CONTRIB_TOOL_VERSION = "v0.8.9"
+DB_CONTRIB_TOOL_VERSION = "v1.0.1"
 RELEASE_URL = (
     f"https://mdb-build-public.s3.amazonaws.com/db-contrib-tool-binaries/{DB_CONTRIB_TOOL_VERSION}/"
 )
@@ -32,6 +33,20 @@ def get_binary_name() -> str:
     if operating_system == "windows":
         binary_name = f"{binary_name}.exe"
 
+    # On ppc64le RHEL, pyinstaller builds are not forward compatible (At least not from RHEL 8 -> 9),
+    # so we need to create and name each binary with the exact OS.
+    if machine == "ppc64le":
+        # Get the major version from the release string
+        # like '4.18.0-513.5.1.el8_9.ppc64le' -> major release 8
+        major_version_match = re.findall("el(\d+)", os.uname().release)
+        assert len(major_version_match) == 1
+        major_version = int(major_version_match[0])
+
+        # db-contrib-tool 1.0.1 is only released up to RHEL 9 on PPC64LE
+        major_version = min(major_version, 9)
+
+        operating_system = f"rhel{major_version}"
+
     return binary_name