SERVER-111031 Cluster wide default read/write concerns are not honored during promotion to sharded (#46284)

Co-authored-by: Meryama Nadim <meryama.nadim@mongodb.com>
GitOrigin-RevId: 60692d74054a0bc73f181179e747815825de38ae

.bazelignore

@@ -5,6 +5,9 @@ src/third_party/protobuf/dist
 src/third_party/re2/dist
 src/third_party/tcmalloc/dist
 src/third_party/wiredtiger/dist
+bazel/auto_header/.auto_header
+src/mongo/db/modules/atlas/.auto_header
+src/mongo/db/modules/enterprise/.auto_header
 
 # Ignore node_modules due to the following error
 # ERROR: in verify_node_modules_ignored:

.bazelrc

@@ -88,6 +88,8 @@ common:macos --repo_env=LLVM_VERSION=19
 
 # Pin down the Microsoft Visual compiler. If you would like to use
 # the default compiler version installed in this host, comment the line.
+common:windows --repo_env=BAZEL_VS="C:/Program Files/Microsoft Visual Studio/2022/Professional"
+common:windows --repo_env=BAZEL_VC="C:/Program Files/Microsoft Visual Studio/2022/Professional/VC"
 common:windows --repo_env=BAZEL_VC_FULL_VERSION=14.31.31103
 
 # Default the Visual C Redistribution to v14.3 for Windows installer.
@@ -505,9 +507,6 @@ common:fission --remote_download_regex=.*\.dwo$
 # Avoid failing builds when BES metadata fails to upload.
 common --bes_upload_mode=fully_async
 
-# Default Mongo Version if a version is not specified.
-common --define=MONGO_VERSION=8.2.0-alpha
-
 # Default distmod if not specified.
 common --define=MONGO_DISTMOD=""
 
@@ -523,6 +522,9 @@ try-import %workspace%/.bazelrc.evergreen
 # local default dev settings
 try-import %workspace%/.bazelrc.common_bes
 
+# local default dev settings
+try-import %workspace%/.bazelrc.mongo_variables
+
 # local git version info
 try-import %workspace%/.bazelrc.git
 

.gitattributes

@@ -6,6 +6,7 @@
 external rules-lint-ignored=true
 **/*.tpl.h rules-lint-ignored=true
 **/*.tpl.cpp rules-lint-ignored=true
+rpm/*.spec rules-lint-ignored=true
 src/mongo/bson/column/bson_column_compressed_data.inl rules-lint-ignored=true
 *.idl linguist-language=yaml
 

.gitignore

@@ -280,10 +280,6 @@ package-lock.json
 # jstestfuzz generated test directory
 /jstestfuzz/
 
-# docker volumes mapped in lint_fuzzer_sanity_patch.py
-/jstestfuzzinput
-/jstestfuzzoutput
-
 # Bazel-related work
 # (Note that each string does NOT terminate with a '/' so that gitignore works properly)
 bazel-*
@@ -295,6 +291,8 @@ buildozer
 .bazelrc.gitinfo
 .bazelrc.workstation
 .bazelrc.common_bes
+.bazelrc.mongo_variables
+.bazelrc.mongo_version
 .bazelrc.compiledb
 .bazelrc.sync
 .compiledb
@@ -310,6 +308,8 @@ src/mongo/db/modules/enterprise/autogenerated_targets/BUILD.bazel
 .mongo_checks_module_path
 MODULE.bazel
 MODULE.bazel.lock
+.auto_header
+
 # generated configs for external fixture suites
 docker_compose/
 

.prettierignore

@@ -40,6 +40,9 @@ version_expansions.yml
 # Ignore all formatting in third_party/*
 src/third_party
 
+# this file is automatically generated and conforms to formatting requirements
+README.third_party.md
+
 # Ignore anything in the build output directories
 build
 bazel-*

BUILD.bazel

@@ -220,13 +220,13 @@ mongo_install(
         "//conditions:default": ["//src/mongo/db:mongod"],
     }),
     package_extract_name = select({
-        "//bazel/config:build_enterprise_linux_enabled": "mongodb-linux-{TARGET_CPU}-enterprise-{MONGO_DISTMOD}-{MONGO_VERSION}",
-        "//bazel/config:build_enterprise_linux_disabled": "mongodb-linux-{TARGET_CPU}-{MONGO_DISTMOD}-{MONGO_VERSION}",
-        "//bazel/config:build_enterprise_windows_enabled": "mongodb-win32-{TARGET_CPU}-enterprise-{MONGO_DISTMOD}-{MONGO_VERSION}",
-        "//bazel/config:build_enterprise_windows_disabled": "mongodb-win32-{TARGET_CPU}-{MONGO_DISTMOD}-{MONGO_VERSION}",
-        "//bazel/config:build_enterprise_mac_enabled": "mongodb-macos-{TARGET_CPU}-enterprise-{MONGO_DISTMOD}-{MONGO_VERSION}",
-        "//bazel/config:build_enterprise_mac_disabled": "mongodb-macos-{TARGET_CPU}-{MONGO_DISTMOD}-{MONGO_VERSION}",
-        "//conditions:default": "mongodb-{TARGET_CPU}-{MONGO_DISTMOD}-{MONGO_VERSION}",
+        "//bazel/config:build_enterprise_linux_enabled": "mongodb-linux-{MONGO_ARCH}-enterprise-{MONGO_DISTMOD}-{MONGO_VERSION}",
+        "//bazel/config:build_enterprise_linux_disabled": "mongodb-linux-{MONGO_ARCH}-{MONGO_DISTMOD}-{MONGO_VERSION}",
+        "//bazel/config:build_enterprise_windows_enabled": "mongodb-win32-{MONGO_ARCH}-enterprise-{MONGO_DISTMOD}-{MONGO_VERSION}",
+        "//bazel/config:build_enterprise_windows_disabled": "mongodb-win32-{MONGO_ARCH}-{MONGO_DISTMOD}-{MONGO_VERSION}",
+        "//bazel/config:build_enterprise_mac_enabled": "mongodb-macos-{MONGO_ARCH}-enterprise-{MONGO_DISTMOD}-{MONGO_VERSION}",
+        "//bazel/config:build_enterprise_mac_disabled": "mongodb-macos-{MONGO_ARCH}-{MONGO_DISTMOD}-{MONGO_VERSION}",
+        "//conditions:default": "mongodb-{MONGO_ARCH}-{MONGO_DISTMOD}-{MONGO_VERSION}",
     }),
     publish_debug_in_stripped = select({
         "@platforms//os:windows": True,

README.md

@@ -1,6 +1,6 @@
 # ![Logo](docs/leaf.svg) MongoDB README
 
-Welcome to MongoDB!
+Welcome to MongoDB 8.2!
 
 ## Components
 

README.third_party.md

@@ -21,132 +21,138 @@ not authored by MongoDB, and has a license which requires reproduction,
 a notice will be included in
 `THIRD-PARTY-NOTICES`.
 
-| Name                                                 | License                                                                                             | Vendored Version                         | Emits persisted data | Distributed in Release Binaries |
-| ---------------------------------------------------- | --------------------------------------------------------------------------------------------------- | ---------------------------------------- | -------------------- | ------------------------------- |
-| [Abseil]                                             | Apache-2.0                                                                                          | 20250512.1                               |                      | ✗                               |
-| [arximboldi/immer]                                   | BSL-1.0                                                                                             | Unknown                                  |                      | ✗                               |
-| [Asio C++ Library]                                   | BSL-1.0                                                                                             | 1.12.2                                   |                      | ✗                               |
-| [aws-sdk - the AWS SDK client library]               | Apache-2.0                                                                                          | 1.11.471                                 |                      | ✗                               |
-| [benchmark]                                          | Apache-2.0                                                                                          | v1.5.2                                   |                      |                                 |
-| [Boost C++ Libraries - boost]                        | BSL-1.0                                                                                             | 1.88.0                                   |                      | ✗                               |
-| [c-ares]                                             | MIT                                                                                                 | 1.27.0                                   |                      | ✗                               |
-| [concurrencytest]                                    | GPL-3.0-or-later                                                                                    | 0.1.2                                    | unknown              |                                 |
-| [Cyrus SASL]                                         | BSD-Attribution-HPND-disclaimer                                                                     | 2.1.28                                   | unknown              |                                 |
-| [dcleblanc/SafeInt]                                  | MIT                                                                                                 | 3.0.26                                   |                      | ✗                               |
-| [derickr/timelib]                                    | MIT                                                                                                 | 2022.13                                  |                      | ✗                               |
-| [discover]                                           | BSD-3-Clause                                                                                        | 0.4.0                                    | unknown              |                                 |
-| [fmtlib/fmt]                                         | MIT                                                                                                 | 11.1.3                                   |                      | ✗                               |
-| [folly]                                              | Apache-2.0                                                                                          | v2025.04.21.00                           |                      | ✗                               |
-| [google-re2]                                         | BSD-3-Clause                                                                                        | 2023-11-01                               |                      | ✗                               |
-| [google-snappy]                                      | BSD-3-Clause                                                                                        | 1.1.10                                   | ✗                    | ✗                               |
-| [google/s2geometry]                                  | Apache-2.0                                                                                          | Unknown                                  | ✗                    | ✗                               |
-| [gperftools]                                         | BSD-3-Clause                                                                                        | 2.9.1                                    |                      | ✗                               |
-| [grpc]                                               | Apache-2.0                                                                                          | 1.59.5                                   |                      | ✗                               |
-| [ICU for C/C++ (ICU4C)]                              | BSD-3-Clause, MIT v2 with Ad Clause License, Public Domain, BSD-2-Clause                            | 57.1                                     | ✗                    | ✗                               |
-| [Intel Decimal Floating-Point Math Library]          | BSD-3-Clause                                                                                        | v2.0 U1                                  |                      | ✗                               |
-| [jbeder/yaml-cpp]                                    | MIT                                                                                                 | 0.6.3                                    |                      | ✗                               |
-| [JSON-Schema-Test-Suite]                             | Unknown License                                                                                     | Unknown                                  |                      |                                 |
-| [libmongocrypt]                                      | Apache-2.0                                                                                          | 1.14.0                                   | ✗                    | ✗                               |
-| [librdkafka - the Apache Kafka C/C++ client library] | BSD-3-Clause, Xmlproc License, ISC, MIT, Public Domain, Zlib, BSD-2-Clause, Andreas Stolcke License | 2.0.2                                    |                      | ✗                               |
-| [LibTomCrypt]                                        | WTFPL, Public Domain                                                                                | 1.18.2                                   | ✗                    | ✗                               |
-| [libunwind/libunwind]                                | MIT                                                                                                 | v1.8.1                                   |                      | ✗                               |
-| [linenoise]                                          | BSD-2-Clause                                                                                        | Unknown                                  |                      | ✗                               |
-| [MongoDB C Driver]                                   | Apache-2.0                                                                                          | 1.28.1                                   | ✗                    | ✗                               |
-| [Mozilla Firefox]                                    | MPL-2.0                                                                                             | 128.11.0esr                              | unknown              | ✗                               |
-| [nlohmann-json]                                      | MIT                                                                                                 | 3.11.3                                   | ✗                    |                                 |
-| [nlohmann.json.decomposed]                           | MIT                                                                                                 | 3.10.5                                   | unknown              |                                 |
-| [node]                                               | ISC                                                                                                 | 22.1.0                                   | unknown              |                                 |
-| [ocspbuilder]                                        | MIT                                                                                                 | 0.10.2                                   |                      |                                 |
-| [ocspresponder]                                      | Apache-2.0                                                                                          | 0.5.0                                    |                      |                                 |
-| [opentelemetry-cpp]                                  | Apache-2.0                                                                                          | 1.17                                     | ✗                    |                                 |
-| [opentelemetry-proto]                                | Apache-2.0                                                                                          | 1.3.2                                    | ✗                    |                                 |
-| [PCRE2]                                              | BSD-3-Clause, Public Domain                                                                         | 10.40                                    |                      | ✗                               |
-| [Protobuf]                                           | BSD-3-Clause                                                                                        | v4.25.0                                  |                      | ✗                               |
-| [pyiso8601]                                          | MIT                                                                                                 | 2.1.0                                    | unknown              |                                 |
-| [RoaringBitmap/CRoaring]                             | Unknown License                                                                                     | v3.0.1                                   |                      | ✗                               |
-| [SchemaStore/schemastore]                            | Apache-2.0                                                                                          | Unknown                                  |                      |                                 |
-| [smhasher]                                           | Unknown License                                                                                     | Unknown                                  | unknown              | ✗                               |
-| [Snowball Stemming Algorithms]                       | BSD-3-Clause                                                                                        | 7b264ffa0f767c579d052fd8142558dc8264d795 | ✗                    | ✗                               |
-| [subunit]                                            | BSD-3-Clause, Apache-2.0                                                                            | 1.4.4                                    | unknown              |                                 |
-| [tcmalloc]                                           | Apache-2.0                                                                                          | 20230227-snapshot-093ba93c               |                      | ✗                               |
-| [testing-cabal/extras]                               | MIT                                                                                                 | 0.0.3                                    | unknown              |                                 |
-| [testscenarios]                                      | BSD-3-Clause, Apache-2.0                                                                            | 0.4                                      | unknown              |                                 |
-| [testtools]                                          | MIT                                                                                                 | 2.7.1                                    | unknown              |                                 |
-| [unicode-data]                                       | Unicode-DFS-2016                                                                                    | 8.0                                      | ✗                    | ✗                               |
-| [valgrind]                                           | GPL-2.0-or-later                                                                                    | Unknown                                  |                      | ✗                               |
-| [zlib]                                               | Zlib                                                                                                | v1.3.1                                   | ✗                    | ✗                               |
-| [zstd]                                               | BSD-3-Clause, GPL-2.0-or-later                                                                      | 1.5.5                                    | ✗                    | ✗                               |
+| Name                                                 | License                           | Vendored Version                         | Emits persisted data | Distributed in Release Binaries |
+| ---------------------------------------------------- | --------------------------------- | ---------------------------------------- | -------------------- | ------------------------------- |
+| [Abseil Common Libraries (C++)]                      | Apache-2.0                        | 20250512.1                               |                      | ✗                               |
+| [Asio C++ Library]                                   | BSL-1.0                           | 1.12.2                                   |                      | ✗                               |
+| [AWS SDK for C++]                                    | Apache-2.0                        | 1.11.471                                 |                      | ✗                               |
+| [benchmark]                                          | Apache-2.0                        | v1.5.2                                   |                      |                                 |
+| [Boost C++ Libraries]                                | BSL-1.0                           | 1.88.0                                   |                      | ✗                               |
+| [c-ares]                                             | MIT                               | 1.27.0                                   |                      | ✗                               |
+| [CRoaring]                                           | Apache-2.0 OR MIT                 | 3.0.1                                    |                      | ✗                               |
+| [Cyrus SASL]                                         | BSD-Attribution-HPND-disclaimer   | 2.1.28                                   |                      |                                 |
+| [fmt]                                                | MIT                               | 11.1.3                                   |                      | ✗                               |
+| [github.com/facebook/folly]                          | Apache-2.0                        | v2025.04.21.00                           |                      | ✗                               |
+| [gperftools]                                         | BSD-3-Clause                      | 2.9.1                                    |                      | ✗                               |
+| [gRPC (C++)]                                         | Apache-2.0                        | 1.59.5                                   |                      | ✗                               |
+| [immer]                                              | BSL-1.0                           | 0.8.0                                    |                      | ✗                               |
+| [Intel® Decimal Floating-Point Math Library]         | BSD-3-Clause                      | v2.0U1                                   |                      | ✗                               |
+| [International Components for Unicode C/C++ (ICU4C)] | Unicode-3.0                       | 57.1                                     | ✗                    | ✗                               |
+| [JSON Schema Store]                                  | Apache-2.0                        | 6847cfc3a17a04a7664474212db50c627e1e3408 |                      |                                 |
+| [JSON-Schema-Test-Suite]                             | MIT                               | 728066f9c5c258ba3b1804a22a5b998f2ec77ec0 |                      |                                 |
+| [libmongocrypt]                                      | Apache-2.0                        | 1.14.0                                   | ✗                    | ✗                               |
+| [librdkafka - The Apache Kafka C/C++ library]        | BSD-2-Clause                      | 2.0.2                                    |                      | ✗                               |
+| [LibTomCrypt]                                        | Unlicense                         | 1.18.2                                   | ✗                    | ✗                               |
+| [libunwind]                                          | MIT                               | v1.8.1                                   |                      | ✗                               |
+| [linenoise]                                          | BSD-2-Clause                      | 6cdc775807e57b2c3fd64bd207814f8ee1fe35f3 |                      | ✗                               |
+| [MongoDB C Driver]                                   | Apache-2.0                        | 1.28.1                                   | ✗                    | ✗                               |
+| [Mozilla Firefox ESR]                                | MPL-2.0                           | 128.11.0esr                              |                      | ✗                               |
+| [MurmurHash3]                                        | Public Domain                     | a6bd3ce7be8ad147ea820a7cf6229a975c0c96bb |                      | ✗                               |
+| [nlohmann/json]                                      | MIT                               | 3.10.5                                   |                      |                                 |
+| [nlohmann/json]                                      | MIT                               | 3.11.3                                   | ✗                    |                                 |
+| [node]                                               | ISC                               | 22.1.0                                   |                      |                                 |
+| [opentelemetry-cpp]                                  | Apache-2.0                        | 1.17                                     | ✗                    |                                 |
+| [opentelemetry-proto]                                | Apache-2.0                        | 1.3.2                                    | ✗                    |                                 |
+| [PCRE2 - Perl-Compatible Regular Expressions]        | BSD-3-Clause WITH PCRE2-exception | 10.40                                    |                      | ✗                               |
+| [Protobuf]                                           | BSD-3-Clause                      | v4.25.0                                  |                      | ✗                               |
+| [pypi/asn1crypto]                                    | MIT                               | 1.5.1                                    |                      |                                 |
+| [pypi/concurrencytest]                               | GPL-3.0-or-later                  | 0.1.2                                    |                      |                                 |
+| [pypi/discover]                                      | BSD-3-Clause                      | 0.4.0                                    |                      |                                 |
+| [pypi/extras]                                        | MIT                               | 0.0.3                                    |                      |                                 |
+| [pypi/iso8601]                                       | MIT                               | 2.1.0                                    |                      |                                 |
+| [pypi/ocspbuilder]                                   | MIT                               | 0.10.2                                   |                      |                                 |
+| [pypi/ocspresponder]                                 | Apache-2.0                        | 0.5.0                                    |                      |                                 |
+| [pypi/oscrypto]                                      | MIT                               | 1.3.0                                    |                      |                                 |
+| [pypi/python-subunit]                                | (Apache-2.0 OR BSD-3-Clause)      | 1.4.4                                    |                      |                                 |
+| [pypi/testscenarios]                                 | BSD-3-Clause                      | 0.4                                      |                      |                                 |
+| [pypi/testtools]                                     | MIT                               | 2.7.1                                    |                      |                                 |
+| [re2]                                                | BSD-3-Clause                      | 2023-11-01                               |                      | ✗                               |
+| [S2 Geometry Library]                                | Apache-2.0                        | c872048da5d1                             | ✗                    | ✗                               |
+| [SafeInt]                                            | MIT                               | 3.0.26                                   |                      | ✗                               |
+| [snappy]                                             | BSD-3-Clause                      | 1.1.10                                   | ✗                    | ✗                               |
+| [Snowball Stemming Algorithms (libstemmer)]          | BSD-3-Clause                      | 7b264ffa0f767c579d052fd8142558dc8264d795 | ✗                    | ✗                               |
+| [tcmalloc]                                           | Apache-2.0                        | 093ba93c1bd6dca03b0a8334f06d01b019244291 |                      | ✗                               |
+| [timelib]                                            | MIT                               | 2022.13                                  |                      | ✗                               |
+| [Unicode Character Database]                         | Unicode-DFS-2016                  | 8.0.0                                    | ✗                    | ✗                               |
+| [valgrind.h]                                         | BSD-4-Clause                      | 3.17.0                                   |                      | ✗                               |
+| [WiredTiger]                                         | GPL-2.0-only OR GPL-3.0-only      | mongodb-8.2                              | ✗                    | ✗                               |
+| [yaml-cpp]                                           | MIT                               | 0.6.3                                    |                      | ✗                               |
+| [zlib]                                               | Zlib                              | 1.3.1                                    | ✗                    | ✗                               |
+| [Zstandard (zstd)]                                   | BSD-3-Clause OR GPL-2.0-only      | 1.5.5                                    | ✗                    | ✗                               |
 
-[Abseil]: https://github.com/abseil/abseil-cpp
+[AWS SDK for C++]: https://github.com/aws/aws-sdk-cpp
+[Abseil Common Libraries (C++)]: https://github.com/abseil/abseil-cpp
 [Asio C++ Library]: https://github.com/chriskohlhoff/asio
-[Boost C++ Libraries - boost]: http://www.boost.org/
+[Boost C++ Libraries]: http://www.boost.org/
+[CRoaring]: https://github.com/RoaringBitmap/CRoaring
 [Cyrus SASL]: https://www.cyrusimap.org/sasl/
-[ICU for C/C++ (ICU4C)]: http://site.icu-project.org/download/
-[Intel Decimal Floating-Point Math Library]: https://software.intel.com/en-us/articles/intel-decimal-floating-point-math-library
+[Intel® Decimal Floating-Point Math Library]: https://software.intel.com/en-us/articles/intel-decimal-floating-point-math-library
+[International Components for Unicode C/C++ (ICU4C)]: http://site.icu-project.org/download/
+[JSON Schema Store]: https://www.schemastore.org/json/
 [JSON-Schema-Test-Suite]: https://github.com/json-schema-org/JSON-Schema-Test-Suite
 [LibTomCrypt]: https://github.com/libtom/libtomcrypt/releases
 [MongoDB C Driver]: https://github.com/mongodb/mongo-c-driver
-[Mozilla Firefox]: https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr
-[PCRE2]: http://www.pcre.org/
+[Mozilla Firefox ESR]: https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr
+[MurmurHash3]: https://github.com/aappleby/smhasher/blob/a6bd3ce/
+[PCRE2 - Perl-Compatible Regular Expressions]: http://www.pcre.org/
 [Protobuf]: https://github.com/protocolbuffers/protobuf
-[RoaringBitmap/CRoaring]: https://github.com/RoaringBitmap/CRoaring
-[SchemaStore/schemastore]: https://www.schemastore.org/json/
-[Snowball Stemming Algorithms]: https://github.com/snowballstem/snowball
-[arximboldi/immer]: https://github.com/arximboldi/immer
-[aws-sdk - the AWS SDK client library]: https://github.com/aws/aws-sdk-cpp
+[S2 Geometry Library]: https://github.com/google/s2geometry
+[SafeInt]: https://github.com/dcleblanc/SafeInt
+[Snowball Stemming Algorithms (libstemmer)]: https://github.com/snowballstem/snowball
+[Unicode Character Database]: http://www.unicode.org/versions/enumeratedversions.html
+[WiredTiger]: https://source.wiredtiger.com/
+[Zstandard (zstd)]: https://github.com/facebook/zstd
 [benchmark]: https://github.com/google/benchmark
 [c-ares]: https://c-ares.org/
-[concurrencytest]: https://pypi.org/project/concurrencytest/
-[dcleblanc/SafeInt]: https://github.com/dcleblanc/SafeInt
-[derickr/timelib]: https://github.com/derickr/timelib
-[discover]: https://pypi.org/project/discover/
-[fmtlib/fmt]: http://fmtlib.net/
-[folly]: https://github.com/facebook/folly
-[google-re2]: https://github.com/google/re2
-[google-snappy]: https://github.com/google/snappy/releases
-[google/s2geometry]: https://github.com/google/s2geometry
+[fmt]: http://fmtlib.net/
+[gRPC (C++)]: https://github.com/grpc/grpc
+[github.com/facebook/folly]: https://github.com/facebook/folly
 [gperftools]: https://github.com/gperftools/gperftools
-[grpc]: https://github.com/grpc/grpc
-[jbeder/yaml-cpp]: https://github.com/jbeder/yaml-cpp/releases
+[immer]: https://github.com/arximboldi/immer
 [libmongocrypt]: https://github.com/mongodb/libmongocrypt
-[librdkafka - the Apache Kafka C/C++ client library]: https://github.com/confluentinc/librdkafka
-[libunwind/libunwind]: http://www.github.com/libunwind/libunwind
+[librdkafka - The Apache Kafka C/C++ library]: https://github.com/confluentinc/librdkafka
+[libunwind]: http://www.github.com/libunwind/libunwind
 [linenoise]: https://github.com/antirez/linenoise
-[nlohmann-json]: https://github.com/open-telemetry/opentelemetry-proto
-[nlohmann.json.decomposed]: https://www.nuget.org/packages/nlohmann.json.decomposed
+[nlohmann/json]: https://github.com/nlohmann/json
+[nlohmann/json]: https://github.com/open-telemetry/opentelemetry-proto
 [node]: https://nodejs.org/en/blog/release
-[ocspbuilder]: https://github.com/wbond/ocspbuilder
-[ocspresponder]: https://github.com/threema-ch/ocspresponder
 [opentelemetry-cpp]: https://github.com/open-telemetry/opentelemetry-cpp/
 [opentelemetry-proto]: https://github.com/open-telemetry/opentelemetry-proto
-[pyiso8601]: https://pypi.org/project/iso8601/
-[smhasher]: https://github.com/aappleby/smhasher/blob/a6bd3ce/
-[subunit]: https://github.com/testing-cabal/subunit
+[pypi/asn1crypto]: https://github.com/wbond/asn1crypto
+[pypi/concurrencytest]: https://pypi.org/project/concurrencytest/
+[pypi/discover]: https://pypi.org/project/discover/
+[pypi/extras]: https://github.com/testing-cabal/extras
+[pypi/iso8601]: https://pypi.org/project/iso8601/
+[pypi/ocspbuilder]: https://github.com/wbond/ocspbuilder
+[pypi/ocspresponder]: https://github.com/threema-ch/ocspresponder
+[pypi/oscrypto]: https://github.com/wbond/oscrypto
+[pypi/python-subunit]: https://github.com/testing-cabal/subunit
+[pypi/testscenarios]: https://pypi.org/project/testscenarios/
+[pypi/testtools]: https://github.com/testing-cabal/testtools
+[re2]: https://github.com/google/re2
+[snappy]: https://github.com/google/snappy/releases
 [tcmalloc]: https://github.com/google/tcmalloc
-[testing-cabal/extras]: https://github.com/testing-cabal/extras
-[testscenarios]: https://pypi.org/project/testscenarios/
-[testtools]: https://github.com/testing-cabal/testtools
-[unicode-data]: http://www.unicode.org/versions/enumeratedversions.html
-[valgrind]: http://valgrind.org/downloads/current.html
+[timelib]: https://github.com/derickr/timelib
+[valgrind.h]: http://valgrind.org/downloads/current.html
+[yaml-cpp]: https://github.com/jbeder/yaml-cpp/releases
 [zlib]: https://zlib.net/
-[zstd]: https://github.com/facebook/zstd
 
 ## WiredTiger Vendored Test Libraries
 
-The following Python libraries are transitively included by WiredTiger,
+The following libraries are transitively included by WiredTiger,
 and are used by that component for testing. They don't appear in
 released binary artifacts.
 
-| Name                     |
-| ------------------------ |
-| concurrencytest          |
-| discover                 |
-| nlohmann.json.decomposed |
-| pyiso8601                |
-| subunit                  |
-| testing-cabal/extras     |
-| testscenarios            |
-| testtools                |
+| Name                       |
+| -------------------------- |
+| nlohmann/json@3.10.5       |
+| pypi/concurrencytest@0.1.2 |
+| pypi/discover@0.4.0        |
+| pypi/extras@0.0.3          |
+| pypi/iso8601@2.1.0         |
+| pypi/python-subunit@1.4.4  |
+| pypi/testscenarios@0.4     |
+| pypi/testtools@2.7.1       |
 
 ## Dynamically Linked Libraries
 

bazel/config/generate_config_header.bzl

@@ -1,7 +1,7 @@
 load("@bazel_tools//tools/cpp:toolchain_utils.bzl", "find_cpp_toolchain")
 load("@bazel_tools//tools/build_defs/cc:action_names.bzl", "ACTION_NAMES")
 load("//bazel/config:configs.bzl", "sdkroot_provider")
-load("//bazel:mongo_src_rules.bzl", "write_target")
+load("//bazel:utils.bzl", "write_target")
 
 def generate_config_header_impl(ctx):
     cc_toolchain = find_cpp_toolchain(ctx)

bazel/config/render_template.bzl

@@ -1,4 +1,4 @@
-load("//bazel:mongo_src_rules.bzl", "write_target")
+load("//bazel:utils.bzl", "write_target")
 
 def render_template_impl(ctx):
     python = ctx.toolchains["@bazel_tools//tools/python:toolchain_type"].py3_runtime

bazel/coverity/BUILD.bazel

@@ -1,5 +1,5 @@
 py_binary(
-    name = "generate_coverity_command",
-    srcs = ["generate_coverity_command.py"],
+    name = "generate_coverity_targets",
+    srcs = ["generate_coverity_targets.py"],
     visibility = ["//visibility:public"],
 )

bazel/coverity/generate_coverity_targets.py

@@ -17,45 +17,27 @@ bazel_cache = os.path.expanduser(args.bazel_cache)
 # the cc_library and cc_binaries in our build. There is not a good way from
 # within the build to get all those targets, so we will generate the list via query
 # https://sig-product-docs.synopsys.com/bundle/coverity-docs/page/coverity-analysis/topics/building_with_bazel.html#build_with_bazel
-proc = subprocess.run(
+cmd = (
     [
         bazel_executable,
         bazel_cache,
         "aquery",
     ]
     + bazel_cmd_args
-    + [args.bazel_query],
+    + [args.bazel_query]
+)
+print(f"Running command: {cmd}")
+proc = subprocess.run(
+    cmd,
     stdout=subprocess.PIPE,
     stderr=subprocess.PIPE,
     text=True,
 )
 
+print(proc.stderr)
+
 targets = set()
-for line in proc.stdout.splitlines():
-    if line.startswith("  Target: "):
-        targets.add(line.split()[-1])
-
-
-enterprise_coverity_dir = os.path.join("src", "mongo", "db", "modules", "enterprise", "coverity")
-os.makedirs(enterprise_coverity_dir, exist_ok=True)
-with open(os.path.join(enterprise_coverity_dir, "BUILD.bazel"), "w") as buildfile:
-    buildfile.write("""\
-load("@rules_coverity//coverity:defs.bzl", "cov_gen_script")
-cov_gen_script(
-    name="enterprise_coverity_build",
-    testonly=True,
-    tags=["coverity"],
-    deps=[
-""")
-    for target in targets:
-        buildfile.write(
-            """\
-        "%s",
-"""
-            % target
-        )
-
-    buildfile.write("""\
-    ],
-)
-""")
+with open("coverity_targets.list", "w") as f:
+    for line in proc.stdout.splitlines():
+        if line.startswith("  Target: "):
+            f.write(line.split()[-1] + "\n")

bazel/format/BUILD.bazel

@@ -35,6 +35,7 @@ format_multirun(
     graphql = "//:prettier",
     html = "//:prettier",
     markdown = "//:prettier",
+    python = "@aspect_rules_lint//format:ruff",
     shell = "@shfmt//:shfmt",
     sql = "//:prettier",
     starlark = "@buildifier_prebuilt//:buildifier",

bazel/mongo_src_rules.bzl

@@ -33,6 +33,9 @@ load(
 )
 load("@local_host_values//:local_host_values_set.bzl", "NUM_CPUS")
 load("@evergreen_variables//:evergreen_variables.bzl", "UNSAFE_COMPILE_VARIANT", "UNSAFE_VERSION_ID")
+load("//bazel/toolchains/cc/mongo_windows:mongo_windows_cc_toolchain_config.bzl", "MIN_VER_MAP")
+load("@bazel_skylib//rules:common_settings.bzl", "BuildSettingInfo")
+load("//bazel/config:generate_config_header.bzl", "generate_config_header")
 
 # These will throw an error if the following condition is not met:
 # (libunwind == on && os == linux) || libunwind == off || libunwind == auto
@@ -1117,27 +1120,6 @@ idl_generator_rule = rule(
     fragments = ["py"],
 )
 
-def write_target_impl(ctx):
-    out = ctx.actions.declare_file(ctx.label.name + ".gen_source_list")
-    ctx.actions.write(
-        out,
-        "//" + ctx.label.package + ":" + ctx.attr.target_name,
-    )
-    return [
-        DefaultInfo(
-            files = depset([out]),
-        ),
-    ]
-
-write_target = rule(
-    write_target_impl,
-    attrs = {
-        "target_name": attr.string(
-            doc = "the name of the target to record",
-        ),
-    },
-)
-
 def idl_generator(name, tags = [], **kwargs):
     idl_generator_rule(
         name = name,
@@ -1464,3 +1446,155 @@ def mongo_cc_fuzzer_test(
         exec_properties = exec_properties,
         **kwargs
     )
+
+def _compute_win_defines(ver):
+    if ver not in MIN_VER_MAP:
+        fail("Unsupported windows_version_minimal=%r; supported: %r" %
+             (ver, sorted(MIN_VER_MAP.keys())))
+    m = MIN_VER_MAP[ver]
+    return [
+        "_WIN32_WINNT=%s" % m["win"],
+        "BOOST_USE_WINAPI_VERSION=%s" % m["win"],
+        "NTDDI_VERSION=%s" % m["ddi"],
+    ]
+
+def _rc_impl(ctx):
+    # No-op on non-Windows
+    if not ctx.target_platform_has_constraint(
+        ctx.attr._os_windows[platform_common.ConstraintValueInfo],
+    ):
+        li = cc_common.create_linker_input(
+            owner = ctx.label,
+            user_link_flags = [],
+            additional_inputs = depset(),  # and declare it as a link input
+        )
+        new_cc_shared_info = CcSharedLibraryInfo(
+            dynamic_deps = depset(),
+            exports = [],
+            linker_input = li,
+            link_once_static_libs = {},
+        )
+
+        return [DefaultInfo(files = depset([])), CcInfo(), new_cc_shared_info]
+
+    new_cc_shared_info = CcSharedLibraryInfo(
+        dynamic_deps = depset(),
+        exports = [],
+        linker_input = None,
+        link_once_static_libs = {},
+    )
+
+    # On Windows we need an rc executable
+    if ctx.executable.rc == None:
+        fail("windows_rc: 'rc' tool not provided. Pass rc = '@mongo_windows_toolchain//:rc' (or your wrapper).")
+
+    out = ctx.actions.declare_file(ctx.label.name + ".res")
+
+    defines = []
+    if ctx.attr.windows_version_minimal:
+        ver = ctx.attr.windows_version_minimal[BuildSettingInfo].value
+        defines += _compute_win_defines(ver)
+    defines += ctx.attr.defines
+
+    include_dirs = ["src", ctx.file.src.dirname]
+
+    # Add $(GENDIR)/src (use backslashes for rc.exe friendliness)
+    gen_src = ctx.var["GENDIR"] + "\\src"
+    include_dirs.append(gen_src)
+
+    args = ctx.actions.args()
+    args.add("/nologo")
+    for inc in include_dirs:
+        args.add("/I", inc)
+    for d in defines:
+        args.add("/d", d)
+    args.add("/fo" + out.path)  # /fo must be joined
+    args.add(ctx.file.src.path)
+
+    ctx.actions.run(
+        executable = ctx.executable.rc,  # your wrapper
+        arguments = [args],
+        inputs = [ctx.file.src] + ctx.files.resources,
+        outputs = [out],
+        mnemonic = "WindowsRC",
+    )
+
+    li = cc_common.create_linker_input(
+        owner = ctx.label,
+        user_link_flags = [out.path],  # put .res on the link line
+        additional_inputs = depset([out]),  # and declare it as a link input
+    )
+    lc = cc_common.create_linking_context(linker_inputs = depset([li]))
+    new_cc_shared_info = CcSharedLibraryInfo(
+        dynamic_deps = depset(),
+        exports = [],
+        linker_input = li,
+        link_once_static_libs = {},
+    )
+
+    return [DefaultInfo(files = depset([out])), CcInfo(linking_context = lc), new_cc_shared_info]
+
+windows_rc_rule = rule(
+    implementation = _rc_impl,
+    attrs = {
+        "src": attr.label(mandatory = True, allow_single_file = [".rc"]),
+        "resources": attr.label_list(allow_files = True),
+        "defines": attr.string_list(),
+        "rc": attr.label(executable = True, cfg = "exec", allow_files = True),
+        "windows_version_minimal": attr.label(),
+        "_os_windows": attr.label(
+            default = Label("@platforms//os:windows"),
+            providers = [platform_common.ConstraintValueInfo],
+        ),
+    },
+    provides = [CcInfo],
+    fragments = ["cpp"],
+)
+
+def windows_rc(name, src, manifest_in = None, icon = None):
+    if manifest_in:
+        # Turn "foo.manifest.in" into "foo.manifest"
+        out_manifest = manifest_in[:-3] if manifest_in.endswith(".in") else manifest_in
+
+        generate_config_header(
+            name = name + "_manifest_gen",
+            checks = "//src/mongo/util:version_constants_gen.py",
+            cpp_defines = [],
+            cpp_linkflags = [],
+            cpp_opts = [],
+            extra_definitions = {
+                "MONGO_DISTMOD": "$(MONGO_DISTMOD)",
+                "MONGO_VERSION": "$(MONGO_VERSION)",
+                "GIT_COMMIT_HASH": "$(GIT_COMMIT_HASH)",
+            } | select({
+                "//bazel/config:js_engine_mozjs": {"js_engine_ver": "mozjs"},
+                "//conditions:default": {"js_engine_ver": "none"},
+            }) | select({
+                "//bazel/config:tcmalloc_google_enabled": {"MONGO_ALLOCATOR": "tcmalloc-google"},
+                "//bazel/config:tcmalloc_gperf_enabled": {"MONGO_ALLOCATOR": "tcmalloc-gperf"},
+                "//conditions:default": {"MONGO_ALLOCATOR": "system"},
+            }) | select({
+                "//bazel/config:build_enterprise_enabled": {"build_enterprise_enabled": "1"},
+                "//conditions:default": {},
+            }),
+            logfile = name + "_manifest_gen.log",
+            output = out_manifest,
+            template = manifest_in,
+        )
+
+    resources = ["//src/mongo/util:rc_constants_gen"]
+    if manifest_in:
+        resources.append(name + "_manifest_gen")
+    if icon:
+        resources.append(icon)
+
+    windows_rc_rule(
+        name = name,
+        src = src,
+        resources = resources,
+        rc = select({
+            "@platforms//os:windows": "@mongo_windows_toolchain//:rc",
+            "//conditions:default": None,
+        }),
+        windows_version_minimal = "//bazel/config:win_min_version",
+    )

bazel/toolchains/cc/mongo_windows/mongo_toolchain.BUILD.tmpl

@@ -39,6 +39,14 @@ mongo_windows_cc_toolchain_config(
     supports_parse_showincludes = True,
 )
 
+exports_files(["rc_wrapper.cmd"])
+
+alias(
+    name = "rc",
+    actual = "rc_wrapper.cmd",
+    visibility = ["//visibility:public"]
+)
+
 cc_toolchain(
     name = "mongo_win_cc_toolchain",
     all_files = ":all_files",

bazel/toolchains/cc/mongo_windows/mongo_toolchain.bzl

@@ -11,6 +11,41 @@ load(
     "setup_vc_env_vars",
 )
 
+def _compute_rc_path(ctx, env_vars):
+    # Allow an explicit override from CI/dev
+    rc_path = ctx.os.environ.get("RC_PATH")
+    if rc_path and ctx.path(rc_path).exists:
+        return rc_path.replace("\\", "/")
+
+    winsdkdir = (env_vars.get("WINDOWSSDKDIR") or "").rstrip("\\/")
+    sdkver = (env_vars.get("WindowsSDKVersion") or "").strip("\\/")
+
+    # Typical locations in recent SDKs
+    candidates = []
+    if winsdkdir:
+        if sdkver:
+            candidates += [
+                "%s\\bin\\%s\\x64\\rc.exe" % (winsdkdir, sdkver),
+                "%s\\bin\\%s\\x86\\rc.exe" % (winsdkdir, sdkver),
+            ]
+        candidates += [
+            "%s\\bin\\x64\\rc.exe" % winsdkdir,
+            "%s\\bin\\x86\\rc.exe" % winsdkdir,
+        ]
+
+    # Fallback to LLVM if present
+    llvm = ctx.os.environ.get("BAZEL_LLVM")
+    if llvm:
+        candidates += [
+            "%s\\bin\\llvm-rc.exe" % llvm,
+            "%s\\bin\\rc.exe" % llvm,  # some layouts
+        ]
+
+    for c in candidates:
+        if ctx.path(c).exists:
+            return c.replace("\\", "/")
+    return None
+
 def _impl_gen_windows_toolchain_build_file(ctx):
     if "windows" not in ctx.os.name:
         ctx.file(
@@ -85,6 +120,21 @@ def _impl_gen_windows_toolchain_build_file(ctx):
     # purpose.
     ctx.file("windows_toolchain_config.json", json.encode(substitutions), executable = False)
 
+    # --- expose rc.exe/llvm-rc.exe as a stable label in this repo ---
+    # Ask VS env for SDK location/version (setup_vc_env_vars already did that).
+    # Add WindowsSDKVersion to your setup_vc_env_vars() if not already included.
+    rc_path = _compute_rc_path(ctx, vars)
+    if not rc_path:
+        auto_configure_fail(
+            "Could not locate rc.exe (or llvm-rc.exe). Set RC_PATH or ensure Windows SDK is installed and WindowsSDKVersion is exported.",
+        )
+
+    ctx.file(
+        "rc_wrapper.cmd",
+        "@echo off\r\nsetlocal\r\nset \"INCLUDE=%s\"\r\nset \"PATH=%s\"\r\n\"%s\" %%*\r\n" % (vars["INCLUDE"], vars["PATH"], rc_path),
+        executable = True,
+    )
+
     ctx.report_progress("Generating toolchain build file")
     ctx.template(
         "BUILD.bazel",

bazel/toolchains/cc/mongo_windows/mongo_windows_cc_toolchain_config.bzl

@@ -36,6 +36,16 @@ load(
     "with_feature_set",
 )
 
+# The values are populated from the following link:
+#    https://learn.microsoft.com/en-us/cpp/porting/modifying-winver-and-win32-winnt?view=msvc-170
+# For future versions, please add it in the map.
+MIN_VER_MAP = {
+    "10": {
+        "win": "0x0A00",
+        "ddi": "0x0A000000",
+    },
+}
+
 all_compile_actions = [
     ACTION_NAMES.c_compile,
     ACTION_NAMES.cpp_compile,
@@ -85,25 +95,15 @@ all_link_actions = [
 ]
 
 def get_windows_mimimun_version_feature(ctx):
-    # The values are populated from the following link:
-    #    https://learn.microsoft.com/en-us/cpp/porting/modifying-winver-and-win32-winnt?view=msvc-170
-    # For future versions, please add it in the map.
-    min_ver_map = {
-        "10": {
-            "win": "0x0A00",
-            "ddi": "0x0A000000",
-        },
-    }
-
     if BuildSettingInfo not in ctx.attr.windows_version_minimal:
         fail("windows_version_minimal attribute value is not a build flag.")
 
     ver = ctx.attr.windows_version_minimal[BuildSettingInfo].value
-    if ver not in min_ver_map:
-        error_msg = "Windows mininum version {} does not exist. These are the minimum versions that are supported: {}".format(ver, min_ver_map.keys())
+    if ver not in MIN_VER_MAP:
+        error_msg = "Windows mininum version {} does not exist. These are the minimum versions that are supported: {}".format(ver, MIN_VER_MAP.keys())
         fail(error_msg)
 
-    min_ver = min_ver_map[ver]
+    min_ver = MIN_VER_MAP[ver]
     return feature(
         name = "windows_version_minimum",
         enabled = True,

bazel/toolchains/cc/mongo_windows/windows_cc_configure.bzl

@@ -351,7 +351,7 @@ def setup_vc_env_vars(repository_ctx, vc_path, envvars = [], allow_empty = False
         dictionary of the envvars
     """
     if not envvars:
-        envvars = ["PATH", "INCLUDE", "LIB", "WINDOWSSDKDIR"]
+        envvars = ["PATH", "INCLUDE", "LIB", "WINDOWSSDKDIR", "WindowsSDKVersion"]
 
     vcvars_script = _find_vcvars_bat_script(repository_ctx, vc_path)
     if not vcvars_script:

bazel/utils.bzl

@@ -1,6 +1,27 @@
 # General starlark utility functions
 load("//bazel/platforms:normalize.bzl", "ARCH_NORMALIZE_MAP")
 
+def write_target_impl(ctx):
+    out = ctx.actions.declare_file(ctx.label.name + ".gen_source_list")
+    ctx.actions.write(
+        out,
+        "//" + ctx.label.package + ":" + ctx.attr.target_name,
+    )
+    return [
+        DefaultInfo(
+            files = depset([out]),
+        ),
+    ]
+
+write_target = rule(
+    write_target_impl,
+    attrs = {
+        "target_name": attr.string(
+            doc = "the name of the target to record",
+        ),
+    },
+)
+
 def retry_download_and_extract(ctx, tries, **kwargs):
     sleep_time = 1
     for attempt in range(tries):

bazel/wrapper_hook/BUILD.bazel

@@ -10,6 +10,7 @@ py_library(
         "install_modules.py",
         "lint.py",
         "plus_interface.py",
+        "set_mongo_variables.py",
         "wrapper_debug.py",
         "wrapper_hook.py",
     ],

bazel/wrapper_hook/compiledb.py

@@ -11,6 +11,8 @@ import sys
 REPO_ROOT = pathlib.Path(__file__).parent.parent.parent
 sys.path.append(str(REPO_ROOT))
 
+from bazel.wrapper_hook.set_mongo_variables import write_mongo_variables_bazelrc
+
 
 def run_pty_command(cmd):
     stdout = None
@@ -43,6 +45,8 @@ def run_pty_command(cmd):
 
 
 def generate_compiledb(bazel_bin, persistent_compdb, enterprise):
+    # compiledb ignores command line args so just make a version rc file in anycase
+    write_mongo_variables_bazelrc([])
     if persistent_compdb:
         info_proc = subprocess.run(
             [bazel_bin, "info", "output_base"], capture_output=True, text=True

bazel/wrapper_hook/generate_common_bes_bazelrc.py

@@ -71,7 +71,7 @@ def write_workstation_bazelrc(args):
 
     filtered_args = args[1:]
     if "--" in filtered_args:
-        filtered_args = filtered_args[:filtered_args.index("--")] + ["--", "(REDACTED)"]
+        filtered_args = filtered_args[: filtered_args.index("--")] + ["--", "(REDACTED)"]
 
     developer_build = os.environ.get("CI") is None
     filtered_command_line = " ".join(filtered_args)

bazel/wrapper_hook/set_mongo_variables.py

@@ -0,0 +1,48 @@
+import hashlib
+import os
+import pathlib
+import platform
+import subprocess
+
+ARCH_NORMALIZE_MAP = {
+    "amd64": "x86_64",
+    "x86_64": "x86_64",
+    "arm64": "aarch64",
+    "aarch64": "aarch64",
+    "ppc64le": "ppc64le",
+    "s390x": "s390x",
+}
+
+
+def get_mongo_arch(args):
+    arch = platform.machine().lower()
+    if arch in ARCH_NORMALIZE_MAP:
+        return ARCH_NORMALIZE_MAP[arch]
+    else:
+        return arch
+
+
+def get_mongo_version(args):
+    proc = subprocess.run(["git", "describe", "--abbrev=0"], capture_output=True, text=True)
+    return proc.stdout.strip()[1:]
+
+
+def write_mongo_variables_bazelrc(args):
+    mongo_version = get_mongo_version(args)
+    mongo_arch = get_mongo_arch(args)
+
+    repo_root = pathlib.Path(os.path.abspath(__file__)).parent.parent.parent
+    version_file = os.path.join(repo_root, ".bazelrc.mongo_variables")
+    existing_hash = ""
+    if os.path.exists(version_file):
+        with open(version_file, encoding="utf-8") as f:
+            existing_hash = hashlib.md5(f.read().encode()).hexdigest()
+
+    bazelrc_contents = f"""
+common --define=MONGO_ARCH={mongo_arch}
+common --define=MONGO_VERSION={mongo_version}
+"""
+    current_hash = hashlib.md5(bazelrc_contents.encode()).hexdigest()
+    if existing_hash != current_hash:
+        with open(version_file, "w", encoding="utf-8") as f:
+            f.write(bazelrc_contents)

bazel/wrapper_hook/wrapper_hook.py

@@ -22,6 +22,7 @@ def main():
     from bazel.wrapper_hook.engflow_check import engflow_auth
     from bazel.wrapper_hook.generate_common_bes_bazelrc import write_workstation_bazelrc
     from bazel.wrapper_hook.plus_interface import check_bazel_command_type, test_runner_interface
+    from bazel.wrapper_hook.set_mongo_variables import write_mongo_variables_bazelrc
 
     # This is used to autogenerate a BUILD.bazel that creates
     # Filegroups for select tags - used to group targets for installing
@@ -38,10 +39,15 @@ def main():
             )
             args += ["--build_enterprise=False", "--config=local"]
 
+        if any(arg.startswith("--include_mongot") for arg in args):
+            os.makedirs("mongot-localdev", exist_ok=True)
+
         engflow_auth(args)
 
         write_workstation_bazelrc(args)
 
+        write_mongo_variables_bazelrc(args)
+
         args = test_runner_interface(
             sys.argv[1:],
             autocomplete_query=os.environ.get("MONGO_AUTOCOMPLETE_QUERY") == "1",

buildscripts/BUILD.bazel

@@ -150,6 +150,10 @@ py_binary(
             "jsonschema",
             group = "build-metrics",
         ),
+        dependency(
+            "license-expression",
+            group = "lint",
+        ),
     ],
 )
 

buildscripts/evergreen_activate_gen_tasks.py

@@ -7,8 +7,15 @@ import sys
 import click
 import structlog
 from pydantic.main import BaseModel
+from urllib3.util import Retry
 
-from evergreen.api import EvergreenApi, RetryingEvergreenApi
+from evergreen.api import (
+    DEFAULT_HTTP_RETRY_ATTEMPTS,
+    DEFAULT_HTTP_RETRY_BACKOFF_FACTOR,
+    DEFAULT_HTTP_RETRY_CODES,
+    EvergreenApi,
+    RetryingEvergreenApi,
+)
 
 # Get relative imports to work when the package is not installed on the PYTHONPATH.
 if __name__ == "__main__" and __package__ is None:
@@ -137,6 +144,14 @@ def main(expansion_file: str, evergreen_config: str, verbose: bool) -> None:
     enable_logging(verbose)
     expansions = EvgExpansions.from_yaml_file(expansion_file)
     evg_api = RetryingEvergreenApi.get_api(config_file=evergreen_config, log_on_error=True)
+    evg_api._http_retry = Retry(
+        # this is a way to reuse all of Evergreen's logic, but to bump up the number of attempts
+        total=DEFAULT_HTTP_RETRY_ATTEMPTS + 10,
+        backoff_factor=DEFAULT_HTTP_RETRY_BACKOFF_FACTOR,
+        status_forcelist=DEFAULT_HTTP_RETRY_CODES,
+        raise_on_status=False,
+        raise_on_redirect=False,
+    )
 
     activate_task(expansions, evg_api)
 

buildscripts/evergreen_task_timeout.py

@@ -6,6 +6,7 @@ from __future__ import annotations
 import argparse
 import math
 import os
+import re
 import shlex
 import sys
 from datetime import timedelta
@@ -115,7 +116,7 @@ class TimeoutOverrides(BaseModel):
         overrides = [
             override
             for override in self.overrides.get(build_variant, [])
-            if override.task == task_name
+            if re.search(override.task, task_name)
         ]
         if overrides:
             if len(overrides) > 1:

buildscripts/generate_version_expansions.py

@@ -61,8 +61,8 @@ def generate_version_expansions():
             raise ValueError("Unable to parse version from stdin and no version.json provided")
 
     if version_parts[0]:
-        expansions["suffix"] = "latest"
-        expansions["src_suffix"] = "latest"
+        expansions["suffix"] = "v8.2-latest"
+        expansions["src_suffix"] = "v8.2-latest"
         expansions["is_release"] = "false"
     else:
         expansions["suffix"] = version_line

buildscripts/idl/checkout_idl_files_from_past_releases.py

@@ -31,10 +31,11 @@ import logging
 import os
 import shutil
 import sys
-from subprocess import check_output
+from subprocess import CalledProcessError, check_output
 from typing import List
 
 from packaging.version import Version
+from retry import retry
 
 # Get relative imports to work when the package is not installed on the PYTHONPATH.
 if __name__ == "__main__" and __package__ is None:
@@ -104,6 +105,11 @@ def get_tags() -> List[str]:
     return list(gen_tags())
 
 
+@retry(tries=3, delay=5)
+def _show_with_retry(tag: str, path: str):
+    return check_output(["git", "show", f"{tag}:{path}"])
+
+
 def make_idl_directories(tags: List[str], destination: str) -> None:
     """For each tag, construct a source tree containing only its IDL files."""
     LOGGER.info("Clearing destination directory '%s'", destination)
@@ -116,7 +122,12 @@ def make_idl_directories(tags: List[str], destination: str) -> None:
             if not path.endswith(".idl"):
                 continue
 
-            contents = check_output(["git", "show", f"{tag}:{path}"]).decode()
+            try:
+                contents = _show_with_retry(tag, path).decode()
+            except CalledProcessError as e:
+                LOGGER.error("Failed to run git show command after multiple retries: %s", str(e))
+                raise e
+
             output_path = os.path.join(directory, path)
             os.makedirs(os.path.dirname(output_path), exist_ok=True)
             with open(output_path, "w+") as fd:

buildscripts/install_bazel.py

@@ -71,10 +71,6 @@ def install_bazel(binary_directory: str) -> str:
     is_bazelisk_supported = normalized_arch not in ["ppc64le", "s390x"]
     binary_filename = "bazelisk"
     binary_path = os.path.join(binary_directory, binary_filename)
-    if os.path.exists(binary_path):
-        print(f"{binary_filename} already exists ({binary_path}), skipping download")
-        _set_bazel_permissions(binary_path)
-        return binary_path
 
     if is_bazelisk_supported:
         print(f"Downloading {binary_filename}...")

buildscripts/msi_validation.py

@@ -1,6 +1,7 @@
 # This script validates the msi can be installed, uninstalled, and checks for the default install location and some of the possible install files
 import glob
 import os
+import re
 import subprocess
 import sys
 import tempfile
@@ -87,6 +88,8 @@ def validate_files(is_enterprise):
             print(f"File exists: {file_match[0]}")
             if file_match[0].endswith(".exe"):
                 validate_help(file_match[0])
+            if file_match[0].endswith("mongod.exe"):
+                validate_version(file_match[0])
         else:
             print(f"Error: {file_path} could not be found.")
             sys.exit(1)
@@ -103,6 +106,26 @@ def validate_help(exe_path):
         sys.exit(1)
 
 
+# Make sure we have a proper git version in the windows release
+def validate_version(exe_path):
+    try:
+        version_command = [exe_path, "--version"]
+        print(f"Calling '{exe_path}' with command: {' '.join(version_command)}...")
+        result = subprocess.run(version_command, check=True, stdout=subprocess.PIPE, text=True)
+        print(f"{exe_path} called version successfully.")
+        match = re.search('.*"gitVersion": "[0-9a-fA-F]{40}".*', result.stdout)
+        if match:
+            print("Found a valid git version.")
+            return
+        else:
+            print("--version command did not contain a valid git version in gitVersion. Stdout:")
+            print(result.stdout)
+            sys.exit(1)
+    except subprocess.CalledProcessError as e:
+        print(f"Error while calling version for {exe_path}: {e}")
+        sys.exit(1)
+
+
 def main():
     if len(sys.argv) != 2:
         print("Usage: python msi_validation.py <path_to_msi>")

buildscripts/package_test.py

@@ -249,6 +249,16 @@ VERSIONS_TO_SKIP: Set[str] = set(
 )
 DISABLED_TESTS: Set[Tuple[str, str]] = set()
 
+VALID_TAR_DIRECTORY_ARCHITECTURES = [
+    "linux-aarch64",
+    "linux-x86_64",
+    "linux-ppc64le",
+    "linux-s390x",
+    "macos-aarch64",
+    "macos-x86_64",
+    "windows-x86_64",
+]
+
 
 @dataclasses.dataclass
 class Test:
@@ -350,7 +360,7 @@ def run_test(test: Test, client: DockerClient) -> Result:
             "yum -y install yum-utils epel-release",
             "yum-config-manager --enable epel",
         ]
-    if test.os_name.startswith("debian92"):
+    if test.os_name.startswith("debian92") or test.os_name.startswith("debian10"):
         # Adapted from https://stackoverflow.com/questions/76094428/debian-stretch-repositories-404-not-found
         # Debian92 renamed its repos to archive
         # The first two sed commands are to replace debian92's sources list to archive repo
@@ -524,6 +534,16 @@ def get_edition_alias(edition_name: str) -> str:
     return edition_name
 
 
+def validate_top_level_directory(tar_name: str):
+    command = f"tar -tf {tar_name} | head -n 1 | awk -F/ '{{print $1}}'"
+    proc = subprocess.run(command, capture_output=True, shell=True, text=True)
+    top_level_directory = proc.stdout.strip()
+    if all(os_arch not in top_level_directory for os_arch in VALID_TAR_DIRECTORY_ARCHITECTURES):
+        raise Exception(
+            f"Found an unexpected os-arch pairing as the top level directory. Top level directory: {top_level_directory}"
+        )
+
+
 arches: Set[str] = set()
 oses: Set[str] = set()
 editions: Set[str] = set()
@@ -663,6 +683,8 @@ if args.command == "branch":
             )
         )
 
+        validate_top_level_directory("mongo-binaries.tgz")
+
         if not args.skip_enterprise_check:
             logging.info(
                 "Checking the source files used to build the binaries, use --skip-enterprise-check to skip this check."

buildscripts/packager.py

@@ -48,6 +48,23 @@ ARCH_CHOICES = ["x86_64", "arm64", "aarch64", "s390x"]
 # Made up names for the flavors of distribution we package for.
 DISTROS = ["suse", "debian", "redhat", "ubuntu", "amazon", "amazon2", "amazon2023"]
 
+unexpected_lts_release_series = ("8.2",)
+
+
+def get_suffix(version, stable_name: str, unstable_name: str) -> str:
+    parts = version.split(".")
+
+    major = int(parts[0])
+    minor = int(parts[1])
+
+    series = f"{major}.{minor}"
+
+    if major >= 5:
+        is_stable_version = minor == 0 or series in unexpected_lts_release_series
+        return stable_name if is_stable_version else unstable_name
+    else:
+        return stable_name if minor % 2 == 0 else unstable_name
+
 
 class Spec(object):
     """Spec class."""
@@ -104,12 +121,9 @@ class Spec(object):
         # e.g., "1.8.2" < "1.8.10", "1.8.2" < "1.8.2-rc1"
         return self.ver > version_string
 
-    def suffix(self):
+    def suffix(self) -> str:
         """Return suffix."""
-        if int(self.ver.split(".")[0]) >= 5:
-            return "-org" if int(self.ver.split(".")[1]) == 0 else "-org-unstable"
-        else:
-            return "-org" if int(self.ver.split(".")[1]) % 2 == 0 else "-org-unstable"
+        return get_suffix(self.ver, "-org", "-org-unstable")
 
     def prelease(self):
         """Return pre-release verison suffix."""

buildscripts/packager_enterprise.py

@@ -54,11 +54,8 @@ class EnterpriseSpec(packager.Spec):
     """EnterpriseSpec class."""
 
     def suffix(self):
+        return packager.get_suffix(self.ver, "-enterprise", "-enterprise-unstable")
         """Suffix."""
-        if int(self.ver.split(".")[0]) >= 5:
-            return "-enterprise" if int(self.ver.split(".")[1]) == 0 else "-enterprise-unstable"
-        else:
-            return "-enterprise" if int(self.ver.split(".")[1]) % 2 == 0 else "-enterprise-unstable"
 
     def move_required_contents(self):
         """Move the required contents to the current working directory.

buildscripts/resmokeconfig/fully_disabled_feature_flags.yml

@@ -28,5 +28,3 @@
 # TODO (SERVER-73632): Delete featureFlagRouterPort.
 - featureFlagRouterPort
 - featureFlagSessionsCollectionCoordinatorOnConfigServer
-# TODO (SERVER-101672) : Delete featureFlagOplogSamplingAsyncEnabled.
-- featureFlagOplogSamplingAsyncEnabled

buildscripts/resmokeconfig/suites/concurrency_replication_for_backup_restore.yml

@@ -22,6 +22,9 @@ selector:
     # These workloads use a verbose log level.
     - jstests/concurrency/fsm_workloads/ddl/rename_collection/collection_uuid.js
 
+    # TODO BACKPORT-25689: reenable this workload after backport to 8.0.
+    - jstests/concurrency/fsm_workloads/query/remove/update_and_batched_delete.js
+
   exclude_with_any_tags:
     - requires_standalone
     # The ability to shut down a node while its in the middle of applying ops is required for

buildscripts/resmokeconfig/suites/external_auth_oidc_azure.yml

@@ -1,6 +1,9 @@
 test_kind: js_test
 
 selector:
+  exclude_files:
+    # TODO: SERVER-109999 Remove this line.
+    - src/mongo/db/modules/enterprise/jstests/external_auth_oidc_azure/oidc_e2e_azure_machine.js
   roots:
     - src/mongo/db/modules/enterprise/jstests/external_auth_oidc_azure/*.js
 

buildscripts/resmokeconfig/suites/replica_sets_jscore_passthrough_with_replica_set_endpoint.yml

@@ -53,6 +53,7 @@ selector:
     - jstests/core/query/resume_query_from_non_existent_record.js
     - jstests/core/query/resume_query.js
     - jstests/core/timeseries/query/timeseries_resume_after.js
+    - jstests/core/query/start_at_blocked_in_sbe.js
     # This test creates collections directly using applyOps commands. So those collections are not
     # tracked by sharding and therefore not discoverable by listCollections commands that go through
     # the router. TODO (SERVER-84342): listCollections command doesn't return collections created

buildscripts/resmokeconfig/suites/secondary_reads_passthrough_with_replica_set_endpoint.yml

@@ -48,6 +48,7 @@ selector:
     - jstests/core/query/resume_query_from_non_existent_record.js
     - jstests/core/query/resume_query.js
     - jstests/core/timeseries/query/timeseries_resume_after.js
+    - jstests/core/query/start_at_blocked_in_sbe.js
     # This test creates collections directly using applyOps commands. So those collections are not
     # tracked by sharding and therefore not discoverable by listCollections commands that go through
     # the router. TODO (SERVER-84342): listCollections command doesn't return collections created

buildscripts/resmokeconfig/suites/sharding_csrs_continuous_config_stepdown.yml

@@ -278,6 +278,7 @@ selector:
     - jstests/sharding/query/change_streams/change_stream_no_shards.js
     - jstests/sharding/query/change_streams/change_stream_on_system_collection.js
     - jstests/sharding/query/change_streams/change_stream_transaction_sharded.js
+    - jstests/sharding/query/change_streams/change_stream_transaction_sharded_commit_timestamp.js
     - jstests/sharding/query/change_streams/change_stream_update_lookup_collation.js
     - jstests/sharding/query/change_streams/change_stream_update_lookup_read_concern.js
     - jstests/sharding/query/change_streams/change_streams.js

buildscripts/resmokeconfig/suites/timeseries_crud_jscore_passthrough.yml

@@ -268,6 +268,7 @@ selector:
     # TODO(SERVER-85322): Try to include this test(s).
     - jstests/core/query/resume_query.js
     - jstests/core/query/resume_query_from_non_existent_record.js
+    - jstests/core/query/start_at_blocked_in_sbe.js
     # Inserting into a time-series collection does not replace top-level empty timestamps.
     - jstests/core/write/ts1.js
     # Cursor manipulation incompatible with count 'applySkipLimit' option.

buildscripts/resmokelib/config_fuzzer_limits.py

@@ -495,6 +495,17 @@ config_fuzzer_params = {
             "period": 5,
             "fuzz_at": ["startup", "runtime"],
         },
+        "preAuthMaximumMessageSizeBytes": {
+            "min": 65536,  # 64 KiB
+            "max": 16777216,  # 16 MiB
+            "period": 10,
+            "fuzz_at": ["startup", "runtime"],
+        },
+        "capMemoryConsumptionForPreAuthBuffers": {
+            "min": 80,
+            "max": 100,
+            "fuzz_at": ["startup"],
+        },
     },
     "mongos": {
         # We need a higher timeout to account for test slowness
@@ -539,6 +550,17 @@ config_fuzzer_params = {
             "choices": [{"mode": "off"}],
             "fuzz_at": ["startup"],
         },
+        "preAuthMaximumMessageSizeBytes": {
+            "min": 65536,  # 64 KiB
+            "max": 16777216,  # 16 MiB
+            "period": 10,
+            "fuzz_at": ["startup", "runtime"],
+        },
+        "capMemoryConsumptionForPreAuthBuffers": {
+            "min": 80,
+            "max": 100,
+            "fuzz_at": ["startup"],
+        },
     },
 }
 

buildscripts/resmokelib/testing/fixtures/standalone.py

@@ -587,3 +587,4 @@ def _add_testing_set_parameters(suite_set_parameters):
     # The placeholder is needed so older versions don't have this option won't have this value set.
     suite_set_parameters.setdefault("backtraceLogFile", True)
     suite_set_parameters.setdefault("disableTransitionFromLatestToLastContinuous", False)
+    suite_set_parameters.setdefault("oplogApplicationEnforcesSteadyStateConstraints", True)

buildscripts/s3_binary/download.py

@@ -3,6 +3,7 @@
 import argparse
 import hashlib
 import os
+import shutil
 import sys
 import tempfile
 import time
@@ -22,6 +23,7 @@ def read_sha_file(filename):
         content = f.read()
         return content.strip().split()[0]
 
+
 def _fetch_remote_sha256_hash(s3_path: str):
     downloaded = False
     result = None
@@ -40,7 +42,7 @@ def _fetch_remote_sha256_hash(s3_path: str):
 
     if downloaded:
         result = read_sha_file(tempfile_name)
-    
+
     if tempfile_name and os.path.exists(tempfile_name):
         os.unlink(tempfile_name)
 
@@ -61,7 +63,7 @@ def _verify_s3_hash(s3_path: str, local_path: str, expected_hash: str) -> None:
         raise ValueError(
             f"Hash mismatch for {s3_path}, expected {expected_hash} but got {hash_string}"
         )
-    print(f"File is valid: {local_path} (sha256: {expected_hash})")
+
 
 def validate_file(s3_path, output_path, remote_sha_allowed):
     hexdigest = S3_SHA256_HASHES.get(s3_path)
@@ -69,7 +71,7 @@ def validate_file(s3_path, output_path, remote_sha_allowed):
         print(f"Validating against hard coded sha256: {hexdigest}")
         _verify_s3_hash(s3_path, output_path, hexdigest)
         return True
-    
+
     if not remote_sha_allowed:
         raise ValueError(f"No SHA256 hash available for {s3_path}")
 
@@ -82,13 +84,13 @@ def validate_file(s3_path, output_path, remote_sha_allowed):
             print(f"Validating against remote sha256 {hexdigest}\n({s3_path}.sha256)")
         else:
             print(f"Failed to download remote sha256 at {s3_path}.sha256)")
-            
+
     if hexdigest:
         _verify_s3_hash(s3_path, output_path, hexdigest)
         return True
     else:
         raise ValueError(f"No SHA256 hash available for {s3_path}")
-        
+
 
 def _download_and_verify(s3_path, output_path, remote_sha_allowed):
     for i in range(5):
@@ -98,8 +100,9 @@ def _download_and_verify(s3_path, output_path, remote_sha_allowed):
                 download_from_s3_with_boto(s3_path, output_path)
             except Exception:
                 download_from_s3_with_requests(s3_path, output_path)
-                
+
             validate_file(s3_path, output_path, remote_sha_allowed)
+            break
 
         except Exception:
             print("Download failed:")
@@ -133,7 +136,15 @@ def download_s3_binary(
         with tempfile.NamedTemporaryFile(delete=False) as temp_file:
             tempfile_name = temp_file.name
             _download_and_verify(s3_path, tempfile_name, remote_sha_allowed)
+
+        try:
             os.replace(tempfile_name, local_path)
+        except OSError as e:
+            if e.errno == 18:  # EXDEV cross filesystem error, need to use a mv
+                shutil.move(tempfile_name, local_path)
+            else:
+                raise
+
         print(f"Downloaded and verified {s3_path} -> {local_path}")
         return True
     except Exception as e:
@@ -146,8 +157,6 @@ def download_s3_binary(
 
 
 if __name__ == "__main__":
-
-
     parser = argparse.ArgumentParser(description="Download and verify S3 binary.")
     parser.add_argument("s3_path", help="S3 URL to download from")
     parser.add_argument("local_path", nargs="?", help="Optional output file path")

buildscripts/s3_binary/sha256sum.py

@@ -12,6 +12,7 @@ def compute_sha256(file_path: str) -> str:
             sha256.update(block)
     return sha256.hexdigest()
 
+
 def write_sha256_file(file_path: str, hash_value: str):
     sha256_path = file_path + ".sha256"
     file_name = os.path.basename(file_path)
@@ -19,6 +20,7 @@ def write_sha256_file(file_path: str, hash_value: str):
         f.write(f"{hash_value}  {file_name}\n")
     print(f"Wrote SHA-256 to {sha256_path}")
 
+
 def main():
     if len(sys.argv) != 2:
         print("Usage: sha256sum.py <file>")
@@ -32,5 +34,6 @@ def main():
     hash_value = compute_sha256(file_path)
     write_sha256_file(file_path, hash_value)
 
+
 if __name__ == "__main__":
     main()

buildscripts/sbom_linter.py

@@ -5,6 +5,7 @@ import sys
 from typing import List
 
 import jsonschema
+from license_expression import get_spdx_licensing
 from referencing import Registry, Resource
 
 BOM_SCHEMA_LOCATION = os.path.join("buildscripts", "tests", "sbom_linter", "bom-1.5.schema.json")
@@ -32,6 +33,7 @@ MISSING_TEAM_ERROR = "Component must include a 'internal:team_responsible' prope
 SCHEMA_MATCH_FAILURE = "File did not match the CycloneDX schema"
 MISSING_VERSION_IN_SBOM_COMPONENT_ERROR = "Component must include a version."
 MISSING_VERSION_IN_IMPORT_FILE_ERROR = "Missing version in the import file: "
+MISSING_LICENSE_IN_SBOM_COMPONENT_ERROR = "Component must include a license."
 COULD_NOT_FIND_OR_READ_SCRIPT_FILE_ERROR = "Could not find or read the import script file"
 VERSION_MISMATCH_ERROR = "Version mismatch: "
 
@@ -115,30 +117,48 @@ def strip_extra_prefixes(string_with_prefix: str) -> str:
     return string_with_prefix.removeprefix("mongo/").removeprefix("v")
 
 
-def validate_evidence(component: dict, third_party_libs: set, error_manager: ErrorManager) -> None:
-    if "evidence" not in component or "occurrences" not in component["evidence"]:
-        error_manager.append_full_error_message(MISSING_EVIDENCE_ERROR)
+def validate_license(component: dict, error_manager: ErrorManager) -> None:
+    if "licenses" not in component:
+        error_manager.append_full_error_message(MISSING_LICENSE_IN_SBOM_COMPONENT_ERROR)
         return
 
-    occurrences = component["evidence"]["occurrences"]
-    if not occurrences:
-        error_manager.append_full_error_message(
-            "'evidence.occurrences' field must include at least one location."
-        )
-    for occurrence in occurrences:
-        location = occurrence["location"]
+    valid_license = False
+    for license in component["licenses"]:
+        if "expression" in license:
+            expression = license.get("expression")
+        elif "license" in license:
+            if "id" in license["license"]:
+                # Should be a valid SPDX license ID
+                expression = license["license"].get("id")
+            elif "name" in license["license"]:
+                # If SPDX does not define the license used, the name field may be used to provide the license name
+                valid_license = True
 
-        if not os.path.exists(location) and not SKIP_FILE_CHECKING:
-            error_manager.append_full_error_message("location does not exist in repo.")
+        if not valid_license:
+            licensing_validate = get_spdx_licensing().validate(expression, validate=True)
+            # ExpressionInfo(
+            #   original_expression='',
+            #   normalized_expression='',
+            #   errors=[],
+            #   invalid_symbols=[]
+            # )
+            valid_license = not licensing_validate.errors or not licensing_validate.invalid_symbols
+            if not valid_license:
+                error_manager.append_full_error_message(licensing_validate)
+                return
 
-        if location.startswith(THIRD_PARTY_LOCATION_PREFIX):
-            lib = location.removeprefix(THIRD_PARTY_LOCATION_PREFIX)
-            if lib in third_party_libs:
-                third_party_libs.remove(lib)
+
+def validate_evidence(component: dict, third_party_libs: set, error_manager: ErrorManager) -> None:
+    if component["scope"] == "required":
+        if "evidence" not in component or "occurrences" not in component["evidence"]:
+            error_manager.append_full_error_message(MISSING_EVIDENCE_ERROR)
+            return
+
+    validate_location(component, third_party_libs, error_manager)
 
 
 def validate_properties(component: dict, error_manager: ErrorManager) -> None:
-    has_team_responsible_property = False
+    has_team_responsible_property = False or component["scope"] == "excluded"
     script_path = ""
     if "properties" in component:
         for prop in component["properties"]:
@@ -159,14 +179,26 @@ def validate_properties(component: dict, error_manager: ErrorManager) -> None:
     if comp_version == "Unknown" or script_path == "":
         return
 
+    # Include the .pedigree.descendants[0] version for version matching
+    if (
+        "pedigree" in component
+        and "descendants" in component["pedigree"]
+        and "version" in component["pedigree"]["descendants"][0]
+    ):
+        comp_pedigree_version = component["pedigree"]["descendants"][0]["version"]
+    else:
+        comp_pedigree_version = ""
+
     # At this point a version is attempted to be read from the import script file
     script_version = get_script_version(script_path, "VERSION", error_manager)
     if script_version == "":
         error_manager.append_full_error_message(MISSING_VERSION_IN_IMPORT_FILE_ERROR + script_path)
-    elif strip_extra_prefixes(script_version) != strip_extra_prefixes(comp_version):
+    elif strip_extra_prefixes(script_version) != strip_extra_prefixes(
+        comp_version
+    ) and strip_extra_prefixes(script_version) != strip_extra_prefixes(comp_pedigree_version):
         error_manager.append_full_error_message(
             VERSION_MISMATCH_ERROR
-            + f"\nscript version:{script_version}\nsbom version:{comp_version}"
+            + f"\nscript version:{script_version}\nsbom component version:{comp_version}\nsbom component pedigree version:{comp_pedigree_version}"
         )
 
 
@@ -174,15 +206,37 @@ def validate_component(component: dict, third_party_libs: set, error_manager: Er
     error_manager.update_component_attribute(component["name"])
     if "scope" not in component:
         error_manager.append_full_error_message("component must include a scope.")
-    elif component["scope"] != "optional":
+    else:
         validate_evidence(component, third_party_libs, error_manager)
     validate_properties(component, error_manager)
+    validate_license(component, error_manager)
 
     if "purl" not in component and "cpe" not in component:
         error_manager.append_full_error_message(MISSING_PURL_CPE_ERROR)
     error_manager.update_component_attribute("")
 
 
+def validate_location(component: dict, third_party_libs: set, error_manager: ErrorManager) -> None:
+    if "evidence" in component:
+        if "occurrences" not in component["evidence"]:
+            error_manager.append_full_error_message(
+                "'evidence.occurrences' field must include at least one location."
+            )
+
+        occurrences = component["evidence"]["occurrences"]
+        for occurrence in occurrences:
+            if "location" in occurrence:
+                location = occurrence["location"]
+
+                if not os.path.exists(location) and not SKIP_FILE_CHECKING:
+                    error_manager.append_full_error_message("location does not exist in repo.")
+
+                if location.startswith(THIRD_PARTY_LOCATION_PREFIX):
+                    lib = location.removeprefix(THIRD_PARTY_LOCATION_PREFIX)
+                    if lib in third_party_libs:
+                        third_party_libs.remove(lib)
+
+
 def lint_sbom(
     input_file: str, output_file: str, third_party_libs: set, should_format: bool
 ) -> ErrorManager:
@@ -257,8 +311,6 @@ def main() -> int:
     )
     # the only files in this dir that are not third party libs
     third_party_libs.remove("scripts")
-    # wiredtiger will not be included in the sbom since it is considered part of the server
-    third_party_libs.remove("wiredtiger")
     # the only files in the sasl dir are BUILD files to setup the sasl library in Windows
     third_party_libs.remove("sasl")
     error_manager = lint_sbom(input_file, output_file, third_party_libs, should_format)

buildscripts/sync_repo_with_copybara.py

@@ -17,6 +17,9 @@ from github import GithubIntegration
 from buildscripts.util.read_config import read_config_file
 from evergreen.api import RetryingEvergreenApi
 
+# Commit hash of Copybara to use (v20251110)
+COPYBARA_COMMIT_HASH = "3f050c9e08b84aeda98875bf1b02a3288d351333"
+
 
 class CopybaraRepoConfig(NamedTuple):
     """Copybara source and destination repo sync configuration."""
@@ -386,6 +389,9 @@ def main():
     else:
         run_command("git clone https://github.com/10gen/copybara.git")
 
+    # Checkout the specific commit of Copybara we want to use
+    run_command(f"cd copybara && git checkout {COPYBARA_COMMIT_HASH}")
+
     # Navigate to the Copybara directory and build the Copybara Docker image
     run_command("cd copybara && docker build --rm -t copybara .")
 

buildscripts/tests/sbom_linter/inputs/sbom_component_empty_version.json

@@ -2,11 +2,11 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
     {
@@ -14,6 +14,11 @@
       "name": "kafka",
       "version": "",
       "scope": "required",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "cpe": "test_cpe",
       "properties": [
         {

buildscripts/tests/sbom_linter/inputs/sbom_component_name_missing.json

@@ -2,11 +2,11 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
     {
@@ -14,6 +14,11 @@
       "version": "v2.0.2",
       "scope": "required",
       "cpe": "test_cpe",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "properties": [
         {
           "name": "internal:team_responsible",

buildscripts/tests/sbom_linter/inputs/sbom_invalid_format.json

@@ -2,11 +2,11 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
 
@@ -16,6 +16,11 @@
       "name": "kafka",
       "version": "2.0.2",
       "scope": "required",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "cpe": "test_cpe",
       "properties": [
         {
@@ -36,6 +41,13 @@
       "name": "protobuf",
       "version": "v4.25.0",
       "scope": "required",
+      "licenses": [
+        {
+          "license": {
+            "id": "BSD-3-Clause"
+          }
+        }
+      ],
       "purl": "test_purl",
       "properties": [
         {
@@ -58,6 +70,13 @@
       "name": "unicode",
       "version": "8.0",
       "scope": "optional",
+      "licenses": [
+        {
+          "license": {
+            "id": "Unicode-DFS-2016"
+          }
+        }
+      ],
       "purl": "test_purl",
       "properties": [
         {

buildscripts/tests/sbom_linter/inputs/sbom_invalid_license_expression.json

@@ -0,0 +1,43 @@
+{
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "properties": [
+    {
+      "name": "comment",
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+    }
+  ],
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5",
+  "version": 1,
+  "components": [
+    {
+      "type": "library",
+      "name": "kafka",
+      "version": "v2.0.2",
+      "licenses": [
+        {
+          "expression": "xBSD-3-Clause"
+        }
+      ],
+      "scope": "required",
+      "cpe": "test_cpe",
+      "properties": [
+        {
+          "name": "internal:team_responsible",
+          "value": "server_security"
+        },
+        {
+          "name": "import_script_path",
+          "value": "buildscripts/tests/sbom_linter/inputs/kafka_valid_import.sh"
+        }
+      ],
+      "evidence": {
+        "occurrences": [
+          {
+            "location": "src/third_party/librdkafka"
+          }
+        ]
+      }
+    }
+  ]
+}

buildscripts/tests/sbom_linter/inputs/sbom_missing_evidence.json

@@ -2,11 +2,11 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
     {
@@ -14,6 +14,11 @@
       "name": "kafka",
       "scope": "required",
       "cpe": "test_cpe",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "properties": [
         {
           "name": "internal:team_responsible",

buildscripts/tests/sbom_linter/inputs/sbom_missing_license.json

@@ -0,0 +1,74 @@
+{
+  "properties": [
+    {
+      "name": "comment",
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+    }
+  ],
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5",
+  "version": 1,
+  "components": [
+    {
+      "type": "library",
+      "name": "kafka",
+      "version": "v2.0.2",
+      "scope": "required",
+      "cpe": "test_cpe",
+      "properties": [
+        {
+          "name": "internal:team_responsible",
+          "value": "server_security"
+        },
+        {
+          "name": "import_script_path",
+          "value": "buildscripts/tests/sbom_linter/inputs/kafka_valid_import.sh"
+        }
+      ],
+      "evidence": {
+        "occurrences": [
+          {
+            "location": "src/third_party/librdkafka"
+          }
+        ]
+      }
+    },
+    {
+      "type": "library",
+      "name": "protobuf",
+      "version": "v4.25.0",
+      "scope": "required",
+      "purl": "test_purl",
+      "properties": [
+        {
+          "name": "internal:team_responsible",
+          "value": "server_security"
+        },
+        {
+          "name": "import_script_path",
+          "value": "buildscripts/tests/sbom_linter/inputs/import_script_with_mongo_prefix_version.sh"
+        }
+      ],
+      "evidence": {
+        "occurrences": [
+          {
+            "location": "src/third_party/protobuf"
+          }
+        ]
+      }
+    },
+    {
+      "type": "library",
+      "name": "unicode",
+      "version": "8.0",
+      "scope": "optional",
+      "purl": "test_purl",
+      "properties": [
+        {
+          "name": "internal:team_responsible",
+          "value": "server_security"
+        }
+      ]
+    }
+  ]
+}

buildscripts/tests/sbom_linter/inputs/sbom_missing_purl.json

@@ -2,17 +2,22 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
     {
       "type": "library",
       "name": "kafka",
       "scope": "required",
+       "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "cpe": "test_cpe",
       "properties": [
         {

buildscripts/tests/sbom_linter/inputs/sbom_missing_team.json

@@ -2,17 +2,22 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
     {
       "type": "library",
       "name": "kafka",
       "scope": "required",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "cpe": "test_cpe",
       "evidence": {
         "occurrences": [

buildscripts/tests/sbom_linter/inputs/sbom_missing_version.json

@@ -2,17 +2,22 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
     {
       "type": "library",
       "name": "kafka",
       "scope": "required",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "cpe": "test_cpe",
       "properties": [
         {

buildscripts/tests/sbom_linter/inputs/sbom_named_license.json

@@ -0,0 +1,51 @@
+{
+  "properties": [
+    {
+      "name": "comment",
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+    }
+  ],
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5",
+  "version": 1,
+  "components": [
+    {
+      "type": "library",
+      "bom-ref": "pkg:github/aappleby/smhasher@a6bd3ce7be8ad147ea820a7cf6229a975c0c96bb",
+      "supplier": {
+        "name": "Austin Appleby"
+      },
+      "author": "Austin Appleby",
+      "group": "aappleby",
+      "name": "MurmurHash3",
+      "version": "a6bd3ce7be8ad147ea820a7cf6229a975c0c96bb",
+      "licenses": [
+        {
+          "license": {
+            "name": "Public Domain"
+          }
+        }
+      ],
+      "copyright": "MurmurHash3 was written by Austin Appleby, and is placed in the public domain. The author hereby disclaims copyright to this source code.",
+      "purl": "pkg:github/aappleby/smhasher@a6bd3ce7be8ad147ea820a7cf6229a975c0c96bb",
+      "properties": [
+        {
+          "name": "internal:team_responsible",
+          "value": "Storage Execution"
+        },
+        {
+          "name": "info_link",
+          "value": "https://github.com/aappleby/smhasher/blob/a6bd3ce/"
+        }
+      ],
+      "evidence": {
+        "occurrences": [
+          {
+            "location": "src/third_party/murmurhash3"
+          }
+        ]
+      },
+      "scope": "required"
+    }
+  ]
+}

buildscripts/tests/sbom_linter/inputs/sbom_pedigree_version_match.json

@@ -0,0 +1,51 @@
+{
+  "properties": [
+    {
+      "name": "comment",
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+    }
+  ],
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5",
+  "version": 1,
+  "components": [
+    {
+      "type": "library",
+      "name": "kafka",
+      "version": "v2.0.0",
+      "scope": "required",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
+      "cpe": "test_cpe",
+      "pedigree": {
+        "descendants": [
+          {
+            "type": "library",
+            "name": "kafka-fork",
+            "version": "v2.0.2"
+          }
+        ]
+      },
+      "properties": [
+        {
+          "name": "internal:team_responsible",
+          "value": "server_security"
+        },
+        {
+          "name": "import_script_path",
+          "value": "buildscripts/tests/sbom_linter/inputs/kafka_valid_import.sh"
+        }
+      ],
+      "evidence": {
+        "occurrences": [
+          {
+            "location": "src/third_party/kafka"
+          }
+        ]
+      }
+    }
+  ]
+}

buildscripts/tests/sbom_linter/inputs/sbom_script_file_missing.json

@@ -2,11 +2,11 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
     {
@@ -14,6 +14,11 @@
       "name": "kafka",
       "version": "2.0.2",
       "scope": "required",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "cpe": "test_cpe",
       "properties": [
         {

buildscripts/tests/sbom_linter/inputs/sbom_script_missing_version.json

@@ -2,11 +2,11 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
     {
@@ -14,6 +14,11 @@
       "name": "kafka",
       "version": "2.0.2",
       "scope": "required",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "cpe": "test_cpe",
       "properties": [
         {

buildscripts/tests/sbom_linter/inputs/sbom_version_mismatch.json

@@ -2,11 +2,11 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
     {
@@ -14,6 +14,11 @@
       "name": "kafka",
       "version": "v4.25.0",
       "scope": "required",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "cpe": "test_cpe",
       "properties": [
         {

buildscripts/tests/sbom_linter/inputs/valid_sbom.json

@@ -2,17 +2,22 @@
   "properties": [
     {
       "name": "comment",
-      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.6/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
+      "value": "SBOM for MDB server product; this file should comply with the format specified here: https://cyclonedx.org/docs/1.5/json/#components_items_publisher; This file is still in development; see https://jira.mongodb.org/browse/DEVPROD-2623 for details."
     }
   ],
   "bomFormat": "CycloneDX",
-  "specVersion": "1.6",
+  "specVersion": "1.5",
   "version": 1,
   "components": [
     {
       "type": "library",
       "name": "kafka",
       "version": "v2.0.2",
+      "licenses": [
+        {
+          "expression": "BSD-3-Clause"
+        }
+      ],
       "scope": "required",
       "cpe": "test_cpe",
       "properties": [
@@ -38,6 +43,13 @@
       "name": "protobuf",
       "version": "v4.25.0",
       "scope": "required",
+      "licenses": [
+        {
+          "license": {
+            "id": "BSD-3-Clause"
+          }
+        }
+      ],
       "purl": "test_purl",
       "properties": [
         {
@@ -61,6 +73,13 @@
       "type": "library",
       "name": "unicode",
       "version": "8.0",
+      "licenses": [
+        {
+          "license": {
+            "id": "Unicode-DFS-2016"
+          }
+        }
+      ],
       "scope": "optional",
       "purl": "test_purl",
       "properties": [

buildscripts/tests/sbom_linter/test_sbom.py

@@ -103,6 +103,14 @@ class TestSbom(unittest.TestCase):
         error_manager = sbom_linter.lint_sbom(test_file, test_file, third_party_libs, False)
         self.assert_message_in_errors(error_manager, sbom_linter.VERSION_MISMATCH_ERROR)
 
+    def test_pedigree_version_match(self):
+        test_file = os.path.join(self.input_dir, "sbom_pedigree_version_match.json")
+        third_party_libs = {"kafka"}
+        error_manager = sbom_linter.lint_sbom(test_file, test_file, third_party_libs, False)
+        if not error_manager.zero_error():
+            error_manager.print_errors()
+        self.assertTrue(error_manager.zero_error())
+
     def test_schema_match_failure(self):
         test_file = os.path.join(self.input_dir, "sbom_component_name_missing.json")
         third_party_libs = {"librdkafka"}
@@ -116,3 +124,26 @@ class TestSbom(unittest.TestCase):
         self.assert_message_in_errors(
             error_manager, sbom_linter.MISSING_VERSION_IN_SBOM_COMPONENT_ERROR
         )
+
+    def test_missing_license(self):
+        test_file = os.path.join(self.input_dir, "sbom_missing_license.json")
+        third_party_libs = {"librdkafka"}
+        error_manager = sbom_linter.lint_sbom(test_file, test_file, third_party_libs, False)
+        self.assert_message_in_errors(
+            error_manager, sbom_linter.MISSING_LICENSE_IN_SBOM_COMPONENT_ERROR
+        )
+
+    def test_invalid_license_expression(self):
+        test_file = os.path.join(self.input_dir, "sbom_invalid_license_expression.json")
+        third_party_libs = {"librdkafka"}
+        error_manager = sbom_linter.lint_sbom(test_file, test_file, third_party_libs, False)
+        # print(error_manager.errors)
+        self.assert_message_in_errors(error_manager, "ExpressionInfo")
+
+    def test_named_license(self):
+        test_file = os.path.join(self.input_dir, "sbom_named_license.json")
+        third_party_libs = {"murmurhash3"}
+        error_manager = sbom_linter.lint_sbom(test_file, test_file, third_party_libs, False)
+        if not error_manager.zero_error():
+            error_manager.print_errors()
+        self.assertTrue(error_manager.zero_error())

buildscripts/tests/test_packager.py

@@ -47,3 +47,45 @@ class TestPackager(TestCase):
             with self.subTest(name=case.name):
                 spec = Spec(ver=case.version)
                 self.assertEqual(spec.is_nightly(), case.want)
+
+    def test_community_suffix(self) -> None:
+        """Test community suffix"""
+
+        @dataclass
+        class Case:
+            """Test case data."""
+
+            name: str
+            version: str
+            want: str
+
+        cases = [
+            Case(name="Old unstable", version="4.3.0", want="-org-unstable"),
+            Case(name="Old stable 4.2", version="4.2.0", want="-org"),
+            Case(name="Old stable 4.4", version="4.4.0", want="-org"),
+            Case(
+                name="New stable standard",
+                version="8.0.0",
+                want="-org",
+            ),
+            Case(
+                name="New unstable standard 8.1",
+                version="8.1.0",
+                want="-org-unstable",
+            ),
+            Case(
+                name="New unstable standard 7.2",
+                version="7.2.0",
+                want="-org-unstable",
+            ),
+            Case(
+                name="New stable special case",
+                version="8.2.0",
+                want="-org",
+            ),
+        ]
+
+        for case in cases:
+            with self.subTest(name=case.name):
+                spec = Spec(ver=case.version)
+                self.assertEqual(spec.suffix(), case.want)

buildscripts/validate_evg_project_config.py

@@ -2,7 +2,6 @@ import os.path
 import re
 import subprocess
 import sys
-from collections import defaultdict
 
 import structlog
 import typer
@@ -17,8 +16,6 @@ LOGGER = structlog.get_logger(__name__)
 DEFAULT_LOCAL_EVG_AUTH_CONFIG = os.path.expanduser("~/.evergreen.yml")
 
 DEFAULT_EVG_PROJECT_NAME = "mongodb-mongo-master"
-DEFAULT_EVG_NIGHTLY_PROJECT_NAME = "mongodb-mongo-master-nightly"
-DEFAULT_EVG_PROJECT_CONFIG = "etc/evergreen.yml"
 DEFAULT_EVG_NIGHTLY_PROJECT_CONFIG = "etc/evergreen_nightly.yml"
 
 UNMATCHED_REGEXES = [
@@ -69,74 +66,23 @@ def main(
     evg_project_config_map = {evg_project_name: DEFAULT_EVG_NIGHTLY_PROJECT_CONFIG}
     if evg_project_name == DEFAULT_EVG_PROJECT_NAME:
         evg_project_config_map = {
-            DEFAULT_EVG_PROJECT_NAME: DEFAULT_EVG_PROJECT_CONFIG,
             DEFAULT_EVG_NIGHTLY_PROJECT_NAME: DEFAULT_EVG_NIGHTLY_PROJECT_CONFIG,
         }
 
-    shared_evg_validate_messages = []
-    error_on_evg_validate_messages = defaultdict(list)
-
-    num_of_projects = len(evg_project_config_map)
     evergreen_bin = find_evergreen_binary("evergreen")
-    for project, project_config in evg_project_config_map.items():
+    for _, project_config in evg_project_config_map.items():
         cmd = [
             evergreen_bin,
             "--config",
             evg_auth_config,
-            "validate",
-            "--project",
-            project,
+            "evaluate",
             "--path",
             project_config,
         ]
         LOGGER.info(f"Running command: {cmd}")
-        result = subprocess.run(cmd, capture_output=True, text=True)
-        interesting_messages = result.stdout.strip().split("\n")[:-1]
+        subprocess.run(cmd, capture_output=True, text=True, check=True)
 
-        (error_on_evg_validate_messages[project], allowed_if_not_shared) = messages_to_report(
-            interesting_messages, num_of_projects
-        )
-        shared_evg_validate_messages.extend(allowed_if_not_shared)
-
-    error_on_shared_evg_validate_messages = []
-    for message in set(shared_evg_validate_messages):
-        if shared_evg_validate_messages.count(message) == num_of_projects:
-            error_on_shared_evg_validate_messages.append(message)
-
-    exit_code = 0
-    all_configs = list(evg_project_config_map.values())
-    all_projects = list(evg_project_config_map.keys())
-
-    for project, errors in error_on_evg_validate_messages.items():
-        if len(errors) > 0:
-            exit_code = 1
-            project_config = evg_project_config_map[project]
-            LOGGER.info(HORIZONTAL_LINE)
-            LOGGER.error(f"Config '{project_config}' for '{project}' evergreen project has errors:")
-            for error in errors:
-                LOGGER.error(error)
-                if any(regex.match(error) for regex in UNMATCHED_REGEXES):
-                    LOGGER.info(
-                        "Unmatched selector/criteria are allowed if they are tagged based (using '!' or '.'), but not if they directly name a task/task group"
-                    )
-
-    if len(error_on_shared_evg_validate_messages) > 0:
-        exit_code = 1
-        LOGGER.info(HORIZONTAL_LINE)
-        LOGGER.error(
-            f"Configs {all_configs} for evergreen projects {all_projects} have errors"
-            f" (they can be fixed in either config):"
-        )
-        for error in error_on_shared_evg_validate_messages:
-            LOGGER.error(error)
-
-    if exit_code == 0:
-        LOGGER.info(HORIZONTAL_LINE)
-        LOGGER.info(
-            f"Config(s) {all_configs} for evergreen project(s) {all_projects} is(are) valid"
-        )
-
-    sys.exit(exit_code)
+    sys.exit(0)
 
 
 if __name__ == "__main__":

copy.bara.sky

@@ -12,12 +12,12 @@ core.workflow(
     name = "default",
     origin = git.origin(
         url = sourceUrl,
-        ref = "master",
+        ref = "v8.2",
     ),
     destination = git.destination(
         url = destinationUrl,
-        fetch = "master",
-        push = "master",
+        fetch = "v8.2",
+        push = "v8.2",
     ),
     # Change path to the folder you want to publish publicly
     origin_files = glob(["**"], exclude = ["src/mongo/db/modules/**"]),

copy.bara.staging.sky

@@ -7,12 +7,12 @@ core.workflow(
     name = "default",
     origin = git.origin(
         url = sourceUrl,
-        ref = "master",
+        ref = "v8.2",
     ),
     destination = git.destination(
         url = destinationUrl,
-        fetch = "master",
-        push = "master",
+        fetch = "v8.2",
+        push = "v8.2",
     ),
     # Change path to the folder you want to publish publicly
     origin_files = glob(["**"], exclude = ["src/mongo/db/modules/**"]),

debian/mongokerberos.1

@@ -69,9 +69,9 @@ documentation. For configuring MongoDB to authenticate using Kerberos,
 please reference the following tutorials:
 .RS
 .IP \(bu 2
-\fBConfigure MongoDB with Kerberos Authentication on Linux\f1
+\fBConfigure Self\-Managed MongoDB with Kerberos Authentication on Linux\f1
 .IP \(bu 2
-\fBConfigure MongoDB with Kerberos Authentication on Windows\f1\&.
+\fBConfigure Self\-Managed MongoDB with Kerberos Authentication on Windows\f1\&.
 .RE
 .PP
 This document provides a complete overview of all command line options
@@ -327,7 +327,7 @@ output.
 .PP
 Specifies a configuration file for runtime configuration options.
 The options are equivalent to the command\-line
-configuration options. See \fBConfiguration File Options\f1 for
+configuration options. See \fBSelf\-Managed Configuration File Options\f1 for
 more information.
 .PP
 \fBmongokerberos\f1\f1 will read the values for

debian/mongoldap.1

@@ -1,6 +1,13 @@
 .TH mongoldap 1
 .SH MONGOLDAP
 \fIMongoDB Enterprise\f1
+.PP
+Starting in MongoDB 8.0, LDAP authentication and authorization is
+deprecated. LDAP is available and will continue to operate without
+changes throughout the lifetime of MongoDB 8. LDAP will be removed in a
+future major release.
+.PP
+For details, see \fBLDAP Deprecation\f1\&.
 .SH SYNOPSIS
 .PP
 MongoDB Enterprise provides
@@ -196,11 +203,11 @@ If your connection string specifies \fB"srv_raw:<DNS_NAME>"\f1,
 .PP
 Specifies a configuration file for runtime configuration options.
 The options are equivalent to the command\-line
-configuration options. See \fBConfiguration File Options\f1 for
+configuration options. See \fBSelf\-Managed Configuration File Options\f1 for
 more information.
 .PP
-\fBmongoldap\f1\f1 uses any configuration options related to \fBLDAP Proxy Authentication\f1
-or \fBLDAP Authorization\f1 for testing LDAP authentication or
+\fBmongoldap\f1\f1 uses any configuration options related to \fBSelf\-Managed LDAP Proxy Authentication\f1
+or \fBLDAP Authorization on Self\-Managed Deployments\f1 for testing LDAP authentication or
 authorization.
 .PP
 Requires specifying \fB\-\-user\f1\f1\&. May accept \fB\-\-password\f1\f1 for
@@ -377,7 +384,7 @@ libraries by default. Defer to the documentation associated with each
 SASL mechanism for guidance on installation and configuration.
 .PP
 If using the \fBGSSAPI\f1 SASL mechanism for use with
-\fBKerberos Authentication\f1, verify the following for the
+\fBKerberos Authentication on Self\-Managed Deployments\f1, verify the following for the
 \fBmongoldap\f1\f1 host machine:
 .PP
 \fBLinux\f1\f1
@@ -492,7 +499,7 @@ authenticate to MongoDB with usernames that are not full LDAP DNs.
 Using an \fBLDAP authorization query template\f1\f1 that requires a DN.
 .IP \(bu 2
 Transforming the usernames of clients authenticating to Mongo DB using
-different authentication mechanisms (e.g. x.509, kerberos) to a full LDAP
+different authentication mechanisms (e.g. X.509, kerberos) to a full LDAP
 DN for authorization.
 .RE
 .PP

debian/mongos.1

@@ -1,5 +1,5 @@
 .TH mongos 1
-.SH MONGOS
+.SH MONGOS INSTANCES
 .SH SYNOPSIS
 For a \fBsharded cluster\f1, the \fBmongos\f1
 instances provide the interface between the client applications and the
@@ -16,12 +16,12 @@ MongoDB disables support for TLS 1.0
 encryption on systems where TLS 1.1+ is available.
 .IP \(bu 2
 The \fBmongos\f1\f1 binary cannot connect to \fBmongod\f1\f1
-instances whose \fBfeature compatibility version (fCV)\f1 is greater
+instances whose \fBfeature compatibility version (FCV)\f1 is greater
 than that of the \fBmongos\f1\f1\&. For example, you cannot connect
-a MongoDB 5.0 version \fBmongos\f1\f1 to a 7.0
-sharded cluster with \fBfCV\f1 set to 7.0\&. You
+a MongoDB 5.0 version \fBmongos\f1\f1 to a 8.0
+sharded cluster with \fBFCV\f1 set to 8.0\&. You
 can, however, connect a MongoDB 5.0 version
-\fBmongos\f1\f1 to a 7.0 sharded cluster with \fBfCV\f1 set to 5.0\&.
+\fBmongos\f1\f1 to a 8.0 sharded cluster with \fBFCV\f1 set to 5.0\&.
 .IP \(bu 2
 \fBmongod\f1\f1 includes a \fBFull Time Diagnostic Data Capture\f1 mechanism to assist MongoDB engineers with troubleshooting
 deployments. If this thread fails, it terminates the originating process.
@@ -32,7 +32,7 @@ directory. For \fBmongod\f1 the directory is within
 .RE
 .SH OPTIONS
 .PP
-\fBConfiguration File Settings and Command\-Line Options Mapping\f1
+\fBSelf\-Managed Configuration File Settings and Command\-Line Options Mapping\f1
 .RS
 .IP \(bu 2
 MongoDB deprecates the SSL options and instead adds new
@@ -66,7 +66,7 @@ Returns the \fBmongos\f1 release number.
 Specifies a configuration file for runtime configuration options. The
 configuration file is the preferred method for runtime configuration of
 \fBmongos\f1\&. The options are equivalent to the command\-line
-configuration options. See \fBConfiguration File Options\f1 for
+configuration options. See \fBSelf\-Managed Configuration File Options\f1 for
 more information.
 .PP
 Ensure the configuration file uses ASCII encoding. The \fBmongos\f1
@@ -124,7 +124,7 @@ list, for example: \fBrest, exec\f1\&. If the configuration file contains
 expansion directives not specified to \fB\-\-configExpand\f1\f1, the \fBmongos\f1
 returns an error and terminates.
 .PP
-See \fBExternally Sourced Configuration File Values\f1 for configuration files
+See \fBExternally Sourced Configuration File Values for Self\-Managed Deployments\f1 for configuration files
 for more information on expansion directives.
 .RE
 .PP
@@ -204,12 +204,12 @@ configured with an IP address fail startup validation and do not start.
 Before you bind your instance to a publicly\-accessible IP address,
 you must secure your cluster from unauthorized access. For a complete
 list of security recommendations, see
-\fBSecurity Checklist\f1\&. At minimum, consider
+\fBSecurity Checklist for Self\-Managed Deployments\f1\&. At minimum, consider
 \fBenabling authentication\f1 and \fBhardening
 network infrastructure\f1\&.
 .PP
 For more information about IP Binding, refer to the
-\fBIP Binding\f1 documentation.
+\fBIP Binding in Self\-Managed Deployments\f1 documentation.
 .PP
 To bind to all IPv4 addresses, enter \fB0.0.0.0\f1\&.
 .PP
@@ -241,12 +241,12 @@ addresses (i.e. \fB0.0.0.0\f1). If \fBmongos\f1 starts with
 Before you bind your instance to a publicly\-accessible IP address,
 you must secure your cluster from unauthorized access. For a complete
 list of security recommendations, see
-\fBSecurity Checklist\f1\&. At minimum, consider
+\fBSecurity Checklist for Self\-Managed Deployments\f1\&. At minimum, consider
 \fBenabling authentication\f1 and \fBhardening
 network infrastructure\f1\&.
 .PP
 For more information about IP Binding, refer to the
-\fBIP Binding\f1 documentation.
+\fBIP Binding in Self\-Managed Deployments\f1 documentation.
 .PP
 Alternatively, you can set the \fB\-\-bind_ip\f1 option to \fB::,0.0.0.0\f1
 or to an asterisk \fB"*"\f1 (enclose the asterisk in quotes to avoid filename
@@ -259,7 +259,7 @@ is, you can specify one or the other, but not both.
 \fBmongos \-\-listenBacklog\f1
 .RS
 .PP
-\fIDefault\f1: Target system specific maximum value
+\fIDefault\f1: Target system \fBSOMAXCONN\f1 constant
 .PP
 The maximum number of connections that can exist in the listen
 queue.
@@ -272,30 +272,21 @@ To prevent undefined behavior, specify a value for this
 parameter between \fB1\f1 and the local system \fBSOMAXCONN\f1
 constant.
 .PP
-The default value for the \fBlistenBacklog\f1 parameter depends on the target
-system. On Linux, \fB/proc/sys/net/core/somaxconn\f1 is used. On all other
-target systems, the compile time constant \fBSOMAXCONN\f1 is used.
-\fBSOMAXCONN\f1 is the maximum valid value that is documented for
-the \fIbacklog\f1 parameter to the \fIlisten\f1 system call.
+The default value for the \fBlistenBacklog\f1 parameter depends on the
+target system. On Linux, MongoDB uses \fB/proc/sys/net/core/somaxconn\f1\&.
+On all other target systems, MongoDB uses the compile time constant
+\fBSOMAXCONN\f1\&.
 .PP
 Some systems may interpret \fBSOMAXCONN\f1 symbolically, and others
 numerically. The actual \fIlisten backlog\f1 applied in practice may
 differ from any numeric interpretation of the \fBSOMAXCONN\f1 constant
-or argument to \fB\-\-listenBacklog\f1, and may also be constrained by
-system settings like \fB/proc/sys/net/core/somaxconn\f1 on Linux.
+or argument to \fB\-\-listenBacklog\f1\&.
 .PP
 Passing a value for the \fBlistenBacklog\f1 parameter that exceeds the
 \fBSOMAXCONN\f1 constant for the local system is, by the letter of the
 standards, undefined behavior. Higher values may be silently integer
 truncated, may be ignored, may cause unexpected resource
 consumption, or have other adverse consequences.
-.PP
-On systems with workloads that exhibit connection spikes, for which
-it is empirically known that the local system can honor higher
-values for the \fIbacklog\f1 parameter than the \fBSOMAXCONN\f1 constant,
-setting the \fBlistenBacklog\f1 parameter to a higher value may reduce
-operation latency as observed by the client by reducing the number
-of connections which are forced into a backoff state.
 .RE
 .PP
 \fBmongos \-\-maxConns\f1
@@ -316,7 +307,7 @@ In this case, set \fBmaxIncomingConnections\f1\f1 to a value slightly
 higher than the maximum number of connections that the client creates, or the
 maximum size of the connection pool.
 .PP
-This setting prevents the \fBmongos\f1\f1 from causing connection spikes on
+This setting prevents the \fBmongos\f1 from causing connection spikes on
 the individual \fBshards\f1\&. Spikes like these may disrupt the
 operation and memory allocation of the \fBsharded cluster\f1\&.
 .RE
@@ -493,7 +484,7 @@ Installation Guide for your operating system.
 Specifies the path to a key file that stores the shared secret
 that MongoDB instances use to authenticate to each other in a
 \fBsharded cluster\f1 or \fBreplica set\f1\&. \fB\-\-keyFile\f1\f1 implies
-\fBclient authorization\f1\&. See \fBInternal/Membership Authentication\f1 for more
+\fBclient authorization\f1\&. See \fBSelf\-Managed Internal/Membership Authentication\f1 for more
 information.
 .PP
 \fBKeyfiles for internal membership authentication\f1 use YAML format to allow for multiple keys in a
@@ -513,7 +504,7 @@ keyfiles that use the text file format.
 .RS
 .PP
 Specifies one of the MongoDB parameters described in
-\fBMongoDB Server Parameters\f1\&. You can specify multiple \fBsetParameter\f1
+\fBMongoDB Server Parameters for a Self\-Managed Deployment\f1\&. You can specify multiple \fBsetParameter\f1
 fields.
 .RE
 .PP
@@ -545,7 +536,8 @@ always listens on the UNIX socket unless one of the following is true:
 \fBnet.bindIp\f1\f1 does not specify \fBlocalhost\f1 or its associated IP address
 .RE
 .PP
-\fBmongos\f1 installed from official \fB\&.deb\f1 and \fB\&.rpm\f1 packages
+\fBmongos\f1 installed from official \fBInstall MongoDB Community Edition on Debian\f1
+and \fBInstall MongoDB Community Edition on Red Hat or CentOS\f1 packages
 have the \fBbind_ip\f1 configuration set to \fB127.0.0.1\f1 by
 default.
 .RE
@@ -716,7 +708,7 @@ and use the \fBtimeZoneInfo\f1\f1 parameter.
 .PP
 Outputs the \fBmongos\f1 instance\(aqs configuration options, formatted
 in YAML, to \fBstdout\f1 and exits the \fBmongos\f1 instance. For
-configuration options that uses \fBExternally Sourced Configuration File Values\f1,
+configuration options that uses \fBExternally Sourced Configuration File Values for Self\-Managed Deployments\f1,
 \fB\-\-outputConfig\f1\f1 returns the resolved value for those options.
 .PP
 This may include any configured passwords or secrets previously
@@ -727,7 +719,7 @@ For usage examples, see:
 .IP \(bu 2
 \fBOutput the Configuration File with Resolved Expansion Directive Values\f1
 .IP \(bu 2
-\fBConvert Command\-Line Options to YAML\f1
+\fBConvert Self\-Managed Command\-Line Options to YAML\f1
 .RE
 .RE
 .SS SHARDED CLUSTER OPTIONS
@@ -841,11 +833,11 @@ The server uses and accepts only TLS encrypted connections.
 .RE
 .PP
 If \fB\-\-tlsCAFile\f1 or \fBtls.CAFile\f1 is not
-specified and you are not using x.509 authentication, you must set the
+specified and you are not using X.509 authentication, you must set the
 \fBtlsUseSystemCA\f1\f1 parameter to \fBtrue\f1\&. This makes MongoDB use
 the system\-wide CA certificate store when connecting to a TLS\-enabled server.
 .PP
-If using x.509 authentication, \fB\-\-tlsCAFile\f1 or \fBtls.CAFile\f1
+If using X.509 authentication, \fB\-\-tlsCAFile\f1 or \fBtls.CAFile\f1
 must be specified unless using \fB\-\-tlsCertificateSelector\f1\f1\&.
 .PP
 For more information about TLS and MongoDB, see
@@ -906,7 +898,7 @@ For more information about TLS and MongoDB, see
 \fIDefault\f1: keyFile
 .PP
 The authentication mode used for cluster authentication. If you use
-\fBinternal x.509 authentication\f1,
+\fBinternal X.509 authentication\f1,
 specify so here. This option can have one of the following values:
 .RS
 .IP \(bu 2
@@ -930,7 +922,7 @@ Accept only keyfiles.
 \fBsendKeyFile\f1
 .IP \(bu 4
 For rolling upgrade purposes. Send a keyfile for
-authentication but can accept both keyfiles and x.509
+authentication but can accept both keyfiles and X.509
 certificates.
 .RE
 .IP \(bu 2
@@ -938,8 +930,8 @@ certificates.
 .IP \(bu 4
 \fBsendX509\f1
 .IP \(bu 4
-For rolling upgrade purposes. Send the x.509 certificate for
-authentication but can accept both keyfiles and x.509
+For rolling upgrade purposes. Send the X.509 certificate for
+authentication but can accept both keyfiles and X.509
 certificates.
 .RE
 .IP \(bu 2
@@ -947,17 +939,17 @@ certificates.
 .IP \(bu 4
 \fBx509\f1
 .IP \(bu 4
-Recommended. Send the x.509 certificate for authentication and
-accept only x.509 certificates.
+Recommended. Send the X.509 certificate for authentication and
+accept only X.509 certificates.
 .RE
 .RE
 .PP
 If \fB\-\-tlsCAFile\f1 or \fBtls.CAFile\f1 is not
-specified and you are not using x.509 authentication, you must set the
+specified and you are not using X.509 authentication, you must set the
 \fBtlsUseSystemCA\f1\f1 parameter to \fBtrue\f1\&. This makes MongoDB use
 the system\-wide CA certificate store when connecting to a TLS\-enabled server.
 .PP
-If using x.509 authentication, \fB\-\-tlsCAFile\f1 or \fBtls.CAFile\f1
+If using X.509 authentication, \fB\-\-tlsCAFile\f1 or \fBtls.CAFile\f1
 must be specified unless using \fB\-\-tlsCertificateSelector\f1\f1\&.
 .PP
 For more information about TLS and MongoDB, see
@@ -972,7 +964,7 @@ On macOS or Windows, you can use a certificate
 from the operating system\(aqs secure store instead of a PEM
 file. See \fB\-\-tlsClusterCertificateSelector\f1\f1\&.
 .PP
-Specifies the \&.pem file that contains the x.509 certificate\-key
+Specifies the \&.pem file that contains the X.509 certificate\-key
 file for \fBmembership authentication\f1
 for the cluster or replica set.
 .PP
@@ -982,14 +974,12 @@ authentication or the alternative
 \fB\&.pem\f1 file specified in the \fB\-\-tlsCertificateKeyFile\f1\f1 option or
 the certificate returned by the \fB\-\-tlsCertificateSelector\f1\f1\&.
 .PP
-If using x.509 authentication, \fB\-\-tlsCAFile\f1 or \fBtls.CAFile\f1
+If using X.509 authentication, \fB\-\-tlsCAFile\f1 or \fBtls.CAFile\f1
 must be specified unless using \fB\-\-tlsCertificateSelector\f1\f1\&.
 .PP
 \fBmongod\f1\f1 / \fBmongos\f1\f1 logs a warning on
-connection if the presented x.509 certificate expires within \fB30\f1
-days of the \fBmongod/mongos\f1 host system time. See
-\fBx.509 Certificates Nearing Expiry Trigger Warnings\f1 for more
-information.
+connection if the presented X.509 certificate expires within \fB30\f1
+days of the \fBmongod/mongos\f1 host system time.
 .PP
 For more information about TLS and MongoDB, see
 \fBConfigure mongod\f1 and mongos\f1 for TLS/SSL\f1 and
@@ -999,17 +989,17 @@ For more information about TLS and MongoDB, see
 \fBmongos \-\-tlsClusterPassword\f1
 .RS
 .PP
-Specifies the password to decrypt the x.509 certificate\-key file
+Specifies the password to decrypt the X.509 certificate\-key file
 specified with \fB\-\-tlsClusterFile\f1\&. Use the \fB\-\-tlsClusterPassword\f1\f1 option only
 if the certificate\-key file is encrypted. In all cases, the \fBmongos\f1
 redacts the password from all logging and reporting output.
 .RS
 .IP \(bu 2
-On Linux/BSD, if the private key in the x.509 file is encrypted and
+On Linux/BSD, if the private key in the X.509 file is encrypted and
 you do not specify the \fB\-\-tlsClusterPassword\f1\f1 option, MongoDB prompts for a
 passphrase. See \fBTLS/SSL Certificate Passphrase\f1\&.
 .IP \(bu 2
-On macOS or Windows, if the private key in the x.509 file is
+On macOS or Windows, if the private key in the X.509 file is
 encrypted, you must explicitly specify the \fB\-\-tlsClusterPassword\f1\f1 option.
 Alternatively, you can either use a certificate from the secure
 system store (see \fB\-\-tlsClusterCertificateSelector\f1\f1) instead of a cluster PEM file or
@@ -1173,10 +1163,8 @@ The \fBthumbprint\f1 is sometimes referred to as a
 .RE
 .PP
 \fBmongod\f1\f1 / \fBmongos\f1\f1 logs a warning on
-connection if the presented x.509 certificate expires within \fB30\f1
-days of the \fBmongod/mongos\f1 host system time. See
-\fBx.509 Certificates Nearing Expiry Trigger Warnings\f1 for more
-information.
+connection if the presented X.509 certificate expires within \fB30\f1
+days of the \fBmongod/mongos\f1 host system time.
 .RE
 .PP
 \fBmongos \-\-tlsCRLFile\f1
@@ -1242,7 +1230,7 @@ connect.
 .PP
 If you specify
 \fB\-\-tlsAllowInvalidCertificates\f1 or \fBtls.allowInvalidCertificates:
-true\f1 when using x.509 authentication, an invalid certificate is
+true\f1 when using X.509 authentication, an invalid certificate is
 only sufficient to establish a TLS connection but is
 \fIinsufficient\f1 for authentication.
 .PP
@@ -1504,8 +1492,9 @@ The \fB<field>\f1 can be \fBany field in the audit message\f1, including fields
 To specify an audit filter, enclose the filter document in single
 quotes to pass the document as a string.
 .PP
-To specify the audit filter in a \fBconfiguration file\f1, you must use the YAML format of
-the configuration file.
+To specify the audit filter in a
+\fBconfiguration file\f1, you must use the YAML format
+of the configuration file.
 .PP
 Available only in MongoDB Enterprise (http://www.mongodb.com/products/mongodb\-enterprise\-advanced?tck=docs_server)
 and MongoDB Atlas (https://cloud.mongodb.com/user#/atlas/login)\&.
@@ -1586,6 +1575,13 @@ only and not the profiler since profiling is not available on
 .RE
 .SS LDAP AUTHENTICATION AND AUTHORIZATION OPTIONS
 .PP
+Starting in MongoDB 8.0, LDAP authentication and authorization is
+deprecated. LDAP is available and will continue to operate without
+changes throughout the lifetime of MongoDB 8. LDAP will be removed in a
+future major release.
+.PP
+For details, see \fBLDAP Deprecation\f1\&.
+.PP
 \fBmongos \-\-ldapServers\f1
 .RS
 .PP
@@ -1745,7 +1741,7 @@ libraries by default. Defer to the documentation associated with each
 SASL mechanism for guidance on installation and configuration.
 .PP
 If using the \fBGSSAPI\f1 SASL mechanism for use with
-\fBKerberos Authentication\f1, verify the following for the
+\fBKerberos Authentication on Self\-Managed Deployments\f1, verify the following for the
 \fBmongos\f1 host machine:
 .PP
 \fBLinux\f1\f1

etc/backports_required_for_multiversion_tests.yml

@@ -21,6 +21,8 @@
 #
 last-continuous:
   all:
+    - test_file: jstests/core/index/elemmatch_index.js
+      ticket: SERVER-108945
     - test_file: jstests/replsets/malformed_heartbeat_request.js
       ticket: SERVER-104563
     - test_file: jstests/core/query/query_settings/query_settings_strict_api.js
@@ -464,9 +466,35 @@ last-continuous:
       ticket: SERVER-106614
     - test_file: jstests/sharding/balancer_should_return_random_migrations_failpoint.js
       ticket: SERVER-105874
+    - test_file: jstests/sharding/query/lookup/union_with_doubly_nested_lookup.js
+      ticket: SERVER-108341
+    - test_file: jstests/core/timeseries/write/timeseries_insert_mixed_schema_docs.js
+      ticket: SERVER-107361
+    - test_file: jstests/core/timeseries/write/timeseries_closed_update_delete.js
+      ticket: SERVER-95726
+    - test_file: jstests/concurrency/fsm_workloads/query/remove/update_and_batched_delete.js
+      ticket: SERVER-95570
+    - test_file: jstests/aggregation/expressions/reduce_overflow.js
+      ticket: SERVER-102364
+    - test_file: jstests/sharding/txn_lookup_hits_migration_conflict_all_colls_local.js
+      ticket: SERVER-107535
+    - test_file: jstests/change_streams/events_containing_version_literals.js
+      ticket: SERVER-111406
+    - test_file: jstests/core/timeseries/geo/timeseries_geonear_measurements.js
+      ticket: SERVER-112520
+    - test_file: jstests/query_golden/distinct_index_eligibility_md.js
+      ticket: SERVER-111486
+    - test_file: jstests/sharding/migration_fails_with_spurious_documents.js
+      ticket: SERVER-110953
+    - test_file: jstests/core/query/boolean_simplifier_stress.js
+      ticket: SERVER-114126
+    - test_file: jstests/core/index/index_on_incorrect_collection.js
+      ticket: SERVER-113888
   suites: null
 last-lts:
   all:
+    - test_file: jstests/core/index/elemmatch_index.js
+      ticket: SERVER-108945
     - test_file: jstests/replsets/malformed_heartbeat_request.js
       ticket: SERVER-104563
     - test_file: jstests/core/query/query_settings/query_settings_strict_api.js
@@ -985,4 +1013,26 @@ last-lts:
       ticket: SERVER-105874
     - test_file: jstests/with_mongot/e2e/hybridSearch/ranked_fusion_with_filter.js
       ticket: SERVER-107352
+    - test_file: jstests/sharding/query/lookup/union_with_doubly_nested_lookup.js
+      ticket: SERVER-108341
+    - test_file: jstests/core/timeseries/write/timeseries_insert_mixed_schema_docs.js
+      ticket: SERVER-107361
+    - test_file: jstests/core/timeseries/write/timeseries_closed_update_delete.js
+      ticket: SERVER-95726
+    - test_file: jstests/concurrency/fsm_workloads/query/remove/update_and_batched_delete.js
+      ticket: SERVER-95570
+    - test_file: jstests/aggregation/expressions/reduce_overflow.js
+      ticket: SERVER-102364
+    - test_file: jstests/sharding/txn_lookup_hits_migration_conflict_all_colls_local.js
+      ticket: SERVER-107535
+    - test_file: jstests/change_streams/events_containing_version_literals.js
+      ticket: SERVER-111406
+    - test_file: jstests/core/timeseries/geo/timeseries_geonear_measurements.js
+      ticket: SERVER-112520
+    - test_file: jstests/query_golden/distinct_index_eligibility_md.js
+      ticket: SERVER-111486
+    - test_file: jstests/sharding/migration_fails_with_spurious_documents.js
+      ticket: SERVER-110953
+    - test_file: jstests/core/index/index_on_incorrect_collection.js
+      ticket: SERVER-113888
   suites: null

etc/coverity.yml

@@ -20,6 +20,8 @@ analyze:
         enabled: false
       GLOBAL_INIT_ORDER:
         enabled: false
+      UNCAUGHT_EXCEPT:
+        enabled: false
       # Explicitly enabled checkers
       # Add any checker that needs to be explicitly enabled below
       REVERSE_OVERRUN:
@@ -53,5 +55,5 @@ analyze:
 
 commit:
   connect:
-    stream: mongo.master
+    stream: mongo.v8.2
     project: "MongoDB master"

etc/evergreen_lint.yml

@@ -94,6 +94,9 @@ rules:
 
           # https://github.com/10gen/mothra/blob/main/mothra/teams/et.yaml
           - assigned_to_jira_team_streams
+
+          # https://github.com/10gen/mothra/blob/main/mothra/teams/security.yaml
+          - assigned_to_jira_team_platsec_server
         min_num_of_tags: 1
         max_num_of_tags: 1
       # Every task should have required selection tag

etc/evergreen_nightly.yml

@@ -15,11 +15,11 @@ include:
 
   - filename: etc/evergreen_yml_components/variants/misc/task_generation.yml
   ### Uncomment when using this file for a LTS or Rapid release branch. ###
-  # - filename: etc/evergreen_yml_components/variants/misc/misc.yml
+  - filename: etc/evergreen_yml_components/variants/misc/misc.yml
 
   - filename: etc/evergreen_yml_components/variants/amazon/test_release.yml
   ### Uncomment when using this file for a LTS or Rapid release branch. ###
-  # - filename: etc/evergreen_yml_components/variants/amazon/test_dev.yml
+  - filename: etc/evergreen_yml_components/variants/amazon/test_dev.yml
 
   - filename: etc/evergreen_yml_components/variants/debian/test_release.yml
 
@@ -30,40 +30,76 @@ include:
 
   - filename: etc/evergreen_yml_components/variants/rhel/test_release.yml
   ### Uncomment when using this file for a LTS or Rapid release branch. ###
-  # - filename: etc/evergreen_yml_components/variants/rhel/test_dev.yml
+  - filename: etc/evergreen_yml_components/variants/rhel/test_dev.yml
   ### Uncomment when using this file for a LTS release branch. ###
-  # - filename: etc/evergreen_yml_components/variants/rhel/test_dev_master_and_lts_branches_only.yml
+  - filename: etc/evergreen_yml_components/variants/rhel/test_dev_master_and_lts_branches_only.yml
 
   ### Uncomment when using this file for a LTS or Rapid release branch. ###
-  # - filename: etc/evergreen_yml_components/variants/sanitizer/test_dev.yml
+  - filename: etc/evergreen_yml_components/variants/sanitizer/test_dev.yml
 
   ### Uncomment when using this file for a LTS or Rapid release branch. ###
-  # filename: etc/evergreen_yml_components/variants/mongot/test_dev.yml
+  - filename: etc/evergreen_yml_components/variants/mongot/test_dev.yml
 
   - filename: etc/evergreen_yml_components/variants/suse/test_release.yml
 
   - filename: etc/evergreen_yml_components/variants/ubuntu/test_release.yml
   ### Uncomment when using this file for a LTS release branch. ###
-  # - filename: etc/evergreen_yml_components/variants/ubuntu/test_dev_master_and_lts_branches_only.yml
+  - filename: etc/evergreen_yml_components/variants/ubuntu/test_dev_master_and_lts_branches_only.yml
 
   - filename: etc/evergreen_yml_components/variants/windows/test_release.yml
   ### Uncomment when using this file for a LTS or Rapid release branch. ###
-  # - filename: etc/evergreen_yml_components/variants/windows/test_dev.yml
+  - filename: etc/evergreen_yml_components/variants/windows/test_dev.yml
   ### Uncomment when using this file for a LTS release branch. ###
-  # - filename: etc/evergreen_yml_components/variants/windows/test_dev_master_and_lts_branches_only.yml
+  - filename: etc/evergreen_yml_components/variants/windows/test_dev_master_and_lts_branches_only.yml
 
   - filename: etc/evergreen_yml_components/tasks/coverity_tasks.yml
   - filename: etc/evergreen_yml_components/variants/coverity.yml
   - filename: etc/evergreen_yml_components/tasks/release_tasks.yml
   ### Uncomment when using this file for a LTS or Rapid release branch. ###
-  # - filename: etc/evergreen_yml_components/variants/release/release.yml
+  - filename: etc/evergreen_yml_components/variants/release/release.yml
 
 parameters:
   - key: evergreen_config_file_path
     value: "etc/evergreen_nightly.yml"
     description: "path to this file"
 
+commit_queue_aliases:
+  - variant: "commit-queue"
+    task: "^(bazel_.*|run_.*|unit_test_group.*|compile_.*|lint_.*|jsCore|check_for_noexcept|version_gen_validation|validate_commit_message|resmoke_validation_tests|buildscripts_test)$"
+    variant_tags: []
+    task_tags: []
+  - variant: "^(amazon-linux2023-arm64-static-compile|linux-x86-dynamic-compile-required)$"
+    variant_tags: []
+    task_tags: ["clang_tidy"]
+  - variant: "^(al2023-arm64-sep-benchmark)$"
+    variant_tags: []
+    task_tags: ["benchmarks_sep"]
+
+github_pr_aliases:
+  - variant: "commit-queue"
+    task: "^(bazel_.*|run_.*|unit_test_group.*|compile_.*|lint_.*|jsCore|check_for_noexcept|version_gen_validation|validate_commit_message|resmoke_validation_tests|buildscripts_test)$"
+    variant_tags: []
+    task_tags: []
+  - variant: "^(amazon-linux2023-arm64-static-compile|linux-x86-dynamic-compile-required)$"
+    variant_tags: []
+    task_tags: ["clang_tidy"]
+  - variant: "^(al2023-arm64-sep-benchmark)$"
+    variant_tags: []
+    task_tags: ["benchmarks_sep"]
+
 patch_aliases:
+  - alias: required
+    variant_tags: ["required"]
+    task: ".*"
+  - alias: query
+    variant: "^(.*query-patch-only|amazon-linux2023-arm64-static-compile)$"
+    task: ".*"
+  - alias: query-quick
+    variant: "^(.*query-quick-patch-only|linux-x86-dynamic-compile)$"
+    task: ".*"
+  - alias: security
+    variant: "^(.*security-patch-only|linux-x86-dynamic-compile|windows-compile-required)$"
+    task: ".*"
   - alias: bazel
     description: "Runs bazel build system tests"
     variant_tags: ["bazel_check"]
@@ -72,3 +108,25 @@ patch_aliases:
     description: "Runs bazel build system tests"
     variant_tags: ["bazel_check"]
     task: ".*"
+  - alias: search
+    description: "Runs all $search, $vectorSearch tests"
+    variant: ".*"
+    task: "^.*search*"
+  - alias: required-and-mongot-e2e-tests
+    description: >
+      This alias selects all tasks in all required variants and all tasks in variants that use a real mongot.
+      Once more e2e tests have been contributed and thus our coverage is better, this alias can be refined
+      to only select tests that use a real mongot.
+    variant_tags: ["required", "mongot_e2e"]
+    task: ".*"
+  - alias: codecoverage
+    description: "Run tests and report code coverage"
+    variant: ".*-coverage"
+    task: ".*"
+  - alias: unittestcoverage
+    description: "Run unit tests and report code coverage"
+    variant: ".*-coverage"
+    task: "^(unit_test_group.*|bazel_coverage)$"
+  - alias: cluster_scalability
+    variant_tags: ["cluster_scalability_only"]
+    task_tags: ["cluster_scalability_only"]

etc/evergreen_timeouts.yml

@@ -27,10 +27,6 @@ overrides:
       exec_timeout: 600 # 10 hours
     - task: change_stream_optimization_fuzzer
       exec_timeout: 600 # 10 hours
-    - task: change_stream_serverless_fuzzer
-      exec_timeout: 600 # 10 hours
-    - task: change_stream_serverless_no_optimization_fuzzer
-      exec_timeout: 600 # 10 hours
 
   enterprise-amazon-linux2023-arm64-all-non-rollback-feature-flags-fuzzers:
     - task: ^change_stream_.*_fuzzer
@@ -53,10 +49,6 @@ overrides:
       exec_timeout: 600 # 10 hours
     - task: change_stream_optimization_fuzzer
       exec_timeout: 600 # 10 hours
-    - task: change_stream_serverless_fuzzer
-      exec_timeout: 600 # 10 hours
-    - task: change_stream_serverless_no_optimization_fuzzer
-      exec_timeout: 600 # 10 hours
 
   enterprise-amazon2023-arm64-fuzzers-roll-back-incremental-feature-flags:
     - task: ^change_stream_.*_fuzzer
@@ -173,10 +165,6 @@ overrides:
       exec_timeout: 600 # 10 hours
     - task: change_stream_optimization_fuzzer
       exec_timeout: 600 # 10 hours
-    - task: change_stream_serverless_fuzzer
-      exec_timeout: 600 # 10 hours
-    - task: change_stream_serverless_no_optimization_fuzzer
-      exec_timeout: 600 # 10 hours
     - task: update_timeseries_fuzzer
       exec_timeout: 600 # 10 hours
     - task: read_concern_linearizable_passthrough
@@ -309,18 +297,10 @@ overrides:
   rhel8-debug-aubsan-all-feature-flags:
     - task: update_timeseries_fuzzer
       exec_timeout: 180 # 3 hours
-    - task: change_stream_serverless_no_optimization_fuzzer
-      exec_timeout: 600 # 10 hours
-    - task: change_stream_serverless_fuzzer
-      exec_timeout: 600 # 10 hours
     - task: change_stream_optimization_fuzzer
       exec_timeout: 600 # 10 hours
 
   rhel8-debug-aubsan:
-    - task: change_stream_serverless_no_optimization_fuzzer
-      exec_timeout: 600 # 10 hours
-    - task: change_stream_serverless_fuzzer
-      exec_timeout: 600 # 10 hours
     - task: change_stream_optimization_fuzzer
       exec_timeout: 600 # 10 hours
 

etc/evergreen_yml_components/definitions.yml

@@ -1975,9 +1975,14 @@ functions:
 
   "setup jstestfuzz":
     - *f_expansions_write
-    - command: ec2.assume_role
+    - command: github.generate_token
       params:
-        role_arn: "arn:aws:iam::901841024863:role/ecr-role-evergreen-ro"
+        owner: 10gen
+        repo: jstestfuzz
+        expansion_name: github_token
+        permissions:
+          metadata: read
+          contents: read
     - command: subprocess.exec
       display_name: "jstestfuzz setup sh"
       params:
@@ -1985,13 +1990,7 @@ functions:
         args:
           - "./src/evergreen/jstestfuzz_setup.sh"
         include_expansions_in_env:
-          - AWS_ACCESS_KEY_ID
-          - AWS_SECRET_ACCESS_KEY
-          - AWS_SESSION_TOKEN
-    - command: expansions.update
-      params:
-        file: src/expansions.yml
-    - *f_expansions_write
+          - github_token
 
   "setup query_tester test repos":
     - *f_expansions_write
@@ -2031,8 +2030,6 @@ functions:
         binary: bash
         args:
           - "src/evergreen/lint_fuzzer_sanity_patch.sh"
-        include_expansions_in_env:
-          - CONTAINER_RUNTIME
 
   "lint fuzzer sanity all":
     - *f_expansions_write
@@ -2042,8 +2039,6 @@ functions:
         binary: bash
         args:
           - "./src/evergreen/lint_fuzzer_sanity_all.sh"
-        include_expansions_in_env:
-          - CONTAINER_RUNTIME
 
   "monitor mongo fork 10gen":
     - *f_expansions_write
@@ -2093,8 +2088,6 @@ functions:
         binary: bash
         args:
           - "./src/evergreen/jstestfuzz_run.sh"
-        include_expansions_in_env:
-          - CONTAINER_RUNTIME
     - command: archive.targz_pack
       display_name: "archive jstests.tgz"
       params:

etc/evergreen_yml_components/tasks/compile_tasks_nightly.yml

@@ -149,10 +149,6 @@ tasks:
       - name: jsCore
       - name: run_dbtest
       - name: replica_sets_jscore_passthrough_gen
-      - name: test_windows_msi
-        variant: "windows"
-      - name: test_windows_msi
-        variant: "enterprise-windows"
     stepback: false
     commands:
       - command: manifest.load

etc/evergreen_yml_components/tasks/misc_tasks.yml

@@ -615,36 +615,6 @@ tasks:
           target: >-
             //:format -- --check --all
 
-  - name: bazel_run_codeowners
-    tags:
-      [
-        "assigned_to_jira_team_devprod_build",
-        "development_critical_single_variant",
-        "lint",
-        "bazel_check",
-      ]
-    depends_on:
-      - name: version_expansions_gen
-        variant: generate-tasks-for-version
-    commands:
-      - command: timeout.update
-        params:
-          # 40 minutes
-          exec_timeout_secs: 2400
-      - func: "f_expansions_write"
-      - command: manifest.load
-      - func: "git get project and add git tag"
-      - func: "f_expansions_write"
-      - func: "kill processes"
-      - func: "cleanup environment"
-      - func: "set up venv"
-      - func: "upload pip requirements"
-      - func: "get engflow creds"
-      - func: "bazel run"
-        vars:
-          target: >-
-            //:codeowners -- --check --expansions-file ../expansions.yml
-
   # TODO(SERVER-97804): rename if display_name appears on the evergreen UI
   - name: bazel_run_//buildscripts:resmoke
     tags:
@@ -1947,6 +1917,59 @@ tasks:
             GITHUB_REPO: ${github_repo}
             GITHUB_TOKEN: ${github_token}
 
+  - name: upload_sbom_via_silkbomb_if_changed
+    allowed_requesters: ["commit", "patch"]
+    tags: ["auxiliary", "assigned_to_jira_team_platsec_server"]
+    exec_timeout_secs: 600 # 10 minute timeout
+    commands:
+      - command: manifest.load
+      - func: "git get project and add git tag"
+      - func: "f_expansions_write"
+      - func: "kill processes"
+      - func: "cleanup environment"
+      - func: "set up venv"
+      - func: "upload pip requirements"
+      - command: ec2.assume_role
+        display_name: Assume Silkbomb IAM role
+        params:
+          role_arn: arn:aws:iam::119629040606:role/silkbomb
+      - func: "f_expansions_write"
+      - command: subprocess.exec
+        display_name: Write temporary AWS credentials to Silkbomb environment file
+        params:
+          binary: bash
+          args:
+            - "src/evergreen/write_aws_creds_to_silkbomb_env_file.sh"
+          include_expansions_in_env:
+            [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN]
+      - command: ec2.assume_role
+        display_name: Assume DevProd Platforms ECR readonly IAM role
+        params:
+          role_arn: arn:aws:iam::901841024863:role/ecr-role-evergreen-ro
+      - command: subprocess.exec
+        params:
+          binary: bash
+          include_expansions_in_env:
+            - AWS_ACCESS_KEY_ID
+            - AWS_SECRET_ACCESS_KEY
+            - AWS_SESSION_TOKEN
+            - github_token
+          args:
+            - "./src/evergreen/run_python_script.sh"
+            - "evergreen/functions/upload_sbom_via_silkbomb.py"
+            - "--run"
+          env:
+            REQUESTER: ${requester}
+            BRANCH_NAME: ${branch_name}
+            GITHUB_ORG: ${github_org}
+            GITHUB_REPO: ${github_repo}
+            CONTAINER_COMMAND: podman # podman or docker
+            CONTAINER_IMAGE: 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0
+            CONTAINER_ENV_FILES: ${workdir}/silkbomb.env
+            WORKING_DIR: ${workdir}
+            SBOM_REPO_PATH: sbom.json
+            LOCAL_REPO_PATH: src
+
   - name: check_for_noexcept
     allowed_requesters: ["github_pr"]
     tags:

etc/evergreen_yml_components/tasks/release_tasks.yml

@@ -1,7 +1,5 @@
 tasks:
   - name: publish-sast-report
-    # uses "Admin Only" variables, so patch runs will only work for admins
-    allowed_requesters: ["commit", "github_tag", "patch"]
     tags: ["auxiliary", "assigned_to_jira_team_devprod_release_infrastructure"]
     depends_on:
       - name: version_expansions_gen
@@ -23,6 +21,10 @@ tasks:
           binary: "${workdir}/src/evergreen/write_sast_report_env_file.sh"
           env:
             WORK_DIR: ${workdir}
+            JIRA_OAUTH_ACCESS_TOKEN: ${jira_auth_access_token}
+            JIRA_OAUTH_ACCESS_TOKEN_SECRET: ${jira_auth_access_token_secret}
+            JIRA_OAUTH_CONSUMER_KEY: ${jira_auth_consumer_key}
+            JIRA_OAUTH_KEY_CERT: ${jira_auth_key_cert}
             SAST_REPORT_COVERITY_USERNAME: ${SAST_REPORT_COVERITY_USERNAME}
             SAST_REPORT_COVERITY_PASSWORD: ${SAST_REPORT_COVERITY_PASSWORD}
             SAST_REPORT_UPLOAD_GOOGLE_CLIENT_ID: ${SAST_REPORT_UPLOAD_GOOGLE_CLIENT_ID}
@@ -35,6 +37,7 @@ tasks:
           env:
             WORK_DIR: ${workdir}
             MODULE_PATH: ${workdir}/devprodCoveritySrc/devprod_coverity
+            GITHUB_COMMIT: ${github_commit}
             TRIGGERED_BY_GIT_TAG: ${triggered_by_git_tag}
             MONGODB_VERSION: ${version}
             MONGODB_RELEASE_BRANCH: ${branch_name}

etc/evergreen_yml_components/tasks/resmoke/non_server_teams/tasks.yml

@@ -365,7 +365,7 @@ tasks:
           <<: *jstestfuzz_config_vars
           num_files: 2
           num_tasks: 2
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: //buildscripts/resmokeconfig:jstestfuzz
           npm_command: jstestfuzz
           bazel_args: >-

etc/evergreen_yml_components/tasks/resmoke/server_divisions/clusters_and_integrations/tasks.yml

@@ -2513,7 +2513,7 @@ tasks:
           <<: *jstestfuzz_config_vars
           num_files: ${jstestfuzz_concurrent_num_files|10}
           num_tasks: 5
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_sharded_causal_consistency
           resmoke_args: --numClientsPerFixture=10
 
@@ -2538,7 +2538,7 @@ tasks:
           <<: *jstestfuzz_config_vars
           num_files: ${jstestfuzz_concurrent_num_files|10}
           num_tasks: 2
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_sharded_kill_terminate_stepdown
           resmoke_args: --numClientsPerFixture=10
 
@@ -2567,7 +2567,7 @@ tasks:
           <<: *jstestfuzz_config_vars
           num_files: ${jstestfuzz_concurrent_num_files|10}
           num_tasks: 2
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_sharded_kill_terminate_stepdown
           resmoke_args: >-
             --numClientsPerFixture=10
@@ -2651,7 +2651,7 @@ tasks:
           <<: *jstestfuzz_config_vars
           num_files: ${jstestfuzz_concurrent_num_files|10}
           num_tasks: 5
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_sharded
           resmoke_args: --numClientsPerFixture=10
 
@@ -2674,7 +2674,7 @@ tasks:
           <<: *jstestfuzz_config_vars
           num_files: ${jstestfuzz_concurrent_num_files|10}
           num_tasks: 5
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_sharded_notablescan
           resmoke_args: --numClientsPerFixture=10
 
@@ -2696,7 +2696,7 @@ tasks:
       - func: "generate resmoke tasks"
         vars:
           <<: *jstestfuzz_config_vars
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_sharded_causal_consistency
           resmoke_args: "--mongodSetParameters='{logComponentVerbosity: {command: 2}}'"
 
@@ -2721,7 +2721,7 @@ tasks:
           <<: *jstestfuzz_config_vars
           num_files: 5
           num_tasks: 5
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_sharded_kill_terminate_stepdown
           resmoke_args: "--mongodSetParameters='{logComponentVerbosity: {command: 2}}'"
 
@@ -2745,7 +2745,7 @@ tasks:
       - func: "generate resmoke tasks"
         vars:
           <<: *jstestfuzz_config_vars
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_sharded
           resmoke_args: "--mongodSetParameters='{logComponentVerbosity: {command: 2}}'"
 
@@ -2769,7 +2769,7 @@ tasks:
       - func: "generate resmoke tasks"
         vars:
           <<: *jstestfuzz_config_vars
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           resmoke_args: >-
             --mongodSetParameters='{logComponentVerbosity: {command: 2}}'
             --runNoFeatureFlagTests
@@ -2792,7 +2792,7 @@ tasks:
       - func: "generate resmoke tasks"
         vars:
           <<: *jstestfuzz_config_vars
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_sharded_notablescan
           resmoke_args: "--mongodSetParameters='{logComponentVerbosity: {command: 2}}'"
 
@@ -2814,7 +2814,7 @@ tasks:
       - func: "generate resmoke tasks"
         vars:
           <<: *jstestfuzz_config_vars
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_sharded_with_config_transitions_and_add_remove_shard
           resmoke_args: "--mongodSetParameters='{logComponentVerbosity: {command: 2}}'"
 

etc/evergreen_yml_components/tasks/resmoke/server_divisions/durable_transactions_and_availability/tasks.yml

@@ -721,7 +721,7 @@ tasks:
           <<: *jstestfuzz_config_vars
           num_files: ${jstestfuzz_concurrent_num_files|10}
           num_tasks: 5
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_replication
           resmoke_args: --numClientsPerFixture=10
 
@@ -744,7 +744,7 @@ tasks:
           <<: *jstestfuzz_config_vars
           num_files: ${jstestfuzz_concurrent_num_files|10}
           num_tasks: 5
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_replication_notablescan
           resmoke_args: --numClientsPerFixture=10
 
@@ -766,7 +766,7 @@ tasks:
       - func: "generate resmoke tasks"
         vars:
           <<: *jstestfuzz_config_vars
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_replication_write_conflicts
           resmoke_args: "--mongodSetParameters='{logComponentVerbosity: {command: 2}}' --numClientsPerFixture=10"
 
@@ -791,7 +791,7 @@ tasks:
           <<: *jstestfuzz_config_vars
           num_files: 8
           num_tasks: 5
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_replication_fcbis
           resmoke_args: --storageEngine=wiredTiger
           name: jstestfuzz_replication_fcbis
@@ -818,7 +818,7 @@ tasks:
       - func: "generate resmoke tasks"
         vars:
           <<: *jstestfuzz_config_vars
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_replication
           resmoke_args: "--mongodSetParameters='{logComponentVerbosity: {command: 2}}'"
 
@@ -842,7 +842,7 @@ tasks:
           <<: *jstestfuzz_config_vars
           num_files: 8
           num_tasks: 5
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_replication_initsync
           resmoke_args: "--mongodSetParameters='{logComponentVerbosity: {command: 2}}'"
 
@@ -870,7 +870,7 @@ tasks:
       - func: "generate resmoke tasks"
         vars:
           <<: *jstestfuzz_config_vars
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           resmoke_args: >-
             --mongodSetParameters='{logComponentVerbosity: {command: 2}}'
             --runNoFeatureFlagTests
@@ -893,7 +893,7 @@ tasks:
       - func: "generate resmoke tasks"
         vars:
           <<: *jstestfuzz_config_vars
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_replication_notablescan
           resmoke_args: "--mongodSetParameters='{logComponentVerbosity: {command: 2}}'"
 
@@ -915,7 +915,7 @@ tasks:
       - func: "generate resmoke tasks"
         vars:
           <<: *jstestfuzz_config_vars
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_replication_write_conflicts
           resmoke_args: "--mongodSetParameters='{logComponentVerbosity: {command: 2}}'"
 
@@ -1843,7 +1843,7 @@ tasks:
           <<: *jstestfuzz_config_vars
           num_files: ${jstestfuzz_concurrent_num_files|10}
           num_tasks: 5
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_replication
           resmoke_args: >-
             --numClientsPerFixture=10
@@ -2056,7 +2056,7 @@ tasks:
           <<: *jstestfuzz_config_vars
           num_files: ${jstestfuzz_concurrent_num_files|10}
           num_tasks: 5
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz
           resmoke_args: --numClientsPerFixture=10
 
@@ -2078,7 +2078,7 @@ tasks:
       - func: "generate resmoke tasks"
         vars:
           <<: *jstestfuzz_config_vars
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_interrupt
           resmoke_args: "--mongodSetParameters='{logComponentVerbosity: {command: 2}}'"
 
@@ -2100,7 +2100,7 @@ tasks:
       - func: "generate resmoke tasks"
         vars:
           <<: *jstestfuzz_config_vars
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz_interrupt_replication
           resmoke_args: "--mongodSetParameters='{logComponentVerbosity: {command: 2}}'"
 

etc/evergreen_yml_components/tasks/resmoke/server_divisions/query/tasks.yml

@@ -435,7 +435,7 @@ tasks:
           suite: generational_fuzzer
           use_large_distro: "true"
           resmoke_args: "--mongodSetParameters='{logComponentVerbosity: {command: 2}}'"
-          jstestfuzz_vars: --diffTestingMode timeseries --numPipelines=1000 --metaSeed 1726779665485 --jstestfuzzGitRev 8ddd8f12cab0088cfcbef520f248803e17284677
+          jstestfuzz_vars: --diffTestingMode timeseries --numPipelines=1000 --metaSeed 1726779665485 --jstestfuzzGitRev 8ddd8f12cab0
 
   ## Standalone fuzzer for checking block_processing correctness ##
   - <<: *jstestfuzz_template
@@ -1157,7 +1157,7 @@ tasks:
       - func: "generate resmoke tasks"
         vars:
           <<: *jstestfuzz_config_vars
-          jstestfuzz_vars: --jsTestsDir jstests
+          jstestfuzz_vars: --jsTestsDir ../jstests
           suite: jstestfuzz
           resmoke_args: "--mongodSetParameters='{logComponentVerbosity: {command: 2}}'"
           npm_command: jstestfuzz
@@ -1638,7 +1638,7 @@ tasks:
           resmoke_args: >-
             --mongodSetParameters='{logComponentVerbosity: {command: 2}}'
             --runNoFeatureFlagTests
-          jstestfuzz_vars: --metaSeed 1726779665485 --jstestfuzzGitRev 8ddd8f12cab0088cfcbef520f248803e17284677
+          jstestfuzz_vars: --metaSeed 1726779665485 --jstestfuzzGitRev 8ddd8f12cab0
 
   # jstestfuzz standalone update time-series generational fuzzer ##
   - <<: *jstestfuzz_template
@@ -1890,7 +1890,7 @@ tasks:
           suite: generational_fuzzer
           use_large_distro: "true"
           resmoke_args: "--mongodSetParameters='{logComponentVerbosity: {command: 2}}'"
-          jstestfuzz_vars: --diffTestingMode optimization --metaSeed 1726779665485 --jstestfuzzGitRev 8ddd8f12cab0088cfcbef520f248803e17284677
+          jstestfuzz_vars: --diffTestingMode optimization --metaSeed 1726779665485 --jstestfuzzGitRev 8ddd8f12cab0
 
   - <<: *task_template
     name: aggregation_repeat_queries_multiplan_single_solutions
@@ -1955,56 +1955,6 @@ tasks:
           suite: generational_fuzzer
           resmoke_args: "--mongodSetParameters='{logComponentVerbosity: {command: 2}}'"
 
-  - <<: *jstestfuzz_template
-    name: change_stream_serverless_no_optimization_fuzzer_gen
-    tags:
-      [
-        "assigned_to_jira_team_server_query_optimization",
-        "experimental",
-        "serverless",
-        "change_stream_fuzzer",
-        "require_npm",
-        "random_name",
-        "incompatible_tsan",
-        "incompatible_aubsan",
-        "incompatible_debug_mode",
-      ]
-    commands:
-      - func: "generate resmoke tasks"
-        vars:
-          <<: *jstestfuzz_config_vars
-          num_files: 20
-          num_tasks: 20
-          jstestfuzz_vars: --diffTestingMode serverlessNoOptimization
-          npm_command: change-stream-fuzzer
-          suite: generational_fuzzer
-          resmoke_args: "--mongodSetParameters='{logComponentVerbosity: {command: 2}}'"
-
-  - <<: *jstestfuzz_template
-    name: change_stream_serverless_fuzzer_gen
-    tags:
-      [
-        "assigned_to_jira_team_server_query_optimization",
-        "experimental",
-        "serverless",
-        "change_stream_fuzzer",
-        "require_npm",
-        "random_name",
-        "incompatible_tsan",
-        "incompatible_aubsan",
-        "incompatible_debug_mode",
-      ]
-    commands:
-      - func: "generate resmoke tasks"
-        vars:
-          <<: *jstestfuzz_config_vars
-          num_files: 20
-          num_tasks: 20
-          jstestfuzz_vars: --diffTestingMode serverless
-          npm_command: change-stream-fuzzer
-          suite: generational_fuzzer
-          resmoke_args: "--mongodSetParameters='{logComponentVerbosity: {command: 2}}'"
-
   - <<: *gen_task_template
     name: jsCore_wildcard_indexes_gen
     tags:

etc/evergreen_yml_components/variants/amazon/test_dev.yml

@@ -141,8 +141,8 @@ buildvariants:
   - &enterprise-amazon-linux2023-arm64-template
     <<: *amazon_linux2023_arm64_static_compile_variant_dependency
     name: enterprise-amazon-linux2023-arm64
-    display_name: "* Amazon Linux 2023 arm64 Enterprise"
-    tags: ["suggested", "forbid_tasks_tagged_with_experimental"]
+    display_name: "! Amazon Linux 2023 arm64 Enterprise"
+    tags: ["required", "forbid_tasks_tagged_with_experimental"]
     cron: "0 */4 * * *" # From the ${project_required_suggested_cron} parameter
     run_on:
       - amazon2023-arm64-latest-small
@@ -321,48 +321,6 @@ buildvariants:
       - name: compile_and_package_serial_no_unittests_TG
       - name: package_supplementary_data
 
-  - name: amazon2023-arm64-compile-pgo
-    display_name: "* Compile Amazon Linux 2023 arm64 PGO for sys-perf"
-    tags: ["suggested"]
-    expansions:
-      platform: linux
-      project_dir: dsi
-      has_packages: false
-      pgo_profile_url: https://mciuploads.s3.amazonaws.com/dsi/perf-3-node-replSet.arm.aws.2024-05/b49fc707fb83a45727ad3f9f7cfa4c940a6805fe/sys_perf_perf_3_node_replSet.arm.aws.2024_05_ycsb.100read.2024_05_patch_b49fc707fb83a45727ad3f9f7cfa4c940a6805fe_66b035d75b27a40007f52c27_24_08_05_02_16_15/66b035d75b27a40007f52c27/logs/default.profdata.tgz
-      compile_variant: amazon2023-arm64-compile-pgo
-      # TODO(SERVER-102852): This is supposed to have --pgo or use --copt=-fprofile-use=./default.profdata, but bazel will have to support passing the default.profdata into the compiles which it does not currently
-      bazel_compile_flags: >-
-        --define=MONGO_DISTMOD=amazon2023
-        --release=True
-        --thin_lto=True
-        --compiler_type=clang
-        --keep_going
-    run_on:
-      - amazon2023.3-arm64-xlarge
-    tasks:
-      - name: compile_and_package_serial_no_unittests_TG
-      - name: package_supplementary_data
-
-  - name: amazon2023-arm64-compile-bolt
-    display_name: "* Compile Amazon Linux 2023 arm64 BOLT for sys-perf"
-    tags: ["suggested"]
-    expansions:
-      platform: linux
-      project_dir: dsi
-      has_packages: false
-      bolt: true
-      compile_variant: amazon2023-arm64-compile-BOLT
-      bazel_compile_flags: >-
-        --define=MONGO_DISTMOD=amazon2023
-        --release=True
-        --bolt=True
-        --linkopt=-Wl,--emit-relocs
-    run_on:
-      - amazon2023.3-arm64-xlarge
-    tasks:
-      - name: compile_and_package_serial_no_unittests_TG
-      - name: package_supplementary_data
-
   - name: amazon2023-arm64-mongocrypt-shlib-compile
     display_name: "* Compile mongo_crypt_v1.so Amazon Linux 2023 arm64 for sys-perf"
     tags: ["suggested"]

etc/evergreen_yml_components/variants/amazon/test_release.yml

@@ -83,7 +83,7 @@ buildvariants:
     tasks:
       - name: compile_test_and_package_serial_TG
         distros:
-          - amazon2-latest-large
+          - amazon2-latest-c6i-32xlarge
       - name: run_unit_tests_TG
         distros:
           - amazon2-latest-large
@@ -174,7 +174,7 @@ buildvariants:
     tasks:
       - name: compile_test_and_package_serial_no_unittests_TG
         distros:
-          - amazon2-arm64-latest-large
+          - amazon2-arm64-latest-xlarge
       - name: test_packages
         distros:
           - ubuntu2204-arm64-large
@@ -216,7 +216,7 @@ buildvariants:
     tasks:
       - name: compile_test_and_package_serial_TG
         distros:
-          - amazon2023.3-large
+          - amazon2023.3-xlarge
       - name: run_unit_tests_TG
         distros:
           - amazon2023.3-large
@@ -261,7 +261,7 @@ buildvariants:
     tasks:
       - name: compile_test_and_package_serial_TG
         distros:
-          - amazon2023.3-large
+          - amazon2023.3-xlarge
       - name: run_unit_tests_TG
         distros:
           - amazon2023.3-large
@@ -396,7 +396,7 @@ buildvariants:
     tasks:
       - name: compile_test_and_package_serial_TG
         distros:
-          - amazon2023.3-arm64-large
+          - amazon2023.3-arm64-xxxlarge
       - name: run_unit_tests_TG
         distros:
           - amazon2023.3-arm64-large

etc/evergreen_yml_components/variants/coverity.yml

@@ -42,11 +42,14 @@ functions:
 
 tasks:
   - name: run_coverity
+    depends_on:
+      - name: version_expansions_gen
+        variant: generate-tasks-for-version
     tags:
       [
         "assigned_to_jira_team_devprod_build",
-        "development_critical_single_variant",
         "requires_large_host",
+        "auxiliary",
         "coverity",
       ]
     exec_timeout_secs: 28800 # Max scan time of 8 hours
@@ -59,6 +62,8 @@ tasks:
       - func: f_expansions_write
       - func: f_setup_python
       - func: f_expansions_write
+      - func: "get and apply version expansions"
+      - func: "f_expansions_write"
       - func: f_generate_evergreen_bazelrc
       - func: f_download_and_extract_coverity
         vars:

etc/evergreen_yml_components/variants/ibm/test_release_master_and_lts_branches_only.yml

@@ -20,6 +20,7 @@ buildvariants:
       # We need to compensate for SMT8 setting the cpu count very high and lower the amount of parallelism down
       bazel_compile_flags: >-
         --define=MONGO_DISTMOD=rhel81
+      core_analyzer_distro_name: rhel81-power8-large
       resmoke_jobs_factor: 0.25
       has_packages: true
       packager_script: packager_enterprise.py
@@ -86,6 +87,7 @@ buildvariants:
       # We need to compensate for SMT8 setting the cpu count very high and lower the amount of parallelism down
       bazel_compile_flags: >-
         --define=MONGO_DISTMOD=rhel9
+      core_analyzer_distro_name: rhel9-power-large
       resmoke_jobs_factor: 0.25
       has_packages: true
       packager_script: packager_enterprise.py
@@ -153,6 +155,7 @@ buildvariants:
       test_flags: --excludeWithAnyTags=incompatible_with_s390x
       bazel_compile_flags: >-
         --define=MONGO_DISTMOD=rhel83
+      core_analyzer_distro_name: rhel83-zseries-large
       resmoke_jobs_max: 2
       has_packages: true
       packager_script: packager_enterprise.py
@@ -217,6 +220,7 @@ buildvariants:
       test_flags: --excludeWithAnyTags=incompatible_with_s390x
       bazel_compile_flags: >-
         --define=MONGO_DISTMOD=rhel9
+      core_analyzer_distro_name: rhel9-zseries-large
       resmoke_jobs_max: 2
       has_packages: true
       packager_script: packager_enterprise.py

etc/evergreen_yml_components/variants/misc/misc.yml

@@ -18,10 +18,7 @@ buildvariants:
       burn_in_tag_exclude_build_variants: >-
         macos-debug-suggested
         ubuntu2204-arm64-bazel-compile
-      burn_in_tag_include_build_variants: >-
-        enterprise-rhel-8-64-bit-inmem
-        enterprise-rhel-8-64-bit-multiversion
-        amazon-linux2023-arm64-try-sbe-engine
+      burn_in_tag_include_build_variants:
       burn_in_tag_compile_task_dependency: archive_dist_test
       compile_variant: &amazon_linux2023_arm64_static_compile_variant_name amazon-linux2023-arm64-static-compile
     depends_on:
@@ -42,6 +39,7 @@ buildvariants:
 
   - name: test-release
     display_name: "Test Release"
+    # tasks may use "Admin Only" variables, so patch runs may only succeed for admins
     allowed_requesters: ["commit", "patch"]
     tags: ["assigned_to_jira_team_devprod_release_infrastructure"]
     activate: true

etc/evergreen_yml_components/variants/rhel/test_dev.yml

@@ -362,3 +362,16 @@ buildvariants:
       - name: sharding_pqs_fallback_gen
       - name: sharding_pqs_hints_gen
       - name: sharding_pqs_index_filters_gen
+
+  - name: upload-sbom-if-changed
+    display_name: "Upload SBOM if changed"
+    allowed_requesters: ["commit"]
+    activate: true
+    paths:
+      - "sbom.json"
+    tags: ["auxiliary", "assigned_to_jira_team_platsec_server"]
+    run_on:
+      - rhel8.8-small
+    stepback: false
+    tasks:
+      - name: upload_sbom_via_silkbomb_if_changed

etc/evergreen_yml_components/variants/sanitizer/test_dev.yml

@@ -298,8 +298,8 @@ buildvariants:
           - rhel8.8-medium
 
   - <<: *linux_debug_aubsan_compile_variant_dependency
-    name: rhel8-debug-aubsan-lite-all-feature-flags-required
-    display_name: "! Shared Library {A,UB}SAN Enterprise RHEL 8 DEBUG (all feature flags)"
+    name: rhel8-debug-aubsan-lite-required
+    display_name: "! Shared Library {A,UB}SAN Enterprise RHEL 8 DEBUG"
     tags: ["required"]
     cron: "0 */4 * * *" # From the ${project_required_suggested_cron} parameter
     run_on:
@@ -309,7 +309,6 @@ buildvariants:
       # To force disable feature flags even on the all feature flags variant, please use this file:
       # buildscripts/resmokeconfig/fully_disabled_feature_flags.yml
       test_flags: >-
-        --runAllFeatureFlagTests
         --excludeWithAnyTags=incompatible_aubsan
     tasks:
       - name: jsCore_in_parts_gen
@@ -360,20 +359,20 @@ buildvariants:
         --excludeWithAnyTags=incompatible_aubsan
         --mongodSetParameters="{internalQueryEnableAggressiveSpillsInGroup: true}"
     tasks:
-      - name: .development_critical !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_aubsan !.incompatible_system_allocator !.incompatible_all_feature_flags
-      - name: .development_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_aubsan !.incompatible_system_allocator !.incompatible_all_feature_flags
+      - name: .development_critical !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_aubsan !.incompatible_system_allocator !.requires_all_feature_flags
+      - name: .development_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_aubsan !.incompatible_system_allocator !.requires_all_feature_flags
         distros:
           - rhel8.8-large
-      - name: .release_critical !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_aubsan !.incompatible_system_allocator !.incompatible_all_feature_flags
-      - name: .release_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_aubsan !.incompatible_system_allocator !.incompatible_all_feature_flags
+      - name: .release_critical !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_aubsan !.incompatible_system_allocator !.requires_all_feature_flags
+      - name: .release_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_aubsan !.incompatible_system_allocator !.requires_all_feature_flags
         distros:
           - rhel8.8-large
-      - name: .default !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_aubsan !.incompatible_system_allocator !.incompatible_all_feature_flags
-      - name: .default .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_aubsan !.incompatible_system_allocator !.incompatible_all_feature_flags
+      - name: .default !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_aubsan !.incompatible_system_allocator !.requires_all_feature_flags
+      - name: .default .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_aubsan !.incompatible_system_allocator !.requires_all_feature_flags
         distros:
           - rhel8.8-large
-      - name: .non_deterministic !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_aubsan !.incompatible_system_allocator !.incompatible_all_feature_flags
-      - name: .non_deterministic .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_aubsan !.incompatible_system_allocator !.incompatible_all_feature_flags
+      - name: .non_deterministic !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_aubsan !.incompatible_system_allocator !.requires_all_feature_flags
+      - name: .non_deterministic .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_aubsan !.incompatible_system_allocator !.requires_all_feature_flags
         distros:
           - rhel8.8-large
 
@@ -579,32 +578,32 @@ buildvariants:
         --excludeWithAnyTags=tsan_incompatible
         --disableUnreleasedIFRFlags
     tasks:
-      - name: .development_critical !.requires_large_host !.requires_compile_variant !.requires_large_host_tsan !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.incompatible_all_feature_flags
-      - name: .development_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.incompatible_all_feature_flags
+      - name: .development_critical !.requires_large_host !.requires_compile_variant !.requires_large_host_tsan !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.requires_all_feature_flags
+      - name: .development_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.requires_all_feature_flags
         distros:
           - *enterprise-rhel8-debug-tsan-large-distro-name
-      - name: .development_critical .requires_large_host_tsan !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.incompatible_all_feature_flags
+      - name: .development_critical .requires_large_host_tsan !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.requires_all_feature_flags
         distros:
           - *enterprise-rhel8-debug-tsan-large-distro-name
-      - name: .release_critical !.requires_large_host .requires_large_host_tsan !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.incompatible_all_feature_flags
-      - name: .release_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.incompatible_all_feature_flags
+      - name: .release_critical !.requires_large_host .requires_large_host_tsan !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.requires_all_feature_flags
+      - name: .release_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.requires_all_feature_flags
         distros:
           - *enterprise-rhel8-debug-tsan-large-distro-name
-      - name: .release_critical .requires_large_host_tsan !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.incompatible_all_feature_flags
+      - name: .release_critical .requires_large_host_tsan !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.requires_all_feature_flags
         distros:
           - *enterprise-rhel8-debug-tsan-large-distro-name
-      - name: .default !.requires_large_host !.requires_large_host_tsan !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.incompatible_all_feature_flags
-      - name: .default .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.incompatible_all_feature_flags
+      - name: .default !.requires_large_host !.requires_large_host_tsan !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.requires_all_feature_flags
+      - name: .default .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.requires_all_feature_flags
         distros:
           - *enterprise-rhel8-debug-tsan-large-distro-name
-      - name: .default .requires_large_host_tsan !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.incompatible_all_feature_flags
+      - name: .default .requires_large_host_tsan !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.requires_all_feature_flags
         distros:
           - *enterprise-rhel8-debug-tsan-large-distro-name
-      - name: .non_deterministic !.requires_large_host !.requires_large_host_tsan !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.incompatible_all_feature_flags
-      - name: .non_deterministic .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.incompatible_all_feature_flags
+      - name: .non_deterministic !.requires_large_host !.requires_large_host_tsan !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.requires_all_feature_flags
+      - name: .non_deterministic .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.requires_all_feature_flags
         distros:
           - *enterprise-rhel8-debug-tsan-large-distro-name
-      - name: .non_deterministic .requires_large_host_tsan !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.incompatible_all_feature_flags
+      - name: .non_deterministic .requires_large_host_tsan !.requires_compile_variant !.incompatible_development_variant !.incompatible_tsan !.incompatible_system_allocator !.requires_all_feature_flags
         distros:
           - *enterprise-rhel8-debug-tsan-large-distro-name
 

etc/evergreen_yml_components/variants/windows/test_dev.yml

@@ -27,7 +27,7 @@ variables:
   # ANY MODIFICATIONS HERE SHOULD ALSO BE MADE IN THOSE FILES
   - &windows_expansions
     compile_variant: *windows_compile_variant_name
-    burn_in_tests_build_variant: enterprise-windows-all-feature-flags-required
+    burn_in_tests_build_variant: enterprise-windows-required
     exe: ".exe"
     content_type: application/zip
     python: "/cygdrive/c/python/python310/python.exe"
@@ -110,15 +110,15 @@ buildvariants:
       - name: run_bazel_TG
 
   - <<: *windows_compile_variant_dependency
-    name: enterprise-windows-all-feature-flags-required
-    display_name: "! Enterprise Windows Server 2022 (all feature flags) essential tasks"
+    name: enterprise-windows-required
+    display_name: "! Enterprise Windows Server 2022 essential tasks"
     tags: ["required", "forbid_tasks_tagged_with_experimental"]
     cron: "0 */4 * * *" # From the ${project_required_suggested_cron} parameter
     run_on:
       - windows-2022-small
     expansions: &windows_essential_expansions
       <<: *windows_expansions
-      burn_in_tests_build_variant: enterprise-windows-all-feature-flags-required
+      burn_in_tests_build_variant: enterprise-windows-required
       exe: ".exe"
       content_type: application/zip
       python: "/cygdrive/c/python/python310/python.exe"
@@ -132,37 +132,36 @@ buildvariants:
       # To force disable feature flags even on the all feature flags variant, please use this file:
       # buildscripts/resmokeconfig/fully_disabled_feature_flags.yml
       test_flags: >-
-        --runAllFeatureFlagTests
         --excludeWithAnyTags=incompatible_with_windows_tls
       external_auth_jobs_max: 1
     tasks:
-      - name: .development_critical !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.incompatible_all_feature_flags .requires_execution_on_windows_patch_build
-      - name: .development_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.incompatible_all_feature_flags .requires_execution_on_windows_patch_build
+      - name: .development_critical !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.requires_all_feature_flags .requires_execution_on_windows_patch_build
+      - name: .development_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.requires_all_feature_flags .requires_execution_on_windows_patch_build
         distros:
           - windows-2022-xlarge
-      - name: .release_critical !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.incompatible_all_feature_flags .requires_execution_on_windows_patch_build
-      - name: .release_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.incompatible_all_feature_flags .requires_execution_on_windows_patch_build
+      - name: .release_critical !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.requires_all_feature_flags .requires_execution_on_windows_patch_build
+      - name: .release_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.requires_all_feature_flags .requires_execution_on_windows_patch_build
         distros:
           - windows-2022-xlarge
 
   # This Windows build variant exists to run all tasks that have been excluded from running on the required Windows build variant.
   # See SERVER-79037 for how the essential set of tasks was computed.
   - <<: *windows_compile_variant_dependency
-    name: enterprise-windows-all-feature-flags-non-essential
-    display_name: "* Enterprise Windows Server 2022 (all feature flags) non-essential tasks"
+    name: enterprise-windows-non-essential
+    display_name: "* Enterprise Windows Server 2022 non-essential tasks"
     tags: ["suggested"]
     cron: "0 */4 * * *" # From the ${project_required_suggested_cron} parameter
     run_on:
       - windows-2022-small
     expansions:
       <<: *windows_essential_expansions
-      burn_in_tests_build_variant: enterprise-windows-all-feature-flags-non-essential
+      burn_in_tests_build_variant: enterprise-windows-non-essential
     tasks:
-      - name: .development_critical !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.incompatible_all_feature_flags
-      - name: .development_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.incompatible_all_feature_flags
+      - name: .development_critical !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.requires_all_feature_flags
+      - name: .development_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.requires_all_feature_flags
         distros:
           - windows-2022-xlarge
-      - name: .release_critical !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.incompatible_all_feature_flags
-      - name: .release_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.incompatible_all_feature_flags
+      - name: .release_critical !.requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.requires_all_feature_flags
+      - name: .release_critical .requires_large_host !.requires_compile_variant !.incompatible_development_variant !.incompatible_windows !.requires_all_feature_flags
         distros:
           - windows-2022-xlarge

etc/evergreen_yml_components/variants/windows/test_dev_master_and_lts_branches_only.yml

@@ -46,8 +46,7 @@ buildvariants:
       - name: .jscore .common !.decimal !.sharding .requires_large_host
         distros:
           - windows-2022-large
-      # SERVER-105328: Enable this task once container support is added to Windows variants.
-      # - name: .jstestfuzz .common !.feature_flag_guarded
+      - name: .jstestfuzz .common !.feature_flag_guarded
       - name: .read_write_concern .linearize !.durable_history
       - name: replica_sets_auth_gen
       - name: replica_sets_jscore_passthrough_gen

etc/evergreen_yml_components/variants/windows/test_release.yml

@@ -42,11 +42,18 @@ buildvariants:
       - name: .development_critical .requires_large_host !.incompatible_community !.incompatible_windows
         distros:
           - windows-2022-large
-      - name: .release_critical !.requires_large_host !.incompatible_community !.incompatible_windows !publish_packages
-      - name: .release_critical .requires_large_host !.incompatible_community !.incompatible_windows !publish_packages
+      - name: .windows_release_critical
+      - name: push
+        depends_on:
+          - .windows_release_critical
+          - name: package
+          - name: jsCore
+          - name: run_dbtest
+          - name: replica_sets_jscore_passthrough_gen
+      - name: .release_critical !.requires_large_host !.incompatible_community !.incompatible_windows !push !publish_packages
+      - name: .release_critical .requires_large_host !.incompatible_community !.incompatible_windows !push !publish_packages
         distros:
           - windows-2022-large
-      - name: .windows_release_critical
 
   - &enterprise-windows-template
     name: &enterprise-windows enterprise-windows
@@ -91,11 +98,18 @@ buildvariants:
       - name: .development_critical .requires_large_host !.incompatible_windows
         distros:
           - windows-2022-large
-      - name: .release_critical !.requires_large_host !.incompatible_windows !publish_packages
-      - name: .release_critical .requires_large_host !.incompatible_windows !publish_packages
+      - name: .windows_release_critical
+      - name: push
+        depends_on:
+          - .windows_release_critical
+          - name: package
+          - name: jsCore
+          - name: run_dbtest
+          - name: replica_sets_jscore_passthrough_gen
+      - name: .release_critical !.requires_large_host !.incompatible_windows !push !publish_packages
+      - name: .release_critical .requires_large_host !.incompatible_windows !push !publish_packages
         distros:
           - windows-2022-large
-      - name: .windows_release_critical
 
   # This variant is owned by the security team and is special
   # because these tests require specific distro to run on

etc/evergreen_yml_components/variants/wiredtiger/test_dev_master_branch_only.yml

@@ -172,8 +172,7 @@ buildvariants:
       - name: .jscore .common !.sharding .requires_large_host
         distros:
           - windows-2022-large
-      # SERVER-105328: Enable this task once container support is added to Windows variants.
-      # - name: .jstestfuzz .common !.feature_flag_guarded
+      - name: .jstestfuzz .common !.feature_flag_guarded
       - name: replica_sets_auth_gen
       - name: sasl
       - name: sharding_auth_audit_gen

etc/system_perf.yml

@@ -13,14 +13,12 @@ include:
   #
   - filename: evergreen/system_perf/master/base.yml
     module: dsi
-  - filename: evergreen/system_perf/master/compiles.yml
+  - filename: evergreen/system_perf/8.2/compiles.yml
     module: dsi
-  - filename: evergreen/system_perf/master/variants.yml
-    module: dsi
-  - filename: evergreen/system_perf/master/master_variants.yml
+  - filename: evergreen/system_perf/8.2/variants.yml
     module: dsi
   - filename: evergreen/system_perf/shared_tasks.yml
     module: dsi
-  - filename: evergreen/system_perf/master/genny_tasks.yml
+  - filename: evergreen/system_perf/8.2/genny_tasks.yml
     module: dsi
   ### lint_yaml trim end ###