JAVA-6187 Upgrade libcrypt version to 1.18.1 by strogiyotec · Pull Request #1983 · mongodb/mongo-java-driver

strogiyotec · 2026-05-21T15:51:05Z

JAVA-6187
Upgrading libcrypt version to 1.18.1
Also the artifact location got changed from s3 to github

Risks

This PR assumes there is gpg installed that might not be a case in Windows

Resolution of risks

There is a new flag -PskipCryptVerify=true that will skip gpg verification

Warnings (not applicable, I passed --quite as suggested by Ross)

If you run ./gradlew :mongodb-crypt:downloadJnaLib locally it will give a few warnings

> Task :mongodb-crypt:downloadJava UP-TO-DATE
Download https://github.com/mongodb/libmongocrypt/releases/download/1.18.1/libmongocrypt-linux-x86_64-glibc_2_7-nocrypto-1.18.1.asc
Download https://github.com/mongodb/libmongocrypt/releases/download/1.18.1/libmongocrypt-linux-s390x-glibc_2_7-nocrypto-1.18.1.asc
Download https://github.com/mongodb/libmongocrypt/releases/download/1.18.1/libmongocrypt-linux-x86_64-glibc_2_7-nocrypto-1.18.1.tar.gz
Download https://github.com/mongodb/libmongocrypt/releases/download/1.18.1/libmongocrypt-linux-s390x-glibc_2_7-nocrypto-1.18.1.tar.gz
Download https://github.com/mongodb/libmongocrypt/releases/download/1.18.1/libmongocrypt-linux-ppc64le-glibc_2_17-nocrypto-1.18.1.tar.gz
Download https://github.com/mongodb/libmongocrypt/releases/download/1.18.1/libmongocrypt-linux-ppc64le-glibc_2_17-nocrypto-1.18.1.asc
Download https://github.com/mongodb/libmongocrypt/releases/download/1.18.1/libmongocrypt-linux-arm64-glibc_2_17-nocrypto-1.18.1.tar.gz
Download https://github.com/mongodb/libmongocrypt/releases/download/1.18.1/libmongocrypt-linux-arm64-glibc_2_17-nocrypto-1.18.1.asc
Download https://github.com/mongodb/libmongocrypt/releases/download/1.18.1/libmongocrypt-windows-x86_64-1.18.1.tar.gz
Download https://github.com/mongodb/libmongocrypt/releases/download/1.18.1/libmongocrypt-windows-x86_64-1.18.1.asc
Download https://github.com/mongodb/libmongocrypt/releases/download/1.18.1/libmongocrypt-macos-universal-1.18.1.tar.gz
Download https://github.com/mongodb/libmongocrypt/releases/download/1.18.1/libmongocrypt-macos-universal-1.18.1.asc
Download https://pgp.mongodb.com/libmongocrypt.pub

> Task :mongodb-crypt:verifyJava
gpg: keybox '/home/almas/repos/mongo-java-driver/mongodb-crypt/build/jnaLibs/gnupg/pubring.kbx' created
gpg: /home/almas/repos/mongo-java-driver/mongodb-crypt/build/jnaLibs/gnupg/trustdb.gpg: trustdb created
gpg: key 81F1404DEBACA586: public key "Libmongocrypt Release Signing Key <packaging@mongodb.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: Signature made Fri May  8 05:08:55 2026 PDT
gpg:                using RSA key F2F5BF4ABF517E039AFCADAA81F1404DEBACA586
gpg: Good signature from "Libmongocrypt Release Signing Key <packaging@mongodb.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.

The reason is because gpg doesn't know if the key is trusted as we arbitrary downloaded it

Running the same command using shell will give the same output

Copilot

Pull request overview

Updates the mongodb-crypt module’s bundled libmongocrypt native library download process to use libmongocrypt’s 1.18.1 GitHub release assets (instead of S3) and adds GPG signature verification of the downloaded tarballs.

Changes:

Bump libmongocrypt download revision to 1.18.1 and switch download base URL to GitHub releases.
Download per-platform tarballs (+ .asc signatures) and extract only the needed native library into the JNA resources directory.
Add a Gradle task that verifies tarball signatures via gpg, with an opt-out via -PskipCryptVerify=true.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+        val tarballList = tarballs.files.toList()
+        val signatureList = signatures.files.toList()
+        check(tarballList.size == signatureList.size) {
+            "Expected each tarball to have a matching signature: ${tarballList.size} tarballs vs ${signatureList.size} signatures."
+        }
+        tarballList.zip(signatureList).forEach { (tarball, signature) ->


…-driver into JAVA-6187

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

strogiyotec · 2026-05-21T21:25:55Z

+                setExecutable(true, true)
+            }
+
+        execOps.exec { commandLine("gpg", "--homedir", home.path, "--batch", "--import", publicKey.get().asFile.path) }


let's skip it for now, as we know that we are downloading from a trusted source

+abstract class VerifyLibmongocryptTask : DefaultTask() {
+    @get:Inject abstract val execOps: ExecOperations
+
+    @get:InputFiles abstract val tarballs: ConfigurableFileCollection
+    @get:InputFiles abstract val signatures: ConfigurableFileCollection
+    @get:InputFile abstract val publicKey: RegularFileProperty
+    @get:Input abstract val skipVerify: Property<Boolean>
+


rozza · 2026-05-21T19:59:25Z

+                execOps.exec {
+                    commandLine("gpg", "--homedir", home.path, "--batch", "--verify", signature.path, tarball.path)


Suggested change

execOps.exec {

commandLine("gpg", "--homedir", home.path, "--batch", "--verify", signature.path, tarball.path)

execOps.exec {

commandLine("gpg", "--homedir", home.path, "--batch", "--trust-model", "always", "--quiet", "--verify", signature.path, tarball.path)

}

Will reduce the noise from gpg

thanks, addressed it here

rozza · 2026-05-21T20:01:00Z

+                setExecutable(true, true)
+            }
+
+        execOps.exec { commandLine("gpg", "--homedir", home.path, "--batch", "--import", publicKey.get().asFile.path) }


Suggested change

execOps.exec { commandLine("gpg", "--homedir", home.path, "--batch", "--import", publicKey.get().asFile.path) }

execOps.exec { commandLine("gpg", "--homedir", home.path, "--batch", "--quiet", "--import", publicKey.get().asFile.path) }

Added the quiet flag to reduce noise

thanks, addressed it here

rozza

Like this. Couple of optional suggestions.

You may want to change the task names downloadJava no longer makes sense as it used to be the java tarball. For example: downloadCryptLibs, verifyCryptLibs and extractCryptLibs make more sense now than downloadJava, verifyJava and unzipJava.

One gripe from the existing implementation, you might want to make downloading optional eg:

 overwrite(false)
  onlyIf { !file("$jnaDownloadsDir/${platform.tarballName}.tar.gz").exists() }

That way it would work without having to check if modified and offline. Also we can bypass this all if jnaLibsPath is set.

Upgrade libcrypt version

f176df3

strogiyotec requested a review from a team as a code owner May 21, 2026 15:51

strogiyotec requested review from Copilot, rozza and vbabanin and removed request for rozza May 21, 2026 15:51

Copilot started reviewing on behalf of strogiyotec May 21, 2026 15:51 View session

Merge branch 'main' into JAVA-6187

5a2697b

Copilot AI reviewed May 21, 2026

View reviewed changes

Almas Abdrazak added 2 commits May 21, 2026 11:45

address failed build

62f7f9a

Merge branch 'JAVA-6187' of https://github.com/strogiyotec/mongo-java…

cab0437

…-driver into JAVA-6187

strogiyotec requested a review from Copilot May 21, 2026 18:46

Copilot started reviewing on behalf of strogiyotec May 21, 2026 18:47 View session

Copilot AI reviewed May 21, 2026

View reviewed changes

rozza reviewed May 21, 2026

View reviewed changes

Almas Abdrazak added 2 commits May 21, 2026 14:00

Kotlin codestyle

e56e5b3

address PR comments

9dd5e33

vbabanin self-assigned this May 22, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

JAVA-6187 Upgrade libcrypt version to 1.18.1#1983

JAVA-6187 Upgrade libcrypt version to 1.18.1#1983
strogiyotec wants to merge 6 commits into
mongodb:mainfrom
strogiyotec:JAVA-6187

strogiyotec commented May 21, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

strogiyotec May 21, 2026

Uh oh!

rozza May 21, 2026

Uh oh!

strogiyotec May 21, 2026

Uh oh!

rozza May 21, 2026

Uh oh!

strogiyotec May 21, 2026 •

edited

Loading

Uh oh!

rozza left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		execOps.exec {
		commandLine("gpg", "--homedir", home.path, "--batch", "--verify", signature.path, tarball.path)

	execOps.exec { commandLine("gpg", "--homedir", home.path, "--batch", "--import", publicKey.get().asFile.path) }
	execOps.exec { commandLine("gpg", "--homedir", home.path, "--batch", "--quiet", "--import", publicKey.get().asFile.path) }

Conversation

strogiyotec commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Risks

Resolution of risks

Warnings (not applicable, I passed --quite as suggested by Ross)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

strogiyotec May 21, 2026

Choose a reason for hiding this comment

Uh oh!

rozza May 21, 2026

Choose a reason for hiding this comment

Uh oh!

strogiyotec May 21, 2026

Choose a reason for hiding this comment

Uh oh!

rozza May 21, 2026

Choose a reason for hiding this comment

Uh oh!

strogiyotec May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rozza left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

strogiyotec commented May 21, 2026 •

edited

Loading

strogiyotec May 21, 2026 •

edited

Loading