chore(ci): test against 9.0 rc3 and bundle its crypt_shared MONGOSH-3553 - #2815
Merged
Conversation
Advance the 90xc/90xe test matrix pins from 9.0.0-rc0 to 9.0.0-rc1 so CI exercises the latest pre-GA 9.0 release candidate. Regenerated .evergreen.yml from .evergreen/constants.js.
9.0 release candidates are published only to downloads.mongodb.org/cloud.json, not the default full.json feed that mongodb-download-url (via mongodb-runner) resolves against, so CI could not find 9.0.0-rc1 and every 90xc/90xe server failed to start. Thread an optional versionListUrl through the test server setup: - MongoRunnerSetup passes downloadOptions.versionListUrl when MONGOSH_SERVER_TEST_VERSION_LIST_URL is set. - constants.js points the 90xc/90xe entries at cloud.json; the value is emitted as a per-variant expansion only when present, so the rest of the matrix keeps using the canonical full.json feed. Verified with Evergreen patch 6a734bf68ffa130007a4e20b.
Server 9.0 renamed the Queryable Encryption text query types to their GA names (prefix/suffix/substring/String). An 8.x crypt_shared rejects those names, so automatic encryption could not analyze such queries against a 9.0 server and the automatic-mode e2e coverage had to be skipped. Bundle a 9.0 crypt_shared instead. This raises the platform floor to glibc 2.27 on Linux (from 2.25) and macOS 14 (from 11), so Amazon Linux 2 and macOS below 14 lose out-of-the-box automatic encryption; both are already EoL per our platform support policy, and mongosh's platform support follows the server's. Those users can still pass --cryptSharedLibPath. This mirrors what was done for the 8.0 release, which moved off the RHEL7 library and dropped out-of-the-box automatic encryption on the platforms below it. The pin is a release candidate for now, published only to the cloud.json feed. The version list is cached in a module-global and on disk keyed by cache path rather than by feed URL, so anything that resolves a version from the default feed earlier in the same process leaves a cached list without the release candidate in it; disabling the cache for this lookup forces the requested feed to be fetched. Also drop the Amazon Linux 2 crypt library smoke check, matching the other images whose glibc is too old to load the library, and re-enable the automatic-mode Queryable Encryption e2e tests.
The bundled 9.0 crypt_shared library is built for macOS 14, so it cannot be loaded on the macOS 13 hosts and every FLE test that passes it via --cryptSharedLibPath failed there with a dlopen error. macOS 13 is EoL under our platform support policy, so move the e2e variants to macOS 14 rather than keep testing on it. Their display names still said Big Sur, from before they were moved off macOS 11. Drop the macOS 13 package smoke variant instead of moving it, since the macOS 14 one already runs the same task. Also skip the FLE tests below macOS 14, mirroring the existing glibc check, so that running them on an older machine skips rather than failing to load the library.
rc3 is now published to the cloud.json feed, along with rc2. Move both the server test version and the bundled crypt_shared library to it so we test against the release candidate closest to GA. Verified that every artifact we need resolves for rc3: crypt_shared for all four packaging targets plus macOS and Windows, and community and enterprise server builds for Linux, macOS and Windows.
ivandevp
changed the title
ivandevp
marked this pull request as ready for review
August 11, 2026 19:24
mabaasit
approved these changes
Aug 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tests against MongoDB 9.0 rc3 and bundles the matching
crypt_sharedlibrary.cloud.json, so those variants resolve against that feed.crypt_sharedlibrary (MONGOSH-2192). An 8.x library rejects the GA Queryable Encryption query type names (prefix/suffix/substring), so automatic encryption could not analyze those queries against a 9.0 server. This re-enables the automatic-mode QE e2e tests.Platform impact: out-of-the-box automatic encryption is no longer available on Amazon Linux 2 or macOS below 14. Both are already EoL, and
--cryptSharedLibPathstill works for anyone on them. This mirrors the 8.0 release, which dropped it for RHEL 7.At GA: switch both pins back to the default feed and remove the
cloud.jsonoverrides.