From a988e5536dc25e987ff8c5cd68de0f35fc8f7ae4 Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Wed, 30 Sep 2026 05:24:56 -0500
Subject: [PATCH] PYTHON-6083 [v4.18] Latest server binary downloads require
 private S3 (#3076)

---
 .evergreen/generated_configs/functions.yml | 3 +++
 .evergreen/scripts/generate_config.py      | 5 +++++
 .evergreen/scripts/setup_tests.py          | 4 +++-
 CONTRIBUTING.md                            | 4 +++-
 4 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/.evergreen/generated_configs/functions.yml b/.evergreen/generated_configs/functions.yml
index 9fbc1f8500..20caa9488c 100644
--- a/.evergreen/generated_configs/functions.yml
+++ b/.evergreen/generated_configs/functions.yml
@@ -111,6 +111,9 @@ functions:
           - LOAD_BALANCER
           - LOCAL_ATLAS
           - NO_EXT
+          - AWS_ACCESS_KEY_ID
+          - AWS_SECRET_ACCESS_KEY
+          - AWS_SESSION_TOKEN
       type: test
     - command: expansions.update
       params:
diff --git a/.evergreen/scripts/generate_config.py b/.evergreen/scripts/generate_config.py
index 033cdb6f6f..e99cf23912 100644
--- a/.evergreen/scripts/generate_config.py
+++ b/.evergreen/scripts/generate_config.py
@@ -1300,6 +1300,11 @@ def create_run_server_func():
         "LOAD_BALANCER",
         "LOCAL_ATLAS",
         "NO_EXT",
+        # The AWS credentials are needed to download the "latest" nightly
+        # build from the private S3 bucket, see DRIVERS-3628.
+        "AWS_ACCESS_KEY_ID",
+        "AWS_SECRET_ACCESS_KEY",
+        "AWS_SESSION_TOKEN",
     ]
     args = [".evergreen/just.sh", "run-server", "${TEST_NAME}"]
     sub_cmd = get_subprocess_exec(include_expansions_in_env=includes, args=args)
diff --git a/.evergreen/scripts/setup_tests.py b/.evergreen/scripts/setup_tests.py
index 5199fe3959..7816da4f7b 100644
--- a/.evergreen/scripts/setup_tests.py
+++ b/.evergreen/scripts/setup_tests.py
@@ -357,7 +357,9 @@ def handle_test_env() -> None:
 
         # The mock OCSP responder MUST BE started before the mongod as the mongod expects that
         # a responder will be available upon startup.
-        version = os.environ.get("VERSION", "latest")
+        # Default to the newest stable release; the "latest" nightly build is
+        # downloaded from a private S3 bucket and needs AWS credentials.
+        version = os.environ.get("VERSION", "latest-stable")
         cmd = [
             "bash",
             f"{DRIVERS_TOOLS}/.evergreen/run-mongodb.sh",
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 2ef90224c2..494891c06a 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -202,7 +202,9 @@ the pages will re-render and the browser will automatically refresh.
 -   Ensure you have started the appropriate Mongo Server(s).  You can run `just run-server` with optional args
     to set up the server.  All given options will be passed to
     [`run-mongodb.sh`](https://github.com/mongodb-labs/drivers-evergreen-tools/blob/master/.evergreen/run-mongodb.sh).  Run `$DRIVERS_TOOLS/.evergreen/run-mongodb.sh start -h`
-    for a full list of options.
+    for a full list of options.  By default the newest stable server release is used.  To test against the
+    nightly build instead, pass `--version latest`, which is downloaded from a private S3 bucket and requires
+    an `AWS_PROFILE` with [Drivers test secrets](https://github.com/mongodb-labs/drivers-evergreen-tools/tree/master/.evergreen/secrets_handling#secrets-handling) credentials.
 -   Run `just test` or `pytest` to run all of the tests.
 -   Append `test/<mod_name>.py::<class_name>::<test_name>` to run
     specific tests. You can omit the `<test_name>` to test a full class