Run fle2v2 spec tests on modern servers; add CSFLE prose tests 1 and 11.5/11.6 - #3097
Merged
Merged
Conversation
The 15 legacy fle2v2 fixtures carry a Ruby-local maxServerVersion of 7.99.99 that upstream does not have, so core QEv2 coverage has not run on 8.0+ since the pin was added in June 2024. It was applied to every fle2v2 file at once, including the fle2v2-Range-* rangePreview fixtures that 8.0 did break; those were deleted two months later and the pin stayed behind on the rest.
- 1: custom key material, asserting the ciphertext the spec pins. - 11 case 5: tlsDisableOCSPEndpointCheck is permitted. The driver spells it :ssl_verify_ocsp_endpoint, and validate_tls_options already allows it while rejecting the insecure TLS options. - 11 case 6: named KMS providers apply their own TLS options, which works because Handle#kms_tls_options resolves "aws:no_client_cert" before falling back to the base type. Case 6 uses port 8002 rather than the 9002 in the spec text: run-tests.sh starts the client-cert-required KMS server on 8002 and never starts 9002, which is what the existing cases 1-4 target too.
DataKeyContext wraps :key_material in a BSON::Binary itself, so passing one in raised NoMethodError: undefined method 'encoding' for BSON::Binary.
comandeo-mongo
changed the title
comandeo-mongo
marked this pull request as ready for review
July 29, 2026 12:54
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the Ruby driver’s CSFLE/QEv2 test suite to run on modern MongoDB server versions by removing an artificial upper server version pin from fle2v2 unified spec fixtures, and adds new integration prose tests covering additional CSFLE specification cases.
Changes:
- Remove
maxServerVersion: "7.99.99"from the remaining fle2v2 unified spec YAML fixtures so QEv2 coverage runs on 8.0+/9.0+ servers. - Add CSFLE prose coverage for KMS TLS options: permitting
tlsDisableOCSPEndpointCheckand applying TLS options to named KMS providers. - Add a prose test for “custom key material” to assert exact expected ciphertext.
Reviewed changes
Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| spec/spec_tests/data/client_side_encryption/fle2v2-validatorAndPartialFieldExpression.yml | Removes server max-version pin for QEv2 fixture (enables running on 8.0+). |
| spec/spec_tests/data/client_side_encryption/fle2v2-Update.yml | Removes server max-version pin for QEv2 fixture. |
| spec/spec_tests/data/client_side_encryption/fle2v2-NoEncryption.yml | Removes server max-version pin for QEv2 fixture. |
| spec/spec_tests/data/client_side_encryption/fle2v2-MissingKey.yml | Removes server max-version pin for QEv2 fixture. |
| spec/spec_tests/data/client_side_encryption/fle2v2-InsertFind-Unindexed.yml | Removes server max-version pin for QEv2 fixture. |
| spec/spec_tests/data/client_side_encryption/fle2v2-InsertFind-Indexed.yml | Removes server max-version pin for QEv2 fixture. |
| spec/spec_tests/data/client_side_encryption/fle2v2-FindOneAndUpdate.yml | Removes server max-version pin for QEv2 fixture. |
| spec/spec_tests/data/client_side_encryption/fle2v2-EncryptedFieldsMap-defaults.yml | Removes server max-version pin for QEv2 fixture. |
| spec/spec_tests/data/client_side_encryption/fle2v2-EncryptedFields-vs-jsonSchema.yml | Removes server max-version pin for QEv2 fixture. |
| spec/spec_tests/data/client_side_encryption/fle2v2-EncryptedFields-vs-EncryptedFieldsMap.yml | Removes server max-version pin for QEv2 fixture. |
| spec/spec_tests/data/client_side_encryption/fle2v2-Delete.yml | Removes server max-version pin for QEv2 fixture. |
| spec/spec_tests/data/client_side_encryption/fle2v2-DecryptExistingData.yml | Removes server max-version pin for QEv2 fixture. |
| spec/spec_tests/data/client_side_encryption/fle2v2-CreateCollection.yml | Removes server max-version pin for QEv2 fixture. |
| spec/spec_tests/data/client_side_encryption/fle2v2-Compact.yml | Removes server max-version pin for QEv2 fixture. |
| spec/spec_tests/data/client_side_encryption/fle2v2-BypassQueryAnalysis.yml | Removes server max-version pin for QEv2 fixture. |
| spec/integration/client_side_encryption/kms_tls_options_spec.rb | Adds prose test cases for allowing OCSP endpoint check disable and for named KMS provider TLS option application. |
| spec/integration/client_side_encryption/custom_key_material_prose_spec.rb | Adds prose test verifying encryption output when using spec-provided custom key material. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+55
to
+58
| key_document = key_vault_collection.find(_id: created_key_id).first | ||
| key_vault_collection.delete_one(_id: created_key_id) | ||
|
|
||
| key_vault_collection.insert_one(key_document.merge('_id' => key_id)) |
Comment on lines
3
to
4
| # Require server version 6.0.0 to get behavior added in SERVER-64911. | ||
| - minServerVersion: "7.0.0" |
jamis
approved these changes
Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Run the fle2v2 spec tests on modern servers
The 15 legacy
fle2v2-*.ymlfixtures carry a Ruby-localmaxServerVersion: "7.99.99"that upstream does not have. Consequence: core QEv2 coverage has not run on any 8.0+
server since June 2024.
Origin:
c6476241d"Skip fle2 on latest" applied the pin to every fle2v2 file at once,including the
fle2v2-Range-*rangePreview fixtures that 8.0 genuinely did break. Thosewere deleted two months later in
da0583c06, and the pin stayed behind on the 15 filesthat likely never needed it.
The Evergreen result is the point of this PR. If these fixtures fail on 8.0/9.0, that
is a finding worth having before the next release, not a reason to restore the pin.
Prose tests 1 and 11 cases 5 and 6
re-inserts it under the all-zero UUID, asserts the exact expected ciphertext. Local KMS
only.
tlsDisableOCSPEndpointCheckis permitted. This case does apply toRuby:
lib/mongo/uri/options_mapper.rb:289maps the URI option to:ssl_verify_ocsp_endpoint, andKMS::Validations.validate_tls_options(
lib/mongo/crypt/kms.rb:96) already permits it while rejectingssl_verify_certificateand
ssl_verify_hostname. Asserts construction succeeds.Handle#kms_tls_options(lib/mongo/crypt/handle.rb:134) resolves the full"aws:no_client_cert"key before falling back to the base type.Case 6 targets port 8002, not the 9002 in the spec text:
.evergreen/run-tests.sh:203starts Ruby's
--require_client_certKMS server on 8002 and never starts 9002. Theexisting cases 1-4 already target 8002, so no CI infrastructure change is needed.
Case 6 asserts the spec's exact error strings (
parse error,HTTP status=404) ratherthan the looser
/libmongocrypt error code/the neighbouring shared examples use. If CIshows different wording I would rather adjust to what the server actually returns than
weaken the assertion pre-emptively.