hkwi opened a new pull request, #17329: URL: https://github.com/apache/iceberg/pull/17329
## Summary - close a closeable encryption manager even when the delegate `FileIO` fails to close - retain the delegate failure as the primary exception and suppress a subsequent encryption-manager close failure - add regression coverage for both failure paths ## Motivation `EncryptingFileIO.close()` currently closes its delegate before closing a closeable encryption manager. If the delegate throws, the encryption manager is never closed. This can leak resources owned by the encryption manager, such as a KMS client. The updated implementation uses try-with-resources to preserve the existing close order while ensuring both resources are closed with standard suppressed-exception behavior. This was identified while reviewing the KMS client lifecycle for Apache Polaris: https://github.com/apache/polaris/pull/5060#discussion_r3625705099 ## Testing - `./gradlew :iceberg-api:test --tests org.apache.iceberg.encryption.TestEncryptingFileIO --no-daemon --console=plain` - `./gradlew :iceberg-api:spotlessCheck --no-daemon --console=plain` - `./gradlew :iceberg-api:check --no-daemon --console=plain` --- **AI Disclosure** - Model: GPT-5 - Platform/Tool: Codex - Human Oversight: partially reviewed - Prompt Summary: Fix `EncryptingFileIO.close()` so all owned resources are closed safely when the delegate close fails, and add regression tests. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
