blackmwk commented on code in PR #2701:
URL: https://github.com/apache/iceberg-rust/pull/2701#discussion_r3689567521
##########
crates/iceberg/src/spec/table_properties.rs:
##########
@@ -40,6 +41,19 @@ where
})
}
+/// The AES key size to use when generating data encryption keys, derived from
+/// `encryption.data-key-length`.
+///
+/// Returns `None` when the table is not configured for encryption.
+/// Returns an error when `encryption.data-key-length` is not a valid AES key
length.
+pub(crate) fn data_encryption_key_size(props: &TableProperties) ->
Result<Option<AesKeySize>> {
Review Comment:
In fact, I mean make this part of `TableProperties` struct, which feels more
natural.
##########
crates/integrations/datafusion/src/physical_plan/write.rs:
##########
@@ -601,4 +606,100 @@ mod tests {
Ok(())
}
+
+ #[tokio::test]
+ async fn test_iceberg_write_exec_encrypted() -> Result<()> {
Review Comment:
In this case you could crate an issue to track adding integration tests to
for encryption. This test is too difficult to maintain, and I think the
ParquetWriter ut is enough for this pr.
##########
crates/iceberg/src/encryption/key_metadata.rs:
##########
@@ -59,6 +62,12 @@ impl StandardKeyMetadata {
Ok(Self::from(SecureKey::new(encryption_key)?))
}
+ /// Generates a `StandardKeyMetadata` carrying a fresh random DEK of
+ /// `key_size` together with a fresh random AAD prefix.
+ pub fn generate(key_size: AesKeySize) -> Self {
Review Comment:
Make this crate private. StandKeyMetadata should be generated by
EncryptionManager
##########
crates/iceberg/src/writer/file_writer/parquet_writer.rs:
##########
@@ -114,13 +134,18 @@ impl FileWriterBuilder for ParquetWriterBuilder {
type R = ParquetWriter;
async fn build(&self, output_file: OutputFile) -> Result<Self::R> {
+ let key_metadata = self
Review Comment:
We should pass the encryption manager to this builder, and let encryption
manager to generate the key metadata. The ability to generate
StandardKeyMetadata should belong to EncryptionManger, and all calles should go
through it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
