stevenzwu commented on code in PR #18503:
URL: https://github.com/apache/iceberg/pull/18503#discussion_r4291323553
##########
format/spec.md:
##########
@@ -1470,9 +1474,18 @@ Keys used for table encryption can be tracked in table
metadata as a list named
| | | _optional_ | **`encrypted-by-id`** | `string`
| Optional ID of the key used to encrypt or wrap `key-metadata` |
| | | _optional_ | **`properties`** | `map<string,
string>` | A string to string map of additional metadata used by the table's
encryption scheme |
+=== "v4"
+ | v4 | Field name | Type |
Description |
+ | ----------
|-------------------------------|-----------------------|-------------|
+ | _optional_ | **`key-id`** | `string` | ID
of the encryption key [2] |
+ | _required_ | **`encrypted-key-metadata`** | `string` |
Encrypted key and metadata, base64 encoded [1] |
+ | _optional_ | **`encrypted-by-id`** | `string` |
Optional ID of the key used to encrypt or wrap `key-metadata` |
+ | _optional_ | **`properties`** | `map<string, string>` | A
string to string map of additional metadata used by the table's encryption
scheme |
+
Notes:
1. The format of encrypted key metadata is determined by the table's
encryption scheme and can be a wrapped format specific to the table's KMS
provider.
+2. `key-id` is required when a key is stored indirectly from the file it
encrypts, such as in the table metadata `encryption-keys` list. It is optional
when the key is stored directly on the encrypted file's metadata.
Review Comment:
> It is optional when the key is stored directly on the encrypted file's
metadata.
Is this accurate? I thought v4 encryption key is stored in the snapshot
metadata. Current sentence reads like the encryption key is stored in the
Parquet root manifest file's Parquet footer metadata.
The section intro has the same problem: "stored directly in the metadata of
the file they encrypt."
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
