kevinjqliu opened a new issue, #18632: URL: https://github.com/apache/iceberg/issues/18632
### Apache Iceberg version main (development) ### Query engine Other ### Please describe the bug 🐞 `encryption-keys` is a v3-only field, but [`TableMetadata.Builder.addEncryptionKey`](https://github.com/apache/iceberg/blob/fb58513787756dedab6550d6695df36a27acb64e/core/src/main/java/org/apache/iceberg/TableMetadata.java#L1511-L1523) doesn't check the format version. Java's own writers only add keys on v3 tables, but REST servers built on `CatalogHandlers` accept `add-encryption-key` from any client and write it into v1/v2 metadata. **Repro** (REST fixture): ```bash docker run -d --rm -p 8181:8181 apache/iceberg-rest-fixture H='Content-Type: application/json'; U=localhost:8181/v1 curl -s -XPOST $U/namespaces -H "$H" -d '{"namespace":["ns"]}' curl -s -XPOST $U/namespaces/ns/tables -H "$H" -d '{"name":"t","schema":{"type":"struct","fields":[{"id":1,"name":"id","type":"long","required":false}]},"properties":{"format-version":"2"}}' curl -s -XPOST $U/namespaces/ns/tables/t -H "$H" -d '{"requirements":[],"updates":[{"action":"add-encryption-key","encryption-key":{"key-id":"kek","encrypted-key-metadata":"a2V5"}}]}' # 200, "format-version": 2 with "encryption-keys" ``` This should be rejected below v3. The fix belongs in core (`TableMetadata.Builder.addEncryptionKey`), which covers both sides: Java clients build commits with the builder, and REST servers apply them through `CatalogHandlers` using the same builder. `removeEncryptionKey` and parsing should stay lenient so existing tables can be cleaned up. iceberg-go already [rejects this](https://github.com/apache/iceberg-go/blob/b7792e9e8799664f2ca8cd7f4ea94c97515c9833/table/metadata.go#L2050-L2054), and PyIceberg is adding the same check (apache/iceberg-python#4148). Related: #14403 / #14668 (encryption properties on v1/v2, create only), #17728 (client-side format version checks on create), #16353 (encryption key cleanup in `TableMetadata`). ### Willingness to contribute - [ ] I can contribute a fix for this bug independently - [ ] I would be willing to contribute a fix for this bug with guidance from the Iceberg community - [ ] I cannot contribute a fix for this bug at this time -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
