thswlsqls opened a new issue, #8968: URL: https://github.com/apache/paimon/issues/8968
**Search before asking** - [x] I searched in the [issues](https://github.com/apache/paimon/issues) and found nothing similar. **Paimon version** master @ b85955cb7 (2.1-SNAPSHOT); also present in release-2.0 **Compute Engine** Flink and Spark (format table writes) **Minimal reproduce step** 1. Set `s3.encryption.algorithm=SSE-C` and `s3.encryption.key=<base64 256-bit key>`. 2. INSERT into a format table on that bucket. `S3MultiPartUpload.startMultiPartUpload()` initiates the upload through `s3accessHelper`, but `uploadPart()` (`S3MultiPartUpload.java` line 88) hand-assembles `UploadPartRequest.builder()...build()`, bypassing the S3A request factory. AWS requires identical encryption information on every part of an upload initiated with SSE-C, so S3 rejects the part upload (HTTP 400). `MultiPartUploadTwoPhaseOutputStream.closeForCommit()` calls `uploadPartUtil()` unconditionally, so every non-empty format table file is affected regardless of size. SSE-S3, SSE-KMS and DSSE-KMS are unaffected. **What doesn't meet your expectations?** Writing a format table on an SSE-C bucket should succeed; it fails instead. **Anything else?** Regression from #7187 (`cca171f43`), which replaced `s3accessHelper.newUploadPartRequest(...)` with a hand-built request while keeping the helper for initiate/complete/abort. hadoop-aws itself always builds part requests through the factory (`S3ABlockOutputStream.java:1033`), the path normal Paimon table writes take, so those are unaffected. **Are you willing to submit a PR?** - [x] I'm willing to submit a PR! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
