autoCAT6 opened a new pull request, #11614: URL: https://github.com/apache/arrow-rs/pull/11614
# Which issue does this PR close? Relates to #7373. This addresses Debug-output redaction; key-memory zeroization remains separate work. # Rationale for this change Debug-printing `FileEncryptionProperties`, or a `WriterProperties` configuration containing it, currently includes raw footer and column encryption keys. Logging these configurations can consequently expose the keys along with otherwise useful diagnostics. # What changes are included in this PR? Give the private `EncryptionKey` type a manual Debug implementation that prints only its type, following the existing `FileDecryptionProperties` formatting style. Enclosing encryption and writer configurations retain their other diagnostic fields. # Are these changes tested? Regression tests exercise ordinary and pretty Debug formatting through the public encryption properties, writer builder, and built writer properties. They fail against the previous derived implementation. The tests also verify that explicit key and key-metadata getters preserve their bytes. Both new regressions fail before the change and pass after it. The Parquet suite with encryption enabled passes (1,798 tests; 7 ignored), as does the full workspace suite (7,330 tests; 29 ignored). Workspace Clippy with all targets and features, formatting, and spelling checks pass. An independent path-dependent application also confirms that public encryption and writer configurations no longer expose either key. # Are there any significant user-facing changes? The public API and encryption behavior are unchanged. Debug formatting no longer includes the contents of the private key objects. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
