hectar-glitches commented on issue #1289:
URL: https://github.com/apache/iceberg-go/issues/1289#issuecomment-4997324506
@rambleraptor following up now that the first slice
(EncryptionManager/KeyManagementClient interfaces + PlaintextEncryptionManager
+ in-memory KMS) is merged in #1447
Everything downstream needs "StandardEncryptionManager" to exist before it
can do real encryption
Proposed split:
"StandardEncryptionManager" + KMS catalog-property wiring
("encryption.kms-type"/"encryption.kms-impl",
"encryption.key-id"/"encryption.data-key-length") to envelope KEK/DEK logic,
key cache, rotation/timestamp AAD. This gates most of the rest, so whoever
picks it up first unblocks everyone else.
"EncryptingFileIO" wrapper can also be built and tested against the existing
interfaces (e.g. "PlaintextEncryptionManager" or a small fake) without waiting
on #1, then swapped over to "StandardEncryptionManager" once it lands.
Once "StandardEncryptionManager" lands, we can split further (mostly
independent files, can run in parallel):
Parquet native encryption ("table/internal/parquet_files.go" +
read path)
Manifest + manifest-list encryption ("manifest.go" + list planners)
Puffin blob/statistics-file encryption ("puffin/")
Format-version gating, end-to-end, and cross-client compatibility tests.
Happy to take a piece of this!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
