smaheshwar-pltr opened a new issue, #17992:
URL: https://github.com/apache/iceberg/issues/17992
### Apache Iceberg version
None
### Query engine
None
### Please describe the bug 🐞
Currently, `rewrite_table_path` produces an unreadable copy of an encrypted
table.
The procedure completes normally and returns a file list, but reading the
registered target fails:
```
java.lang.RuntimeException: GCM tag check failed. Possible reasons: wrong
decryption
key; or corrupt/tampered data. AES GCM doesn't differentiate between these
two.
Caused by: javax.crypto.AEADBadTagException: Tag mismatch
```
Root cause:
1. **The copied manifest list is encrypted with a key that is never
recorded.** A
fresh data encryption key is generated for it, but the key is only
persisted when
`ManifestListWriter.toManifestListFile()` is called, and the rewrite path
uses the
writer as a plain `FileAppender` and never calls it. The key is discarded
when the
writer closes.
2. **The target inherits the source's key registry.** The rewrite copies the
`encryption-keys` list and the snapshot's `key-id` into the target
metadata
unchanged, so the target points at keys that decrypt the *source's*
manifest
lists, not its own.
For now, I wonder if we can just disallow this procedure for encrypted
tables so encryption users do not run into this -
https://github.com/apache/iceberg/pull/17988.
### Willingness to contribute
- [x] I can contribute a fix for this bug independently
- [ ] I would be willing to contribute a fix for this bug with guidance from
the Iceberg community
- [ ] I cannot contribute a fix for this bug at this time
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
