Skip to content

feat(encryption): [2/N] Add standard key metadata - #3948

Merged
kevinjqliu merged 2 commits into
apache:mainfrom
xanderbailey:encryption-key-metadata
Sep 11, 2026
Merged

feat(encryption): [2/N] Add standard key metadata#3948
kevinjqliu merged 2 commits into
apache:mainfrom
xanderbailey:encryption-key-metadata

Conversation

@xanderbailey

Copy link
Copy Markdown
Contributor

Python version of StandardKeyMetadata direct port of the logic added in https://github.com/apache/iceberg-rust/pull/2340/changes

Rationale for this change

Are these changes tested?

Are there any user-facing changes?

xanderbailey and others added 2 commits September 11, 2026 20:58
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

@kevinjqliu kevinjqliu left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

i pushed a change to redact encryption_key in repr
6f6ceaa

Comment on lines +24 to +26
from pyiceberg.avro.decoder import new_decoder
from pyiceberg.avro.encoder import BinaryEncoder
from pyiceberg.avro.resolver import construct_reader, construct_writer

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

BTW we want to rip out the current pyiceberg avro reader (which is written with cython) and replace with rust's avro reader. maybe this would be a good integration point 😄

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just spitballing, maybe something like

@dataclass(frozen=True)
class StandardKeyMetadata:
    encryption_key: bytes = field(repr=False)
    aad_prefix: bytes | None = None
    file_length: int | None = None

    @classmethod
    def from_bytes(cls, data: bytes) -> StandardKeyMetadata:
        key, aad, length = pyiceberg_core.encryption.decode_standard_key_metadata(data)
        return cls(key, aad, length)

    def to_bytes(self) -> bytes:
        return pyiceberg_core.encryption.encode_standard_key_metadata(
            self.encryption_key, self.aad_prefix, self.file_length
        )

and in rust side:

// iceberg-rust/bindings/python/src/encryption.rs
#[pyfunction]
fn decode_standard_key_metadata(data: &[u8])
    -> PyResult<(Vec<u8>, Option<Vec<u8>>, Option<i64>)>
{
    let metadata = StandardKeyMetadata::from_bytes(data).map_err(to_py_err)?;
    Ok((metadata.key_bytes(), metadata.aad_prefix(), metadata.file_length()))
}

#[pyfunction]
fn encode_standard_key_metadata(
    key: &[u8],
    aad_prefix: Option<&[u8]>,
    file_length: Option<i64>,
) -> PyResult<Vec<u8>> {
    StandardKeyMetadata::new(key, aad_prefix, file_length)
        .and_then(|metadata| metadata.to_bytes())
        .map_err(to_py_err)
}

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is pretty cool, let me have a look at this on Monday!

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cheers, im pretty excited about this. we can brainstorm and write it up as an issue.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay gave it a go here apache/iceberg-rust#3206 let me know what you think!

@kevinjqliu
kevinjqliu added this pull request to the merge queue Sep 11, 2026
Merged via the queue into apache:main with commit 5202ea5 Sep 11, 2026
21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants