cvr-aditya commented on code in PR #18220:
URL: https://github.com/apache/iceberg/pull/18220#discussion_r4387111214
##########
aws/src/main/java/org/apache/iceberg/aws/glue/GlueTableOperations.java:
##########
@@ -403,6 +532,117 @@ void cleanupMetadataAndUnlock(CommitStatus commitStatus,
String metadataLocation
}
}
+ @Override
+ public TableOperations temp(TableMetadata uncommittedMetadata) {
+ return new TableOperations() {
+ @Override
+ public TableMetadata current() {
+ return uncommittedMetadata;
+ }
+
+ @Override
+ public TableMetadata refresh() {
+ throw new UnsupportedOperationException(
+ "Cannot call refresh on temporary table operations");
+ }
+
+ @Override
+ public void commit(TableMetadata base, TableMetadata metadata) {
+ throw new UnsupportedOperationException("Cannot call commit on
temporary table operations");
+ }
+
+ @Override
+ public String metadataFileLocation(String fileName) {
+ return
GlueTableOperations.this.metadataFileLocation(uncommittedMetadata, fileName);
+ }
+
+ @Override
+ public LocationProvider locationProvider() {
+ return LocationProviders.locationsFor(
+ uncommittedMetadata.location(), uncommittedMetadata.properties());
+ }
+
+ @Override
+ public FileIO io() {
+
GlueTableOperations.this.encryptionPropsFromMetadata(uncommittedMetadata.properties());
+ return GlueTableOperations.this.io();
+ }
+
+ @Override
+ public EncryptionManager encryption() {
+ return GlueTableOperations.this.encryption();
+ }
+
+ @Override
+ public long newSnapshotId() {
+ return GlueTableOperations.this.newSnapshotId();
+ }
+ };
+ }
+
+ private void encryptionPropsFromMetadata(Map<String, String>
tableProperties) {
+ if (tableKeyId == null) {
+ this.tableKeyId =
tableProperties.get(TableProperties.ENCRYPTION_TABLE_KEY);
+ }
+
+ if (tableKeyId != null && encryptionDekLength <= 0) {
+ this.encryptionDekLength =
+ PropertyUtil.propertyAsInt(
+ tableProperties,
+ TableProperties.ENCRYPTION_DEK_LENGTH,
+ TableProperties.ENCRYPTION_DEK_LENGTH_DEFAULT);
+ }
+ }
+
+ /** The key ID of an encrypted table must stay the same for the whole table
lifetime. */
+ private static void checkEncryptionKeyUnchanged(TableMetadata base,
TableMetadata metadata) {
+ if (base == null) {
+ return;
+ }
+
+ String baseKeyId =
base.properties().get(TableProperties.ENCRYPTION_TABLE_KEY);
+ String newKeyId =
metadata.properties().get(TableProperties.ENCRYPTION_TABLE_KEY);
+
+ Preconditions.checkArgument(
+ baseKeyId == null || newKeyId != null, "Cannot remove key ID from an
encrypted table");
+ Preconditions.checkArgument(
+ Objects.equals(baseKeyId, newKeyId), "Cannot modify key ID of an
encrypted table");
+ }
+
+ private void checkIntegrityForEncryption(
+ String encryptionKeyIdFromGlue, String dekLengthFromGlue, String
metadataHashFromGlue) {
+ TableMetadata metadata = current();
+ if (!Strings.isNullOrEmpty(metadataHashFromGlue)) {
+ EncryptionUtil.verifyMetadataHash(metadata, metadataHashFromGlue);
+ return;
+ }
+
+ LOG.warn(
+ "Full metadata integrity check skipped because no metadata hash was
recorded in Glue for table {}."
+ + " Falling back to encryption property based check.",
+ tableName());
+
+ Map<String, String> propertiesFromMetadata = metadata.properties();
+
+ String encryptionKeyIdFromMetadata =
+ propertiesFromMetadata.get(TableProperties.ENCRYPTION_TABLE_KEY);
+ if (!Objects.equals(encryptionKeyIdFromGlue, encryptionKeyIdFromMetadata))
{
+ throw new RuntimeException(
+ String.format(
+ "Metadata file might have been modified. Encryption key id %s
differs from Glue value %s",
+ encryptionKeyIdFromMetadata, encryptionKeyIdFromGlue));
+ }
+
+ String dekLengthFromMetadata =
+ propertiesFromMetadata.get(TableProperties.ENCRYPTION_DEK_LENGTH);
+ if (!Objects.equals(dekLengthFromGlue, dekLengthFromMetadata)) {
+ throw new RuntimeException(
+ String.format(
+ "Metadata file might have been modified. DEK length %s differs
from Glue value %s",
+ dekLengthFromMetadata, dekLengthFromGlue));
+ }
+ }
Review Comment:
Yeah. Makes sense. I have addressed it
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
