Repository navigation
build: enable Parquet modular encryption and zstd in vendored Arrow - #989
Merged
Merged
Conversation
Table encryption needs Parquet modular encryption for data and delete files, and AES-GCM for the AGS1 streams of manifests and manifest lists. - Add the ICEBERG_ENCRYPTION option (default ON). When enabled, find OpenSSL before the vendored Arrow is configured (with a Homebrew hint on macOS), build Arrow with PARQUET_REQUIRE_ENCRYPTION, and link the bundle library with OpenSSL::Crypto. - Build the vendored Arrow with zstd, the default Parquet codec of both Java and C++, so tables written by Java can be read. - Record the OpenSSL root in iceberg-config.cmake for consumers. - Install OpenSSL in CI (libssl-dev on Ubuntu, vcpkg on Windows). - Add a smoke test for encrypted Parquet with the settings Iceberg uses (encrypted footer, AAD prefix not stored in the file). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On Windows the Parquet encryption sources are compiled in parquet_static rather than parquet_objlib, so they did not find the OpenSSL headers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
4 of 17 tasks
wgtmac
reviewed
Oct 14, 2026
wgtmac
left a comment
wgtmac
left a comment
Member
There was a problem hiding this comment.
I found three package/build integration issues and two scope/default-value concerns in this build-only step. Details are attached inline.
- Register OpenSSL in ICEBERG_SYSTEM_DEPENDENCIES for both vendored and system Arrow, since the bundle exports OpenSSL::Crypto in both modes. - Stop exporting the build machine's OpenSSL root from the installed package so consumers resolve OpenSSL from their own toolchain. - Restrict the Parquet include injection to vendored Arrow targets and skip ALIAS targets, which target_include_directories cannot modify. - Default ICEBERG_ENCRYPTION to OFF and enable it on the Ubuntu and macOS test jobs, so the encryption build, parquet_encryption_test, and the Homebrew keg-only OpenSSL lookup all stay covered. - Document why zstd is enabled in the vendored Arrow build.
# Conflicts: # .github/workflows/test.yml
wgtmac
approved these changes
Oct 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #988.
Adds the
ICEBERG_ENCRYPTIONCMake option (default on), which builds the vendored Arrow with Parquet modular encryption and zstd and links OpenSSL into the bundle library. This makes the crypto available for the following table encryption steps; there is no behavior change for tables.