You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Allow disabling remote signing in REST Catalog #3888
When using a REST Catalog (e.g. Lakekeeper), pyiceberg gets remote signing details from the catalog.
However, sometimes it would be useful to not use remote signing, in the case where the process performing the operations has access to the S3 endpoint through secret access keys. This is because remote signing requires a network round trip (plus any authorisation on server side).
It would be great if we could disable remote signing by respecting the s3.signer catalog property if it is empty.
The FileIO object gets created in pyiceberg/catalog/rest/__init__.py:
I traced the current flow: RestCatalog._load_file_io() already merges self.properties, but the per-table response config is merged later, so a client-provided s3.signer="" cannot currently override a server S3V4RestSigner value.\n\nWould a narrow rule be acceptable: when the client explicitly supplies an empty s3.signer, apply that value after the table response solely as an opt-out; otherwise preserve today’s response-wins precedence? I would cover both Table and StagedTable construction paths and leave all other properties unchanged.
Activity
emecii commentedon Sep 7, 2026
I traced the current flow:
RestCatalog._load_file_io()already mergesself.properties, but the per-table response config is merged later, so a client-provideds3.signer=""cannot currently override a serverS3V4RestSignervalue.\n\nWould a narrow rule be acceptable: when the client explicitly supplies an emptys3.signer, apply that value after the table response solely as an opt-out; otherwise preserve today’s response-wins precedence? I would cover bothTableandStagedTableconstruction paths and leave all other properties unchanged.BenCradock commentedon Sep 8, 2026
Yes that makes sense to me - happy for it to be only on an explicit empty
s3.signer. Thanks!