Skip to content

Use SSE-C for encrypted spooling#23547

Merged
wendigo merged 2 commits intomasterfrom
serafin/spooling-encryption
Sep 25, 2024
Merged

Use SSE-C for encrypted spooling#23547
wendigo merged 2 commits intomasterfrom
serafin/spooling-encryption

Conversation

@wendigo
Copy link
Copy Markdown
Contributor

@wendigo wendigo commented Sep 24, 2024

Description

Additional context and related issues

Release notes

(x) This is not user-visible or is docs only, and no release notes are required.
( ) Release notes are required. Please propose a release note for me.
( ) Release notes are required, with the following suggested text:

# Section
* Fix some things. ({issue}`issuenumber`)

@cla-bot cla-bot bot added the cla-signed label Sep 24, 2024
@wendigo wendigo requested a review from losipiuk September 24, 2024 16:04
@wendigo wendigo force-pushed the serafin/spooling-encryption branch 2 times, most recently from 9e00aa9 to 7f389d1 Compare September 24, 2024 18:52
@wendigo wendigo requested a review from electrum September 24, 2024 19:24
@wendigo wendigo force-pushed the serafin/spooling-encryption branch 2 times, most recently from ecff7d7 to ce337ae Compare September 25, 2024 09:39
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not a big fan of this one. This is fine in tests but it changes the semantics of interface significantly by putting constraints on EncryptionKey passed to new*File methods,

it looks it would be trivial to just inline the logic in openInputStream, createOutputStream and directLocation and not use EncryptionEnforcingFileSystem at all

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I actually did it before but changed that in the meantime.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can be a followup but I think that SpoolingManager should throw TrinoException. Not IOException. Then you can provide nice error code which explains what is going on.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, that area can be improved

Copy link
Copy Markdown
Member

@losipiuk losipiuk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTm % comments

In comparison to Minio it supports SSE-C without the need to configure
TLS to secure connection.
@wendigo wendigo force-pushed the serafin/spooling-encryption branch from ce337ae to 1130731 Compare September 25, 2024 11:11
@wendigo wendigo merged commit 7c91e47 into master Sep 25, 2024
@wendigo wendigo deleted the serafin/spooling-encryption branch September 25, 2024 11:47
@github-actions github-actions bot added this to the 459 milestone Sep 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Development

Successfully merging this pull request may close these issues.

2 participants