You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@polaris.apache.org by "rishii-19-works (via GitHub)" <gi...@apache.org> on 2026/01/05 17:27:22 UTC

[PR] Add config to disable S3 trailing checksum validation [polaris]

rishii-19-works opened a new pull request, #3357:
URL: https://github.com/apache/polaris/pull/3357

   This PR adds a config-driven, S3-compatible way to disable AWS SDK trailing
   checksum validation by wiring the setting through Iceberg’s S3FileIO properties.
   
   - Default behavior remains unchanged
   - No provider-specific logic
   - Applies to all S3-compatible object stores
   
   Local note: Spotless passes locally. Full build fails on Windows during unrelated
   JAR packaging tasks; CI on Linux should validate.
   
   Fixes #3346
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Re: [PR] Add config to disable S3 trailing checksum validation [polaris]

Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on code in PR #3357:
URL: https://github.com/apache/polaris/pull/3357#discussion_r2670266228


##########
polaris-core/src/main/java/org/apache/polaris/core/storage/aws/AwsStorageConfigurationInfo.java:
##########
@@ -107,6 +107,13 @@ public URI getInternalEndpointUri() {
   /** Flag indicating whether path-style bucket access should be forced in S3 clients. */
   public abstract @Nullable Boolean getPathStyleAccess();
 
+  /**
+   * Flag indicating whether S3 trailing checksum validation should be enabled. Defaults to true
+   * when unset.
+   */
+  @Nullable
+  public abstract Boolean getEnableTrailingChecksums();

Review Comment:
   This seems to be a "dangling" property 🤔 Is it possible for a user to set it? It also does not appear to be set in code 🤔 (basically what @adnanhemani commented)



##########
runtime/service/src/main/java/org/apache/polaris/service/catalog/io/DefaultFileIOFactory.java:
##########
@@ -49,13 +49,11 @@ public FileIO loadFileIO(
       @Nonnull String ioImplClassName,
       @Nonnull Map<String, String> properties) {
 
-    // Get subcoped creds
+    // Get subscoped creds
     properties = new HashMap<>(properties);
 
     // Update the FileIO with the subscoped credentials
-    // Update with properties in case there are table-level overrides the credentials should
-    // always override table-level properties, since storage configuration will be found at
-    // whatever entity defines it
+    // Storage-level configuration should override table-level properties

Review Comment:
   These changes LGTM, but please move them into a separate PR to avoid conflating "cleanup" with feature work.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Re: [PR] Add config to disable S3 trailing checksum validation [polaris]

Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on code in PR #3357:
URL: https://github.com/apache/polaris/pull/3357#discussion_r2673141431


##########
polaris-core/src/main/java/org/apache/polaris/core/storage/aws/AwsStorageConfigurationInfo.java:
##########
@@ -105,13 +105,15 @@ public URI getInternalEndpointUri() {
   }
 
   /** Flag indicating whether path-style bucket access should be forced in S3 clients. */
-  public abstract @Nullable Boolean getPathStyleAccess();
+  @Nullable
+  public abstract Boolean getPathStyleAccess();

Review Comment:
   Please use separate PRs for cleanup / typo fixes. Mixing cleanup change with feature work really complicates reviews, IMHO.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Re: [PR] Add config to disable S3 trailing checksum validation [polaris]

Posted by "rishii-19-works (via GitHub)" <gi...@apache.org>.
rishii-19-works commented on PR #3357:
URL: https://github.com/apache/polaris/pull/3357#issuecomment-3721502182

   Thanks for pointing this out — you’re right.
   
   The trailing checksum flag ended up being a dangling configuration in the current version, so I’ve removed it to keep the PR minimal and avoid introducing unused config.
   
   The remaining change keeps FileIO wiring storage-agnostic and scoped to StorageAccessConfig, as discussed.
   
   Happy to follow up with a separate PR if further cleanup is preferred.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Re: [PR] Add config to disable S3 trailing checksum validation [polaris]

Posted by "rishii-19-works (via GitHub)" <gi...@apache.org>.
rishii-19-works commented on PR #3357:
URL: https://github.com/apache/polaris/pull/3357#issuecomment-3711766238

   I’ve updated the PR to move the setting into AwsStorageConfigurationInfo
   and apply the Iceberg-specific behavior during FileIO construction,
   keeping it storage-scoped and per-catalog as discussed. Thanks!
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Re: [PR] Add config to disable S3 trailing checksum validation [polaris]

Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on code in PR #3357:
URL: https://github.com/apache/polaris/pull/3357#discussion_r2662323961


##########
polaris-core/src/main/java/org/apache/polaris/core/entity/NamespaceEntity.java:
##########
@@ -75,8 +77,24 @@ public String getBaseLocation() {
   }
 
   public static class Builder extends PolarisEntity.BaseBuilder<NamespaceEntity, Builder> {
+
+    private static final int MAX_NAMESPACE_DEPTH = 10;

Review Comment:
   Unrelated change?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Re: [PR] Add config to disable S3 trailing checksum validation [polaris]

Posted by "rishii-19-works (via GitHub)" <gi...@apache.org>.
rishii-19-works closed pull request #3357: Add config to disable S3 trailing checksum validation
URL: https://github.com/apache/polaris/pull/3357


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Re: [PR] Add config to disable S3 trailing checksum validation [polaris]

Posted by "rishii-19-works (via GitHub)" <gi...@apache.org>.
rishii-19-works commented on PR #3357:
URL: https://github.com/apache/polaris/pull/3357#issuecomment-3719500842

   Thanks for the review!
   
   I’ve addressed the feedback by scoping the checksum behavior to AwsStorageConfigurationInfo, keeping DefaultFileIOFactory storage-agnostic, and reverting unrelated changes.
   
   All CI checks are now green. Please let me know if anything else is needed.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Re: [PR] Add config to disable S3 trailing checksum validation [polaris]

Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on PR #3357:
URL: https://github.com/apache/polaris/pull/3357#issuecomment-3711522616

   > Please let me know if you have pointers on where you’d prefer that configuration to be passed or stored.
   
   Given that the behaviour this config setting is trying to control is specific to the storage technology, I'd guess putting it into `AwsStorageConfigInfo` would be appropriate (cf. `pathStyleAccess`). This way the same sever can have catalogs using different storage without affecting one another.
   
   The next best choice is `RealmConfig` (via `FeatureConfiguration`).


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Re: [PR] Add config to disable S3 trailing checksum validation [polaris]

Posted by "rishii-19-works (via GitHub)" <gi...@apache.org>.
rishii-19-works commented on PR #3357:
URL: https://github.com/apache/polaris/pull/3357#issuecomment-3711569403

   Thanks for the clarification — that makes sense.
   
   Agree that this behavior is storage-specific, and placing it in
   AwsStorageConfigInfo (similar to pathStyleAccess) seems like the
   cleanest option so different catalogs can have independent behavior.
   Using RealmConfig as a fallback also makes sense if needed.
   
   I’m happy to rework the PR following the AwsStorageConfigInfo approach.
   Please let me know if that’s the preferred direction, or if you’d like
   this handled differently.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Re: [PR] Add config to disable S3 trailing checksum validation [polaris]

Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on PR #3357:
URL: https://github.com/apache/polaris/pull/3357#issuecomment-3711579063

   @rishii-19-works : please go ahead :) I'd approve a solution that I proposed :wink: 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Re: [PR] Add config to disable S3 trailing checksum validation [polaris]

Posted by "rishii-19-works (via GitHub)" <gi...@apache.org>.
rishii-19-works commented on PR #3357:
URL: https://github.com/apache/polaris/pull/3357#issuecomment-3726385997

   Thanks for the feedback.
   I’ve closed this PR and opened a clean follow-up with the change correctly scoped to the FileIO layer and without unrelated diffs.
   Continuing the work there for clarity.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Re: [PR] Add config to disable S3 trailing checksum validation [polaris]

Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on code in PR #3357:
URL: https://github.com/apache/polaris/pull/3357#discussion_r2662334382


##########
runtime/service/src/main/java/org/apache/polaris/service/catalog/io/DefaultFileIOFactory.java:
##########
@@ -60,6 +61,14 @@ public FileIO loadFileIO(
     properties.putAll(storageAccessConfig.extraProperties());
     properties.putAll(storageAccessConfig.internalProperties());
 
+    // Disable AWS SDK trailing checksum validation if explicitly configured
+    String enableTrailingChecksums =
+        properties.getOrDefault("s3.enable-trailing-checksums", "true");
+
+    if (!Boolean.parseBoolean(enableTrailingChecksums)) {
+      properties.put(S3FileIOProperties.CHECKSUM_VALIDATION_ENABLED, "false");

Review Comment:
   It is probably preferable to handle FileIO-related config via `StorageAccessConfig`. This way it will apply both to Polaris and clients (engines).



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Re: [PR] Add config to disable S3 trailing checksum validation [polaris]

Posted by "rishii-19-works (via GitHub)" <gi...@apache.org>.
rishii-19-works commented on PR #3357:
URL: https://github.com/apache/polaris/pull/3357#issuecomment-3711498347

   Thanks for the review and feedback!
   
   I appreciate the suggestion about handling this config through `StorageAccessConfig`. 
   I’ll take a look at that approach and see how it can be incorporated so it applies more broadly to clients/engines as well.
   
   Please let me know if you have pointers on where you’d prefer that configuration to be passed or stored.
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Re: [PR] Add config to disable S3 trailing checksum validation [polaris]

Posted by "rishii-19-works (via GitHub)" <gi...@apache.org>.
rishii-19-works commented on PR #3357:
URL: https://github.com/apache/polaris/pull/3357#issuecomment-3711969509

   Thanks for the guidance!
   I’ve refactored the config into AwsStorageConfigurationInfo as discussed.
   CI is currently failing due to some model/codegen alignment issues — I’ll dig into that and push a fix shortly.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Re: [PR] Add config to disable S3 trailing checksum validation [polaris]

Posted by "rishii-19-works (via GitHub)" <gi...@apache.org>.
rishii-19-works commented on PR #3357:
URL: https://github.com/apache/polaris/pull/3357#issuecomment-3713063118

   Thanks for the review! I’ve removed the unrelated namespace-depth change and refactored the S3 checksum configuration into AwsStorageConfigurationInfo as discussed.
   Local Windows builds still fail during JAR packaging due to reproducible-build permission handling, but this should pass on CI (Linux runners). Happy to make further changes if needed.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Re: [PR] Add config to disable S3 trailing checksum validation [polaris]

Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on code in PR #3357:
URL: https://github.com/apache/polaris/pull/3357#discussion_r2666022903


##########
polaris-core/src/main/java/org/apache/polaris/core/entity/CatalogEntity.java:
##########
@@ -27,54 +27,26 @@
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Map;
-import java.util.Optional;
 import java.util.Set;
 import org.apache.iceberg.exceptions.BadRequestException;
 import org.apache.polaris.core.admin.model.AwsStorageConfigInfo;
 import org.apache.polaris.core.admin.model.AzureStorageConfigInfo;
 import org.apache.polaris.core.admin.model.Catalog;
-import org.apache.polaris.core.admin.model.CatalogProperties;
-import org.apache.polaris.core.admin.model.ConnectionConfigInfo;
-import org.apache.polaris.core.admin.model.ExternalCatalog;
 import org.apache.polaris.core.admin.model.FileStorageConfigInfo;
 import org.apache.polaris.core.admin.model.GcpStorageConfigInfo;
-import org.apache.polaris.core.admin.model.PolarisCatalog;
 import org.apache.polaris.core.admin.model.StorageConfigInfo;
 import org.apache.polaris.core.config.BehaviorChangeConfiguration;
 import org.apache.polaris.core.config.RealmConfig;
-import org.apache.polaris.core.connection.ConnectionConfigInfoDpo;
-import org.apache.polaris.core.identity.dpo.ServiceIdentityInfoDpo;
-import org.apache.polaris.core.identity.provider.ServiceIdentityProvider;
-import org.apache.polaris.core.secrets.SecretReference;
 import org.apache.polaris.core.storage.FileStorageConfigurationInfo;
 import org.apache.polaris.core.storage.PolarisStorageConfigurationInfo;
 import org.apache.polaris.core.storage.aws.AwsStorageConfigurationInfo;
 import org.apache.polaris.core.storage.azure.AzureStorageConfigurationInfo;
 import org.apache.polaris.core.storage.gcp.GcpStorageConfigurationInfo;
 
-/**
- * Catalog specific subclass of the {@link PolarisEntity} that handles conversion from the {@link
- * Catalog} model to the persistent entity model.
- */
 public class CatalogEntity extends PolarisEntity implements LocationBasedEntity {
-  public static final String CATALOG_TYPE_PROPERTY = "catalogType";
 
-  // Specifies the object-store base location used for all Table file locations under the
-  // catalog, stored in the "properties" map.
+  public static final String CATALOG_TYPE_PROPERTY = "catalogType";
   public static final String DEFAULT_BASE_LOCATION_KEY = "default-base-location";
-
-  /**
-   * Test-only property that specifies a prefix that will be replaced with the catalog's
-   * default-base-location whenever it matches a specified new table or view location.
-   *
-   * <p>For example, if the catalog base location is "s3://my-bucket/base/location" and the prefix
-   * specified here is "file:/tmp" then any new table attempting to specify a base location of
-   * "file:/tmp/ns1/ns2/table1" will be translated into
-   * "s3://my-bucket/base/location/ns1/ns2/table1".
-   *
-   * <p><strong>WARNING:</strong> This property is intended for testing purposes only and should not
-   * be used in production environments.
-   */

Review Comment:
   I doubt all change in this file are related to the stated purpose of this PR. Could you keep only the minimally necessary changes?



##########
runtime/service/src/main/java/org/apache/polaris/service/catalog/io/DefaultFileIOFactory.java:
##########
@@ -60,6 +61,14 @@ public FileIO loadFileIO(
     properties.putAll(storageAccessConfig.extraProperties());
     properties.putAll(storageAccessConfig.internalProperties());
 
+    // Disable AWS SDK trailing checksum validation if explicitly configured
+    String enableTrailingChecksums =
+        properties.getOrDefault("s3.enable-trailing-checksums", "true");
+
+    if (!Boolean.parseBoolean(enableTrailingChecksums)) {
+      properties.put(S3FileIOProperties.CHECKSUM_VALIDATION_ENABLED, "false");

Review Comment:
   This change should not be necessary with the `StorageAccessConfig`-base solution.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Re: [PR] Add config to disable S3 trailing checksum validation [polaris]

Posted by "rishii-19-works (via GitHub)" <gi...@apache.org>.
rishii-19-works commented on PR #3357:
URL: https://github.com/apache/polaris/pull/3357#issuecomment-3724865342

   Thanks for the clarification — I’ve converted this PR to draft while I finish wiring the checksum behavior and align the diff with the stated intent. I’ll mark it ready once complete.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org