`rewrite_table_path` produces an unreadable copy of an encrypted table

[smaheshwar-pltr]

Apache Iceberg version

None

Query engine

None

Please describe the bug 🐞

Currently, rewrite_table_path produces an unreadable copy of an encrypted table.

The procedure completes normally and returns a file list, but reading the registered target fails:

java.lang.RuntimeException: GCM tag check failed. Possible reasons: wrong decryption
key; or corrupt/tampered data. AES GCM doesn't differentiate between these two.
Caused by: javax.crypto.AEADBadTagException: Tag mismatch

Root cause:

1. The copied manifest list is encrypted with a key that is never recorded. A
   fresh data encryption key is generated for it, but the key is only persisted when
   ManifestListWriter.toManifestListFile() is called, and the rewrite path uses the
   writer as a plain FileAppender and never calls it. The key is discarded when the
   writer closes.
2. The target inherits the source's key registry. The rewrite copies the
   encryption-keys list and the snapshot's key-id into the target metadata
   unchanged, so the target points at keys that decrypt the source's manifest
   lists, not its own.

For now, I wonder if we can just disallow this procedure for encrypted tables so encryption users do not run into this - #17988.

Willingness to contribute

• I can contribute a fix for this bug independently
• I would be willing to contribute a fix for this bug with guidance from the Iceberg community
• I cannot contribute a fix for this bug at this time