{"record":{"id":"36840d45388b54b6","repo":"apache/iceberg","slug":"orc-does-not-support-aad-prefix","errorCode":null,"errorMessage":"ORC does not support AAD prefix","messagePattern":"ORC does not support AAD prefix","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"orc/src/main/java/org/apache/iceberg/orc/ORCFormatModel.java","lineNumber":165,"sourceCode":"      return this;\n    }\n\n    @Override\n    public ModelWriteBuilder<D, S> overwrite() {\n      internal.overwrite();\n      return this;\n    }\n\n    @Override\n    public ModelWriteBuilder<D, S> withFileEncryptionKey(ByteBuffer encryptionKey) {\n      // ORC doesn't support file encryption\n      throw new UnsupportedOperationException(\"ORC does not support file encryption keys\");\n    }\n\n    @Override\n    public ModelWriteBuilder<D, S> withAADPrefix(ByteBuffer aadPrefix) {\n      // ORC doesn't support file encryption\n      throw new UnsupportedOperationException(\"ORC does not support AAD prefix\");\n    }\n\n    @Override\n    public FileAppender<D> build() {\n      switch (content) {\n        case DATA:\n          internal.createContextFunc(ORC.WriteBuilder.Context::dataContext);\n          internal.createWriterFunc(\n              (icebergSchema, typeDescription) ->\n                  writerFunction.write(icebergSchema, typeDescription, engineSchema));\n          break;\n        case EQUALITY_DELETES:\n          internal.createContextFunc(ORC.WriteBuilder.Context::deleteContext);\n          internal.createWriterFunc(\n              (icebergSchema, typeDescription) ->\n                  writerFunction.write(icebergSchema, typeDescription, engineSchema));\n          break;\n        case POSITION_DELETES:","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/apache/iceberg/blob/86d9c8fc543e7c56c9f624eb725f76c9baff9570/orc/src/main/java/org/apache/iceberg/orc/ORCFormatModel.java#L147-L183","documentation":"ORC does not support AAD (additional authenticated data) prefixes used by Parquet-style modular encryption. The ORC ModelWriteBuilder.withAADPrefix override always throws UnsupportedOperationException.","triggerScenarios":"Calling withAADPrefix(...) (or a generic writer configuration that sets an AAD prefix) when building an ORC FileAppender.","commonSituations":"Same as encryption keys: unified Parquet/ORC write code paths, tables migrated from Parquet with encryption properties still set.","solutions":["Remove AAD prefix configuration for ORC writes","Use Parquet when AAD-based encryption metadata is required","Guard the write path so encryption-related builder calls only run for Parquet"],"exampleFix":"// before\nbuilder.withAADPrefix(encryption.aadPrefix()); // throws for ORC\n// after\nif (supportsEncryption(format)) { builder.withAADPrefix(encryption.aadPrefix()); }","handlingStrategy":"type-guard","validationCode":"if (format == FileFormat.ORC && aadPrefix != null) {\n  throw new IllegalArgumentException(\"AAD prefix is not supported for ORC\");\n}","typeGuard":"boolean aadSupported(FileFormat f) { return f == FileFormat.PARQUET; }","tryCatchPattern":"try {\n  builder.withAADPrefix(aadPrefix);\n} catch (UnsupportedOperationException e) {\n  if (e.getMessage().contains(\"AAD prefix\")) {\n    log.warn(\"ORC does not support AAD prefix; skipping\");\n  } else throw e;\n}","preventionTips":["Configure AAD prefix only for Parquet writers","Remove Parquet encryption properties when migrating tables to ORC","Centralize encryption configuration so format checks happen once"],"tags":["orc","encryption","unsupported-feature"],"backgroundTag":"operation-not-supported","analyzedSha":"86d9c8fc543e7c56c9f624eb725f76c9baff9570","analyzedAt":"2026-09-12T00:46:39.097Z","contentChangedAt":"2026-09-12T00:46:39.097Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}