{"record":{"id":"d810af4c9510da07","repo":"apache/iceberg","slug":"orc-does-not-support-file-encryption-keys","errorCode":null,"errorMessage":"ORC does not support file encryption keys","messagePattern":"ORC does not support file encryption keys","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"orc/src/main/java/org/apache/iceberg/orc/ORCFormatModel.java","lineNumber":159,"sourceCode":"      return this;\n    }\n\n    @Override\n    public ModelWriteBuilder<D, S> metricsConfig(MetricsConfig metricsConfig) {\n      internal.metricsConfig(metricsConfig);\n      return this;\n    }\n\n    @Override\n    public ModelWriteBuilder<D, S> overwrite() {\n      internal.overwrite();\n      return this;\n    }\n\n    @Override\n    public ModelWriteBuilder<D, S> withFileEncryptionKey(ByteBuffer encryptionKey) {\n      // ORC doesn't support file encryption\n      throw new UnsupportedOperationException(\"ORC does not support file encryption keys\");\n    }\n\n    @Override\n    public ModelWriteBuilder<D, S> withAADPrefix(ByteBuffer aadPrefix) {\n      // ORC doesn't support file encryption\n      throw new UnsupportedOperationException(\"ORC does not support AAD prefix\");\n    }\n\n    @Override\n    public FileAppender<D> build() {\n      switch (content) {\n        case DATA:\n          internal.createContextFunc(ORC.WriteBuilder.Context::dataContext);\n          internal.createWriterFunc(\n              (icebergSchema, typeDescription) ->\n                  writerFunction.write(icebergSchema, typeDescription, engineSchema));\n          break;\n        case EQUALITY_DELETES:","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/apache/iceberg/blob/86d9c8fc543e7c56c9f624eb725f76c9baff9570/orc/src/main/java/org/apache/iceberg/orc/ORCFormatModel.java#L141-L177","documentation":"ORC does not implement Iceberg's file-level encryption (file encryption keys). The ORC ModelWriteBuilder.withFileEncryptionKey override always throws UnsupportedOperationException to make this limitation explicit rather than silently writing unencrypted data.","triggerScenarios":"Calling withFileEncryptionKey(...) (directly or via a generic write path that configures encryption) when writing ORC files, e.g. tables configured for encryption key handling with format=orc.","commonSituations":"Shared write pipelines that set encryption keys for all formats; switching a table's file format from Parquet (which supports encryption) to ORC without removing encryption config.","solutions":["Do not configure file encryption keys when writing ORC files","Use Parquet for tables that require Iceberg file encryption","Strip encryption settings (withFileEncryptionKey/withAADPrefix) from the ORC write path"],"exampleFix":"// before\nwriteBuilder.withFileEncryptionKey(key).withAADPrefix(aad); // throws for ORC\n// after\nif (\"parquet\".equals(fileFormat)) { writeBuilder.withFileEncryptionKey(key); } // skip for ORC","handlingStrategy":"type-guard","validationCode":"if (format == FileFormat.ORC && encryptionKey != null) {\n  throw new IllegalArgumentException(\"File encryption keys are not supported for ORC\");\n}","typeGuard":"boolean encryptionSupported(FileFormat f) { return f == FileFormat.PARQUET; }","tryCatchPattern":"try {\n  builder.withFileEncryptionKey(key);\n} catch (UnsupportedOperationException e) {\n  if (e.getMessage().contains(\"file encryption keys\")) {\n    log.warn(\"ORC does not support encryption; writing without key\");\n  } else throw e;\n}","preventionTips":["Only configure file encryption for Parquet writes","Strip encryption settings when switching formats to ORC","Keep encryption config format-aware in shared write pipelines"],"tags":["orc","encryption","unsupported-feature"],"backgroundTag":"operation-not-supported","analyzedSha":"86d9c8fc543e7c56c9f624eb725f76c9baff9570","analyzedAt":"2026-09-12T00:46:39.097Z","contentChangedAt":"2026-09-12T00:46:39.097Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}