@@ -163,7 +163,28 @@ endmacro()
163163# ----------------------------------------------------------------------
164164# Apache Arrow
165165
166+ # Find OpenSSL for table encryption. Called before Arrow is configured, so that the
167+ # imported OpenSSL targets are visible to the vendored Arrow subdirectories.
168+ macro (resolve_openssl_for_encryption )
169+ if (APPLE
170+ AND NOT DEFINED OPENSSL_ROOT_DIR
171+ AND NOT DEFINED ENV{OPENSSL_ROOT_DIR})
172+ # Homebrew's OpenSSL is keg-only and not on the default search path.
173+ execute_process (COMMAND brew --prefix openssl@3
174+ OUTPUT_VARIABLE ICEBERG_BREW_OPENSSL_PREFIX
175+ OUTPUT_STRIP_TRAILING_WHITESPACE ERROR_QUIET )
176+ if (ICEBERG_BREW_OPENSSL_PREFIX AND EXISTS "${ICEBERG_BREW_OPENSSL_PREFIX} " )
177+ set (OPENSSL_ROOT_DIR "${ICEBERG_BREW_OPENSSL_PREFIX} " )
178+ endif ()
179+ endif ()
180+ find_package (OpenSSL REQUIRED )
181+ endmacro ()
182+
166183function (resolve_arrow_dependency )
184+ if (ICEBERG_ENCRYPTION)
185+ resolve_openssl_for_encryption ()
186+ endif ()
187+
167188 prepare_fetchcontent ()
168189
169190 # Prevent Arrow from injecting -Werror into CMAKE_CXX_FLAGS_DEBUG via
@@ -178,12 +199,21 @@ function(resolve_arrow_dependency)
178199 set (ARROW_S3 ${ICEBERG_S3} )
179200 set (ARROW_JSON ON )
180201 set (ARROW_PARQUET ON )
202+ if (ICEBERG_ENCRYPTION)
203+ # Parquet modular encryption, used for encrypted Iceberg data and delete files.
204+ set (PARQUET_REQUIRE_ENCRYPTION ON )
205+ endif ()
181206 set (ARROW_ENABLE_THREADING ON )
182207 set (ARROW_SIMD_LEVEL "NONE" )
183208 set (ARROW_RUNTIME_SIMD_LEVEL "NONE" )
184209 set (ARROW_POSITION_INDEPENDENT_CODE ON )
185210 set (ARROW_DEPENDENCY_SOURCE "BUNDLED" )
186211 set (ARROW_WITH_ZLIB ON )
212+ # zstd is the default value of the write.parquet.compression-codec table property,
213+ # so a vendored Arrow without it cannot write Iceberg's default Parquet files.
214+ # Not required by modular encryption itself; parquet_encryption_test covers the
215+ # encrypted-plus-zstd combination to keep the two features verified together.
216+ set (ARROW_WITH_ZSTD ON )
187217 if (ICEBERG_S3 AND NOT ICEBERG_AWSSDK_BUNDLED)
188218 set (AWSSDK_SOURCE "SYSTEM" )
189219 endif ()
@@ -217,6 +247,25 @@ function(resolve_arrow_dependency)
217247 fetchcontent_makeavailable (VendoredArrow)
218248
219249 if (vendoredarrow_SOURCE_DIR )
250+ # Arrow's Parquet targets do not inherit the OpenSSL include directory when
251+ # Arrow is vendored; add it for the Parquet encryption sources. Depending on the
252+ # platform and build type, they are compiled in the object library or directly in
253+ # the static/shared library. The bundle library links OpenSSL::Crypto.
254+ #
255+ # Only vendored targets are touched here. With system Arrow the same names can
256+ # be ALIAS targets created by a parent project, and target_include_directories
257+ # cannot modify an ALIAS.
258+ if (ICEBERG_ENCRYPTION)
259+ foreach (parquet_target parquet_objlib parquet_static parquet_shared)
260+ if (TARGET ${parquet_target} )
261+ get_target_property (parquet_target_alias ${parquet_target} ALIASED_TARGET)
262+ if (NOT parquet_target_alias)
263+ target_include_directories (${parquet_target} PRIVATE ${OPENSSL_INCLUDE_DIR} )
264+ endif ()
265+ endif ()
266+ endforeach ()
267+ endif ()
268+
220269 if (NOT TARGET Arrow::arrow_static)
221270 add_library (Arrow::arrow_static INTERFACE IMPORTED )
222271 target_link_libraries (Arrow::arrow_static INTERFACE arrow_static )
@@ -268,6 +317,12 @@ function(resolve_arrow_dependency)
268317 list (APPEND ICEBERG_SYSTEM_DEPENDENCIES Arrow Parquet)
269318 endif ()
270319
320+ # The bundle exports OpenSSL::Crypto in its link interface for both vendored and
321+ # system Arrow, so consumers must find OpenSSL in both modes.
322+ if (ICEBERG_ENCRYPTION)
323+ list (APPEND ICEBERG_SYSTEM_DEPENDENCIES OpenSSL)
324+ endif ()
325+
271326 set (ICEBERG_SYSTEM_DEPENDENCIES
272327 ${ICEBERG_SYSTEM_DEPENDENCIES}
273328 PARENT_SCOPE )
0 commit comments