feat(encryption): support AES-256 keys for reading Parquet data files

Cargo.toml

@@ -49,15 +49,15 @@ aes-gcm = "0.10"
 anyhow = "1.0.72"
 apache-avro = { version = "0.21", features = ["snappy", "zstandard"] }
 array-init = "2"
-arrow = "58"
-arrow-arith = "58"
-arrow-array = "58"
-arrow-buffer = "58"
-arrow-cast = "58"
-arrow-ord = "58"
-arrow-schema = "58"
-arrow-select = "58"
-arrow-string = "58"
+arrow = "58.4"
+arrow-arith = "58.4"
+arrow-array = "58.4"
+arrow-buffer = "58.4"
+arrow-cast = "58.4"
+arrow-ord = "58.4"
+arrow-schema = "58.4"
+arrow-select = "58.4"
+arrow-string = "58.4"
 as-any = "0.3.2"
 async-trait = "0.1.89"
 aws-config = "1.8.7"
@@ -121,7 +121,7 @@ murmur3 = "0.5.2"
 once_cell = "1.20"
 opendal = "0.57"
 ordered-float = "4"
-parquet = "58"
+parquet = "58.4"
 pilota = "0.11.10"
 pretty_assertions = "1.4"
 pyo3 = "0.28"

crates/iceberg/src/arrow/reader/pipeline.rs

@@ -737,9 +737,10 @@ mod tests {
         }
     }
 
-    #[tokio::test]
-    async fn test_read_encrypted_parquet() {
-        let encryption_key = b"0123456789abcdef";
+    /// Writes a single-column Parquet file encrypted with `encryption_key`, then reads it
+    /// back through `ArrowReader` and asserts the round-tripped values. The key length
+    /// selects the AES-GCM variant in arrow-rs (16 -> AES-128, 32 -> AES-256).
+    async fn assert_encrypted_parquet_roundtrip(encryption_key: &[u8]) {
         let aad_prefix = b"aad_prefix";
 
         let schema = Arc::new(
@@ -807,6 +808,16 @@ mod tests {
         assert_eq!(ids.values(), &[10, 20, 30]);
     }
 
+    #[tokio::test]
+    async fn test_read_encrypted_parquet_aes_128() {
+        assert_encrypted_parquet_roundtrip(b"0123456789abcdef").await;
+    }
+
+    #[tokio::test]
+    async fn test_read_encrypted_parquet_aes_256() {
+        assert_encrypted_parquet_roundtrip(b"0123456789abcdef0123456789abcdef").await;
+    }
+
     #[tokio::test]
     async fn test_read_encrypted_parquet_without_key_metadata_fails() {
         let encryption_key = b"0123456789abcdef";