herringbone 0.5.0 → 0.6.0

data/lib/herringbone/writer.rb

@@ -24,6 +24,8 @@ module Herringbone
   # Options:
   #   compression:     :snappy (default), :zstd, :gzip, :lz4 (LZ4_RAW), :lz4_hadoop, :brotli, :none
   #                    (:zstd and :brotli need the zstd-ruby / brotli gems)
+  #   compression_level: nil (the codec's default), or a level for :zstd (up to 22), :gzip (0-9)
+  #                    or :brotli (0-11)
   #   row_group_bytes: flush a row group once the buffered values take roughly this much memory
   #                    (default 16MB). This bounds memory use while writing.
   #   row_group_rows:  also flush after this many rows (default: no row limit)
@@ -38,6 +40,9 @@ module Herringbone
   #                    an Array of column paths, or { "path" => true | { ndv:, fpp:, max_bytes: } }.
   #                    Without ndv: the distinct values of each row group are counted. fpp defaults
   #                    to 0.01 and max_bytes to 1MB. Filters are written after each row group.
+  #   encryption:      Parquet modular encryption: { footer_key: "...", columns: { "ssn" => "..." } }.
+  #                    Without columns: every column is encrypted with the footer key. See
+  #                    #initialize for the settings.
   #
   # Statistics and page indexes (ColumnIndex/OffsetIndex) are always written.
   class Writer
@@ -83,6 +88,7 @@ module Herringbone
     # @param schema [Schema] schema of the rows
     # @param options [Hash{Symbol => Object}] see the class description and #initialize
     # @option options [Symbol] :compression (:snappy) codec, see Herringbone.codecs
+    # @option options [Integer, nil] :compression_level (nil) level for :zstd, :gzip or :brotli
     # @option options [Integer] :row_group_bytes (16MB) approximate buffered size that triggers a row group
     # @option options [Integer, nil] :row_group_rows (nil) also flush a row group after this many rows
     # @option options [Integer] :page_bytes (1MB) approximate uncompressed data page size
@@ -95,6 +101,8 @@ module Herringbone
     # @option options [Hash{String => String}] :metadata ({}) key/value metadata for the footer
     # @option options [Boolean, Array<String>, Hash{String => Boolean, Hash}] :bloom_filters (nil)
     #   columns to write split block bloom filters for
+    # @option options [EncryptionConfiguration, Hash{Symbol => Object}, nil] :encryption (nil) modular
+    #   encryption settings, see #initialize
     # @yield [writer] the open writer
     # @yieldparam writer [Writer] writer to append rows to
     # @yieldreturn [Object] returned by open
@@ -118,6 +126,8 @@ module Herringbone
     # @param io [IO, #write] destination; switched to binmode when it supports that
     # @param schema [Schema] schema of the rows
     # @param compression [Symbol, Integer] codec name (see Herringbone.codecs) or Format::Codec id
+    # @param compression_level [Integer, nil] level for :zstd, :gzip or :brotli (see
+    #   Compression::LEVELS), nil for the codec's default
     # @param row_group_bytes [Integer] approximate buffered size that triggers a row group
     # @param row_group_rows [Integer, nil] also flush a row group after this many rows
     # @param page_bytes [Integer] approximate uncompressed data page size
@@ -131,17 +141,35 @@ module Herringbone
     # @param metadata [Hash{#to_s => #to_s}] key/value metadata for the footer
     # @param bloom_filters [Boolean, Array<String>, Hash{String => Boolean, Hash}, nil] see the class
     #   description
-    # @raise [ArgumentError] for an invalid IO, schema or option
+    # @param encryption [EncryptionConfiguration, Hash{Symbol => Object}, false, nil] encrypts the file
+    #   (Parquet modular encryption); a Hash holds the keywords of EncryptionConfiguration.new.
+    #   Keys are 16, 24 or 32-byte Strings; key metadata is stored as given, for readers to find
+    #   the keys by.
+    # @option encryption [String] :footer_key key of the footer, and of columns without their own
+    # @option encryption [String, nil] :footer_key_metadata stored for the footer key
+    # @option encryption [Hash{String => String, Hash, Symbol}, nil] :columns column path or field
+    #   name => key, +{key:, key_metadata:}+ or +:footer+. Columns not listed are not encrypted;
+    #   without this option every column is, with the footer key.
+    # @option encryption [Boolean] :plaintext_footer (false) store the footer in the clear (signed),
+    #   so readers without keys can read the plaintext columns
+    # @option encryption [Symbol] :algorithm (:aes_gcm) or :aes_gcm_ctr, which encrypts pages with
+    #   AES-CTR (faster, but page contents are not authenticated)
+    # @option encryption [String, nil] :aad_prefix identity of the file, which readers can check
+    # @option encryption [Boolean] :store_aad_prefix (true) false leaves it out of the file, so
+    #   readers must supply it
+    # @raise [ArgumentError] for an invalid IO, schema or option, or a compression level the codec
+    #   does not take
     # @raise [MissingCodecError] when the codec's optional gem is not loaded
     # @raise [UnsupportedError] when the codec is not supported
-    def initialize(io, schema, compression: :snappy, row_group_bytes: 16 * 1024 * 1024, row_group_rows: nil,
+    def initialize(io, schema, compression: :snappy, compression_level: nil, row_group_bytes: 16 * 1024 * 1024, row_group_rows: nil,
       page_bytes: 1024 * 1024, page_rows: 20_000, data_page_version: 1, dictionary: true, encodings: {},
-      metadata: {}, bloom_filters: nil)
+      metadata: {}, bloom_filters: nil, encryption: nil)
       raise ArgumentError, "Expected a Herringbone::Schema, got #{schema.class}" unless schema.is_a?(Schema)
       @schema = schema
       @codec = Compression.codec_id(compression)
       # Fail before creating any file if the codec's library is missing
       Compression.ensure_available!(@codec)
+      @compression_level = Compression.check_level!(@codec, compression_level)
       @row_group_bytes = Integer(row_group_bytes)
       @row_group_rows = row_group_rows && Integer(row_group_rows)
       @row_limit = @row_group_rows || ESTIMATE_AFTER_ROWS
@@ -159,7 +187,8 @@ module Herringbone
       @encodings.each { |path, enc| check_encoding!(columns[path], enc) }
       @metadata = metadata
       @bloom_filters = bloom_filter_config(bloom_filters)
-      @pending_bloom_filters = [] # [ColumnMetaData, BloomFilter] for the row group being written
+      @pending_bloom_filters = [] # [ColumnMetaData, BloomFilter, ModuleCrypto] for the row group being written
+      @encryption = encryption ? Encryption::FileEncryptor.new(EncryptionConfiguration.from(encryption), schema) : nil
       @row_groups = []
       @total_rows = 0
       @pos = 0
@@ -167,7 +196,7 @@ module Herringbone
       @aborted = false
       @bytes_per_row = nil
       @io = check_io!(io)
-      write_raw(MAGIC)
+      write_raw(@encryption ? @encryption.magic : MAGIC)
       reset_buffers
     end
 
@@ -248,6 +277,7 @@ module Herringbone
     #
     # @param num_rows [Integer] rows in the row group
     # @param copies [Hash{Integer => CopiedChunk}] column index => chunk to copy instead of encoding
+    #   (only plaintext chunks, into columns this writer does not encrypt)
     # @param codecs [Hash{Integer => Integer}] column index => codec id for an encoded chunk, instead
     #   of the +compression:+ option
     # @param bloom_filters [Hash{Integer => Boolean}] column index => true to give an encoded chunk a
@@ -257,6 +287,9 @@ module Herringbone
     # @raise [Error] when the writer is closed
     def write_row_group(num_rows, copies: {}, codecs: {}, bloom_filters: {}, sorting_columns: nil)
       raise Error, "Writer is closed" if @closed
+      if @encryption && (encrypted = copies.keys.find { |i| @encryption.encrypted?(i) })
+        raise ArgumentError, "Cannot copy a chunk into the encrypted column #{@schema.columns[encrypted].dotted_path}"
+      end
       start = @pos
       chunks = @schema.columns.map do |col|
         if (copy = copies[col.index])
@@ -281,6 +314,12 @@ module Herringbone
       reset_buffers
     end
 
+    # Internal (used by Redaction): whether the column is encrypted in this file
+    #
+    # @param index [Integer] leaf column index
+    # @return [Boolean]
+    def encrypted_column?(index) = @encryption&.encrypted?(index) || false
+
     # Internal (used by Redaction): shreds one value per row of a top-level field into the buffers,
     # for #write_row_group. Other fields are left as they are, so the caller decides which columns
     # are encoded and which are copied.
@@ -307,6 +346,7 @@ module Herringbone
       return if @closed
       flush_row_group
       write_page_indexes
+      @encryption&.finish(@row_groups)
       meta = Format::FileMetaData.new(
         version: 2,
         schema: @schema.to_elements,
@@ -316,10 +356,10 @@ module Herringbone
         created_by: "herringbone-ruby #{VERSION}",
         column_orders: @schema.columns.map { Format::ColumnOrder.new(type_order: Format::TypeDefinedOrder.new) }
       )
-      footer = meta.encode
+      footer = @encryption ? @encryption.footer(meta) : meta.encode
       write_raw(footer)
       write_raw([footer.bytesize].pack("V"))
-      write_raw(MAGIC)
+      write_raw(@encryption ? @encryption.magic : MAGIC)
       @io.flush if @io.respond_to?(:flush)
       @closed = true
     end
@@ -637,6 +677,7 @@ module Herringbone
         @encodings[path] || E::PLAIN
       end
 
+      crypto = @encryption&.chunk(@row_groups.size, col.index)
       chunk_start = @pos
       uncompressed_total = 0
       dictionary_offset = nil
@@ -647,7 +688,7 @@ module Herringbone
           type: Format::PageType::DICTIONARY_PAGE,
           dictionary_page_header: Format::DictionaryPageHeader.new(num_values: dict_values.size, encoding: E::PLAIN)
         )
-        uncompressed_total += write_page(header, plain, codec: codec)
+        uncompressed_total += write_page(header, plain, codec: codec, crypto: crypto)
       end
 
       data_offset = @pos
@@ -680,11 +721,12 @@ module Herringbone
         encoded = encode_values(page_values, value_encoding, type, col.type_length, dict_values&.size)
         rep_bytes = max_rep.positive? ? Encodings::RLE.encode_hybrid(reps, max_rep.bit_length) : "".b
         def_bytes = max_def.positive? ? Encodings::RLE.encode_hybrid(defs, max_def.bit_length) : "".b
+        page_crypto = crypto && [crypto, pages.size]
         uncompressed_total += if @data_page_version == 1
-          write_data_page_v1(n, rep_bytes, def_bytes, encoded, value_encoding, codec)
+          write_data_page_v1(n, rep_bytes, def_bytes, encoded, value_encoding, codec, page_crypto)
         else
           num_rows = max_rep.zero? ? n : reps.count(0)
-          write_data_page_v2(n, n - non_null, num_rows, rep_bytes, def_bytes, encoded, value_encoding, codec)
+          write_data_page_v2(n, n - non_null, num_rows, rep_bytes, def_bytes, encoded, value_encoding, codec, page_crypto)
         end
         pages << PageInfo.new(page_offset, @pos - page_offset, first_row, n - non_null, non_null, range)
         first_row += max_rep.zero? ? n : reps.count(0)
@@ -707,9 +749,9 @@ module Herringbone
       )
       chunk = Format::ColumnChunk.new(file_offset: chunk_start, meta_data: meta)
       if bloom
-        @pending_bloom_filters << [meta, build_bloom_filter(col, bloom, dict_values, values)]
+        @pending_bloom_filters << [meta, build_bloom_filter(col, bloom, dict_values, values), crypto]
       end
-      @page_indexes << [chunk, column_index_for(col, pages, order), offset_index_for(pages)]
+      @page_indexes << [chunk, column_index_for(col, pages, order), offset_index_for(pages), crypto]
       chunk
     end
 
@@ -805,19 +847,22 @@ module Herringbone
 
     # Page indexes go after the last row group: all column indexes, then all offset indexes.
     # A copied chunk brings its ColumnIndex already encoded, and may come without either index.
+    # Those of encrypted columns are encrypted.
     #
     # @return [void]
     def write_page_indexes
-      @page_indexes.each do |chunk, column_index, _|
+      @page_indexes.each do |chunk, column_index, _, crypto|
         next unless column_index
         bytes = column_index.is_a?(String) ? column_index : column_index.encode
+        bytes = crypto.encrypt(Encryption::COLUMN_INDEX, bytes) if crypto
         chunk.column_index_offset = @pos
         chunk.column_index_length = bytes.bytesize
         write_raw(bytes)
       end
-      @page_indexes.each do |chunk, _, offset_index|
+      @page_indexes.each do |chunk, _, offset_index, crypto|
         next unless offset_index
         bytes = offset_index.encode
+        bytes = crypto.encrypt(Encryption::OFFSET_INDEX, bytes) if crypto
         chunk.offset_index_offset = @pos
         chunk.offset_index_length = bytes.bytesize
         write_raw(bytes)
@@ -893,12 +938,18 @@ module Herringbone
     end
 
     # Bloom filters go right after the row group's column chunks, in column order. A copied
-    # chunk brings its filter already encoded.
+    # chunk brings its filter already encoded. In an encrypted column the header and the bitset
+    # are encrypted separately.
     #
     # @return [void]
     def write_bloom_filters
-      @pending_bloom_filters.each do |meta, filter|
-        bytes = filter.is_a?(String) ? filter : filter.encode
+      @pending_bloom_filters.each do |meta, filter, crypto|
+        bytes = if crypto
+          crypto.encrypt(Encryption::BLOOM_FILTER_HEADER, filter.header.encode) <<
+            crypto.encrypt(Encryption::BLOOM_FILTER_BITSET, filter.bitset)
+        else
+          filter.is_a?(String) ? filter : filter.encode
+        end
         meta.bloom_filter_offset = @pos
         meta.bloom_filter_length = bytes.bytesize
         write_raw(bytes)
@@ -1015,18 +1066,40 @@ module Herringbone
 
     # Writes a page, returning the uncompressed size including the header
     #
+    # Compresses with the configured level when +codec+ is the writer's own; chunks a redaction
+    # keeps in their source codec use that codec's default
+    #
+    # @param codec [Integer] codec id
+    # @param data [String] bytes to compress
+    # @return [String] compressed bytes
+    def compress(codec, data)
+      Compression.compress(codec, data, (codec == @codec) ? @compression_level : nil)
+    end
+
+    # In an encrypted column the body and the header are encrypted; the CRC covers the body as
+    # stored, encrypted.
+    #
     # @param header [Format::PageHeader] header; sizes and CRC32 are filled in here
     # @param body [String] uncompressed page body
     # @param compressed [String, nil] bytes to write as the page body, when already prepared (v2 data
     #   pages, whose levels stay uncompressed); +body+ is compressed otherwise
     # @param codec [Integer] codec id to compress +body+ with
+    # @param crypto [Encryption::ModuleCrypto, nil] encryption of the column's modules
+    # @param ordinal [Integer, nil] data page ordinal within the chunk; nil for a dictionary page
     # @return [Integer]
-    def write_page(header, body, compressed = nil, codec: @codec)
-      compressed ||= Compression.compress(codec, body)
+    def write_page(header, body, compressed = nil, codec: @codec, crypto: nil, ordinal: nil)
+      compressed ||= compress(codec, body)
       header.uncompressed_page_size ||= body.bytesize
+      dictionary = header.type == Format::PageType::DICTIONARY_PAGE
+      if crypto
+        compressed = crypto.encrypt(dictionary ? Encryption::DICTIONARY_PAGE : Encryption::DATA_PAGE, compressed, ordinal)
+      end
       header.compressed_page_size = compressed.bytesize
       header.crc = Zlib.crc32(compressed).then { |c| (c >= 0x8000_0000) ? c - 0x1_0000_0000 : c }
       encoded = header.encode
+      if crypto
+        encoded = crypto.encrypt(dictionary ? Encryption::DICTIONARY_PAGE_HEADER : Encryption::DATA_PAGE_HEADER, encoded, ordinal)
+      end
       write_raw(encoded)
       write_raw(compressed)
       encoded.bytesize + header.uncompressed_page_size
@@ -1040,8 +1113,10 @@ module Herringbone
     # @param encoded [String] encoded values
     # @param encoding [Integer] encoding id of the values
     # @param codec [Integer] codec id to compress the page with
+    # @param page_crypto [Array(Encryption::ModuleCrypto, Integer), nil] encryption of the column's
+    #   modules and the page's ordinal, for an encrypted column
     # @return [Integer] uncompressed size including the header
-    def write_data_page_v1(n, rep_bytes, def_bytes, encoded, encoding, codec)
+    def write_data_page_v1(n, rep_bytes, def_bytes, encoded, encoding, codec, page_crypto)
       body = String.new(encoding: Encoding::BINARY)
       body << [rep_bytes.bytesize].pack("V") << rep_bytes unless rep_bytes.empty?
       body << [def_bytes.bytesize].pack("V") << def_bytes unless def_bytes.empty?
@@ -1053,7 +1128,7 @@ module Herringbone
           definition_level_encoding: E::RLE, repetition_level_encoding: E::RLE
         )
       )
-      write_page(header, body, codec: codec)
+      write_page(header, body, codec: codec, crypto: page_crypto&.first, ordinal: page_crypto&.last)
     end
 
     # A DATA_PAGE_V2: levels without length prefixes and uncompressed, then the compressed values
@@ -1066,9 +1141,11 @@ module Herringbone
     # @param encoded [String] encoded values
     # @param encoding [Integer] encoding id of the values
     # @param codec [Integer] codec id to compress the values with
+    # @param page_crypto [Array(Encryption::ModuleCrypto, Integer), nil] encryption of the column's
+    #   modules and the page's ordinal, for an encrypted column
     # @return [Integer] uncompressed size including the header
-    def write_data_page_v2(n, nulls, rows, rep_bytes, def_bytes, encoded, encoding, codec)
-      compressed = Compression.compress(codec, encoded)
+    def write_data_page_v2(n, nulls, rows, rep_bytes, def_bytes, encoded, encoding, codec, page_crypto)
+      compressed = compress(codec, encoded)
       header = Format::PageHeader.new(
         type: Format::PageType::DATA_PAGE_V2,
         uncompressed_page_size: rep_bytes.bytesize + def_bytes.bytesize + encoded.bytesize,
@@ -1079,7 +1156,8 @@ module Herringbone
           is_compressed: codec != Format::Codec::UNCOMPRESSED
         )
       )
-      write_page(header, "".b, rep_bytes + def_bytes + compressed, codec: codec)
+      write_page(header, "".b, rep_bytes + def_bytes + compressed, codec: codec, crypto: page_crypto&.first,
+        ordinal: page_crypto&.last)
     end
 
     # Statistics and column index bounds longer than this are truncated, see #truncate_min

data/lib/herringbone.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require "stringio"
-require "pathname"
 require_relative "herringbone/version"
 
 # Pure-Ruby reader and writer for Apache Parquet files
@@ -38,33 +37,76 @@ module Herringbone
   class SchemaMismatch < EncodeError; end
 
   # The file (or the writer configuration) uses a Parquet feature Herringbone does not implement,
-  # such as encryption or a codec whose library is unavailable
+  # such as a codec whose library is unavailable
   class UnsupportedError < Error; end
+
+  # An encrypted file or column cannot be read: its key was not given, the key or AAD prefix is
+  # wrong, or the encrypted bytes were changed
+  class DecryptionError < Error; end
 end
 
-require_relative "herringbone/io_buffer_support"
-require_relative "herringbone/codecs/snappy"
-require_relative "herringbone/codecs/lz4"
-require_relative "herringbone/codecs/lzo"
-require_relative "herringbone/thrift"
-require_relative "herringbone/format"
-require_relative "herringbone/encodings/rle"
-require_relative "herringbone/encodings/plain"
-require_relative "herringbone/encodings/delta"
-require_relative "herringbone/compression"
-require_relative "herringbone/types"
-require_relative "herringbone/schema"
-require_relative "herringbone/active_record"
-require_relative "herringbone/reader"
-require_relative "herringbone/byte_values"
-require_relative "herringbone/writer"
-require_relative "herringbone/inferring_writer"
-require_relative "herringbone/simple_writer"
-require_relative "herringbone/xxhash"
-require_relative "herringbone/bloom_filter"
-require_relative "herringbone/inspector"
-require_relative "herringbone/visualizer"
-require_relative "herringbone/redaction"
+module Herringbone
+  # Everything else loads on first use, so a process that only reads plain files never loads the
+  # writer, the inspector or OpenSSL. Herringbone.eager_load! loads it all (Ractors on Ruby < 3.4
+  # need that: they cannot autoload).
+
+  # Directory holding the files that are autoloaded
+  LIB = File.expand_path("herringbone", __dir__)
+  private_constant :LIB
+
+  autoload :BloomFilter, "#{LIB}/bloom_filter"
+  autoload :ByteValues, "#{LIB}/byte_values"
+  autoload :Compression, "#{LIB}/compression"
+  autoload :DecryptionConfiguration, "#{LIB}/encryption_configuration"
+  autoload :Encryption, "#{LIB}/encryption"
+  autoload :EncryptionConfiguration, "#{LIB}/encryption_configuration"
+  autoload :Format, "#{LIB}/format"
+  autoload :InferringWriter, "#{LIB}/inferring_writer"
+  autoload :Inspector, "#{LIB}/inspector"
+  autoload :IOBufferSupport, "#{LIB}/io_buffer_support"
+  autoload :Key, "#{LIB}/key"
+  autoload :MissingCodecError, "#{LIB}/compression"
+  autoload :Reader, "#{LIB}/reader"
+  autoload :Redaction, "#{LIB}/redaction"
+  autoload :Schema, "#{LIB}/schema"
+  autoload :SimpleWriter, "#{LIB}/simple_writer"
+  autoload :Thrift, "#{LIB}/thrift"
+  autoload :Types, "#{LIB}/types"
+  autoload :Visualizer, "#{LIB}/visualizer"
+  autoload :Writer, "#{LIB}/writer"
+  autoload :XXHash, "#{LIB}/xxhash"
+
+  module Codecs
+    autoload :LZ4, "#{LIB}/codecs/lz4"
+    autoload :LZO, "#{LIB}/codecs/lzo"
+    autoload :Snappy, "#{LIB}/codecs/snappy"
+  end
+
+  module Encodings
+    autoload :ByteStreamSplit, "#{LIB}/encodings/delta"
+    autoload :Delta, "#{LIB}/encodings/delta"
+    autoload :Plain, "#{LIB}/encodings/plain"
+    autoload :RLE, "#{LIB}/encodings/rle"
+  end
+
+  # Loads every part of Herringbone now instead of on first use. Ractors cannot autoload before
+  # Ruby 3.4, so call this before starting Ractors that use Herringbone there; it also moves the
+  # loading out of the first request in a forking server.
+  #
+  # @return [void]
+  def self.eager_load!
+    seen = {}
+    walk = lambda do |mod|
+      next if seen[mod]
+      seen[mod] = true
+      mod.constants(false).each do |name|
+        value = mod.const_get(name, false)
+        walk.call(value) if value.is_a?(Module) && value.name&.start_with?("Herringbone::")
+      end
+    end
+    walk.call(self)
+  end
+end
 
 module Herringbone
   module_function
@@ -86,6 +128,7 @@ module Herringbone
   # @param schema [Schema, nil] schema to write with; derived from +records+ when nil
   # @param options [Hash{Symbol => Object}] passed to Writer.new
   # @option options [Symbol] :compression (:snappy) codec, see Herringbone.codecs
+  # @option options [Integer, nil] :compression_level (nil) level for :zstd, :gzip or :brotli
   # @option options [Integer] :row_group_bytes (16MB) approximate buffered size that triggers a row group
   # @option options [Integer, nil] :row_group_rows (nil) also flush a row group after this many rows
   # @option options [Integer] :page_bytes (1MB) approximate uncompressed data page size
@@ -147,6 +190,7 @@ module Herringbone
   # @param writer_options [Hash{Symbol => Object}] Writer options for re-encoded column chunks, and
   #   +metadata:+ to replace the footer key/value metadata, see Redaction#apply
   # @option writer_options [Symbol] :compression (codec of each source chunk) codec for re-encoded chunks
+  # @option writer_options [Integer, nil] :compression_level (nil) level for that codec, see Writer
   # @option writer_options [Boolean, Array<String>, Hash{String => Boolean, Hash}] :bloom_filters (nil)
   #   columns whose re-encoded chunks get a bloom filter, besides those whose source chunk had one
   # @option writer_options [Hash{String => String}] :metadata (the input's) footer key/value metadata

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: herringbone
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Julik Tarkhanov
 bindir: bin
 cert_chain: []
-date: 2026-10-02 00:00:00.000000000 Z
+date: 2026-10-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bigdecimal
@@ -35,6 +35,7 @@ extra_rdoc_files: []
 files:
 - CHANGELOG.md
 - LICENSE
+- MANUAL.md
 - README.md
 - bin/herringbone
 - lib/herringbone.rb
@@ -48,11 +49,15 @@ files:
 - lib/herringbone/encodings/delta.rb
 - lib/herringbone/encodings/plain.rb
 - lib/herringbone/encodings/rle.rb
+- lib/herringbone/encryption.rb
+- lib/herringbone/encryption_configuration.rb
 - lib/herringbone/format.rb
 - lib/herringbone/inferring_writer.rb
 - lib/herringbone/inspector.rb
 - lib/herringbone/io_buffer_support.rb
+- lib/herringbone/key.rb
 - lib/herringbone/reader.rb
+- lib/herringbone/reader/bloom_filters.rb
 - lib/herringbone/reader/column_chunk_reader.rb
 - lib/herringbone/reader/column_cursor.rb
 - lib/herringbone/reader/numo.rb