Repository navigation
Conversation
Add EXPERIMENTAL --offset/--length to decrypt a plaintext byte range; only the segments covering the range are read and decrypted. An http(s):// argument is loaded with HTTP range requests via LoadTDFFromURL. Part of DSPX-4886 (DSPX-5114). Signed-off-by: sujan kota <sujankota@gmail.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Benchmark results, click to expandBulk Benchmark Results
TDF3 Benchmark Results
|
Contributor
dmihalcik-virtru
requested changes
Oct 15, 2026
…imit Signed-off-by: sujan kota <sujankota@gmail.com>
Contributor
Benchmark results, click to expandBulk Benchmark Results
TDF3 Benchmark Results
|
Contributor
|
Contributor
3 tasks
dmihalcik-virtru
approved these changes
Oct 16, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed Changes
Part of DSPX-4886 (DSPX-5114): lets otdfctl decrypt a plaintext byte range, locally or from a TDF served over HTTP(S), which the xtest partial-decrypt tests at 100 GiB–50 TiB depend on.
decrypt --offset/--length(EXPERIMENTAL): decrypts only the requested plaintext range.--lengthdefaults to-1(to end) and is clamped at the end of the payload; an offset past the end fails, and-oleaves no file behind.Reader.Seek+WriteTothrough arangeWriterthat stops the reader once the range is written, so boundary segments aren't fetched or decrypted twice.http:///https://argument is loaded withLoadTDFFromURL(range requests, SDK's unauthenticated HTTP client), so only the zip directory, manifest and needed segments are downloaded.Decrypthandler gainsURL,Offset,Lengthoptions.Checklist
Testing Instructions
cd otdfctl && go test ./pkg/handlers/ ./cmd/...(TestRangeWriter).otdfctl/e2e/encrypt-decrypt.bats(range across a segment boundary, offset to end via-o, length past end, piped stdin, offset past end). Ran locally against a CI-equivalent platform config:bats e2e/encrypt-decrypt.bats --filter "partial decrypt", all 5 pass.otdfctl decrypt --offset 2097000 --length 400 http://127.0.0.1:8099/p.txt.tdf; output matched the plaintext and the server saw 11 range requests (tail + manifest, then exactly the two 2 MiB segments the range crosses).