Skip to content

Apache Iggy encrypts streams with rind #474

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kixelated wants to merge 2 commits into from
Closed

Apache Iggy encrypts streams with rind #474

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8b2e21e
chore(quest): claim quest/m2/adoption/iggy.md
kixelated Nov 7, 2026
8035718
chore(quest): record the ready Iggy patch and wait on the maintainer'…
kixelated Nov 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions quest/m2/adoption/iggy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,3 +12,28 @@ Decided with the maintainer on 2026-11-04, in a planning interview. Its
AES-GCM-SIV option stays on RustCrypto (rind has none). Apache projects take
contributions through their own process; follow it. Posting is the
maintainer's call.

The patch is ready and tested: `iggy_common`'s client-side
`Aes256GcmEncryptor` and the server's stream-key envelope seal with rind, and
`aes-gcm` drops to a dev-dependency. It lives at
[`patches/1-rind.patch`](https://github.com/moq-dev/rind/blob/scratch/iggy-bench/patches/1-rind.patch)
on the `scratch/iggy-bench` branch, with the bench probe that measured it;
[moq-dev/rind#474](https://github.com/moq-dev/rind/pull/474) holds the numbers
and the facts for the issue.

- Iggy wants an approved issue, assigned to the person who opens the PR,
before any code. That person writes the rationale in their own words and
must be able to defend every line. Maintainers can close agent-driven PRs
without review. So the maintainer opens the issue and, once assigned, the PR.
- Iggy's newer per-stream server-side keys encrypt with AES-256-GCM-SIV; plain
AES-256-GCM is the SDK's client-side encryption and the key envelope.
- Iggy ships x86_64 and aarch64 only, which rind covers.

## Waiting

- Maintainer: open the apache/iggy issue in your own words from the facts in
[moq-dev/rind#474](https://github.com/moq-dev/rind/pull/474) (recommended),
or drop the quest. An agent cannot: Iggy closes agent-driven PRs and wants
the author to answer review themselves. Check with
`gh issue list -R apache/iggy --author @me --search rind`; once assigned,
open the PR from the patch.