[NIFI-6783] Handle content repository encryption status change on startup

• Type: Sub-task
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.2.0
• Component/s: Core Framework
• Labels: encryption provenance security
• Assignee: Unassigned
• Reporter: Andy LoPresto
• Created: 16/Oct/19 21:58
• Updated: 26/Jan/23 02:35

Description

If the content repository changes from encrypted -> unencrypted or vice-versa on startup, the application should handle the change.

• Unencrypted -> encrypted: Attempt to create an InputStream instance to read the existing content into memory and write them back using EncryptedContentRepositoryOutputStream
• Encrypted -> unencrypted: Attempt to create a CipherInputStream instance to read the existing events into memory and write them back using OutputStream. This depends on the key(s) for the key IDs used still being available via nifi.properties.

This process may be very slow given large existing repositories, so a standalone tool should also be made available to perform this process outside of the running app.

Issue Links

• is a clone of: NIFI-3722 Handle provenance repository encryption status change on startup
• is cloned by: NIFI-6994 Handle flowfile repository encryption status change on startup