cdh: use b64url encoding in sealed-secrets JWS

confidential-data-hub/docs/SEALED_SECRET.md

@@ -146,7 +146,7 @@ Since signature verification is not yet supported, dummy values
 can be used for the header and signature. A sealed secret could look like this.
 
 ```
-secret=sealed.fakejwsheader.ewogICAgInZlcnNpb24iOiAiMC4xLjAiLAogICAgInR5cGUiOiAidmF1bHQiLAogICAgIm5hbWUiOiAia2JzOi8vL2RlZmF1bHQvc2VhbGVkLXNlY3JldC90ZXN0IiwKICAgICJwcm92aWRlciI6ICJrYnMiLAogICAgInByb3ZpZGVyX3NldHRpbmdzIjoge30sCiAgICAiYW5ub3RhdGlvbnMiOiB7fQp9Cg==.fakesignature
+secret=sealed.fakejwsheader.ewogICAgInZlcnNpb24iOiAiMC4xLjAiLAogICAgInR5cGUiOiAidmF1bHQiLAogICAgIm5hbWUiOiAia2JzOi8vL2RlZmF1bHQvc2VhbGVkLXNlY3JldC90ZXN0IiwKICAgICJwcm92aWRlciI6ICJrYnMiLAogICAgInByb3ZpZGVyX3NldHRpbmdzIjoge30sCiAgICAiYW5ub3RhdGlvbnMiOiB7fQp9Cg.fakesignature
 ```
 
 ## Usage in CoCo
@@ -175,14 +175,14 @@ Start with a sealed secret such as
 ```
 You can use the [secret cli](../secret/src/bin) tool to generate a sealed secret.
 
-Encode the payload in BASE64
+Encode the payload in BASE64URL
 ```
-ewoJInZlcnNpb24iOiAiMC4xLjAiLAoJInR5cGUiOiAiZW52ZWxvcGUiLAoJInByb3ZpZGVyIjogInh4eCIsCgkia2V5X2lkIjogInh4eCIsCgkiZW5jcnlwdGVkX2tleSI6ICJhYjI3ZGM9IiwgCgkiZW5jcnlwdGVkX2RhdGEiOiAieHh4IiwKCSJ3cmFwX3R5cGUiOiAiQTI1NkdDTSIsCgkiaXYiOiAieHh4IiwKCSJhbm5vdGF0aW9ucyI6IHsKCQkiY3J5cHRvX2NvbnRleHQiOiB7CgkJCSJhbGdvcml0aG0iOiAiQTI1NkdDTSIKCQl9LAoJCSJwcm92aWRlcl9zZXR0aW5nIjogewoJCQkia21zX2luc3RhbmNlX2lkIjogInh4eCIKCQl9Cgl9Cn0=
+ewoJInZlcnNpb24iOiAiMC4xLjAiLAoJInR5cGUiOiAiZW52ZWxvcGUiLAoJInByb3ZpZGVyIjogInh4eCIsCgkia2V5X2lkIjogInh4eCIsCgkiZW5jcnlwdGVkX2tleSI6ICJhYjI3ZGM9IiwgCgkiZW5jcnlwdGVkX2RhdGEiOiAieHh4IiwKCSJ3cmFwX3R5cGUiOiAiQTI1NkdDTSIsCgkiaXYiOiAieHh4IiwKCSJhbm5vdGF0aW9ucyI6IHsKCQkiY3J5cHRvX2NvbnRleHQiOiB7CgkJCSJhbGdvcml0aG0iOiAiQTI1NkdDTSIKCQl9LAoJCSJwcm92aWRlcl9zZXR0aW5nIjogewoJCQkia21zX2luc3RhbmNlX2lkIjogInh4eCIKCQl9Cgl9Cn0
 ```
 Then add a prefix `sealed.` and JWS header and signature.
 
 ```
-sealed.fakejwsheader.ewoJInZlcnNpb24iOiAiMC4xLjAiLAoJInR5cGUiOiAiZW52ZWxvcGUiLAoJInByb3ZpZGVyIjogInh4eCIsCgkia2V5X2lkIjogInh4eCIsCgkiZW5jcnlwdGVkX2tleSI6ICJhYjI3ZGM9IiwgCgkiZW5jcnlwdGVkX2RhdGEiOiAieHh4IiwKCSJ3cmFwX3R5cGUiOiAiQTI1NkdDTSIsCgkiaXYiOiAieHh4IiwKCSJhbm5vdGF0aW9ucyI6IHsKCQkiY3J5cHRvX2NvbnRleHQiOiB7CgkJCSJhbGdvcml0aG0iOiAiQTI1NkdDTSIKCQl9LAoJCSJwcm92aWRlcl9zZXR0aW5nIjogewoJCQkia21zX2luc3RhbmNlX2lkIjogInh4eCIKCQl9Cgl9Cn0=.fakesignature
+sealed.fakejwsheader.ewoJInZlcnNpb24iOiAiMC4xLjAiLAoJInR5cGUiOiAiZW52ZWxvcGUiLAoJInByb3ZpZGVyIjogInh4eCIsCgkia2V5X2lkIjogInh4eCIsCgkiZW5jcnlwdGVkX2tleSI6ICJhYjI3ZGM9IiwgCgkiZW5jcnlwdGVkX2RhdGEiOiAieHh4IiwKCSJ3cmFwX3R5cGUiOiAiQTI1NkdDTSIsCgkiaXYiOiAieHh4IiwKCSJhbm5vdGF0aW9ucyI6IHsKCQkiY3J5cHRvX2NvbnRleHQiOiB7CgkJCSJhbGdvcml0aG0iOiAiQTI1NkdDTSIKCQl9LAoJCSJwcm92aWRlcl9zZXR0aW5nIjogewoJCQkia21zX2luc3RhbmNlX2lkIjogInh4eCIKCQl9Cgl9Cn0.fakesignature
 ```
 
 Create a Kubernetes secret

confidential-data-hub/secret/src/secret/mod.rs

@@ -5,7 +5,7 @@
 
 pub mod layout;
 
-use base64::{engine::general_purpose::STANDARD, Engine};
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD as b64, Engine};
 use serde::{Deserialize, Serialize};
 
 use self::layout::{envelope::EnvelopeSecret, vault::VaultSecret};
@@ -49,7 +49,7 @@ impl Secret {
             return Err(SecretError::ParseFailed("malformed input sealed secret"));
         }
 
-        let secret_json = STANDARD
+        let secret_json = b64
             .decode(sections[2])
             .map_err(|_| SecretError::ParseFailed("base64 decode Secret body"))?;
 
@@ -67,7 +67,7 @@ impl Secret {
         let secret_json = serde_json::to_string(&self)
             .map_err(|_| SecretError::ParseFailed("JSON serialization failed"))?;
 
-        let secret_base64 = STANDARD.encode(secret_json);
+        let secret_base64 = b64.encode(secret_json);
 
         let secret_string = format!("sealed.fakejwsheader.{}.fakesignature", secret_base64);
 
@@ -111,6 +111,15 @@ mod tests {
             name: "xxx".into(),
         }),
     })]
+    #[case(include_str!("../../tests/vault-2.json"), Secret {
+        version: "0.1.0".into(),
+        r#type: SecretContent::Vault(VaultSecret {
+            provider: "kbs".into(),
+            provider_settings: ProviderSettings::default(),
+            annotations: Annotations::default(),
+            name: "kbs:///one/2/trois".into(),
+        }),
+    })]
     fn serialize_deserialize(#[case] secret_json: &str, #[case] secret_object: Secret) {
         let serialized = serde_json::to_string_pretty(&secret_object).expect("serialize failed");
         assert_json_eq!(secret_json, serialized);
@@ -127,4 +136,23 @@ mod tests {
 
         assert_eq!(secret_from_string, secret_object);
     }
+
+    #[rstest]
+    fn test_no_padding(#[values(0, 1, 2, 3)] name_size: usize) {
+        let name = "0".repeat(name_size);
+
+        let secret = Secret {
+            version: "0.1.0".into(),
+            r#type: SecretContent::Vault(VaultSecret {
+                provider: "kbs".into(),
+                provider_settings: ProviderSettings::default(),
+                annotations: Annotations::default(),
+                name,
+            }),
+        };
+
+        let serialized = serde_json::to_string_pretty(&secret).unwrap();
+
+        assert!(!serialized.contains("="));
+    }
 }

confidential-data-hub/secret/tests/vault-2.json

@@ -0,0 +1,8 @@
+{
+  "version": "0.1.0",
+  "type": "vault",
+  "name": "kbs:///one/2/trois",
+  "provider": "kbs",
+  "provider_settings": {},
+  "annotations": {}
+}