Fix: Correct handling of base64 padding during aes-gcm private key decryption. (#96761)

* SecretsService: Use RawStdEncoding to avoid padding

* Commment

* Forgot one line

* Backward compatibility

pkg/services/secrets/manager/manager.go

@@ -441,7 +441,7 @@ func (s *SecretsService) dataKeyById(ctx context.Context, id string) ([]byte, er
 		return nil, fmt.Errorf("could not find encryption provider '%s'", dataKey.Provider)
 	}
 
-	// 2.2. Encrypt the data key.
+	// 2.2. Decrypt the data key.
 	decrypted, err := provider.Decrypt(ctx, dataKey.EncryptedData)
 	if err != nil {
 		return nil, err

pkg/services/signingkeys/signingkeysimpl/service.go

@@ -1,6 +1,7 @@
 package signingkeysimpl
 
 import (
+	"bytes"
 	"context"
 	"crypto"
 	"crypto/ecdsa"
@@ -226,8 +227,8 @@ func (s *Service) encodePrivateKey(ctx context.Context, privateKey crypto.Signer
 		return nil, err
 	}
 
-	encoded := make([]byte, base64.StdEncoding.EncodedLen(len(encrypted)))
-	base64.StdEncoding.Encode(encoded, encrypted)
+	encoded := make([]byte, base64.RawStdEncoding.EncodedLen(len(encrypted)))
+	base64.RawStdEncoding.Encode(encoded, encrypted)
 	return encoded, nil
 }
 
@@ -237,8 +238,12 @@ func (s *Service) decodePrivateKey(ctx context.Context, privateKey []byte) (cryp
 		return nil, errors.New("private key is empty")
 	}
 
-	payload := make([]byte, base64.StdEncoding.DecodedLen(len(privateKey)))
-	_, err := base64.StdEncoding.Decode(payload, privateKey)
+	// Backwards compatibility with old base64 encoding
+	// Can be removed in the future
+	privateKey = bytes.TrimRight(privateKey, "=")
+
+	payload := make([]byte, base64.RawStdEncoding.DecodedLen(len(privateKey)))
+	_, err := base64.RawStdEncoding.Decode(payload, privateKey)
 	if err != nil {
 		return nil, err
 	}