Internal 2026 audit fixes

[patrislav]

No description provided.

[Copilot]

Pull request overview

This PR applies a set of security/audit hardening changes across tracing, attestation/enclave, and crypto utilities to reduce sensitive-data exposure, tighten validation, and make failure modes safer and more explicit.

Changes:

• Tracing: add middleware options (custom header, skip stack traces) and redact recorded URLs.
• Encryption/attestation: add stricter input validation (KMS allowed keys non-empty, config validation) and safer key cleanup behavior (quarantine period).
• Crypto parsing: harden BER/CMS and padding handling; add tests for malformed inputs.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tracing/span.go	Adds context-driven config to optionally skip stack trace capture in spans.
tracing/middleware.go	Adds middleware options, uses redacted URL, configurable response header.
tracing/http_client.go	Uses redacted URL in client spans.
encryption/pool.go	Adds key-deletion quarantine window and threshold check before combining shares.
encryption/pool_test.go	Updates tests for share-threshold error and quarantine behavior.
encryption/config.go	Makes NewConfig validate inputs and return an error on invalid config.
encryption/config_test.go	Adds coverage for NewConfig validation rules.
enclave/provider_dummy.go	Replaces embedded static key material with generated ephemeral CA/certs.
enclave/attestation.go	Requires explicit allowed KMS key IDs and tightens allow-list enforcement.
enclave/attestation_test.go	Updates tests for dynamic cert fingerprint and KeyId handling.
cms/cms.go	Adds ciphertext length validation before CBC decryption.
cms/cms_test.go	Adds tests for malformed BER and truncated ciphertext.
cms/ber.go	Tightens bounds checks to avoid out-of-range reads on malformed BER.
attestation/userdata.go	Changes userdata generation to accept request/response bodies explicitly.
attestation/middleware.go	Passes captured request body into userdata hashing instead of re-reading request body.
aesgcm/aesgcm.go	Rejects nil randomness source for AES-GCM nonce generation.
aescbc/aescbc.go	Validates all PKCS#7 padding bytes on unpad.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 5 comments.