v0.24.9_hotfix2

scripts/check_source.py

@@ -521,6 +521,12 @@ assert 'regex::Regex::new(r#"(?i)((?:authorization|' in logging_source, "KV reda
 assert '[^\\s,;\"\']+" )' not in logging_source, "do not reintroduce the unterminated raw-string form in KV redaction"
 assert "pub error_log: crate::logging::ErrorLogSettings" in config_source
 assert "credential_ini_b64" in acme_source and "credential_ini_b64" in acme_worker_source
+assert "STANDARD.encode(credential.as_slice())" in acme_source, "Base64 input must be an unambiguous byte slice"
+assert "STANDARD.encode(credential.as_ref())" not in acme_source, "Zeroizing<Vec<u8>>::as_ref() is ambiguous for Engine::encode"
+assert "&mut *ciphertext" in secret_store_source, "ring seal must receive the underlying Vec<u8>, not an ambiguous AsMut target"
+assert "&mut *encrypted" in backup_source, "ring seal must receive the underlying Vec<u8>, not an ambiguous AsMut target"
+assert "seal_in_place_append_tag(\n            Nonce::assume_unique_for_key(nonce),\n            Aad::from(aad(secret_id, provider)),\n            ciphertext.as_mut()," not in secret_store_source
+assert "seal_in_place_append_tag(\n            Nonce::assume_unique_for_key(nonce_bytes),\n            Aad::from(KEY_AAD),\n            encrypted.as_mut()," not in backup_source
 assert "finally:" in acme_worker_source and "credential_file.unlink" in acme_worker_source
 for marker in ['certificate_api_credentials', 'upsert_certificate_api_credential', 'revoke_certificate_api_credential', 'verify_certificate_api_credential', '0005_certificate_api.sql', '0006_certificate_api_credentials.sql']:
     assert marker in db_source, marker