feat: bump base64

[nmattia]

This drops base64 0.13.1 (released 4 years ago) and consolidates the base64 versions around 0.22.1.

This includes some API changes (mostly specifying the decoding options via eg base64::prelude::BASE64_STANDARD::decode(...) & friends) and drops the openssh-keys (does not support recent base64, so we inline the ssh-rsa-specific decoding).

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 2ef666a.

Security Overview

• 🔎 Scanned files: 43 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/6992424c-495e-4621-b441-efd6821a4be6?scanId=5a8a91e9-bdce-4e3a-8230-bd7a11ebab67&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► Cargo.Bazel.json.lock        Update dependencies and crate versions (base64 0.22.1, headers 0.4.1, jsonrpc 0.20.1, etc)
Enhancement	► Cargo.Bazel.toml.lock        Update base64 and jsonrpc versions and related checksums in lockfile sections
Enhancement	► Cargo.lock        Bump base64 to 0.22.1 and jsonrpc to 0.20.1 across multiple crates; adjust dependencies references from 0.13.1/0.18.0 to 0.22.1/0.20.1
Enhancement	► Cargo.toml        Update base64 crate version to 0.22; update jsonrpc to 0.20.1
Enhancement	► bazel/rust.MODULE.bazel        Bump crate specs for base64 to ^0.22 and jsonrpc to ^0.20.1; reflect updated versions
Enhancement	► rs/artifact_pool/Cargo.toml        Update serde-bytes-repr to 0.3.0
Enhancement	► rs/bitcoin/checker/src/providers.rs        Use BASE64_STANDARD for encoding in authorization header parsing
Enhancement	► rs/bitcoin/checker/src/providers/tests.rs        Adjust test expectations to BASE64_STANDARD encoding
Enhancement	► rs/crypto/iccsa/src/types/generic_traits.rs        Import base64::prelude::* and use BASE64_STANDARD for formatting
Enhancement	► rs/crypto/internal/crypto_lib/basic_sig/ecdsa_secp256k1/src/types.rs        Use BASE64_STANDARD for Debug formatting of keys/signatures
Enhancement	► rs/crypto/internal/crypto_lib/basic_sig/ecdsa_secp256k1/tests/api_tests.rs        Update test to use BASE64_STANDARD in key parsing
Enhancement	► rs/crypto/internal/crypto_lib/basic_sig/ecdsa_secp256r1/src/types.rs        Use BASE64_STANDARD for Debug formatting
Enhancement	► rs/crypto/internal/crypto_lib/basic_sig/ecdsa_secp256r1/tests/api_tests.rs        Update test to use BASE64_STANDARD_NO_PAD for decoding
Enhancement	► rs/crypto/internal/crypto_lib/basic_sig/ed25519/src/types/generic_traits.rs        Use BASE64_STANDARD for Debug formatting
Enhancement	► rs/crypto/internal/crypto_lib/multi_sig/bls12_381/src/types.rs        Use BASE64_STANDARD for Debug formatting of signatures
Enhancement	► rs/crypto/internal/crypto_lib/multi_sig/bls12_381/src/types/generic_traits.rs        Use BASE64_STANDARD in Debug implementations
Enhancement	► rs/crypto/internal/crypto_lib/threshold_sig/bls12_381/src/ni_dkg/groth20_bls12_381/types.rs        Use BASE64_STANDARD for encoding tau in Debug output
Enhancement	► rs/crypto/internal/crypto_lib/threshold_sig/bls12_381/src/types/generic_traits.rs Use BASE64_STANDARD for encoding in Debug
Enhancement	► rs/crypto/internal/crypto_service_provider/src/types.rs        Use BASE64_STANDARD for RsaSha256 formatting in Debug
Enhancement	► rs/ic_os/config/tool/src/guestos/cloud.rs        Use BASE64_STANDARD for decoding Base64 config data
Enhancement	► rs/ic_os/sev/guest/src/key_deriver.rs        Return BASE64_STANDARD encoded key deriver output
Enhancement	► rs/nervous_system/common/src/ledger_validation.rs        [Unclear from diff]

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 2ef666a.

Security Overview

• 🔎 Scanned files: 43 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/14c3f6d7-8c8e-4a33-9b18-2f289f25b557?scanId=f40ce1e0-7866-406a-bac9-b66ca53753b1&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► Cargo.Bazel.json.lock        Update dependencies and crate versions (base64 0.22.1, headers 0.4.1, jsonrpc 0.20.1, etc)
Enhancement	► Cargo.Bazel.toml.lock        Update base64 and jsonrpc versions and related checksums in lockfile sections
Enhancement	► Cargo.lock        Bump base64 to 0.22.1 and jsonrpc to 0.20.1 across multiple crates; adjust dependencies references from 0.13.1/0.18.0 to 0.22.1/0.20.1
Enhancement	► Cargo.toml        Update base64 crate version to 0.22; update jsonrpc to 0.20.1
Enhancement	► bazel/rust.MODULE.bazel        Bump crate specs for base64 to ^0.22 and jsonrpc to ^0.20.1; reflect updated versions
Enhancement	► rs/artifact_pool/Cargo.toml        Update serde-bytes-repr to 0.3.0
Enhancement	► rs/bitcoin/checker/src/providers.rs        Use BASE64_STANDARD for encoding in authorization header parsing
Enhancement	► rs/bitcoin/checker/src/providers/tests.rs        Adjust test expectations to BASE64_STANDARD encoding
Enhancement	► rs/crypto/iccsa/src/types/generic_traits.rs        Import base64::prelude::* and use BASE64_STANDARD for formatting
Enhancement	► rs/crypto/internal/crypto_lib/basic_sig/ecdsa_secp256k1/src/types.rs        Use BASE64_STANDARD for Debug formatting of keys/signatures
Enhancement	► rs/crypto/internal/crypto_lib/basic_sig/ecdsa_secp256k1/tests/api_tests.rs        Update test to use BASE64_STANDARD in key parsing
Enhancement	► rs/crypto/internal/crypto_lib/basic_sig/ecdsa_secp256r1/src/types.rs        Use BASE64_STANDARD for Debug formatting
Enhancement	► rs/crypto/internal/crypto_lib/basic_sig/ecdsa_secp256r1/tests/api_tests.rs        Update test to use BASE64_STANDARD_NO_PAD for decoding
Enhancement	► rs/crypto/internal/crypto_lib/basic_sig/ed25519/src/types/generic_traits.rs        Use BASE64_STANDARD for Debug formatting
Enhancement	► rs/crypto/internal/crypto_lib/multi_sig/bls12_381/src/types.rs        Use BASE64_STANDARD for Debug formatting of signatures
Enhancement	► rs/crypto/internal/crypto_lib/multi_sig/bls12_381/src/types/generic_traits.rs        Use BASE64_STANDARD in Debug implementations
Enhancement	► rs/crypto/internal/crypto_lib/threshold_sig/bls12_381/src/ni_dkg/groth20_bls12_381/types.rs        Use BASE64_STANDARD for encoding tau in Debug output
Enhancement	► rs/crypto/internal/crypto_lib/threshold_sig/bls12_381/src/types/generic_traits.rs Use BASE64_STANDARD for encoding in Debug
Enhancement	► rs/crypto/internal/crypto_service_provider/src/types.rs        Use BASE64_STANDARD for RsaSha256 formatting in Debug
Enhancement	► rs/ic_os/config/tool/src/guestos/cloud.rs        Use BASE64_STANDARD for decoding Base64 config data
Enhancement	► rs/ic_os/sev/guest/src/key_deriver.rs        Return BASE64_STANDARD encoded key deriver output
Enhancement	► rs/nervous_system/common/src/ledger_validation.rs        [Unclear from diff]

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 2ef666a.

Security Overview

• 🔎 Scanned files: 43 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/f5e9d2bb-29a4-4b64-902a-391d65fd8b2d?scanId=8d2a8d59-8bb2-4f57-b47f-6eeb882efc33&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► Cargo.Bazel.json.lock        Update dependencies and crate versions (base64 0.22.1, headers 0.4.1, jsonrpc 0.20.1, etc)
Enhancement	► Cargo.Bazel.toml.lock        Update base64 and jsonrpc versions and related checksums in lockfile sections
Enhancement	► Cargo.lock        Bump base64 to 0.22.1 and jsonrpc to 0.20.1 across multiple crates; adjust dependencies references from 0.13.1/0.18.0 to 0.22.1/0.20.1
Enhancement	► Cargo.toml        Update base64 crate version to 0.22; update jsonrpc to 0.20.1
Enhancement	► bazel/rust.MODULE.bazel        Bump crate specs for base64 to ^0.22 and jsonrpc to ^0.20.1; reflect updated versions
Enhancement	► rs/artifact_pool/Cargo.toml        Update serde-bytes-repr to 0.3.0
Enhancement	► rs/bitcoin/checker/src/providers.rs        Use BASE64_STANDARD for encoding in authorization header parsing
Enhancement	► rs/bitcoin/checker/src/providers/tests.rs        Adjust test expectations to BASE64_STANDARD encoding
Enhancement	► rs/crypto/iccsa/src/types/generic_traits.rs        Import base64::prelude::* and use BASE64_STANDARD for formatting
Enhancement	► rs/crypto/internal/crypto_lib/basic_sig/ecdsa_secp256k1/src/types.rs        Use BASE64_STANDARD for Debug formatting of keys/signatures
Enhancement	► rs/crypto/internal/crypto_lib/basic_sig/ecdsa_secp256k1/tests/api_tests.rs        Update test to use BASE64_STANDARD in key parsing
Enhancement	► rs/crypto/internal/crypto_lib/basic_sig/ecdsa_secp256r1/src/types.rs        Use BASE64_STANDARD for Debug formatting
Enhancement	► rs/crypto/internal/crypto_lib/basic_sig/ecdsa_secp256r1/tests/api_tests.rs        Update test to use BASE64_STANDARD_NO_PAD for decoding
Enhancement	► rs/crypto/internal/crypto_lib/basic_sig/ed25519/src/types/generic_traits.rs        Use BASE64_STANDARD for Debug formatting
Enhancement	► rs/crypto/internal/crypto_lib/multi_sig/bls12_381/src/types.rs        Use BASE64_STANDARD for Debug formatting of signatures
Enhancement	► rs/crypto/internal/crypto_lib/multi_sig/bls12_381/src/types/generic_traits.rs        Use BASE64_STANDARD in Debug implementations
Enhancement	► rs/crypto/internal/crypto_lib/threshold_sig/bls12_381/src/ni_dkg/groth20_bls12_381/types.rs        Use BASE64_STANDARD for encoding tau in Debug output
Enhancement	► rs/crypto/internal/crypto_lib/threshold_sig/bls12_381/src/types/generic_traits.rs Use BASE64_STANDARD for encoding in Debug
Enhancement	► rs/crypto/internal/crypto_service_provider/src/types.rs        Use BASE64_STANDARD for RsaSha256 formatting in Debug
Enhancement	► rs/ic_os/config/tool/src/guestos/cloud.rs        Use BASE64_STANDARD for decoding Base64 config data
Enhancement	► rs/ic_os/sev/guest/src/key_deriver.rs        Return BASE64_STANDARD encoded key deriver output
Enhancement	► rs/nervous_system/common/src/ledger_validation.rs        [Unclear from diff]

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 2ef666a.

Security Overview

• 🔎 Scanned files: 43 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/bd30fac0-c6f5-4bec-83e2-480d2b345946?scanId=33775830-584a-42b9-983a-df93c0da92ad&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type

Relevant files

Enhancement

► Cargo.toml     Update base64 dependency from 0.13.1 to 0.22 ► Bazel rust.MODULE.bazel     Update crate spec version for base64 to ^0.22 and jsonrpc to ^0.20.1 ► Cargo.lock     Reflect updated crate versions and checksums (base64 0.22.1, jsonrpc 0.20.1, headers 0.4.1, etc.) ► Cargo.Bazel.lock     Reflect updated dependencies and versions (base64 0.22.1, jsonrpc 0.20.1, headers 0.4.1, windows-sys 0.61.2, etc.) ► bazel/rust.MODULE.bazel     Update crate specs for base64 and jsonrpc to new versions ► rs/bitcoin/checker/src/providers.rs     Use BASE64_STANDARD for encoding in authorization header ► rs/bitcoin/checker/src/providers/tests.rs     Update tests to use BASE64_STANDARD for expected values ► rs/crypto/.../types.rs (multiple paths)     Switch to BASE64_STANDARD for Debug implementations ► rs/crypto/.../tests.rs (multiple paths)     Update tests to use BASE64_STANDARD for decoding/expected values ► rs/crypto/utils/threshold_sig/src/tests.rs     Use BASE64_STANDARD for decoding test vectors ► rs/ic_os/config/tool/src/guestos/cloud.rs     Use BASE64_STANDARD for decoding Base64 config ► rs/ic_os/sev/guest/src/key_deriver.rs     Return BASE64_STANDARD encoded output instead of base64::encode ► rs/nervous_system/common/src/ledger_validation.rs     No content change indicated in diff excerpt

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 2ef666a.

Security Overview

• 🔎 Scanned files: 43 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/f975f1a5-0a47-4a3b-b7f0-a55609e90390?scanId=be013e43-e969-4477-b4f4-1acec592bed0&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► Cargo.Bazel.json.lock        Update dependencies and crate versions (base64 0.22.1, headers 0.4.1, jsonrpc 0.20.1, etc)
Enhancement	► Cargo.Bazel.toml.lock        Update base64 and jsonrpc versions and related checksums in lockfile sections
Enhancement	► Cargo.lock        Bump base64 to 0.22.1 and jsonrpc to 0.20.1 across multiple crates; adjust dependencies references from 0.13.1/0.18.0 to 0.22.1/0.20.1
Enhancement	► Cargo.toml        Update base64 crate version to 0.22; update jsonrpc to 0.20.1
Enhancement	► bazel/rust.MODULE.bazel        Bump crate specs for base64 to ^0.22 and jsonrpc to ^0.20.1; reflect updated versions
Enhancement	► rs/artifact_pool/Cargo.toml        Update serde-bytes-repr to 0.3.0
Enhancement	► rs/bitcoin/checker/src/providers.rs        Use BASE64_STANDARD for encoding in authorization header parsing
Enhancement	► rs/bitcoin/checker/src/providers/tests.rs        Adjust test expectations to BASE64_STANDARD encoding
Enhancement	► rs/crypto/iccsa/src/types/generic_traits.rs        Import base64::prelude::* and use BASE64_STANDARD for formatting
Enhancement	► rs/crypto/internal/crypto_lib/basic_sig/ecdsa_secp256k1/src/types.rs        Use BASE64_STANDARD for Debug formatting of keys/signatures
Enhancement	► rs/crypto/internal/crypto_lib/basic_sig/ecdsa_secp256k1/tests/api_tests.rs        Update test to use BASE64_STANDARD in key parsing
Enhancement	► rs/crypto/internal/crypto_lib/basic_sig/ecdsa_secp256r1/src/types.rs        Use BASE64_STANDARD for Debug formatting
Enhancement	► rs/crypto/internal/crypto_lib/basic_sig/ecdsa_secp256r1/tests/api_tests.rs        Update test to use BASE64_STANDARD_NO_PAD for decoding
Enhancement	► rs/crypto/internal/crypto_lib/basic_sig/ed25519/src/types/generic_traits.rs        Use BASE64_STANDARD for Debug formatting
Enhancement	► rs/crypto/internal/crypto_lib/multi_sig/bls12_381/src/types.rs        Use BASE64_STANDARD for Debug formatting of signatures
Enhancement	► rs/crypto/internal/crypto_lib/multi_sig/bls12_381/src/types/generic_traits.rs        Use BASE64_STANDARD in Debug implementations
Enhancement	► rs/crypto/internal/crypto_lib/threshold_sig/bls12_381/src/ni_dkg/groth20_bls12_381/types.rs        Use BASE64_STANDARD for encoding tau in Debug output
Enhancement	► rs/crypto/internal/crypto_lib/threshold_sig/bls12_381/src/types/generic_traits.rs Use BASE64_STANDARD for encoding in Debug
Enhancement	► rs/crypto/internal/crypto_service_provider/src/types.rs        Use BASE64_STANDARD for RsaSha256 formatting in Debug
Enhancement	► rs/ic_os/config/tool/src/guestos/cloud.rs        Use BASE64_STANDARD for decoding Base64 config data
Enhancement	► rs/ic_os/sev/guest/src/key_deriver.rs        Return BASE64_STANDARD encoded key deriver output
Enhancement	► rs/nervous_system/common/src/ledger_validation.rs        [Unclear from diff]

N/A

[bjoernek]

Non-blocking note from the governance side (no action needed, just so the consequence is on record).

The base64::decode -> BASE64_STANDARD.decode rewrite is not quite semantics-preserving: base64 0.13's decode() did not require padding (see the comment in its decode.rs, "given that we don't require padding"), whereas 0.22's BASE64_STANDARD is built from GeneralPurposeConfig::new(), whose default is DecodePaddingMode::RequireCanonical. So input that lacks canonical = padding used to decode fine and is now rejected. Encoding is unchanged (both pad).

That touches two governance validators:

• SnsMetadata::validate_logo (rs/sns/governance/src/types.rs)
• ledger_validation::validate_token_logo (rs/nervous_system/common/src/ledger_validation.rs)

The logo one sits on an upgrade path: canister_post_upgrade -> canister_init_ -> ValidGovernanceProto::try_from -> sns_metadata.validate() -> validate_logo, and that try_from is wrapped in .expect(...). An SNS with a stored unpadded logo would therefore trap on its next upgrade.

I checked mainnet before approving: of the 54 entries from list_deployed_snses, the 38 that have a Wasm installed all have canonically padded logos (the other 16 are aborted swaps, IC0537 no Wasm module). And since the same tightened validator now also guards the ManageSnsMetadata and CreateServiceNervousSystem submission paths, no unpadded logo can enter going forward either. So this is safe as-is.

If you'd prefer to keep 0.13 semantics exactly at these two call sites, a local engine with .with_decode_padding_mode(DecodePaddingMode::Indifferent) would do it. Fine either way; arguably the stricter check is an improvement.

[claude]

The CI RBE Evaluation / Bazel Test All on RBE check failed at the Download target files step with a 403 Forbidden from GitHub's artifact-download service, before Bazel Build/Test ever ran (both steps were skipped). This is a transient GitHub Actions infra flake, unrelated to this PR's change (padding of 3 base64 test constants).

Update: a second job in the same run, CI Main / Build IC, also failed — but the Bazel build itself succeeded cleanly; it only failed on the post-build actions/upload-artifact step with the same 403 Forbidden: Error from intermediary signature. Same GitHub Actions infra flake, not caused by this diff.

I've queued a re-run of both affected jobs (rerun-failed-jobs, which reruns every failed job in the run). Note: GitHub currently rejects re-running while sibling jobs in the same workflow run are still in progress, so the re-run will fire automatically as soon as the run reaches completed (I'm watching for that and will trigger it then).

---

Generated by Claude Code