fix(s3): treat SSE-C encryption_key as a secret (CVE-2026-28377)

[mattdurham]

Summary

• S3 SSE-C encryption_key (CustomerEncryptionKey) was stored and registered as a plain string, risking exposure in logs, config dumps, and API responses
• Changed the field type to flagext.Secret to match how secret_key and session_token are already handled
• Affects Tempo v2.10.0 through v2.10.2 (SSE-C was introduced in v2.10.0)

Test plan

• go test -race ./tempodb/backend/s3/... passes
• Full unit test suite passes (integration tests require Docker)

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR addresses CVE-2026-28377 by preventing S3 SSE-C (CustomerEncryptionKey / encryption_key) from being handled as a plain string in configuration, reducing the risk of accidental exposure via config dumps and similar outputs.

Changes:

• Change S3 SSE-C CustomerEncryptionKey from string to flagext.Secret and register it as a secret flag value.
• Update SSE-C config building to read the secret value via CustomerEncryptionKey.String().
• Add a CHANGELOG entry describing the fix and referencing the CVE.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
tempodb/backend/s3/config.go	Converts SSE-C encryption_key to flagext.Secret and updates flag registration to treat it as secret-like config.
tempodb/backend/s3/s3.go	Uses the secret wrapper value when validating/constructing MinIO SSE-C encryption config.
CHANGELOG.md	Documents the security fix in the unreleased changelog section.

[Copilot]

Pull request overview

This PR hardens Tempo’s S3 backend configuration by treating the SSE-C encryption_key as a secret, reducing the risk of exposing customer-provided encryption keys via config marshaling/dumps and similar outputs.

Changes:

• Change SSEConfig.CustomerEncryptionKey from string to flagext.Secret and register it as a secret flag value.
• Update SSE-C config building to read the key via flagext.Secret.String().
• Add a unit test asserting the key is redacted when YAML-marshaled, and add a changelog entry referencing the CVE.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
tempodb/backend/s3/s3.go	Reads SSE-C encryption key from flagext.Secret when building MinIO SSE config
tempodb/backend/s3/config.go	Changes SSE-C encryption_key type to flagext.Secret and updates flag registration
tempodb/backend/s3/compactor_test.go	Adds test verifying YAML redaction of encryption_key
CHANGELOG.md	Documents the security-related bugfix and CVE reference

[Copilot]

Pull request overview

This PR mitigates accidental exposure of the S3 SSE-C customer-provided encryption key by treating encryption_key as a secret type (consistent with other S3 credentials handling in Tempo).

Changes:

• Change SSEConfig.CustomerEncryptionKey from string to flagext.Secret and update flag registration accordingly.
• Update SSE-C config construction to use the secret value via .String().
• Add a unit test ensuring YAML marshaling redacts the encryption key and document the fix in the changelog.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
tempodb/backend/s3/s3.go	Uses the secret-backed encryption key when building the MinIO SSE-C config.
tempodb/backend/s3/config.go	Switches SSE-C encryption_key to flagext.Secret and registers it via flag.Var.
tempodb/backend/s3/config_test.go	Adds a YAML redaction test for the SSE-C encryption key.
CHANGELOG.md	Adds a CVE-related bugfix entry for the secret-handling change.

[javiermolinar]

LGTM