azure_core/azure_identity: introduce SecretBytes for ClientCertificateCredential

[Copilot]

ClientCertificateCredential::new() previously required callers to base64-encode their certificate bytes and pass them as a Secret, only for the credential to immediately decode them. This replaces that with a purpose-built SecretBytes type that accepts raw bytes directly.

New SecretBytes type (in azure_core::credentials):

• Wraps Vec<u8>; Debug and Display emit "SecretBytes" — no data leakage
• PartialEq/Eq use constant-time comparison (same approach as Secret)
• From<azure_core::Bytes>, From<&[u8]>, From<Vec<u8>>
• Public bytes() accessor returns &[u8]

ClientCertificateCredential::new() — certificate parameter changed from Secret to SecretBytes; the base64 decode step is removed.

Migration

Before:

let cert_bytes = std::fs::read("cert.pfx")?;
ClientCertificateCredential::new(tenant, client, Secret::new(base64::encode(cert_bytes)), None)?;

After:

let cert_bytes = std::fs::read("cert.pfx")?;
ClientCertificateCredential::new(tenant, client, SecretBytes::from(cert_bytes.as_slice()), None)?;

Breaking Change: ClientCertificateCredential::new() — certificate is now SecretBytes instead of Secret. See CHANGELOG.md.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>ClientCertificateCredential should take bytes instead of base64-encoded string for certificate</issue_title>
<issue_description>Current, the ClientCertificateCredential in azure_identity requires that the caller base64-encode the certificate bytes and pass them as a azure_core::credentialsSecret. We just turn around and base64-decode those. Not only is this wasteful, but taking what is otherwise a String doesn't make it plain what the dev should pass anyway.

Instead, define a SecretBytes struct that implements Display and Debug exactly as azure_core::credentials::Secret does so that no data is printed. Define it in a new module in azure_identity but import that module privately and re-export the SecretBytes publicly from the root of the crate. Update ClientCertificateCredential::new to take a SecretBytes instead of Secret and update all examples that show base64-encoding a file or some other bytes to just wrap those bytes in a SecretBytes instead.

SecretBytes should also implement PartialEq in constant time similar to Secret, and should implement From<Bytes> (specifically, azure_core::Bytes) as well as From<&[u8]>. Add tests appropriately.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes ClientCertificateCredential should take bytes instead of base64-encoded string for certificate #3806

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

This PR improves azure_identity’s certificate credential ergonomics by letting callers pass raw PKCS#12 bytes directly, avoiding the previous base64 encode/decode roundtrip and making the API intent clearer.

Changes:

• Added a new public SecretBytes type for securely holding secret byte buffers (no leakage via Debug/Display, constant-time Eq).
• Updated ClientCertificateCredential::new() to accept SecretBytes and removed the base64 decode step.
• Updated azure_identity’s changelog to document the new type and the breaking constructor signature change.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
sdk/identity/azure_identity/src/secret_bytes.rs	Introduces SecretBytes with safe formatting, constant-time equality, conversions, and unit tests.
sdk/identity/azure_identity/src/lib.rs	Adds the module and re-exports SecretBytes from the crate root.
sdk/identity/azure_identity/src/client_certificate_credential.rs	Switches ClientCertificateCredential::new() from Secret (base64 string) to SecretBytes (raw bytes) and updates tests accordingly.
sdk/identity/azure_identity/CHANGELOG.md	Documents the new SecretBytes and the breaking API change in the unreleased section.

[heaths]

Rename the function and make sure tests pass - specifically, spell check and mitigation issues appropriately.

[Copilot]

Rename the function and make sure tests pass - specifically, spell check and mitigation issues appropriately.

Renamed secret() to bytes() and ran cargo fmt in 70321e7. All 79 tests pass and clippy is clean.

[heaths]

@copilot commit/pull request instructions make clear to summarize the changes in the PR description - not retain your task list. Do that, and please suggest improvements to make sure you always do that because you most often don't after feedback for changes is provided.

[heaths]

@copilot summarize the changes in the PR description. Do not retain your task list.

[Copilot]

@copilot summarize the changes in the PR description. Do not retain your task list.

Updated the PR description to a prose summary. I've also stored a memory to always replace task checklists with a summary before finalizing future PRs.

[heaths]

@copilot move SecretBytes into the azure_core crate next to Secret and make sure its exported similarly. Update azure_core's and azure_identity's CHANGELOGS accordingly. The tests should also be moved.

For context, @chlowell and I talked about this offline. I initially wrestled with this myself and ended up echoing @JeffreyRichter in these matters about how we can almost move things up the dependency stack; however, leaving behind something somewhat intrinsic and is likely to be needed elsehwere in the root of azure_identity does feel a little dirty.

[Copilot]

@copilot move SecretBytes into the azure_core crate next to Secret and make sure its exported similarly. Update azure_core's and azure_identity's CHANGELOGS accordingly. Th...

Done in 31374f3. SecretBytes is now defined in azure_core::credentials alongside Secret, with the tests moved there too. azure_identity re-exports it via pub use azure_core::credentials::SecretBytes. Both changelogs updated accordingly.

[github-actions]

Hi @copilot. We've noticed that new changes have been pushed to this pull request. Because it is set to automatically merge, we've reset the approvals to allow the opportunity to review the updates.

Hi @heaths. We've noticed that new changes have been pushed to this pull request. Because it is set to automatically merge, we've reset the approvals to allow the opportunity to review the updates.

[github-actions]

Hi @copilot. We've noticed that new changes have been pushed to this pull request. Because it is set to automatically merge, we've reset the approvals to allow the opportunity to review the updates.

Hi @heaths. We've noticed that new changes have been pushed to this pull request. Because it is set to automatically merge, we've reset the approvals to allow the opportunity to review the updates.

[heaths]

/check-enforcer evaluate