Versions in this module Expand all Collapse all v0 v0.2.0 Jul 20, 2026 Changes in this version + var ErrReadOnly = errors.New("secmem: secure buffer is read-only — call ReadWrite before mutating") v0.1.0 Jul 17, 2026 Changes in this version + var ErrArenaDestroyed = errors.New("secmem: secure arena has been destroyed") + var ErrArenaFull = errors.New("secmem: secure arena is full — no free slots") + var ErrCanaryViolation = errors.New(...) + var ErrDestroyed = errors.New("secmem: secure buffer has been destroyed") + var ErrNoSecureMemory = errors.New(...) + var ErrRuntimeSecretInactive = errors.New(...) + var ErrSealed = errors.New("secmem: secure buffer is sealed") + var ErrSlotReleased = errors.New("secmem: arena slot has been released") + func AssertRuntimeSecret() error + func DisableCoreDumps() error + func EnsureMemlockLimit(bytes uint64) (achieved uint64, err error) + func HasCLFLUSHOPT() bool + func InstallTerminationWipe(signals ...os.Signal) (uninstall func()) + func RuntimeSecretActive() bool + func RuntimeSecretEnforced() bool + func Scope(size int, fn func(*SecureBuffer) error) (retErr error) + func ScopeWith(ctor func() (*SecureBuffer, error), fn func(*SecureBuffer) error) (retErr error) + func Scrub(fn func()) + func ScrubErr(fn func() error) (err error) + func SecureWipe(b []byte) + func WipeAllSecrets() error + type ArenaSlot struct + func (s *ArenaSlot) Index() int + func (s *ArenaSlot) IsLive() bool + func (s *ArenaSlot) Release() error + func (s *ArenaSlot) WithBytes(fn func([]byte)) error + func (s *ArenaSlot) WithBytesErr(fn func([]byte) error) error + func (s ArenaSlot) Format(f fmt.State, _ rune) + func (s ArenaSlot) GoString() string + func (s ArenaSlot) LogValue() slog.Value + func (s ArenaSlot) String() string + type Capabilities struct + FlushedWipe bool + GOARCH string + GOOS string + GuardPages bool + Insecure bool + MemfdSecret bool + Mlocked bool + NoDump bool + NoFork bool + OffHeap bool + RegisterScrub bool + func Probe() Capabilities + func (c Capabilities) String() string + func (c Capabilities) Warnings() []string + type HardenLevel int + const HardenNoDump + const HardenNoDynamicCode + const HardenNoNewPriv + const HardenNone + const HardenSeccomp + const HardenStrictHandles + func HardenProcess(_ context.Context) (HardenLevel, error) + type Option func(*config) + func WithInsecureFallback() Option + type Secret struct + func NewSecret(b []byte, opts ...Option) (Secret, error) + func (s Secret) ConstantTimeEqual(other Secret) bool + func (s Secret) Destroy() error + func (s Secret) GoString() string + func (s Secret) LogValue() slog.Value + func (s Secret) MarshalJSON() ([]byte, error) + func (s Secret) MarshalText() ([]byte, error) + func (s Secret) String() string + func (s Secret) WithBytes(fn func([]byte)) error + func (s Secret) WriteTo(w io.Writer) (int64, error) + type SecureArena struct + func NewArena(slotSize, count int, opts ...Option) (*SecureArena, error) + func (SecureArena) Format(f fmt.State, _ rune) + func (SecureArena) GoString() string + func (SecureArena) LogValue() slog.Value + func (SecureArena) String() string + func (a *SecureArena) Acquire() (*ArenaSlot, error) + func (a *SecureArena) Cap() int + func (a *SecureArena) Capabilities() Capabilities + func (a *SecureArena) Destroy() error + func (a *SecureArena) IsDestroyed() bool + func (a *SecureArena) LiveCount() int + func (a *SecureArena) ReadOnly() error + func (a *SecureArena) ReadWrite() error + func (a *SecureArena) SlotSize() int + type SecureBuffer struct + func NewBuffer(raw []byte, opts ...Option) (*SecureBuffer, error) + func NewBufferFromReader(r io.Reader, size int, opts ...Option) (*SecureBuffer, int64, error) + func NewEmptyBuffer(size int, opts ...Option) (*SecureBuffer, error) + func NewSyscallSafeBuffer(raw []byte, opts ...Option) (*SecureBuffer, error) + func (s *SecureBuffer) ByteAt(i int) (byte, error) + func (s *SecureBuffer) Capabilities() Capabilities + func (s *SecureBuffer) ConstantTimeEqual(other []byte) (bool, error) + func (s *SecureBuffer) CopyIn(src []byte, dstOffset int) (int, error) + func (s *SecureBuffer) CopyOut(dst []byte, srcOffset int) (int, error) + func (s *SecureBuffer) Destroy() error + func (s *SecureBuffer) ExposeString() (string, error) + func (s *SecureBuffer) IsDestroyed() bool + func (s *SecureBuffer) IsSealed() bool + func (s *SecureBuffer) Len() int + func (s *SecureBuffer) MappedLen() int + func (s *SecureBuffer) ReadFrom(r io.Reader) (int64, error) + func (s *SecureBuffer) ReadOnly() error + func (s *SecureBuffer) ReadWrite() error + func (s *SecureBuffer) Seal() error + func (s *SecureBuffer) SetByteAt(i int, v byte) error + func (s *SecureBuffer) Truncate(n int) error + func (s *SecureBuffer) Unseal() error + func (s *SecureBuffer) WithBytes(fn func([]byte)) error + func (s *SecureBuffer) WithBytesErr(fn func([]byte) error) error + func (s *SecureBuffer) WriteTo(w io.Writer) (int64, error) + func (s SecureBuffer) Format(f fmt.State, _ rune) + func (s SecureBuffer) GoString() string + func (s SecureBuffer) LogValue() slog.Value + func (s SecureBuffer) String() string
Go to main page