Skip to content

Commit 88d1bb2

Browse files
committed
docs and version
1 parent 40c5dbc commit 88d1bb2

File tree

3 files changed

+10
-6
lines changed

3 files changed

+10
-6
lines changed

Cargo.lock

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Cargo.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "zeroize"
3-
version = "0.4.19"
3+
version = "0.4.20"
44
edition = "2021"
55

66
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

README.md

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,15 @@
55

66
Securely clear secrets from memory. Built on stable Rust primitives which guarantee memory is zeroed using an operation will not be 'optimized away' by the compiler.
77

8-
It uses [zeroize](https://crates.io/crates/zeroize) crate under the hood to zeroize and [libsodium-sys](https://crates.io/crates/libsodium-sys) for `mlock()` and `munlock()`. **Maximum you can mlock is 4MB**.
8+
It uses [zeroize](https://crates.io/crates/zeroize) crate under the hood to zeroize and [memsec](https://crates.io/crates/memsec) for `mlock()` and `munlock()`. **Maximum you can mlock is 4MB**.
99
It can work with `bytearray` and `numpy array`.
1010

1111
> [!WARNING]
1212
> **In the case of [Copy-on-write fork](https://en.wikipedia.org/wiki/Copy-on-write) you need to zeroize the memory before forking the child process, see example below.
1313
> Also by itself it doesn't work if memory is moved or moved to swap. You can use `zeroize.mlock()` to lock the memory, see example below.**
1414
1515
# Caveats of `mlock()`
16+
1617
`mlock` works on pages, so 2 variables could reside in the same page and if you `munlock` one it will `munlock` the whole page and also the memory for the other variable. Ideally you could `munlock` all your vars at same time so it would not be affected by the overlap. One strategy could be to expire your vars that store credentials when not used and to reload them again when needed. Like that you could `mlock` when you load them and `munlock` on expire and keep all vars under the same expire policy. Like this all var will be `munlock`ed at the same time.
1718

1819
# Examples
@@ -65,9 +66,8 @@ if __name__ == "__main__":
6566
## Zeroing memory before forking child process
6667

6768
This mitigates the problems that appears on [Copy-on-write fork](https://en.wikipedia.org/wiki/Copy-on-write). You need to zeroize the data before forking the child process.
68-
```python
69-
""" In the case of [Copy-on-write fork](https://en.wikipedia.org/wiki/Copy-on-write) you need to zeroize the memory before forking the child process. """
7069

70+
```python
7171
import os
7272
from zeroize import zeroize1, mlock, munlock
7373

@@ -109,6 +109,7 @@ if __name__ == "__main__":
109109
[![Open in Codespaces](https://github.com/codespaces/badge.svg)](https://github.com/codespaces/new/?repo=radumarias%2Fzeroize-python&ref=main)
110110

111111
## Geting sources from GitHub
112+
112113
Skip this if you're starting it in browser.
113114

114115
```bash
@@ -120,13 +121,16 @@ git clone https://github.com/radumarias/zeroize-python && cd zeroize-python
120121
```bash
121122
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
122123
```
124+
123125
To configure your current shell, you need to source
124126
the corresponding env file under $HOME/.cargo.
125127
This is usually done by running one of the following (note the leading DOT):
128+
126129
```bash
127130
. "$HOME/.cargo/env"
128131
```
129-
```
132+
133+
```bash
130134
python -m venv .env
131135
source .env/bin/activate
132136
pip install -r requirements.txt

0 commit comments

Comments
 (0)