security: zero PEM bytearray after loading private keys
Three call sites read PEM key material from disk as immutable bytes; change to bytearray so the sensitive bytes can be wiped after the key object is created:
- keypair.py::load_private_key: bytearray(path.read_bytes()), zero after load - identity.py::_load_private_key_from_path: same pattern - sign.py: bytearray(path.read_bytes()), zero after load_private_key_from_pem
The original bytes from read_bytes() still linger (Python immutable return), but this zeroes the only mutable copy the caller holds.
sha256:5aa8df0b76d5a6c3bec992b68cd9aed8a364b358359fe3d2e47024ded16574ea
sha
sha256:d5805f5bedf50a24e2bd7f0b44ea466e8e805ba5b0ff940f39e177987ba1360f
snapshot
0 comments
To add a comment, use the Muse CLI:
muse hub commit comment sha256:5aa8df0b76d5a6c3bec992b68cd9aed8a364b358359fe3d2e47024ded16574ea --body "your comment"
No comments yet. Be the first to start the discussion.