From edc82849361b2665589c9e9eccf1b409ba4e04ee Mon Sep 17 00:00:00 2001
From: UneBaguette <28904802+UneBaguette@users.noreply.github.com>
Date: Mon, 4 May 2026 12:56:18 +0200
Subject: [PATCH] feat: add zeroize feature to wipe blake3 internal key
 material on drop

---
 Cargo.lock | 10 ++++++++++
 Cargo.toml |  1 +
 Makefile   |  2 +-
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/Cargo.lock b/Cargo.lock
index 83d0da1..f883e67 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -19,6 +19,9 @@ name = "arrayvec"
 version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
+dependencies = [
+ "zeroize",
+]
 
 [[package]]
 name = "async-trait"
@@ -49,6 +52,7 @@ dependencies = [
  "cfg-if",
  "constant_time_eq",
  "cpufeatures",
+ "zeroize",
 ]
 
 [[package]]
@@ -482,6 +486,12 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+
 [[package]]
 name = "zmij"
 version = "1.0.21"
diff --git a/Cargo.toml b/Cargo.toml
index 2de3493..8c0e36c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -17,6 +17,7 @@ crate-type = ["cdylib", "rlib"]
 default = []
 wasm = ["dep:wasm-bindgen"]
 talc = ["dep:talc"]
+zeroize = ["blake3/zeroize"]
 
 [dependencies]
 blake3 = { version = "1", features = ["wasm32_simd"] }
diff --git a/Makefile b/Makefile
index 0b741b0..95c0d0f 100644
--- a/Makefile
+++ b/Makefile
@@ -20,7 +20,7 @@ build: build-all node-esm
 
 build-all:
 	@echo "Building all target..."
-	RUSTFLAGS='-C opt-level=3 -C target-feature=+simd128' $(CARGO) build --target $(WASM_TARGET) --release --features wasm,talc
+	RUSTFLAGS='-C opt-level=3 -C target-feature=+simd128' $(CARGO) build --target $(WASM_TARGET) --release --features wasm,talc,zeroize
 	@mkdir -p $(ROOT)/bundler $(ROOT)/web $(ROOT)/node
 	$(WASM_BINDGEN) --target bundler --out-dir $(ROOT)/bundler $(TARGET_DIR)/$(CRATE).wasm
 	$(WASM_BINDGEN) --target web --out-dir $(ROOT)/web $(TARGET_DIR)/$(CRATE).wasm