C ABI for HIDE. Every language binding calls this; none reimplements the cryptography, so there is exactly one implementation to review.
Rules this boundary keeps:
- Nothing crossing the boundary is trusted: every pointer is checked for null and every length is validated before use.
- Secret keys never leave Rust. Callers hold an opaque handle; there is no function that exports key material.
- Buffers allocated here are freed here (
hide_buffer_free), because a caller freeing Rust memory with libcfreeis undefined behaviour. - No function unwinds across the boundary. A panic in Rust crossing into C is undefined behaviour, so every entry point catches it.