Struct ZeroizeOnDropSentinel 

pub struct ZeroizeOnDropSentinel(/* private fields */);

Runtime verification that zeroization happened before drop.

ZeroizeOnDropSentinel is a guard type used to verify that .zeroize() was called before a value is dropped. This provides runtime enforcement of zeroization invariants, complementing compile-time checks.

Design

• Wraps a shared boolean flag (Arc<AtomicBool>) representing pristine state
• Initially true (pristine/untouched)
• .zeroize() sets the flag to false (no longer pristine)
• Can be cloned to verify zeroization from tests

Panics

Panics on drop if .zeroize() was not called before drop. This is intentional: forgetting to zeroize sensitive data is a critical bug that must be caught.

Usage

Typically used as a field in structs to verify zeroization:

use redoubt_zero_core::{ZeroizeOnDropSentinel, FastZeroizable};

struct Secret {
    data: Vec<u8>,
    __sentinel: ZeroizeOnDropSentinel,
}

impl Drop for Secret {
    fn drop(&mut self) {
        self.data.fast_zeroize();
        self.__sentinel.fast_zeroize();
    }
}

The __sentinel field tracks whether .zeroize() was called before drop. You’ll need to implement FastZeroizable, ZeroizationProbe, and AssertZeroizeOnDrop manually, or use the RedoubtZero umbrella crate which provides #[derive(RedoubtZero)].

Testing

Clone the sentinel to verify zeroization behavior:

use redoubt_zero_core::ZeroizeOnDropSentinel;
use redoubt_zero_core::FastZeroizable;

let mut sentinel = ZeroizeOnDropSentinel::default();
let sentinel_clone = sentinel.clone();

assert!(!sentinel_clone.is_zeroized());
sentinel.fast_zeroize();
assert!(sentinel_clone.is_zeroized());

Implementations

impl ZeroizeOnDropSentinel

pub fn reset(&mut self)

Resets the sentinel to “not zeroized” (pristine) state.

This is useful in tests when reusing a sentinel for multiple assertions.

Example

use redoubt_zero_core::{ZeroizeOnDropSentinel, FastZeroizable, ZeroizationProbe};

let mut sentinel = ZeroizeOnDropSentinel::default();
sentinel.fast_zeroize();
assert!(sentinel.is_zeroized());

sentinel.reset();
assert!(!sentinel.is_zeroized());

pub fn is_zeroized(&self) -> bool

Checks if zeroization happened (i.e., if .zeroize() was called).

Returns true if the sentinel was zeroized, false if still pristine.

Example

use redoubt_zero_core::{ZeroizeOnDropSentinel, FastZeroizable, ZeroizationProbe};

let mut sentinel = ZeroizeOnDropSentinel::default();
assert!(!sentinel.is_zeroized());

sentinel.fast_zeroize();
assert!(sentinel.is_zeroized());

Trait Implementations

impl Clone for ZeroizeOnDropSentinel

fn clone(&self) -> ZeroizeOnDropSentinel

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ZeroizeOnDropSentinel

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ZeroizeOnDropSentinel

fn default() -> Self

Returns the “default value” for a type.

impl FastZeroizable for ZeroizeOnDropSentinel

fn fast_zeroize(&mut self)

Zeroizes the value in place.

impl PartialEq for ZeroizeOnDropSentinel

fn eq(&self, other: &Self) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl ZeroizeMetadata for ZeroizeOnDropSentinel

const CAN_BE_BULK_ZEROIZED: bool = false

Whether this type can be bulk-zeroized with memset.

impl Eq for ZeroizeOnDropSentinel