fix(secure_buffer): wipe before resize reallocation

.github/workflows/CI-Linux.yml

@@ -18,18 +18,22 @@ jobs:
     strategy:
       matrix:
         std: [11, 17]
+        mlock: [ON, OFF]
     steps:
       - uses: actions/checkout@v3
       - name: Install dependencies
         run: sudo apt-get update && sudo apt-get install -y cmake
       - name: Configure
-        run: cmake -S . -B build -DHMACCPP_BUILD_TESTS=ON -DCMAKE_CXX_STANDARD=${{ matrix.std }}
+        run: cmake -S . -B build -DHMACCPP_BUILD_TESTS=ON -DHMACCPP_ENABLE_MLOCK=${{ matrix.mlock }} -DCMAKE_CXX_STANDARD=${{ matrix.std }}
       - name: Build
         run: cmake --build build
       - name: Run tests
-        run: ctest --test-dir build --output-on-failure -R "test_all|test_totp"
+        run: ctest --test-dir build --output-on-failure
   vcpkg:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        mlock: [ON, OFF]
     steps:
       - uses: actions/checkout@v3
       - name: Install vcpkg
@@ -38,8 +42,8 @@ jobs:
           ./vcpkg/bootstrap-vcpkg.sh
           ./vcpkg/vcpkg install gtest
       - name: Configure
-        run: cmake -S . -B build -DHMACCPP_BUILD_TESTS=ON -DCMAKE_TOOLCHAIN_FILE=./vcpkg/scripts/buildsystems/vcpkg.cmake
+        run: cmake -S . -B build -DHMACCPP_BUILD_TESTS=ON -DHMACCPP_ENABLE_MLOCK=${{ matrix.mlock }} -DCMAKE_TOOLCHAIN_FILE=./vcpkg/scripts/buildsystems/vcpkg.cmake
       - name: Build
         run: cmake --build build
       - name: Run tests
-        run: ctest --test-dir build --output-on-failure -R "test_all|test_totp"
+        run: ctest --test-dir build --output-on-failure

.github/workflows/CI-Win.yml

@@ -18,6 +18,7 @@ jobs:
     strategy:
       matrix:
         std: [11, 17]
+        mlock: [ON, OFF]
     steps:
       - uses: actions/checkout@v3
       - uses: msys2/setup-msys2@v2
@@ -30,10 +31,10 @@ jobs:
             mingw-w64-x86_64-make
       - name: Configure
         shell: msys2 {0}
-        run: cmake -S . -B build -DHMACCPP_BUILD_TESTS=ON -DCMAKE_CXX_STANDARD=${{ matrix.std }}
+        run: cmake -S . -B build -DHMACCPP_BUILD_TESTS=ON -DHMACCPP_ENABLE_MLOCK=${{ matrix.mlock }} -DCMAKE_CXX_STANDARD=${{ matrix.std }}
       - name: Build
         shell: msys2 {0}
         run: cmake --build build
       - name: Run tests
         shell: msys2 {0}
-        run: ctest --test-dir build --output-on-failure -R "test_all|test_totp"
+        run: ctest --test-dir build --output-on-failure

.github/workflows/CI-macOS.yml

@@ -18,6 +18,7 @@ jobs:
     strategy:
       matrix:
         std: [11, 17]
+        mlock: [ON, OFF]
     steps:
       - uses: actions/checkout@v3
       - name: Install dependencies
@@ -26,14 +27,17 @@ jobs:
           brew uninstall --ignore-dependencies cmake || true
           brew install cmake
       - name: Configure
-        run: cmake -S . -B build -DHMACCPP_BUILD_TESTS=ON -DCMAKE_CXX_STANDARD=${{ matrix.std }}
+        run: cmake -S . -B build -DHMACCPP_BUILD_TESTS=ON -DHMACCPP_ENABLE_MLOCK=${{ matrix.mlock }} -DCMAKE_CXX_STANDARD=${{ matrix.std }}
       - name: Build
         run: cmake --build build
       - name: Run tests
-        run: ctest --test-dir build --output-on-failure -R "test_all|test_totp"
+        run: ctest --test-dir build --output-on-failure
 
   vcpkg:
     runs-on: macos-latest
+    strategy:
+      matrix:
+        mlock: [ON, OFF]
     steps:
       - uses: actions/checkout@v3
       - name: Install vcpkg
@@ -42,8 +46,8 @@ jobs:
           ./vcpkg/bootstrap-vcpkg.sh
           ./vcpkg/vcpkg install gtest
       - name: Configure
-        run: cmake -S . -B build -DHMACCPP_BUILD_TESTS=ON -DCMAKE_TOOLCHAIN_FILE=./vcpkg/scripts/buildsystems/vcpkg.cmake
+        run: cmake -S . -B build -DHMACCPP_BUILD_TESTS=ON -DHMACCPP_ENABLE_MLOCK=${{ matrix.mlock }} -DCMAKE_TOOLCHAIN_FILE=./vcpkg/scripts/buildsystems/vcpkg.cmake
       - name: Build
         run: cmake --build build
       - name: Run tests
-        run: ctest --test-dir build --output-on-failure -R "test_all|test_totp"
+        run: ctest --test-dir build --output-on-failure

CHANGELOG.md

@@ -2,6 +2,33 @@
 
 ## [Unreleased]
 
+## [0.6.0] - Unreleased
+### Security
+- `secure_buffer` now coordinates page locks process-wide at page granularity,
+  preventing one buffer from unlocking a page still used by another buffer.
+- Replacement, copy, assignment, and string-consumption paths wipe old storage
+  before release and lock replacement storage before copying secrets.
+
+### Changed
+- **Breaking ABI change:** `secure_buffer` layout and move-operation exception
+  specification changed. Shared-library consumers must be fully rebuilt; do not
+  use a 0.6.0 DLL/SO as a drop-in replacement for a 0.5.x build.
+- CI now runs the secure-buffer regression target with page locking both enabled
+  and disabled.
+- CMake package compatibility is `ExactVersion` while the project remains
+  pre-1.0; a 0.x minor release may contain breaking changes.
+
+### Page-locking limitations
+- The page-lock registry coordinates calls only within one loaded copy of
+  hmac-cpp. Separate statically linked modules have independent registries.
+- Continuing after POSIX `fork()` without `exec()` is unsupported for page
+  locking because child processes do not inherit memory locks.
+
+### Upgrade
+- Rebuild every consumer against the 0.6.0 headers and library together.
+- The bundled vcpkg port remains at the latest tagged release until `v0.6.0`
+  is published.
+
 ## [0.5.0] - 2025-09-07
 ### Added
 - Lifecycle management APIs and hardened zeroing for `secure_buffer`.

CMakeLists.txt

@@ -1,5 +1,5 @@
 cmake_minimum_required(VERSION 3.5)
-project(hmac_cpp VERSION 0.5.0 LANGUAGES CXX)
+project(hmac_cpp VERSION 0.6.0 LANGUAGES CXX)
 
 option(HMACCPP_BUILD_EXAMPLES "Build the example program" OFF)
 option(HMACCPP_BUILD_TESTS "Build the test suite" OFF)
@@ -33,6 +33,7 @@ set(HMAC_HEADERS
     include/hmac_cpp/sha512.hpp
     include/hmac_cpp/secure_buffer.hpp
     include/hmac_cpp/memlock.hpp
+    include/hmac_cpp/page_lock_registry.hpp
     include/hmac_cpp/secret_string.hpp
     include/hmac_cpp/encoding.hpp
     include/hmac_cpp/version.hpp
@@ -108,7 +109,7 @@ configure_package_config_file(
 write_basic_package_version_file(
     "${CMAKE_CURRENT_BINARY_DIR}/hmac_cppConfigVersion.cmake"
     VERSION ${PROJECT_VERSION}
-    COMPATIBILITY SameMajorVersion
+    COMPATIBILITY ExactVersion
 )
 install(FILES
     "${CMAKE_CURRENT_BINARY_DIR}/hmac_cppConfig.cmake"
@@ -129,16 +130,26 @@ if(HMACCPP_BUILD_TESTS)
         DOWNLOAD_EXTRACT_TIMESTAMP TRUE
     )
     FetchContent_MakeAvailable(googletest)
-    find_package(OpenSSL REQUIRED)
-    add_executable(test_all test_all.cpp)
-    target_link_libraries(test_all PRIVATE hmac_cpp gtest_main OpenSSL::Crypto)
-    target_include_directories(test_all PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/include)
-    add_test(NAME test_all COMMAND test_all)
+
+    add_executable(test_secure_buffer test_secure_buffer.cpp)
+    target_link_libraries(test_secure_buffer PRIVATE hmac_cpp gtest_main)
+    target_include_directories(test_secure_buffer PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/include)
+    add_test(NAME test_secure_buffer COMMAND test_secure_buffer)
 
     add_executable(test_totp test_totp.cpp)
     target_link_libraries(test_totp PRIVATE hmac_cpp gtest_main)
     target_include_directories(test_totp PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/include)
     add_test(NAME test_totp COMMAND test_totp)
+
+    find_package(OpenSSL QUIET)
+    if(OpenSSL_FOUND)
+        add_executable(test_all test_all.cpp)
+        target_link_libraries(test_all PRIVATE hmac_cpp gtest_main OpenSSL::Crypto)
+        target_include_directories(test_all PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/include)
+        add_test(NAME test_all COMMAND test_all)
+    else()
+        message(STATUS "OpenSSL not found; skipping test_all")
+    endif()
 endif()
 
 export(EXPORT hmac_cppTargets

README.md

@@ -35,8 +35,9 @@ CI covers Linux/Windows/macOS. Tested with GCC, Clang, and MSVC; requires C++11.
 ## 📈 Versioning / SemVer policy
 
 * Follows [Semantic Versioning](https://semver.org).
-* MAJOR: breaking changes to headers or exported symbols.
-* MINOR: backward-compatible additions.
+* Before 1.0, a MINOR release may include breaking changes to headers or
+  exported symbols; CMake package discovery therefore requires an exact version.
+* After 1.0, MAJOR denotes breaking changes and MINOR denotes backward-compatible additions.
 * PATCH: bug fixes and internal changes.
 
 Version macros live in `<hmac_cpp/version.hpp>`:
@@ -62,6 +63,17 @@ builds and controls symbol export/import for shared builds.
 `HMACCPP_ENABLE_MLOCK` toggles best-effort page locking via `mlock`/`VirtualLock`.
 Disable it if the platform lacks the necessary privileges.
 
+### Page-locking limitations
+
+`secure_buffer<T, true>` attempts page locking only when `HMACCPP_ENABLE_MLOCK`
+is enabled; it is not page-locked by default. Lock ownership is coordinated only
+inside one loaded copy of hmac-cpp. Statically linking separate copies into
+multiple modules creates separate registries.
+
+On POSIX, continuing in a child process after `fork()` without `exec()` is not
+supported for page locking: the child must immediately `exec()` or avoid using
+the inherited secure buffers.
+
 ### Build
 
 ```bash