Data.Digest.Sha2: Cleanse hash buffers after use

Implement a wrapper for `OPENSSL_cleanse` and use it to securely erase
hash buffers. This matches the behavior of BoringSSL’s all-in-one hash
functions (`SHA256`, `SHA512`, etc.) and memory allocation subsystem.

1 files changed, 3 insertions, 1 deletions

diff --git a/btls.cabal b/btls.cabal
index a9dea29..fc91ad1 100644
--- a/btls.cabal
+++ b/btls.cabal
@@ -34,11 +34,13 @@ library
                        -optl-Wl,-z,relro -optl-Wl,-z,now -optl-Wl,-s
   exposed-modules:     Data.Digest
                      , Data.Digest.Sha2
-  other-modules:       Data.Digest.Internal
+  other-modules:       Cleanse
+                     , Data.Digest.Internal
   -- Use special names for the BoringSSL libraries to avoid accidentally pulling
   -- in OpenSSL.
   extra-libraries:     btls_crypto
   build-depends:       base >=4.9 && <4.10
+                     , base-compat >=0.9.3 && <0.10
                      , bytestring >=0.10 && <0.11
 
 test-suite tests