feat(dgram): wrap experimental runtime secret calls

commit: f2ef998a1f2d4cb8ae089956eebbfb0e42f3465f
author: brice · 3mo ago · 2026-07-23 20:18 UTC
parent: c310fcf
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

3 files · +52 -0

A pkg/dgram/secret_disabled.go +11 -0

@@ -0,0 +1,11 @@
	1	+	//go:build !goexperiment.runtimesecret \|\| !linux \|\| (!amd64 && !arm64)
	2	+
	3	+	package dgram
	4	+
	5	+	// SecretDo runs f synchronously. Without Go 1.26's experimental runtime secret
	6	+	// support on linux/amd64 or linux/arm64, it invokes f directly. Runtime secret
	7	+	// protection, when available, does not extend to global variables or goroutines
	8	+	// started by f.
	9	+	func SecretDo(f func()) {
	10	+	f()
	11	+	}

@@ -0,0 +1,11 @@
	1	+	//go:build !goexperiment.runtimesecret \|\| !linux \|\| (!amd64 && !arm64)
	2	+
	3	+	package dgram
	4	+
	5	+	// SecretDo runs f synchronously. Without Go 1.26's experimental runtime secret
	6	+	// support on linux/amd64 or linux/arm64, it invokes f directly. Runtime secret
	7	+	// protection, when available, does not extend to global variables or goroutines
	8	+	// started by f.
	9	+	func SecretDo(f func()) {
	10	+	f()
	11	+	}

A pkg/dgram/secret_enabled.go +13 -0

@@ -0,0 +1,13 @@
	1	+	//go:build goexperiment.runtimesecret && linux && (amd64 \|\| arm64)
	2	+
	3	+	package dgram
	4	+
	5	+	import "runtime/secret"
	6	+
	7	+	// SecretDo runs f synchronously. On supported platforms with Go 1.26's
	8	+	// experimental runtime secret support enabled, it protects temporary storage
	9	+	// used by f's full call tree. Protection does not extend to global variables or
	10	+	// goroutines started by f.
	11	+	func SecretDo(f func()) {
	12	+	secret.Do(f)
	13	+	}

@@ -0,0 +1,13 @@
	1	+	//go:build goexperiment.runtimesecret && linux && (amd64 \|\| arm64)
	2	+
	3	+	package dgram
	4	+
	5	+	import "runtime/secret"
	6	+
	7	+	// SecretDo runs f synchronously. On supported platforms with Go 1.26's
	8	+	// experimental runtime secret support enabled, it protects temporary storage
	9	+	// used by f's full call tree. Protection does not extend to global variables or
	10	+	// goroutines started by f.
	11	+	func SecretDo(f func()) {
	12	+	secret.Do(f)
	13	+	}

A pkg/dgram/secret_test.go +28 -0

@@ -0,0 +1,28 @@
	1	+	package dgram
	2	+
	3	+	import "testing"
	4	+
	5	+	func TestSecretDoRunsSynchronously(t *testing.T) {
	6	+	called := false
	7	+
	8	+	SecretDo(func() {
	9	+	called = true
	10	+	})
	11	+
	12	+	if !called {
	13	+	t.Fatal("SecretDo returned before callback ran")
	14	+	}
	15	+	}
	16	+
	17	+	func TestSecretDoPropagatesPanic(t *testing.T) {
	18	+	want := &struct{ message string }{message: "secret callback panic"}
	19	+	defer func() {
	20	+	if got := recover(); got != want {
	21	+	t.Fatalf("recover() = %#v, want %#v", got, want)
	22	+	}
	23	+	}()
	24	+
	25	+	SecretDo(func() {
	26	+	panic(want)
	27	+	})
	28	+	}

@@ -0,0 +1,28 @@
	1	+	package dgram
	2	+
	3	+	import "testing"
	4	+
	5	+	func TestSecretDoRunsSynchronously(t *testing.T) {
	6	+	called := false
	7	+
	8	+	SecretDo(func() {
	9	+	called = true
	10	+	})
	11	+
	12	+	if !called {
	13	+	t.Fatal("SecretDo returned before callback ran")
	14	+	}
	15	+	}
	16	+
	17	+	func TestSecretDoPropagatesPanic(t *testing.T) {
	18	+	want := &struct{ message string }{message: "secret callback panic"}
	19	+	defer func() {
	20	+	if got := recover(); got != want {
	21	+	t.Fatalf("recover() = %#v, want %#v", got, want)
	22	+	}
	23	+	}()
	24	+
	25	+	SecretDo(func() {
	26	+	panic(want)
	27	+	})
	28	+	}