WIP: refactor to use memguard for secure memory handling

- Add memguard dependency
- Update ReadPassphrase to return LockedBuffer
- Update EncryptWithPassphrase/DecryptWithPassphrase to accept LockedBuffer
- Remove string wrapper functions
- Update all callers to create LockedBuffers at entry points
- Update interfaces and mock implementations

internal/cli/init.go

@@ -11,6 +11,7 @@ import (
 	"git.eeqj.de/sneak/secret/internal/secret"
 	"git.eeqj.de/sneak/secret/internal/vault"
 	"git.eeqj.de/sneak/secret/pkg/agehd"
+	"github.com/awnumar/memguard"
 	"github.com/spf13/afero"
 	"github.com/spf13/cobra"
 	"github.com/tyler-smith/go-bip39"
@@ -125,24 +126,25 @@ func (cli *Instance) Init(cmd *cobra.Command) error {
 	vlt.Unlock(ltIdentity)
 
 	// Prompt for passphrase for unlocker
-	var passphraseStr string
+	var passphraseBuffer *memguard.LockedBuffer
 	if envPassphrase := os.Getenv(secret.EnvUnlockPassphrase); envPassphrase != "" {
 		secret.Debug("Using unlock passphrase from environment variable")
-		passphraseStr = envPassphrase
+		passphraseBuffer = memguard.NewBufferFromBytes([]byte(envPassphrase))
 	} else {
 		secret.Debug("Prompting user for unlock passphrase")
 		// Use secure passphrase input with confirmation
-		passphraseStr, err = readSecurePassphrase("Enter passphrase for unlocker: ")
+		passphraseBuffer, err = readSecurePassphrase("Enter passphrase for unlocker: ")
 		if err != nil {
 			secret.Debug("Failed to read unlock passphrase", "error", err)
 
 			return fmt.Errorf("failed to read passphrase: %w", err)
 		}
 	}
+	defer passphraseBuffer.Destroy()
 
 	// Create passphrase-protected unlocker
 	secret.Debug("Creating passphrase-protected unlocker")
-	passphraseUnlocker, err := vlt.CreatePassphraseUnlocker(passphraseStr)
+	passphraseUnlocker, err := vlt.CreatePassphraseUnlocker(passphraseBuffer)
 	if err != nil {
 		secret.Debug("Failed to create unlocker", "error", err)
 
@@ -190,23 +192,27 @@ func (cli *Instance) Init(cmd *cobra.Command) error {
 
 // readSecurePassphrase reads a passphrase securely from the terminal without echoing
 // This version adds confirmation (read twice) for creating new unlockers
-func readSecurePassphrase(prompt string) (string, error) {
+// Returns a LockedBuffer containing the passphrase
+func readSecurePassphrase(prompt string) (*memguard.LockedBuffer, error) {
 	// Get the first passphrase
-	passphrase1, err := secret.ReadPassphrase(prompt)
+	passphraseBuffer1, err := secret.ReadPassphrase(prompt)
 	if err != nil {
-		return "", err
+		return nil, err
 	}
+	defer passphraseBuffer1.Destroy()
 
 	// Read confirmation passphrase
-	passphrase2, err := secret.ReadPassphrase("Confirm passphrase: ")
+	passphraseBuffer2, err := secret.ReadPassphrase("Confirm passphrase: ")
 	if err != nil {
-		return "", fmt.Errorf("failed to read passphrase confirmation: %w", err)
+		return nil, fmt.Errorf("failed to read passphrase confirmation: %w", err)
 	}
+	defer passphraseBuffer2.Destroy()
 
 	// Compare passphrases
-	if passphrase1 != passphrase2 {
-		return "", fmt.Errorf("passphrases do not match")
+	if passphraseBuffer1.String() != passphraseBuffer2.String() {
+		return nil, fmt.Errorf("passphrases do not match")
 	}
 
-	return passphrase1, nil
+	// Create a new buffer with the confirmed passphrase
+	return memguard.NewBufferFromBytes(passphraseBuffer1.Bytes()), nil
 }