Method from_bytes

nodedb-wal/src/crypto.rs:113–128

Create from a 32-byte key with a fresh random epoch. Returns an error if the OS RNG (`getrandom`) is unavailable. Without a fresh epoch we cannot guarantee nonce uniqueness across WAL lifetimes, so panicking would silently risk nonce reuse on RNG failure — better to surface it.

(key: &[u8; 32])

    /// lifetimes, so panicking would silently risk nonce reuse on RNG
    /// failure — better to surface it.
    pub fn from_bytes(key: &[u8; 32]) -> Result<Self> {
        let mut epoch = [0u8; 4];
        getrandom::fill(&mut epoch).map_err(|e| WalError::EncryptionError {
            detail: format!("getrandom failed while generating epoch: {e}"),
        })?;
        // mlock key_bytes so they are not swapped to disk. Best-effort: if the
        // OS refuses (e.g. RLIMIT_MEMLOCK exceeded in a container) we log and
        // continue rather than aborting startup.
        let mut key_bytes = *key;
        secure_mem::mlock_key_bytes(key_bytes.as_mut_ptr(), 32);
        Ok(Self {
            cipher: Aes256Gcm::new(key.into()),
            key_bytes,
            epoch,
        })
    }

    /// Create from a 32-byte key with a **caller-supplied epoch**.
    ///