Interface
How a program is handed the secrets it may use, never through its environment.
Secrets a program is handed
Link starts none of its programs with a secret in its environment
(Credentials). A plugin, an adapter or a
tool is handed the secrets the program that started it holds (those
you set for lnk, a connection's token, a model's key) on a pipe instead:
LNK_SECRETS_FD names the descriptor, 60, and it holds each as its
variable's name and its value, each ended by a zero byte, up to 16 KiB.
Reading it
Read it once, first, and close it: link_plugin::Secret::from_env
does, when its program calls link_plugin::secret::process::guard at
the start of main. A program written without link_plugin reads the
same; a shell script, from /dev/fd/60. Every child a program built on
link_plugin starts closes the pipe, so it reaches that program alone,
and more than a pipe holds unread fails the start rather than holding
it up.