fetchFromFile (credentials/file.go)

Securely reads an absolute secret file, validating permissions and size.

// Source: https://github.com/dedene/claw-wrap | License: MIT | Copyright 2026 Peter Dedene
// Provided via justclaw.it.com; keep this notice with the code.
package credentials

import (
	"fmt"
	"io"
	"os"
	"path/filepath"
	"strings"
	"syscall"
)

// maxSecretFileSize bounds how much of a file: credential is read.
const maxSecretFileSize = 64 * 1024

// fetchFromFile reads a mounted secret file (Docker/Kubernetes secret
// convention). Symlinks are followed because Kubernetes secret volumes are
// built from ..data symlinks. Trust comes from the file itself: it must be a
// regular file owned by root or the daemon user, and not group-writable or
// accessible by others. Trailing newlines are trimmed.
func fetchFromFile(path string) (string, error) {
	if !filepath.IsAbs(path) {
		return "",

... (truncated -- full source via MCP)