pub fn write_secret_file(path: &Path, content: &str) -> Result<()>Expand description
Write a secret to disk so that it is never, even briefly, readable by anyone but its owner.
Opening the destination directly is not enough: mode applies only when
the file is created, so rewriting a pre-existing 0644 file would hold the
new secret at 0644 for the whole write. Instead the content goes to a
fresh 0600 temporary file in the same directory and is renamed over the
destination — which also makes the replacement atomic, so a crash or a
full disk leaves the previous contents rather than a truncated file.