Function from_environment 

pub fn from_environment(
    values: &[(String, String)],
    files: &[SecretFile],
) -> String

A VM’s Secrets step when the tool that runs it hands the values over itself (Vagrant’s provisioner environment, filled from the host’s when Vagrant runs): each of values, a secret’s name and the variable holding its value in base64 (so a $, a quote or a line break in it is never read by the shell that sets the variable), kept as delivery keeps it and the delivery marked; then the files put in place now and at every boot. Nothing waits: the values are there. An empty or unset variable writes an empty value the first time, and keeps the value already kept after (a re-provision given no value again).