Josh Siviour 34aa6d2230 fix: stop passing nbdkit S3 credentials as literal argv (#644) ...

* fix: stop passing nbdkit S3 credentials as literal argv

access_key/secret_key were interpolated into the nbdkit plugin argv,
which is world-readable via /proc/<pid>/cmdline for the life of the
process. Credentials now travel via cmd.Env (VB_ACCESS_KEY/
VB_SECRET_KEY) instead. Requires a viperblock nbdkit plugin build that
reads these environment variables; inert against an older plugin
until that pin moves.

* chore: pin viperblock to the VB_ACCESS_KEY/VB_SECRET_KEY fallback

The spinifex half sets these env vars on the nbdkit child, but the
deploy builds with GOWORK=off, so viperblock's matching read of them
only ships once go.mod points at 8a4787a.

2026-08-02 09:07:39 +10:00

..

nbd_test.go

fix: stop passing nbdkit S3 credentials as literal argv (#644)

2026-08-02 09:07:39 +10:00

nbd.go

fix: stop passing nbdkit S3 credentials as literal argv (#644)

2026-08-02 09:07:39 +10:00