Expand description
The one place the file, command-line arguments and the environment are resolved against each other.
Command-line arguments win, then the file, then the environment.
Arguments are the leakiest tier — world-readable in /proc/<pid>/cmdline
— so this order is a concession to how a developer actually runs the
binary, not an endorsement: a secret’s own value should never be an
argument in a real deployment, only a path, and this
function resolving arguments highest does not change that — see the
crate root’s doc.
Every caller in this workspace is expected to route its own three-way merges through this function rather than reimplementing the order field by field, so the order is one fact instead of one per setting.
Functions§
- precedence
- Resolves one setting across the three tiers, first
Somewins.