pallid moss
Hi! I just came across https://docs.dagger.io/api/arguments#caching and stumbled upon the very first sentence:
When a Secret is included in other operations, the layer cache entries for those operations will be based on the plaintext value of the secret.
I assume (hope) this doesn't mean the actual secret gets stored in the layer cache but just, e.g., some hash thereof?
signal depot
just a hash yup! it's an argon2 hash based on the plaintext value and a hidden salt (which is stored on the engine filesystem, and never exported)
pallid moss
Perfect, thank you! Now I'm relieved 😄
signal depot
yeah! it's definitely not perfect, but it's really the only way to get value based caching for secrets
hidden cape
That seems like too much implementation detail in that docs page, which leads to confusion like the one here
signal depot
That seems like too much implementation detail in that docs page, which leads to...
we added docs for this in https://github.com/dagger/dagger/pull/10343
i think we need some docs on how secrets cache 🤔
