sneak
90bfbec5cb
check / check (push) Canceled after 0s
`secret encrypt` and `secret decrypt` emptied the file named by `--output` before reading any input, so a failure left it empty, and a file given as both `--input` and `--output` was emptied before it was read. They now write into a temporary file of mode 0600 next to it and rename that over it only on success, using the new `secret.WriteFileAtomicFunc`, which `secret.WriteFileAtomic` now calls. A device or pipe given as `--output`, such as `/dev/null`, is written to directly instead of being replaced by a file. Judgement call: the device and pipe case goes beyond the plan. Judgement call: a symbolic link given as `--output` is replaced, not followed. Model: opus-5-5