# Fix Cross-Platform Windows Secret Mount Path Validation and Hash Stability

[aayuxsh326]

Fix Cross-Platform Windows Secret Mount Path Validation and Hash Stability

Background & Problem

In src/flyte/_secret.py:

1. Windows Mount Path Check: The validation logic if str(self.mount) != "/etc/flyte/secrets" fails on Windows because pathlib.Path("/etc/flyte/secrets") formats as \etc\flyte\secrets under str(). This causes any valid Secret with a mount path to raise ValueError: Only /etc/flyte/secrets is supported as secret mount path today. on Windows systems, breaking test_secret_mount_valid().
2. Stable Hash Consistency: Secret.stable_hash() uses str(self.mount), which causes the same secret definition to yield different SHA-256 hashes on Windows vs. Linux/macOS.
3. Broken __main__ Example: Line 94 uses mount=pathlib.Path("/path/to/secret") which immediately crashes if the script is run directly.

User Review Required

Note

No breaking changes to existing APIs or interfaces. Secret.mount continues to accept pathlib.Path | None, and we also permit str | pathlib.Path | None normalized to pathlib.Path or standard POSIX representation.

Proposed Changes

Core Library

[MODIFY] src/flyte/_secret.py

• In Secret.__post_init__, convert self.mount if it's a string to pathlib.Path, and check self.mount.as_posix() != "/etc/flyte/secrets".
• In Secret.stable_hash, use self.mount.as_posix() instead of str(self.mount) so the hash is deterministic across all operating systems.
• In if __name__ == "__main__":, update the example to use /etc/flyte/secrets.

Test Suite

[MODIFY] tests/user_api/test_secret.py

• Verify Secret(key="my-secret", mount=pathlib.Path("/etc/flyte/secrets")) passes across platforms.
• Verify Secret(key="my-secret", mount="/etc/flyte/secrets") (string mount) works cleanly.
• Verify stable_hash() produces the exact same hash regardless of whether Path or PurePosixPath is provided on any OS.

Verification Plan

Automated Tests

• Run validation scripts using Python directly against src/flyte/_secret.py to confirm the fix works on Windows.
• Verify that hash determinism tests pass.

[runllm]

Your proposed changes directly address the cross-platform issues with secret mount path validation and hash stability in src/flyte/_secret.py. The current implementation only supports the POSIX path /etc/flyte/secrets and uses str(self.mount) for both validation and hashing, which is not cross-platform safe, as confirmed by the code and tests in the Flyte SDK (source, test source). Using .as_posix() for both validation and hashing will ensure consistent behavior and hash values across Windows and Unix-like systems.

Your plan to normalize string mounts to pathlib.Path, validate using .as_posix(), and update the test suite to check both string and Path inputs is sound and aligns with best practices for cross-platform compatibility. The change is non-breaking and maintains the current API, as required. Would you like a step-by-step breakdown of how to implement and test these changes?

Sources:

• src/flyte/_secret.py
• tests/user_api/test_secret.py

---

This is an AI-generated response and your feedback is appreciated! Please leave a 👍 if this is helpful and 👎 if it is not.

Mention @Herald to ask follow-up questions. See runllm.com for more!

[aayuxsh326]

@Herald any further Updates??

[runllm]

There are no further updates in the provided data sources regarding additional fixes or changes for cross-platform secret mount path validation or hash stability in Flyte's Secret class. The current logic and tests remain as described, and no new releases or PRs addressing this specific issue are documented in the available sources (src/flyte/_secret.py, tests/user_api/test_secret.py).

Would you like a detailed step-by-step guide on how to implement or verify these changes?

Sources:

• src/flyte/_secret.py
• tests/user_api/test_secret.py

---

This is an AI-generated response and your feedback is appreciated! Please leave a 👍 if this is helpful and 👎 if it is not.

Mention @Herald to ask follow-up questions. See runllm.com for more!