refactor: retire external vector deployment

scripts/secret-file-utils.sh

@@ -0,0 +1,32 @@
+#!/bin/sh
+set -eu
+
+validate_secret_file() {
+  path="$1"
+  label="$2"
+  if [ -L "$path" ] || [ ! -f "$path" ] || [ ! -r "$path" ]; then
+    echo "$label must be a readable regular file, not a symlink: $path" >&2
+    exit 2
+  fi
+  mode=$(stat -c '%a' "$path" 2>/dev/null || stat -f '%Lp' "$path" 2>/dev/null) || {
+    echo "cannot inspect permissions for $label: $path" >&2
+    exit 2
+  }
+  if [ $((0$mode & 077)) -ne 0 ]; then
+    echo "$label must not be readable or writable by group/other users: $path" >&2
+    exit 2
+  fi
+}
+
+read_secret_file() {
+  path="$1"
+  label="$2"
+  validate_secret_file "$path" "$label"
+  value=$(tr -d '\r' <"$path")
+  case "$value" in
+    *'
+'*) echo "$label must contain exactly one line" >&2; exit 2 ;;
+  esac
+  [ -n "$value" ] || { echo "$label must not be empty" >&2; exit 2; }
+  printf '%s' "$value"
+}