# Fix Cross-Platform Windows Secret Mount Path Validation and Hash Stability

Fix Cross-Platform Windows Secret Mount Path Validation and Hash Stability

Background & Problem

In src/flyte/_secret.py:

1. Windows Mount Path Check: The validation logic if str(self.mount) != "/etc/flyte/secrets" fails on Windows because pathlib.Path("/etc/flyte/secrets") formats as \etc\flyte\secrets under str(). This causes any valid Secret with a mount path to raise ValueError: Only /etc/flyte/secrets is supported as secret mount path today. on Windows systems, breaking test_secret_mount_valid().
2. Stable Hash Consistency: Secret.stable_hash() uses str(self.mount), which causes the same secret definition to yield different SHA-256 hashes on Windows vs. Linux/macOS.
3. Broken __main__ Example: Line 94 uses mount=pathlib.Path("/path/to/secret") which immediately crashes if the script is run directly.

User Review Required

[!NOTE] No breaking changes to existing APIs or interfaces. Secret.mount continues to accept pathlib.Path | None, and we also permit str | pathlib.Path | None normalized to pathlib.Path or standard POSIX representation.

Proposed Changes

Core Library

[MODIFY] src/flyte/_secret.py

• In Secret.__post_init__, convert self.mount if it's a string to pathlib.Path, and check self.mount.as_posix() != "/etc/flyte/secrets".
• In Secret.stable_hash, use self.mount.as_posix() instead of str(self.mount) so the hash is deterministic across all operating systems.
• In if __name__ == "__main__":, update the example to use /etc/flyte/secrets.

Test Suite

[MODIFY] tests/user_api/test_secret.py

• Verify Secret(key="my-secret", mount=pathlib.Path("/etc/flyte/secrets")) passes across platforms.
• Verify Secret(key="my-secret", mount="/etc/flyte/secrets") (string mount) works cleanly.
• Verify stable_hash() produces the exact same hash regardless of whether Path or PurePosixPath is provided on any OS.

Verification Plan

Automated Tests

• Run validation scripts using Python directly against src/flyte/_secret.py to confirm the fix works on Windows.
• Verify that hash determinism tests pass.