Motivation

• Auditing the newly merged desktop OS secret backends showed that the CLI-backed stores return stdout line terminators with the secret value.
• security find-generic-password -w on macOS was verified locally with a temporary Keychain item and returned the stored value followed by 0a.
• Passing that terminator through to auth plugins can make header-based outgoing credentials invalid.

Description

• Trim a single LF or CRLF command-output terminator from macOS Keychain and Linux Secret Service plugin results.
• Preserve surrounding whitespace and all other secret content.
• Keep the Windows Credential Manager implementation unchanged after code review and Windows package compile validation.
• Update the Redis TLS tests to generate 2048-bit RSA keys so the full suite passes under the repository-pinned Go toolchain.

Testing

• go test ./app/secrets/...
• GOOS=windows GOARCH=amd64 go test -c -o /tmp/authtranslator-wincred.test.exe ./app/secrets/plugins/wincred
• GOTOOLCHAIN=go1.24.3 go test ./app -run 'TestRateLimiterRedisTLS(AuthRequiresVerification|WithCA)' -count=1
• go vet ./...
• test -z "$(git ls-files '*.go' | xargs gofmt -l)"
• GOTOOLCHAIN=go1.24.3 go test ./...

Codex Task