The latter is the most secure route since it keeps the password
completely out of any command lines, and the permissions on the file
can be very restrictive, e.g. 0400.
It would be somewhat nicer if the password file contained just
<password>
rather than
WEAVE_PASSWORD=<password>
but then we'd have to transit the password via a temporary file with
0600 permissions.