4 Commits (9d815ea7271d56a43fc45fdff186e57bfb032a06)

Author	SHA1	Message	Date
hashicorp-copywrite[bot]	325d18262e	[COMPLIANCE] Add Copyright and License Headers	3 years ago
Martin Atkins	383bbdeebc	Upgrade to Go 1.17 ... This includes the addition of the new "//go:build" comment form in addition to the legacy "// +build" notation, as produced by gofmt to ensure consistent behavior between Go versions. The new directives are all equivalent to what was present before, so there's no change in behavior. Go 1.17 continues to use the Unicode 13 tables as in Go 1.16, so this upgrade does not require also upgrading our Unicode-related dependencies. This upgrade includes the following breaking changes which will also appear as breaking changes for Terraform users, but that are consistent with the Terraform v1.0 compatibility promises. - On MacOS, Terraform now requires macOS 10.13 High Sierra or later. This upgrade also includes the following breaking changes which will appear as breaking changes for Terraform users that are inconsistent with our compatibility promises, but have justified exceptions as follows: - cidrsubnet, cidrhost, and cidrnetmask will now reject IPv4 CIDR addresses whose decimal components have leading zeros, where previously they would just silently ignore those leading zeros. This is a security-motivated exception to our compatibility promises, because some external systems interpret zero-prefixed octets as octal numbers rather than decimal, and thus the previous lenient parsing could lead to a different interpretation of the address between systems, and thus potentially allow bypassing policy when configuring firewall rules etc. This upgrade also includes the following breaking changes which could _potentially_ appear as breaking changes for Terraform users, but that do not in practice for the reasons given: - The Go net/url package no longer allows query strings with pairs separated by semicolons instead of ampersands. This primarily affects HTTP servers written in Go, and Terraform includes a special temporary HTTP server as part of its implementation of OAuth for "terraform login", but that server only needs to accept URLs created by Terraform itself and Terraform does not generate any URLs that would be rejected.	5 years ago
Martin Atkins	2332a7ab47	replacefile: don't create the temporary file in TMPDIR ... ioutil.TempFile has a special case where an empty string for its dir argument is interpreted as a request to automatically look up the system temporary directory, which is commonly /tmp . We don't want that behavior here because we're specifically trying to create the temporary file in the same directory as the file we're hoping to replace. If the file gets created in /tmp then it might be on a different device and thus the later atomic rename won't work. Instead, we'll add our own special case to explicitly use "." when the given filename is in the current working directory. That overrides the special automatic behavior of ioutil.TempFile and thus forces the behavior we need. This hadn't previously mattered for earlier callers of this code because they were creating files in subdirectories, but this codepath was failing for the dependency lock file due to it always being created directly in the current working directory. Unfortunately since this is a picky implementation detail I couldn't find a good way to write a unit test for it without considerable refactoring. Instead, I verified manually that the temporary filename wasn't in /tmp on my Linux system, and hope that the comment inline will explain this situation well enough to avoid an accidental regression in future maintenence.	5 years ago
Martin Atkins	55e6f64977	internal/depsfile: Factor out our atomic file replacement logic ... This originated in the cliconfig code to write out credentials files. The Windows implementation of this in particular was quite onerous to get right because it needs a very specific sequence of operations to avoid running into exclusive file locks, and so by factoring this out with only cosmetic modification we can avoid repeating all of that engineering effort for other atomic file writing use-cases.	5 years ago