4 Commits (c6cbbcb79a751fcee2334b22bb3ee18aecaefb91)

Author	SHA1	Message	Date
Alisdair McDiarmid	a5b3d497cc	internal: Verify provider signatures on install ... Providers installed from the registry are accompanied by a list of checksums (the "SHA256SUMS" file), which is cryptographically signed to allow package authentication. The process of verifying this has multiple steps: - First we must verify that the SHA256 hash of the package archive matches the expected hash. This could be done for local installations too, in the future. - Next we ensure that the expected hash returned as part of the registry API response matches an entry in the checksum list. - Finally we verify the cryptographic signature of the checksum list, using the public keys provided by the registry. Each of these steps is implemented as a separate PackageAuthentication type. The local archive installation mechanism uses only the archive checksum authenticator, and the HTTP installation uses all three in the order given. The package authentication system now also returns a result value, which is used by command/init to display the result of the authentication process. There are three tiers of signature, each of which is presented differently to the user: - Signatures from the embedded HashiCorp public key indicate that the provider is officially supported by HashiCorp; - If the signing key is not from HashiCorp, it may have an associated trust signature, which indicates that the provider is from one of HashiCorp's trusted partners; - Otherwise, if the signature is valid, this is a community provider.	6 years ago
Kristin Laemmert	f09ae6f862	provider source tests: added test suite to exercise hyphenated providers (#24685)	6 years ago
Martin Atkins	391ca0c991	internal/providercache: add windows test fixture ... This was accidentally left out of an earlier commit due to our top-level .gitignore file containing *.exe as an ignore pattern.	6 years ago
Martin Atkins	d13001830b	providercache: A package to encapsulate management of provider cache dirs ... Historically our logic to handle discovering and installing providers has been spread across several different packages. This package is intended to become the home of all logic related to what is now called "provider cache directories", which means directories on local disk where Terraform caches providers in a form that is ready to run. That includes both logic related to interrogating items already in a cache (included in this commit) and logic related to inserting new items into the cache from upstream provider sources (to follow in later commits). These new codepaths are focused on providers and do not include other plugin types (provisioners and credentials helpers), because providers are the only plugin type that is represented by a heirarchical, decentralized namespace and the only plugin type that has an auto-installation protocol defined. The existing codepaths will remain to support the handling of the other plugin types that require manual installation and that use only a flat, locally-defined namespace.	6 years ago