AB#2533 Pin terraform provider hashes

[malt3]

Proposed change(s)

• Pin terraform provider hashes

Additional info

Manually created using:

terraform providers lock -platform=linux_arm64 -platform=linux_amd64 -platform=darwin_arm64 -platform=darwin_amd64 -platform=windows_amd64

Checklist

• Link to Milestone

[netlify]

✅ Deploy Preview for constellation-docs canceled.

Name	Link
🔨 Latest commit	8d6c9e2
🔍 Latest deploy log	https://app.netlify.com/sites/constellation-docs/deploys/63568547dfa8e5000841f399

[daniel-weisse]

I think we also talked about pinning the terraform binary version, not sure if we can provide a hash, though

[malt3]

I think we also talked about pinning the terraform binary version, not sure if we can provide a hash, though

I looked through the source of terraform-exec. Our installation method already verifies the hashes of the terraform binary. The hashes are not pinned but signed by hashicorp instead.

Installer.Ensure calls Downloader.DownloadAndUnpack which internally performs the verification.

[Nirusu]

Signed vs. pinned hashes has the issue though that supply chain attacks by Hashicorp are possible. If the signing key is compromised, someone can upload a maliciously signed hash and achieve unintended code execution.

Of course it's a more advanced attack, but this issue exists with signed hashes.

[malt3]

There is no option for hash pinning in terraform-exec so I don't believe that this is feasible for now. I can open an issue on their Git and ask if such a feature can be added.

[Nirusu]

True... We could build a wrapper but that's likely going to be ugly, especially since the terraform-exec / install package also checks for already existing installations so execution paths can vary.

Maybe we can ask. The Terraform package also already supports defining your own PGP key for verification, which is something we could (ab)use for that but would mean we also would need to redistribute their packages signed by us.

But if they have this option, it shows that they might care about providing a list of pinned hashes, too.

Another question related, do we want to pin the used Terraform version here?:

constellation/cli/internal/terraform/terraform.go

Line 27 in 8d6c9e2

tfVersion = ">= 1.2.0"

[malt3]

Another question related, do we want to pin the used Terraform version here?:

As long as we don't pin hashes it is not required to pin this version. Hashicorp can always modify existing or future binaries to include malware. From all other perspectives, a newer terraform version should fix bugs and security vulnerabilities.

[malt3]

Tracking: hashicorp/hc-install#72

[malt3]

I moved hash validation of the terraform binary into a separate ticket AB#2534 to unblock this PR.