Authentication signature from unknown issue when installing registry.opentofu.org/datadog/datadog v3.39.0

[sombrerosheep]

Thank you for reporting an issue.

This deployment is using terragrunt which changed some providers to use the opentofu registry. This error is now blocking production pipelines and has severely sour'd our opinion of the stability of OpenTofu.

Because this is using terragrunt, we're not able to provide all the details requested below. I hope this is enough information to get us moving forward.

OpenTofu Version

Based on the terragrunt documentation here: https://terragrunt.gruntwork.io/docs/getting-started/supported-versions/, we're using tofu 1.7.x

OpenTofu Configuration Files

terraform {
  required_version = ">= 1.7.1"

  required_providers {
    datadog = {
      source = "DataDog/datadog"
    }
  }
}

[cam72cam]

We don't have any keys for datadog in our registry currently.

You should be getting:

~/tofu init

Initializing the backend...

Initializing provider plugins...
- Finding latest version of datadog/datadog...
- Installing datadog/datadog v3.39.0...
- Installed datadog/datadog v3.39.0. Signature validation was skipped due to the registry not containing GPG keys for this provider

Are you able to provide any additional information about your setup?

[cam72cam]

Also, what terragrunt version are you coming from / which one are you going to?

[cam72cam]

Ah, figured out what your are trying to do / what terragrunt is doing:

terraform {
  required_version = ">= 1.7.0"

  required_providers {
    datadog = {
      source = "registry.opentofu.org/DataDog/datadog"
    }
  }
}

./terraform init

Initializing the backend...

Initializing provider plugins...
- Finding latest version of registry.opentofu.org/datadog/datadog...
- Installing registry.opentofu.org/datadog/datadog v3.39.0...
╷
│ Error: Failed to install provider
│ 
│ Error while installing registry.opentofu.org/datadog/datadog v3.39.0: authentication signature from unknown issuer

They are trying to use opentofu providers and signatures with terraform. This is not a code-path we expect or test and is a bug in TerraGrunt.

Edit: this may be related to gruntwork-io/terragrunt#3123.

[sombrerosheep]

@cam72cam Appreciate the quick reply! Would you suggest we open an issue with Terragrunt on this? We attempted this with the current version of terragrunt as well as a few previous versions. With the provider being baked into the state, we are unable to even initialize to flip the provider back to the terraform registry.

[cam72cam]

Yes, I'd recommend opening in the terragrunt issue linked to this one. I've also pinged a few of their devs and pointed them toward this issue.

I'm sorry that this is your first introduction to OpenTofu, hopefully we can get this sorted quickly!

You should be able to repair your state file using:
tofu state replace-provider 'registry.opentofu.org/datadog/datadog' 'registry.terraform.io/datadog/datadog'

[sombrerosheep]

@cam72cam This worked! We tried this using terragrunt binary but I must not have had opentofu installed for it to pick up that config. Running it with tofu directly worked!

I'll get an issue filed through terragrunt on the registry error. Appreciate your help! Cheers!

[ZachGoldberg]

Zach from the Gruntwork team here! Just want to acknowledge the issue you've experienced @sombrerosheep and we're eager track this down in Terragrunt and ensure this is resolved and that OpenTofu and Terragrunt work seamlessly together.