33532 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Martin Atkins	36c16172c6	rfc: Collecting Data on Usage of Various OpenTofu Features ... Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-05-13 15:46:29 -07:00
Gal Salomon	8541e02cc6	encryption/azure_vault: ... - add test for authentication configuration - fix 'environment' and 'metadata_host' Resolves #4090 Signed-off-by: Gal Salomon <gasalomo@akamai.com>	2026-05-13 11:39:46 -05:00
Gal Salomon	3a557feb0d	encryption/azure_vault: fix Azure key_provider ignores 'tenant_id' and 'subscription_id' ... Resolves #4090 Signed-off-by: Gal Salomon <gasalomo@akamai.com>	2026-05-13 11:39:46 -05:00
Sebastien Tardif	a5e0d7c266	states: Add missing lock in RemoveResourceInstanceObjectFull ... RemoveResourceInstanceObjectFull reads and mutates s.state and calls s.maybePruneModule without holding s.lock. Every other mutation method on SyncState acquires the lock, and maybePruneModule's own doc comment states it must only be called while the caller is holding the write lock. Both callers (plan_data.go and operations_resource_managed.go) execute inside goroutines spawned by the execution graph engine, making concurrent access possible. Concurrent map read/write in Go causes a fatal runtime panic that cannot be recovered. Add s.lock.Lock()/defer s.lock.Unlock() to match the identical pattern used by SetResourceInstanceObjectFull. Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>	2026-05-13 09:11:53 -07:00
Martin Atkins	74a1b87db9	CHANGELOG: Entry for opentofu/opentofu#3316 ... Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-05-13 08:52:36 -07:00
Daniel Argüelles	ff60b79090	chore: rename test for OCI repository ... Signed-off-by: Daniel Argüelles <leinad87@gmail.com>	2026-05-13 08:52:36 -07:00
Daniel Argüelles	4cd02246bb	feat: add test for OCI repository handling with 401 Unauthorized response ... Signed-off-by: Daniel Argüelles <leinad87@gmail.com>	2026-05-13 08:52:36 -07:00
Daniel Argüelles	0ef05811e7	chore: improve TestGetOCIRepositoryORASClient_PerRepositoryCredentials with subtests ... Signed-off-by: Daniel Argüelles <leinad87@gmail.com>	2026-05-13 08:52:36 -07:00
Daniel Argüelles	0a4c98a48e	fix: typos and improve comments ... Signed-off-by: Daniel Argüelles <leinad87@gmail.com>	2026-05-13 08:52:36 -07:00
Daniel Argüelles	29f3758127	feat: remove oras.Ping and add test per-repository credential handling for OCI clients ... Signed-off-by: Daniel Argüelles <leinad87@gmail.com>	2026-05-13 08:52:36 -07:00
Martin Atkins	cc6c038dda	go.mod: Upgrade to Go 1.26.3 ... This is primarily to address CVE-2026-33814, also known as GO-2026-4918. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-05-12 06:48:07 -07:00
Andrei Ciobanu	85e9009e4a	Fix panic during closing of the ephemeral resources (#4081) ... Signed-off-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org>	2026-05-12 09:30:07 +03:00
aleksandarss	ab8e09b15a	docs(test): clarify mock_resource usage in test docs (#3639) ... Signed-off-by: aleksandarss <aleksandar-sasa.calic@hotmail.com> Co-authored-by: Diógenes Fernandes <diofeher@gmail.com>	2026-05-12 08:35:14 +03:00
Martin Atkins	1d3548a0e7	providercache: Don't clobber mismatching cache entries ... Prevously OpenTofu's provider installer would try to install a package even if there was already a directory there which doesn't match the package contents. That's effective in making us more likely to end up with a working provider cache directory, but risks clobbering a package directory that the operator intentionally modified for some reason. We'll now require that if an existing directory (or symlink to one) is present at the place where we'd need to put our cache entry then its contents must already match what we're trying to install, thereby making this a no-op. If the existing contents don't match then we'll fail with an error to let the operator decide whether they need to keep something from their modified directory before deleting it. In earlier versions of OpenTofu, silently replacing an existing directory was actually sometimes done intentionally to ensure that the cache would definitely match the dependency lock file, but we no longer need to do that because as of OpenTofu v1.12 the provider installer now exits early (without downloading anything at all) if a matching package is already present, so we never end up trying to replace a package that was already present on disk unless it's the case we're now trying to catch as an error here. The handling of this is in PackageLocalArchive because the two network-based location types (HTTP archive and OCI blob archive) work by first fetching the archive to a temporary local location and then asking the local archive location to finish the installation. This is covered by e2etests rather than a unit test because successfully hitting this error requires both the "providercache" and "getproviders" packages to cooperate to let execution reach this late step without any earlier code doing an early exit due to the directory already being present. The e2etest runs through that entire codepath to make sure we reach the error message we're expecting to reach. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-05-08 08:35:38 -07:00
Christian Mesh	9e746cc2d1	Fix panic in validate from replace_triggered_by (#4069) ... Signed-off-by: Christian Mesh <christianmesh1@gmail.com>	2026-04-29 09:05:32 -04:00
Babur Ayanlar	5ddfb11cbc	tofu plan: mention that empty plan might be caused by incorrect -target ... Signed-off-by: Babur Ayanlar <babur.ayanlar@ableton.com>	2026-04-28 11:40:20 -07:00
Martin Atkins	c2e619ebb9	resources: Unit tests for ManagedResourceType.PlanChanges ... While working through the "walking skeleton" phase of developing the new runtime we intentionally kept the test coverage pretty light so that it'd be easier to make substantial changes to the design if we learned new information as we went along. Since we're now switching to a more incremental mode of development, it'll be helpful to have a little more test coverage. This is a retroactive addition of a unit test suite for the function that encapsulates the interactions with providers for planning changes to managed resource instances, since (FIXMEs and TODOs notwithstanding) this seems pretty unlikely to be refactored significantly in the near future. This establishes a very simple fake provider client implementation that's convenient to use in the tests here. Along with just being much simpler than the one in "package tofu" (no call tracking, etc), including this here also avoids the need for "package resources" to depend on "package tofu", which would therefore make it impossible for the old runtime to call into here. As we add new code to support other resource-related provider operations later the additional tests can hopefully share this fake provider client implementation. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-28 11:03:35 -07:00
Christian Mesh	2cfaa36598	Deprecation diagnostics internal rework (#3996) ... Signed-off-by: Christian Mesh <christianmesh1@gmail.com> Co-authored-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org>	2026-04-28 07:44:49 -04:00
Martin Atkins	450bd7ca88	CHANGELOG: Entry for opentofu/opentofu#4056 ... Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-27 09:47:58 -07:00
Martin Atkins	787cf165db	go.mod: go get github.com/apparentlymart/go-cidr@v1.1.1 ... This includes an upstream fix for a panic inside HostBig which was observable through OpenTofu's "cidrhost" built-in function. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-27 09:47:58 -07:00
Larry Bordowitz	878e628861	add changelog bugfix ... Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>	2026-04-27 10:49:54 -05:00
Larry Bordowitz	f09556ee76	remove magic strings, add dev notes ... Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>	2026-04-27 10:49:54 -05:00
Larry Bordowitz	561012e4a9	azurerm: respect audience in request URL ... Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>	2026-04-27 10:49:54 -05:00
Andrei Ciobanu	0af2e8d521	UIInput must return when the first SIGINT/SIGTERM signal is received (#4051) ... Signed-off-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org>	2026-04-27 17:03:57 +03:00
DongJun Lee	c6f06f8f6d	fix: prevent panic in tofu login OAuth flow due to channel race (#4016) ... Signed-off-by: dongjune8931 <ldj990517@gmail.com>	2026-04-25 10:00:52 -07:00
Martin Atkins	0b5321e870	CHANGELOG: Entry for opentofu/opentofu#4042 ... Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-21 09:29:38 -07:00
Martin Atkins	e4af2b454c	lang/funcs: cidrsubnet now allows newbits up to 128 for IPv6 ... The original design for this function seems to have mistakenly thought that the upstream library used to implement the calculations could not accept newbits>32, perhaps due to that having been true for some of its other functions in an earlier release. However, this restriction is not needed in the current version of the upstream library: it performs its calculations on a byte-by-byte basis treating the IP address as a byte-slice, rather than using the Go "int" type. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-21 09:29:38 -07:00
krishna sindhur	5b5a0972d0	Failed to load backend configuration (#3961) ... Signed-off-by: krishna sindhur <krishna.sindhur@harness.io>	2026-04-20 11:04:28 +03:00
DongJun Lee	b5161494b1	fix: replace panic with error diagnostics for invalid TF_STATE_PERSIST_INTERVAL (#4034) ... Signed-off-by: dongjune8931 <ldj990517@gmail.com>	2026-04-20 10:19:03 +03:00
Martin Atkins	c240cb72e7	CHANGELOG: Entries for opentofu/opentofu#4043 ... This just echoes the two fixes from the upstream cty upgrade, since OpenTofu exposes these two functions directly in its own language. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-16 17:26:13 -07:00
Martin Atkins	26185e988b	go.mod: go get github.com/zclconf/go-cty@v1.18.1 ... This includes minor fixes to two functions that OpenTofu exposes as part of its language: - "contains" now allows its second argument to be null to test whether a collection contains any null values. - "merge" no longer panics when its only argument is a null value of an object type, which is a somewhat-degenerate case because this function has a special case where it treats null values as having no attributes regardless of the actual object type. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-16 17:26:13 -07:00
ogormans-deptstack	6a09262c97	local-exec: propagate TRACEPARENT to child processes ... This allows child processes launched with local-exec to contribute to the same trace that OpenTofu started. Signed-off-by: ogormans-deptstack <sean.ogorman@deptagency.com>	2026-04-15 13:40:31 -07:00
Diógenes Fernandes	2c7cd8546c	fix: showSensitive working for provisioners output (#3931) ... Signed-off-by: Diogenes Fernandes <diofeher@gmail.com>	2026-04-15 09:39:53 -03:00
Martin Atkins	192b4c9d60	SECURITY.md: More minor copyediting ... In particular this corrects the error of "an library" instead of "a library", but I also made some other adjustments once I had an excuse to re-review my own earlier writing. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-14 09:41:10 -07:00
Christian Mesh	f4a7c80b0a	Clarify PG backend documentation examples ... Remove example of bad practices and focus on Env vars instead. Signed-off-by: Christian Mesh <christianmesh1@gmail.com>	2026-04-14 06:28:30 -04:00
Martin Atkins	ffb64bbd16	tools/find-pkg-importer: Tool to find what imports a Go package ... Advisories in the Go vulnerability database often identify specific Go packages or even specific symbols within Go packages that the advisory applies to. Therefore when we are evaluating the impact of an advisory on OpenTofu we often need to ask the question "what parts of OpenTofu are using that affected package?" This new tool is a small wrapper around the "go list" command which takes a package path of interest and returns all of the packages in OpenTofu's package import graph that directly import the given package. The results can include both OpenTofu's own packages and packages from upstream modules or the Go standard library. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-13 11:26:43 -07:00
Martin Atkins	b0339b83cf	SECURITY.md: Summary of our upstream advisory policy ... Our policy for handling advisories in upstream dependencies was previously documented only in the RFC where we adopted it, which is hard to find for anyone not already familiar with it. We'd like for SECURITY.md to be the one place someone needs to look when they want to learn about our security policy, so this introduces a short summary of the main consequences of the policy from that RFC and then links to the full RFC in case a reader would like to learn the reasons behind those decisions. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-13 10:33:45 -07:00
Christian Mesh	2e3fb16b8b	Add additional panic info and buffer panic message (#4026) ... Signed-off-by: Christian Mesh <christianmesh1@gmail.com>	2026-04-13 12:11:34 -04:00
Martin Atkins	fb7fc49d8d	CHANGELOG: Entry for opentofu/opentofu#3826 ... Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-09 13:22:27 -07:00
Martin Atkins	82da43c81b	tofu: A better error message for WinRM support being removed ... The previous commit already removed WinRM support and made it return a relatively-terse error message, but during the v1.13 release series we'd like to use a more helpful error message that includes a link to Microsoft's documentation about enabling an OpenSSH server to use as an alternative. This commit is designed to be reverted during the v1.14 period so that we'll just fall back on the error message already implemented in "package communicator". This new message needs to be implemented outside of the communicator abstraction because that old API doesn't support returning diagnostics, but it's not worth the risk to refactor it just for an error message we're intending to remove in the next release series anyway. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-09 13:22:27 -07:00
Martin Atkins	30db471ac0	provisioners: remove WinRM support ... The upstream libraries we use to implement this feature are in various states of unmaintained-ness where we've not been able to upgrade them beyond the old versions we're currently using without them no longer working well together. Therefore we previously made this connection type produce a deprecation warning in OpenTofu v1.12, and now we're making it produce an error instead and so we can remove all of our code that was calling in to those dependencies. Although this is a breaking change, we're justifying it under the "external dependencies" pragmatic exception in our compatibility promises: external software has changed in a way that makes it no longer viable to offer this feature. Modern Windows has built-in support for running an OpenSSH server, and so we expect that most folks who were previously relying on WinRM should be able to migrate to using SSH instead. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-09 13:22:27 -07:00
Martin Atkins	bea94265f3	views: TestStateViews non-hardcoded "terraform_version" ... The "terraform_version" property of the JSON state format (intentionally misnamed for backward-compatibility with our predecessor) changes each time we make a new release, so we'll compare it with the currently-expected version number instead of with a hard-coded value. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-08 14:53:40 -07:00
Martin Atkins	579930a306	CHANGELOG: Begin the v1.13 development period ... The "main" branch now represents v1.13 development, because v1.12 has diverged into its own maintenance branch. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-08 13:35:40 -07:00
ogormans-deptstack	fb45eceae5	provisioners: thread context.Context through ProvisionResource interface ... This is to give provisioners access to trace span metadata, which we'll make use of in later commits. Signed-off-by: ogormans-deptstack <sean.ogorman@deptagency.com>	2026-04-08 08:13:51 -07:00
Christian Mesh	6abffb9d5c	Update contributing.release with most recent instructions (#4011) ... Signed-off-by: Christian Mesh <christianmesh1@gmail.com>	2026-04-08 10:32:03 -04:00
Christian Mesh	826e5fcd88	Fix release action inputs.prerelease condition ... Warning: Conditional expression contains literal text outside replacement tokens. This will cause the expression to always evaluate to truthy. Did you mean to put the entire expression inside ${{ }}? That lead me to https://github.com/orgs/community/discussions/9343 and was validated by using https://rhysd.github.io/actionlint/ Signed-off-by: Christian Mesh <christianmesh1@gmail.com>	2026-04-08 07:25:53 -04:00
Martin Atkins	23002a02ec	go.mod: Upgrade to Go 1.26.2 ... This is just a minor release fixing a number of bugs that don't seem to have affected OpenTofu, and so this is just a routine upgrade in preparation for the v1.12.0 release. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-07 14:16:32 -07:00
Martin Atkins	85e8e539d8	GitHub ACtions: use actions/setup-go v6.4.0 ... The version we were previously using has an incorrect hard-coded URL template for downloading Go versions that are not yet in the action's own manifest file, which means that it can't successfully install any Go version that hasn't been added to the manifest yet. This new version is updated to use an endpoint on https://go.dev/ that is set up to redirect to whatever the correct location is, which was recommended by a member of the Go team in actions/setup-go#665 and so is presumably intended to remain valid. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-07 14:15:03 -07:00
Larry Bordowitz	5c0cbf828d	remove powershell warning in docs ... Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>	2026-04-07 13:46:47 -05:00
Larry Bordowitz	a0354c6f10	remote-exec: fix Powershell - only quote args, not command ... Co-authored-by: Martin Atkins <mart@degeneration.co.uk> Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>	2026-04-07 13:46:47 -05:00