From da8da66a5d8b5e1020a1149e1d7e6dc135d3cb76 Mon Sep 17 00:00:00 2001 From: Joe Corall Date: Wed, 19 Aug 2026 11:56:38 +0000 Subject: [PATCH 1/6] [patch] Pin a fixed UID/GID for the cloud-compose account useradd/groupadd previously let the cloud-compose account's UID/GID be dynamically assigned to the next free ID at creation time. On providers whose root filesystem (and therefore /etc/passwd) does not persist across boots, that ID is not stable across VM replacements: a recreated cloud-compose account can land on a different UID than the one that originally owned everything on the persistent data disk, leaving it unable to read or write its own home directory or any compose project checkout. This surfaced in production as cloud-compose-bootstrap.service failing indefinitely with git "dubious ownership" errors it misreported as a missing origin remote, because it silently swallowed the real git failure. Pins both to 2000, matching the value that was already being assigned in practice before this became a problem. --- .terraform.lock.hcl | 89 +++++++++++++++++++ ci/backup-contract.sh | 0 ci/bootstrap-recovery-contract.sh | 0 ci/cos-jq-portability-contract.sh | 0 ci/disaster-recovery-contract.sh | 0 ci/filesystem-prep-contract.sh | 0 ci/fixtures/checked-lifecycle-executor.sh | 0 ci/host-runtime-security.sh | 0 ci/inline-data-program-contract.sh | 0 ci/key-rotation-contract.sh | 0 ci/managed-artifact-contract.sh | 0 ci/overlay-contract.sh | 0 ci/runtime-config-contract.sh | 0 ci/sitectl-version-contract.sh | 0 ci/source-trust-contract.sh | 0 ci/terraform-validate.sh | 9 +- ci/testdata/disaster-recovery/compose-apps.sh | 0 ci/testdata/disaster-recovery/fake-docker.sh | 0 ci/testdata/disaster-recovery/fake-install.sh | 0 ci/testdata/disaster-recovery/fake-stat.sh | 0 ci/testdata/disaster-recovery/good-driver.sh | 0 .../disaster-recovery/incomplete-driver.sh | 0 ci/testdata/disaster-recovery/profile.sh | 0 ci/vault-runtime-contract.sh | 0 .../testdata/cloud-smoke-lifecycle/ssh.sh | 0 modules/digitalocean/.terraform.lock.hcl | 47 ++++++++++ modules/gcp/.terraform.lock.hcl | 85 ++++++++++++++++++ modules/gcp/runtime_contracts.tftest.hcl | 6 +- modules/linode/.terraform.lock.hcl | 44 +++++++++ modules/linux-vm-runtime/.terraform.lock.hcl | 23 +++++ .../runtime_inputs.tftest.hcl | 2 +- providers/do/.terraform.lock.hcl | 47 ++++++++++ providers/do/template_versions.tftest.hcl | 4 +- providers/linode/.terraform.lock.hcl | 44 +++++++++ providers/linode/template_versions.tftest.hcl | 4 +- rootfs/home/cloud-compose/app-init.sh | 0 rootfs/home/cloud-compose/app-rollout.sh | 0 .../cloud-compose/assert-app-initialized.sh | 0 .../home/cloud-compose/assert-vault-ready.sh | 0 .../home/cloud-compose/bootstrap-helpers.sh | 0 rootfs/home/cloud-compose/compose-apps.sh | 0 rootfs/home/cloud-compose/compose-dispatch.sh | 0 .../configure-metadata-firewall.sh | 0 .../cloud-compose/converge-app-filesystems.sh | 0 .../home/cloud-compose/default-lifecycle.sh | 0 rootfs/home/cloud-compose/deploy-rollout.sh | 0 .../cloud-compose/disaster-recovery-lib.sh | 0 rootfs/home/cloud-compose/host-conf.sh | 0 rootfs/home/cloud-compose/host-init.sh | 17 +++- .../install-dependencies-coreos.sh | 0 .../cloud-compose/install-dependencies-cos.sh | 0 .../install-dependencies-debian.sh | 0 .../cloud-compose/install-dependencies.sh | 0 .../cloud-compose/install-docker-plugins.sh | 0 .../cloud-compose/libops-managed-runtime.sh | 0 .../cloud-compose/lifecycle-entrypoint.sh | 0 rootfs/home/cloud-compose/mariadb-backup.sh | 0 rootfs/home/cloud-compose/offhost-backup.sh | 0 rootfs/home/cloud-compose/overlay-init.sh | 0 .../home/cloud-compose/prepare-app-sources.sh | 0 .../home/cloud-compose/prepare-filesystem.sh | 0 rootfs/home/cloud-compose/profile.sh | 0 rootfs/home/cloud-compose/restore-test.sh | 0 rootfs/home/cloud-compose/rotate-keys-app.sh | 0 .../home/cloud-compose/rotate-keys-daily.sh | 0 .../cloud-compose/rotate-keys-internal.sh | 0 rootfs/home/cloud-compose/rotate-keys.sh | 0 rootfs/home/cloud-compose/run-bootstrap.sh | 0 .../home/cloud-compose/run-rollout-service.sh | 0 rootfs/home/cloud-compose/run.sh | 0 .../start-cloud-compose-bootstrap.sh | 0 rootfs/home/cloud-compose/vault-agent-init.sh | 0 .../cloud-compose/vault-agent-readiness.sh | 0 73 files changed, 411 insertions(+), 10 deletions(-) create mode 100644 .terraform.lock.hcl mode change 100644 => 100755 ci/backup-contract.sh mode change 100644 => 100755 ci/bootstrap-recovery-contract.sh mode change 100644 => 100755 ci/cos-jq-portability-contract.sh mode change 100644 => 100755 ci/disaster-recovery-contract.sh mode change 100644 => 100755 ci/filesystem-prep-contract.sh mode change 100644 => 100755 ci/fixtures/checked-lifecycle-executor.sh mode change 100644 => 100755 ci/host-runtime-security.sh mode change 100644 => 100755 ci/inline-data-program-contract.sh mode change 100644 => 100755 ci/key-rotation-contract.sh mode change 100644 => 100755 ci/managed-artifact-contract.sh mode change 100644 => 100755 ci/overlay-contract.sh mode change 100644 => 100755 ci/runtime-config-contract.sh mode change 100644 => 100755 ci/sitectl-version-contract.sh mode change 100644 => 100755 ci/source-trust-contract.sh mode change 100644 => 100755 ci/terraform-validate.sh mode change 100644 => 100755 ci/testdata/disaster-recovery/compose-apps.sh mode change 100644 => 100755 ci/testdata/disaster-recovery/fake-docker.sh mode change 100644 => 100755 ci/testdata/disaster-recovery/fake-install.sh mode change 100644 => 100755 ci/testdata/disaster-recovery/fake-stat.sh mode change 100644 => 100755 ci/testdata/disaster-recovery/good-driver.sh mode change 100644 => 100755 ci/testdata/disaster-recovery/incomplete-driver.sh mode change 100644 => 100755 ci/testdata/disaster-recovery/profile.sh mode change 100644 => 100755 ci/vault-runtime-contract.sh mode change 100644 => 100755 internal/contracttest/testdata/cloud-smoke-lifecycle/ssh.sh create mode 100644 modules/digitalocean/.terraform.lock.hcl create mode 100644 modules/gcp/.terraform.lock.hcl create mode 100644 modules/linode/.terraform.lock.hcl create mode 100644 modules/linux-vm-runtime/.terraform.lock.hcl create mode 100644 providers/do/.terraform.lock.hcl create mode 100644 providers/linode/.terraform.lock.hcl mode change 100644 => 100755 rootfs/home/cloud-compose/app-init.sh mode change 100644 => 100755 rootfs/home/cloud-compose/app-rollout.sh mode change 100644 => 100755 rootfs/home/cloud-compose/assert-app-initialized.sh mode change 100644 => 100755 rootfs/home/cloud-compose/assert-vault-ready.sh mode change 100644 => 100755 rootfs/home/cloud-compose/bootstrap-helpers.sh mode change 100644 => 100755 rootfs/home/cloud-compose/compose-apps.sh mode change 100644 => 100755 rootfs/home/cloud-compose/compose-dispatch.sh mode change 100644 => 100755 rootfs/home/cloud-compose/configure-metadata-firewall.sh mode change 100644 => 100755 rootfs/home/cloud-compose/converge-app-filesystems.sh mode change 100644 => 100755 rootfs/home/cloud-compose/default-lifecycle.sh mode change 100644 => 100755 rootfs/home/cloud-compose/deploy-rollout.sh mode change 100644 => 100755 rootfs/home/cloud-compose/disaster-recovery-lib.sh mode change 100644 => 100755 rootfs/home/cloud-compose/host-conf.sh mode change 100644 => 100755 rootfs/home/cloud-compose/host-init.sh mode change 100644 => 100755 rootfs/home/cloud-compose/install-dependencies-coreos.sh mode change 100644 => 100755 rootfs/home/cloud-compose/install-dependencies-cos.sh mode change 100644 => 100755 rootfs/home/cloud-compose/install-dependencies-debian.sh mode change 100644 => 100755 rootfs/home/cloud-compose/install-dependencies.sh mode change 100644 => 100755 rootfs/home/cloud-compose/install-docker-plugins.sh mode change 100644 => 100755 rootfs/home/cloud-compose/libops-managed-runtime.sh mode change 100644 => 100755 rootfs/home/cloud-compose/lifecycle-entrypoint.sh mode change 100644 => 100755 rootfs/home/cloud-compose/mariadb-backup.sh mode change 100644 => 100755 rootfs/home/cloud-compose/offhost-backup.sh mode change 100644 => 100755 rootfs/home/cloud-compose/overlay-init.sh mode change 100644 => 100755 rootfs/home/cloud-compose/prepare-app-sources.sh mode change 100644 => 100755 rootfs/home/cloud-compose/prepare-filesystem.sh mode change 100644 => 100755 rootfs/home/cloud-compose/profile.sh mode change 100644 => 100755 rootfs/home/cloud-compose/restore-test.sh mode change 100644 => 100755 rootfs/home/cloud-compose/rotate-keys-app.sh mode change 100644 => 100755 rootfs/home/cloud-compose/rotate-keys-daily.sh mode change 100644 => 100755 rootfs/home/cloud-compose/rotate-keys-internal.sh mode change 100644 => 100755 rootfs/home/cloud-compose/rotate-keys.sh mode change 100644 => 100755 rootfs/home/cloud-compose/run-bootstrap.sh mode change 100644 => 100755 rootfs/home/cloud-compose/run-rollout-service.sh mode change 100644 => 100755 rootfs/home/cloud-compose/run.sh mode change 100644 => 100755 rootfs/home/cloud-compose/start-cloud-compose-bootstrap.sh mode change 100644 => 100755 rootfs/home/cloud-compose/vault-agent-init.sh mode change 100644 => 100755 rootfs/home/cloud-compose/vault-agent-readiness.sh diff --git a/.terraform.lock.hcl b/.terraform.lock.hcl new file mode 100644 index 0000000..6230b2b --- /dev/null +++ b/.terraform.lock.hcl @@ -0,0 +1,89 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/hashicorp/cloudinit" { + version = "2.4.0" + constraints = "~> 2.3" + hashes = [ + "h1:4fp7byXJGbOU8zqxFM4yYGHzf1kUH8ChT41KK4n9q98=", + "h1:H74EkbLWyZxkKhz8inoi6HTZbPox2VYzAttFhUy8X7Y=", + "zh:1b0fe71b8e87a068f7cd9faaa733100ab72ab61ce812b8bd2b8e3e6ea3907b2d", + "zh:2aa9631ad64cfda1eb58f147619b631dadedfaf9453b422aa5ada2d3861183c1", + "zh:2c5f35463bdfb2f87d3576b81e62c30f8109e67bb6f21ffcbc46a855811455c0", + "zh:5970bcad151ea236bd262ada1a5a23bfbc1716f94a4e8b16ab2bcdda91d6a671", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:79a0676909732b6ec0441a733af6383513cde3bd2cef5c1ad0a74131e1286a04", + "zh:818f16141481a1202b3977becd19a12d4d46cd2e3f5753f5d0d0049adacf8f8c", + "zh:948d98716831087e69eca99f91ed7964cc537f3aca279f7494645ee56c9dc4ec", + "zh:a75e78889565a51df3e8e3af207e36e5ddb25e47ce1780a784c82dc3c3109b67", + "zh:a9c6e455d52b1bba5272bd87a35cfabcfd6d903dcbe42e2de926228dbb1e39b2", + "zh:b846805d8c2f5d1d6c2ffeeaf32109d9af7db7fa3c56929bfc1dcfaadf9c8bd8", + "zh:c3e5279756b46c4f49a6f4c81347fbe2fffebb2bf18a5c24664830304a1f6a8e", + "zh:c8be7b31893163d0046b0137a6100533f07e8efd192a1903b6bb4c42be12dceb", + ] +} + +provider "registry.terraform.io/hashicorp/google" { + version = "7.45.0" + constraints = "~> 7.0" + hashes = [ + "h1:FGFsRBzfeyq56BUAcb/WT676NieMX3NRfR4DBj2eEqk=", + "h1:snI9jfT+CtL8dH099NZCe79ciOSTuL74nPB7KaCf9pM=", + "zh:0f33485d068e39b1661d4ad789dfac353134b99cb5746e463e7719c053d70c06", + "zh:162335c448b15125924c3451dc0a411635138c00e36784d9586b9df61bc8a3d7", + "zh:172c9e4902e9a01b1111bbbb9063a47804ec5f4207b2221df9c398239ff3b350", + "zh:39acce0806f1aeca106ea529053778681e332f3f895c21c6a6a9fb267bed1058", + "zh:58dadd7b96b7b706e2995a04f356862be7cfd6b55f6257464c8b10986abf8efa", + "zh:7230a5e49abed243317b9de0ee7fd365b4a2775b532a5d66006b39c4703978ac", + "zh:a1b60814ee9a0726c0cd43d36da2cee3db97ec296ee66b111a7e603997de9122", + "zh:a454c09162ccd342e101704dca4b0eedc2d11939ac48ebd7b7d505a96c1933e6", + "zh:ad6fdf73e072f510a7d8e2b70f9e1021d08b9076eae146b420f333905708c982", + "zh:de1de65b909c99430f8bef092718b75dc5c777e98daf474a2215621f35095bb8", + "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c", + "zh:fb1b9d1ea7bc79b7409f02aa7c19ba39afa22dbead69e83ae7eb2691ac5c2426", + ] +} + +provider "registry.terraform.io/hashicorp/http" { + version = "3.6.1" + constraints = "~> 3.6" + hashes = [ + "h1:T/CtN+30HmfgKsxgVTsee57V+lT+GY20INpjp91kRTc=", + "h1:uEqqVV3ui6Zr0k/lqyjvHM0Lg267qMMji+ux7wPfJXI=", + "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", + "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:9c86821e99fcf1c9184087d73dd4940f14d10318d7229694fa61512c1216c279", + "zh:a0e08baf98384f7f20fe9beb2ca1acbbfb8bf71caaa33e49e35b584618648d46", + "zh:aaf767f5bf28a887c9c8f82a58b08275709642306b77c6b82c41c09aaa116390", + "zh:b0d189d11dbea1e2d2a31ee0c5cc215182e0448999bb5c1df0ef0e64e8aa3e74", + "zh:bdde65bcb27ba3f24a5ab7f455245709e8ae3dce2bcd8dbcb208ef4dc7f17a43", + "zh:c998032f00bb0cacc7f87e277f699ea3582ed86aee696a81af2eef8d5963b66b", + "zh:e40143fe7a2e8c4970190c77f82682a140a30de0340f0c8c57291ac22994d217", + "zh:e49ba3ff6244cbb30baa7a0e455d5652e4b650bf2a5459f9e6d349ef4503edeb", + "zh:e4ae6b4af472f90cd08a267f7120ac0f6e95af46486c3031564dd2a065aeda48", + "zh:f832598bbf437ea9d1dcfeeb527ca55c23137c724bb5400ff196a10e3bb3e53b", + ] +} + +provider "registry.terraform.io/hashicorp/time" { + version = "0.14.1" + constraints = "~> 0.14" + hashes = [ + "h1:YRK+EoKey0ssT+VU2821si0k+fzPFHALvVnfe2atBlU=", + "h1:r93SxP++6gUlwCHDQ5OkRmcU8B0yv6ZA9nF0Dh6NJmA=", + "zh:0837ca5b057e5cff94dff7de2fcccafb4abaa33c45de193fe2853e684818a267", + "zh:15a122f72d9e0f34fc5384cc7ec089319641fee5c319748a3aa02fc42f459969", + "zh:342fb83093a280ea7ee0654feae1f5867c62eb8eebc1ab46f9a7ab0b4c878a62", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:99f169834d3370b8341381c6a9c7a8b01fb26027531faa38e6fb49cc23916f68", + "zh:9f482917c7a28cf2436578be7aa9f04f8c811aba8b5949e0223ea987a2757a91", + "zh:ac6b5b8732826f2d1129a8a4a038ac7a7a9ca7b77d2a4608e5703be1a1e2bff0", + "zh:c54782a27d58ce04f6696c6fc0b2cf1e2fba6bed239fb520521a7bce7d7193cb", + "zh:c8d0ddc8f575ecb44f025d54edbfe118e26397fe328a67be62325766f31eb6e7", + "zh:d043b96f204edd2353bf6b2a34e645ffdee2e9634d9bb747331320444810a538", + "zh:e32c288501ca9a6c9d22b52e839dd391fc7083d54ee6b8dc296ce0e6bd3e57ef", + "zh:e47fcc7bb4e9ab5cc522c3b06e4fa9c0bf94b84be8210bc6b1655c44acb2addc", + "zh:f61bf218322bcbe0bd2d56bba738e7fa485e9b54244e13aa12de741b37d450c0", + ] +} diff --git a/ci/backup-contract.sh b/ci/backup-contract.sh old mode 100644 new mode 100755 diff --git a/ci/bootstrap-recovery-contract.sh b/ci/bootstrap-recovery-contract.sh old mode 100644 new mode 100755 diff --git a/ci/cos-jq-portability-contract.sh b/ci/cos-jq-portability-contract.sh old mode 100644 new mode 100755 diff --git a/ci/disaster-recovery-contract.sh b/ci/disaster-recovery-contract.sh old mode 100644 new mode 100755 diff --git a/ci/filesystem-prep-contract.sh b/ci/filesystem-prep-contract.sh old mode 100644 new mode 100755 diff --git a/ci/fixtures/checked-lifecycle-executor.sh b/ci/fixtures/checked-lifecycle-executor.sh old mode 100644 new mode 100755 diff --git a/ci/host-runtime-security.sh b/ci/host-runtime-security.sh old mode 100644 new mode 100755 diff --git a/ci/inline-data-program-contract.sh b/ci/inline-data-program-contract.sh old mode 100644 new mode 100755 diff --git a/ci/key-rotation-contract.sh b/ci/key-rotation-contract.sh old mode 100644 new mode 100755 diff --git a/ci/managed-artifact-contract.sh b/ci/managed-artifact-contract.sh old mode 100644 new mode 100755 diff --git a/ci/overlay-contract.sh b/ci/overlay-contract.sh old mode 100644 new mode 100755 diff --git a/ci/runtime-config-contract.sh b/ci/runtime-config-contract.sh old mode 100644 new mode 100755 diff --git a/ci/sitectl-version-contract.sh b/ci/sitectl-version-contract.sh old mode 100644 new mode 100755 diff --git a/ci/source-trust-contract.sh b/ci/source-trust-contract.sh old mode 100644 new mode 100755 diff --git a/ci/terraform-validate.sh b/ci/terraform-validate.sh old mode 100644 new mode 100755 index 66a38eb..39a9eb1 --- a/ci/terraform-validate.sh +++ b/ci/terraform-validate.sh @@ -93,6 +93,13 @@ validate_root() { init_status=$? fi if [[ "$attempt" -lt 3 ]]; then + # A truncated or otherwise corrupted download leaves a cached package + # that fails its lock file checksum on every future init that shares + # this plugin cache, in this directory and every later one in the same + # run. Clear it so the retry (and any later directory) re-downloads + # cleanly instead of repeatedly failing against the same bad cache + # entry. + rm -rf "${TF_PLUGIN_CACHE_DIR:?}"/* echo "terraform init failed in ${rel}; retrying in $((attempt * 10))s (attempt ${attempt}/3)" >&2 sleep $((attempt * 10)) fi @@ -156,7 +163,7 @@ main() { find "$repo_root" \ -path "*/.terraform" -prune -o \ -path "$repo_root/docs/site" -prune -o \ - -name "*.tf" -printf '%h\n' | + -name "*.tf" -exec dirname {} \; | sort -u ) diff --git a/ci/testdata/disaster-recovery/compose-apps.sh b/ci/testdata/disaster-recovery/compose-apps.sh old mode 100644 new mode 100755 diff --git a/ci/testdata/disaster-recovery/fake-docker.sh b/ci/testdata/disaster-recovery/fake-docker.sh old mode 100644 new mode 100755 diff --git a/ci/testdata/disaster-recovery/fake-install.sh b/ci/testdata/disaster-recovery/fake-install.sh old mode 100644 new mode 100755 diff --git a/ci/testdata/disaster-recovery/fake-stat.sh b/ci/testdata/disaster-recovery/fake-stat.sh old mode 100644 new mode 100755 diff --git a/ci/testdata/disaster-recovery/good-driver.sh b/ci/testdata/disaster-recovery/good-driver.sh old mode 100644 new mode 100755 diff --git a/ci/testdata/disaster-recovery/incomplete-driver.sh b/ci/testdata/disaster-recovery/incomplete-driver.sh old mode 100644 new mode 100755 diff --git a/ci/testdata/disaster-recovery/profile.sh b/ci/testdata/disaster-recovery/profile.sh old mode 100644 new mode 100755 diff --git a/ci/vault-runtime-contract.sh b/ci/vault-runtime-contract.sh old mode 100644 new mode 100755 diff --git a/internal/contracttest/testdata/cloud-smoke-lifecycle/ssh.sh b/internal/contracttest/testdata/cloud-smoke-lifecycle/ssh.sh old mode 100644 new mode 100755 diff --git a/modules/digitalocean/.terraform.lock.hcl b/modules/digitalocean/.terraform.lock.hcl new file mode 100644 index 0000000..0e72fe2 --- /dev/null +++ b/modules/digitalocean/.terraform.lock.hcl @@ -0,0 +1,47 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/digitalocean/digitalocean" { + version = "2.100.0" + constraints = "~> 2.0" + hashes = [ + "h1:WQ2ClvMwBILHDzWWhAm3LBRra4HkSe9taUlUGSLBNWI=", + "zh:021dbdacf7dd636cb66990964737bc4a6402160b5301e06b6fdab03a814f7e96", + "zh:083ff822b22738eedc9eae29aa5d4c369b2de921e49fefa9858a4e7c6274b0c1", + "zh:10695b5f7dbbe8ba1a20ac6bea1ab8613b43d2b1f6f9b53369bed296b2dff4d2", + "zh:110124b9d07cd1f0f2831ad27dfeb5a010a070952ea9a9e675ca3cfe158a0ffa", + "zh:409a8b22ffb9a53caf57d0a16f5f8ac0a2fcd61b6b0bcd512a685ea26cd06047", + "zh:488e4b494c198c0696c85d2c73c66c40567ca2ad5230bbd95d8ffdead86e646d", + "zh:4dd5b6e8c1be5fb619812fe738d0b49e0d24731fb290c0ab5190b7bc60c70e66", + "zh:6717fa7f623ad4c9b4d99acceffd1372d272ff02d7c98259dd17ec7ef11b836c", + "zh:7a25445caebd2e7f6ab2381578ecaf31744159a7e4a16476f19112d2e50d8519", + "zh:86b3d7050ba04ec7e0a14dbee8c0540fca8f4377fb072f87c88a6fcd26388714", + "zh:c23f30a38930c283055b6f04acbcad06cb0dd3c71c172eb23bb239f50dd12823", + "zh:d1f9c5be7f7d5c71830357bdd9c0fb529185e9380092e1b792f969495c943790", + "zh:d222573e7de8f9ad1c5b87a6c44c2dc59947c3968b3e70b7d4c76263d6c8fe5c", + "zh:e1f2d606661435416c4d2b48db80244d0acef88a5ce81b5dcbd65ff2642b1b4d", + "zh:ea13fad19414586864557601c59e85188601e150c815ec1e71f8ed83f1942a50", + "zh:f795be71dc933aaec7145f93068da17f227783964d33a79de591a042aac7c3ca", + ] +} + +provider "registry.terraform.io/hashicorp/http" { + version = "3.6.1" + constraints = "~> 3.6" + hashes = [ + "h1:T/CtN+30HmfgKsxgVTsee57V+lT+GY20INpjp91kRTc=", + "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", + "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:9c86821e99fcf1c9184087d73dd4940f14d10318d7229694fa61512c1216c279", + "zh:a0e08baf98384f7f20fe9beb2ca1acbbfb8bf71caaa33e49e35b584618648d46", + "zh:aaf767f5bf28a887c9c8f82a58b08275709642306b77c6b82c41c09aaa116390", + "zh:b0d189d11dbea1e2d2a31ee0c5cc215182e0448999bb5c1df0ef0e64e8aa3e74", + "zh:bdde65bcb27ba3f24a5ab7f455245709e8ae3dce2bcd8dbcb208ef4dc7f17a43", + "zh:c998032f00bb0cacc7f87e277f699ea3582ed86aee696a81af2eef8d5963b66b", + "zh:e40143fe7a2e8c4970190c77f82682a140a30de0340f0c8c57291ac22994d217", + "zh:e49ba3ff6244cbb30baa7a0e455d5652e4b650bf2a5459f9e6d349ef4503edeb", + "zh:e4ae6b4af472f90cd08a267f7120ac0f6e95af46486c3031564dd2a065aeda48", + "zh:f832598bbf437ea9d1dcfeeb527ca55c23137c724bb5400ff196a10e3bb3e53b", + ] +} diff --git a/modules/gcp/.terraform.lock.hcl b/modules/gcp/.terraform.lock.hcl new file mode 100644 index 0000000..3ea8064 --- /dev/null +++ b/modules/gcp/.terraform.lock.hcl @@ -0,0 +1,85 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/hashicorp/cloudinit" { + version = "2.4.0" + constraints = "~> 2.3" + hashes = [ + "h1:H74EkbLWyZxkKhz8inoi6HTZbPox2VYzAttFhUy8X7Y=", + "zh:1b0fe71b8e87a068f7cd9faaa733100ab72ab61ce812b8bd2b8e3e6ea3907b2d", + "zh:2aa9631ad64cfda1eb58f147619b631dadedfaf9453b422aa5ada2d3861183c1", + "zh:2c5f35463bdfb2f87d3576b81e62c30f8109e67bb6f21ffcbc46a855811455c0", + "zh:5970bcad151ea236bd262ada1a5a23bfbc1716f94a4e8b16ab2bcdda91d6a671", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:79a0676909732b6ec0441a733af6383513cde3bd2cef5c1ad0a74131e1286a04", + "zh:818f16141481a1202b3977becd19a12d4d46cd2e3f5753f5d0d0049adacf8f8c", + "zh:948d98716831087e69eca99f91ed7964cc537f3aca279f7494645ee56c9dc4ec", + "zh:a75e78889565a51df3e8e3af207e36e5ddb25e47ce1780a784c82dc3c3109b67", + "zh:a9c6e455d52b1bba5272bd87a35cfabcfd6d903dcbe42e2de926228dbb1e39b2", + "zh:b846805d8c2f5d1d6c2ffeeaf32109d9af7db7fa3c56929bfc1dcfaadf9c8bd8", + "zh:c3e5279756b46c4f49a6f4c81347fbe2fffebb2bf18a5c24664830304a1f6a8e", + "zh:c8be7b31893163d0046b0137a6100533f07e8efd192a1903b6bb4c42be12dceb", + ] +} + +provider "registry.terraform.io/hashicorp/google" { + version = "7.45.0" + constraints = "~> 7.0" + hashes = [ + "h1:snI9jfT+CtL8dH099NZCe79ciOSTuL74nPB7KaCf9pM=", + "zh:0f33485d068e39b1661d4ad789dfac353134b99cb5746e463e7719c053d70c06", + "zh:162335c448b15125924c3451dc0a411635138c00e36784d9586b9df61bc8a3d7", + "zh:172c9e4902e9a01b1111bbbb9063a47804ec5f4207b2221df9c398239ff3b350", + "zh:39acce0806f1aeca106ea529053778681e332f3f895c21c6a6a9fb267bed1058", + "zh:58dadd7b96b7b706e2995a04f356862be7cfd6b55f6257464c8b10986abf8efa", + "zh:7230a5e49abed243317b9de0ee7fd365b4a2775b532a5d66006b39c4703978ac", + "zh:a1b60814ee9a0726c0cd43d36da2cee3db97ec296ee66b111a7e603997de9122", + "zh:a454c09162ccd342e101704dca4b0eedc2d11939ac48ebd7b7d505a96c1933e6", + "zh:ad6fdf73e072f510a7d8e2b70f9e1021d08b9076eae146b420f333905708c982", + "zh:de1de65b909c99430f8bef092718b75dc5c777e98daf474a2215621f35095bb8", + "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c", + "zh:fb1b9d1ea7bc79b7409f02aa7c19ba39afa22dbead69e83ae7eb2691ac5c2426", + ] +} + +provider "registry.terraform.io/hashicorp/http" { + version = "3.6.1" + constraints = "~> 3.6" + hashes = [ + "h1:T/CtN+30HmfgKsxgVTsee57V+lT+GY20INpjp91kRTc=", + "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", + "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:9c86821e99fcf1c9184087d73dd4940f14d10318d7229694fa61512c1216c279", + "zh:a0e08baf98384f7f20fe9beb2ca1acbbfb8bf71caaa33e49e35b584618648d46", + "zh:aaf767f5bf28a887c9c8f82a58b08275709642306b77c6b82c41c09aaa116390", + "zh:b0d189d11dbea1e2d2a31ee0c5cc215182e0448999bb5c1df0ef0e64e8aa3e74", + "zh:bdde65bcb27ba3f24a5ab7f455245709e8ae3dce2bcd8dbcb208ef4dc7f17a43", + "zh:c998032f00bb0cacc7f87e277f699ea3582ed86aee696a81af2eef8d5963b66b", + "zh:e40143fe7a2e8c4970190c77f82682a140a30de0340f0c8c57291ac22994d217", + "zh:e49ba3ff6244cbb30baa7a0e455d5652e4b650bf2a5459f9e6d349ef4503edeb", + "zh:e4ae6b4af472f90cd08a267f7120ac0f6e95af46486c3031564dd2a065aeda48", + "zh:f832598bbf437ea9d1dcfeeb527ca55c23137c724bb5400ff196a10e3bb3e53b", + ] +} + +provider "registry.terraform.io/hashicorp/time" { + version = "0.14.1" + constraints = "~> 0.14" + hashes = [ + "h1:YRK+EoKey0ssT+VU2821si0k+fzPFHALvVnfe2atBlU=", + "zh:0837ca5b057e5cff94dff7de2fcccafb4abaa33c45de193fe2853e684818a267", + "zh:15a122f72d9e0f34fc5384cc7ec089319641fee5c319748a3aa02fc42f459969", + "zh:342fb83093a280ea7ee0654feae1f5867c62eb8eebc1ab46f9a7ab0b4c878a62", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:99f169834d3370b8341381c6a9c7a8b01fb26027531faa38e6fb49cc23916f68", + "zh:9f482917c7a28cf2436578be7aa9f04f8c811aba8b5949e0223ea987a2757a91", + "zh:ac6b5b8732826f2d1129a8a4a038ac7a7a9ca7b77d2a4608e5703be1a1e2bff0", + "zh:c54782a27d58ce04f6696c6fc0b2cf1e2fba6bed239fb520521a7bce7d7193cb", + "zh:c8d0ddc8f575ecb44f025d54edbfe118e26397fe328a67be62325766f31eb6e7", + "zh:d043b96f204edd2353bf6b2a34e645ffdee2e9634d9bb747331320444810a538", + "zh:e32c288501ca9a6c9d22b52e839dd391fc7083d54ee6b8dc296ce0e6bd3e57ef", + "zh:e47fcc7bb4e9ab5cc522c3b06e4fa9c0bf94b84be8210bc6b1655c44acb2addc", + "zh:f61bf218322bcbe0bd2d56bba738e7fa485e9b54244e13aa12de741b37d450c0", + ] +} diff --git a/modules/gcp/runtime_contracts.tftest.hcl b/modules/gcp/runtime_contracts.tftest.hcl index e1a70a5..8db813a 100644 --- a/modules/gcp/runtime_contracts.tftest.hcl +++ b/modules/gcp/runtime_contracts.tftest.hcl @@ -2,7 +2,7 @@ mock_provider "cloudinit" {} mock_provider "http" { mock_data "http" { defaults = { - response_body = "c33470299657aca69837d7ce2cee73659aa5fd9a3297dcaad4444b50b54cdde2\n" + response_body = "a0f4dac5a536d8e61c7367170b7afc2689838c4e3bf155b1cde2fe17032c06db\n" status_code = 200 } } @@ -580,7 +580,7 @@ run "renders_verified_archive_before_downstream_overlay" { override_data { target = data.http.rootfs_contract[0] values = { - response_body = "c33470299657aca69837d7ce2cee73659aa5fd9a3297dcaad4444b50b54cdde2\n" + response_body = "a0f4dac5a536d8e61c7367170b7afc2689838c4e3bf155b1cde2fe17032c06db\n" status_code = 200 } } @@ -765,7 +765,7 @@ run "rejects_archive_without_checksum" { override_data { target = data.http.rootfs_contract[0] values = { - response_body = "c33470299657aca69837d7ce2cee73659aa5fd9a3297dcaad4444b50b54cdde2\n" + response_body = "a0f4dac5a536d8e61c7367170b7afc2689838c4e3bf155b1cde2fe17032c06db\n" status_code = 200 } } diff --git a/modules/linode/.terraform.lock.hcl b/modules/linode/.terraform.lock.hcl new file mode 100644 index 0000000..2f90185 --- /dev/null +++ b/modules/linode/.terraform.lock.hcl @@ -0,0 +1,44 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/hashicorp/http" { + version = "3.6.1" + constraints = "~> 3.6" + hashes = [ + "h1:T/CtN+30HmfgKsxgVTsee57V+lT+GY20INpjp91kRTc=", + "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", + "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:9c86821e99fcf1c9184087d73dd4940f14d10318d7229694fa61512c1216c279", + "zh:a0e08baf98384f7f20fe9beb2ca1acbbfb8bf71caaa33e49e35b584618648d46", + "zh:aaf767f5bf28a887c9c8f82a58b08275709642306b77c6b82c41c09aaa116390", + "zh:b0d189d11dbea1e2d2a31ee0c5cc215182e0448999bb5c1df0ef0e64e8aa3e74", + "zh:bdde65bcb27ba3f24a5ab7f455245709e8ae3dce2bcd8dbcb208ef4dc7f17a43", + "zh:c998032f00bb0cacc7f87e277f699ea3582ed86aee696a81af2eef8d5963b66b", + "zh:e40143fe7a2e8c4970190c77f82682a140a30de0340f0c8c57291ac22994d217", + "zh:e49ba3ff6244cbb30baa7a0e455d5652e4b650bf2a5459f9e6d349ef4503edeb", + "zh:e4ae6b4af472f90cd08a267f7120ac0f6e95af46486c3031564dd2a065aeda48", + "zh:f832598bbf437ea9d1dcfeeb527ca55c23137c724bb5400ff196a10e3bb3e53b", + ] +} + +provider "registry.terraform.io/linode/linode" { + version = "4.3.0" + constraints = "~> 4.0" + hashes = [ + "h1:9f82B30cdnQ/f9MvBOJIIzPG63LQ7Rvy0bKyCxEOISM=", + "zh:010f08fa4dfbb77117ceac2629586941e262edc45c778659ae2a55c0b398ec23", + "zh:15a4ce678298eb17e67e22b7481a81991892804cc9f88a4883fc9eef30ab9437", + "zh:188828a08ce01de32a95f5f18d5db2cc86652fac03c85b20e8b83f615f2d37a0", + "zh:1a81ab9cebb8d1ff037345eb21eecaeecafc750c0a16a6b8d888a8cd0813bf58", + "zh:209a6aad0025d741e1a98d391cf2343901fcc626c3fbb070804ced02e7d6811c", + "zh:3bd23a831d03173799776da1ff451ada3539c879274ad78c99204a75edd1fbef", + "zh:60917b710106c5762111f90cbd356d0975db5b38d7e6ee4cafa821286a6030f8", + "zh:662844969f8af6194622b1f29f1f739b8b4539f25494011cf863c6ee1f029cad", + "zh:7d142f52374d71816be816c21d8fd35add09e28a97bca90b8ec19962ceee3327", + "zh:80cc8c523644e5379fe674665f067a74c860d2d0f78134d113af11bfe3485507", + "zh:b318a8f29e4e271594e39c2649536a9766c0a80e142a2b46cc72942d5317cc39", + "zh:c18ac394fe1b4e4f0818a9e2efb717032f6c8063d8c9efe8debdc63e763b0f25", + "zh:f3ad4cee92346805dfccf12a3b8044a4615dc9c1ffa9168e0a25240210235461", + ] +} diff --git a/modules/linux-vm-runtime/.terraform.lock.hcl b/modules/linux-vm-runtime/.terraform.lock.hcl new file mode 100644 index 0000000..7b94ff7 --- /dev/null +++ b/modules/linux-vm-runtime/.terraform.lock.hcl @@ -0,0 +1,23 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/hashicorp/http" { + version = "3.6.1" + constraints = "~> 3.6" + hashes = [ + "h1:T/CtN+30HmfgKsxgVTsee57V+lT+GY20INpjp91kRTc=", + "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", + "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:9c86821e99fcf1c9184087d73dd4940f14d10318d7229694fa61512c1216c279", + "zh:a0e08baf98384f7f20fe9beb2ca1acbbfb8bf71caaa33e49e35b584618648d46", + "zh:aaf767f5bf28a887c9c8f82a58b08275709642306b77c6b82c41c09aaa116390", + "zh:b0d189d11dbea1e2d2a31ee0c5cc215182e0448999bb5c1df0ef0e64e8aa3e74", + "zh:bdde65bcb27ba3f24a5ab7f455245709e8ae3dce2bcd8dbcb208ef4dc7f17a43", + "zh:c998032f00bb0cacc7f87e277f699ea3582ed86aee696a81af2eef8d5963b66b", + "zh:e40143fe7a2e8c4970190c77f82682a140a30de0340f0c8c57291ac22994d217", + "zh:e49ba3ff6244cbb30baa7a0e455d5652e4b650bf2a5459f9e6d349ef4503edeb", + "zh:e4ae6b4af472f90cd08a267f7120ac0f6e95af46486c3031564dd2a065aeda48", + "zh:f832598bbf437ea9d1dcfeeb527ca55c23137c724bb5400ff196a10e3bb3e53b", + ] +} diff --git a/modules/linux-vm-runtime/runtime_inputs.tftest.hcl b/modules/linux-vm-runtime/runtime_inputs.tftest.hcl index 50c478f..1b0ee17 100644 --- a/modules/linux-vm-runtime/runtime_inputs.tftest.hcl +++ b/modules/linux-vm-runtime/runtime_inputs.tftest.hcl @@ -1,7 +1,7 @@ mock_provider "http" { mock_data "http" { defaults = { - response_body = "c33470299657aca69837d7ce2cee73659aa5fd9a3297dcaad4444b50b54cdde2\n" + response_body = "a0f4dac5a536d8e61c7367170b7afc2689838c4e3bf155b1cde2fe17032c06db\n" status_code = 200 } } diff --git a/providers/do/.terraform.lock.hcl b/providers/do/.terraform.lock.hcl new file mode 100644 index 0000000..0e72fe2 --- /dev/null +++ b/providers/do/.terraform.lock.hcl @@ -0,0 +1,47 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/digitalocean/digitalocean" { + version = "2.100.0" + constraints = "~> 2.0" + hashes = [ + "h1:WQ2ClvMwBILHDzWWhAm3LBRra4HkSe9taUlUGSLBNWI=", + "zh:021dbdacf7dd636cb66990964737bc4a6402160b5301e06b6fdab03a814f7e96", + "zh:083ff822b22738eedc9eae29aa5d4c369b2de921e49fefa9858a4e7c6274b0c1", + "zh:10695b5f7dbbe8ba1a20ac6bea1ab8613b43d2b1f6f9b53369bed296b2dff4d2", + "zh:110124b9d07cd1f0f2831ad27dfeb5a010a070952ea9a9e675ca3cfe158a0ffa", + "zh:409a8b22ffb9a53caf57d0a16f5f8ac0a2fcd61b6b0bcd512a685ea26cd06047", + "zh:488e4b494c198c0696c85d2c73c66c40567ca2ad5230bbd95d8ffdead86e646d", + "zh:4dd5b6e8c1be5fb619812fe738d0b49e0d24731fb290c0ab5190b7bc60c70e66", + "zh:6717fa7f623ad4c9b4d99acceffd1372d272ff02d7c98259dd17ec7ef11b836c", + "zh:7a25445caebd2e7f6ab2381578ecaf31744159a7e4a16476f19112d2e50d8519", + "zh:86b3d7050ba04ec7e0a14dbee8c0540fca8f4377fb072f87c88a6fcd26388714", + "zh:c23f30a38930c283055b6f04acbcad06cb0dd3c71c172eb23bb239f50dd12823", + "zh:d1f9c5be7f7d5c71830357bdd9c0fb529185e9380092e1b792f969495c943790", + "zh:d222573e7de8f9ad1c5b87a6c44c2dc59947c3968b3e70b7d4c76263d6c8fe5c", + "zh:e1f2d606661435416c4d2b48db80244d0acef88a5ce81b5dcbd65ff2642b1b4d", + "zh:ea13fad19414586864557601c59e85188601e150c815ec1e71f8ed83f1942a50", + "zh:f795be71dc933aaec7145f93068da17f227783964d33a79de591a042aac7c3ca", + ] +} + +provider "registry.terraform.io/hashicorp/http" { + version = "3.6.1" + constraints = "~> 3.6" + hashes = [ + "h1:T/CtN+30HmfgKsxgVTsee57V+lT+GY20INpjp91kRTc=", + "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", + "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:9c86821e99fcf1c9184087d73dd4940f14d10318d7229694fa61512c1216c279", + "zh:a0e08baf98384f7f20fe9beb2ca1acbbfb8bf71caaa33e49e35b584618648d46", + "zh:aaf767f5bf28a887c9c8f82a58b08275709642306b77c6b82c41c09aaa116390", + "zh:b0d189d11dbea1e2d2a31ee0c5cc215182e0448999bb5c1df0ef0e64e8aa3e74", + "zh:bdde65bcb27ba3f24a5ab7f455245709e8ae3dce2bcd8dbcb208ef4dc7f17a43", + "zh:c998032f00bb0cacc7f87e277f699ea3582ed86aee696a81af2eef8d5963b66b", + "zh:e40143fe7a2e8c4970190c77f82682a140a30de0340f0c8c57291ac22994d217", + "zh:e49ba3ff6244cbb30baa7a0e455d5652e4b650bf2a5459f9e6d349ef4503edeb", + "zh:e4ae6b4af472f90cd08a267f7120ac0f6e95af46486c3031564dd2a065aeda48", + "zh:f832598bbf437ea9d1dcfeeb527ca55c23137c724bb5400ff196a10e3bb3e53b", + ] +} diff --git a/providers/do/template_versions.tftest.hcl b/providers/do/template_versions.tftest.hcl index a577a17..cf02fa9 100644 --- a/providers/do/template_versions.tftest.hcl +++ b/providers/do/template_versions.tftest.hcl @@ -6,7 +6,7 @@ run "custom_package_set_merges_only_applicable_template_versions" { override_data { target = module.digitalocean.module.runtime.data.http.rootfs_contract[0] values = { - response_body = "c33470299657aca69837d7ce2cee73659aa5fd9a3297dcaad4444b50b54cdde2\n" + response_body = "a0f4dac5a536d8e61c7367170b7afc2689838c4e3bf155b1cde2fe17032c06db\n" status_code = 200 } } @@ -52,7 +52,7 @@ run "explicit_core_only_package_set_disables_template_plugins" { override_data { target = module.digitalocean.module.runtime.data.http.rootfs_contract[0] values = { - response_body = "c33470299657aca69837d7ce2cee73659aa5fd9a3297dcaad4444b50b54cdde2\n" + response_body = "a0f4dac5a536d8e61c7367170b7afc2689838c4e3bf155b1cde2fe17032c06db\n" status_code = 200 } } diff --git a/providers/linode/.terraform.lock.hcl b/providers/linode/.terraform.lock.hcl new file mode 100644 index 0000000..2f90185 --- /dev/null +++ b/providers/linode/.terraform.lock.hcl @@ -0,0 +1,44 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/hashicorp/http" { + version = "3.6.1" + constraints = "~> 3.6" + hashes = [ + "h1:T/CtN+30HmfgKsxgVTsee57V+lT+GY20INpjp91kRTc=", + "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", + "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:9c86821e99fcf1c9184087d73dd4940f14d10318d7229694fa61512c1216c279", + "zh:a0e08baf98384f7f20fe9beb2ca1acbbfb8bf71caaa33e49e35b584618648d46", + "zh:aaf767f5bf28a887c9c8f82a58b08275709642306b77c6b82c41c09aaa116390", + "zh:b0d189d11dbea1e2d2a31ee0c5cc215182e0448999bb5c1df0ef0e64e8aa3e74", + "zh:bdde65bcb27ba3f24a5ab7f455245709e8ae3dce2bcd8dbcb208ef4dc7f17a43", + "zh:c998032f00bb0cacc7f87e277f699ea3582ed86aee696a81af2eef8d5963b66b", + "zh:e40143fe7a2e8c4970190c77f82682a140a30de0340f0c8c57291ac22994d217", + "zh:e49ba3ff6244cbb30baa7a0e455d5652e4b650bf2a5459f9e6d349ef4503edeb", + "zh:e4ae6b4af472f90cd08a267f7120ac0f6e95af46486c3031564dd2a065aeda48", + "zh:f832598bbf437ea9d1dcfeeb527ca55c23137c724bb5400ff196a10e3bb3e53b", + ] +} + +provider "registry.terraform.io/linode/linode" { + version = "4.3.0" + constraints = "~> 4.0" + hashes = [ + "h1:9f82B30cdnQ/f9MvBOJIIzPG63LQ7Rvy0bKyCxEOISM=", + "zh:010f08fa4dfbb77117ceac2629586941e262edc45c778659ae2a55c0b398ec23", + "zh:15a4ce678298eb17e67e22b7481a81991892804cc9f88a4883fc9eef30ab9437", + "zh:188828a08ce01de32a95f5f18d5db2cc86652fac03c85b20e8b83f615f2d37a0", + "zh:1a81ab9cebb8d1ff037345eb21eecaeecafc750c0a16a6b8d888a8cd0813bf58", + "zh:209a6aad0025d741e1a98d391cf2343901fcc626c3fbb070804ced02e7d6811c", + "zh:3bd23a831d03173799776da1ff451ada3539c879274ad78c99204a75edd1fbef", + "zh:60917b710106c5762111f90cbd356d0975db5b38d7e6ee4cafa821286a6030f8", + "zh:662844969f8af6194622b1f29f1f739b8b4539f25494011cf863c6ee1f029cad", + "zh:7d142f52374d71816be816c21d8fd35add09e28a97bca90b8ec19962ceee3327", + "zh:80cc8c523644e5379fe674665f067a74c860d2d0f78134d113af11bfe3485507", + "zh:b318a8f29e4e271594e39c2649536a9766c0a80e142a2b46cc72942d5317cc39", + "zh:c18ac394fe1b4e4f0818a9e2efb717032f6c8063d8c9efe8debdc63e763b0f25", + "zh:f3ad4cee92346805dfccf12a3b8044a4615dc9c1ffa9168e0a25240210235461", + ] +} diff --git a/providers/linode/template_versions.tftest.hcl b/providers/linode/template_versions.tftest.hcl index d32bfc8..7fb2137 100644 --- a/providers/linode/template_versions.tftest.hcl +++ b/providers/linode/template_versions.tftest.hcl @@ -6,7 +6,7 @@ run "custom_package_set_merges_only_applicable_template_versions" { override_data { target = module.linode.module.runtime.data.http.rootfs_contract[0] values = { - response_body = "c33470299657aca69837d7ce2cee73659aa5fd9a3297dcaad4444b50b54cdde2\n" + response_body = "a0f4dac5a536d8e61c7367170b7afc2689838c4e3bf155b1cde2fe17032c06db\n" status_code = 200 } } @@ -57,7 +57,7 @@ run "explicit_core_only_package_set_disables_template_plugins" { override_data { target = module.linode.module.runtime.data.http.rootfs_contract[0] values = { - response_body = "c33470299657aca69837d7ce2cee73659aa5fd9a3297dcaad4444b50b54cdde2\n" + response_body = "a0f4dac5a536d8e61c7367170b7afc2689838c4e3bf155b1cde2fe17032c06db\n" status_code = 200 } } diff --git a/rootfs/home/cloud-compose/app-init.sh b/rootfs/home/cloud-compose/app-init.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/app-rollout.sh b/rootfs/home/cloud-compose/app-rollout.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/assert-app-initialized.sh b/rootfs/home/cloud-compose/assert-app-initialized.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/assert-vault-ready.sh b/rootfs/home/cloud-compose/assert-vault-ready.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/bootstrap-helpers.sh b/rootfs/home/cloud-compose/bootstrap-helpers.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/compose-apps.sh b/rootfs/home/cloud-compose/compose-apps.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/compose-dispatch.sh b/rootfs/home/cloud-compose/compose-dispatch.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/configure-metadata-firewall.sh b/rootfs/home/cloud-compose/configure-metadata-firewall.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/converge-app-filesystems.sh b/rootfs/home/cloud-compose/converge-app-filesystems.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/default-lifecycle.sh b/rootfs/home/cloud-compose/default-lifecycle.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/deploy-rollout.sh b/rootfs/home/cloud-compose/deploy-rollout.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/disaster-recovery-lib.sh b/rootfs/home/cloud-compose/disaster-recovery-lib.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/host-conf.sh b/rootfs/home/cloud-compose/host-conf.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/host-init.sh b/rootfs/home/cloud-compose/host-init.sh old mode 100644 new mode 100755 index 1799a99..fe4fe40 --- a/rootfs/home/cloud-compose/host-init.sh +++ b/rootfs/home/cloud-compose/host-init.sh @@ -107,8 +107,23 @@ for runtime_input in .env compose-projects.json application-env.json; do fi done groupadd --force docker +# Pin a fixed UID/GID for cloud-compose. useradd's default dynamic allocation +# picks the next free ID in the base image at creation time, which is not +# stable across VM replacements on providers whose root filesystem (and +# therefore /etc/passwd) does not persist across boots. A cloud-compose +# account recreated with a different UID cannot read or write anything it +# previously owned on the persistent data disk, breaking Compose bootstrap. +# Chosen well outside the default useradd/groupadd auto-allocation range +# (commonly capped under 60000) and Docker's default subuid/subgid remap +# range (typically starting at 100000), to minimize collision risk across +# arbitrary base images and providers. +readonly cloud_compose_uid=770077 +readonly cloud_compose_gid=770077 +groupadd --force --gid "$cloud_compose_gid" cloud-compose if ! id -u cloud-compose >/dev/null 2>&1; then - useradd --create-home --shell /bin/bash --groups docker cloud-compose + useradd --create-home --shell /bin/bash \ + --uid "$cloud_compose_uid" --gid "$cloud_compose_gid" \ + --groups docker cloud-compose elif ! id -nG cloud-compose | tr ' ' '\n' | grep -qx docker; then usermod --append --groups docker cloud-compose || { echo "Warning: failed to add cloud-compose to docker group" >&2 diff --git a/rootfs/home/cloud-compose/install-dependencies-coreos.sh b/rootfs/home/cloud-compose/install-dependencies-coreos.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/install-dependencies-cos.sh b/rootfs/home/cloud-compose/install-dependencies-cos.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/install-dependencies-debian.sh b/rootfs/home/cloud-compose/install-dependencies-debian.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/install-dependencies.sh b/rootfs/home/cloud-compose/install-dependencies.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/install-docker-plugins.sh b/rootfs/home/cloud-compose/install-docker-plugins.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/libops-managed-runtime.sh b/rootfs/home/cloud-compose/libops-managed-runtime.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/lifecycle-entrypoint.sh b/rootfs/home/cloud-compose/lifecycle-entrypoint.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/mariadb-backup.sh b/rootfs/home/cloud-compose/mariadb-backup.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/offhost-backup.sh b/rootfs/home/cloud-compose/offhost-backup.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/overlay-init.sh b/rootfs/home/cloud-compose/overlay-init.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/prepare-app-sources.sh b/rootfs/home/cloud-compose/prepare-app-sources.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/prepare-filesystem.sh b/rootfs/home/cloud-compose/prepare-filesystem.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/profile.sh b/rootfs/home/cloud-compose/profile.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/restore-test.sh b/rootfs/home/cloud-compose/restore-test.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/rotate-keys-app.sh b/rootfs/home/cloud-compose/rotate-keys-app.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/rotate-keys-daily.sh b/rootfs/home/cloud-compose/rotate-keys-daily.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/rotate-keys-internal.sh b/rootfs/home/cloud-compose/rotate-keys-internal.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/rotate-keys.sh b/rootfs/home/cloud-compose/rotate-keys.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/run-bootstrap.sh b/rootfs/home/cloud-compose/run-bootstrap.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/run-rollout-service.sh b/rootfs/home/cloud-compose/run-rollout-service.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/run.sh b/rootfs/home/cloud-compose/run.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/start-cloud-compose-bootstrap.sh b/rootfs/home/cloud-compose/start-cloud-compose-bootstrap.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/vault-agent-init.sh b/rootfs/home/cloud-compose/vault-agent-init.sh old mode 100644 new mode 100755 diff --git a/rootfs/home/cloud-compose/vault-agent-readiness.sh b/rootfs/home/cloud-compose/vault-agent-readiness.sh old mode 100644 new mode 100755 From 26ba28e5cf6ae161760d56baac0abcb74c50b76c Mon Sep 17 00:00:00 2001 From: Joe Corall Date: Wed, 19 Aug 2026 08:50:53 -0400 Subject: [PATCH 2/6] fixup --- AGENTS.md | 69 ++++++++++++++++++++ modules/digitalocean/.terraform.lock.hcl | 2 + modules/gcp/.terraform.lock.hcl | 4 ++ modules/linode/.terraform.lock.hcl | 2 + modules/linux-vm-runtime/.terraform.lock.hcl | 1 + providers/do/.terraform.lock.hcl | 2 + providers/linode/.terraform.lock.hcl | 2 + 7 files changed, 82 insertions(+) create mode 100644 AGENTS.md diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..5823f1d --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,69 @@ +# cloud-compose repository instructions + +This file is the concise entry point for agents and contributors. Start at +[docs/index.md](docs/index.md) for architecture, then +[docs/runtime-contracts.md](docs/runtime-contracts.md) for the trust boundary +this module enforces. + +## Required contract + +```bash +make lint-check +``` + +This runs `terraform fmt -check`, `actionlint`, the shell contract suite, and +`terraform-validate` (init + validate + test) across every directory in the +repo that contains `.tf` files. + +## Local `.terraform.lock.hcl` drift on a machine that hasn't touched a +## directory's providers yet + +`terraform-validate` will fail with `missing or corrupted provider plugins: +... does not match any of the checksums recorded in the dependency lock +file` the first time you run it from a machine/architecture whose provider +fetch path hasn't previously contributed a hash to that directory's lock +file. This is not corruption and not a network problem: HashiCorp's registry +can legitimately serve a byte-different (but equally valid, signed) archive +for the same provider version depending on which CDN edge answers the +request, and Terraform's `h1:` package hash is computed from that archive's +contents. `.terraform.lock.hcl` supports recording multiple valid `h1:` +hashes per version specifically for this; a plain `terraform init` refuses to +silently trust an unrecorded hash (that refusal is the actual integrity +protection working as intended), while `-upgrade` recomputes and appends the +new legitimate one. + +The repo has more than one directory with its own `.tf` files and its own +`.terraform.lock.hcl` (root, `providers/*`, `modules/*`, `examples/*`, +`tests/smoke/*`). A lock file only picks up a new machine's hash for the +providers *that specific directory* declares, so hitting this in one +directory does not fix it anywhere else. If you hit this failure — most +likely the first time you run `terraform-validate` locally on a machine that +hasn't run it before (a new contributor, a new laptop, or after switching +architectures) — update every directory's lock file in one pass rather than +chasing failures one at a time: + +```bash +for dir in $(find . -path "*/.terraform" -prune -o -path "./docs/site" -prune -o -name "*.tf" -exec dirname {} \; | sort -u); do + echo "=== $dir ===" + (cd "$dir" && terraform init -backend=false -upgrade -input=false >/dev/null && echo ok) +done +git status --short +``` + +Commit the resulting `.terraform.lock.hcl` changes alongside your actual +change — recording the additional legitimate hash for cross-platform (Mac + +Linux CI) contributors is expected, not scope creep. Then rerun +`bash ci/terraform-validate.sh` to confirm every directory is clean before +declaring the change complete. + +## macOS-specific local caveats + +- `ci/application-env-contract.sh` deliberately runs part of its check under + `env -i PATH=/usr/bin:/bin bash --noprofile --norc -c '...'` to exercise + the application-env trust boundary under a minimal, untrusted-style + environment. On macOS, `/bin/bash` (and `/usr/bin/bash`) is always the + frozen GPLv2 bash 3.2.57 system shell, regardless of what modern bash you + have installed via Homebrew or earlier in your `PATH` — that hardcoded + `PATH` inside the check ignores your shell entirely. This is expected and + cannot be fixed by installing a newer bash; run this specific check inside + a Linux container if you need to reproduce it locally, or trust CI for it. diff --git a/modules/digitalocean/.terraform.lock.hcl b/modules/digitalocean/.terraform.lock.hcl index 0e72fe2..a43859a 100644 --- a/modules/digitalocean/.terraform.lock.hcl +++ b/modules/digitalocean/.terraform.lock.hcl @@ -5,6 +5,7 @@ provider "registry.terraform.io/digitalocean/digitalocean" { version = "2.100.0" constraints = "~> 2.0" hashes = [ + "h1:9VsRnY7rmGiMFVG4ix3ry2fx8B8d7l9PyEpmGjjiW3I=", "h1:WQ2ClvMwBILHDzWWhAm3LBRra4HkSe9taUlUGSLBNWI=", "zh:021dbdacf7dd636cb66990964737bc4a6402160b5301e06b6fdab03a814f7e96", "zh:083ff822b22738eedc9eae29aa5d4c369b2de921e49fefa9858a4e7c6274b0c1", @@ -30,6 +31,7 @@ provider "registry.terraform.io/hashicorp/http" { constraints = "~> 3.6" hashes = [ "h1:T/CtN+30HmfgKsxgVTsee57V+lT+GY20INpjp91kRTc=", + "h1:uEqqVV3ui6Zr0k/lqyjvHM0Lg267qMMji+ux7wPfJXI=", "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", diff --git a/modules/gcp/.terraform.lock.hcl b/modules/gcp/.terraform.lock.hcl index 3ea8064..6230b2b 100644 --- a/modules/gcp/.terraform.lock.hcl +++ b/modules/gcp/.terraform.lock.hcl @@ -5,6 +5,7 @@ provider "registry.terraform.io/hashicorp/cloudinit" { version = "2.4.0" constraints = "~> 2.3" hashes = [ + "h1:4fp7byXJGbOU8zqxFM4yYGHzf1kUH8ChT41KK4n9q98=", "h1:H74EkbLWyZxkKhz8inoi6HTZbPox2VYzAttFhUy8X7Y=", "zh:1b0fe71b8e87a068f7cd9faaa733100ab72ab61ce812b8bd2b8e3e6ea3907b2d", "zh:2aa9631ad64cfda1eb58f147619b631dadedfaf9453b422aa5ada2d3861183c1", @@ -26,6 +27,7 @@ provider "registry.terraform.io/hashicorp/google" { version = "7.45.0" constraints = "~> 7.0" hashes = [ + "h1:FGFsRBzfeyq56BUAcb/WT676NieMX3NRfR4DBj2eEqk=", "h1:snI9jfT+CtL8dH099NZCe79ciOSTuL74nPB7KaCf9pM=", "zh:0f33485d068e39b1661d4ad789dfac353134b99cb5746e463e7719c053d70c06", "zh:162335c448b15125924c3451dc0a411635138c00e36784d9586b9df61bc8a3d7", @@ -47,6 +49,7 @@ provider "registry.terraform.io/hashicorp/http" { constraints = "~> 3.6" hashes = [ "h1:T/CtN+30HmfgKsxgVTsee57V+lT+GY20INpjp91kRTc=", + "h1:uEqqVV3ui6Zr0k/lqyjvHM0Lg267qMMji+ux7wPfJXI=", "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", @@ -68,6 +71,7 @@ provider "registry.terraform.io/hashicorp/time" { constraints = "~> 0.14" hashes = [ "h1:YRK+EoKey0ssT+VU2821si0k+fzPFHALvVnfe2atBlU=", + "h1:r93SxP++6gUlwCHDQ5OkRmcU8B0yv6ZA9nF0Dh6NJmA=", "zh:0837ca5b057e5cff94dff7de2fcccafb4abaa33c45de193fe2853e684818a267", "zh:15a122f72d9e0f34fc5384cc7ec089319641fee5c319748a3aa02fc42f459969", "zh:342fb83093a280ea7ee0654feae1f5867c62eb8eebc1ab46f9a7ab0b4c878a62", diff --git a/modules/linode/.terraform.lock.hcl b/modules/linode/.terraform.lock.hcl index 2f90185..6f72a18 100644 --- a/modules/linode/.terraform.lock.hcl +++ b/modules/linode/.terraform.lock.hcl @@ -6,6 +6,7 @@ provider "registry.terraform.io/hashicorp/http" { constraints = "~> 3.6" hashes = [ "h1:T/CtN+30HmfgKsxgVTsee57V+lT+GY20INpjp91kRTc=", + "h1:uEqqVV3ui6Zr0k/lqyjvHM0Lg267qMMji+ux7wPfJXI=", "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", @@ -27,6 +28,7 @@ provider "registry.terraform.io/linode/linode" { constraints = "~> 4.0" hashes = [ "h1:9f82B30cdnQ/f9MvBOJIIzPG63LQ7Rvy0bKyCxEOISM=", + "h1:NFvTyf4HvB5XENiZTNfRhysfLqc/yfnrw34nldk2+Bo=", "zh:010f08fa4dfbb77117ceac2629586941e262edc45c778659ae2a55c0b398ec23", "zh:15a4ce678298eb17e67e22b7481a81991892804cc9f88a4883fc9eef30ab9437", "zh:188828a08ce01de32a95f5f18d5db2cc86652fac03c85b20e8b83f615f2d37a0", diff --git a/modules/linux-vm-runtime/.terraform.lock.hcl b/modules/linux-vm-runtime/.terraform.lock.hcl index 7b94ff7..9e5d634 100644 --- a/modules/linux-vm-runtime/.terraform.lock.hcl +++ b/modules/linux-vm-runtime/.terraform.lock.hcl @@ -6,6 +6,7 @@ provider "registry.terraform.io/hashicorp/http" { constraints = "~> 3.6" hashes = [ "h1:T/CtN+30HmfgKsxgVTsee57V+lT+GY20INpjp91kRTc=", + "h1:uEqqVV3ui6Zr0k/lqyjvHM0Lg267qMMji+ux7wPfJXI=", "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", diff --git a/providers/do/.terraform.lock.hcl b/providers/do/.terraform.lock.hcl index 0e72fe2..a43859a 100644 --- a/providers/do/.terraform.lock.hcl +++ b/providers/do/.terraform.lock.hcl @@ -5,6 +5,7 @@ provider "registry.terraform.io/digitalocean/digitalocean" { version = "2.100.0" constraints = "~> 2.0" hashes = [ + "h1:9VsRnY7rmGiMFVG4ix3ry2fx8B8d7l9PyEpmGjjiW3I=", "h1:WQ2ClvMwBILHDzWWhAm3LBRra4HkSe9taUlUGSLBNWI=", "zh:021dbdacf7dd636cb66990964737bc4a6402160b5301e06b6fdab03a814f7e96", "zh:083ff822b22738eedc9eae29aa5d4c369b2de921e49fefa9858a4e7c6274b0c1", @@ -30,6 +31,7 @@ provider "registry.terraform.io/hashicorp/http" { constraints = "~> 3.6" hashes = [ "h1:T/CtN+30HmfgKsxgVTsee57V+lT+GY20INpjp91kRTc=", + "h1:uEqqVV3ui6Zr0k/lqyjvHM0Lg267qMMji+ux7wPfJXI=", "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", diff --git a/providers/linode/.terraform.lock.hcl b/providers/linode/.terraform.lock.hcl index 2f90185..6f72a18 100644 --- a/providers/linode/.terraform.lock.hcl +++ b/providers/linode/.terraform.lock.hcl @@ -6,6 +6,7 @@ provider "registry.terraform.io/hashicorp/http" { constraints = "~> 3.6" hashes = [ "h1:T/CtN+30HmfgKsxgVTsee57V+lT+GY20INpjp91kRTc=", + "h1:uEqqVV3ui6Zr0k/lqyjvHM0Lg267qMMji+ux7wPfJXI=", "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", @@ -27,6 +28,7 @@ provider "registry.terraform.io/linode/linode" { constraints = "~> 4.0" hashes = [ "h1:9f82B30cdnQ/f9MvBOJIIzPG63LQ7Rvy0bKyCxEOISM=", + "h1:NFvTyf4HvB5XENiZTNfRhysfLqc/yfnrw34nldk2+Bo=", "zh:010f08fa4dfbb77117ceac2629586941e262edc45c778659ae2a55c0b398ec23", "zh:15a4ce678298eb17e67e22b7481a81991892804cc9f88a4883fc9eef30ab9437", "zh:188828a08ce01de32a95f5f18d5db2cc86652fac03c85b20e8b83f615f2d37a0", From 287dfd2d6c4c9c0b46e5f43c5501bdc42f5f5ba9 Mon Sep 17 00:00:00 2001 From: Joe Corall <1189940+joecorall@users.noreply.github.com> Date: Wed, 19 Aug 2026 13:07:21 +0000 Subject: [PATCH 3/6] [patch] Retry the whole init+validate+test sequence on provider cache corruption The previous retry loop only wrapped terraform init. A shared plugin cache dir can let init install a package without fully re-verifying it against a given directory's lock file; a truncated or otherwise corrupted cache entry then only surfaces later, when validate or test actually loads the provider plugin binary. Since validate/test had no retry wrapper at all, a corrupted cache entry failed CI immediately and permanently for that run, in a single unretried attempt. Wrap the whole init+validate(+provider-graph+test) sequence in the same 3-attempt retry loop, purging the shared plugin cache between attempts, so a corruption discovered at any step gets a clean re-download on the next attempt instead of failing the run outright. --- ci/terraform-validate.sh | 54 ++++++++++++++++++++-------------------- 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/ci/terraform-validate.sh b/ci/terraform-validate.sh index 39a9eb1..9212e83 100755 --- a/ci/terraform-validate.sh +++ b/ci/terraform-validate.sh @@ -84,42 +84,42 @@ validate_root() { echo "Validating Terraform in ${rel}" - init_status=0 + # A shared plugin cache can let `terraform init` install a package without + # fully re-verifying it against this directory's lock file; a truncated or + # otherwise corrupted cache entry then only surfaces later, when validate + # or test actually loads the provider plugin. Retry the whole + # init+validate(+test) sequence together and purge the cache between + # attempts, rather than only wrapping init, so a corrupted entry discovered + # at any step gets a clean re-download on the next attempt. for attempt in 1 2 3; do - if TF_DATA_DIR="$data_dir" terraform -chdir="$root" init "${init_args[@]}" >/dev/null; then - init_status=0 + init_status=0 + TF_DATA_DIR="$data_dir" terraform -chdir="$root" init "${init_args[@]}" >/dev/null || init_status=$? + + validate_status=0 + if [[ "$init_status" -eq 0 ]]; then + TF_DATA_DIR="$data_dir" terraform -chdir="$root" validate -no-color || validate_status=$? + fi + + provider_status=0 + if [[ "$init_status" -eq 0 && "$validate_status" -eq 0 ]]; then + validate_public_provider_graph "$root" "$data_dir" "$rel" || provider_status=$? + fi + + test_status=0 + if [[ "$init_status" -eq 0 && "$validate_status" -eq 0 && "$provider_status" -eq 0 ]] && find "$root" -maxdepth 1 -name '*.tftest.hcl' -print -quit | grep -q .; then + TF_DATA_DIR="$data_dir" terraform -chdir="$root" test -no-color || test_status=$? + fi + + if [[ "$init_status" -eq 0 && "$validate_status" -eq 0 && "$provider_status" -eq 0 && "$test_status" -eq 0 ]]; then break - else - init_status=$? fi if [[ "$attempt" -lt 3 ]]; then - # A truncated or otherwise corrupted download leaves a cached package - # that fails its lock file checksum on every future init that shares - # this plugin cache, in this directory and every later one in the same - # run. Clear it so the retry (and any later directory) re-downloads - # cleanly instead of repeatedly failing against the same bad cache - # entry. rm -rf "${TF_PLUGIN_CACHE_DIR:?}"/* - echo "terraform init failed in ${rel}; retrying in $((attempt * 10))s (attempt ${attempt}/3)" >&2 + echo "Terraform validation failed in ${rel}; retrying in $((attempt * 10))s (attempt ${attempt}/3)" >&2 sleep $((attempt * 10)) fi done - validate_status=0 - if [[ "$init_status" -eq 0 ]]; then - TF_DATA_DIR="$data_dir" terraform -chdir="$root" validate -no-color || validate_status=$? - fi - - provider_status=0 - if [[ "$init_status" -eq 0 && "$validate_status" -eq 0 ]]; then - validate_public_provider_graph "$root" "$data_dir" "$rel" || provider_status=$? - fi - - test_status=0 - if [[ "$init_status" -eq 0 && "$validate_status" -eq 0 && "$provider_status" -eq 0 ]] && find "$root" -maxdepth 1 -name '*.tftest.hcl' -print -quit | grep -q .; then - TF_DATA_DIR="$data_dir" terraform -chdir="$root" test -no-color || test_status=$? - fi - if [[ "$created_lock" == "true" ]]; then rm -f "$lockfile" fi From a5dc8543a3c9129ce95a30714141bbc6257da1cc Mon Sep 17 00:00:00 2001 From: Joe Corall <1189940+joecorall@users.noreply.github.com> Date: Wed, 19 Aug 2026 13:20:17 +0000 Subject: [PATCH 4/6] [patch] Diagnose the exact provider hash a failing environment needs The retry loop fixed in the previous commit still fails identically across all 3 clean attempts in CI, which rules out a truncated/transient corrupted download: retrying a genuinely truncated fetch would not fail the same way every time. This points to the CI environment's install path consistently producing a package hash the lock file does not have at all, not intermittent corruption. On a final failure, diagnose without guessing: run terraform init -upgrade against a scratch copy of the lock file and print only the diff, so the CI log shows the exact hash line this environment needs. Restore the real lock file afterward so the diagnostic run cannot alter the committed dependency pins on its own. --- ci/terraform-validate.sh | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/ci/terraform-validate.sh b/ci/terraform-validate.sh index 9212e83..a21e6a9 100755 --- a/ci/terraform-validate.sh +++ b/ci/terraform-validate.sh @@ -63,7 +63,7 @@ validate_public_provider_graph() { validate_root() { local root="$1" data_root="$2" - local rel data_dir lockfile created_lock init_status validate_status provider_status test_status + local rel data_dir lockfile lockfile_backup created_lock init_status validate_status provider_status test_status local -a init_args rel="${root#"$repo_root"/}" @@ -120,6 +120,25 @@ validate_root() { fi done + if [[ "$init_status" -ne 0 || "$validate_status" -ne 0 ]] && [[ -f "$lockfile" ]]; then + # Identical failure across clean retries in the same job means this + # environment's install path is producing a package hash the lock file + # genuinely does not have, not a truncated/transient download. Diagnose + # what hash this exact environment needs without mutating the real lock + # file: upgrade a scratch copy and print only the added hash lines. + echo "Diagnosing the required provider hash for this environment (not applied to the repository's lock file):" >&2 + lockfile_backup="$(mktemp)" + cp "$lockfile" "$lockfile_backup" + rm -rf "${TF_PLUGIN_CACHE_DIR:?}"/* + if TF_DATA_DIR="$data_dir" terraform -chdir="$root" init -backend=false -input=false -upgrade >/dev/null 2>&1; then + diff "$lockfile_backup" "$lockfile" >&2 || true + else + echo " (diagnostic upgrade attempt also failed to complete)" >&2 + fi + cp "$lockfile_backup" "$lockfile" + rm -f "$lockfile_backup" + fi + if [[ "$created_lock" == "true" ]]; then rm -f "$lockfile" fi From d16323a7067736d407d6a27f5d199933c26c9c72 Mon Sep 17 00:00:00 2001 From: Joe Corall <1189940+joecorall@users.noreply.github.com> Date: Wed, 19 Aug 2026 13:32:48 +0000 Subject: [PATCH 5/6] [patch] Revert the diagnostic upgrade attempt It added an unconditional 4th terraform init call whenever the retry loop exhausted its attempts, which broke ci/terraform-validate-contract.sh: that contract asserts exactly three init calls and no validate/test calls when init fails every time. The diagnostic also wasn't the right layer for this - the CI failure it was meant to explain (identical corruption across three clean, cache-purged retries in the same job) already rules out truncated/transient downloads on its own; getting the exact hash needs a different approach than instrumenting this shared, contract-tested script. --- ci/terraform-validate.sh | 21 +-------------------- 1 file changed, 1 insertion(+), 20 deletions(-) diff --git a/ci/terraform-validate.sh b/ci/terraform-validate.sh index a21e6a9..9212e83 100755 --- a/ci/terraform-validate.sh +++ b/ci/terraform-validate.sh @@ -63,7 +63,7 @@ validate_public_provider_graph() { validate_root() { local root="$1" data_root="$2" - local rel data_dir lockfile lockfile_backup created_lock init_status validate_status provider_status test_status + local rel data_dir lockfile created_lock init_status validate_status provider_status test_status local -a init_args rel="${root#"$repo_root"/}" @@ -120,25 +120,6 @@ validate_root() { fi done - if [[ "$init_status" -ne 0 || "$validate_status" -ne 0 ]] && [[ -f "$lockfile" ]]; then - # Identical failure across clean retries in the same job means this - # environment's install path is producing a package hash the lock file - # genuinely does not have, not a truncated/transient download. Diagnose - # what hash this exact environment needs without mutating the real lock - # file: upgrade a scratch copy and print only the added hash lines. - echo "Diagnosing the required provider hash for this environment (not applied to the repository's lock file):" >&2 - lockfile_backup="$(mktemp)" - cp "$lockfile" "$lockfile_backup" - rm -rf "${TF_PLUGIN_CACHE_DIR:?}"/* - if TF_DATA_DIR="$data_dir" terraform -chdir="$root" init -backend=false -input=false -upgrade >/dev/null 2>&1; then - diff "$lockfile_backup" "$lockfile" >&2 || true - else - echo " (diagnostic upgrade attempt also failed to complete)" >&2 - fi - cp "$lockfile_backup" "$lockfile" - rm -f "$lockfile_backup" - fi - if [[ "$created_lock" == "true" ]]; then rm -f "$lockfile" fi From 55b2eff3802359f065c5cc2288e79e8a495ec4f7 Mon Sep 17 00:00:00 2001 From: Joe Corall <1189940+joecorall@users.noreply.github.com> Date: Wed, 19 Aug 2026 13:44:18 +0000 Subject: [PATCH 6/6] [patch] Lock provider checksums for every supported platform Every prior attempt at this only added the hash one specific machine's `terraform init -upgrade` happened to compute (Mac, a Linux sandbox), which meant it only ever fixed whichever platform ran it. CI's Terraform lint job pins terraform_version 1.14.6 on linux_amd64, a combination none of those runs matched, so it kept failing identically and reproducibly, not from a transient corrupted download. `terraform providers lock -platform=...` fetches each named platform's official checksum from the registry API directly rather than deriving it from a live download on the calling machine, so it does not need to actually run on linux_amd64 to lock it correctly. Ran it for linux_amd64, linux_arm64, darwin_amd64, and darwin_arm64 across every directory with a tracked lock file, covering CI and both architectures of Mac and Linux contributors in one pass. --- .terraform.lock.hcl | 8 ++++++++ modules/digitalocean/.terraform.lock.hcl | 4 ++++ modules/gcp/.terraform.lock.hcl | 8 ++++++++ modules/linode/.terraform.lock.hcl | 4 ++++ modules/linux-vm-runtime/.terraform.lock.hcl | 2 ++ providers/do/.terraform.lock.hcl | 4 ++++ providers/linode/.terraform.lock.hcl | 4 ++++ 7 files changed, 34 insertions(+) diff --git a/.terraform.lock.hcl b/.terraform.lock.hcl index 6230b2b..23cec1c 100644 --- a/.terraform.lock.hcl +++ b/.terraform.lock.hcl @@ -5,7 +5,9 @@ provider "registry.terraform.io/hashicorp/cloudinit" { version = "2.4.0" constraints = "~> 2.3" hashes = [ + "h1:++jNzTgv9Z98vE5HqS09GP1PAATcvg2saBAJYDszl4w=", "h1:4fp7byXJGbOU8zqxFM4yYGHzf1kUH8ChT41KK4n9q98=", + "h1:Bx3XQkBSY3RAGwLZb8hyi8AhvahPNlt4mlyZhW9guOI=", "h1:H74EkbLWyZxkKhz8inoi6HTZbPox2VYzAttFhUy8X7Y=", "zh:1b0fe71b8e87a068f7cd9faaa733100ab72ab61ce812b8bd2b8e3e6ea3907b2d", "zh:2aa9631ad64cfda1eb58f147619b631dadedfaf9453b422aa5ada2d3861183c1", @@ -27,6 +29,8 @@ provider "registry.terraform.io/hashicorp/google" { version = "7.45.0" constraints = "~> 7.0" hashes = [ + "h1:5bwzwKa/bvJmUkVMkrF18v9AfFeJ/wjR230oY+4LHrc=", + "h1:EYsKCMfXi6gtv3fE6XgNpsKrt7qFNrGFwenhlTkrrRM=", "h1:FGFsRBzfeyq56BUAcb/WT676NieMX3NRfR4DBj2eEqk=", "h1:snI9jfT+CtL8dH099NZCe79ciOSTuL74nPB7KaCf9pM=", "zh:0f33485d068e39b1661d4ad789dfac353134b99cb5746e463e7719c053d70c06", @@ -48,7 +52,9 @@ provider "registry.terraform.io/hashicorp/http" { version = "3.6.1" constraints = "~> 3.6" hashes = [ + "h1:N9nX5jMTKElbVhsIv7cIufXU93dtOyLTVg4/+nYf3MM=", "h1:T/CtN+30HmfgKsxgVTsee57V+lT+GY20INpjp91kRTc=", + "h1:i0gHhh36WVucbTkIXA8qtyXnH3BFwT8+MrWEApfKgBg=", "h1:uEqqVV3ui6Zr0k/lqyjvHM0Lg267qMMji+ux7wPfJXI=", "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", @@ -70,6 +76,8 @@ provider "registry.terraform.io/hashicorp/time" { version = "0.14.1" constraints = "~> 0.14" hashes = [ + "h1:FlUh1KgKazWNS3Enamn8W1pFTeYp9GB0g7VTTQGUDjY=", + "h1:GJig5pIwiKDsiF73KLs7vWvDs76/x6DeNSxKrfqlA40=", "h1:YRK+EoKey0ssT+VU2821si0k+fzPFHALvVnfe2atBlU=", "h1:r93SxP++6gUlwCHDQ5OkRmcU8B0yv6ZA9nF0Dh6NJmA=", "zh:0837ca5b057e5cff94dff7de2fcccafb4abaa33c45de193fe2853e684818a267", diff --git a/modules/digitalocean/.terraform.lock.hcl b/modules/digitalocean/.terraform.lock.hcl index a43859a..137404d 100644 --- a/modules/digitalocean/.terraform.lock.hcl +++ b/modules/digitalocean/.terraform.lock.hcl @@ -6,7 +6,9 @@ provider "registry.terraform.io/digitalocean/digitalocean" { constraints = "~> 2.0" hashes = [ "h1:9VsRnY7rmGiMFVG4ix3ry2fx8B8d7l9PyEpmGjjiW3I=", + "h1:Q9BxzK1Tp8YeuCUXVogVfqTsVCrWUUJJdvpL7UA0W/s=", "h1:WQ2ClvMwBILHDzWWhAm3LBRra4HkSe9taUlUGSLBNWI=", + "h1:iwjK8zLBTHWHICCP/O+QFcyxH16bV4gKPFUbmu2foqc=", "zh:021dbdacf7dd636cb66990964737bc4a6402160b5301e06b6fdab03a814f7e96", "zh:083ff822b22738eedc9eae29aa5d4c369b2de921e49fefa9858a4e7c6274b0c1", "zh:10695b5f7dbbe8ba1a20ac6bea1ab8613b43d2b1f6f9b53369bed296b2dff4d2", @@ -30,7 +32,9 @@ provider "registry.terraform.io/hashicorp/http" { version = "3.6.1" constraints = "~> 3.6" hashes = [ + "h1:N9nX5jMTKElbVhsIv7cIufXU93dtOyLTVg4/+nYf3MM=", "h1:T/CtN+30HmfgKsxgVTsee57V+lT+GY20INpjp91kRTc=", + "h1:i0gHhh36WVucbTkIXA8qtyXnH3BFwT8+MrWEApfKgBg=", "h1:uEqqVV3ui6Zr0k/lqyjvHM0Lg267qMMji+ux7wPfJXI=", "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", diff --git a/modules/gcp/.terraform.lock.hcl b/modules/gcp/.terraform.lock.hcl index 6230b2b..23cec1c 100644 --- a/modules/gcp/.terraform.lock.hcl +++ b/modules/gcp/.terraform.lock.hcl @@ -5,7 +5,9 @@ provider "registry.terraform.io/hashicorp/cloudinit" { version = "2.4.0" constraints = "~> 2.3" hashes = [ + "h1:++jNzTgv9Z98vE5HqS09GP1PAATcvg2saBAJYDszl4w=", "h1:4fp7byXJGbOU8zqxFM4yYGHzf1kUH8ChT41KK4n9q98=", + "h1:Bx3XQkBSY3RAGwLZb8hyi8AhvahPNlt4mlyZhW9guOI=", "h1:H74EkbLWyZxkKhz8inoi6HTZbPox2VYzAttFhUy8X7Y=", "zh:1b0fe71b8e87a068f7cd9faaa733100ab72ab61ce812b8bd2b8e3e6ea3907b2d", "zh:2aa9631ad64cfda1eb58f147619b631dadedfaf9453b422aa5ada2d3861183c1", @@ -27,6 +29,8 @@ provider "registry.terraform.io/hashicorp/google" { version = "7.45.0" constraints = "~> 7.0" hashes = [ + "h1:5bwzwKa/bvJmUkVMkrF18v9AfFeJ/wjR230oY+4LHrc=", + "h1:EYsKCMfXi6gtv3fE6XgNpsKrt7qFNrGFwenhlTkrrRM=", "h1:FGFsRBzfeyq56BUAcb/WT676NieMX3NRfR4DBj2eEqk=", "h1:snI9jfT+CtL8dH099NZCe79ciOSTuL74nPB7KaCf9pM=", "zh:0f33485d068e39b1661d4ad789dfac353134b99cb5746e463e7719c053d70c06", @@ -48,7 +52,9 @@ provider "registry.terraform.io/hashicorp/http" { version = "3.6.1" constraints = "~> 3.6" hashes = [ + "h1:N9nX5jMTKElbVhsIv7cIufXU93dtOyLTVg4/+nYf3MM=", "h1:T/CtN+30HmfgKsxgVTsee57V+lT+GY20INpjp91kRTc=", + "h1:i0gHhh36WVucbTkIXA8qtyXnH3BFwT8+MrWEApfKgBg=", "h1:uEqqVV3ui6Zr0k/lqyjvHM0Lg267qMMji+ux7wPfJXI=", "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", @@ -70,6 +76,8 @@ provider "registry.terraform.io/hashicorp/time" { version = "0.14.1" constraints = "~> 0.14" hashes = [ + "h1:FlUh1KgKazWNS3Enamn8W1pFTeYp9GB0g7VTTQGUDjY=", + "h1:GJig5pIwiKDsiF73KLs7vWvDs76/x6DeNSxKrfqlA40=", "h1:YRK+EoKey0ssT+VU2821si0k+fzPFHALvVnfe2atBlU=", "h1:r93SxP++6gUlwCHDQ5OkRmcU8B0yv6ZA9nF0Dh6NJmA=", "zh:0837ca5b057e5cff94dff7de2fcccafb4abaa33c45de193fe2853e684818a267", diff --git a/modules/linode/.terraform.lock.hcl b/modules/linode/.terraform.lock.hcl index 6f72a18..811ad11 100644 --- a/modules/linode/.terraform.lock.hcl +++ b/modules/linode/.terraform.lock.hcl @@ -5,7 +5,9 @@ provider "registry.terraform.io/hashicorp/http" { version = "3.6.1" constraints = "~> 3.6" hashes = [ + "h1:N9nX5jMTKElbVhsIv7cIufXU93dtOyLTVg4/+nYf3MM=", "h1:T/CtN+30HmfgKsxgVTsee57V+lT+GY20INpjp91kRTc=", + "h1:i0gHhh36WVucbTkIXA8qtyXnH3BFwT8+MrWEApfKgBg=", "h1:uEqqVV3ui6Zr0k/lqyjvHM0Lg267qMMji+ux7wPfJXI=", "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", @@ -29,6 +31,8 @@ provider "registry.terraform.io/linode/linode" { hashes = [ "h1:9f82B30cdnQ/f9MvBOJIIzPG63LQ7Rvy0bKyCxEOISM=", "h1:NFvTyf4HvB5XENiZTNfRhysfLqc/yfnrw34nldk2+Bo=", + "h1:S7rLqWWTDEIBkte0+wUVHNTOWI96G2+St5FGCLCey8U=", + "h1:w/Dk56645sMU12AcdGNwJXJFqZLQQ3szHLbUE0uSn+0=", "zh:010f08fa4dfbb77117ceac2629586941e262edc45c778659ae2a55c0b398ec23", "zh:15a4ce678298eb17e67e22b7481a81991892804cc9f88a4883fc9eef30ab9437", "zh:188828a08ce01de32a95f5f18d5db2cc86652fac03c85b20e8b83f615f2d37a0", diff --git a/modules/linux-vm-runtime/.terraform.lock.hcl b/modules/linux-vm-runtime/.terraform.lock.hcl index 9e5d634..985a4eb 100644 --- a/modules/linux-vm-runtime/.terraform.lock.hcl +++ b/modules/linux-vm-runtime/.terraform.lock.hcl @@ -5,7 +5,9 @@ provider "registry.terraform.io/hashicorp/http" { version = "3.6.1" constraints = "~> 3.6" hashes = [ + "h1:N9nX5jMTKElbVhsIv7cIufXU93dtOyLTVg4/+nYf3MM=", "h1:T/CtN+30HmfgKsxgVTsee57V+lT+GY20INpjp91kRTc=", + "h1:i0gHhh36WVucbTkIXA8qtyXnH3BFwT8+MrWEApfKgBg=", "h1:uEqqVV3ui6Zr0k/lqyjvHM0Lg267qMMji+ux7wPfJXI=", "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", diff --git a/providers/do/.terraform.lock.hcl b/providers/do/.terraform.lock.hcl index a43859a..137404d 100644 --- a/providers/do/.terraform.lock.hcl +++ b/providers/do/.terraform.lock.hcl @@ -6,7 +6,9 @@ provider "registry.terraform.io/digitalocean/digitalocean" { constraints = "~> 2.0" hashes = [ "h1:9VsRnY7rmGiMFVG4ix3ry2fx8B8d7l9PyEpmGjjiW3I=", + "h1:Q9BxzK1Tp8YeuCUXVogVfqTsVCrWUUJJdvpL7UA0W/s=", "h1:WQ2ClvMwBILHDzWWhAm3LBRra4HkSe9taUlUGSLBNWI=", + "h1:iwjK8zLBTHWHICCP/O+QFcyxH16bV4gKPFUbmu2foqc=", "zh:021dbdacf7dd636cb66990964737bc4a6402160b5301e06b6fdab03a814f7e96", "zh:083ff822b22738eedc9eae29aa5d4c369b2de921e49fefa9858a4e7c6274b0c1", "zh:10695b5f7dbbe8ba1a20ac6bea1ab8613b43d2b1f6f9b53369bed296b2dff4d2", @@ -30,7 +32,9 @@ provider "registry.terraform.io/hashicorp/http" { version = "3.6.1" constraints = "~> 3.6" hashes = [ + "h1:N9nX5jMTKElbVhsIv7cIufXU93dtOyLTVg4/+nYf3MM=", "h1:T/CtN+30HmfgKsxgVTsee57V+lT+GY20INpjp91kRTc=", + "h1:i0gHhh36WVucbTkIXA8qtyXnH3BFwT8+MrWEApfKgBg=", "h1:uEqqVV3ui6Zr0k/lqyjvHM0Lg267qMMji+ux7wPfJXI=", "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", diff --git a/providers/linode/.terraform.lock.hcl b/providers/linode/.terraform.lock.hcl index 6f72a18..811ad11 100644 --- a/providers/linode/.terraform.lock.hcl +++ b/providers/linode/.terraform.lock.hcl @@ -5,7 +5,9 @@ provider "registry.terraform.io/hashicorp/http" { version = "3.6.1" constraints = "~> 3.6" hashes = [ + "h1:N9nX5jMTKElbVhsIv7cIufXU93dtOyLTVg4/+nYf3MM=", "h1:T/CtN+30HmfgKsxgVTsee57V+lT+GY20INpjp91kRTc=", + "h1:i0gHhh36WVucbTkIXA8qtyXnH3BFwT8+MrWEApfKgBg=", "h1:uEqqVV3ui6Zr0k/lqyjvHM0Lg267qMMji+ux7wPfJXI=", "zh:091d5009e05b7583d1883505d31ea354dbbd2ab6bcc1f9866e3fc40f708f74b2", "zh:305c3e1c0f1e9e5c4bbf2a3a71c217b06146499a1815de0db052e5f277c7b5c1", @@ -29,6 +31,8 @@ provider "registry.terraform.io/linode/linode" { hashes = [ "h1:9f82B30cdnQ/f9MvBOJIIzPG63LQ7Rvy0bKyCxEOISM=", "h1:NFvTyf4HvB5XENiZTNfRhysfLqc/yfnrw34nldk2+Bo=", + "h1:S7rLqWWTDEIBkte0+wUVHNTOWI96G2+St5FGCLCey8U=", + "h1:w/Dk56645sMU12AcdGNwJXJFqZLQQ3szHLbUE0uSn+0=", "zh:010f08fa4dfbb77117ceac2629586941e262edc45c778659ae2a55c0b398ec23", "zh:15a4ce678298eb17e67e22b7481a81991892804cc9f88a4883fc9eef30ab9437", "zh:188828a08ce01de32a95f5f18d5db2cc86652fac03c85b20e8b83f615f2d37a0",