2020-03-12 02:00:43 +01:00
|
|
|
package providercache
|
|
|
|
|
|
|
|
import (
|
2020-03-13 22:46:44 +01:00
|
|
|
"context"
|
2020-03-12 02:00:43 +01:00
|
|
|
"fmt"
|
2020-03-25 20:22:39 +01:00
|
|
|
"log"
|
2020-03-12 02:00:43 +01:00
|
|
|
|
|
|
|
"github.com/hashicorp/terraform/internal/getproviders"
|
|
|
|
)
|
|
|
|
|
2020-03-12 02:10:25 +01:00
|
|
|
// InstallPackage takes a metadata object describing a package available for
|
|
|
|
// installation, retrieves that package, and installs it into the receiving
|
|
|
|
// cache directory.
|
internal: Verify provider signatures on install
Providers installed from the registry are accompanied by a list of
checksums (the "SHA256SUMS" file), which is cryptographically signed to
allow package authentication. The process of verifying this has multiple
steps:
- First we must verify that the SHA256 hash of the package archive
matches the expected hash. This could be done for local installations
too, in the future.
- Next we ensure that the expected hash returned as part of the registry
API response matches an entry in the checksum list.
- Finally we verify the cryptographic signature of the checksum list,
using the public keys provided by the registry.
Each of these steps is implemented as a separate PackageAuthentication
type. The local archive installation mechanism uses only the archive
checksum authenticator, and the HTTP installation uses all three in the
order given.
The package authentication system now also returns a result value, which
is used by command/init to display the result of the authentication
process.
There are three tiers of signature, each of which is presented
differently to the user:
- Signatures from the embedded HashiCorp public key indicate that the
provider is officially supported by HashiCorp;
- If the signing key is not from HashiCorp, it may have an associated
trust signature, which indicates that the provider is from one of
HashiCorp's trusted partners;
- Otherwise, if the signature is valid, this is a community provider.
2020-04-08 22:22:07 +02:00
|
|
|
func (d *Dir) InstallPackage(ctx context.Context, meta getproviders.PackageMeta) (*getproviders.PackageAuthenticationResult, error) {
|
2020-03-13 22:46:44 +01:00
|
|
|
if meta.TargetPlatform != d.targetPlatform {
|
internal: Verify provider signatures on install
Providers installed from the registry are accompanied by a list of
checksums (the "SHA256SUMS" file), which is cryptographically signed to
allow package authentication. The process of verifying this has multiple
steps:
- First we must verify that the SHA256 hash of the package archive
matches the expected hash. This could be done for local installations
too, in the future.
- Next we ensure that the expected hash returned as part of the registry
API response matches an entry in the checksum list.
- Finally we verify the cryptographic signature of the checksum list,
using the public keys provided by the registry.
Each of these steps is implemented as a separate PackageAuthentication
type. The local archive installation mechanism uses only the archive
checksum authenticator, and the HTTP installation uses all three in the
order given.
The package authentication system now also returns a result value, which
is used by command/init to display the result of the authentication
process.
There are three tiers of signature, each of which is presented
differently to the user:
- Signatures from the embedded HashiCorp public key indicate that the
provider is officially supported by HashiCorp;
- If the signing key is not from HashiCorp, it may have an associated
trust signature, which indicates that the provider is from one of
HashiCorp's trusted partners;
- Otherwise, if the signature is valid, this is a community provider.
2020-04-08 22:22:07 +02:00
|
|
|
return nil, fmt.Errorf("can't install %s package into cache directory expecting %s", meta.TargetPlatform, d.targetPlatform)
|
2020-03-13 22:46:44 +01:00
|
|
|
}
|
|
|
|
newPath := getproviders.UnpackedDirectoryPathForPackage(
|
|
|
|
d.baseDir, meta.Provider, meta.Version, d.targetPlatform,
|
|
|
|
)
|
|
|
|
|
2020-03-27 00:05:27 +01:00
|
|
|
// Invalidate our metaCache so that subsequent read calls will re-scan to
|
|
|
|
// incorporate any changes we make here.
|
|
|
|
d.metaCache = nil
|
|
|
|
|
2020-03-25 20:22:39 +01:00
|
|
|
log.Printf("[TRACE] providercache.Dir.InstallPackage: installing %s v%s from %s", meta.Provider, meta.Version, meta.Location)
|
internal: Verify provider signatures on install
Providers installed from the registry are accompanied by a list of
checksums (the "SHA256SUMS" file), which is cryptographically signed to
allow package authentication. The process of verifying this has multiple
steps:
- First we must verify that the SHA256 hash of the package archive
matches the expected hash. This could be done for local installations
too, in the future.
- Next we ensure that the expected hash returned as part of the registry
API response matches an entry in the checksum list.
- Finally we verify the cryptographic signature of the checksum list,
using the public keys provided by the registry.
Each of these steps is implemented as a separate PackageAuthentication
type. The local archive installation mechanism uses only the archive
checksum authenticator, and the HTTP installation uses all three in the
order given.
The package authentication system now also returns a result value, which
is used by command/init to display the result of the authentication
process.
There are three tiers of signature, each of which is presented
differently to the user:
- Signatures from the embedded HashiCorp public key indicate that the
provider is officially supported by HashiCorp;
- If the signing key is not from HashiCorp, it may have an associated
trust signature, which indicates that the provider is from one of
HashiCorp's trusted partners;
- Otherwise, if the signature is valid, this is a community provider.
2020-04-08 22:22:07 +02:00
|
|
|
switch meta.Location.(type) {
|
2020-03-13 22:46:44 +01:00
|
|
|
case getproviders.PackageHTTPURL:
|
internal: Verify provider signatures on install
Providers installed from the registry are accompanied by a list of
checksums (the "SHA256SUMS" file), which is cryptographically signed to
allow package authentication. The process of verifying this has multiple
steps:
- First we must verify that the SHA256 hash of the package archive
matches the expected hash. This could be done for local installations
too, in the future.
- Next we ensure that the expected hash returned as part of the registry
API response matches an entry in the checksum list.
- Finally we verify the cryptographic signature of the checksum list,
using the public keys provided by the registry.
Each of these steps is implemented as a separate PackageAuthentication
type. The local archive installation mechanism uses only the archive
checksum authenticator, and the HTTP installation uses all three in the
order given.
The package authentication system now also returns a result value, which
is used by command/init to display the result of the authentication
process.
There are three tiers of signature, each of which is presented
differently to the user:
- Signatures from the embedded HashiCorp public key indicate that the
provider is officially supported by HashiCorp;
- If the signing key is not from HashiCorp, it may have an associated
trust signature, which indicates that the provider is from one of
HashiCorp's trusted partners;
- Otherwise, if the signature is valid, this is a community provider.
2020-04-08 22:22:07 +02:00
|
|
|
return installFromHTTPURL(ctx, meta, newPath)
|
2020-03-13 22:46:44 +01:00
|
|
|
case getproviders.PackageLocalArchive:
|
internal: Verify provider signatures on install
Providers installed from the registry are accompanied by a list of
checksums (the "SHA256SUMS" file), which is cryptographically signed to
allow package authentication. The process of verifying this has multiple
steps:
- First we must verify that the SHA256 hash of the package archive
matches the expected hash. This could be done for local installations
too, in the future.
- Next we ensure that the expected hash returned as part of the registry
API response matches an entry in the checksum list.
- Finally we verify the cryptographic signature of the checksum list,
using the public keys provided by the registry.
Each of these steps is implemented as a separate PackageAuthentication
type. The local archive installation mechanism uses only the archive
checksum authenticator, and the HTTP installation uses all three in the
order given.
The package authentication system now also returns a result value, which
is used by command/init to display the result of the authentication
process.
There are three tiers of signature, each of which is presented
differently to the user:
- Signatures from the embedded HashiCorp public key indicate that the
provider is officially supported by HashiCorp;
- If the signing key is not from HashiCorp, it may have an associated
trust signature, which indicates that the provider is from one of
HashiCorp's trusted partners;
- Otherwise, if the signature is valid, this is a community provider.
2020-04-08 22:22:07 +02:00
|
|
|
return installFromLocalArchive(ctx, meta, newPath)
|
2020-03-13 22:46:44 +01:00
|
|
|
case getproviders.PackageLocalDir:
|
internal: Verify provider signatures on install
Providers installed from the registry are accompanied by a list of
checksums (the "SHA256SUMS" file), which is cryptographically signed to
allow package authentication. The process of verifying this has multiple
steps:
- First we must verify that the SHA256 hash of the package archive
matches the expected hash. This could be done for local installations
too, in the future.
- Next we ensure that the expected hash returned as part of the registry
API response matches an entry in the checksum list.
- Finally we verify the cryptographic signature of the checksum list,
using the public keys provided by the registry.
Each of these steps is implemented as a separate PackageAuthentication
type. The local archive installation mechanism uses only the archive
checksum authenticator, and the HTTP installation uses all three in the
order given.
The package authentication system now also returns a result value, which
is used by command/init to display the result of the authentication
process.
There are three tiers of signature, each of which is presented
differently to the user:
- Signatures from the embedded HashiCorp public key indicate that the
provider is officially supported by HashiCorp;
- If the signing key is not from HashiCorp, it may have an associated
trust signature, which indicates that the provider is from one of
HashiCorp's trusted partners;
- Otherwise, if the signature is valid, this is a community provider.
2020-04-08 22:22:07 +02:00
|
|
|
return installFromLocalDir(ctx, meta, newPath)
|
2020-03-13 22:46:44 +01:00
|
|
|
default:
|
|
|
|
// Should not get here, because the above should be exhaustive for
|
|
|
|
// all implementations of getproviders.Location.
|
internal: Verify provider signatures on install
Providers installed from the registry are accompanied by a list of
checksums (the "SHA256SUMS" file), which is cryptographically signed to
allow package authentication. The process of verifying this has multiple
steps:
- First we must verify that the SHA256 hash of the package archive
matches the expected hash. This could be done for local installations
too, in the future.
- Next we ensure that the expected hash returned as part of the registry
API response matches an entry in the checksum list.
- Finally we verify the cryptographic signature of the checksum list,
using the public keys provided by the registry.
Each of these steps is implemented as a separate PackageAuthentication
type. The local archive installation mechanism uses only the archive
checksum authenticator, and the HTTP installation uses all three in the
order given.
The package authentication system now also returns a result value, which
is used by command/init to display the result of the authentication
process.
There are three tiers of signature, each of which is presented
differently to the user:
- Signatures from the embedded HashiCorp public key indicate that the
provider is officially supported by HashiCorp;
- If the signing key is not from HashiCorp, it may have an associated
trust signature, which indicates that the provider is from one of
HashiCorp's trusted partners;
- Otherwise, if the signature is valid, this is a community provider.
2020-04-08 22:22:07 +02:00
|
|
|
return nil, fmt.Errorf("don't know how to install from a %T location", meta.Location)
|
2020-03-13 22:46:44 +01:00
|
|
|
}
|
2020-03-12 02:10:25 +01:00
|
|
|
}
|
|
|
|
|
2020-03-12 02:00:43 +01:00
|
|
|
// LinkFromOtherCache takes a CachedProvider value produced from another Dir
|
|
|
|
// and links it into the cache represented by the receiver Dir.
|
|
|
|
//
|
|
|
|
// This is used to implement tiered caching, where new providers are first
|
|
|
|
// populated into a system-wide shared cache and then linked from there into
|
|
|
|
// a configuration-specific local cache.
|
|
|
|
//
|
|
|
|
// It's invalid to link a CachedProvider from a particular Dir into that same
|
|
|
|
// Dir, because that would otherwise potentially replace a real package
|
|
|
|
// directory with a circular link back to itself.
|
|
|
|
func (d *Dir) LinkFromOtherCache(entry *CachedProvider) error {
|
|
|
|
newPath := getproviders.UnpackedDirectoryPathForPackage(
|
|
|
|
d.baseDir, entry.Provider, entry.Version, d.targetPlatform,
|
|
|
|
)
|
|
|
|
currentPath := entry.PackageDir
|
2020-03-25 20:22:39 +01:00
|
|
|
log.Printf("[TRACE] providercache.Dir.LinkFromOtherCache: linking %s v%s from existing cache %s to %s", entry.Provider, entry.Version, currentPath, newPath)
|
2020-03-12 02:00:43 +01:00
|
|
|
|
|
|
|
// Invalidate our metaCache so that subsequent read calls will re-scan to
|
|
|
|
// incorporate any changes we make here.
|
|
|
|
d.metaCache = nil
|
|
|
|
|
2020-04-01 19:25:48 +02:00
|
|
|
// We re-use the process of installing from a local directory here, because
|
|
|
|
// the two operations are fundamentally the same: symlink if possible,
|
|
|
|
// deep-copy otherwise.
|
internal: Verify provider signatures on install
Providers installed from the registry are accompanied by a list of
checksums (the "SHA256SUMS" file), which is cryptographically signed to
allow package authentication. The process of verifying this has multiple
steps:
- First we must verify that the SHA256 hash of the package archive
matches the expected hash. This could be done for local installations
too, in the future.
- Next we ensure that the expected hash returned as part of the registry
API response matches an entry in the checksum list.
- Finally we verify the cryptographic signature of the checksum list,
using the public keys provided by the registry.
Each of these steps is implemented as a separate PackageAuthentication
type. The local archive installation mechanism uses only the archive
checksum authenticator, and the HTTP installation uses all three in the
order given.
The package authentication system now also returns a result value, which
is used by command/init to display the result of the authentication
process.
There are three tiers of signature, each of which is presented
differently to the user:
- Signatures from the embedded HashiCorp public key indicate that the
provider is officially supported by HashiCorp;
- If the signing key is not from HashiCorp, it may have an associated
trust signature, which indicates that the provider is from one of
HashiCorp's trusted partners;
- Otherwise, if the signature is valid, this is a community provider.
2020-04-08 22:22:07 +02:00
|
|
|
meta := getproviders.PackageMeta{
|
|
|
|
Provider: entry.Provider,
|
|
|
|
Version: entry.Version,
|
|
|
|
|
|
|
|
// FIXME: How do we populate this?
|
|
|
|
ProtocolVersions: nil,
|
|
|
|
TargetPlatform: d.targetPlatform,
|
|
|
|
|
|
|
|
// Because this is already unpacked, the filename is synthetic
|
|
|
|
// based on the standard naming scheme.
|
|
|
|
Filename: fmt.Sprintf("terraform-provider-%s_%s_%s.zip",
|
|
|
|
entry.Provider.Type, entry.Version, d.targetPlatform),
|
|
|
|
Location: getproviders.PackageLocalDir(currentPath),
|
|
|
|
}
|
|
|
|
_, err := installFromLocalDir(context.TODO(), meta, newPath)
|
|
|
|
return err
|
2020-03-12 02:00:43 +01:00
|
|
|
}
|