Skip to content

Commit b1267c9

Browse files
Kaniska244Kaniska244
committed
[terraform] - Fix terraform installation in ubuntu noble.
1 parent e3e3ed7 commit b1267c9

5 files changed

Lines changed: 110 additions & 11 deletions

File tree

‎src/terraform/devcontainer-feature.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"id": "terraform",
3-
"version": "1.4.0",
3+
"version": "1.4.1",
44
"name": "Terraform, tflint, and TFGrunt",
55
"documentationURL": "https://github.com/devcontainers/features/tree/main/src/terraform",
66
"description": "Installs the Terraform CLI and optionally TFLint and Terragrunt. Auto-detects latest version and installs needed dependencies.",

‎src/terraform/install.sh‎

Lines changed: 60 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,25 @@ if [ "$(id -u)" -ne 0 ]; then
5050
exit 1
5151
fi
5252

53+
import_hashicorp_gpg_key_noble() {
54+
unset GNUPGHOME
55+
curl -fsSL https://keybase.io/hashicorp/pgp_keys.asc | gpg --import
56+
if ! gpg --list-keys "${TERRAFORM_GPG_KEY}" > /dev/null 2>&1; then
57+
gpg --list-keys
58+
echo "(!) HashiCorp GPG key not found in keyring after import. Aborting."
59+
exit 1
60+
fi
61+
}
62+
63+
# Detect Ubuntu Noble and use new repo setup, else use legacy GPG logic
64+
IS_NOBLE=0
65+
if grep -qi 'ubuntu' /etc/os-release; then
66+
. /etc/os-release
67+
if [[ "$VERSION_CODENAME" == "noble" ]]; then
68+
IS_NOBLE=1
69+
fi
70+
fi
71+
5372
# Get the list of GPG key servers that are reachable
5473
get_gpg_key_servers() {
5574
declare -A keyservers_curl_map=(
@@ -366,6 +385,13 @@ install_terraform() {
366385
curl -sSL -o ${terraform_filename} "${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/${terraform_filename}"
367386
}
368387

388+
verify_terraform_sig() {
389+
receive_gpg_keys TERRAFORM_GPG_KEY
390+
curl -sSL -o terraform_SHA256SUMS "${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS"
391+
curl -sSL -o terraform_SHA256SUMS.sig "${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS.${TERRAFORM_GPG_KEY}.sig"
392+
gpg --verify terraform_SHA256SUMS.sig terraform_SHA256SUMS
393+
}
394+
369395
mkdir -p /tmp/tf-downloads
370396
cd /tmp/tf-downloads
371397
# Install Terraform, tflint, Terragrunt
@@ -378,10 +404,18 @@ if grep -q "The specified key does not exist." "${terraform_filename}"; then
378404
fi
379405
if [ "${TERRAFORM_SHA256}" != "dev-mode" ]; then
380406
if [ "${TERRAFORM_SHA256}" = "automatic" ]; then
381-
receive_gpg_keys TERRAFORM_GPG_KEY
382-
curl -sSL -o terraform_SHA256SUMS "${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS"
383-
curl -sSL -o terraform_SHA256SUMS.sig "${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS.${TERRAFORM_GPG_KEY}.sig"
384-
gpg --verify terraform_SHA256SUMS.sig terraform_SHA256SUMS
407+
if [ "$IS_NOBLE" -eq 1 ]; then
408+
import_hashicorp_gpg_key_noble
409+
curl -sSL -o terraform_SHA256SUMS "${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS"
410+
curl -sSL -o terraform_SHA256SUMS.sig "${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS.${TERRAFORM_GPG_KEY}.sig"
411+
gpg --list-keys
412+
if ! gpg --verify terraform_SHA256SUMS.sig terraform_SHA256SUMS; then
413+
echo "Primary GPG verification failed, attempting fallback verification..."
414+
verify_terraform_sig
415+
fi
416+
else
417+
verify_terraform_sig
418+
fi
385419
else
386420
echo "${TERRAFORM_SHA256} *${terraform_filename}" > terraform_SHA256SUMS
387421
fi
@@ -443,6 +477,13 @@ if [ "${TFLINT_VERSION}" != "none" ]; then
443477
mv -f tflint /usr/local/bin/
444478
fi
445479

480+
verify_sentinel_sig() {
481+
receive_gpg_keys TERRAFORM_GPG_KEY
482+
curl -sSL -o sentinel_checksums.txt ${sentinel_releases_url}/${SENTINEL_VERSION}/sentinel_${SENTINEL_VERSION}_SHA256SUMS
483+
curl -sSL -o sentinel_checksums.txt.sig ${sentinel_releases_url}/${SENTINEL_VERSION}/sentinel_${SENTINEL_VERSION}_SHA256SUMS.${TERRAFORM_GPG_KEY}.sig
484+
gpg --verify sentinel_checksums.txt.sig sentinel_checksums.txt
485+
}
486+
446487
install_terragrunt() {
447488
TERRAGRUNT_VERSION=$1
448489
curl -sSL -o /tmp/tf-downloads/${terragrunt_filename} https://github.com/gruntwork-io/terragrunt/releases/download/v${TERRAGRUNT_VERSION}/${terragrunt_filename}
@@ -477,12 +518,21 @@ if [ "${INSTALL_SENTINEL}" = "true" ]; then
477518
curl -sSL -o /tmp/tf-downloads/${sentinel_filename} ${sentinel_releases_url}/${SENTINEL_VERSION}/${sentinel_filename}
478519
if [ "${SENTINEL_SHA256}" != "dev-mode" ]; then
479520
if [ "${SENTINEL_SHA256}" = "automatic" ]; then
480-
receive_gpg_keys TERRAFORM_GPG_KEY
481-
curl -sSL -o sentinel_checksums.txt ${sentinel_releases_url}/${SENTINEL_VERSION}/sentinel_${SENTINEL_VERSION}_SHA256SUMS
482-
curl -sSL -o sentinel_checksums.txt.sig ${sentinel_releases_url}/${SENTINEL_VERSION}/sentinel_${SENTINEL_VERSION}_SHA256SUMS.${TERRAFORM_GPG_KEY}.sig
483-
gpg --verify sentinel_checksums.txt.sig sentinel_checksums.txt
484-
# Verify the SHASUM matches the archive
485-
shasum -a 256 --ignore-missing -c sentinel_checksums.txt
521+
if [ "$IS_NOBLE" -eq 1 ]; then
522+
import_hashicorp_gpg_key_noble
523+
curl -sSL -o sentinel_checksums.txt ${sentinel_releases_url}/${SENTINEL_VERSION}/sentinel_${SENTINEL_VERSION}_SHA256SUMS
524+
curl -sSL -o sentinel_checksums.txt.sig ${sentinel_releases_url}/${SENTINEL_VERSION}/sentinel_${SENTINEL_VERSION}_SHA256SUMS.${TERRAFORM_GPG_KEY}.sig
525+
if ! gpg --verify sentinel_checksums.txt.sig sentinel_checksums.txt; then
526+
echo "Primary GPG verification failed, attempting fallback verification..."
527+
verify_sentinel_sig
528+
fi
529+
# Verify the SHASUM matches the archive
530+
shasum -a 256 --ignore-missing -c sentinel_checksums.txt
531+
else
532+
verify_sentinel_sig
533+
# Verify the SHASUM matches the archive
534+
shasum -a 256 --ignore-missing -c sentinel_checksums.txt
535+
fi
486536
else
487537
echo "${SENTINEL_SHA256} *${SENTINEL_FILENAME}" >sentinel_checksums.txt
488538
fi

‎test/terraform/install_in_ubuntu_noble.sh‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/bin/bash
2+
3+
set -e
4+
5+
# Import test library
6+
source dev-container-features-test-lib
7+
8+
# Check if terraform was installed correctly
9+
check "terraform installed" terraform --version
10+
11+
check "tflint" tflint --version
12+
13+
# Report results
14+
reportResults
15+

‎test/terraform/install_in_ubuntu_noble_sentinel.sh‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/bin/bash
2+
3+
set -e
4+
5+
# Import test library for `check` command
6+
source dev-container-features-test-lib
7+
8+
# Check if terraform was installed correctly
9+
check "terraform installed" terraform --version
10+
11+
check "tflint" tflint --version
12+
13+
# Sentinel specific tests
14+
check "sentinel" sentinel --version
15+
16+
# Report result
17+
reportResults
18+

‎test/terraform/scenarios.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,20 @@
11
{
2+
"install_in_ubuntu_noble": {
3+
"image": "mcr.microsoft.com/devcontainers/base:noble",
4+
"features": {
5+
"terraform": {
6+
"version": "latest"
7+
}
8+
}
9+
},
10+
"install_in_ubuntu_noble_sentinel": {
11+
"image": "mcr.microsoft.com/devcontainers/base:noble",
12+
"features": {
13+
"terraform": {
14+
"installSentinel": true
15+
}
16+
}
17+
},
218
"install_sentinel": {
319
"image": "mcr.microsoft.com/devcontainers/base:jammy",
420
"features": {

0 commit comments

Comments
 (0)