Modify language for reporting signing state by paultyng · Pull Request #24932 · hashicorp/terraform

paultyng · 2020-05-12T17:58:35Z

Be more explicit about the signing status of fetched plugins and provide documentation about the different signing options.

paultyng · 2020-05-12T18:09:01Z

website/docs/plugins/signing.html.md

+programatically. To use partner providers in your Terraform configuration, you need to specify the
+provider source, typically this is the namespace and name to download from the registry.
+* **Self-signed** - are built, signed, and supported by a third party. HashiCorp does not provide a verification or chain of trust for the signing. You will want to obtain and validate fingerprints manually if you want to ensure you are using a binary you can trust.
+* **Unsigned** - Terraform does support fetching and using unsigned binaries, but you should take extreme care when doing so as no programatic authentication is performed on the downloaded binary.


I'm not sure if this is true, just wanted to cover all the states I saw in code.

It might, but not from the Registry, which this doc currently lives in the nav hierarchy. Maybe we could clarify that or group them somehow.

I moved the doc, this is top level now under plugins.

We don't support fetching unsigned providers. The only non-local sources follow the Registry protocol, and signatures are mandatory.

I modified it to say this, let me know your thoughts. I wanted to keep it in there, as we will run unsigned, if not fetch them.

pkolyvas

I've left a comment on the warning.

internal/getproviders/package_authentication.go

justincampbell · 2020-05-12T19:06:36Z

website/docs/plugins/signing.html.md

+programatically. To use partner providers in your Terraform configuration, you need to specify the
+provider source, typically this is the namespace and name to download from the registry.
+* **Self-signed** - are built, signed, and supported by a third party. HashiCorp does not provide a verification or chain of trust for the signing. You will want to obtain and validate fingerprints manually if you want to ensure you are using a binary you can trust.
+* **Unsigned** - Terraform does support fetching and using unsigned binaries, but you should take extreme care when doing so as no programatic authentication is performed on the downloaded binary.


It might, but not from the Registry, which this doc currently lives in the nav hierarchy. Maybe we could clarify that or group them somehow.

command/init.go

alisdair

The structure of the code makes sense to me. I left some comments inline, mostly about the documentation.

internal/getproviders/package_authentication.go

alisdair · 2020-05-13T13:28:18Z

website/docs/plugins/signing.html.md

+  Terraform plugin signing trust levels
+---
+
+# Plugin Signing


This document describes plugins in general, but Terraform's tiered signature verification only applies to providers specifically.

Yeah, in this case i was hedging a little on the future, as this is a URL hard coded in to a shipped binary, was making it a bit more future proof. I can add some language though that currently only provider plugins are authenticated.

website/docs/plugins/signing.html.md

alisdair · 2020-05-13T13:35:05Z

website/docs/plugins/signing.html.md

+verified the ownership of the private key and we provide a chain of trust to the CLI to verify this
+programatically. To use partner providers in your Terraform configuration, you need to specify the
+provider source, typically this is the namespace and name to download from the registry.
+* **Self-signed** - are built, signed, and supported by a third party. HashiCorp does not provide a verification or chain of trust for the signing. You will want to obtain and validate fingerprints manually if you want to ensure you are using a binary you can trust.


You will want to obtain and validate fingerprints manually if you want to ensure you are using a binary you can trust.

It's not clear to me how a user could take action on this recommendation, unless we give some more detail about how to obtain the key fingerprint, and how to usefully validate it. As I understand it that is the subject of some unspecified future work. Until we have something more concrete to offer here, I think it's better to omit this sentence.

Until we offer an ability to authenticate, perhaps we should print a fingerprint for this self-signed category to the output for manual verification?

@paultyng we need to limit scope creep, but we will definitely consider that suggestion for a future enhancement. We don't have concrete plans yet, but a number of ideas to extend the community provider trust process in later releases.

I added in this PR to output KeyID when its third party signed, maybe that will be sufficient?

codecov · 2020-05-13T17:40:03Z

Codecov Report

Merging #24932 into master will decrease coverage by 0.01%.
The diff coverage is 52.38%.

Impacted Files	Coverage Δ
internal/providercache/installer_events.go	`42.85% <ø> (ø)`
command/init.go	`67.07% <31.25%> (-1.20%)`	⬇️
internal/providercache/installer.go	`20.57% <40.00%> (+0.08%)`	⬆️
internal/getproviders/package_authentication.go	`88.33% <71.42%> (-4.46%)`	⬇️
dag/walk.go	`92.54% <0.00%> (-0.63%)`	⬇️

command/init.go

internal/getproviders/package_authentication.go

website/docs/plugins/signing.html.md

alisdair

👍 from me once the remaining minor issues are addressed. Thanks!

command/init.go

Be more explicit about the signing status of fetched plugins and provide documentation about the different signing options.

paultyng · 2020-05-26T17:20:07Z

The warning was removed after discussions with @alisdair as it was not longer used.

justincampbell

Language and docs look good to me!

mildwonkey

Thank you!

ghost · 2020-06-28T01:51:51Z

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

paultyng force-pushed the signing-language branch from 4f0fb1f to 5217fea Compare May 12, 2020 18:05

paultyng commented May 12, 2020

View reviewed changes

paultyng requested a review from justincampbell May 12, 2020 18:12

pkolyvas reviewed May 12, 2020

View reviewed changes

paultyng removed the request for review from justincampbell May 12, 2020 18:26

justincampbell reviewed May 12, 2020

View reviewed changes

pkolyvas reviewed May 12, 2020

View reviewed changes

command/init.go Outdated Show resolved Hide resolved

alisdair suggested changes May 13, 2020

View reviewed changes

paultyng force-pushed the signing-language branch 2 times, most recently from df28d4c to a141ee7 Compare May 13, 2020 17:36

mildwonkey requested changes May 13, 2020

View reviewed changes

command/init.go Outdated Show resolved Hide resolved

command/init.go Outdated Show resolved Hide resolved

internal/getproviders/package_authentication.go Show resolved Hide resolved

mildwonkey reviewed May 18, 2020

View reviewed changes

website/docs/plugins/signing.html.md Outdated Show resolved Hide resolved

alisdair approved these changes May 21, 2020

View reviewed changes

command/init.go Outdated Show resolved Hide resolved

danieldreier added the waiting-response An issue/pull request is waiting for a response from the community label May 21, 2020

paultyng force-pushed the signing-language branch 2 times, most recently from cf3fc68 to 8130fae Compare May 26, 2020 17:12

Modify language for reporting signing state

22ef5cc

Be more explicit about the signing status of fetched plugins and provide documentation about the different signing options.

paultyng force-pushed the signing-language branch from 8130fae to 22ef5cc Compare May 26, 2020 17:14

paultyng marked this pull request as ready for review May 26, 2020 17:15

paultyng removed the waiting-response An issue/pull request is waiting for a response from the community label May 26, 2020

justincampbell approved these changes May 26, 2020

View reviewed changes

mildwonkey approved these changes May 28, 2020

View reviewed changes

alisdair merged commit ef28671 into master May 28, 2020

alisdair deleted the signing-language branch May 28, 2020 13:09

ghost locked and limited conversation to collaborators Jun 28, 2020

Conversation

paultyng commented May 12, 2020

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pkolyvas left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

alisdair left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov bot commented May 13, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

alisdair left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

paultyng commented May 26, 2020

Uh oh!

justincampbell left a comment

Choose a reason for hiding this comment

Uh oh!

mildwonkey left a comment

Choose a reason for hiding this comment

Uh oh!

ghost commented Jun 28, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

pkolyvas left a comment •

edited

Loading

codecov bot commented May 13, 2020 •

edited

Loading