Terraform crashes on mirroring the cloudflare provider

[zoonage]

Terraform Version

% terraform version
Terraform v1.8.5
on darwin_arm64

### Terraform Configuration Files

```terraform
terraform {
  required_providers {
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = ">= 4.0.0, < 5.0.0"
    }
  }
}

provider "cloudflare" {}

Debug Output

% tftest % TF_LOG=trace terraform providers mirror .
2024-06-10T11:05:27.576+0100 [INFO]  Terraform version: 1.8.5
2024-06-10T11:05:27.577+0100 [DEBUG] using github.com/hashicorp/go-tfe v1.51.0
2024-06-10T11:05:27.577+0100 [DEBUG] using github.com/hashicorp/hcl/v2 v2.20.0
2024-06-10T11:05:27.577+0100 [DEBUG] using github.com/hashicorp/terraform-svchost v0.1.1
2024-06-10T11:05:27.577+0100 [DEBUG] using github.com/zclconf/go-cty v1.14.3
2024-06-10T11:05:27.577+0100 [INFO]  Go runtime version: go1.22.1
2024-06-10T11:05:27.577+0100 [INFO]  CLI args: []string{"terraform", "providers", "mirror", "."}
2024-06-10T11:05:27.577+0100 [TRACE] Stdout is a terminal of width 98
2024-06-10T11:05:27.577+0100 [TRACE] Stderr is a terminal of width 98
2024-06-10T11:05:27.577+0100 [TRACE] Stdin is a terminal
2024-06-10T11:05:27.577+0100 [DEBUG] Attempting to open CLI config file: /Users/<REDACTED>>/.terraform.d/config.tf
2024-06-10T11:05:27.577+0100 [INFO]  Loading CLI configuration from /Users/<REDACTED>>/.terraform.d/config.tf
2024-06-10T11:05:27.577+0100 [DEBUG] Not reading CLI config directory because config location is overridden by environment variable
2024-06-10T11:05:27.577+0100 [DEBUG] ignoring non-existing provider search directory terraform.d/plugins
2024-06-10T11:05:27.577+0100 [DEBUG] ignoring non-existing provider search directory /Users/<REDACTED>>/.terraform.d/plugins
2024-06-10T11:05:27.577+0100 [DEBUG] ignoring non-existing provider search directory /Users/<REDACTED>>/Library/Application Support/io.terraform/plugins
2024-06-10T11:05:27.577+0100 [DEBUG] ignoring non-existing provider search directory /Library/Application Support/io.terraform/plugins
2024-06-10T11:05:27.577+0100 [INFO]  CLI command args: []string{"providers", "mirror", "."}
2024-06-10T11:05:27.577+0100 [TRACE] Config.VerifyDependencySelections: provider registry.terraform.io/cloudflare/cloudflare has no lock file entry to satisfy ">= 4.0.0, < 5.0.0"
- Mirroring cloudflare/cloudflare...
2024-06-10T11:05:27.578+0100 [DEBUG] Service discovery for registry.terraform.io at https://registry.terraform.io/.well-known/terraform.json
2024-06-10T11:05:27.578+0100 [TRACE] HTTP client GET request to https://registry.terraform.io/.well-known/terraform.json
2024-06-10T11:05:27.609+0100 [DEBUG] GET https://registry.terraform.io/v1/providers/cloudflare/cloudflare/versions
2024-06-10T11:05:27.609+0100 [TRACE] HTTP client GET request to https://registry.terraform.io/v1/providers/cloudflare/cloudflare/versions

!!!!!!!!!!!!!!!!!!!!!!!!!!! TERRAFORM CRASH !!!!!!!!!!!!!!!!!!!!!!!!!!!!

Terraform crashed! This is always indicative of a bug within Terraform.
Please report the crash with Terraform[1] so that we can fix this.

When reporting bugs, please include your terraform version, the stack trace
shown below, and any additional information which may help replicate the issue.

[1]: https://github.com/hashicorp/terraform/issues

!!!!!!!!!!!!!!!!!!!!!!!!!!! TERRAFORM CRASH !!!!!!!!!!!!!!!!!!!!!!!!!!!!

panic: runtime error: invalid memory address or nil pointer dereference
goroutine 1 [running]:
runtime/debug.Stack()
	runtime/debug/stack.go:24 +0x64
github.com/hashicorp/terraform/internal/logging.PanicHandler()
	github.com/hashicorp/terraform/internal/logging/panic.go:84 +0x198
panic({0x1030e7e00?, 0x104ff1640?})
	runtime/panic.go:770 +0x124
github.com/hashicorp/terraform/internal/depsfile.(*ProviderLock).Version(...)
	github.com/hashicorp/terraform/internal/depsfile/locks.go:380
github.com/hashicorp/terraform/internal/command.(*ProvidersMirrorCommand).Run(0x1400084a380, {0x140001c2030?, 0x0?, 0x0?})
	github.com/hashicorp/terraform/internal/command/providers_mirror.go:164 +0x1204
github.com/hashicorp/cli.(*CLI).Run(0x14000856280)
	github.com/hashicorp/cli@v1.1.6/cli.go:265 +0x4a8
main.realMain()
	github.com/hashicorp/terraform/main.go:339 +0x18f8
main.main()
	github.com/hashicorp/terraform/main.go:64 +0x1c

Expected Behavior

Mirrors the providers

Actual Behavior

Crashes

Steps to Reproduce

terraform providers mirror .

Additional Context

Only seems to affect the cloudflare provider, other ones like null, random, aws all seem OK

References

No response

[apparentlymart]

Thanks for reporting this, @zoonage.

It seems like the providers mirror command is attempting to call a method of an entry that isn't already present in the lock file, without checking first whether it's present:

terraform/internal/command/providers_mirror.go

Lines 163 to 170 in 8f2d640

	if !lockedDeps.Empty() {
	selected = lockedDeps.Provider(provider).Version()
	c.Ui.Output(fmt.Sprintf(" - Selected v%s to match dependency lock file", selected.String()))
	} else if len(constraintsStr) > 0 {
	c.Ui.Output(fmt.Sprintf(" - Selected v%s to meet constraints %s", selected.String(), constraintsStr))
	} else {
	c.Ui.Output(fmt.Sprintf(" - Selected v%s with no constraints", selected.String()))
	}

That then fails trying to access the version field through a nil pointer:

terraform/internal/depsfile/locks.go

Lines 378 to 381 in 8f2d640

	// Version returns the currently-selected version for the corresponding provider.
	func (l *ProviderLock) Version() getproviders.Version {
	return l.version
	}

I think the first code snippet above should also check whether lockedDeps.Provider(provider) returned a non-nil pointer, in addition to checking whether the lock file is non-empty.

It seems like this code originated in #32742, which was intending to use an already-selected version if one is present. However, it's only checking whether there are any dependency lock file entries at all, and not checking whether the provider currently under consideration has a lock file entry.

Given that, I think what you've encountered is not specific to the cloudflare/cloudflare provider except that this is a provider you've added recently after you already had a dependency lock file. I expect this would have worked if either the dependency lock file were totally absent or if cloudflare/cloudflare already had an entry in the lock file.

---

If you need a workaround in the meantime, I see two main options (mutually-exclusive; choose only one!):

• Temporarily rename .terraform.lock.hcl while you run terraform providers lock, so that it'll not enter this crashing codepath at all. However, this might cause your mirror to be updated with newer versions of providers than you already have for the ones that had pre-existing lock file entries.
• Temporarily disable using your mirror in the CLI configuration and run terraform init to get the lock file updated to include the cloudflare/cloudflare entry, and then run terraform providers lock against the updated lock file. You can switch back to using your custom mirror afterwards.

[zoonage]

@apparentlymart Thnks for the quick response, I can confirm that the .terrafork.lock.hcl trick works, and you're correct, I've only just started using the cloudflare provider so everything lines up nicely with that explanation.

Is there anything else I can do to help?

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.