TerraHash - a way to lock and verify modules in Terraform by hash. This is the Go project I alluded to earlier in the week. This is still very much a WIP. I haven't even created a build pipeline to generate binaries. Here's the problem I'm trying to address: Modules used by Terraform are not locked in any way or verified by a hash. My recommendation is to set the version constraint for a module to a specific version (e.g. version = "1.2.3") and not a range. Even if you do that, the module maintainer could (in theory) recreate the release with the same version number and different code. It's a possible attack vector or simply has the potential to break things. The solution could be similar to what the .terraform.lock.hcl file does for providers. Create a module lock file that has a hash of each module's contents and verify the hash after initialization. That's what TerraHash is meant to do. You can run it after Terraform initializes using the `terrahash init` command and it will create a lock file called .terraform.module.hcl. The `terrahash check` command verifies the module hashes against the lock file and exits with a 1 code if they don't match. The `terrahash upgrade` command updates the lock file to the current modules. There's still a lot of testing and features I need to get to. But let me know what you think! https://lnkd.in/egBDWYhs
This is a great idea!
Love this idea!
Technical Educator and Content Creator | Microsoft MVP 8x | HashiCorp Ambassador 5x
6moFinished adding a CI and build pipeline, but still need to add tests and some additional features. You can grab the binary now and take it for a spin. I'm also ready for people to submit issues, but not quite ready to accept contributions. This is my first real Go project and I'm going to be selfish with it for a while longer.