Build pkg for macOS

[charliwest]

Terraform Version

Terraform v1.14.3
on darwin_arm64

Use Cases

Distributing terraform in enterprise

Attempted Solutions

Can be scripted, but difficult to automate easily

Proposal

A pkg is built to make version and automation easy.

A guide on it can be found here https://scriptingosx.com/2023/08/build-a-notarized-package-with-a-swift-package-manager-executable/

References

No response

[dbanck]

Hi @charliwest!

I'm not sure if I've understood your request correctly.

All Terraform binary releases are published at https://releases.hashicorp.com/terraform and are signed/notarised on Windows and macOS. They are also available via most package managers — see https://docs.hashicorp.com/terraform/install.

Is that what you're looking for? Otherwise, could you please provide more context?

[charliwest]

Hi @dbanck thanks for getting back so quick.
Basically we are looking to use some automations for keeping devices terraform binary up to date. There are already tools out there like AutoPKG, Installomator. These tend to rely on more than the unix executable file being available for downloadable in a zip. Something like a pkg file that installs the binary in /opt/terraform, for example, would make it easy to incorporate into existing tools for macadmins.

For example the podman cli tool does this

[charliwest]

Similar to this request here for another app for context getsops/sops#2040

[radeksimko]

@charliwest I think the linked case is a bit different. We do codesign Terraform binaries with our own Apple Developer Team ID, as Daniel already mentioned.

This can be verified on macOS via codesign, e.g.

$ codesign -dvvv ./terraform 2>&1 | grep Authority

Authority=Developer ID Application: Hashicorp, Inc. (D38WU7D763)
Authority=Developer ID Certification Authority
Authority=Apple Root CA

Any binaries we distribute through official channels are signed that way, for macOS-specific channels this includes our Homebrew tap. Note this is different from the community maintained default tap. i.e. you would have to install terraform via brew install hashicorp/tap/terraform, NOT brew install terraform.

To my knowledge, pkg is more commonly used on macOS to package UI apps or apps which are otherwise more difficult to distribute (i.e. aren't just a single binary). Are there any other popular CLI (not UI) applications which are packaged as pkg for macOS?

For example, HashiCorp Vagrant is packaged as dmg for macOS, because it's written in Ruby, and hence cannot be as easily distributed in the same way as Terraform.

All that is to say - while we could consider expanding the packaging formats - we would likely need a good reason to do so. The binaries we already produce are already signed as mentioned, so that in itself does not seem like a good enough reason.

Is there any other reason for supporting pkg in the context of Terraform? Can you come up with any examples of any other popular software which is CLI-only, that is distributed that way?

[jbardin]

We should also take into consideration that the Terraform team does not manage the release process. That is done by another team at IBM/Hashicorp so that the same processes can be used across all products. If there is no existing release process for pkg packages, and no demand for pkg with any other product, that's probably a showstopper.