PSS: Add interactive confirmation of state storage provider trust when initialising a state store for the first time by SarahFrench · Pull Request #38395 · hashicorp/terraform

SarahFrench · 2026-04-16T15:30:50Z

Closes https://hashicorp.atlassian.net/browse/TF-33680

This is a reworking of discovery in #38205. Following design changes, we no longer expect a new flag to be used in this feature.

The security features added in this PR will be active during init only. They'll only be active when the state store provider is being installed for the first time, via HTTP. We believe using provider from a local cache or filesystem mirror shows that trust has already been established for the provider so the prompt is not shown then. See the ticket for more information.

Given that all changes to a state store are going to be implemented in a new state migrate command (see #38388), the work in this PR will need to be replicated in the new state migrate command.

Reviewer 👋🏻

~~It's worth going commit by commit in this PR, given that I start with this change 7f9c48c because that obscures how I later change the callbacks slightly in getProvidersFromConfig~~

Hang in there! 😉

Target Release

1.16.x

Rollback Plan

If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

CHANGELOG entry

This change is user-facing and I added a changelog entry.
This change is not user-facing.

SarahFrench · 2026-04-23T12:56:28Z

+	var authentication string
+	if authResult != nil && authResult.KeyID != "" {
+		authentication = fmt.Sprintf("%s, key ID %s", authResult.String(), authResult.KeyID)
+	} else {
+		authentication = authResult.String()
+	}


As the (AI?) comment also noted, this is an area that I'd like to get some feedback on in the review process. I think that the auth result is only populated when I download a provider from the Registry, which makes it hard to test.

Given that the prompt is only shown when a provider is downloaded via HTTP I think we always expect there to be an auth result when a prompt is shown. My test simulating download via HTTP is highly artificial, and it's unclear to me right now what the gap is there versus downloading a provider from a Registry or a network mirror.

Researching this some more today...

Ok, so here's my understanding:

The process of installing providers gets meta data for a given provider here. An installer can include multiple sources of providers, and the presence of Authentication metadata (that this thread focuses on) depends on the source that's in play.

Irrelevant sources, which just wrap other sources: MemoizeSource, MultiSource
Sources used by end-users:

FilesystemMirrorSource

HTTPMirrorSource

RegistrySource (uses registryClient internally)

Sources used in our tests:

MockSource

The Authentication metadata returned from these sources vary:

FilesystemMirrorSource never has Authentication metadata:

Obtains provider metadata via SearchLocalDirectory, which never sets Authentication metadata (also, note the FIXMEs -lol)

HTTPMirrorSource only has Authentication metadata if the network mirror's response data includes hashes - not guaranteed.

Sets meta data directly in the PackageMeta method. Here, Authentication is conditionally set depending on whether the network mirror sends information about expected hashes. See example network mirror response data that does contain hashes.

RegistrySource always has Authentication metadata

Gets meta data via (registryClient) PackageMeta

MockSource returns Authentication metadata like this.

The features in this PR are only active when a provider is downloaded via HTTP. So, only HTTPMirrorSource and RegistrySource are relevant. The only time when we'd have a lack of Authentication data is when using a network mirror and that network mirror doesn't include any hash data for the state store provider.

I could look at enabling tests to use an HTTPMirrorSource in combination with a test server - I'll look into that next week.

Rebased to pull in changes from #38447 merged to main. I've added the test in a11fa85

…ing the new newMockProviderSourceUsingTestHttpServer method

…ow finer control of callbacks when implementing security related features

…use, and only if downloaded via HTTP.

… method I originally added this to have more control over what we render in the prompt, but I'm walking this back before seeking feedback in review. Could (*PackageAuthenticationResult) .String() be sufficient?

Ahh!

…k mirror doesn't include hashes

…ining reused callbacks Co-authored-by: Copilot <copilot@github.com>

SarahFrench

Some quick comments for reviewers

SarahFrench · 2026-04-28T16:27:46Z

 	return "Prepare your working directory for other commands"
 }

+// Returns a reused callback function for the ProviderAlreadyInstalled event in a providercache.InstallerEvents struct.


This section of many, many callbacks was essentially a copy-paste job from getProvidersFromConfig and then working out what variables were previously caught by closures and now needed to be explicit arguments for creating the callback.

SarahFrench · 2026-04-28T16:32:42Z

+			// 2. Call the shared callback for FetchPackageSuccess
+			cb := fetchPackageSuccessCallback(view)
+			cb(provider, version, localDir, authResult)


Whereas PendingProviders and QueryPackagesBegin have their own logic above due to needing specific message content to send to the view, the FetchPackageSuccess callback is handling distinct tasks and I think using a callback like this helps highlight what's special logic for this calling code .

mildwonkey

love the changes to events, thank you!

SarahFrench added the no-changelog-needed Add this to your PR if the change does not require a changelog entry label Apr 16, 2026

SarahFrench changed the base branch from main to pss/TF-36273-no-pss-upgrade-in-init April 16, 2026 15:31

This comment was marked as resolved.

Sign in to view

SarahFrench force-pushed the pss/TF-33680-interactive-confirm-pss-providers branch 2 times, most recently from 2988e59 to 2a398fd Compare April 17, 2026 18:47

SarahFrench changed the title ~~Pss/tf 33680 interactive confirm pss providers~~ PSS: Add interactive confirmation of state storage provider trust when initialising a state store for the first time Apr 17, 2026

SarahFrench force-pushed the pss/TF-36273-no-pss-upgrade-in-init branch from cb46802 to aa50304 Compare April 21, 2026 11:45

SarahFrench force-pushed the pss/TF-33680-interactive-confirm-pss-providers branch from e65292f to 7945eb3 Compare April 21, 2026 11:48

This comment was marked as resolved.

Sign in to view

Base automatically changed from pss/TF-36273-no-pss-upgrade-in-init to main April 23, 2026 06:51

SarahFrench force-pushed the pss/TF-33680-interactive-confirm-pss-providers branch 3 times, most recently from c47c251 to 03f4de7 Compare April 23, 2026 07:27

SarahFrench marked this pull request as ready for review April 23, 2026 12:48

SarahFrench requested a review from a team as a code owner April 23, 2026 12:48

SarahFrench commented Apr 23, 2026

View reviewed changes

This was referenced Apr 27, 2026

refactor: Separate concerns in mock provider sources logic, handle callbacks using t.Cleanup #38446

Merged

test: Add test helper for mocking out use of a network mirror as a provider source #38447

Merged

SarahFrench removed the no-changelog-needed Add this to your PR if the change does not require a changelog entry label Apr 28, 2026

SarahFrench force-pushed the pss/TF-33680-interactive-confirm-pss-providers branch from d67c9ab to c6c30a6 Compare April 28, 2026 12:10

SarahFrench added the no-changelog-needed Add this to your PR if the change does not require a changelog entry label Apr 28, 2026

This comment was marked as resolved.

Sign in to view

SarahFrench added 8 commits April 28, 2026 17:29

test: Remove temporary test case; it'll now be replaced with tests us…

f661ebf

…ing the new newMockProviderSourceUsingTestHttpServer method

refactor: Replace use of prepareInstallerEvents method. This will all…

2ad24d9

…ow finer control of callbacks when implementing security related features

refactor: Remove unused prepareInstallerEvents method

6c71dfe

feat: Users are prompted to approve a provider used for PSS on first …

2d491c0

…use, and only if downloaded via HTTP.

Prefer "state storage" over "pluggable state storage"

bde9564

Add signer details to the prompt shown to users

cbd221d

update user prompt to include key ID data

c7084f0

Remove unused (*PackageAuthenticationResult) SignedByHashiCorpPartner…

5663517

… method I originally added this to have more control over what we render in the prompt, but I'm walking this back before seeking feedback in review. Could (*PackageAuthenticationResult) .String() be sufficient?

SarahFrench and others added 5 commits April 28, 2026 17:29

fix: Return correct auth result from getProvidersFromConfig, update test

b549ba2

Ahh!

test: Users see "Authentication: unauthenticated" in prompt if networ…

269bf16

…k mirror doesn't include hashes

rename test cases

f077eff

refactor: Simplify how we prepare installation event callbacks by def…

b91304d

…ining reused callbacks Co-authored-by: Copilot <copilot@github.com>

refactor: Update getProvidersFromState to use the shared callbacks

95bd13f

SarahFrench force-pushed the pss/TF-33680-interactive-confirm-pss-providers branch from 972ac1f to 95bd13f Compare April 28, 2026 16:29

SarahFrench commented Apr 28, 2026

View reviewed changes

SarahFrench mentioned this pull request Apr 29, 2026

PSS: Allow users of Terraform in automation to trust the state storage provider when initialising a state store for the first time #38461

Draft

3 tasks

mildwonkey reviewed Apr 29, 2026

View reviewed changes

Comment thread internal/command/init.go Outdated

fix borked code comment

163546b

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

PSS: Add interactive confirmation of state storage provider trust when initialising a state store for the first time#38395

PSS: Add interactive confirmation of state storage provider trust when initialising a state store for the first time#38395
SarahFrench wants to merge 14 commits intomainfrom
pss/TF-33680-interactive-confirm-pss-providers

SarahFrench commented Apr 16, 2026 •

edited

Loading

Uh oh!

This comment was marked as resolved.

This comment was marked as resolved.

SarahFrench Apr 23, 2026

Uh oh!

SarahFrench Apr 24, 2026

Uh oh!

SarahFrench Apr 24, 2026 •

edited

Loading

Uh oh!

SarahFrench Apr 24, 2026

Uh oh!

SarahFrench Apr 27, 2026 •

edited

Loading

Uh oh!

This comment was marked as resolved.

Uh oh!

SarahFrench left a comment

Uh oh!

SarahFrench Apr 28, 2026

Uh oh!

SarahFrench Apr 28, 2026

Uh oh!

mildwonkey left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

SarahFrench commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer 👋🏻

Target Release

Rollback Plan

Changes to Security Controls

CHANGELOG entry

Uh oh!

This comment was marked as resolved.

This comment was marked as resolved.

SarahFrench Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

SarahFrench Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

SarahFrench Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SarahFrench Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

SarahFrench Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment was marked as resolved.

Uh oh!

SarahFrench left a comment

Choose a reason for hiding this comment

Uh oh!

SarahFrench Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

SarahFrench Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

mildwonkey left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

SarahFrench commented Apr 16, 2026 •

edited

Loading

SarahFrench Apr 24, 2026 •

edited

Loading

SarahFrench Apr 27, 2026 •

edited

Loading