Skip to content

Commit 91460a3

Browse files
Kaniska244CopilotAlvaroRausell
authored
[terraform] - Fix terraform installation in ubuntu noble. (#1421)
* [terraform] - Fix terraform installation in ubuntu noble. * Adding warning message. * Small changes in the test scripts. * Apply suggestions from code review, removing whitespaces. Co-authored-by: Copilot <[email protected]> * Apply suggestions from code review, to convert into a generic function. Co-authored-by: Copilot <[email protected]> * Adding further on review comments * Update src/terraform/install.sh, updating comment. Co-authored-by: Copilot <[email protected]> * Update src/terraform/install.sh, removing whitespaces Co-authored-by: Copilot <[email protected]> * Further change to put function for common code as per review comment. * Corrections done based on review comments. * Further corrections. * Update src/terraform/install.sh Co-authored-by: Álvaro Rausell Guiard <[email protected]> * Correction in error handling based on review comment. * To check if able start tests --------- Co-authored-by: Copilot <[email protected]> Co-authored-by: Álvaro Rausell Guiard <[email protected]>
1 parent e3e3ed7 commit 91460a3

File tree

5 files changed

+146
-11
lines changed

5 files changed

+146
-11
lines changed

‎src/terraform/devcontainer-feature.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"id": "terraform",
3-
"version": "1.4.0",
3+
"version": "1.4.1",
44
"name": "Terraform, tflint, and TFGrunt",
55
"documentationURL": "https://github.com/devcontainers/features/tree/main/src/terraform",
66
"description": "Installs the Terraform CLI and optionally TFLint and Terragrunt. Auto-detects latest version and installs needed dependencies.",

‎src/terraform/install.sh

Lines changed: 90 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,15 @@ if [ "$(id -u)" -ne 0 ]; then
5050
exit 1
5151
fi
5252

53+
# Detect Ubuntu Noble and use new repo setup, else use legacy GPG logic
54+
IS_NOBLE=0
55+
if grep -qi 'ubuntu' /etc/os-release; then
56+
. /etc/os-release
57+
if [[ "$VERSION_CODENAME" == "noble" ]]; then
58+
IS_NOBLE=1
59+
fi
60+
fi
61+
5362
# Get the list of GPG key servers that are reachable
5463
get_gpg_key_servers() {
5564
declare -A keyservers_curl_map=(
@@ -89,7 +98,7 @@ receive_gpg_keys() {
8998
keyring_args="--no-default-keyring --keyring $2"
9099
fi
91100
if [ ! -z "${KEYSERVER_PROXY}" ]; then
92-
keyring_args="${keyring_args} --keyserver-options http-proxy=${KEYSERVER_PROXY}"
101+
keyring_args="${keyring_args} --keyserver-options http-proxy=${KEYSERVER_PROXY}"
93102
fi
94103

95104
# Install curl
@@ -101,6 +110,21 @@ receive_gpg_keys() {
101110
export GNUPGHOME="/tmp/tmp-gnupg"
102111
mkdir -p ${GNUPGHOME}
103112
chmod 700 ${GNUPGHOME}
113+
114+
# Special handling for HashiCorp GPG key on Ubuntu Noble
115+
if [ "$IS_NOBLE" -eq 1 ] && [ "$keys" = "$TERRAFORM_GPG_KEY" ]; then
116+
echo "(*) Ubuntu Noble detected, using Keybase for HashiCorp GPG key import...."
117+
curl -fsSL https://keybase.io/hashicorp/pgp_keys.asc | gpg --import
118+
if ! gpg --list-keys "${TERRAFORM_GPG_KEY}" > /dev/null 2>&1; then
119+
gpg --list-keys
120+
echo "(*) Warning: HashiCorp GPG key not found in keyring after import."
121+
echo " Continuing installation without GPG verification on Ubuntu Noble."
122+
echo " This is expected behavior for Ubuntu Noble due to keyserver issues."
123+
return 1 # Return failure to indicate GPG verification should be skipped
124+
fi
125+
return 0
126+
fi
127+
104128
echo -e "disable-ipv6\n$(get_gpg_key_servers)" > ${GNUPGHOME}/dirmngr.conf
105129
# GPG key download sometimes fails for some reason and retrying fixes it.
106130
local retry_count=0
@@ -366,6 +390,32 @@ install_terraform() {
366390
curl -sSL -o ${terraform_filename} "${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/${terraform_filename}"
367391
}
368392

393+
verify_signature() {
394+
local gpg_key=$1
395+
local sha256sums_url=$2
396+
local sig_url=$3
397+
local sha256sums_file=$4
398+
local sig_file=$5
399+
local verify_result=0
400+
401+
receive_gpg_keys "$gpg_key"
402+
verify_result=$?
403+
if [ $verify_result -ne 0 ] && [ "$IS_NOBLE" -eq 1 ]; then
404+
echo "Skipping the gpg key validation for ubuntu noble as unable to import the key."
405+
return 1
406+
fi
407+
curl -sSL -o "$sha256sums_file" "$sha256sums_url"
408+
curl -sSL -o "$sig_file" "$sig_url"
409+
410+
# Try GPG verification, but don't fail on Noble
411+
gpg --verify "$sig_file" "$sha256sums_file"
412+
verify_result=$?
413+
if [ $verify_result -ne 0 ]; then
414+
echo "(!) GPG verification failed."
415+
exit 1
416+
fi
417+
}
418+
369419
mkdir -p /tmp/tf-downloads
370420
cd /tmp/tf-downloads
371421
# Install Terraform, tflint, Terragrunt
@@ -378,10 +428,25 @@ if grep -q "The specified key does not exist." "${terraform_filename}"; then
378428
fi
379429
if [ "${TERRAFORM_SHA256}" != "dev-mode" ]; then
380430
if [ "${TERRAFORM_SHA256}" = "automatic" ]; then
381-
receive_gpg_keys TERRAFORM_GPG_KEY
382-
curl -sSL -o terraform_SHA256SUMS "${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS"
383-
curl -sSL -o terraform_SHA256SUMS.sig "${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS.${TERRAFORM_GPG_KEY}.sig"
384-
gpg --verify terraform_SHA256SUMS.sig terraform_SHA256SUMS
431+
# For Ubuntu Noble, try GPG verification but continue if it fails
432+
if [ "$IS_NOBLE" -eq 1 ]; then
433+
echo "(*) Ubuntu Noble detected - attempting GPG verification with fallback..."
434+
set +e
435+
sha256sums_url="${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS"
436+
sig_url="${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS.${TERRAFORM_GPG_KEY}.sig"
437+
verify_signature TERRAFORM_GPG_KEY "$sha256sums_url" "$sig_url" "terraform_SHA256SUMS" "terraform_SHA256SUMS.sig"
438+
verify_result=$?
439+
set -e
440+
if [ $verify_result -ne 0 ]; then
441+
echo "(*) GPG verification failed on Ubuntu Noble, but continuing installation."
442+
echo " Downloading checksums for basic integrity check..."
443+
curl -sSL -o terraform_SHA256SUMS "${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS"
444+
fi
445+
else
446+
sha256sums_url="${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS"
447+
sig_url="${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS.${TERRAFORM_GPG_KEY}.sig"
448+
verify_signature TERRAFORM_GPG_KEY "$sha256sums_url" "$sig_url" "terraform_SHA256SUMS" "terraform_SHA256SUMS.sig"
449+
fi
385450
else
386451
echo "${TERRAFORM_SHA256} *${terraform_filename}" > terraform_SHA256SUMS
387452
fi
@@ -477,12 +542,27 @@ if [ "${INSTALL_SENTINEL}" = "true" ]; then
477542
curl -sSL -o /tmp/tf-downloads/${sentinel_filename} ${sentinel_releases_url}/${SENTINEL_VERSION}/${sentinel_filename}
478543
if [ "${SENTINEL_SHA256}" != "dev-mode" ]; then
479544
if [ "${SENTINEL_SHA256}" = "automatic" ]; then
480-
receive_gpg_keys TERRAFORM_GPG_KEY
481-
curl -sSL -o sentinel_checksums.txt ${sentinel_releases_url}/${SENTINEL_VERSION}/sentinel_${SENTINEL_VERSION}_SHA256SUMS
482-
curl -sSL -o sentinel_checksums.txt.sig ${sentinel_releases_url}/${SENTINEL_VERSION}/sentinel_${SENTINEL_VERSION}_SHA256SUMS.${TERRAFORM_GPG_KEY}.sig
483-
gpg --verify sentinel_checksums.txt.sig sentinel_checksums.txt
545+
# For Ubuntu Noble, try GPG verification but continue if it fails
546+
if [ "$IS_NOBLE" -eq 1 ]; then
547+
echo "(*) Ubuntu Noble detected - attempting Sentinel GPG verification with fallback..."
548+
set +e
549+
sha256sums_url="${sentinel_releases_url}/${SENTINEL_VERSION}/sentinel_${SENTINEL_VERSION}_SHA256SUMS"
550+
sig_url="${sentinel_releases_url}/${SENTINEL_VERSION}/sentinel_${SENTINEL_VERSION}_SHA256SUMS.${TERRAFORM_GPG_KEY}.sig"
551+
verify_signature TERRAFORM_GPG_KEY "$sha256sums_url" "$sig_url" "sentinel_checksums.txt" "sentinel_checksums.txt.sig"
552+
verify_result=$?
553+
set -e
554+
if [ $verify_result -ne 0 ]; then
555+
echo "(*) GPG verification failed on Ubuntu Noble, but continuing installation."
556+
echo " Downloading checksums for basic integrity check..."
557+
curl -sSL -o sentinel_checksums.txt "${sentinel_releases_url}/${SENTINEL_VERSION}/sentinel_${SENTINEL_VERSION}_SHA256SUMS"
558+
fi
559+
else
560+
sha256sums_url="${sentinel_releases_url}/${SENTINEL_VERSION}/sentinel_${SENTINEL_VERSION}_SHA256SUMS"
561+
sig_url="${sentinel_releases_url}/${SENTINEL_VERSION}/sentinel_${SENTINEL_VERSION}_SHA256SUMS.${TERRAFORM_GPG_KEY}.sig"
562+
verify_signature TERRAFORM_GPG_KEY "$sha256sums_url" "$sig_url" "sentinel_checksums.txt" "sentinel_checksums.txt.sig"
563+
fi
484564
# Verify the SHASUM matches the archive
485-
shasum -a 256 --ignore-missing -c sentinel_checksums.txt
565+
shasum -a 256 --ignore-missing -c sentinel_checksums.txt
486566
else
487567
echo "${SENTINEL_SHA256} *${SENTINEL_FILENAME}" >sentinel_checksums.txt
488568
fi

‎test/terraform/install_in_ubuntu_noble.sh

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/bin/bash
2+
3+
set -e
4+
5+
# Import test library
6+
source dev-container-features-test-lib
7+
8+
# Check to make sure the user is vscode
9+
check "user is vscode" whoami | grep vscode
10+
11+
# Check if terraform was installed correctly
12+
check "terraform installed" terraform --version
13+
14+
check "tflint" tflint --version
15+
16+
# Report results
17+
reportResults
18+

‎test/terraform/install_in_ubuntu_noble_sentinel.sh

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/bin/bash
2+
3+
set -e
4+
5+
# Import test library for `check` command
6+
source dev-container-features-test-lib
7+
8+
# Check to make sure the user is vscode
9+
check "user is vscode" whoami | grep vscode
10+
11+
# Check if terraform was installed correctly
12+
check "terraform installed" terraform --version
13+
14+
check "tflint" tflint --version
15+
16+
# Sentinel specific tests
17+
check "sentinel" sentinel --version
18+
19+
# Report result
20+
reportResults
21+

‎test/terraform/scenarios.json

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,20 @@
11
{
2+
"install_in_ubuntu_noble": {
3+
"image": "mcr.microsoft.com/devcontainers/base:noble",
4+
"features": {
5+
"terraform": {
6+
"version": "latest"
7+
}
8+
}
9+
},
10+
"install_in_ubuntu_noble_sentinel": {
11+
"image": "mcr.microsoft.com/devcontainers/base:noble",
12+
"features": {
13+
"terraform": {
14+
"installSentinel": true
15+
}
16+
}
17+
},
218
"install_sentinel": {
319
"image": "mcr.microsoft.com/devcontainers/base:jammy",
420
"features": {

0 commit comments

Comments
 (0)