harp-terraformer --out truncates incorrectly when overwriting existing file

[robinverduijn]

Bug

harp-terraformer service --out <existing-file> overwrites the file in place without truncating first. If the new output is shorter than the existing file content, the leftover tail of the old content remains, producing corrupted Terraform output.

This affects all harp SDK commands that use --out on an existing file, not just harp-terraformer.

Root cause

In elastic/harp — pkg/sdk/cmdutil/io.go (~line 97):

os.OpenFile(name, os.O_CREATE|os.O_WRONLY, 0o400)  // missing O_TRUNC

Fix

os.OpenFile(name, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o400)

Steps to reproduce

1. Generate a large .tf file with harp-terraformer service --out output.tf
2. Modify the spec to produce a smaller output
3. Re-run with the same --out output.tf
4. Observe that the tail of the previous file content remains appended to the new output

Workaround

Skip --out and use shell redirection instead (which truncates by default):

harp-terraformer service --spec spec.yaml --env production > output.tf

Notes

• The fix is in elastic/harp (the SDK), but filing here per maintainer guidance — this repo is the appropriate place to track validation and testing.