Skip to content

Allow provider authors to request re-indexing a provider version #642

@ghost

Description

Description of the feature you are looking for.

Currently, when a provider re-releases a binary, the old checksum stays in the registry. While normally provider versions should be immutable, this is often not the case. (See #630, #633, databricks/terraform-provider-databricks#3660, etc.) Since the Terraform registry apparently doesn't treat versions as immutable, we should have a way for provider authors to request re-indexing a specific version.

I propose that we create a GitHub workflow that lets a provider author request reindexing of a version if a) they are an org member in the organization and b) they have submitted a GPG key with the registry and c) the provider version verifies correctly against the GPG key. (This should be part of the issue verification process.) This should be sufficient to protect against most supply chain attacks since the binary will be verified against their GPG key. The process would involve manually merging the change that removes the given version from the registry data so we still have a level of manual control. The created PR should look roughly like #634.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions