You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently, when a provider re-releases a binary, the old checksum stays in the registry. While normally provider versions should be immutable, this is often not the case. (See #630, #633, databricks/terraform-provider-databricks#3660, etc.) Since the Terraform registry apparently doesn't treat versions as immutable, we should have a way for provider authors to request re-indexing a specific version.
I propose that we create a GitHub workflow that lets a provider author request reindexing of a version if a) they are an org member in the organization and b) they have submitted a GPG key with the registry and c) the provider version verifies correctly against the GPG key. (This should be part of the issue verification process.) This should be sufficient to protect against most supply chain attacks since the binary will be verified against their GPG key. The process would involve manually merging the change that removes the given version from the registry data so we still have a level of manual control. The created PR should look roughly like #634.
The text was updated successfully, but these errors were encountered:
ghost
changed the title
Allow users to request re-indexing a provider version
Allow provider authors to request re-indexing a provider version
Jun 7, 2024
Description of the feature you are looking for.
Currently, when a provider re-releases a binary, the old checksum stays in the registry. While normally provider versions should be immutable, this is often not the case. (See #630, #633, databricks/terraform-provider-databricks#3660, etc.) Since the Terraform registry apparently doesn't treat versions as immutable, we should have a way for provider authors to request re-indexing a specific version.
I propose that we create a GitHub workflow that lets a provider author request reindexing of a version if a) they are an org member in the organization and b) they have submitted a GPG key with the registry and c) the provider version verifies correctly against the GPG key. (This should be part of the issue verification process.) This should be sufficient to protect against most supply chain attacks since the binary will be verified against their GPG key. The process would involve manually merging the change that removes the given version from the registry data so we still have a level of manual control. The created PR should look roughly like #634.
The text was updated successfully, but these errors were encountered: