Jun 8, 2025 · Jun 8, 2025 · Jun 8, 2025 · Jun 8, 2025 · Jun 8, 2025
diff --git a/provisioner/terraform/executor.go b/provisioner/terraform/executor.go
 "bufio"
 "bytes"
 "context"
 "crypto/sha256"
 "encoding/hex"
 "encoding/json"
 "fmt"
 "io"
 e.mut.Lock()
 defer e.mut.Unlock()

 // Calculate checksum of .terraform.lock.hcl before running terraform init
 lockFilePath := getTerraformLockFilePath(e.workdir)
 preInitChecksum := calculateFileChecksum(lockFilePath)

 outWriter, doneOut := logWriter(logr, proto.LogLevel_DEBUG)
 errWriter, doneErr := logWriter(logr, proto.LogLevel_ERROR)
 defer func() {
 }

 err := e.execWriteOutput(ctx, killCtx, args, e.basicEnv(), outWriter, errBuf)

 // Check if .terraform.lock.hcl was modified after terraform init
 postInitChecksum := calculateFileChecksum(lockFilePath)
 if preInitChecksum != "" && postInitChecksum != "" && preInitChecksum != postInitChecksum {
 // Log warning about lock file changes
 warningMsg := "WARNING: .terraform.lock.hcl was modified during 'terraform init'. " +
 "This may indicate that provider hashes are missing for your target architecture. " +
 "Consider regenerating the lock file on the same OS/architecture as your Coder instance " +
 "to improve provisioning performance and avoid unnecessary provider downloads."

 // Write warning to both debug and error streams to ensure visibility
 if outWriter != nil {
 _, _ = outWriter.Write([]byte(warningMsg + "\n"))
 }
 if errWriter != nil {
 _, _ = errWriter.Write([]byte(warningMsg + "\n"))
 }

 e.logger.Warn(ctx, "terraform lock file modified during init",
 slog.F("lock_file_path", lockFilePath),
 slog.F("pre_init_checksum", preInitChecksum),
 slog.F("post_init_checksum", postInitChecksum),
 )
 }

 var exitErr *exec.ExitError
 if xerrors.As(err, &exitErr) {
 if bytes.Contains(errBuf.b.Bytes(), []byte("text file busy")) {
 return filepath.Join(workdir, "terraform.tfstate")
 }

 func getTerraformLockFilePath(workdir string) string {
 return filepath.Join(workdir, ".terraform.lock.hcl")
 }

 // calculateFileChecksum calculates the SHA256 checksum of a file.
 // Returns empty string if file doesn't exist or can't be read.
 func calculateFileChecksum(filePath string) string {
 data, err := os.ReadFile(filePath)
 if err != nil {
 return ""
 }
 hash := sha256.Sum256(data)
 return hex.EncodeToString(hash[:])
 }

 // revive:disable-next-line:flag-parameter
 func (e *executor) plan(ctx, killCtx context.Context, env, vars []string, logr logSink, metadata *proto.Metadata) (*proto.PlanComplete, error) {
 ctx, span := e.server.startTrace(ctx, tracing.FuncName())
diff --git a/provisioner/terraform/executor_internal_test.go b/provisioner/terraform/executor_internal_test.go

 import (
 "encoding/json"
 "os"
 "path/filepath"
 "testing"

 tfjson "github.com/hashicorp/terraform-json"
 })
 }
 }

 func TestGetTerraformLockFilePath(t *testing.T) {
 t.Parallel()

 workdir := "/tmp/test"
 expected := filepath.Join(workdir, ".terraform.lock.hcl")
 got := getTerraformLockFilePath(workdir)
 require.Equal(t, expected, got)
 }

 func TestCalculateFileChecksum(t *testing.T) {
 t.Parallel()

 // Test with non-existent file
 checksum := calculateFileChecksum("/non/existent/file")
 require.Equal(t, "", checksum)

 // Test with actual file
 tmpDir := t.TempDir()
 testFile := filepath.Join(tmpDir, "test.txt")
 testContent := "test content for checksum"

 err := os.WriteFile(testFile, []byte(testContent), 0o600)
 require.NoError(t, err)

 checksum1 := calculateFileChecksum(testFile)
 require.NotEmpty(t, checksum1)
 require.Len(t, checksum1, 64) // SHA256 hex string length

 // Same content should produce same checksum
 checksum2 := calculateFileChecksum(testFile)
 require.Equal(t, checksum1, checksum2)

 // Different content should produce different checksum
 err = os.WriteFile(testFile, []byte("different content"), 0o600)
 require.NoError(t, err)

 checksum3 := calculateFileChecksum(testFile)
 require.NotEqual(t, checksum1, checksum3)
 require.Len(t, checksum3, 64)
 }
Original file line number	Diff line number	Diff line change
Expand Up		@@ -4,6 +4,8 @@ import (
		"bufio"
		"bytes"
		"context"
		"crypto/sha256"
		"encoding/hex"
		"encoding/json"
		"fmt"
		"io"
Expand DownExpand Up		@@ -222,6 +224,10 @@ func (e *executor) init(ctx, killCtx context.Context, logr logSink) error {
		e.mut.Lock()
		defer e.mut.Unlock()

		// Calculate checksum of .terraform.lock.hcl before running terraform init
		lockFilePath := getTerraformLockFilePath(e.workdir)
		preInitChecksum := calculateFileChecksum(lockFilePath)

		outWriter, doneOut := logWriter(logr, proto.LogLevel_DEBUG)
		errWriter, doneErr := logWriter(logr, proto.LogLevel_ERROR)
		defer func() {
Expand All		@@ -242,6 +248,31 @@ func (e *executor) init(ctx, killCtx context.Context, logr logSink) error {
		}

		err := e.execWriteOutput(ctx, killCtx, args, e.basicEnv(), outWriter, errBuf)

		// Check if .terraform.lock.hcl was modified after terraform init
		postInitChecksum := calculateFileChecksum(lockFilePath)
		if preInitChecksum != "" && postInitChecksum != "" && preInitChecksum != postInitChecksum {
		// Log warning about lock file changes
		warningMsg := "WARNING: .terraform.lock.hcl was modified during 'terraform init'. " +
		"This may indicate that provider hashes are missing for your target architecture. " +
		"Consider regenerating the lock file on the same OS/architecture as your Coder instance " +
		"to improve provisioning performance and avoid unnecessary provider downloads."

		// Write warning to both debug and error streams to ensure visibility
		if outWriter != nil {
		_, _ = outWriter.Write([]byte(warningMsg + "\n"))
		}
		if errWriter != nil {
		_, _ = errWriter.Write([]byte(warningMsg + "\n"))
		}

		e.logger.Warn(ctx, "terraform lock file modified during init",
		slog.F("lock_file_path", lockFilePath),
		slog.F("pre_init_checksum", preInitChecksum),
		slog.F("post_init_checksum", postInitChecksum),
		)
		}

		var exitErr *exec.ExitError
		if xerrors.As(err, &exitErr) {
		if bytes.Contains(errBuf.b.Bytes(), []byte("text file busy")) {
Expand All		@@ -259,6 +290,21 @@ func getStateFilePath(workdir string) string {
		return filepath.Join(workdir, "terraform.tfstate")
		}

		func getTerraformLockFilePath(workdir string) string {
		return filepath.Join(workdir, ".terraform.lock.hcl")
		}

		// calculateFileChecksum calculates the SHA256 checksum of a file.
		// Returns empty string if file doesn't exist or can't be read.
		func calculateFileChecksum(filePath string) string {
		data, err := os.ReadFile(filePath)
		if err != nil {
		return ""
		}
		hash := sha256.Sum256(data)
		return hex.EncodeToString(hash[:])
		}

		// revive:disable-next-line:flag-parameter
		func (e executor) plan(ctx, killCtx context.Context, env, vars []string, logr logSink, metadata proto.Metadata) (*proto.PlanComplete, error) {
		ctx, span := e.server.startTrace(ctx, tracing.FuncName())
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -2,6 +2,8 @@ package terraform

		import (
		"encoding/json"
		"os"
		"path/filepath"
		"testing"

		tfjson "github.com/hashicorp/terraform-json"
Expand DownExpand Up		@@ -173,3 +175,44 @@ func TestOnlyDataResources(t *testing.T) {
		})
		}
		}

		func TestGetTerraformLockFilePath(t *testing.T) {
		t.Parallel()

		workdir := "/tmp/test"
		expected := filepath.Join(workdir, ".terraform.lock.hcl")
		got := getTerraformLockFilePath(workdir)
		require.Equal(t, expected, got)
		}

		func TestCalculateFileChecksum(t *testing.T) {
		t.Parallel()

		// Test with non-existent file
		checksum := calculateFileChecksum("/non/existent/file")
		require.Equal(t, "", checksum)

		// Test with actual file
		tmpDir := t.TempDir()
		testFile := filepath.Join(tmpDir, "test.txt")
		testContent := "test content for checksum"

		err := os.WriteFile(testFile, []byte(testContent), 0o600)
		require.NoError(t, err)

		checksum1 := calculateFileChecksum(testFile)
		require.NotEmpty(t, checksum1)
		require.Len(t, checksum1, 64) // SHA256 hex string length

		// Same content should produce same checksum
		checksum2 := calculateFileChecksum(testFile)
		require.Equal(t, checksum1, checksum2)

		// Different content should produce different checksum
		err = os.WriteFile(testFile, []byte("different content"), 0o600)
		require.NoError(t, err)

		checksum3 := calculateFileChecksum(testFile)
		require.NotEqual(t, checksum1, checksum3)
		require.Len(t, checksum3, 64)
		}