From a04c890c546c57d993ee36984e9add771baea5ff Mon Sep 17 00:00:00 2001
From: Katy Moe <katy@katy.moe>
Date: Mon, 7 Sep 2020 19:49:06 +0100
Subject: [PATCH] add more excluded env vars

---
 tfexec/cmd.go       | 20 ++++++++++++--------
 tfexec/terraform.go | 34 +++++++++++++++++++++++++++++-----
 tfexec/version.go   |  1 +
 3 files changed, 42 insertions(+), 13 deletions(-)

diff --git a/tfexec/cmd.go b/tfexec/cmd.go
index 7473b66c..1ea88921 100644
--- a/tfexec/cmd.go
+++ b/tfexec/cmd.go
@@ -15,14 +15,16 @@ import (
 )
 
 const (
-	checkpointDisableEnvVar = "CHECKPOINT_DISABLE"
-	logEnvVar               = "TF_LOG"
-	inputEnvVar             = "TF_INPUT"
-	automationEnvVar        = "TF_IN_AUTOMATION"
-	logPathEnvVar           = "TF_LOG_PATH"
-	reattachEnvVar          = "TF_REATTACH_PROVIDERS"
-	appendUserAgentEnvVar   = "TF_APPEND_USER_AGENT"
-	workspaceEnvVar         = "TF_WORKSPACE"
+	checkpointDisableEnvVar  = "CHECKPOINT_DISABLE"
+	logEnvVar                = "TF_LOG"
+	inputEnvVar              = "TF_INPUT"
+	automationEnvVar         = "TF_IN_AUTOMATION"
+	logPathEnvVar            = "TF_LOG_PATH"
+	reattachEnvVar           = "TF_REATTACH_PROVIDERS"
+	appendUserAgentEnvVar    = "TF_APPEND_USER_AGENT"
+	workspaceEnvVar          = "TF_WORKSPACE"
+	disablePluginTLSEnvVar   = "TF_DISABLE_PLUGIN_TLS"
+	skipProviderVerifyEnvVar = "TF_SKIP_PROVIDER_VERIFY"
 
 	varEnvVarPrefix = "TF_VAR_"
 )
@@ -35,6 +37,8 @@ var prohibitedEnvVars = []string{
 	reattachEnvVar,
 	appendUserAgentEnvVar,
 	workspaceEnvVar,
+	disablePluginTLSEnvVar,
+	skipProviderVerifyEnvVar,
 }
 
 func envMap(environ []string) map[string]string {
diff --git a/tfexec/terraform.go b/tfexec/terraform.go
index a9f3d2df..beeb8263 100644
--- a/tfexec/terraform.go
+++ b/tfexec/terraform.go
@@ -1,6 +1,7 @@
 package tfexec
 
 import (
+	"context"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -32,11 +33,15 @@ type printfer interface {
 //  - TF_LOG
 //  - TF_LOG_PATH
 //  - TF_REATTACH_PROVIDERS
+//  - TF_DISABLE_PLUGIN_TLS
+//  - TF_SKIP_PROVIDER_VERIFY
 type Terraform struct {
-	execPath        string
-	workingDir      string
-	appendUserAgent string
-	env             map[string]string
+	execPath           string
+	workingDir         string
+	appendUserAgent    string
+	disablePluginTLS   bool
+	skipProviderVerify bool
+	env                map[string]string
 
 	stdout  io.Writer
 	stderr  io.Writer
@@ -125,8 +130,27 @@ func (tf *Terraform) SetLogPath(path string) error {
 
 // SetAppendUserAgent sets the TF_APPEND_USER_AGENT environment variable for
 // Terraform CLI execution.
-func (tf *Terraform) SetAppendUserAgent(ua string) {
+func (tf *Terraform) SetAppendUserAgent(ua string) error {
 	tf.appendUserAgent = ua
+	return nil
+}
+
+// SetDisablePluginTLS sets the TF_DISABLE_PLUGIN_TLS environment variable for
+// Terraform CLI execution.
+func (tf *Terraform) SetDisablePluginTLS(disabled bool) error {
+	tf.disablePluginTLS = disabled
+	return nil
+}
+
+// SetSkipProviderVerify sets the TF_SKIP_PROVIDER_VERIFY environment variable
+// for Terraform CLI execution. This is no longer used in 0.13.0 and greater.
+func (tf *Terraform) SetSkipProviderVerify(skip bool) error {
+	err := tf.compatible(context.Background(), nil, tf0_13_0)
+	if err != nil {
+		return err
+	}
+	tf.skipProviderVerify = skip
+	return nil
 }
 
 // WorkingDir returns the working directory for Terraform.
diff --git a/tfexec/version.go b/tfexec/version.go
index 88184a64..aadf369a 100644
--- a/tfexec/version.go
+++ b/tfexec/version.go
@@ -13,6 +13,7 @@ import (
 
 var (
 	tf0_12_0 = version.Must(version.NewVersion("0.12.0"))
+	tf0_13_0 = version.Must(version.NewVersion("0.13.0"))
 )
 
 // Version returns structured output from the terraform version command including both the Terraform CLI version