Terraform lockfile zh hashes

[viceice]

Currently Renovate updates only the h1 hashes. So when i do an terraform init i now get a modified lockfile

@secustor Is it possible to additionally generate the zh hashes?

[viceice]

Or is there maybe an option to suppress the old zh hashes 🤔

[secustor]

Yes it should be possible to add them as these are exposed using their API https://releases.hashicorp.com/terraform-provider-kubernetes/2.5.0/terraform-provider-kubernetes_2.5.0_SHA256SUMS, but they are not needed for the functionality.

You should be able to skip this using terraform init -lockfile=readonly

[viceice]

trying -lockfile=readonly

[viceice]

ok -lockfile=readonly seems to work, would like to have it as default 😅

are the zh hases outdated? Will they be removed in future? or does it make sense to support the too?

[secustor]

zh hashes are only for the download. Terraform generates a h1 for your local arch and os and complains if there is none. So h1 make it work.

This suggests that they are facing it out https://www.terraform.io/docs/language/dependency-lock.html#zh- but no timeline as far as I know

[ekristen]

First renovate is AMAZING, probably one of the best OSS tools in well over a decade and what you've all done is amazing, so thank you!

I would like to jump in on this discussion. Unfortunately I have to disagree with your point of view @secustor.

It is my opinion that you are essentially saying that if someone wants to use renovate for terraform that they have to use non-default options to make it work, I think this is a bad precedence to set with renovate.

To put this another way, in the context of node.js, this would be the equivalent to saying renovate can keep dependencies up to date, but the file has to be called package-renovate.json and you have to call a non-standard npm install --config=renovate-package.json to use it otherwise it won't work. Yes I'm aware that's not a valid command, just using as an example to make a point.

The suggestion to use the -lockfile=readonly is a workaround to prevent issues with a lockfile generated by renovate that is essentially incomplete.

Another reason I would consider this a workaround is that even though zh is considered legacy, there is no way to natively disable it from being added by terraform.

Until terraform stops using and adding the zh hash, renovate have parity on it's own implementation, otherwise it looks like all the PRs done by renovate are inconsistent with user usage.

Thank you for your time.

[secustor]

Also this setup allows us to cache the hashes, which the CLI does not.

• Automatically cache zh and h1 hash values for all downloaded providers hashicorp/terraform#27811
• Do not download and index already mirrored providers hashicorp/terraform#28333

[pascal-hofmann]

A workaround to prevent terraform from adding the zh hashes is setting the env var TF_CLI_ARGS_init="-lockfile=readonly.

This way not every call to terraform init has to be changed.

[Daniel-I-Am]

Missing zh hash format is still an issue when renovating Terraform. And Hashicorp still shows no sign of actually removing them from the lockfile.

The issue that was ostensibly created for this has been deleted (https://github.com/renovatebot/renovate/issues/13692), is there still an issue currently tracking this feature request?

[rarkins]

We don't have any solution or plan to change anything so therefore this Discussion is the place to track.

Solutions are welcome, repeating the problem doesn't really help at all

[Daniel-I-Am]

All good! I will take a stab at the problem, see if it's something I can figure out 🤞