Impact of GPG Key Exposure (HCSEC-2021-12) on Terraform Cloud, Terraform Enterprise, & plugin use

[corzine]

Hello,

How does the GPG Key Exposure event (HCSEC-2021-12) affect Terraform Cloud, Terraform Enterprise, and their users? Are they now verifying Terraform plugins with the new HashiCorp key?

HCSEC-2021-12 - Codecov Security Event and HashiCorp GPG Key Exposure

Bulletin ID: HCSEC-2021-12 Publication Date: April 22, 2021 Summary HashiCorp was impacted by a security incident with a third party (Codecov) that led to potential disclosure of sensitive information. As a result, the GPG key used for release signing and verification has been rotated. Customers who verify HashiCorp release signatures may need to update their process to use the new key. Codecov Security Event On April 15, 2021, Codecov (a code coverage solution) publicly disclosed a securit…

Thank you,
-Scott Corzine-

[infa-sajagade]

codesign --verify -d --verbose=2 terraform-provider-aws_v3.37.0_x5
code object is not signed at all

How can we validated terraform providers signatures?

[phinze]

@corzine

How does the GPG Key Exposure event (HCSEC-2021-12) affect Terraform Cloud, Terraform Enterprise, and their users? Are they now verifying Terraform plugins with the new HashiCorp key?

We’re publishing Terraform-specific details related to the security bulletin over on this topic. Right now it has basic information about the updated Terraform CLI releases, but it will be updated with more detailed information about Terraform Cloud and Terraform Enterprise.

@infa-sajagade

How can we validated terraform providers signatures?

Each existing Terraform provider’s release is published with dual GPG signatures - one for the old key and one for the new key. You can verify the signature with the new key by checking the signature in the file that ends in SHA256SUMS.72D7468F.sig using the instructions and key published on our security page.