1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
|
{ stdenv
, lib
, buildGoModule
, fetchFromGitHub
, makeWrapper
, coreutils
, runCommand
, runtimeShell
, writeText
, terraform-providers
, installShellFiles
}:
let
generic = { version, hash, vendorHash ? null, ... }@attrs:
let attrs' = builtins.removeAttrs attrs [ "version" "hash" "vendorHash" ];
in
buildGoModule ({
pname = "terraform";
inherit version vendorHash;
src = fetchFromGitHub {
owner = "hashicorp";
repo = "terraform";
rev = "v${version}";
inherit hash;
};
ldflags = [ "-s" "-w" ];
postConfigure = ''
# speakeasy hardcodes /bin/stty https://github.com/bgentry/speakeasy/issues/22
substituteInPlace vendor/github.com/bgentry/speakeasy/speakeasy_unix.go \
--replace "/bin/stty" "${coreutils}/bin/stty"
'';
nativeBuildInputs = [ installShellFiles ];
postInstall = ''
# https://github.com/posener/complete/blob/9a4745ac49b29530e07dc2581745a218b646b7a3/cmd/install/bash.go#L8
installShellCompletion --bash --name terraform <(echo complete -C terraform terraform)
'';
preCheck = ''
export HOME=$TMPDIR
export TF_SKIP_REMOTE_TESTS=1
'';
subPackages = [ "." ];
meta = with lib; {
description =
"Tool for building, changing, and versioning infrastructure";
homepage = "https://www.terraform.io/";
changelog = "https://github.com/hashicorp/terraform/blob/v${version}/CHANGELOG.md";
license = licenses.bsl11;
maintainers = with maintainers; [
Chili-Man
babariviere
kalbasit
amaxine
timstott
zimbatm
zowoq
techknowlogick
qjoly
];
mainProgram = "terraform";
};
} // attrs');
pluggable = terraform:
let
withPlugins = plugins:
let
actualPlugins = plugins terraform.plugins;
# Wrap PATH of plugins propagatedBuildInputs, plugins may have runtime dependencies on external binaries
wrapperInputs = lib.unique (lib.flatten
(lib.catAttrs "propagatedBuildInputs"
(builtins.filter (x: x != null) actualPlugins)));
passthru = {
withPlugins = newplugins:
withPlugins (x: newplugins x ++ actualPlugins);
full = withPlugins (p: lib.filter lib.isDerivation (lib.attrValues p.actualProviders));
# Expose wrappers around the override* functions of the terraform
# derivation.
#
# Note that this does not behave as anyone would expect if plugins
# are specified. The overrides are not on the user-visible wrapper
# derivation but instead on the function application that eventually
# generates the wrapper. This means:
#
# 1. When using overrideAttrs, only `passthru` attributes will
# become visible on the wrapper derivation. Other overrides that
# modify the derivation *may* still have an effect, but it can be
# difficult to follow.
#
# 2. Other overrides may work if they modify the terraform
# derivation, or they may have no effect, depending on what
# exactly is being changed.
#
# 3. Specifying overrides on the wrapper is unsupported.
#
# See nixpkgs#158620 for details.
overrideDerivation = f:
(pluggable (terraform.overrideDerivation f)).withPlugins plugins;
overrideAttrs = f:
(pluggable (terraform.overrideAttrs f)).withPlugins plugins;
override = x:
(pluggable (terraform.override x)).withPlugins plugins;
};
# Don't bother wrapping unless we actually have plugins, since the wrapper will stop automatic downloading
# of plugins, which might be counterintuitive if someone just wants a vanilla Terraform.
in
if actualPlugins == [ ] then
terraform.overrideAttrs
(orig: { passthru = orig.passthru // passthru; })
else
lib.appendToName "with-plugins" (stdenv.mkDerivation {
inherit (terraform) meta pname version;
nativeBuildInputs = [ makeWrapper ];
# Expose the passthru set with the override functions
# defined above, as well as any passthru values already
# set on `terraform` at this point (relevant in case a
# user overrides attributes).
passthru = terraform.passthru // passthru;
buildCommand = ''
# Create wrappers for terraform plugins because Terraform only
# walks inside of a tree of files.
for providerDir in ${toString actualPlugins}
do
for file in $(find $providerDir/libexec/terraform-providers -type f)
do
relFile=''${file#$providerDir/}
mkdir -p $out/$(dirname $relFile)
cat <<WRAPPER > $out/$relFile
#!${runtimeShell}
exec "$file" "$@"
WRAPPER
chmod +x $out/$relFile
done
done
# Create a wrapper for terraform to point it to the plugins dir.
mkdir -p $out/bin/
makeWrapper "${terraform}/bin/terraform" "$out/bin/terraform" \
--set NIX_TERRAFORM_PLUGIN_DIR $out/libexec/terraform-providers \
--prefix PATH : "${lib.makeBinPath wrapperInputs}"
'';
});
in
withPlugins (_: [ ]);
plugins = removeAttrs terraform-providers [
"override"
"overrideDerivation"
"recurseForDerivations"
];
in
rec {
# Constructor for other terraform versions
mkTerraform = attrs: pluggable (generic attrs);
terraform_1 = mkTerraform {
version = "1.6.4";
hash = "sha256-kA0H+JxyMV6RKRr20enTOzfwj2Lk2IP4vivfHv02+w8=";
vendorHash = "sha256-cxnvEwtZLXYZzCITJgYk8hDRndLLC8YTD+RvgcNska0=";
patches = [ ./provider-path-0_15.patch ];
passthru = {
inherit plugins;
tests = { inherit terraform_plugins_test; };
};
};
# Tests that the plugins are being used. Terraform looks at the specific
# file pattern and if the plugin is not found it will try to download it
# from the Internet. With sandboxing enable this test will fail if that is
# the case.
terraform_plugins_test =
let
mainTf = writeText "main.tf" ''
resource "random_id" "test" {}
'';
terraform = terraform_1.withPlugins (p: [ p.random ]);
test =
runCommand "terraform-plugin-test" { buildInputs = [ terraform ]; } ''
set -e
# make it fail outside of sandbox
export HTTP_PROXY=http://127.0.0.1:0 HTTPS_PROXY=https://127.0.0.1:0
cp ${mainTf} main.tf
terraform init
touch $out
'';
in
test;
}
|