You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
_, _=color.New(color.FgYellow).Fprintln(cli.outStream, `No signing key configured. Set "signing_key" to verify that the release is signed by the plugin developer`)
63
-
}
64
-
65
65
_, err=installCfg.Install()
66
66
iferr!=nil {
67
-
returnfmt.Errorf("Failed to install a plugin; %w", err)
67
+
iferrors.Is(err, plugin.ErrPluginNotVerified) {
68
+
_, _=color.New(color.FgYellow).Fprintln(cli.outStream, `No signing key configured. Set "signing_key" to verify that the release is signed by the plugin developer`)
69
+
} else {
70
+
returnfmt.Errorf("Failed to install a plugin; %w", err)
- Include a step in your GitHub Actions workflow that uses the [`attest-build-provenance` action](https://github.com/actions/attest-build-provenance) for `checksums.txt`.
58
61
59
62
Releases that meet these requirements can be easily created by following the GoReleaser config in the template repository.
Copy file name to clipboardExpand all lines: docs/user-guide/environment_variables.md
+2
Original file line number
Diff line number
Diff line change
@@ -8,6 +8,8 @@ Below is a list of environment variables available in TFLint.
8
8
- Configure the config file path. See [Configuring TFLint](./config.md).
9
9
-`TFLINT_PLUGIN_DIR`
10
10
- Configure the plugin directory. See [Configuring Plugins](./plugins.md).
11
+
-`TFLINT_EXPERIMENTAL`
12
+
- Enable experimental features. Note that experimental features are subject to change without notice. Currently only [Keyless Verification](./plugins.md#keyless-verification-experimental) are supported.
11
13
-`TF_VAR_name`
12
14
- Set variables for compatibility with Terraform. See [Compatibility with Terraform](./compatibility.md).
Copy file name to clipboardExpand all lines: docs/user-guide/plugins.md
+10
Original file line number
Diff line number
Diff line change
@@ -54,6 +54,8 @@ Plugin developer's PGP public signing key. When this attribute is set, TFLint wi
54
54
55
55
Plugins under the terraform-linters organization (AWS/GCP/Azure ruleset plugins) can use the built-in signing key, so this attribute can be omitted.
56
56
57
+
If the plugin developer generates [Artifact Attestation](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds), you can omit this attribute. See [Keyless Verification](#keyless-verification-experimental) for details.
58
+
57
59
## Plugin directory
58
60
59
61
Plugins are usually installed under `~/.tflint.d/plugins`. Exceptionally, if you already have `./.tflint.d/plugins` in your working directory, it will be installed there.
@@ -132,3 +134,11 @@ plugin "terraform" {
132
134
```
133
135
134
136
If you have tflint-ruleset-terraform manually installed, the bundled plugin will not be automatically enabled. In this case the manually installed version takes precedence.
137
+
138
+
## Keyless verification (experimental)
139
+
140
+
If the plugin developer has generated [Artifact Attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds), TFLint will automatically verify them and prove that the plugin binary was built in that repository.
141
+
142
+
This verification is experimental and optional: it is only attempted if there is no PGP public signing key, and if there is no artifact attestation, a warning will be output, not an error. If you want to require all plugin installs to be signed with a PGP signing key or an artifact attestation, you can force this behavior to be enabled by setting the `TFLINT_EXPERIMENTAL=1`. This behavior will be the default in future versions, but is subject to change without notice.
143
+
144
+
Note that this validation, like the PGP signing key, does not guarantee that the plugin is secure. It only attests the source repository/revision from which it was built. It prevents direct upload of malicious release artifacts to GitHub or manipulation of download requests. If an attacker has control over the repository and can perform execution during a build, any resulting malicious release will still be considered "verified."
0 commit comments