mirror of
https://github.com/hashicorp/packer.git
synced 2026-10-14 10:12:03 -04:00
* hcl2template: pass user variable values to plugins as packer_user_variables (#13686) HCL2 builds do not send the packer_user_variables config key to the builder, provisioner and post-processor plugins. Legacy JSON builds send this key (through CoreBuild.packerConfig()). Without the key, the plugin SDK keeps interpolate.Context.UserVariables nil. Then the template function {{ user "name" }} fails with 'error calling user: test'. This failure occurs in each string that a plugin interpolates at run time, for example the contents of the vagrant post-processor's vagrantfile_template. Add the function PackerConfig.userVariableValues(). This function converts the input variable values to strings, equivalent to the legacy user variables. The core sends the map at each plugin handoff point: builder, provisioner, post-processor, and enforced provisioner. The map does not contain the sensitive variables. A sensitive value goes to a plugin only if the template refers to it explicitly. The map does not contain values that are not primitive (lists, maps, objects). Legacy user variables were always strings. Co-authored-by: Claude Fable 5 <[email protected]> * Dependency upgrade (#13689) * go.mod version upgrade * actions upgrade * plugin-getter: install plugins from non-GitHub HTTP sources (#13691) Packer can only install plugins from github.com, with releases.hashicorp.com consulted first for HashiCorp-published plugins. This has been a long-standing gap for air-gapped and policy-restricted environments (#11164): the source address parser already accepts any hostname, but both existing getters reject non-github.com sources at install time. Add a remote plugin getter that installs plugins from the host named in a required_plugins source address. The host serves the directory structure of releases.hashicorp.com under the source's path: an index.json listing versions, and per version a SHA256SUMS file, the zips it lists, and - when the zip names carry no plugin protocol version - the version's manifest.json. A plugin published on releases.hashicorp.com is therefore mirrored as a verbatim copy of its tree, with every checksum file and signature upstream-authored. A plugin published as GitHub release assets is mirrored by copying each release's assets into a version directory, renaming their SHA256SUMS file to the unprefixed convention with content unchanged, and writing an index.json listing the versions. Both kinds of content can be served side by side by one host. Getter selection happens per source address: github.com sources keep the release and github getters unchanged, while any other host is served by the remote getter over HTTPS. Sources with three or more components are supported, up to the existing 16-component limit, so nested artifact-repository paths and hosts that embed the upstream origin in their path all resolve. Version discovery, constraint solving, checksum verification, and the binary naming rules match the existing getters. The installed filename is rebuilt from validated checksum-file fields and never taken from the server's response, checksum entries matching neither known naming shape are rejected rather than guessed at, and nothing the remote metadata supplies is used to fetch from another origin or path. index.json parsing is covered by fixtures captured from the live releases API, so a format change there fails tests rather than user installs. Closes #11164 * fix: update link to CONTRIBUTING.md for consistency with main branch * Merge pull request #13701 from hashicorp/sanya-hashicorp/fix-vuln Module Dependency update * build(deps): bump google.golang.org/grpc (#13704) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.83.1 to 1.83.2. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.83.1...v1.83.2) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.83.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * [COMPLIANCE] Add/Update Copyright Headers (#13699) * [COMPLIANCE] Add/Update Copyright Headers * make generate update * make generate --------- Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com> Co-authored-by: sanya <[email protected]> Co-authored-by: Sanya <[email protected]> * Packer release 1.16.1 (#13705) * Module upgrade (#13707) --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Erik Berg <[email protected]> Co-authored-by: Claude Fable 5 <[email protected]> Co-authored-by: Benjamin Holmes <[email protected]> Co-authored-by: elomito <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>
144 lines
4.8 KiB
Go
144 lines
4.8 KiB
Go
// Copyright IBM Corp. 2024, 2026
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
package function
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/hashicorp/go-cty-funcs/filesystem"
|
|
"github.com/hashicorp/hcl/v2"
|
|
"github.com/hashicorp/hcl/v2/hclsyntax"
|
|
"github.com/zclconf/go-cty/cty"
|
|
"github.com/zclconf/go-cty/cty/function"
|
|
)
|
|
|
|
// MakeTemplateFileFunc constructs a function that takes a file path and
|
|
// an arbitrary object of named values and attempts to render the referenced
|
|
// file as a template using HCL template syntax.
|
|
//
|
|
// The template itself may recursively call other functions so a callback
|
|
// must be provided to get access to those functions. The template cannot,
|
|
// however, access any variables defined in the scope: it is restricted only to
|
|
// those variables provided in the second function argument.
|
|
//
|
|
// As a special exception, a referenced template file may not recursively call
|
|
// the templatefile function, since that would risk the same file being
|
|
// included into itself indefinitely.
|
|
func MakeTemplateFileFunc(baseDir string, funcsCb func() map[string]function.Function) function.Function {
|
|
|
|
params := []function.Parameter{
|
|
{
|
|
Name: "path",
|
|
Type: cty.String,
|
|
},
|
|
{
|
|
Name: "vars",
|
|
Type: cty.DynamicPseudoType,
|
|
},
|
|
}
|
|
|
|
loadTmpl := func(fn string) (hcl.Expression, error) {
|
|
// We re-use File here to ensure the same filename interpretation
|
|
// as it does, along with its other safety checks.
|
|
tmplVal, err := filesystem.File(baseDir, cty.StringVal(fn))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
expr, diags := hclsyntax.ParseTemplate([]byte(tmplVal.AsString()), fn, hcl.Pos{Line: 1, Column: 1})
|
|
if diags.HasErrors() {
|
|
return nil, diags
|
|
}
|
|
|
|
return expr, nil
|
|
}
|
|
|
|
renderTmpl := func(expr hcl.Expression, varsVal cty.Value) (cty.Value, error) {
|
|
if varsTy := varsVal.Type(); !(varsTy.IsMapType() || varsTy.IsObjectType()) {
|
|
return cty.DynamicVal, function.NewArgErrorf(1, "invalid vars value: must be a map") // or an object, but we don't strongly distinguish these most of the time
|
|
}
|
|
|
|
ctx := &hcl.EvalContext{
|
|
Variables: varsVal.AsValueMap(),
|
|
}
|
|
|
|
// We require all of the variables to be valid HCL identifiers, because
|
|
// otherwise there would be no way to refer to them in the template
|
|
// anyway. Rejecting this here gives better feedback to the user
|
|
// than a syntax error somewhere in the template itself.
|
|
for n := range ctx.Variables {
|
|
if !hclsyntax.ValidIdentifier(n) {
|
|
// This error message intentionally doesn't describe _all_ of
|
|
// the different permutations that are technically valid as an
|
|
// HCL identifier, but rather focuses on what we might
|
|
// consider to be an "idiomatic" variable name.
|
|
return cty.DynamicVal, function.NewArgErrorf(1, "invalid template variable name %q: must start with a letter, followed by zero or more letters, digits, and underscores", n)
|
|
}
|
|
}
|
|
|
|
// We'll pre-check references in the template here so we can give a
|
|
// more specialized error message than HCL would by default, so it's
|
|
// clearer that this problem is coming from a templatefile call.
|
|
for _, traversal := range expr.Variables() {
|
|
root := traversal.RootName()
|
|
if _, ok := ctx.Variables[root]; !ok {
|
|
return cty.DynamicVal, function.NewArgErrorf(1, "vars map does not contain key %q, referenced at %s", root, traversal[0].SourceRange())
|
|
}
|
|
}
|
|
|
|
givenFuncs := funcsCb() // this callback indirection is to avoid chicken/egg problems
|
|
funcs := make(map[string]function.Function, len(givenFuncs))
|
|
for name, fn := range givenFuncs {
|
|
if name == "templatefile" {
|
|
// We stub this one out to prevent recursive calls.
|
|
funcs[name] = function.New(&function.Spec{
|
|
Params: params,
|
|
Type: func(args []cty.Value) (cty.Type, error) {
|
|
return cty.NilType, fmt.Errorf("cannot recursively call templatefile from inside templatefile call")
|
|
},
|
|
})
|
|
continue
|
|
}
|
|
funcs[name] = fn
|
|
}
|
|
ctx.Functions = funcs
|
|
|
|
val, diags := expr.Value(ctx)
|
|
if diags.HasErrors() {
|
|
return cty.DynamicVal, diags
|
|
}
|
|
return val, nil
|
|
}
|
|
|
|
return function.New(&function.Spec{
|
|
Params: params,
|
|
Type: func(args []cty.Value) (cty.Type, error) {
|
|
if !(args[0].IsKnown() && args[1].IsKnown()) {
|
|
return cty.DynamicPseudoType, nil
|
|
}
|
|
|
|
// We'll render our template now to see what result type it
|
|
// produces. A template consisting only of a single interpolation
|
|
// can potentially return any type.
|
|
expr, err := loadTmpl(args[0].AsString())
|
|
if err != nil {
|
|
return cty.DynamicPseudoType, err
|
|
}
|
|
|
|
// This is safe even if args[1] contains unknowns because the HCL
|
|
// template renderer itself knows how to short-circuit those.
|
|
val, err := renderTmpl(expr, args[1])
|
|
return val.Type(), err
|
|
},
|
|
Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
|
|
expr, err := loadTmpl(args[0].AsString())
|
|
if err != nil {
|
|
return cty.DynamicVal, err
|
|
}
|
|
return renderTmpl(expr, args[1])
|
|
},
|
|
})
|
|
|
|
}
|