From 0574eadb62f561bbe39fdd472b329c467cf3984a Mon Sep 17 00:00:00 2001
From: Justin Campbell <justin@justincampbell.me>
Date: Fri, 1 Mar 2019 14:05:48 -0500
Subject: [PATCH] plugin/discovery: Verify sig against HashiCorp key

https://github.com/hashicorp/terraform/pull/19389 introduced a change to
the provider GPG signature verification process, and removed the
hardcoded HashiCorp GPG key.

While the changes were intended and are still planned for a future
release, we should still be verifying all providers in the TF 0.12.0
release against the HashiCorp GPG key until a more robust key
verification procedure is in place.

Fixes https://github.com/hashicorp/terraform/issues/20527
---
 plugin/discovery/get.go       | 11 ++++++++++-
 plugin/discovery/hashicorp.go | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+), 1 deletion(-)
 create mode 100644 plugin/discovery/hashicorp.go

diff --git a/plugin/discovery/get.go b/plugin/discovery/get.go
index e07007018b34..8ac5fd92ddfa 100644
--- a/plugin/discovery/get.go
+++ b/plugin/discovery/get.go
@@ -383,7 +383,7 @@ func (i *ProviderInstaller) getProviderChecksum(urls *response.TerraformProvider
 		return "", fmt.Errorf("error fetching checksums signature: %s", err)
 	}
 
-	// Verify GPG signature.
+	// Verify the GPG signature returned from the Registry.
 	asciiArmor := urls.SigningKeys.GPGASCIIArmor()
 	signer, err := verifySig(shasums, signature, asciiArmor)
 	if err != nil {
@@ -391,6 +391,15 @@ func (i *ProviderInstaller) getProviderChecksum(urls *response.TerraformProvider
 		return "", fmt.Errorf(gpgVerificationError)
 	}
 
+	// Also verify the GPG signature against the HashiCorp public key. This is
+	// a temporary additional check until a more robust key verification
+	// process is added in a future release.
+	_, err = verifySig(shasums, signature, HashicorpPublicKey)
+	if err != nil {
+		log.Printf("[ERROR] error verifying signature against HashiCorp public key: %s", err)
+		return "", fmt.Errorf(gpgVerificationError)
+	}
+
 	// Display identity for GPG key which succeeded verifying the signature.
 	// This could also be used to display to the user with i.Ui.Info().
 	identities := []string{}
diff --git a/plugin/discovery/hashicorp.go b/plugin/discovery/hashicorp.go
new file mode 100644
index 000000000000..4622ca0545c1
--- /dev/null
+++ b/plugin/discovery/hashicorp.go
@@ -0,0 +1,34 @@
+package discovery
+
+// HashicorpPublicKey is the HashiCorp public key, also available at
+// https://www.hashicorp.com/security
+const HashicorpPublicKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQENBFMORM0BCADBRyKO1MhCirazOSVwcfTr1xUxjPvfxD3hjUwHtjsOy/bT6p9f
+W2mRPfwnq2JB5As+paL3UGDsSRDnK9KAxQb0NNF4+eVhr/EJ18s3wwXXDMjpIifq
+fIm2WyH3G+aRLTLPIpscUNKDyxFOUbsmgXAmJ46Re1fn8uKxKRHbfa39aeuEYWFA
+3drdL1WoUngvED7f+RnKBK2G6ZEpO+LDovQk19xGjiMTtPJrjMjZJ3QXqPvx5wca
+KSZLr4lMTuoTI/ZXyZy5bD4tShiZz6KcyX27cD70q2iRcEZ0poLKHyEIDAi3TM5k
+SwbbWBFd5RNPOR0qzrb/0p9ksKK48IIfH2FvABEBAAG0K0hhc2hpQ29ycCBTZWN1
+cml0eSA8c2VjdXJpdHlAaGFzaGljb3JwLmNvbT6JATgEEwECACIFAlMORM0CGwMG
+CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEFGFLYc0j/xMyWIIAIPhcVqiQ59n
+Jc07gjUX0SWBJAxEG1lKxfzS4Xp+57h2xxTpdotGQ1fZwsihaIqow337YHQI3q0i
+SqV534Ms+j/tU7X8sq11xFJIeEVG8PASRCwmryUwghFKPlHETQ8jJ+Y8+1asRydi
+psP3B/5Mjhqv/uOK+Vy3zAyIpyDOMtIpOVfjSpCplVRdtSTFWBu9Em7j5I2HMn1w
+sJZnJgXKpybpibGiiTtmnFLOwibmprSu04rsnP4ncdC2XRD4wIjoyA+4PKgX3sCO
+klEzKryWYBmLkJOMDdo52LttP3279s7XrkLEE7ia0fXa2c12EQ0f0DQ1tGUvyVEW
+WmJVccm5bq25AQ0EUw5EzQEIANaPUY04/g7AmYkOMjaCZ6iTp9hB5Rsj/4ee/ln9
+wArzRO9+3eejLWh53FoN1rO+su7tiXJA5YAzVy6tuolrqjM8DBztPxdLBbEi4V+j
+2tK0dATdBQBHEh3OJApO2UBtcjaZBT31zrG9K55D+CrcgIVEHAKY8Cb4kLBkb5wM
+skn+DrASKU0BNIV1qRsxfiUdQHZfSqtp004nrql1lbFMLFEuiY8FZrkkQ9qduixo
+mTT6f34/oiY+Jam3zCK7RDN/OjuWheIPGj/Qbx9JuNiwgX6yRj7OE1tjUx6d8g9y
+0H1fmLJbb3WZZbuuGFnK6qrE3bGeY8+AWaJAZ37wpWh1p0cAEQEAAYkBHwQYAQIA
+CQUCUw5EzQIbDAAKCRBRhS2HNI/8TJntCAClU7TOO/X053eKF1jqNW4A1qpxctVc
+z8eTcY8Om5O4f6a/rfxfNFKn9Qyja/OG1xWNobETy7MiMXYjaa8uUx5iFy6kMVaP
+0BXJ59NLZjMARGw6lVTYDTIvzqqqwLxgliSDfSnqUhubGwvykANPO+93BBx89MRG
+unNoYGXtPlhNFrAsB1VR8+EyKLv2HQtGCPSFBhrjuzH3gxGibNDDdFQLxxuJWepJ
+EK1UbTS4ms0NgZ2Uknqn1WRU1Ki7rE4sTy68iZtWpKQXZEJa0IGnuI2sSINGcXCJ
+oEIgXTMyCILo34Fa/C6VCm2WBgz9zZO8/rHIiQm1J5zqz0DrDwKBUM9C
+=LYpS
+-----END PGP PUBLIC KEY BLOCK-----`