feat: Generate full lock file expected in OpenTofu 1.12

Author: yhakbar

internal/tf/cache/models/provider.go

@@ -101,19 +101,26 @@ func (platform Platform) String() string {
 	return fmt.Sprintf("%s/%s", platform.OS, platform.Arch)
 }
 
-// ResponseBody represents the details of the Terraform provider received from a registry.
+// PlatformPackage carries the per-platform hash and size data exposed by the
+// OpenTofu provider registry. Consumers can populate `.terraform.lock.hcl`
+// with hashes for every supported platform from a single response, without
+// downloading each provider archive.
+type PlatformPackage struct {
+	Hashes      []string `json:"hashes"`
+	PackageSize int64    `json:"package_size,omitempty"`
+}
+
+// ResponseBody represents the details of the OpenTofu/Terraform provider received from a registry.
 type ResponseBody struct {
+	Packages map[string]*PlatformPackage `json:"packages,omitempty"`
 	Platform
-
-	Protocols []string `json:"protocols,omitempty"`
-	Filename  string   `json:"filename"`
-
-	DownloadURL            string `json:"download_url"`
-	SHA256SumsURL          string `json:"shasums_url,omitempty"`
-	SHA256SumsSignatureURL string `json:"shasums_signature_url,omitempty"`
-
-	SHA256Sum   string         `json:"shasum,omitempty"`
-	SigningKeys SigningKeyList `json:"signing_keys"`
+	Filename               string         `json:"filename"`
+	DownloadURL            string         `json:"download_url"`
+	SHA256SumsURL          string         `json:"shasums_url,omitempty"`
+	SHA256SumsSignatureURL string         `json:"shasums_signature_url,omitempty"`
+	SHA256Sum              string         `json:"shasum,omitempty"`
+	Protocols              []string       `json:"protocols,omitempty"`
+	SigningKeys            SigningKeyList `json:"signing_keys"`
 }
 
 func (body *ResponseBody) ResolveRelativeReferences(base *url.URL) *ResponseBody {

internal/tf/cache/models/provider_test.go

@@ -1,6 +1,7 @@
 package models_test
 
 import (
+	"encoding/json"
 	"fmt"
 	"net/url"
 	"testing"
@@ -10,6 +11,54 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestResponseBodyPackagesRoundTrip(t *testing.T) {
+	t.Parallel()
+
+	// Sample response shape extracted from opentofu/opentofu RFC
+	// 20251027-provider-registry-hashes.md, including the `packages` field that
+	// carries per-platform hashes.
+	raw := []byte(`{
+		"protocols": ["5.0"],
+		"os": "linux",
+		"arch": "amd64",
+		"filename": "terraform-provider-aws_5.31.0_linux_amd64.zip",
+		"download_url": "https://example.com/terraform-provider-aws_5.31.0_linux_amd64.zip",
+		"shasums_url": "https://example.com/SHA256SUMS",
+		"shasum": "5f9c7aa76b7c34d722fc91111111111111111111111111111111111111111111",
+		"signing_keys": {"gpg_public_keys": []},
+		"packages": {
+			"linux_amd64": {
+				"hashes": ["zh:abc", "h1:def"],
+				"package_size": 12345
+			},
+			"darwin_arm64": {
+				"hashes": ["zh:ghi", "h1:jkl"],
+				"package_size": 67890
+			}
+		}
+	}`)
+
+	var body models.ResponseBody
+	require.NoError(t, json.Unmarshal(raw, &body))
+
+	require.Len(t, body.Packages, 2)
+	require.Contains(t, body.Packages, "linux_amd64")
+	assert.Equal(t, []string{"zh:abc", "h1:def"}, body.Packages["linux_amd64"].Hashes)
+	assert.Equal(t, int64(12345), body.Packages["linux_amd64"].PackageSize)
+	assert.Equal(t, []string{"zh:ghi", "h1:jkl"}, body.Packages["darwin_arm64"].Hashes)
+}
+
+func TestResponseBodyPackagesAbsent(t *testing.T) {
+	t.Parallel()
+
+	raw := []byte(`{"os":"linux","arch":"amd64","filename":"x.zip","download_url":"https://example.com/x.zip","signing_keys":{"gpg_public_keys":[]}}`)
+
+	var body models.ResponseBody
+	require.NoError(t, json.Unmarshal(raw, &body))
+
+	assert.Nil(t, body.Packages)
+}
+
 func TestFilterValid(t *testing.T) {
 	t.Parallel()
 
@@ -112,39 +161,39 @@ func TestResolveRelativeReferences(t *testing.T) {
 		expectedResolved models.ResponseBody
 	}{
 		{
-			"https://releases.hashicorp.com/terraform-provider-local/2.5.1",
-			models.ResponseBody{
+			baseURL: "https://releases.hashicorp.com/terraform-provider-local/2.5.1",
+			body: models.ResponseBody{
 				DownloadURL:            "terraform-provider-local_2.5.1_darwin_amd64.zip",
 				SHA256SumsURL:          "terraform-provider-local_2.5.1_SHA256SUMS",
 				SHA256SumsSignatureURL: "terraform-provider-local_2.5.1_SHA256SUMS.72D7468F.sig",
 			},
-			models.ResponseBody{
+			expectedResolved: models.ResponseBody{
 				DownloadURL:            "https://releases.hashicorp.com/terraform-provider-local/2.5.1/terraform-provider-local_2.5.1_darwin_amd64.zip",
 				SHA256SumsURL:          "https://releases.hashicorp.com/terraform-provider-local/2.5.1/terraform-provider-local_2.5.1_SHA256SUMS",
 				SHA256SumsSignatureURL: "https://releases.hashicorp.com/terraform-provider-local/2.5.1/terraform-provider-local_2.5.1_SHA256SUMS.72D7468F.sig",
 			},
 		},
 		{
-			"https://somehost.com",
-			models.ResponseBody{
+			baseURL: "https://somehost.com",
+			body: models.ResponseBody{
 				DownloadURL:            "https://releases.hashicorp.com/terraform-provider-local/2.5.1/terraform-provider-local_2.5.1_darwin_amd64.zip",
 				SHA256SumsURL:          "https://releases.hashicorp.com/terraform-provider-local/2.5.1/terraform-provider-local_2.5.1_SHA256SUMS",
 				SHA256SumsSignatureURL: "https://releases.hashicorp.com/terraform-provider-local/2.5.1/terraform-provider-local_2.5.1_SHA256SUMS.72D7468F.sig",
 			},
-			models.ResponseBody{
+			expectedResolved: models.ResponseBody{
 				DownloadURL:            "https://releases.hashicorp.com/terraform-provider-local/2.5.1/terraform-provider-local_2.5.1_darwin_amd64.zip",
 				SHA256SumsURL:          "https://releases.hashicorp.com/terraform-provider-local/2.5.1/terraform-provider-local_2.5.1_SHA256SUMS",
 				SHA256SumsSignatureURL: "https://releases.hashicorp.com/terraform-provider-local/2.5.1/terraform-provider-local_2.5.1_SHA256SUMS.72D7468F.sig",
 			},
 		},
 		{
-			"https://registry.company.com/v1/providers/ns/name/1.0/download/linux/amd64",
-			models.ResponseBody{
+			baseURL: "https://registry.company.com/v1/providers/ns/name/1.0/download/linux/amd64",
+			body: models.ResponseBody{
 				DownloadURL:            "/v1/providers/ns/name/1.0/download/linux/amd64/terraform-provider.zip",
 				SHA256SumsURL:          "/v1/providers/ns/name/1.0/download/linux/amd64/terraform-provider_SHA256SUMS",
 				SHA256SumsSignatureURL: "/v1/providers/ns/name/1.0/download/linux/amd64/terraform-provider_SHA256SUMS.sig",
 			},
-			models.ResponseBody{
+			expectedResolved: models.ResponseBody{
 				DownloadURL:            "https://registry.company.com/v1/providers/ns/name/1.0/download/linux/amd64/terraform-provider.zip",
 				SHA256SumsURL:          "https://registry.company.com/v1/providers/ns/name/1.0/download/linux/amd64/terraform-provider_SHA256SUMS",
 				SHA256SumsSignatureURL: "https://registry.company.com/v1/providers/ns/name/1.0/download/linux/amd64/terraform-provider_SHA256SUMS.sig",

internal/tf/cache/services/provider_cache.go

@@ -130,6 +130,33 @@ func (cache *ProviderCache) PackageDir() string {
 	return cache.packageDir
 }
 
+// RegistryHashes returns the per-platform hashes supplied by the upstream registry.
+// Returns nil when the registry response did not include the
+// `packages` field, in which case lockfile generation falls back to local h1
+// computation plus the shasums document.
+func (cache *ProviderCache) RegistryHashes() map[string][]getproviders.Hash {
+	if cache.ResponseBody == nil || len(cache.Packages) == 0 {
+		return nil
+	}
+
+	out := make(map[string][]getproviders.Hash, len(cache.Packages))
+
+	for platform, pkg := range cache.Packages {
+		if pkg == nil {
+			continue
+		}
+
+		hashes := make([]getproviders.Hash, 0, len(pkg.Hashes))
+		for _, h := range pkg.Hashes {
+			hashes = append(hashes, getproviders.Hash(h))
+		}
+
+		out[platform] = hashes
+	}
+
+	return out
+}
+
 func (cache *ProviderCache) AuthenticatePackage(ctx context.Context) (*getproviders.PackageAuthenticationResult, error) {
 	var (
 		checksum           [sha256.Size]byte

internal/tf/getproviders/lock.go

@@ -105,27 +105,15 @@ func updateProviderBlock(ctx context.Context, providerBlock *hclwrite.Block, pro
 		providerBlock.Body().SetAttributeValue("constraints", cty.StringVal(constraintsValue))
 	}
 
-	h1Hash, err := PackageHashV1(provider.PackageDir())
-	if err != nil {
-		return err
-	}
-
-	newHashes := []Hash{h1Hash}
-
-	documentSHA256Sums, err := provider.DocumentSHA256Sums(ctx)
+	newHashes, err := collectNewHashes(ctx, provider)
 	if err != nil {
 		return err
 	}
 
-	if documentSHA256Sums != nil {
-		zipHashes := DocumentHashes(documentSHA256Sums)
-		newHashes = append(newHashes, zipHashes...)
-	}
-
 	// merge with existing hashes
-	for _, newHashe := range newHashes {
-		if !slices.Contains(hashes, newHashe) {
-			hashes = append(hashes, newHashe)
+	for _, newHash := range newHashes {
+		if !slices.Contains(hashes, newHash) {
+			hashes = append(hashes, newHash)
 		}
 	}
 
@@ -136,6 +124,62 @@ func updateProviderBlock(ctx context.Context, providerBlock *hclwrite.Block, pro
 	return nil
 }
 
+// collectNewHashes returns the hashes to merge into the lock file for the given
+// provider, preferring registry-supplied hashes when available and otherwise
+// falling back to computing them from the cached package and shasums document.
+func collectNewHashes(ctx context.Context, provider Provider) ([]Hash, error) {
+	if registryHashes := provider.RegistryHashes(); len(registryHashes) > 0 {
+		return uniqueRegistryHashes(registryHashes), nil
+	}
+
+	return computedFallbackHashes(ctx, provider)
+}
+
+// uniqueRegistryHashes flattens the per-platform hashes from the OpenTofu
+// registry's `packages` response field into a deduplicated list. Each input
+// hash is already scheme-prefixed (e.g. `h1:` or `zh:`).
+func uniqueRegistryHashes(byPlatform map[string][]Hash) []Hash {
+	seen := make(map[Hash]struct{})
+
+	var hashes []Hash
+
+	for _, platformHashes := range byPlatform {
+		for _, h := range platformHashes {
+			if _, ok := seen[h]; ok {
+				continue
+			}
+
+			seen[h] = struct{}{}
+			hashes = append(hashes, h)
+		}
+	}
+
+	return hashes
+}
+
+// computedFallbackHashes returns the legacy hash set for a provider: an `h1:`
+// hash derived from the unpacked package on disk, followed by `zh:` hashes
+// parsed from the registry's shasums document.
+func computedFallbackHashes(ctx context.Context, provider Provider) ([]Hash, error) {
+	h1Hash, err := PackageHashV1(provider.PackageDir())
+	if err != nil {
+		return nil, err
+	}
+
+	hashes := []Hash{h1Hash}
+
+	documentSHA256Sums, err := provider.DocumentSHA256Sums(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	if documentSHA256Sums != nil {
+		hashes = append(hashes, DocumentHashes(documentSHA256Sums)...)
+	}
+
+	return hashes, nil
+}
+
 func getExistingHashes(providerBlock *hclwrite.Block, provider Provider) ([]Hash, error) {
 	versionAttr := providerBlock.Body().GetAttribute("version")
 	if versionAttr == nil {

internal/tf/getproviders/lock_test.go

@@ -54,6 +54,7 @@ func mockProviderWithConstraints(t *testing.T, ctrl *gomock.Controller, address,
 	provider.EXPECT().PackageDir().Return(packageDir).AnyTimes()
 	provider.EXPECT().Logger().Return(logger.CreateLogger()).AnyTimes()
 	provider.EXPECT().DocumentSHA256Sums(gomock.Any()).Return([]byte(document), nil).AnyTimes()
+	provider.EXPECT().RegistryHashes().Return(nil).AnyTimes()
 
 	return provider
 }
@@ -92,6 +93,7 @@ func mockProviderUpdateLock(t *testing.T, ctrl *gomock.Controller, address, vers
 	provider.EXPECT().PackageDir().Return(packageDir).AnyTimes()
 	provider.EXPECT().Logger().Return(logger.CreateLogger()).AnyTimes()
 	provider.EXPECT().DocumentSHA256Sums(gomock.Any()).Return([]byte(document), nil).AnyTimes()
+	provider.EXPECT().RegistryHashes().Return(nil).AnyTimes()
 
 	return provider
 }
@@ -268,6 +270,68 @@ provider "registry.terraform.io/hashicorp/template" {
 	}
 }
 
+// mockProviderWithRegistryHashes returns a mock Provider that exposes
+// per-platform hashes, matching the OpenTofu registry's `packages` response
+// field. In this path, lockfile generation skips the local PackageHashV1 /
+// shasums document fallback and uses the registry-supplied hashes.
+func mockProviderWithRegistryHashes(t *testing.T, ctrl *gomock.Controller, address, ver string, hashesByPlatform map[string][]getproviders.Hash) getproviders.Provider {
+	t.Helper()
+
+	provider := mocks.NewMockProvider(ctrl)
+	provider.EXPECT().Address().Return(address).AnyTimes()
+	provider.EXPECT().Version().Return(ver).AnyTimes()
+	provider.EXPECT().Constraints().Return("").AnyTimes()
+	provider.EXPECT().Logger().Return(logger.CreateLogger()).AnyTimes()
+	provider.EXPECT().RegistryHashes().Return(hashesByPlatform).AnyTimes()
+
+	return provider
+}
+
+func TestMockUpdateLockfileWithRegistryHashes(t *testing.T) {
+	t.Parallel()
+
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	provider := mockProviderWithRegistryHashes(t, ctrl,
+		"registry.opentofu.org/hashicorp/aws", "5.37.0",
+		map[string][]getproviders.Hash{
+			"linux_amd64": {
+				"zh:aaaa000000000000000000000000000000000000000000000000000000000001",
+				"h1:LinuxAmd64HashOpentofuRegistryProvidedValueAAA=",
+			},
+			"darwin_arm64": {
+				"zh:bbbb000000000000000000000000000000000000000000000000000000000002",
+				"h1:DarwinArm64HashOpentofuRegistryProvidedValueBBB=",
+			},
+		},
+	)
+
+	workingDir := helpers.TmpDirWOSymlinks(t)
+	lockfilePath := filepath.Join(workingDir, ".terraform.lock.hcl")
+
+	err := getproviders.UpdateLockfile(t.Context(), workingDir, []getproviders.Provider{provider})
+	require.NoError(t, err)
+
+	actual, err := os.ReadFile(lockfilePath)
+	require.NoError(t, err)
+
+	expected := `
+provider "registry.opentofu.org/hashicorp/aws" {
+  version     = "5.37.0"
+  constraints = "5.37.0"
+  hashes = [
+    "h1:DarwinArm64HashOpentofuRegistryProvidedValueBBB=",
+    "h1:LinuxAmd64HashOpentofuRegistryProvidedValueAAA=",
+    "zh:aaaa000000000000000000000000000000000000000000000000000000000001",
+    "zh:bbbb000000000000000000000000000000000000000000000000000000000002",
+  ]
+}
+`
+
+	assert.Equal(t, expected, string(actual))
+}
+
 // TestMockUpdateLockfilePreservesAggregatedConstraints verifies that when a lock file
 // already has valid aggregated constraints from the full dependency tree (e.g.
 // ">= 2.0.0, >= 3.0.0, >= 4.9.0, < 7.0.0"), and the provider's module-only