fix(scripts/ironbank): upgrade bundled Terraform to 1.14.5 and provider to 2.13.1#25248
Open
coder-tasks[bot] wants to merge 1 commit into
Open
fix(scripts/ironbank): upgrade bundled Terraform to 1.14.5 and provider to 2.13.1#25248coder-tasks[bot] wants to merge 1 commit into
coder-tasks[bot] wants to merge 1 commit into
Conversation
|
All contributors have signed the CLA ✍️ ✅ |
…er to 2.13.1 Update the IronBank hardening manifest to use current Terraform and provider versions, matching what the Coder v2.30.x codebase expects: - Terraform: 1.3.7 -> 1.14.5 (matches TerraformVersion in install.go and scripts/Dockerfile.base) - terraform-provider-coder: 0.6.10 -> 2.13.1 (matches go.mod) - SHA256 checksums updated for both artifacts Note: the pre-built Terraform 1.14.5 binary from HashiCorp is compiled with Go 1.25.8. The Go stdlib CVEs in the Terraform binary depend on an upstream HashiCorp Go toolchain bump. The Coder binary itself was already upgraded to Go 1.25.10 in #25232. Refs ENT-37
a5d164d to
753d3c4
Compare
Contributor
Author
Documentation CheckNo Changes NeededThis PR only updates Automated review via Coder Tasks |
f0ssel
pushed a commit
that referenced
this pull request
May 18, 2026
…1.25.10 (#25268) Build Terraform from source during the IronBank image build instead of downloading pre-built binaries from HashiCorp. This controls the Go toolchain version, ensuring Go stdlib CVEs (1 Critical, 5 High, 3 Medium) fixed in Go 1.25.9 are addressed in the bundled Terraform binary. Supersedes #25248 which only did a version bump without source build. ### Changes - **hardening_manifest.yaml**: Replace pre-built Terraform 1.3.7 binary with Terraform 1.14.5 source tarball (matches `install.go`). Update terraform-provider-coder from 0.6.10 to 2.13.1 (matches `go.mod`). Add `TERRAFORM_VERSION` build arg. - **build_ironbank.sh**: Download Terraform source, compile with the project's Go toolchain (1.25.10), package as terraform.zip. Add `go` to dependencies. Update base image to UBI9. - **Dockerfile**: Update base image from UBI8 8.7 to UBI9 9.6. Remove python3-urllib3 to address CVE-2026-44431. Refs ENT-37 > Generated by Coder Agents <details> <summary>Implementation context (Coder Agents generated)</summary> ### Go toolchain analysis | Component | Before | After | |-----------|--------|-------| | Terraform binary | Go 1.19.4 (v1.3.7 pre-built) | Go 1.25.10 (v1.14.5 built from source) | | terraform-provider-coder | old (v0.6.10) | Go 1.24.6 (v2.13.1) | | Coder binary | Go 1.25.10 | Go 1.25.10 (unchanged) | ### Related PRs - #25219 — main - #25250 — release/2.33 - #25259 — release/2.32 - #25260 — release/2.31 - #25267 — release/2.29 </details>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Update the IronBank hardening manifest on the v2.30.x release branch to use current Terraform and provider versions that match what the codebase expects.
Changes
TerraformVersioninprovisioner/terraform/install.goandscripts/Dockerfile.base)go.mod)Context
The Coder binary Go toolchain was already upgraded from 1.25.8 to 1.25.10 in #25232 (addressing ENT-40). This PR brings the IronBank-bundled Terraform and provider versions in sync with the rest of the codebase.
Note: the pre-built Terraform 1.14.5 binary from HashiCorp is still compiled with Go 1.25.8 (
.go-versionin the Terraform repo). The Go stdlib CVEs in the bundled Terraform binary depend on an upstream HashiCorp Go toolchain bump; no Terraform release through 1.15.2 uses Go 1.25.9+.Refs https://linear.app/codercom/issue/ENT-37