Fixes #2022: Running external commands as a key provider

internal/encryption/default_registry.go

@@ -7,6 +7,7 @@ package encryption
 
 import (
 	"github.com/opentofu/opentofu/internal/encryption/keyprovider/aws_kms"
+	"github.com/opentofu/opentofu/internal/encryption/keyprovider/externalcommand"
 	"github.com/opentofu/opentofu/internal/encryption/keyprovider/gcp_kms"
 	"github.com/opentofu/opentofu/internal/encryption/keyprovider/openbao"
 	"github.com/opentofu/opentofu/internal/encryption/keyprovider/pbkdf2"
@@ -30,6 +31,9 @@ func init() {
 	if err := DefaultRegistry.RegisterKeyProvider(openbao.New()); err != nil {
 		panic(err)
 	}
+	if err := DefaultRegistry.RegisterKeyProvider(externalcommand.New()); err != nil {
+		panic(err)
+	}
 	if err := DefaultRegistry.RegisterMethod(aesgcm.New()); err != nil {
 		panic(err)
 	}

internal/encryption/keyprovider/externalcommand/compliance_test.go

@@ -0,0 +1,85 @@
+// Copyright (c) The OpenTofu Authors
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) 2023 HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package externalcommand
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/opentofu/opentofu/internal/encryption/keyprovider"
+	"github.com/opentofu/opentofu/internal/encryption/keyprovider/compliancetest"
+)
+
+func TestCompliance(t *testing.T) {
+	validConfig := &Config{
+		Command: []string{"testprovider"},
+	}
+	compliancetest.ComplianceTest(
+		t,
+		compliancetest.TestConfiguration[*descriptor, *Config, *Metadata, *keyProvider]{
+			Descriptor: New().(*descriptor),
+			HCLParseTestCases: map[string]compliancetest.HCLParseTestCase[*Config, *keyProvider]{
+				"empty": {
+					HCL: `key_provider "externalcommand" "foo" {
+}`,
+					ValidHCL:   false,
+					ValidBuild: false,
+					Validate:   nil,
+				},
+				"basic": {
+					HCL: `key_provider "externalcommand" "foo" {
+    command = ["keyprovider"]
+}`,
+					ValidHCL:   true,
+					ValidBuild: true,
+					Validate: func(config *Config, keyProvider *keyProvider) error {
+						if len(config.Command) != 1 {
+							return fmt.Errorf("invalid command after parsing")
+						}
+						if config.Command[0] != "keyprovider" {
+							return fmt.Errorf("invalid command after parsing")
+						}
+						return nil
+					},
+				},
+			},
+			ConfigStructTestCases: map[string]compliancetest.ConfigStructTestCase[*Config, *keyProvider]{},
+			MetadataStructTestCases: map[string]compliancetest.MetadataStructTestCase[*Config, *Metadata]{
+				"not-present-externaldata": {
+					ValidConfig: validConfig,
+					Meta: &Metadata{
+						ExternalData: nil,
+					},
+					IsPresent: false,
+				},
+				"present-valid": {
+					ValidConfig: validConfig,
+					Meta: &Metadata{
+						ExternalData: map[string]any{},
+					},
+					IsPresent: true,
+					IsValid:   true,
+				},
+			},
+			ProvideTestCase: compliancetest.ProvideTestCase[*Config, *Metadata]{
+				ValidConfig: &Config{
+					Command: []string{"testcommand"},
+				},
+				ExpectedOutput: &keyprovider.Output{
+					EncryptionKey: []byte{},
+					DecryptionKey: []byte{},
+				},
+				ValidateKeys: nil,
+				ValidateMetadata: func(meta *Metadata) error {
+					if meta.ExternalData == nil {
+						return fmt.Errorf("output metadata is not present")
+					}
+					return nil
+				},
+			},
+		},
+	)
+}

internal/encryption/keyprovider/externalcommand/config.go

@@ -0,0 +1,23 @@
+// Copyright (c) The OpenTofu Authors
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) 2023 HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package externalcommand
+
+import (
+	"github.com/opentofu/opentofu/internal/encryption/keyprovider"
+)
+
+type Config struct {
+	Command []string `hcl:"command"`
+}
+
+func (c *Config) Build() (keyprovider.KeyProvider, keyprovider.KeyMeta, error) {
+	if len(c.Command) < 1 {
+		return nil, nil, &keyprovider.ErrInvalidConfiguration{
+			Message: "the command option is required",
+		}
+	}
+	return &keyProvider{}, &Metadata{}, nil
+}

internal/encryption/keyprovider/externalcommand/descriptor.go

@@ -0,0 +1,35 @@
+// Copyright (c) The OpenTofu Authors
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) 2023 HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package externalcommand
+
+import (
+	"github.com/opentofu/opentofu/internal/encryption/keyprovider"
+)
+
+func New() Descriptor {
+	return &descriptor{}
+}
+
+type Descriptor interface {
+	keyprovider.Descriptor
+
+	TypedConfig() *Config
+}
+
+type descriptor struct {
+}
+
+func (f descriptor) ID() keyprovider.ID {
+	return "externalcommand"
+}
+
+func (f descriptor) TypedConfig() *Config {
+	return &Config{}
+}
+
+func (f descriptor) ConfigStruct() keyprovider.Config {
+	return f.TypedConfig()
+}

internal/encryption/keyprovider/externalcommand/meta.go

@@ -0,0 +1,10 @@
+// Copyright (c) The OpenTofu Authors
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) 2023 HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package externalcommand
+
+type Metadata struct {
+	ExternalData ExternalCommandMeta `hcl:"external_data"`
+}

internal/encryption/keyprovider/externalcommand/protocol.go

@@ -0,0 +1,17 @@
+// Copyright (c) The OpenTofu Authors
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) 2023 HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package externalcommand
+
+import (
+	"github.com/opentofu/opentofu/internal/encryption/keyprovider"
+)
+
+type ExternalCommandMeta map[string]any
+
+type ExternalCommandOutput struct {
+	Key  keyprovider.Output  `json:"key"`
+	Meta ExternalCommandMeta `json:"meta"`
+}

internal/encryption/keyprovider/externalcommand/provider.go

@@ -0,0 +1,74 @@
+// Copyright (c) The OpenTofu Authors
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) 2023 HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package externalcommand
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os/exec"
+
+	"github.com/opentofu/opentofu/internal/encryption/keyprovider"
+)
+
+type keyProvider struct {
+	command []string
+}
+
+func (k keyProvider) Provide(rawMeta keyprovider.KeyMeta) (keysOutput keyprovider.Output, encryptionMeta keyprovider.KeyMeta, err error) {
+	if rawMeta == nil {
+		return keyprovider.Output{}, nil, &keyprovider.ErrInvalidMetadata{Message: "bug: no metadata struct provided"}
+	}
+	inMeta, ok := rawMeta.(*Metadata)
+	if !ok {
+		return keyprovider.Output{}, nil, &keyprovider.ErrInvalidMetadata{
+			Message: fmt.Sprintf("bug: incorrect metadata type of %T provided", rawMeta),
+		}
+	}
+
+	input, err := json.Marshal(inMeta)
+	if err != nil {
+		return keyprovider.Output{}, nil, &keyprovider.ErrInvalidMetadata{
+			Message: fmt.Sprintf("bug: cannot JSON-marshal metadata (%v)", err),
+		}
+	}
+
+	ctx := context.TODO()
+
+	stdout := &bytes.Buffer{}
+	stderr := &bytes.Buffer{}
+
+	cmd := exec.CommandContext(ctx, k.command[0], k.command[1:]...)
+	cmd.Stdin = bytes.NewReader(input)
+	cmd.Stdout = stdout
+	cmd.Stderr = stderr
+	if err := cmd.Run(); err != nil {
+		var exitErr *exec.ExitError
+		if errors.As(err, &exitErr) {
+			if exitErr.ExitCode() != 0 {
+				return keyprovider.Output{}, nil, &keyprovider.ErrKeyProviderFailure{
+					Message: fmt.Sprintf("the external command exited with a non-zero exit code (%v)\n\nStdout:\n-------\n%s\n-------\nStderr:\n-------\n%s", err, stdout, stderr),
+				}
+			}
+		}
+		return keyprovider.Output{}, nil, &keyprovider.ErrKeyProviderFailure{
+			Message: fmt.Sprintf("the external command exited with an error (%v)\n\nStdout:\n-------\n%s\n-------\nStderr:\n-------\n%s", err, stdout, stderr),
+		}
+	}
+
+	var result *ExternalCommandOutput
+	decoder := json.NewDecoder(bytes.NewReader(stdout.Bytes()))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&result); err != nil {
+		return keyprovider.Output{}, nil, &keyprovider.ErrKeyProviderFailure{
+			Message: fmt.Sprintf("the external command returned an invalid JSON response (%v)\n\nStdout:\n-------\n%s\n-------\nStderr:\n-------\n%s", err, stdout, stderr),
+		}
+	}
+
+	return result.Key, result.Meta, nil
+}