hashicorp
Fix download links behind protected source
We run private provider registry backed by GitHub releases + GitHub pages as API frontend[1]. While downloading release asset, client needs Application and Authorization headers set. To do that lets extend PackageMeta with AuthHeader field and set headers appropriately in installFromHTTPURL
The provider generator is used by GitHub action
[1] https://github.com/AbsaOSS/tf-provider-registry-generator
Signed-off-by: Dinar Valeev [email protected]
Thanks for this submission. Although I cannot commit to having this PR reviewed at this time, we acknowledge your contribution and appreciate it! Thanks again for the submission!
Hi @ivan046, no updates. I will run this past the product team again. This PR does not have much interest (read: upvotes). That said it also looks relatively discrete in terms of impact. Would you mind sharing your use case for this feature? Are you using the same project/process described in the original comment? Thanks!
I think this PR as implemented will break our integration with HCP Terraform private registries. Requests to a HCP private registry are authenticated, but the download and shasum URLs are short-lived unauthenticated URLs.
My reading of this PR is that all follow up requests will have the same authentication as the original request. Attaching authentication to the follow up requests in all cases is invalid. As stated in this comment we consider the current behaviour (of not required authentication) to be working as intended so simply attaching authentication headers to all requests is not a valid solution.
