Which security problem does terraform Checksum verification try to solve?

user_5117552 0
Viewed 332

.terraform.lock.hcl is the dependency lock file of terraform. In the following example, it has a hashes field, which contains all valid checksums for a specify provider version.

provider "registry.terraform.io/hashicorp/aws" {
  version     = "3.63.0"
  constraints = ">= 2.7.0, >= 2.42.0, >= 2.49.0, >= 3.4.0, >= 3.40.0"
  hashes = [
    "h1:lf8Qex8bhCmh8TUEAU6H4brzjy3+d4BXB6gcOYnNtNY=",
    "zh:42c6c98b294953a4e1434a331251e539f5372bf6779bd61ab5df84cac0545287",
    "zh:5493773762a470889c9a23db97582d3a82035847c8d3bd13323b4c3012abf325",
    "zh:550d22ff9fed4d817a922e7b84bd9d1f2ef8d3afa00832cf66b8cd5f0e6dc748",
    "zh:632cb5e2d9d5041875f57174236eafe5b05dbf26750c1041ab57eb08c5369fe2",
    "zh:7cfeaf5bde1b28bd010415af1f3dc494680a8374f1a26ec19db494d99938cc4e",
    "zh:99d871606b67c8aefce49007315de15736b949c09a9f8f29ad8af1e9ce383ed3",
    "zh:c4fc8539ffe90df5c7ae587fde495fac6bc0186fec2f2713a8988a619cef265f",
    "zh:d0a26493206575c99ca221d78fe64f96a8fbcebe933af92eea6b39168c1f1c1d",
    "zh:e156fdc964fdd4a7586ec15629e20d2b06295b46b4962428006e088145db07d6",
    "zh:eb04fc80f652b5c92f76822f0fec1697581543806244068506aed69e1bb9b2af",
    "zh:f5638a533cf9444f7d02b5527446cdbc3b2eab8bcc4ec4b0ca32035fe6f479d3",
  ]
}

Terraform Documentation said the checksum verification is intended to represent a trust on first use approach.

I am not a security expert. Could you please explain which security problem does terraform Checksum verification try to solve?

Is it used for prevent people on installing vicious package from untrusted repository?

terraform
2 Answers

Checksum verification on libraries is used to prevent malicious code from being installed in a library. So long as the initial version of the library was valid, a malicious version installed via man in the middle or breaking into the package manager will fail the checksum.

However, if the version initially installed by the developer was compromised, the compromise will be used. This is "trust on first use" - the initial version is assumed to be correct, so the application is only vulnerable when the code changes, but not at runtime. This does not protect you from packages installed from an untrusted source, only from a trusted source being compromised.

Dan_Monego_327710

Verifying the checksum of a file helps ensure the file was not corrupted during download, or modified by a malicious third-party before you downloaded it.

This helps to check the file integrity or the binary integrity. In other words, it is a sum that checks the validity of data. Checksums are typically used to compare two sets of data to make sure they are the same

user_62466280
Related