Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package opentofu for openSUSE:Factory checked in at 2026-07-21 23:12:13 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/opentofu (Old) and /work/SRC/openSUSE:Factory/.opentofu.new.24530 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "opentofu" Tue Jul 21 23:12:13 2026 rev:53 rq:1366945 version:1.12.5 Changes: -------- --- /work/SRC/openSUSE:Factory/opentofu/opentofu.changes 2026-07-14 13:52:33.828417343 +0200 +++ /work/SRC/openSUSE:Factory/.opentofu.new.24530/opentofu.changes 2026-07-21 23:12:23.590385681 +0200 @@ -1,0 +2,18 @@ +Tue Jul 21 12:00:57 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 1.12.5: + * SECURITY ADVISORIES: + - Previous releases in the v1.12 series could be affected by + several vulnerabilities: + - The Encrypted Client Hello implementation (which is used by + OpenTofu through the go stdlib) would leak the pre-shared + key identities during the handshake, allowing a passive + network observer who can collect handshakes to de-anonymize + the hostname of the server, even when ECH was being used. + This is fixed now by (#4363) + * BUG FIXES: + - Fixed bug where implicit moves and provider address changes + would incorrectly cause providers.MovedResourceState to be + used in place of providers.UpgradeResourceState (#4375) + +------------------------------------------------------------------- Old: ---- opentofu-1.12.4.obscpio New: ---- opentofu-1.12.5.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ opentofu.spec ++++++ --- /var/tmp/diff_new_pack.XQ0mQA/_old 2026-07-21 23:12:25.770460227 +0200 +++ /var/tmp/diff_new_pack.XQ0mQA/_new 2026-07-21 23:12:25.770460227 +0200 @@ -19,7 +19,7 @@ %define executable_name tofu Name: opentofu -Version: 1.12.4 +Version: 1.12.5 Release: 0 Summary: Declaratively manage your cloud infrastructure License: MPL-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.XQ0mQA/_old 2026-07-21 23:12:25.806461459 +0200 +++ /var/tmp/diff_new_pack.XQ0mQA/_new 2026-07-21 23:12:25.810461595 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/opentofu/opentofu.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v1.12.4</param> + <param name="revision">refs/tags/v1.12.5</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.XQ0mQA/_old 2026-07-21 23:12:25.834462416 +0200 +++ /var/tmp/diff_new_pack.XQ0mQA/_new 2026-07-21 23:12:25.838462553 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/opentofu/opentofu/</param> <param name="changesrevision">bdcbf091aab886499ed7718d7f558b428fffce39</param></service><service name="tar_scm"> <param name="url">https://github.com/opentofu/opentofu.git</param> - <param name="changesrevision">d5291190380d16aa5ef4590facbe0719d7fa165f</param></service></servicedata> + <param name="changesrevision">230349e959a44fb8eb7b83754f9d9b012f3bdb42</param></service></servicedata> (No newline at EOF) ++++++ opentofu-1.12.4.obscpio -> opentofu-1.12.5.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.12.4/CHANGELOG.md new/opentofu-1.12.5/CHANGELOG.md --- old/opentofu-1.12.4/CHANGELOG.md 2026-07-13 17:08:17.000000000 +0200 +++ new/opentofu-1.12.5/CHANGELOG.md 2026-07-21 12:31:31.000000000 +0200 @@ -1,6 +1,19 @@ The v1.12.x release series is supported until **February 1 2027**. -## 1.12.5 (unreleased) +## 1.12.6 (unreleased) + +## 1.12.5 + +SECURITY ADVISORIES: + +* Previous releases in the v1.12 series could be affected by several vulnerabilities: + * The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake, + allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used. + + This is fixed now by ([#4363](https://github.com/opentofu/opentofu/pull/4363)) + +BUG FIXES: +- Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState ([#4375](https://github.com/opentofu/opentofu/pull/4375)) ## 1.12.4 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.12.4/go.mod new/opentofu-1.12.5/go.mod --- old/opentofu-1.12.4/go.mod 2026-07-13 17:08:17.000000000 +0200 +++ new/opentofu-1.12.5/go.mod 2026-07-21 12:31:31.000000000 +0200 @@ -1,6 +1,6 @@ module github.com/opentofu/opentofu -go 1.26.4 +go 1.26.5 // At the time of adding this configuration, the new Go feature introduced here https://github.com/golang/go/issues/67061, // was having a good amount of issues linked to, affecting AWS Firewall, GCP various services and a lot more. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.12.4/internal/refactoring/move_execute.go new/opentofu-1.12.5/internal/refactoring/move_execute.go --- old/opentofu-1.12.4/internal/refactoring/move_execute.go 2026-07-13 17:08:17.000000000 +0200 +++ new/opentofu-1.12.5/internal/refactoring/move_execute.go 2026-07-21 12:31:31.000000000 +0200 @@ -72,7 +72,7 @@ log.Printf("[TRACE] refactoring.ApplyMoves: Processing 'moved' statements in the configuration\n%s", logging.Indent(g.String())) - recordOldAddr := func(oldAddr, newAddr addrs.AbsResourceInstance) { + recordOldAddr := func(oldAddr, newAddr addrs.AbsResourceInstance, implied bool) { if prevMove, exists := ret.Changes.GetOk(oldAddr); exists { // If the old address was _already_ the result of a move then // we'll replace that entry so that our results summarize a chain @@ -81,8 +81,9 @@ oldAddr = prevMove.From } ret.Changes.Put(newAddr, MoveSuccess{ - From: oldAddr, - To: newAddr, + From: oldAddr, + To: newAddr, + Implied: implied, }) } recordBlockage := func(newAddr, wantedAddr addrs.AbsMoveable) { @@ -123,7 +124,7 @@ for key := range rs.Instances { oldInst := relAddr.Instance(key).Absolute(modAddr) newInst := relAddr.Instance(key).Absolute(newAddr) - recordOldAddr(oldInst, newInst) + recordOldAddr(oldInst, newInst, stmt.Implied) } } @@ -157,7 +158,7 @@ for key := range rs.Instances { oldInst := rAddr.Instance(key) newInst := newAddr.Instance(key) - recordOldAddr(oldInst, newInst) + recordOldAddr(oldInst, newInst, stmt.Implied) } state.MoveAbsResource(rAddr, newAddr) continue @@ -176,7 +177,7 @@ continue } - recordOldAddr(iAddr, newAddr) + recordOldAddr(iAddr, newAddr, stmt.Implied) state.MoveAbsResourceInstance(iAddr, newAddr) continue @@ -317,8 +318,9 @@ } type MoveSuccess struct { - From addrs.AbsResourceInstance - To addrs.AbsResourceInstance + From addrs.AbsResourceInstance + To addrs.AbsResourceInstance + Implied bool } type MoveBlocked struct { @@ -335,6 +337,17 @@ return rs.Changes.Has(newAddr) } +// AddrMovedExplicit returns true if and only if the given resource instance +// moved to a new address in the ApplyMoves call that the receiver is describing +// because of a "moved" block in the configuration. +// +// If AddrMovedExplicit returns true, you can pass the same address to method OldAddr +// to find its original address prior to moving. +func (rs MoveResults) AddrMovedExplicit(newAddr addrs.AbsResourceInstance) bool { + change, ok := rs.Changes.GetOk(newAddr) + return ok && !change.Implied +} + // OldAddr returns the old address of the given resource instance address, or // just returns back the same address if the given instance wasn't affected by // any move statements. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.12.4/internal/refactoring/move_execute_test.go new/opentofu-1.12.5/internal/refactoring/move_execute_test.go --- old/opentofu-1.12.4/internal/refactoring/move_execute_test.go 2026-07-13 17:08:17.000000000 +0200 +++ new/opentofu-1.12.5/internal/refactoring/move_execute_test.go 2026-07-21 12:31:31.000000000 +0200 @@ -534,10 +534,12 @@ addrs.MakeMapElem(mustParseInstAddr("module.boo.foo.from"), MoveSuccess{ mustParseInstAddr("foo.from"), mustParseInstAddr("module.boo.foo.from"), + false, }), addrs.MakeMapElem(mustParseInstAddr("module.boo.foo.to"), MoveSuccess{ mustParseInstAddr("module.bar[0].foo.to"), mustParseInstAddr("module.boo.foo.to"), + false, }), ), Blocked: emptyResults.Blocked, @@ -579,10 +581,12 @@ addrs.MakeMapElem(mustParseInstAddr("module.bar[0].foo.to"), MoveSuccess{ mustParseInstAddr("foo.from"), mustParseInstAddr("module.bar[0].foo.to"), + false, }), addrs.MakeMapElem(mustParseInstAddr("module.bar[0].bar.to"), MoveSuccess{ mustParseInstAddr("bar.from"), mustParseInstAddr("module.bar[0].bar.to"), + false, }), ), Blocked: emptyResults.Blocked, @@ -623,6 +627,7 @@ addrs.MakeMapElem(mustParseInstAddr("module.boo.foo.from"), MoveSuccess{ mustParseInstAddr("module.bar[0].foo.from"), mustParseInstAddr("module.boo.foo.from"), + false, }), ), Blocked: addrs.MakeMap( diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.12.4/internal/tofu/context_plan2_test.go new/opentofu-1.12.5/internal/tofu/context_plan2_test.go --- old/opentofu-1.12.4/internal/tofu/context_plan2_test.go 2026-07-13 17:08:17.000000000 +0200 +++ new/opentofu-1.12.5/internal/tofu/context_plan2_test.go 2026-07-21 12:31:31.000000000 +0200 @@ -1414,6 +1414,7 @@ newSchema providers.Schema oldType string newType string + newAddr string config map[string]string attrsJSON []byte wantOp plans.Action @@ -1702,12 +1703,122 @@ }, }, }, + { + name: "different provider addr with same schema (explicit)", + oldSchema: constructProviderSchemaForTesting(map[string]*configschema.Attribute{ + "test_number": { + Type: cty.Number, + Required: true, + }, + }), + newSchema: constructProviderSchemaForTesting(map[string]*configschema.Attribute{ + "test_number": { + Type: cty.Number, + Required: true, + }, + }), + oldType: "provider_object", + newType: "provider_object", + newAddr: "provider_object.new[0]", + config: map[string]string{ + "main.tf": ` + resource "provider_object" "new" { + count = 1 + test_number = 1 + } + moved { + from = provider_object.old + to = provider_object.new[0] + } + `, + }, + attrsJSON: []byte(`{"test_number": 1}`), + wantOp: plans.NoOp, + providerAddr1: &addrs.AbsProviderConfig{ + Provider: addrs.NewBuiltInProvider("provider"), + }, + providerAddr2: &addrs.AbsProviderConfig{ + Provider: addrs.NewDefaultProvider("provider"), + }, + mockProvider: &MockProvider{ + GetProviderSchemaResponse: &providers.GetProviderSchemaResponse{ + ResourceTypes: map[string]providers.Schema{ + "provider_object": constructProviderSchemaForTesting(map[string]*configschema.Attribute{ + "test_number": { + Type: cty.Number, + Required: true, + }, + }), + }, + }, + MoveResourceStateResponse: &providers.MoveResourceStateResponse{ + TargetState: cty.ObjectVal(map[string]cty.Value{ + "test_number": cty.NumberIntVal(1), + }), + }, + }, + }, + { + name: "different provider addr with same schema (implicit)", + oldSchema: constructProviderSchemaForTesting(map[string]*configschema.Attribute{ + "test_number": { + Type: cty.Number, + Required: true, + }, + }), + newSchema: constructProviderSchemaForTesting(map[string]*configschema.Attribute{ + "test_number": { + Type: cty.Number, + Required: true, + }, + }), + oldType: "provider_object", + newType: "provider_object", + config: map[string]string{ + "main.tf": ` + resource "provider_object" "new" { + count = 1 + test_number = 1 + } + // This is an *IMPLICIT* move and should not perform a MovedResource provider request + // This matches what is in the provider framework documentation, but differs from + // terraform (as far as we can tell from black box testing) + // See discussion in https://github.com/opentofu/opentofu/issues/4374#issuecomment-5022178852 + `, + }, + attrsJSON: []byte(`{"test_number": 1}`), + providerAddr1: &addrs.AbsProviderConfig{ + Provider: addrs.NewBuiltInProvider("provider"), + }, + providerAddr2: &addrs.AbsProviderConfig{ + Provider: addrs.NewDefaultProvider("provider"), + }, + wantErrStr: "Showing Upgrade instead of moved: contrived test", + mockProvider: &MockProvider{ + GetProviderSchemaResponse: &providers.GetProviderSchemaResponse{ + ResourceTypes: map[string]providers.Schema{ + "provider_object": constructProviderSchemaForTesting(map[string]*configschema.Attribute{ + "test_number": { + Type: cty.Number, + Required: true, + }, + }), + }, + }, + UpgradeResourceStateResponse: &providers.UpgradeResourceStateResponse{ + Diagnostics: tfdiags.Diagnostics{}.Append(tfdiags.Sourceless(tfdiags.Error, "Showing Upgrade instead of moved", "contrived test")), + }, + }, + }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { oldAddr := mustResourceInstanceAddr(tt.oldType + ".old") newAddr := mustResourceInstanceAddr(tt.newType + ".new") + if tt.newAddr != "" { + newAddr = mustResourceInstanceAddr(tt.newAddr) + } m := testModuleInline(t, tt.config) providerAddr := addrs.AbsProviderConfig{ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.12.4/internal/tofu/node_resource_abstract.go new/opentofu-1.12.5/internal/tofu/node_resource_abstract.go --- old/opentofu-1.12.4/internal/tofu/node_resource_abstract.go 2026-07-13 17:08:17.000000000 +0200 +++ new/opentofu-1.12.5/internal/tofu/node_resource_abstract.go 2026-07-21 12:31:31.000000000 +0200 @@ -643,7 +643,7 @@ currentSchema: schema.Block, currentSchemaVersion: currentVersion, } - if isResourceMovedToDifferentType(addr, prevAddr, providerAddr, prevProviderAddr) { + if evalCtx.MoveResults().AddrMovedExplicit(addr) && isResourceMovedToDifferentType(addr, prevAddr, providerAddr, prevProviderAddr) { src, diags = moveResourceState(transformArgs) } else { src, diags = upgradeResourceState(transformArgs) @@ -722,7 +722,7 @@ currentSchema: schema.Block, currentSchemaVersion: currentVersion, } - if isResourceMovedToDifferentType(addr, prevAddr, providerAddr, prevProviderAddr) { + if evalCtx.MoveResults().AddrMovedExplicit(addr) && isResourceMovedToDifferentType(addr, prevAddr, providerAddr, prevProviderAddr) { src, diags = moveResourceState(transformArgs) } else { src, diags = upgradeResourceState(transformArgs) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.12.4/internal/tofu/upgrade_resource_state.go new/opentofu-1.12.5/internal/tofu/upgrade_resource_state.go --- old/opentofu-1.12.4/internal/tofu/upgrade_resource_state.go 2026-07-13 17:08:17.000000000 +0200 +++ new/opentofu-1.12.5/internal/tofu/upgrade_resource_state.go 2026-07-21 12:31:31.000000000 +0200 @@ -149,7 +149,7 @@ resp := args.provider.MoveResourceState(context.TODO(), req) diags := resp.Diagnostics if diags.HasErrors() { - log.Printf("[TRACE] moveResourceStateTransform: failed - new address: %s, previous address: %s - diags: %s", args.currentAddr, args.prevAddr, diags.Err().Error()) + log.Printf("[TRACE] moveResourceStateTransform: failed - new address: %s %s, previous address: %s %s - diags: %s", args.currentProviderAddr, args.currentAddr, args.prevProviderAddr, args.prevAddr, diags.Err().Error()) return cty.NilVal, nil, diags } return resp.TargetState, resp.TargetPrivate, diags diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.12.4/version/VERSION new/opentofu-1.12.5/version/VERSION --- old/opentofu-1.12.4/version/VERSION 2026-07-13 17:08:17.000000000 +0200 +++ new/opentofu-1.12.5/version/VERSION 2026-07-21 12:31:31.000000000 +0200 @@ -1 +1 @@ -1.12.4 +1.12.5 ++++++ opentofu.obsinfo ++++++ --- /var/tmp/diff_new_pack.XQ0mQA/_old 2026-07-21 23:12:31.454654596 +0200 +++ /var/tmp/diff_new_pack.XQ0mQA/_new 2026-07-21 23:12:31.462654869 +0200 @@ -1,5 +1,5 @@ name: opentofu -version: 1.12.4 -mtime: 1783955297 -commit: d5291190380d16aa5ef4590facbe0719d7fa165f +version: 1.12.5 +mtime: 1784629891 +commit: 230349e959a44fb8eb7b83754f9d9b012f3bdb42 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/opentofu/vendor.tar.gz /work/SRC/openSUSE:Factory/.opentofu.new.24530/vendor.tar.gz differ: char 134, line 1
