vendor: github.com/hashicorp/terraform/...@v0.10.0

9 files changed, 1172 insertions, 0 deletions

diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/error.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/error.go
new file mode 100644
index 0000000..df855a7
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/error.go
@@ -0,0 +1,30 @@
+package discovery
+
+// Error is a type used to describe situations that the caller must handle
+// since they indicate some form of user error.
+//
+// The functions and methods that return these specialized errors indicate so
+// in their documentation. The Error type should not itself be used directly,
+// but rather errors should be compared using the == operator with the
+// error constants in this package.
+//
+// Values of this type are _not_ used when the error being reported is an
+// operational error (server unavailable, etc) or indicative of a bug in
+// this package or its caller.
+type Error string
+
+// ErrorNoSuitableVersion indicates that a suitable version (meeting given
+// constraints) is not available.
+const ErrorNoSuitableVersion = Error("no suitable version is available")
+
+// ErrorNoVersionCompatible indicates that all of the available versions
+// that otherwise met constraints are not compatible with the current
+// version of Terraform.
+const ErrorNoVersionCompatible = Error("no available version is compatible with this version of Terraform")
+
+// ErrorNoSuchProvider indicates that no provider exists with a name given
+const ErrorNoSuchProvider = Error("no provider exists with the given name")
+
+func (err Error) Error() string {
+        return string(err)
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/find.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/find.go
new file mode 100644
index 0000000..f5bc4c1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/find.go
@@ -0,0 +1,168 @@
+package discovery
+
+import (
+        "io/ioutil"
+        "log"
+        "path/filepath"
+        "strings"
+)
+
+// FindPlugins looks in the given directories for files whose filenames
+// suggest that they are plugins of the given kind (e.g. "provider") and
+// returns a PluginMetaSet representing the discovered potential-plugins.
+//
+// Currently this supports two different naming schemes. The current
+// standard naming scheme is a subdirectory called $GOOS-$GOARCH containing
+// files named terraform-$KIND-$NAME-V$VERSION. The legacy naming scheme is
+// files directly in the given directory whose names are like
+// terraform-$KIND-$NAME.
+//
+// Only one plugin will be returned for each unique plugin (name, version)
+// pair, with preference given to files found in earlier directories.
+//
+// This is a convenience wrapper around FindPluginPaths and ResolvePluginsPaths.
+func FindPlugins(kind string, dirs []string) PluginMetaSet {
+        return ResolvePluginPaths(FindPluginPaths(kind, dirs))
+}
+
+// FindPluginPaths looks in the given directories for files whose filenames
+// suggest that they are plugins of the given kind (e.g. "provider").
+//
+// The return value is a list of absolute paths that appear to refer to
+// plugins in the given directories, based only on what can be inferred
+// from the naming scheme. The paths returned are ordered such that files
+// in later dirs appear after files in earlier dirs in the given directory
+// list. Within the same directory plugins are returned in a consistent but
+// undefined order.
+func FindPluginPaths(kind string, dirs []string) []string {
+        // This is just a thin wrapper around findPluginPaths so that we can
+        // use the latter in tests with a fake machineName so we can use our
+        // test fixtures.
+        return findPluginPaths(kind, dirs)
+}
+
+func findPluginPaths(kind string, dirs []string) []string {
+        prefix := "terraform-" + kind + "-"
+
+        ret := make([]string, 0, len(dirs))
+
+        for _, dir := range dirs {
+                items, err := ioutil.ReadDir(dir)
+                if err != nil {
+                        // Ignore missing dirs, non-dirs, etc
+                        continue
+                }
+
+                log.Printf("[DEBUG] checking for %s in %q", kind, dir)
+
+                for _, item := range items {
+                        fullName := item.Name()
+
+                        if !strings.HasPrefix(fullName, prefix) {
+                                log.Printf("[DEBUG] skipping %q, not a %s", fullName, kind)
+                                continue
+                        }
+
+                        // New-style paths must have a version segment in filename
+                        if strings.Contains(strings.ToLower(fullName), "_v") {
+                                absPath, err := filepath.Abs(filepath.Join(dir, fullName))
+                                if err != nil {
+                                        log.Printf("[ERROR] plugin filepath error: %s", err)
+                                        continue
+                                }
+
+                                log.Printf("[DEBUG] found %s %q", kind, fullName)
+                                ret = append(ret, filepath.Clean(absPath))
+                                continue
+                        }
+
+                        // Legacy style with files directly in the base directory
+                        absPath, err := filepath.Abs(filepath.Join(dir, fullName))
+                        if err != nil {
+                                log.Printf("[ERROR] plugin filepath error: %s", err)
+                                continue
+                        }
+
+                        log.Printf("[WARNING] found legacy %s %q", kind, fullName)
+
+                        ret = append(ret, filepath.Clean(absPath))
+                }
+        }
+
+        return ret
+}
+
+// ResolvePluginPaths takes a list of paths to plugin executables (as returned
+// by e.g. FindPluginPaths) and produces a PluginMetaSet describing the
+// referenced plugins.
+//
+// If the same combination of plugin name and version appears multiple times,
+// the earlier reference will be preferred. Several different versions of
+// the same plugin name may be returned, in which case the methods of
+// PluginMetaSet can be used to filter down.
+func ResolvePluginPaths(paths []string) PluginMetaSet {
+        s := make(PluginMetaSet)
+
+        type nameVersion struct {
+                Name    string
+                Version string
+        }
+        found := make(map[nameVersion]struct{})
+
+        for _, path := range paths {
+                baseName := strings.ToLower(filepath.Base(path))
+                if !strings.HasPrefix(baseName, "terraform-") {
+                        // Should never happen with reasonable input
+                        continue
+                }
+
+                baseName = baseName[10:]
+                firstDash := strings.Index(baseName, "-")
+                if firstDash == -1 {
+                        // Should never happen with reasonable input
+                        continue
+                }
+
+                baseName = baseName[firstDash+1:]
+                if baseName == "" {
+                        // Should never happen with reasonable input
+                        continue
+                }
+
+                // Trim the .exe suffix used on Windows before we start wrangling
+                // the remainder of the path.
+                if strings.HasSuffix(baseName, ".exe") {
+                        baseName = baseName[:len(baseName)-4]
+                }
+
+                parts := strings.SplitN(baseName, "_v", 2)
+                name := parts[0]
+                version := VersionZero
+                if len(parts) == 2 {
+                        version = parts[1]
+                }
+
+                // Auto-installed plugins contain an extra name portion representing
+                // the expected plugin version, which we must trim off.
+                if underX := strings.Index(version, "_x"); underX != -1 {
+                        version = version[:underX]
+                }
+
+                if _, ok := found[nameVersion{name, version}]; ok {
+                        // Skip duplicate versions of the same plugin
+                        // (We do this during this step because after this we will be
+                        // dealing with sets and thus lose our ordering with which to
+                        // decide preference.)
+                        continue
+                }
+
+                s.Add(PluginMeta{
+                        Name:    name,
+                        Version: VersionStr(version),
+                        Path:    path,
+                })
+                found[nameVersion{name, version}] = struct{}{}
+        }
+
+        return s
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go
new file mode 100644
index 0000000..241b5cb
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go
@@ -0,0 +1,424 @@
+package discovery
+
+import (
+        "errors"
+        "fmt"
+        "io/ioutil"
+        "log"
+        "net/http"
+        "os"
+        "runtime"
+        "strconv"
+        "strings"
+
+        "golang.org/x/net/html"
+
+        cleanhttp "github.com/hashicorp/go-cleanhttp"
+        getter "github.com/hashicorp/go-getter"
+        multierror "github.com/hashicorp/go-multierror"
+)
+
+// Releases are located by parsing the html listing from releases.hashicorp.com.
+//
+// The URL for releases follows the pattern:
+//    https://releases.hashicorp.com/terraform-provider-name/<x.y.z>/terraform-provider-name_<x.y.z>_<os>_<arch>.<ext>
+//
+// The plugin protocol version will be saved with the release and returned in
+// the header X-TERRAFORM_PROTOCOL_VERSION.
+
+const protocolVersionHeader = "x-terraform-protocol-version"
+
+var releaseHost = "https://releases.hashicorp.com"
+
+var httpClient = cleanhttp.DefaultClient()
+
+// An Installer maintains a local cache of plugins by downloading plugins
+// from an online repository.
+type Installer interface {
+        Get(name string, req Constraints) (PluginMeta, error)
+        PurgeUnused(used map[string]PluginMeta) (removed PluginMetaSet, err error)
+}
+
+// ProviderInstaller is an Installer implementation that knows how to
+// download Terraform providers from the official HashiCorp releases service
+// into a local directory. The files downloaded are compliant with the
+// naming scheme expected by FindPlugins, so the target directory of a
+// provider installer can be used as one of several plugin discovery sources.
+type ProviderInstaller struct {
+        Dir string
+
+        PluginProtocolVersion uint
+
+        // OS and Arch specify the OS and architecture that should be used when
+        // installing plugins. These use the same labels as the runtime.GOOS and
+        // runtime.GOARCH variables respectively, and indeed the values of these
+        // are used as defaults if either of these is the empty string.
+        OS   string
+        Arch string
+
+        // Skip checksum and signature verification
+        SkipVerify bool
+}
+
+// Get is part of an implementation of type Installer, and attempts to download
+// and install a Terraform provider matching the given constraints.
+//
+// This method may return one of a number of sentinel errors from this
+// package to indicate issues that are likely to be resolvable via user action:
+//
+//     ErrorNoSuchProvider: no provider with the given name exists in the repository.
+//     ErrorNoSuitableVersion: the provider exists but no available version matches constraints.
+//     ErrorNoVersionCompatible: a plugin was found within the constraints but it is
+//                               incompatible with the current Terraform version.
+//
+// These errors should be recognized and handled as special cases by the caller
+// to present a suitable user-oriented error message.
+//
+// All other errors indicate an internal problem that is likely _not_ solvable
+// through user action, or at least not within Terraform's scope. Error messages
+// are produced under the assumption that if presented to the user they will
+// be presented alongside context about what is being installed, and thus the
+// error messages do not redundantly include such information.
+func (i *ProviderInstaller) Get(provider string, req Constraints) (PluginMeta, error) {
+        versions, err := i.listProviderVersions(provider)
+        // TODO: return multiple errors
+        if err != nil {
+                return PluginMeta{}, err
+        }
+
+        if len(versions) == 0 {
+                return PluginMeta{}, ErrorNoSuitableVersion
+        }
+
+        versions = allowedVersions(versions, req)
+        if len(versions) == 0 {
+                return PluginMeta{}, ErrorNoSuitableVersion
+        }
+
+        // sort them newest to oldest
+        Versions(versions).Sort()
+
+        // take the first matching plugin we find
+        for _, v := range versions {
+                url := i.providerURL(provider, v.String())
+
+                if !i.SkipVerify {
+                        sha256, err := i.getProviderChecksum(provider, v.String())
+                        if err != nil {
+                                return PluginMeta{}, err
+                        }
+
+                        // add the checksum parameter for go-getter to verify the download for us.
+                        if sha256 != "" {
+                                url = url + "?checksum=sha256:" + sha256
+                        }
+                }
+
+                log.Printf("[DEBUG] fetching provider info for %s version %s", provider, v)
+                if checkPlugin(url, i.PluginProtocolVersion) {
+                        log.Printf("[DEBUG] getting provider %q version %q at %s", provider, v, url)
+                        err := getter.Get(i.Dir, url)
+                        if err != nil {
+                                return PluginMeta{}, err
+                        }
+
+                        // Find what we just installed
+                        // (This is weird, because go-getter doesn't directly return
+                        //  information about what was extracted, and we just extracted
+                        //  the archive directly into a shared dir here.)
+                        log.Printf("[DEBUG] looking for the %s %s plugin we just installed", provider, v)
+                        metas := FindPlugins("provider", []string{i.Dir})
+                        log.Printf("[DEBUG] all plugins found %#v", metas)
+                        metas, _ = metas.ValidateVersions()
+                        metas = metas.WithName(provider).WithVersion(v)
+                        log.Printf("[DEBUG] filtered plugins %#v", metas)
+                        if metas.Count() == 0 {
+                                // This should never happen. Suggests that the release archive
+                                // contains an executable file whose name doesn't match the
+                                // expected convention.
+                                return PluginMeta{}, fmt.Errorf(
+                                        "failed to find installed plugin version %s; this is a bug in Terraform and should be reported",
+                                        v,
+                                )
+                        }
+
+                        if metas.Count() > 1 {
+                                // This should also never happen, and suggests that a
+                                // particular version was re-released with a different
+                                // executable filename. We consider releases as immutable, so
+                                // this is an error.
+                                return PluginMeta{}, fmt.Errorf(
+                                        "multiple plugins installed for version %s; this is a bug in Terraform and should be reported",
+                                        v,
+                                )
+                        }
+
+                        // By now we know we have exactly one meta, and so "Newest" will
+                        // return that one.
+                        return metas.Newest(), nil
+                }
+
+                log.Printf("[INFO] incompatible ProtocolVersion for %s version %s", provider, v)
+        }
+
+        return PluginMeta{}, ErrorNoVersionCompatible
+}
+
+func (i *ProviderInstaller) PurgeUnused(used map[string]PluginMeta) (PluginMetaSet, error) {
+        purge := make(PluginMetaSet)
+
+        present := FindPlugins("provider", []string{i.Dir})
+        for meta := range present {
+                chosen, ok := used[meta.Name]
+                if !ok {
+                        purge.Add(meta)
+                }
+                if chosen.Path != meta.Path {
+                        purge.Add(meta)
+                }
+        }
+
+        removed := make(PluginMetaSet)
+        var errs error
+        for meta := range purge {
+                path := meta.Path
+                err := os.Remove(path)
+                if err != nil {
+                        errs = multierror.Append(errs, fmt.Errorf(
+                                "failed to remove unused provider plugin %s: %s",
+                                path, err,
+                        ))
+                } else {
+                        removed.Add(meta)
+                }
+        }
+
+        return removed, errs
+}
+
+// Plugins are referred to by the short name, but all URLs and files will use
+// the full name prefixed with terraform-<plugin_type>-
+func (i *ProviderInstaller) providerName(name string) string {
+        return "terraform-provider-" + name
+}
+
+func (i *ProviderInstaller) providerFileName(name, version string) string {
+        os := i.OS
+        arch := i.Arch
+        if os == "" {
+                os = runtime.GOOS
+        }
+        if arch == "" {
+                arch = runtime.GOARCH
+        }
+        return fmt.Sprintf("%s_%s_%s_%s.zip", i.providerName(name), version, os, arch)
+}
+
+// providerVersionsURL returns the path to the released versions directory for the provider:
+// https://releases.hashicorp.com/terraform-provider-name/
+func (i *ProviderInstaller) providerVersionsURL(name string) string {
+        return releaseHost + "/" + i.providerName(name) + "/"
+}
+
+// providerURL returns the full path to the provider file, using the current OS
+// and ARCH:
+// .../terraform-provider-name_<x.y.z>/terraform-provider-name_<x.y.z>_<os>_<arch>.<ext>
+func (i *ProviderInstaller) providerURL(name, version string) string {
+        return fmt.Sprintf("%s%s/%s", i.providerVersionsURL(name), version, i.providerFileName(name, version))
+}
+
+func (i *ProviderInstaller) providerChecksumURL(name, version string) string {
+        fileName := fmt.Sprintf("%s_%s_SHA256SUMS", i.providerName(name), version)
+        u := fmt.Sprintf("%s%s/%s", i.providerVersionsURL(name), version, fileName)
+        return u
+}
+
+func (i *ProviderInstaller) getProviderChecksum(name, version string) (string, error) {
+        checksums, err := getPluginSHA256SUMs(i.providerChecksumURL(name, version))
+        if err != nil {
+                return "", err
+        }
+
+        return checksumForFile(checksums, i.providerFileName(name, version)), nil
+}
+
+// Return the plugin version by making a HEAD request to the provided url.
+// If the header is not present, we assume the latest version will be
+// compatible, and leave the check for discovery or execution.
+func checkPlugin(url string, pluginProtocolVersion uint) bool {
+        resp, err := httpClient.Head(url)
+        if err != nil {
+                log.Printf("[ERROR] error fetching plugin headers: %s", err)
+                return false
+        }
+
+        if resp.StatusCode != http.StatusOK {
+                log.Println("[ERROR] non-200 status fetching plugin headers:", resp.Status)
+                return false
+        }
+
+        proto := resp.Header.Get(protocolVersionHeader)
+        if proto == "" {
+                // The header isn't present, but we don't make this error fatal since
+                // the latest version will probably work.
+                log.Printf("[WARNING] missing %s from: %s", protocolVersionHeader, url)
+                return true
+        }
+
+        protoVersion, err := strconv.Atoi(proto)
+        if err != nil {
+                log.Printf("[ERROR] invalid ProtocolVersion: %s", proto)
+                return false
+        }
+
+        return protoVersion == int(pluginProtocolVersion)
+}
+
+// list the version available for the named plugin
+func (i *ProviderInstaller) listProviderVersions(name string) ([]Version, error) {
+        versions, err := listPluginVersions(i.providerVersionsURL(name))
+        if err != nil {
+                // listPluginVersions returns a verbose error message indicating
+                // what was being accessed and what failed
+                return nil, err
+        }
+        return versions, nil
+}
+
+var errVersionNotFound = errors.New("version not found")
+
+// take the list of available versions for a plugin, and filter out those that
+// don't fit the constraints.
+func allowedVersions(available []Version, required Constraints) []Version {
+        var allowed []Version
+
+        for _, v := range available {
+                if required.Allows(v) {
+                        allowed = append(allowed, v)
+                }
+        }
+
+        return allowed
+}
+
+// return a list of the plugin versions at the given URL
+func listPluginVersions(url string) ([]Version, error) {
+        resp, err := httpClient.Get(url)
+        if err != nil {
+                // http library produces a verbose error message that includes the
+                // URL being accessed, etc.
+                return nil, err
+        }
+        defer resp.Body.Close()
+
+        if resp.StatusCode != http.StatusOK {
+                body, _ := ioutil.ReadAll(resp.Body)
+                log.Printf("[ERROR] failed to fetch plugin versions from %s\n%s\n%s", url, resp.Status, body)
+
+                switch resp.StatusCode {
+                case http.StatusNotFound, http.StatusForbidden:
+                        // These are treated as indicative of the given name not being
+                        // a valid provider name at all.
+                        return nil, ErrorNoSuchProvider
+
+                default:
+                        // All other errors are assumed to be operational problems.
+                        return nil, fmt.Errorf("error accessing %s: %s", url, resp.Status)
+                }
+
+        }
+
+        body, err := html.Parse(resp.Body)
+        if err != nil {
+                log.Fatal(err)
+        }
+
+        names := []string{}
+
+        // all we need to do is list links on the directory listing page that look like plugins
+        var f func(*html.Node)
+        f = func(n *html.Node) {
+                if n.Type == html.ElementNode && n.Data == "a" {
+                        c := n.FirstChild
+                        if c != nil && c.Type == html.TextNode && strings.HasPrefix(c.Data, "terraform-") {
+                                names = append(names, c.Data)
+                                return
+                        }
+                }
+                for c := n.FirstChild; c != nil; c = c.NextSibling {
+                        f(c)
+                }
+        }
+        f(body)
+
+        return versionsFromNames(names), nil
+}
+
+// parse the list of directory names into a sorted list of available versions
+func versionsFromNames(names []string) []Version {
+        var versions []Version
+        for _, name := range names {
+                parts := strings.SplitN(name, "_", 2)
+                if len(parts) == 2 && parts[1] != "" {
+                        v, err := VersionStr(parts[1]).Parse()
+                        if err != nil {
+                                // filter invalid versions scraped from the page
+                                log.Printf("[WARN] invalid version found for %q: %s", name, err)
+                                continue
+                        }
+
+                        versions = append(versions, v)
+                }
+        }
+
+        return versions
+}
+
+func checksumForFile(sums []byte, name string) string {
+        for _, line := range strings.Split(string(sums), "\n") {
+                parts := strings.Fields(line)
+                if len(parts) > 1 && parts[1] == name {
+                        return parts[0]
+                }
+        }
+        return ""
+}
+
+// fetch the SHA256SUMS file provided, and verify its signature.
+func getPluginSHA256SUMs(sumsURL string) ([]byte, error) {
+        sigURL := sumsURL + ".sig"
+
+        sums, err := getFile(sumsURL)
+        if err != nil {
+                return nil, fmt.Errorf("error fetching checksums: %s", err)
+        }
+
+        sig, err := getFile(sigURL)
+        if err != nil {
+                return nil, fmt.Errorf("error fetching checksums signature: %s", err)
+        }
+
+        if err := verifySig(sums, sig); err != nil {
+                return nil, err
+        }
+
+        return sums, nil
+}
+
+func getFile(url string) ([]byte, error) {
+        resp, err := httpClient.Get(url)
+        if err != nil {
+                return nil, err
+        }
+        defer resp.Body.Close()
+
+        if resp.StatusCode != http.StatusOK {
+                return nil, fmt.Errorf("%s", resp.Status)
+        }
+
+        data, err := ioutil.ReadAll(resp.Body)
+        if err != nil {
+                return data, err
+        }
+        return data, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/meta.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/meta.go
new file mode 100644
index 0000000..bdcebcb
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/meta.go
@@ -0,0 +1,41 @@
+package discovery
+
+import (
+        "crypto/sha256"
+        "io"
+        "os"
+)
+
+// PluginMeta is metadata about a plugin, useful for launching the plugin
+// and for understanding which plugins are available.
+type PluginMeta struct {
+        // Name is the name of the plugin, e.g. as inferred from the plugin
+        // binary's filename, or by explicit configuration.
+        Name string
+
+        // Version is the semver version of the plugin, expressed as a string
+        // that might not be semver-valid.
+        Version VersionStr
+
+        // Path is the absolute path of the executable that can be launched
+        // to provide the RPC server for this plugin.
+        Path string
+}
+
+// SHA256 returns a SHA256 hash of the content of the referenced executable
+// file, or an error if the file's contents cannot be read.
+func (m PluginMeta) SHA256() ([]byte, error) {
+        f, err := os.Open(m.Path)
+        if err != nil {
+                return nil, err
+        }
+        defer f.Close()
+
+        h := sha256.New()
+        _, err = io.Copy(h, f)
+        if err != nil {
+                return nil, err
+        }
+
+        return h.Sum(nil), nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/meta_set.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/meta_set.go
new file mode 100644
index 0000000..181ea1f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/meta_set.go
@@ -0,0 +1,195 @@
+package discovery
+
+// A PluginMetaSet is a set of PluginMeta objects meeting a certain criteria.
+//
+// Methods on this type allow filtering of the set to produce subsets that
+// meet more restrictive criteria.
+type PluginMetaSet map[PluginMeta]struct{}
+
+// Add inserts the given PluginMeta into the receiving set. This is a no-op
+// if the given meta is already present.
+func (s PluginMetaSet) Add(p PluginMeta) {
+        s[p] = struct{}{}
+}
+
+// Remove removes the given PluginMeta from the receiving set. This is a no-op
+// if the given meta is not already present.
+func (s PluginMetaSet) Remove(p PluginMeta) {
+        delete(s, p)
+}
+
+// Has returns true if the given meta is in the receiving set, or false
+// otherwise.
+func (s PluginMetaSet) Has(p PluginMeta) bool {
+        _, ok := s[p]
+        return ok
+}
+
+// Count returns the number of metas in the set
+func (s PluginMetaSet) Count() int {
+        return len(s)
+}
+
+// ValidateVersions returns two new PluginMetaSets, separating those with
+// versions that have syntax-valid semver versions from those that don't.
+//
+// Eliminating invalid versions from consideration (and possibly warning about
+// them) is usually the first step of working with a meta set after discovery
+// has completed.
+func (s PluginMetaSet) ValidateVersions() (valid, invalid PluginMetaSet) {
+        valid = make(PluginMetaSet)
+        invalid = make(PluginMetaSet)
+        for p := range s {
+                if _, err := p.Version.Parse(); err == nil {
+                        valid.Add(p)
+                } else {
+                        invalid.Add(p)
+                }
+        }
+        return
+}
+
+// WithName returns the subset of metas that have the given name.
+func (s PluginMetaSet) WithName(name string) PluginMetaSet {
+        ns := make(PluginMetaSet)
+        for p := range s {
+                if p.Name == name {
+                        ns.Add(p)
+                }
+        }
+        return ns
+}
+
+// WithVersion returns the subset of metas that have the given version.
+//
+// This should be used only with the "valid" result from ValidateVersions;
+// it will ignore any plugin metas that have a invalid version strings.
+func (s PluginMetaSet) WithVersion(version Version) PluginMetaSet {
+        ns := make(PluginMetaSet)
+        for p := range s {
+                gotVersion, err := p.Version.Parse()
+                if err != nil {
+                        continue
+                }
+                if gotVersion.Equal(version) {
+                        ns.Add(p)
+                }
+        }
+        return ns
+}
+
+// ByName groups the metas in the set by their Names, returning a map.
+func (s PluginMetaSet) ByName() map[string]PluginMetaSet {
+        ret := make(map[string]PluginMetaSet)
+        for p := range s {
+                if _, ok := ret[p.Name]; !ok {
+                        ret[p.Name] = make(PluginMetaSet)
+                }
+                ret[p.Name].Add(p)
+        }
+        return ret
+}
+
+// Newest returns the one item from the set that has the newest Version value.
+//
+// The result is meaningful only if the set is already filtered such that
+// all of the metas have the same Name.
+//
+// If there isn't at least one meta in the set then this function will panic.
+// Use Count() to ensure that there is at least one value before calling.
+//
+// If any of the metas have invalid version strings then this function will
+// panic. Use ValidateVersions() first to filter out metas with invalid
+// versions.
+//
+// If two metas have the same Version then one is arbitrarily chosen. This
+// situation should be avoided by pre-filtering the set.
+func (s PluginMetaSet) Newest() PluginMeta {
+        if len(s) == 0 {
+                panic("can't call NewestStable on empty PluginMetaSet")
+        }
+
+        var first = true
+        var winner PluginMeta
+        var winnerVersion Version
+        for p := range s {
+                version, err := p.Version.Parse()
+                if err != nil {
+                        panic(err)
+                }
+
+                if first == true || version.NewerThan(winnerVersion) {
+                        winner = p
+                        winnerVersion = version
+                        first = false
+                }
+        }
+
+        return winner
+}
+
+// ConstrainVersions takes a set of requirements and attempts to
+// return a map from name to a set of metas that have the matching
+// name and an appropriate version.
+//
+// If any of the given requirements match *no* plugins then its PluginMetaSet
+// in the returned map will be empty.
+//
+// All viable metas are returned, so the caller can apply any desired filtering
+// to reduce down to a single option. For example, calling Newest() to obtain
+// the highest available version.
+//
+// If any of the metas in the set have invalid version strings then this
+// function will panic. Use ValidateVersions() first to filter out metas with
+// invalid versions.
+func (s PluginMetaSet) ConstrainVersions(reqd PluginRequirements) map[string]PluginMetaSet {
+        ret := make(map[string]PluginMetaSet)
+        for p := range s {
+                name := p.Name
+                allowedVersions, ok := reqd[name]
+                if !ok {
+                        continue
+                }
+                if _, ok := ret[p.Name]; !ok {
+                        ret[p.Name] = make(PluginMetaSet)
+                }
+                version, err := p.Version.Parse()
+                if err != nil {
+                        panic(err)
+                }
+                if allowedVersions.Allows(version) {
+                        ret[p.Name].Add(p)
+                }
+        }
+        return ret
+}
+
+// OverridePaths returns a new set where any existing plugins with the given
+// names are removed and replaced with the single path given in the map.
+//
+// This is here only to continue to support the legacy way of overriding
+// plugin binaries in the .terraformrc file. It treats all given plugins
+// as pre-versioning (version 0.0.0). This mechanism will eventually be
+// phased out, with vendor directories being the intended replacement.
+func (s PluginMetaSet) OverridePaths(paths map[string]string) PluginMetaSet {
+        ret := make(PluginMetaSet)
+        for p := range s {
+                if _, ok := paths[p.Name]; ok {
+                        // Skip plugins that we're overridding
+                        continue
+                }
+
+                ret.Add(p)
+        }
+
+        // Now add the metadata for overriding plugins
+        for name, path := range paths {
+                ret.Add(PluginMeta{
+                        Name:    name,
+                        Version: VersionZero,
+                        Path:    path,
+                })
+        }
+
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/requirements.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/requirements.go
new file mode 100644
index 0000000..75430fd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/requirements.go
@@ -0,0 +1,105 @@
+package discovery
+
+import (
+        "bytes"
+)
+
+// PluginRequirements describes a set of plugins (assumed to be of a consistent
+// kind) that are required to exist and have versions within the given
+// corresponding sets.
+type PluginRequirements map[string]*PluginConstraints
+
+// PluginConstraints represents an element of PluginRequirements describing
+// the constraints for a single plugin.
+type PluginConstraints struct {
+        // Specifies that the plugin's version must be within the given
+        // constraints.
+        Versions Constraints
+
+        // If non-nil, the hash of the on-disk plugin executable must exactly
+        // match the SHA256 hash given here.
+        SHA256 []byte
+}
+
+// Allows returns true if the given version is within the receiver's version
+// constraints.
+func (s *PluginConstraints) Allows(v Version) bool {
+        return s.Versions.Allows(v)
+}
+
+// AcceptsSHA256 returns true if the given executable SHA256 hash is acceptable,
+// either because it matches the constraint or because there is no such
+// constraint.
+func (s *PluginConstraints) AcceptsSHA256(digest []byte) bool {
+        if s.SHA256 == nil {
+                return true
+        }
+        return bytes.Equal(s.SHA256, digest)
+}
+
+// Merge takes the contents of the receiver and the other given requirements
+// object and merges them together into a single requirements structure
+// that satisfies both sets of requirements.
+//
+// Note that it doesn't make sense to merge two PluginRequirements with
+// differing required plugin SHA256 hashes, since the result will never
+// match any plugin.
+func (r PluginRequirements) Merge(other PluginRequirements) PluginRequirements {
+        ret := make(PluginRequirements)
+        for n, c := range r {
+                ret[n] = &PluginConstraints{
+                        Versions: Constraints{}.Append(c.Versions),
+                        SHA256:   c.SHA256,
+                }
+        }
+        for n, c := range other {
+                if existing, exists := ret[n]; exists {
+                        ret[n].Versions = ret[n].Versions.Append(c.Versions)
+
+                        if existing.SHA256 != nil {
+                                if c.SHA256 != nil && !bytes.Equal(c.SHA256, existing.SHA256) {
+                                        // If we've been asked to merge two constraints with
+                                        // different SHA256 hashes then we'll produce a dummy value
+                                        // that can never match anything. This is a silly edge case
+                                        // that no reasonable caller should hit.
+                                        ret[n].SHA256 = []byte(invalidProviderHash)
+                                }
+                        } else {
+                                ret[n].SHA256 = c.SHA256 // might still be nil
+                        }
+                } else {
+                        ret[n] = &PluginConstraints{
+                                Versions: Constraints{}.Append(c.Versions),
+                                SHA256:   c.SHA256,
+                        }
+                }
+        }
+        return ret
+}
+
+// LockExecutables applies additional constraints to the receiver that
+// require plugin executables with specific SHA256 digests. This modifies
+// the receiver in-place, since it's intended to be applied after
+// version constraints have been resolved.
+//
+// The given map must include a key for every plugin that is already
+// required. If not, any missing keys will cause the corresponding plugin
+// to never match, though the direct caller doesn't necessarily need to
+// guarantee this as long as the downstream code _applying_ these constraints
+// is able to deal with the non-match in some way.
+func (r PluginRequirements) LockExecutables(sha256s map[string][]byte) {
+        for name, cons := range r {
+                digest := sha256s[name]
+
+                if digest == nil {
+                        // Prevent any match, which will then presumably cause the
+                        // downstream consumer of this requirements to report an error.
+                        cons.SHA256 = []byte(invalidProviderHash)
+                        continue
+                }
+
+                cons.SHA256 = digest
+        }
+}
+
+const invalidProviderHash = "<invalid>"
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/signature.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/signature.go
new file mode 100644
index 0000000..b6686a5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/signature.go
@@ -0,0 +1,53 @@
+package discovery
+
+import (
+        "bytes"
+        "log"
+        "strings"
+
+        "golang.org/x/crypto/openpgp"
+)
+
+// Verify the data using the provided openpgp detached signature and the
+// embedded hashicorp public key.
+func verifySig(data, sig []byte) error {
+        el, err := openpgp.ReadArmoredKeyRing(strings.NewReader(hashiPublicKey))
+        if err != nil {
+                log.Fatal(err)
+        }
+
+        _, err = openpgp.CheckDetachedSignature(el, bytes.NewReader(data), bytes.NewReader(sig))
+        return err
+}
+
+// this is the public key that signs the checksums file for releases.
+const hashiPublicKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQENBFMORM0BCADBRyKO1MhCirazOSVwcfTr1xUxjPvfxD3hjUwHtjsOy/bT6p9f
+W2mRPfwnq2JB5As+paL3UGDsSRDnK9KAxQb0NNF4+eVhr/EJ18s3wwXXDMjpIifq
+fIm2WyH3G+aRLTLPIpscUNKDyxFOUbsmgXAmJ46Re1fn8uKxKRHbfa39aeuEYWFA
+3drdL1WoUngvED7f+RnKBK2G6ZEpO+LDovQk19xGjiMTtPJrjMjZJ3QXqPvx5wca
+KSZLr4lMTuoTI/ZXyZy5bD4tShiZz6KcyX27cD70q2iRcEZ0poLKHyEIDAi3TM5k
+SwbbWBFd5RNPOR0qzrb/0p9ksKK48IIfH2FvABEBAAG0K0hhc2hpQ29ycCBTZWN1
+cml0eSA8c2VjdXJpdHlAaGFzaGljb3JwLmNvbT6JATgEEwECACIFAlMORM0CGwMG
+CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEFGFLYc0j/xMyWIIAIPhcVqiQ59n
+Jc07gjUX0SWBJAxEG1lKxfzS4Xp+57h2xxTpdotGQ1fZwsihaIqow337YHQI3q0i
+SqV534Ms+j/tU7X8sq11xFJIeEVG8PASRCwmryUwghFKPlHETQ8jJ+Y8+1asRydi
+psP3B/5Mjhqv/uOK+Vy3zAyIpyDOMtIpOVfjSpCplVRdtSTFWBu9Em7j5I2HMn1w
+sJZnJgXKpybpibGiiTtmnFLOwibmprSu04rsnP4ncdC2XRD4wIjoyA+4PKgX3sCO
+klEzKryWYBmLkJOMDdo52LttP3279s7XrkLEE7ia0fXa2c12EQ0f0DQ1tGUvyVEW
+WmJVccm5bq25AQ0EUw5EzQEIANaPUY04/g7AmYkOMjaCZ6iTp9hB5Rsj/4ee/ln9
+wArzRO9+3eejLWh53FoN1rO+su7tiXJA5YAzVy6tuolrqjM8DBztPxdLBbEi4V+j
+2tK0dATdBQBHEh3OJApO2UBtcjaZBT31zrG9K55D+CrcgIVEHAKY8Cb4kLBkb5wM
+skn+DrASKU0BNIV1qRsxfiUdQHZfSqtp004nrql1lbFMLFEuiY8FZrkkQ9qduixo
+mTT6f34/oiY+Jam3zCK7RDN/OjuWheIPGj/Qbx9JuNiwgX6yRj7OE1tjUx6d8g9y
+0H1fmLJbb3WZZbuuGFnK6qrE3bGeY8+AWaJAZ37wpWh1p0cAEQEAAYkBHwQYAQIA
+CQUCUw5EzQIbDAAKCRBRhS2HNI/8TJntCAClU7TOO/X053eKF1jqNW4A1qpxctVc
+z8eTcY8Om5O4f6a/rfxfNFKn9Qyja/OG1xWNobETy7MiMXYjaa8uUx5iFy6kMVaP
+0BXJ59NLZjMARGw6lVTYDTIvzqqqwLxgliSDfSnqUhubGwvykANPO+93BBx89MRG
+unNoYGXtPlhNFrAsB1VR8+EyKLv2HQtGCPSFBhrjuzH3gxGibNDDdFQLxxuJWepJ
+EK1UbTS4ms0NgZ2Uknqn1WRU1Ki7rE4sTy68iZtWpKQXZEJa0IGnuI2sSINGcXCJ
+oEIgXTMyCILo34Fa/C6VCm2WBgz9zZO8/rHIiQm1J5zqz0DrDwKBUM9C
+=LYpS
+-----END PGP PUBLIC KEY BLOCK-----`
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/version.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/version.go
new file mode 100644
index 0000000..8fad58d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/version.go
@@ -0,0 +1,72 @@
+package discovery
+
+import (
+        "fmt"
+        "sort"
+
+        version "github.com/hashicorp/go-version"
+)
+
+const VersionZero = "0.0.0"
+
+// A VersionStr is a string containing a possibly-invalid representation
+// of a semver version number. Call Parse on it to obtain a real Version
+// object, or discover that it is invalid.
+type VersionStr string
+
+// Parse transforms a VersionStr into a Version if it is
+// syntactically valid. If it isn't then an error is returned instead.
+func (s VersionStr) Parse() (Version, error) {
+        raw, err := version.NewVersion(string(s))
+        if err != nil {
+                return Version{}, err
+        }
+        return Version{raw}, nil
+}
+
+// MustParse transforms a VersionStr into a Version if it is
+// syntactically valid. If it isn't then it panics.
+func (s VersionStr) MustParse() Version {
+        ret, err := s.Parse()
+        if err != nil {
+                panic(err)
+        }
+        return ret
+}
+
+// Version represents a version number that has been parsed from
+// a semver string and known to be valid.
+type Version struct {
+        // We wrap this here just because it avoids a proliferation of
+        // direct go-version imports all over the place, and keeps the
+        // version-processing details within this package.
+        raw *version.Version
+}
+
+func (v Version) String() string {
+        return v.raw.String()
+}
+
+func (v Version) NewerThan(other Version) bool {
+        return v.raw.GreaterThan(other.raw)
+}
+
+func (v Version) Equal(other Version) bool {
+        return v.raw.Equal(other.raw)
+}
+
+// MinorUpgradeConstraintStr returns a ConstraintStr that would permit
+// minor upgrades relative to the receiving version.
+func (v Version) MinorUpgradeConstraintStr() ConstraintStr {
+        segments := v.raw.Segments()
+        return ConstraintStr(fmt.Sprintf("~> %d.%d", segments[0], segments[1]))
+}
+
+type Versions []Version
+
+// Sort sorts version from newest to oldest.
+func (v Versions) Sort() {
+        sort.Slice(v, func(i, j int) bool {
+                return v[i].NewerThan(v[j])
+        })
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/version_set.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/version_set.go
new file mode 100644
index 0000000..0aefd75
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/version_set.go
@@ -0,0 +1,84 @@
+package discovery
+
+import (
+        "sort"
+
+        version "github.com/hashicorp/go-version"
+)
+
+// A ConstraintStr is a string containing a possibly-invalid representation
+// of a version constraint provided in configuration. Call Parse on it to
+// obtain a real Constraint object, or discover that it is invalid.
+type ConstraintStr string
+
+// Parse transforms a ConstraintStr into a Constraints if it is
+// syntactically valid. If it isn't then an error is returned instead.
+func (s ConstraintStr) Parse() (Constraints, error) {
+        raw, err := version.NewConstraint(string(s))
+        if err != nil {
+                return Constraints{}, err
+        }
+        return Constraints{raw}, nil
+}
+
+// MustParse is like Parse but it panics if the constraint string is invalid.
+func (s ConstraintStr) MustParse() Constraints {
+        ret, err := s.Parse()
+        if err != nil {
+                panic(err)
+        }
+        return ret
+}
+
+// Constraints represents a set of versions which any given Version is either
+// a member of or not.
+type Constraints struct {
+        raw version.Constraints
+}
+
+// AllVersions is a Constraints containing all versions
+var AllVersions Constraints
+
+func init() {
+        AllVersions = Constraints{
+                raw: make(version.Constraints, 0),
+        }
+}
+
+// Allows returns true if the given version permitted by the receiving
+// constraints set.
+func (s Constraints) Allows(v Version) bool {
+        return s.raw.Check(v.raw)
+}
+
+// Append combines the receiving set with the given other set to produce
+// a set that is the intersection of both sets, which is to say that resulting
+// constraints contain only the versions that are members of both.
+func (s Constraints) Append(other Constraints) Constraints {
+        raw := make(version.Constraints, 0, len(s.raw)+len(other.raw))
+
+        // Since "raw" is a list of constraints that remove versions from the set,
+        // "Intersection" is implemented by concatenating together those lists,
+        // thus leaving behind only the versions not removed by either list.
+        raw = append(raw, s.raw...)
+        raw = append(raw, other.raw...)
+
+        // while the set is unordered, we sort these lexically for consistent output
+        sort.Slice(raw, func(i, j int) bool {
+                return raw[i].String() < raw[j].String()
+        })
+
+        return Constraints{raw}
+}
+
+// String returns a string representation of the set members as a set
+// of range constraints.
+func (s Constraints) String() string {
+        return s.raw.String()
+}
+
+// Unconstrained returns true if and only if the receiver is an empty
+// constraint set.
+func (s Constraints) Unconstrained() bool {
+        return len(s.raw) == 0
+}