21 files changed, 541 insertions, 195 deletions

diff --git a/vendor/github.com/hashicorp/go-getter/.travis.yml b/vendor/github.com/hashicorp/go-getter/.travis.yml
index 4438286..da804c2 100644
--- a/vendor/github.com/hashicorp/go-getter/.travis.yml
+++ b/vendor/github.com/hashicorp/go-getter/.travis.yml
@@ -10,8 +10,14 @@ addons:
 language: go
 
 go:
-  - 1.5
+  - 1.8.x
+  - 1.9.x
+  - master
 
 branches:
   only:
     - master
+
+matrix:
+  allow_failures:
+    - go: master
diff --git a/vendor/github.com/hashicorp/go-getter/README.md b/vendor/github.com/hashicorp/go-getter/README.md
index 4a0b6a6..40ace74 100644
--- a/vendor/github.com/hashicorp/go-getter/README.md
+++ b/vendor/github.com/hashicorp/go-getter/README.md
@@ -21,8 +21,7 @@ URLs. For example: "github.com/hashicorp/go-getter" would turn into a
 Git URL. Or "./foo" would turn into a file URL. These are extensible.
 
 This library is used by [Terraform](https://terraform.io) for
-downloading modules, [Otto](https://ottoproject.io) for dependencies and
-Appfile imports, and [Nomad](https://nomadproject.io) for downloading
+downloading modules and [Nomad](https://nomadproject.io) for downloading
 binaries.
 
 ## Installation and Usage
@@ -119,6 +118,37 @@ The protocol-specific options are documented below the URL format
 section. But because they are part of the URL, we point it out here so
 you know they exist.
 
+### Subdirectories
+
+If you want to download only a specific subdirectory from a downloaded
+directory, you can specify a subdirectory after a double-slash `//`.
+go-getter will first download the URL specified _before_ the double-slash
+(as if you didn't specify a double-slash), but will then copy the
+path after the double slash into the target directory.
+
+For example, if you're downloading this GitHub repository, but you only
+want to download the `test-fixtures` directory, you can do the following:
+
+```
+https://github.com/hashicorp/go-getter.git//test-fixtures
+```
+
+If you downloaded this to the `/tmp` directory, then the file
+`/tmp/archive.gz` would exist. Notice that this file is in the `test-fixtures`
+directory in this repository, but because we specified a subdirectory,
+go-getter automatically copied only that directory contents.
+
+Subdirectory paths may contain may also use filesystem glob patterns.
+The path must match _exactly one_ entry or go-getter will return an error.
+This is useful if you're not sure the exact directory name but it follows
+a predictable naming structure.
+
+For example, the following URL would also work:
+
+```
+https://github.com/hashicorp/go-getter.git//test-*
+```
+
 ### Checksumming
 
 For file downloads of any protocol, go-getter can automatically verify
@@ -154,9 +184,11 @@ The following archive formats are supported:
 
   * `tar.gz` and `tgz`
   * `tar.bz2` and `tbz2`
+  * `tar.xz` and `txz`
   * `zip`
   * `gz`
   * `bz2`
+  * `xz`
 
 For example, an example URL is shown below:
 
@@ -200,6 +232,9 @@ The options below are available to all protocols:
   * `checksum` - Checksum to verify the downloaded file or archive. See
     the entire section on checksumming above for format and more details.
 
+  * `filename` - When in file download mode, allows specifying the name of the
+    downloaded file on disk. Has no effect in directory mode.
+
 ### Local Files (`file`)
 
 None
@@ -222,13 +257,17 @@ None
 
 ### HTTP (`http`)
 
-None
+#### Basic Authentication
+
+To use HTTP basic authentication with go-getter, simply prepend `username:password@` to the
+hostname in the URL such as `https://Aladdin:OpenSesame@www.example.com/index.html`. All special
+characters, including the username and password, must be URL encoded.
 
 ### S3 (`s3`)
 
 S3 takes various access configurations in the URL. Note that it will also
-read these from standard AWS environment variables if they're set. If
-the query parameters are present, these take priority.
+read these from standard AWS environment variables if they're set. S3 compliant servers like Minio
+are also supported. If the query parameters are present, these take priority.
 
   * `aws_access_key_id` - AWS access key.
   * `aws_access_key_secret` - AWS access key secret.
@@ -240,6 +279,14 @@ If you use go-getter and want to use an EC2 IAM Instance Profile to avoid
 using credentials, then just omit these and the profile, if available will
 be used automatically.
 
+### Using S3 with Minio
+ If you use go-gitter for Minio support, you must consider the following:
+
+  * `aws_access_key_id` (required) - Minio access key.
+  * `aws_access_key_secret` (required) - Minio access key secret.
+  * `region` (optional - defaults to us-east-1) - Region identifier to use.
+  * `version` (optional - defaults to Minio default) - Configuration file format.
+
 #### S3 Bucket Examples
 
 S3 has several addressing schemes used to reference your bucket. These are
@@ -250,4 +297,5 @@ Some examples for these addressing schemes:
 - s3::https://s3-eu-west-1.amazonaws.com/bucket/foo
 - bucket.s3.amazonaws.com/foo
 - bucket.s3-eu-west-1.amazonaws.com/foo/bar
+- "s3::http://127.0.0.1:9000/test-bucket/hello.txt?aws_access_key_id=KEYID&aws_access_key_secret=SECRETKEY&region=us-east-2"
 
diff --git a/vendor/github.com/hashicorp/go-getter/appveyor.yml b/vendor/github.com/hashicorp/go-getter/appveyor.yml
index 159dad4..ec48d45 100644
--- a/vendor/github.com/hashicorp/go-getter/appveyor.yml
+++ b/vendor/github.com/hashicorp/go-getter/appveyor.yml
@@ -1,5 +1,5 @@
 version: "build-{branch}-{build}"
-image: Visual Studio 2015
+image: Visual Studio 2017
 clone_folder: c:\gopath\github.com\hashicorp\go-getter
 environment:
   GOPATH: c:\gopath
diff --git a/vendor/github.com/hashicorp/go-getter/client.go b/vendor/github.com/hashicorp/go-getter/client.go
index 876812a..300301c 100644
--- a/vendor/github.com/hashicorp/go-getter/client.go
+++ b/vendor/github.com/hashicorp/go-getter/client.go
@@ -17,6 +17,7 @@ import (
         "strings"
 
         urlhelper "github.com/hashicorp/go-getter/helper/url"
+        "github.com/hashicorp/go-safetemp"
 )
 
 // Client is a client for downloading things.
@@ -100,17 +101,14 @@ func (c *Client) Get() error {
         dst := c.Dst
         src, subDir := SourceDirSubdir(src)
         if subDir != "" {
-                tmpDir, err := ioutil.TempDir("", "tf")
+                td, tdcloser, err := safetemp.Dir("", "getter")
                 if err != nil {
                         return err
                 }
-                if err := os.RemoveAll(tmpDir); err != nil {
-                        return err
-                }
-                defer os.RemoveAll(tmpDir)
+                defer tdcloser.Close()
 
                 realDst = dst
-                dst = tmpDir
+                dst = td
         }
 
         u, err := urlhelper.Parse(src)
@@ -232,7 +230,18 @@ func (c *Client) Get() error {
                 // Destination is the base name of the URL path in "any" mode when
                 // a file source is detected.
                 if mode == ClientModeFile {
-                        dst = filepath.Join(dst, filepath.Base(u.Path))
+                        filename := filepath.Base(u.Path)
+
+                        // Determine if we have a custom file name
+                        if v := q.Get("filename"); v != "" {
+                                // Delete the query parameter if we have it.
+                                q.Del("filename")
+                                u.RawQuery = q.Encode()
+
+                                filename = v
+                        }
+
+                        dst = filepath.Join(dst, filename)
                 }
         }
 
@@ -305,7 +314,13 @@ func (c *Client) Get() error {
                         return err
                 }
 
-                return copyDir(realDst, filepath.Join(dst, subDir), false)
+                // Process any globs
+                subDir, err := SubdirGlob(dst, subDir)
+                if err != nil {
+                        return err
+                }
+
+                return copyDir(realDst, subDir, false)
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/go-getter/decompress.go b/vendor/github.com/hashicorp/go-getter/decompress.go
index d18174c..198bb0e 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress.go
@@ -1,7 +1,15 @@
 package getter
 
+import (
+        "strings"
+)
+
 // Decompressor defines the interface that must be implemented to add
 // support for decompressing a type.
+//
+// Important: if you're implementing a decompressor, please use the
+// containsDotDot helper in this file to ensure that files can't be
+// decompressed outside of the specified directory.
 type Decompressor interface {
         // Decompress should decompress src to dst. dir specifies whether dst
         // is a directory or single file. src is guaranteed to be a single file
@@ -16,14 +24,35 @@ var Decompressors map[string]Decompressor
 func init() {
         tbzDecompressor := new(TarBzip2Decompressor)
         tgzDecompressor := new(TarGzipDecompressor)
+        txzDecompressor := new(TarXzDecompressor)
 
         Decompressors = map[string]Decompressor{
                 "bz2":     new(Bzip2Decompressor),
                 "gz":      new(GzipDecompressor),
+                "xz":      new(XzDecompressor),
                 "tar.bz2": tbzDecompressor,
                 "tar.gz":  tgzDecompressor,
+                "tar.xz":  txzDecompressor,
                 "tbz2":    tbzDecompressor,
                 "tgz":     tgzDecompressor,
+                "txz":     txzDecompressor,
                 "zip":     new(ZipDecompressor),
         }
 }
+
+// containsDotDot checks if the filepath value v contains a ".." entry.
+// This will check filepath components by splitting along / or \. This
+// function is copied directly from the Go net/http implementation.
+func containsDotDot(v string) bool {
+        if !strings.Contains(v, "..") {
+                return false
+        }
+        for _, ent := range strings.FieldsFunc(v, isSlashRune) {
+                if ent == ".." {
+                        return true
+                }
+        }
+        return false
+}
+
+func isSlashRune(r rune) bool { return r == '/' || r == '\\' }
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_gzip.go b/vendor/github.com/hashicorp/go-getter/decompress_gzip.go
index 2001054..5ebf709 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_gzip.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_gzip.go
@@ -9,7 +9,7 @@ import (
 )
 
 // GzipDecompressor is an implementation of Decompressor that can
-// decompress bz2 files.
+// decompress gzip files.
 type GzipDecompressor struct{}
 
 func (d *GzipDecompressor) Decompress(dst, src string, dir bool) error {
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_tar.go b/vendor/github.com/hashicorp/go-getter/decompress_tar.go
new file mode 100644
index 0000000..39cb392
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/decompress_tar.go
@@ -0,0 +1,138 @@
+package getter
+
+import (
+        "archive/tar"
+        "fmt"
+        "io"
+        "os"
+        "path/filepath"
+)
+
+// untar is a shared helper for untarring an archive. The reader should provide
+// an uncompressed view of the tar archive.
+func untar(input io.Reader, dst, src string, dir bool) error {
+        tarR := tar.NewReader(input)
+        done := false
+        dirHdrs := []*tar.Header{}
+        for {
+                hdr, err := tarR.Next()
+                if err == io.EOF {
+                        if !done {
+                                // Empty archive
+                                return fmt.Errorf("empty archive: %s", src)
+                        }
+
+                        break
+                }
+                if err != nil {
+                        return err
+                }
+
+                if hdr.Typeflag == tar.TypeXGlobalHeader || hdr.Typeflag == tar.TypeXHeader {
+                        // don't unpack extended headers as files
+                        continue
+                }
+
+                path := dst
+                if dir {
+                        // Disallow parent traversal
+                        if containsDotDot(hdr.Name) {
+                                return fmt.Errorf("entry contains '..': %s", hdr.Name)
+                        }
+
+                        path = filepath.Join(path, hdr.Name)
+                }
+
+                if hdr.FileInfo().IsDir() {
+                        if !dir {
+                                return fmt.Errorf("expected a single file: %s", src)
+                        }
+
+                        // A directory, just make the directory and continue unarchiving...
+                        if err := os.MkdirAll(path, 0755); err != nil {
+                                return err
+                        }
+
+                        // Record the directory information so that we may set its attributes
+                        // after all files have been extracted
+                        dirHdrs = append(dirHdrs, hdr)
+
+                        continue
+                } else {
+                        // There is no ordering guarantee that a file in a directory is
+                        // listed before the directory
+                        dstPath := filepath.Dir(path)
+
+                        // Check that the directory exists, otherwise create it
+                        if _, err := os.Stat(dstPath); os.IsNotExist(err) {
+                                if err := os.MkdirAll(dstPath, 0755); err != nil {
+                                        return err
+                                }
+                        }
+                }
+
+                // We have a file. If we already decoded, then it is an error
+                if !dir && done {
+                        return fmt.Errorf("expected a single file, got multiple: %s", src)
+                }
+
+                // Mark that we're done so future in single file mode errors
+                done = true
+
+                // Open the file for writing
+                dstF, err := os.Create(path)
+                if err != nil {
+                        return err
+                }
+                _, err = io.Copy(dstF, tarR)
+                dstF.Close()
+                if err != nil {
+                        return err
+                }
+
+                // Chmod the file
+                if err := os.Chmod(path, hdr.FileInfo().Mode()); err != nil {
+                        return err
+                }
+
+                // Set the access and modification time
+                if err := os.Chtimes(path, hdr.AccessTime, hdr.ModTime); err != nil {
+                        return err
+                }
+        }
+
+        // Adding a file or subdirectory changes the mtime of a directory
+        // We therefore wait until we've extracted everything and then set the mtime and atime attributes
+        for _, dirHdr := range dirHdrs {
+                path := filepath.Join(dst, dirHdr.Name)
+                if err := os.Chtimes(path, dirHdr.AccessTime, dirHdr.ModTime); err != nil {
+                        return err
+                }
+        }
+
+        return nil
+}
+
+// tarDecompressor is an implementation of Decompressor that can
+// unpack tar files.
+type tarDecompressor struct{}
+
+func (d *tarDecompressor) Decompress(dst, src string, dir bool) error {
+        // If we're going into a directory we should make that first
+        mkdir := dst
+        if !dir {
+                mkdir = filepath.Dir(dst)
+        }
+        if err := os.MkdirAll(mkdir, 0755); err != nil {
+                return err
+        }
+
+        // File first
+        f, err := os.Open(src)
+        if err != nil {
+                return err
+        }
+        defer f.Close()
+
+        return untar(f, dst, src, dir)
+}
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_tbz2.go b/vendor/github.com/hashicorp/go-getter/decompress_tbz2.go
index c46ed44..5391b5c 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_tbz2.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_tbz2.go
@@ -1,10 +1,7 @@
 package getter
 
 import (
-        "archive/tar"
         "compress/bzip2"
-        "fmt"
-        "io"
         "os"
         "path/filepath"
 )
@@ -32,64 +29,5 @@ func (d *TarBzip2Decompressor) Decompress(dst, src string, dir bool) error {
 
         // Bzip2 compression is second
         bzipR := bzip2.NewReader(f)
-
-        // Once bzip decompressed we have a tar format
-        tarR := tar.NewReader(bzipR)
-        done := false
-        for {
-                hdr, err := tarR.Next()
-                if err == io.EOF {
-                        if !done {
-                                // Empty archive
-                                return fmt.Errorf("empty archive: %s", src)
-                        }
-
-                        return nil
-                }
-                if err != nil {
-                        return err
-                }
-
-                path := dst
-                if dir {
-                        path = filepath.Join(path, hdr.Name)
-                }
-
-                if hdr.FileInfo().IsDir() {
-                        if dir {
-                                return fmt.Errorf("expected a single file: %s", src)
-                        }
-
-                        // A directory, just make the directory and continue unarchiving...
-                        if err := os.MkdirAll(path, 0755); err != nil {
-                                return err
-                        }
-
-                        continue
-                }
-
-                // We have a file. If we already decoded, then it is an error
-                if !dir && done {
-                        return fmt.Errorf("expected a single file, got multiple: %s", src)
-                }
-
-                // Mark that we're done so future in single file mode errors
-                done = true
-
-                // Open the file for writing
-                dstF, err := os.Create(path)
-                if err != nil {
-                        return err
-                }
-                _, err = io.Copy(dstF, tarR)
-                dstF.Close()
-                if err != nil {
-                        return err
-                }
-
-                // Chmod the file
-                if err := os.Chmod(path, hdr.FileInfo().Mode()); err != nil {
-                        return err
-                }
-        }
+        return untar(bzipR, dst, src, dir)
 }
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_testing.go b/vendor/github.com/hashicorp/go-getter/decompress_testing.go
index 686d6c2..91cf33d 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_testing.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_testing.go
@@ -11,7 +11,9 @@ import (
         "runtime"
         "sort"
         "strings"
-        "testing"
+        "time"
+
+        "github.com/mitchellh/go-testing-interface"
 )
 
 // TestDecompressCase is a single test case for testing decompressors
@@ -21,10 +23,11 @@ type TestDecompressCase struct {
         Err     bool     // Err is whether we expect an error or not
         DirList []string // DirList is the list of files for Dir mode
         FileMD5 string   // FileMD5 is the expected MD5 for a single file
+        Mtime *time.Time // Mtime is the optionally expected mtime for a single file (or all files if in Dir mode)
 }
 
 // TestDecompressor is a helper function for testing generic decompressors.
-func TestDecompressor(t *testing.T, d Decompressor, cases []TestDecompressCase) {
+func TestDecompressor(t testing.T, d Decompressor, cases []TestDecompressCase) {
         for _, tc := range cases {
                 t.Logf("Testing: %s", tc.Input)
 
@@ -67,6 +70,14 @@ func TestDecompressor(t *testing.T, d Decompressor, cases []TestDecompressCase)
                                         }
                                 }
 
+                                if tc.Mtime != nil {
+                                        actual := fi.ModTime()
+                                        expected := *tc.Mtime
+                                        if actual != expected {
+                                                t.Fatalf("err %s: expected mtime '%s' for %s, got '%s'", tc.Input, expected.String(), dst, actual.String())
+                                        }
+                                }
+
                                 return
                         }
 
@@ -83,11 +94,26 @@ func TestDecompressor(t *testing.T, d Decompressor, cases []TestDecompressCase)
                         if !reflect.DeepEqual(actual, expected) {
                                 t.Fatalf("bad %s\n\n%#v\n\n%#v", tc.Input, actual, expected)
                         }
+                        // Check for correct atime/mtime
+                        for _, dir := range actual {
+                                path := filepath.Join(dst, dir)
+                                if tc.Mtime != nil {
+                                        fi, err := os.Stat(path)
+                                        if err != nil {
+                                                t.Fatalf("err: %s", err)
+                                        }
+                                        actual := fi.ModTime()
+                                        expected := *tc.Mtime
+                                        if actual != expected {
+                                                t.Fatalf("err %s: expected mtime '%s' for %s, got '%s'", tc.Input, expected.String(), path, actual.String())
+                                        }
+                                }
+                        }
                 }()
         }
 }
 
-func testListDir(t *testing.T, path string) []string {
+func testListDir(t testing.T, path string) []string {
         var result []string
         err := filepath.Walk(path, func(sub string, info os.FileInfo, err error) error {
                 if err != nil {
@@ -102,7 +128,7 @@ func testListDir(t *testing.T, path string) []string {
 
                 // If it is a dir, add trailing sep
                 if info.IsDir() {
-                        sub += "/"
+                        sub += string(os.PathSeparator)
                 }
 
                 result = append(result, sub)
@@ -116,7 +142,7 @@ func testListDir(t *testing.T, path string) []string {
         return result
 }
 
-func testMD5(t *testing.T, path string) string {
+func testMD5(t testing.T, path string) string {
         f, err := os.Open(path)
         if err != nil {
                 t.Fatalf("err: %s", err)
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_tgz.go b/vendor/github.com/hashicorp/go-getter/decompress_tgz.go
index e8b1c31..65eb70d 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_tgz.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_tgz.go
@@ -1,10 +1,8 @@
 package getter
 
 import (
-        "archive/tar"
         "compress/gzip"
         "fmt"
-        "io"
         "os"
         "path/filepath"
 )
@@ -37,63 +35,5 @@ func (d *TarGzipDecompressor) Decompress(dst, src string, dir bool) error {
         }
         defer gzipR.Close()
 
-        // Once gzip decompressed we have a tar format
-        tarR := tar.NewReader(gzipR)
-        done := false
-        for {
-                hdr, err := tarR.Next()
-                if err == io.EOF {
-                        if !done {
-                                // Empty archive
-                                return fmt.Errorf("empty archive: %s", src)
-                        }
-
-                        return nil
-                }
-                if err != nil {
-                        return err
-                }
-
-                path := dst
-                if dir {
-                        path = filepath.Join(path, hdr.Name)
-                }
-
-                if hdr.FileInfo().IsDir() {
-                        if !dir {
-                                return fmt.Errorf("expected a single file: %s", src)
-                        }
-
-                        // A directory, just make the directory and continue unarchiving...
-                        if err := os.MkdirAll(path, 0755); err != nil {
-                                return err
-                        }
-
-                        continue
-                }
-
-                // We have a file. If we already decoded, then it is an error
-                if !dir && done {
-                        return fmt.Errorf("expected a single file, got multiple: %s", src)
-                }
-
-                // Mark that we're done so future in single file mode errors
-                done = true
-
-                // Open the file for writing
-                dstF, err := os.Create(path)
-                if err != nil {
-                        return err
-                }
-                _, err = io.Copy(dstF, tarR)
-                dstF.Close()
-                if err != nil {
-                        return err
-                }
-
-                // Chmod the file
-                if err := os.Chmod(path, hdr.FileInfo().Mode()); err != nil {
-                        return err
-                }
-        }
+        return untar(gzipR, dst, src, dir)
 }
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_txz.go b/vendor/github.com/hashicorp/go-getter/decompress_txz.go
new file mode 100644
index 0000000..5e151c1
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/decompress_txz.go
@@ -0,0 +1,39 @@
+package getter
+
+import (
+        "fmt"
+        "os"
+        "path/filepath"
+
+        "github.com/ulikunitz/xz"
+)
+
+// TarXzDecompressor is an implementation of Decompressor that can
+// decompress tar.xz files.
+type TarXzDecompressor struct{}
+
+func (d *TarXzDecompressor) Decompress(dst, src string, dir bool) error {
+        // If we're going into a directory we should make that first
+        mkdir := dst
+        if !dir {
+                mkdir = filepath.Dir(dst)
+        }
+        if err := os.MkdirAll(mkdir, 0755); err != nil {
+                return err
+        }
+
+        // File first
+        f, err := os.Open(src)
+        if err != nil {
+                return err
+        }
+        defer f.Close()
+
+        // xz compression is second
+        txzR, err := xz.NewReader(f)
+        if err != nil {
+                return fmt.Errorf("Error opening an xz reader for %s: %s", src, err)
+        }
+
+        return untar(txzR, dst, src, dir)
+}
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_xz.go b/vendor/github.com/hashicorp/go-getter/decompress_xz.go
new file mode 100644
index 0000000..4e37aba
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/decompress_xz.go
@@ -0,0 +1,49 @@
+package getter
+
+import (
+        "fmt"
+        "io"
+        "os"
+        "path/filepath"
+
+        "github.com/ulikunitz/xz"
+)
+
+// XzDecompressor is an implementation of Decompressor that can
+// decompress xz files.
+type XzDecompressor struct{}
+
+func (d *XzDecompressor) Decompress(dst, src string, dir bool) error {
+        // Directory isn't supported at all
+        if dir {
+                return fmt.Errorf("xz-compressed files can only unarchive to a single file")
+        }
+
+        // If we're going into a directory we should make that first
+        if err := os.MkdirAll(filepath.Dir(dst), 0755); err != nil {
+                return err
+        }
+
+        // File first
+        f, err := os.Open(src)
+        if err != nil {
+                return err
+        }
+        defer f.Close()
+
+        // xz compression is second
+        xzR, err := xz.NewReader(f)
+        if err != nil {
+                return err
+        }
+
+        // Copy it out
+        dstF, err := os.Create(dst)
+        if err != nil {
+                return err
+        }
+        defer dstF.Close()
+
+        _, err = io.Copy(dstF, xzR)
+        return err
+}
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_zip.go b/vendor/github.com/hashicorp/go-getter/decompress_zip.go
index a065c07..b0e70ca 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_zip.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_zip.go
@@ -42,6 +42,11 @@ func (d *ZipDecompressor) Decompress(dst, src string, dir bool) error {
         for _, f := range zipR.File {
                 path := dst
                 if dir {
+                        // Disallow parent traversal
+                        if containsDotDot(f.Name) {
+                                return fmt.Errorf("entry contains '..': %s", f.Name)
+                        }
+
                         path = filepath.Join(path, f.Name)
                 }
 
diff --git a/vendor/github.com/hashicorp/go-getter/detect.go b/vendor/github.com/hashicorp/go-getter/detect.go
index 481b737..c369551 100644
--- a/vendor/github.com/hashicorp/go-getter/detect.go
+++ b/vendor/github.com/hashicorp/go-getter/detect.go
@@ -72,12 +72,18 @@ func Detect(src string, pwd string, ds []Detector) (string, error) {
                                 subDir = detectSubdir
                         }
                 }
+
                 if subDir != "" {
                         u, err := url.Parse(result)
                         if err != nil {
                                 return "", fmt.Errorf("Error parsing URL: %s", err)
                         }
                         u.Path += "//" + subDir
+
+                        // a subdir may contain wildcards, but in order to support them we
+                        // have to ensure the path isn't escaped.
+                        u.RawPath = u.Path
+
                         result = u.String()
                 }
 
diff --git a/vendor/github.com/hashicorp/go-getter/detect_file.go b/vendor/github.com/hashicorp/go-getter/detect_file.go
index 756ea43..4ef41ea 100644
--- a/vendor/github.com/hashicorp/go-getter/detect_file.go
+++ b/vendor/github.com/hashicorp/go-getter/detect_file.go
@@ -32,7 +32,7 @@ func (d *FileDetector) Detect(src, pwd string) (string, bool, error) {
                                 return "", true, err
                         }
                         if fi.Mode()&os.ModeSymlink != 0 {
-                                pwd, err = os.Readlink(pwd)
+                                pwd, err = filepath.EvalSymlinks(pwd)
                                 if err != nil {
                                         return "", true, err
                                 }
diff --git a/vendor/github.com/hashicorp/go-getter/get.go b/vendor/github.com/hashicorp/go-getter/get.go
index c3236f5..e6053d9 100644
--- a/vendor/github.com/hashicorp/go-getter/get.go
+++ b/vendor/github.com/hashicorp/go-getter/get.go
@@ -18,6 +18,8 @@ import (
         "os/exec"
         "regexp"
         "syscall"
+
+        cleanhttp "github.com/hashicorp/go-cleanhttp"
 )
 
 // Getter defines the interface that schemes must implement to download
@@ -49,8 +51,13 @@ var Getters map[string]Getter
 // syntax is schema::url, example: git::https://foo.com
 var forcedRegexp = regexp.MustCompile(`^([A-Za-z0-9]+)::(.+)$`)
 
+// httpClient is the default client to be used by HttpGetters.
+var httpClient = cleanhttp.DefaultClient()
+
 func init() {
-        httpGetter := &HttpGetter{Netrc: true}
+        httpGetter := &HttpGetter{
+                Netrc: true,
+        }
 
         Getters = map[string]Getter{
                 "file":  new(FileGetter),
diff --git a/vendor/github.com/hashicorp/go-getter/get_git.go b/vendor/github.com/hashicorp/go-getter/get_git.go
index 0728139..cb1d029 100644
--- a/vendor/github.com/hashicorp/go-getter/get_git.go
+++ b/vendor/github.com/hashicorp/go-getter/get_git.go
@@ -11,6 +11,7 @@ import (
         "strings"
 
         urlhelper "github.com/hashicorp/go-getter/helper/url"
+        "github.com/hashicorp/go-safetemp"
         "github.com/hashicorp/go-version"
 )
 
@@ -105,13 +106,11 @@ func (g *GitGetter) Get(dst string, u *url.URL) error {
 // GetFile for Git doesn't support updating at this time. It will download
 // the file every time.
 func (g *GitGetter) GetFile(dst string, u *url.URL) error {
-        td, err := ioutil.TempDir("", "getter-git")
+        td, tdcloser, err := safetemp.Dir("", "getter")
         if err != nil {
                 return err
         }
-        if err := os.RemoveAll(td); err != nil {
-                return err
-        }
+        defer tdcloser.Close()
 
         // Get the filename, and strip the filename from the URL so we can
         // just get the repository directly.
@@ -180,17 +179,34 @@ func (g *GitGetter) fetchSubmodules(dst, sshKeyFile string) error {
 // setupGitEnv sets up the environment for the given command. This is used to
 // pass configuration data to git and ssh and enables advanced cloning methods.
 func setupGitEnv(cmd *exec.Cmd, sshKeyFile string) {
-        var sshOpts []string
+        const gitSSHCommand = "GIT_SSH_COMMAND="
+        var sshCmd []string
+
+        // If we have an existing GIT_SSH_COMMAND, we need to append our options.
+        // We will also remove our old entry to make sure the behavior is the same
+        // with versions of Go < 1.9.
+        env := os.Environ()
+        for i, v := range env {
+                if strings.HasPrefix(v, gitSSHCommand) {
+                        sshCmd = []string{v}
+
+                        env[i], env[len(env)-1] = env[len(env)-1], env[i]
+                        env = env[:len(env)-1]
+                        break
+                }
+        }
+
+        if len(sshCmd) == 0 {
+                sshCmd = []string{gitSSHCommand + "ssh"}
+        }
 
         if sshKeyFile != "" {
                 // We have an SSH key temp file configured, tell ssh about this.
-                sshOpts = append(sshOpts, "-i", sshKeyFile)
+                sshCmd = append(sshCmd, "-i", sshKeyFile)
         }
 
-        cmd.Env = append(os.Environ(),
-                // Set the ssh command to use for clones.
-                "GIT_SSH_COMMAND=ssh "+strings.Join(sshOpts, " "),
-        )
+        env = append(env, strings.Join(sshCmd, " "))
+        cmd.Env = env
 }
 
 // checkGitVersion is used to check the version of git installed on the system
diff --git a/vendor/github.com/hashicorp/go-getter/get_hg.go b/vendor/github.com/hashicorp/go-getter/get_hg.go
index 820bdd4..f386922 100644
--- a/vendor/github.com/hashicorp/go-getter/get_hg.go
+++ b/vendor/github.com/hashicorp/go-getter/get_hg.go
@@ -2,7 +2,6 @@ package getter
 
 import (
         "fmt"
-        "io/ioutil"
         "net/url"
         "os"
         "os/exec"
@@ -10,6 +9,7 @@ import (
         "runtime"
 
         urlhelper "github.com/hashicorp/go-getter/helper/url"
+        "github.com/hashicorp/go-safetemp"
 )
 
 // HgGetter is a Getter implementation that will download a module from
@@ -64,13 +64,13 @@ func (g *HgGetter) Get(dst string, u *url.URL) error {
 // GetFile for Hg doesn't support updating at this time. It will download
 // the file every time.
 func (g *HgGetter) GetFile(dst string, u *url.URL) error {
-        td, err := ioutil.TempDir("", "getter-hg")
+        // Create a temporary directory to store the full source. This has to be
+        // a non-existent directory.
+        td, tdcloser, err := safetemp.Dir("", "getter")
         if err != nil {
                 return err
         }
-        if err := os.RemoveAll(td); err != nil {
-                return err
-        }
+        defer tdcloser.Close()
 
         // Get the filename, and strip the filename from the URL so we can
         // just get the repository directly.
diff --git a/vendor/github.com/hashicorp/go-getter/get_http.go b/vendor/github.com/hashicorp/go-getter/get_http.go
index 3c02034..d2e2879 100644
--- a/vendor/github.com/hashicorp/go-getter/get_http.go
+++ b/vendor/github.com/hashicorp/go-getter/get_http.go
@@ -4,12 +4,13 @@ import (
         "encoding/xml"
         "fmt"
         "io"
-        "io/ioutil"
         "net/http"
         "net/url"
         "os"
         "path/filepath"
         "strings"
+
+        "github.com/hashicorp/go-safetemp"
 )
 
 // HttpGetter is a Getter implementation that will download from an HTTP
@@ -36,6 +37,10 @@ type HttpGetter struct {
         // Netrc, if true, will lookup and use auth information found
         // in the user's netrc file if available.
         Netrc bool
+
+        // Client is the http.Client to use for Get requests.
+        // This defaults to a cleanhttp.DefaultClient if left unset.
+        Client *http.Client
 }
 
 func (g *HttpGetter) ClientMode(u *url.URL) (ClientMode, error) {
@@ -57,13 +62,17 @@ func (g *HttpGetter) Get(dst string, u *url.URL) error {
                 }
         }
 
+        if g.Client == nil {
+                g.Client = httpClient
+        }
+
         // Add terraform-get to the parameter.
         q := u.Query()
         q.Add("terraform-get", "1")
         u.RawQuery = q.Encode()
 
         // Get the URL
-        resp, err := http.Get(u.String())
+        resp, err := g.Client.Get(u.String())
         if err != nil {
                 return err
         }
@@ -98,7 +107,18 @@ func (g *HttpGetter) Get(dst string, u *url.URL) error {
 }
 
 func (g *HttpGetter) GetFile(dst string, u *url.URL) error {
-        resp, err := http.Get(u.String())
+        if g.Netrc {
+                // Add auth from netrc if we can
+                if err := addAuthFromNetrc(u); err != nil {
+                        return err
+                }
+        }
+
+        if g.Client == nil {
+                g.Client = httpClient
+        }
+
+        resp, err := g.Client.Get(u.String())
         if err != nil {
                 return err
         }
@@ -116,29 +136,40 @@ func (g *HttpGetter) GetFile(dst string, u *url.URL) error {
         if err != nil {
                 return err
         }
-        defer f.Close()
 
-        _, err = io.Copy(f, resp.Body)
+        n, err := io.Copy(f, resp.Body)
+        if err == nil && n < resp.ContentLength {
+                err = io.ErrShortWrite
+        }
+        if err1 := f.Close(); err == nil {
+                err = err1
+        }
         return err
 }
 
 // getSubdir downloads the source into the destination, but with
 // the proper subdir.
 func (g *HttpGetter) getSubdir(dst, source, subDir string) error {
-        // Create a temporary directory to store the full source
-        td, err := ioutil.TempDir("", "tf")
+        // Create a temporary directory to store the full source. This has to be
+        // a non-existent directory.
+        td, tdcloser, err := safetemp.Dir("", "getter")
         if err != nil {
                 return err
         }
-        defer os.RemoveAll(td)
+        defer tdcloser.Close()
 
         // Download that into the given directory
         if err := Get(td, source); err != nil {
                 return err
         }
 
+        // Process any globbing
+        sourcePath, err := SubdirGlob(td, subDir)
+        if err != nil {
+                return err
+        }
+
         // Make sure the subdir path actually exists
-        sourcePath := filepath.Join(td, subDir)
         if _, err := os.Stat(sourcePath); err != nil {
                 return fmt.Errorf(
                         "Error downloading %s: %s", source, err)
diff --git a/vendor/github.com/hashicorp/go-getter/get_s3.go b/vendor/github.com/hashicorp/go-getter/get_s3.go
index d3bffeb..ebb3217 100644
--- a/vendor/github.com/hashicorp/go-getter/get_s3.go
+++ b/vendor/github.com/hashicorp/go-getter/get_s3.go
@@ -28,7 +28,7 @@ func (g *S3Getter) ClientMode(u *url.URL) (ClientMode, error) {
         }
 
         // Create client config
-        config := g.getAWSConfig(region, creds)
+        config := g.getAWSConfig(region, u, creds)
         sess := session.New(config)
         client := s3.New(sess)
 
@@ -84,7 +84,7 @@ func (g *S3Getter) Get(dst string, u *url.URL) error {
                 return err
         }
 
-        config := g.getAWSConfig(region, creds)
+        config := g.getAWSConfig(region, u, creds)
         sess := session.New(config)
         client := s3.New(sess)
 
@@ -139,7 +139,7 @@ func (g *S3Getter) GetFile(dst string, u *url.URL) error {
                 return err
         }
 
-        config := g.getAWSConfig(region, creds)
+        config := g.getAWSConfig(region, u, creds)
         sess := session.New(config)
         client := s3.New(sess)
         return g.getObject(client, dst, bucket, path, version)
@@ -174,7 +174,7 @@ func (g *S3Getter) getObject(client *s3.S3, dst, bucket, key, version string) er
         return err
 }
 
-func (g *S3Getter) getAWSConfig(region string, creds *credentials.Credentials) *aws.Config {
+func (g *S3Getter) getAWSConfig(region string, url *url.URL, creds *credentials.Credentials) *aws.Config {
         conf := &aws.Config{}
         if creds == nil {
                 // Grab the metadata URL
@@ -195,6 +195,14 @@ func (g *S3Getter) getAWSConfig(region string, creds *credentials.Credentials) *
                         })
         }
 
+        if creds != nil {
+                conf.Endpoint = &url.Host
+                conf.S3ForcePathStyle = aws.Bool(true)
+                if url.Scheme == "http" {
+                        conf.DisableSSL = aws.Bool(true)
+                }
+        }
+
         conf.Credentials = creds
         if region != "" {
                 conf.Region = aws.String(region)
@@ -204,29 +212,48 @@ func (g *S3Getter) getAWSConfig(region string, creds *credentials.Credentials) *
 }
 
 func (g *S3Getter) parseUrl(u *url.URL) (region, bucket, path, version string, creds *credentials.Credentials, err error) {
-        // Expected host style: s3.amazonaws.com. They always have 3 parts,
-        // although the first may differ if we're accessing a specific region.
-        hostParts := strings.Split(u.Host, ".")
-        if len(hostParts) != 3 {
-                err = fmt.Errorf("URL is not a valid S3 URL")
-                return
-        }
+        // This just check whether we are dealing with S3 or
+        // any other S3 compliant service. S3 has a predictable
+        // url as others do not
+        if strings.Contains(u.Host, "amazonaws.com") {
+                // Expected host style: s3.amazonaws.com. They always have 3 parts,
+                // although the first may differ if we're accessing a specific region.
+                hostParts := strings.Split(u.Host, ".")
+                if len(hostParts) != 3 {
+                        err = fmt.Errorf("URL is not a valid S3 URL")
+                        return
+                }
 
-        // Parse the region out of the first part of the host
-        region = strings.TrimPrefix(strings.TrimPrefix(hostParts[0], "s3-"), "s3")
-        if region == "" {
-                region = "us-east-1"
-        }
+                // Parse the region out of the first part of the host
+                region = strings.TrimPrefix(strings.TrimPrefix(hostParts[0], "s3-"), "s3")
+                if region == "" {
+                        region = "us-east-1"
+                }
 
-        pathParts := strings.SplitN(u.Path, "/", 3)
-        if len(pathParts) != 3 {
-                err = fmt.Errorf("URL is not a valid S3 URL")
-                return
-        }
+                pathParts := strings.SplitN(u.Path, "/", 3)
+                if len(pathParts) != 3 {
+                        err = fmt.Errorf("URL is not a valid S3 URL")
+                        return
+                }
+
+                bucket = pathParts[1]
+                path = pathParts[2]
+                version = u.Query().Get("version")
 
-        bucket = pathParts[1]
-        path = pathParts[2]
-        version = u.Query().Get("version")
+        } else {
+                pathParts := strings.SplitN(u.Path, "/", 3)
+                if len(pathParts) != 3 {
+                        err = fmt.Errorf("URL is not a valid S3 complaint URL")
+                        return
+                }
+                bucket = pathParts[1]
+                path = pathParts[2]
+                version = u.Query().Get("version")
+                region = u.Query().Get("region")
+                if region == "" {
+                        region = "us-east-1"
+                }
+        }
 
         _, hasAwsId := u.Query()["aws_access_key_id"]
         _, hasAwsSecret := u.Query()["aws_access_key_secret"]
diff --git a/vendor/github.com/hashicorp/go-getter/source.go b/vendor/github.com/hashicorp/go-getter/source.go
index 4d5ee3c..c63f2bb 100644
--- a/vendor/github.com/hashicorp/go-getter/source.go
+++ b/vendor/github.com/hashicorp/go-getter/source.go
@@ -1,6 +1,8 @@
 package getter
 
 import (
+        "fmt"
+        "path/filepath"
         "strings"
 )
 
@@ -34,3 +36,27 @@ func SourceDirSubdir(src string) (string, string) {
 
         return src, subdir
 }
+
+// SubdirGlob returns the actual subdir with globbing processed.
+//
+// dst should be a destination directory that is already populated (the
+// download is complete) and subDir should be the set subDir. If subDir
+// is an empty string, this returns an empty string.
+//
+// The returned path is the full absolute path.
+func SubdirGlob(dst, subDir string) (string, error) {
+        matches, err := filepath.Glob(filepath.Join(dst, subDir))
+        if err != nil {
+                return "", err
+        }
+
+        if len(matches) == 0 {
+                return "", fmt.Errorf("subdir %q not found", subDir)
+        }
+
+        if len(matches) > 1 {
+                return "", fmt.Errorf("subdir %q matches multiple paths", subDir)
+        }
+
+        return matches[0], nil
+}