Bump github.com/hashicorp/terraform-plugin-sdk/v2 from 2.26.1 to 2.27.0

Bumps [github.com/hashicorp/terraform-plugin-sdk/v2](https://github.com/hashicorp/terraform-plugin-sdk) from 2.26.1 to 2.27.0.
- [Release notes](https://github.com/hashicorp/terraform-plugin-sdk/releases)
- [Changelog](https://github.com/hashicorp/terraform-plugin-sdk/blob/main/CHANGELOG.md)
- [Commits](https://github.com/hashicorp/terraform-plugin-sdk/compare/v2.26.1...v2.27.0)

---
updated-dependencies:
- dependency-name: github.com/hashicorp/terraform-plugin-sdk/v2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

vendor/github.com/hashicorp/go-hclog/LICENSE

@@ -1,6 +1,4 @@
-MIT License
-
-Copyright (c) 2017 HashiCorp
+Copyright (c) 2017 HashiCorp, Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

vendor/github.com/hashicorp/go-hclog/colorize_unix.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 //go:build !windows
 // +build !windows
 
@@ -7,23 +10,35 @@ import (
 	"github.com/mattn/go-isatty"
 )
 
+// hasFD is used to check if the writer has an Fd value to check
+// if it's a terminal.
+type hasFD interface {
+	Fd() uintptr
+}
+
 // setColorization will mutate the values of this logger
 // to appropriately configure colorization options. It provides
 // a wrapper to the output stream on Windows systems.
 func (l *intLogger) setColorization(opts *LoggerOptions) {
-	switch opts.Color {
-	case ColorOff:
-		fallthrough
-	case ForceColor:
+	if opts.Color != AutoColor {
 		return
-	case AutoColor:
-		fi := l.checkWriterIsFile()
-		isUnixTerm := isatty.IsTerminal(fi.Fd())
-		isCygwinTerm := isatty.IsCygwinTerminal(fi.Fd())
-		isTerm := isUnixTerm || isCygwinTerm
-		if !isTerm {
+	}
+
+	if sc, ok := l.writer.w.(SupportsColor); ok {
+		if !sc.SupportsColor() {
 			l.headerColor = ColorOff
 			l.writer.color = ColorOff
 		}
+		return
+	}
+
+	fi, ok := l.writer.w.(hasFD)
+	if !ok {
+		return
+	}
+
+	if !isatty.IsTerminal(fi.Fd()) {
+		l.headerColor = ColorOff
+		l.writer.color = ColorOff
 	}
 }

vendor/github.com/hashicorp/go-hclog/colorize_windows.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 //go:build windows
 // +build windows
 
@@ -7,32 +10,32 @@ import (
 	"os"
 
 	colorable "github.com/mattn/go-colorable"
-	"github.com/mattn/go-isatty"
 )
 
 // setColorization will mutate the values of this logger
 // to appropriately configure colorization options. It provides
 // a wrapper to the output stream on Windows systems.
 func (l *intLogger) setColorization(opts *LoggerOptions) {
-	switch opts.Color {
-	case ColorOff:
+	if opts.Color == ColorOff {
 		return
-	case ForceColor:
-		fi := l.checkWriterIsFile()
-		l.writer.w = colorable.NewColorable(fi)
-	case AutoColor:
-		fi := l.checkWriterIsFile()
-		isUnixTerm := isatty.IsTerminal(os.Stdout.Fd())
-		isCygwinTerm := isatty.IsCygwinTerminal(os.Stdout.Fd())
-		isTerm := isUnixTerm || isCygwinTerm
-		if !isTerm {
-			l.writer.color = ColorOff
-			l.headerColor = ColorOff
-			return
-		}
+	}
 
-		if l.headerColor == ColorOff {
-			l.writer.w = colorable.NewColorable(fi)
-		}
+	fi, ok := l.writer.w.(*os.File)
+	if !ok {
+		l.writer.color = ColorOff
+		l.headerColor = ColorOff
+		return
+	}
+
+	cfi := colorable.NewColorable(fi)
+
+	// NewColorable detects if color is possible and if it's not, then it
+	// returns the original value. So we can test if we got the original
+	// value back to know if color is possible.
+	if cfi == fi {
+		l.writer.color = ColorOff
+		l.headerColor = ColorOff
+	} else {
+		l.writer.w = cfi
 	}
 }

vendor/github.com/hashicorp/go-hclog/context.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 package hclog
 
 import (

vendor/github.com/hashicorp/go-hclog/exclude.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 package hclog
 
 import (

vendor/github.com/hashicorp/go-hclog/global.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 package hclog
 
 import (

vendor/github.com/hashicorp/go-hclog/interceptlogger.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 package hclog
 
 import (

vendor/github.com/hashicorp/go-hclog/intlogger.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 package hclog
 
 import (
@@ -8,7 +11,6 @@ import (
 	"fmt"
 	"io"
 	"log"
-	"os"
 	"reflect"
 	"runtime"
 	"sort"
@@ -86,6 +88,8 @@ type intLogger struct {
 
 	// create subloggers with their own level setting
 	independentLevels bool
+
+	subloggerHook func(sub Logger) Logger
 }
 
 // New returns a configured logger.
@@ -152,6 +156,7 @@ func newLogger(opts *LoggerOptions) *intLogger {
 		independentLevels: opts.IndependentLevels,
 		headerColor:       headerColor,
 		fieldColor:        fieldColor,
+		subloggerHook:     opts.SubloggerHook,
 	}
 	if opts.IncludeLocation {
 		l.callerOffset = offsetIntLogger + opts.AdditionalLocationOffset
@@ -167,6 +172,10 @@ func newLogger(opts *LoggerOptions) *intLogger {
 		l.timeFormat = opts.TimeFormat
 	}
 
+	if l.subloggerHook == nil {
+		l.subloggerHook = identityHook
+	}
+
 	l.setColorization(opts)
 
 	atomic.StoreInt32(l.level, int32(level))
@@ -174,6 +183,10 @@ func newLogger(opts *LoggerOptions) *intLogger {
 	return l
 }
 
+func identityHook(logger Logger) Logger {
+	return logger
+}
+
 // offsetIntLogger is the stack frame offset in the call stack for the caller to
 // one of the Warn, Info, Log, etc methods.
 const offsetIntLogger = 3
@@ -775,7 +788,7 @@ func (l *intLogger) With(args ...interface{}) Logger {
 		sl.implied = append(sl.implied, MissingKey, extra)
 	}
 
-	return sl
+	return l.subloggerHook(sl)
 }
 
 // Create a new sub-Logger that a name decending from the current name.
@@ -789,7 +802,7 @@ func (l *intLogger) Named(name string) Logger {
 		sl.name = name
 	}
 
-	return sl
+	return l.subloggerHook(sl)
 }
 
 // Create a new sub-Logger with an explicit name. This ignores the current
@@ -800,7 +813,7 @@ func (l *intLogger) ResetNamed(name string) Logger {
 
 	sl.name = name
 
-	return sl
+	return l.subloggerHook(sl)
 }
 
 func (l *intLogger) ResetOutput(opts *LoggerOptions) error {
@@ -876,16 +889,6 @@ func (l *intLogger) StandardWriter(opts *StandardLoggerOptions) io.Writer {
 	}
 }
 
-// checks if the underlying io.Writer is a file, and
-// panics if not. For use by colorization.
-func (l *intLogger) checkWriterIsFile() *os.File {
-	fi, ok := l.writer.w.(*os.File)
-	if !ok {
-		panic("Cannot enable coloring of non-file Writers")
-	}
-	return fi
-}
-
 // Accept implements the SinkAdapter interface
 func (i *intLogger) Accept(name string, level Level, msg string, args ...interface{}) {
 	i.log(name, level, msg, args...)

vendor/github.com/hashicorp/go-hclog/logger.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 package hclog
 
 import (
@@ -89,6 +92,13 @@ const (
 	ForceColor
 )
 
+// SupportsColor is an optional interface that can be implemented by the output
+// value. If implemented and SupportsColor() returns true, then AutoColor will
+// enable colorization.
+type SupportsColor interface {
+	SupportsColor() bool
+}
+
 // LevelFromString returns a Level type for the named log level, or "NoLevel" if
 // the level string is invalid. This facilitates setting the log level via
 // config or environment variable by name in a predictable way.
@@ -292,6 +302,13 @@ type LoggerOptions struct {
 	// logger will not affect any subloggers, and SetLevel on any subloggers
 	// will not affect the parent or sibling loggers.
 	IndependentLevels bool
+
+	// SubloggerHook registers a function that is called when a sublogger via
+	// Named, With, or ResetNamed is created. If defined, the function is passed
+	// the newly created Logger and the returned Logger is returned from the
+	// original function. This option allows customization via interception and
+	// wrapping of Logger instances.
+	SubloggerHook func(sub Logger) Logger
 }
 
 // InterceptLogger describes the interface for using a logger

vendor/github.com/hashicorp/go-hclog/nulllogger.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 package hclog
 
 import (

vendor/github.com/hashicorp/go-hclog/stdlog.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 package hclog
 
 import (

vendor/github.com/hashicorp/go-hclog/writer.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 package hclog
 
 import (

vendor/github.com/hashicorp/go-plugin/CHANGELOG.md

@@ -1,3 +1,19 @@
+## v1.4.10
+
+BUG FIXES:
+
+* additional notes: ensure to close files [GH-241](https://github.com/hashicorp/go-plugin/pull/241)]
+
+ENHANCEMENTS:
+
+* deps: Remove direct dependency on golang.org/x/net [GH-240](https://github.com/hashicorp/go-plugin/pull/240)]
+
+## v1.4.9
+
+ENHANCEMENTS:
+
+* client: Remove log warning introduced in 1.4.5 when SecureConfig is nil. [[GH-238](https://github.com/hashicorp/go-plugin/pull/238)]
+
 ## v1.4.8
 
 BUG FIXES:
@@ -33,5 +49,3 @@ BUG FIXES:
 
 * Bidirectional communication: fix bidirectional communication when AutoMTLS is enabled [[GH-193](https://github.com/hashicorp/go-plugin/pull/193)]
 * RPC: Trim a spurious log message for plugins using RPC [[GH-186](https://github.com/hashicorp/go-plugin/pull/186)]
-
-

vendor/github.com/hashicorp/go-plugin/README.md

@@ -4,8 +4,9 @@
 that has been in use by HashiCorp tooling for over 4 years. While initially
 created for [Packer](https://www.packer.io), it is additionally in use by
 [Terraform](https://www.terraform.io), [Nomad](https://www.nomadproject.io),
-[Vault](https://www.vaultproject.io), and
-[Boundary](https://www.boundaryproject.io).
+[Vault](https://www.vaultproject.io),
+[Boundary](https://www.boundaryproject.io),
+and [Waypoint](https://www.waypointproject.io).
 
 While the plugin system is over RPC, it is currently only designed to work
 over a local [reliable] network. Plugins over a real network are not supported

vendor/github.com/hashicorp/go-plugin/client.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
@@ -565,9 +568,7 @@ func (c *Client) Start() (addr net.Addr, err error) {
 		return nil, err
 	}
 
-	if c.config.SecureConfig == nil {
-		c.logger.Warn("plugin configured with a nil SecureConfig")
-	} else {
+	if c.config.SecureConfig != nil {
 		if ok, err := c.config.SecureConfig.Check(cmd.Path); err != nil {
 			return nil, fmt.Errorf("error verifying checksum: %s", err)
 		} else if !ok {

vendor/github.com/hashicorp/go-plugin/discover.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (

vendor/github.com/hashicorp/go-plugin/error.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 // This is a type that wraps error types so that they can be messaged

vendor/github.com/hashicorp/go-plugin/grpc_broker.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (

vendor/github.com/hashicorp/go-plugin/grpc_client.go

@@ -1,6 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
+	"context"
 	"crypto/tls"
 	"fmt"
 	"math"
@@ -8,7 +12,6 @@ import (
 	"time"
 
 	"github.com/hashicorp/go-plugin/internal/plugin"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/health/grpc_health_v1"

vendor/github.com/hashicorp/go-plugin/grpc_controller.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (

vendor/github.com/hashicorp/go-plugin/grpc_server.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (

vendor/github.com/hashicorp/go-plugin/grpc_stdio.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (

vendor/github.com/hashicorp/go-plugin/internal/plugin/gen.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate protoc -I ./ ./grpc_broker.proto ./grpc_controller.proto ./grpc_stdio.proto --go_out=plugins=grpc:.
 
 package plugin

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.pb.go

@@ -8,7 +8,7 @@ import fmt "fmt"
 import math "math"
 
 import (
-	context "golang.org/x/net/context"
+	context "context"
 	grpc "google.golang.org/grpc"
 )
 

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.proto

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 syntax = "proto3";
 package plugin;
 option go_package = "plugin";

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.pb.go

@@ -8,7 +8,7 @@ import fmt "fmt"
 import math "math"
 
 import (
-	context "golang.org/x/net/context"
+	context "context"
 	grpc "google.golang.org/grpc"
 )
 

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.proto

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 syntax = "proto3";
 package plugin;
 option go_package = "plugin";

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_stdio.pb.go

@@ -9,7 +9,7 @@ import math "math"
 import empty "github.com/golang/protobuf/ptypes/empty"
 
 import (
-	context "golang.org/x/net/context"
+	context "context"
 	grpc "google.golang.org/grpc"
 )
 

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_stdio.proto

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 syntax = "proto3";
 package plugin;
 option go_package = "plugin";

vendor/github.com/hashicorp/go-plugin/log_entry.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (

vendor/github.com/hashicorp/go-plugin/mtls.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (

vendor/github.com/hashicorp/go-plugin/mux_broker.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (

vendor/github.com/hashicorp/go-plugin/notes_unix.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build !windows
 // +build !windows
 
@@ -50,10 +53,13 @@ func additionalNotesAboutCommand(path string) string {
 	}
 
 	if elfFile, err := elf.Open(path); err == nil {
+		defer elfFile.Close()
 		notes += fmt.Sprintf("  ELF architecture: %s (current architecture: %s)\n", elfFile.Machine, runtime.GOARCH)
 	} else if machoFile, err := macho.Open(path); err == nil {
+		defer machoFile.Close()
 		notes += fmt.Sprintf("  MachO architecture: %s (current architecture: %s)\n", machoFile.Cpu, runtime.GOARCH)
 	} else if peFile, err := pe.Open(path); err == nil {
+		defer peFile.Close()
 		machine, ok := peTypes[peFile.Machine]
 		if !ok {
 			machine = "unknown"

vendor/github.com/hashicorp/go-plugin/notes_windows.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build windows
 // +build windows
 
@@ -26,10 +29,13 @@ func additionalNotesAboutCommand(path string) string {
 	notes += fmt.Sprintf("  Mode: %s\n", stat.Mode())
 
 	if elfFile, err := elf.Open(path); err == nil {
+		defer elfFile.Close()
 		notes += fmt.Sprintf("  ELF architecture: %s (current architecture: %s)\n", elfFile.Machine, runtime.GOARCH)
 	} else if machoFile, err := macho.Open(path); err == nil {
+		defer machoFile.Close()
 		notes += fmt.Sprintf("  MachO architecture: %s (current architecture: %s)\n", machoFile.Cpu, runtime.GOARCH)
 	} else if peFile, err := pe.Open(path); err == nil {
+		defer peFile.Close()
 		machine, ok := peTypes[peFile.Machine]
 		if !ok {
 			machine = "unknown"

vendor/github.com/hashicorp/go-plugin/plugin.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // The plugin package exposes functions and helpers for communicating to
 // plugins which are implemented as standalone binary applications.
 //

vendor/github.com/hashicorp/go-plugin/process.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (

vendor/github.com/hashicorp/go-plugin/process_posix.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build !windows
 // +build !windows
 

vendor/github.com/hashicorp/go-plugin/process_windows.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (

vendor/github.com/hashicorp/go-plugin/protocol.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (

vendor/github.com/hashicorp/go-plugin/rpc_client.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (

vendor/github.com/hashicorp/go-plugin/rpc_server.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (

vendor/github.com/hashicorp/go-plugin/server.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (

vendor/github.com/hashicorp/go-plugin/server_mux.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (

vendor/github.com/hashicorp/go-plugin/stream.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (

vendor/github.com/hashicorp/go-plugin/testing.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (

vendor/github.com/hashicorp/hc-install/.copywrite.hcl

@@ -0,0 +1,7 @@
+schema_version = 1
+
+project {
+  license        = "MPL-2.0"
+  copyright_year = 2020
+  header_ignore  = []
+}

vendor/github.com/hashicorp/hc-install/.go-version

@@ -1 +1 @@
-1.19.5
+1.20

vendor/github.com/hashicorp/hc-install/README.md

@@ -44,13 +44,13 @@ Each comes with different trade-offs described below.
    - **Cons:**
      - Installation may consume some bandwith, disk space and a little time
      - Potentially less stable builds (see `checkpoint` below)
- - `checkpoint.{LatestVersion}` - Downloads, verifies & installs any known product available in HashiCorp Checkpoint
+ - `checkpoint.LatestVersion` - Downloads, verifies & installs any known product available in HashiCorp Checkpoint
    - **Pros:**
      - Checkpoint typically contains only product versions considered stable
    - **Cons:**
      - Installation may consume some bandwith, disk space and a little time
      - Currently doesn't allow installation of a old versions (see `releases` above)
- - `build.{GitRevision}` - Clones raw source code and builds the product from it
+ - `build.GitRevision` - Clones raw source code and builds the product from it
    - **Pros:**
      - Useful for catching bugs and incompatibilities as early as possible (prior to product release).
    - **Cons:**
@@ -61,73 +61,59 @@ Each comes with different trade-offs described below.
 
 ## Example Usage
 
-### Install single version
+See examples at https://pkg.go.dev/github.com/hashicorp/hc-install#example-Installer.
 
-```go
-TODO
+## CLI
+
+In addition to the Go library, which is the intended primary use case of `hc-install`, we also distribute CLI.
+
+The CLI comes with some trade-offs:
+
+ - more limited interface compared to the flexible Go API (installs specific versions of products via `releases.ExactVersion`)
+ - minimal environment pre-requisites (no need to compile Go code)
+ - see ["hc-install is not a package manager"](https://github.com/hashicorp/hc-install#hc-install-is-not-a-package-manager)
+
+### Installation
+
+Given that one of the key roles of the CLI/library is integrity checking, you should choose the installation method which involves the same level of integrity checks, and/or perform these checks yourself. `go install` provides only minimal to no integrity checks, depending on exact use. We recommend any of the installation methods documented below.
+
+#### Homebrew (macOS / Linux)
+
+[Homebrew](https://brew.sh)
+
+```
+brew install hashicorp/tap/hc-install
 ```
 
-### Find or install single version
+#### Linux
 
-```go
-i := NewInstaller()
+We support Debian & Ubuntu via apt and RHEL, CentOS, Fedora and Amazon Linux via RPM.
 
-v0_14_0 := version.Must(version.NewVersion("0.14.0"))
+You can follow the instructions in the [Official Packaging Guide](https://www.hashicorp.com/official-packaging-guide) to install the package from the official HashiCorp-maintained repositories. The package name is `hc-install` in all repositories.
 
-execPath, err := i.Ensure(context.Background(), []src.Source{
-  &fs.ExactVersion{
-    Product: product.Terraform,
-    Version: v0_14_0,
-  },
-  &releases.ExactVersion{
-    Product: product.Terraform,
-    Version: v0_14_0,
-  },
-})
-if err != nil {
-  // process err
-}
+#### Other platforms
 
-// run any tests
+1. [Download for the latest version](https://releases.hashicorp.com/hc-install/) relevant for your operating system and architecture.
+2. Verify integrity by comparing the SHA256 checksums which are part of the release (called `hc-install_<VERSION>_SHA256SUMS`).
+3. Install it by unzipping it and moving it to a directory included in your system's `PATH`.
+4. Check that you have installed it correctly via `hc-install --version`.
+  You should see the latest version printed to your terminal.
+
+### Usage
 
-defer i.Remove()
 ```
+Usage: hc-install install [options] -version <version> <product>
 
-### Install multiple versions
-
-```go
-TODO
+  This command installs a HashiCorp product.
+  Options:
+    -version  [REQUIRED] Version of product to install.
+    -path     Path to directory where the product will be installed. Defaults
+              to current working directory.
 ```
-
-### Install and build multiple versions
-
-```go
-i := NewInstaller()
-
-vc, _ := version.NewConstraint(">= 0.12")
-rv := &releases.Versions{
-  Product:     product.Terraform,
-  Constraints: vc,
-}
-
-versions, err := rv.List(context.Background())
-if err != nil {
-  return err
-}
-versions = append(versions, &build.GitRevision{Ref: "HEAD"})
-
-for _, installableVersion := range versions {
-  execPath, err := i.Ensure(context.Background(), []src.Source{
-    installableVersion,
-  })
-  if err != nil {
-    return err
-  }
-
-  // Do some testing here
-  _ = execPath
-
-  // clean up
-  os.Remove(execPath)
-}
+```sh
+hc-install install -version 1.3.7 terraform
+```
+```
+hc-install: will install terraform@1.3.7
+installed terraform@1.3.7 to /current/working/dir/terraform
 ```

vendor/github.com/hashicorp/hc-install/checkpoint/latest_version.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package checkpoint
 
 import (

vendor/github.com/hashicorp/hc-install/errors/errors.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package errors
 
 type skippableErr struct {

vendor/github.com/hashicorp/hc-install/fs/any_version.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fs
 
 import (

vendor/github.com/hashicorp/hc-install/fs/exact_version.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fs
 
 import (

vendor/github.com/hashicorp/hc-install/fs/fs.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fs
 
 import (

vendor/github.com/hashicorp/hc-install/fs/fs_unix.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build !windows
 // +build !windows
 

vendor/github.com/hashicorp/hc-install/fs/fs_windows.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fs
 
 import (

vendor/github.com/hashicorp/hc-install/fs/version.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fs
 
 import (

vendor/github.com/hashicorp/hc-install/installer.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package install
 
 import (

vendor/github.com/hashicorp/hc-install/internal/build/get_go_version.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package build
 
 import (

vendor/github.com/hashicorp/hc-install/internal/build/go_build.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package build
 
 import (

vendor/github.com/hashicorp/hc-install/internal/build/go_is_installed.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package build
 
 import (

vendor/github.com/hashicorp/hc-install/internal/build/install_go_version.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package build
 
 import (

vendor/github.com/hashicorp/hc-install/internal/httpclient/httpclient.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package httpclient
 
 import (

vendor/github.com/hashicorp/hc-install/internal/pubkey/pubkey.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pubkey
 
 const (

vendor/github.com/hashicorp/hc-install/internal/releasesjson/checksum_downloader.go

@@ -1,7 +1,9 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package releasesjson
 
 import (
-	"bytes"
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
@@ -12,8 +14,8 @@ import (
 	"net/url"
 	"strings"
 
+	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/hashicorp/hc-install/internal/httpclient"
-	"golang.org/x/crypto/openpgp"
 )
 
 type ChecksumDownloader struct {
@@ -133,43 +135,13 @@ func fileMapFromChecksums(checksums strings.Builder) (ChecksumFileMap, error) {
 	return csMap, nil
 }
 
-func compareChecksum(logger *log.Logger, r io.Reader, verifiedHashSum HashSum, filename string, expectedSize int64) error {
-	h := sha256.New()
-
-	// This may take a while depending on network connection as the io.Reader
-	// is expected to be http.Response.Body which streams the bytes
-	// on demand over the network.
-	logger.Printf("copying %q (%d bytes) to calculate checksum", filename, expectedSize)
-	bytesCopied, err := io.Copy(h, r)
-	if err != nil {
-		return err
-	}
-	logger.Printf("copied %d bytes of %q", bytesCopied, filename)
-
-	if expectedSize != 0 && bytesCopied != int64(expectedSize) {
-		return fmt.Errorf("unexpected size (downloaded: %d, expected: %d)",
-			bytesCopied, expectedSize)
-	}
-
-	calculatedSum := h.Sum(nil)
-	if !bytes.Equal(calculatedSum, verifiedHashSum) {
-		return fmt.Errorf("checksum mismatch (expected %q, calculated %q)",
-			verifiedHashSum,
-			hex.EncodeToString(calculatedSum))
-	}
-
-	logger.Printf("checksum matches: %q", hex.EncodeToString(calculatedSum))
-
-	return nil
-}
-
 func (cd *ChecksumDownloader) verifySumsSignature(checksums, signature io.Reader) error {
 	el, err := cd.keyEntityList()
 	if err != nil {
 		return err
 	}
 
-	_, err = openpgp.CheckDetachedSignature(el, checksums, signature)
+	_, err = openpgp.CheckDetachedSignature(el, checksums, signature, nil)
 	if err != nil {
 		return fmt.Errorf("unable to verify checksums signature: %w", err)
 	}

vendor/github.com/hashicorp/hc-install/internal/releasesjson/downloader.go

@@ -1,9 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package releasesjson
 
 import (
 	"archive/zip"
 	"bytes"
 	"context"
+	"crypto/sha256"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -92,8 +96,7 @@ func (d *Downloader) DownloadAndUnpack(ctx context.Context, pv *ProductVersion,
 
 	defer resp.Body.Close()
 
-	var pkgReader io.Reader
-	pkgReader = resp.Body
+	pkgReader := resp.Body
 
 	contentType := resp.Header.Get("content-type")
 	if !contentTypeIsZip(contentType) {
@@ -103,19 +106,6 @@ func (d *Downloader) DownloadAndUnpack(ctx context.Context, pv *ProductVersion,
 
 	expectedSize := resp.ContentLength
 
-	if d.VerifyChecksum {
-		d.Logger.Printf("verifying checksum of %q", pb.Filename)
-		// provide extra reader to calculate & compare checksum
-		var buf bytes.Buffer
-		r := io.TeeReader(resp.Body, &buf)
-		pkgReader = &buf
-
-		err := compareChecksum(d.Logger, r, verifiedChecksum, pb.Filename, expectedSize)
-		if err != nil {
-			return "", err
-		}
-	}
-
 	pkgFile, err := ioutil.TempFile("", pb.Filename)
 	if err != nil {
 		return "", err
@@ -124,19 +114,39 @@ func (d *Downloader) DownloadAndUnpack(ctx context.Context, pv *ProductVersion,
 	pkgFilePath, err := filepath.Abs(pkgFile.Name())
 
 	d.Logger.Printf("copying %q (%d bytes) to %s", pb.Filename, expectedSize, pkgFile.Name())
-	// Unless the bytes were already downloaded above for checksum verification
-	// this may take a while depending on network connection as the io.Reader
-	// is expected to be http.Response.Body which streams the bytes
-	// on demand over the network.
-	bytesCopied, err := io.Copy(pkgFile, pkgReader)
-	if err != nil {
-		return pkgFilePath, err
+
+	var bytesCopied int64
+	if d.VerifyChecksum {
+		d.Logger.Printf("verifying checksum of %q", pb.Filename)
+		h := sha256.New()
+		r := io.TeeReader(resp.Body, pkgFile)
+
+		bytesCopied, err = io.Copy(h, r)
+		if err != nil {
+			return "", err
+		}
+
+		calculatedSum := h.Sum(nil)
+		if !bytes.Equal(calculatedSum, verifiedChecksum) {
+			return pkgFilePath, fmt.Errorf(
+				"checksum mismatch (expected: %x, got: %x)",
+				verifiedChecksum, calculatedSum,
+			)
+		}
+	} else {
+		bytesCopied, err = io.Copy(pkgFile, pkgReader)
+		if err != nil {
+			return pkgFilePath, err
+		}
 	}
+
 	d.Logger.Printf("copied %d bytes to %s", bytesCopied, pkgFile.Name())
 
 	if expectedSize != 0 && bytesCopied != int64(expectedSize) {
-		return pkgFilePath, fmt.Errorf("unexpected size (downloaded: %d, expected: %d)",
-			bytesCopied, expectedSize)
+		return pkgFilePath, fmt.Errorf(
+			"unexpected size (downloaded: %d, expected: %d)",
+			bytesCopied, expectedSize,
+		)
 	}
 
 	r, err := zip.OpenReader(pkgFile.Name())

vendor/github.com/hashicorp/hc-install/internal/releasesjson/product_version.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package releasesjson
 
 import "github.com/hashicorp/go-version"

vendor/github.com/hashicorp/hc-install/internal/releasesjson/releases.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package releasesjson
 
 import (

vendor/github.com/hashicorp/hc-install/internal/src/src.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package src
 
 type InstallSrcSigil struct{}

vendor/github.com/hashicorp/hc-install/internal/validators/validators.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package validators
 
 import "regexp"

vendor/github.com/hashicorp/hc-install/product/consul.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package product
 
 import (

vendor/github.com/hashicorp/hc-install/product/product.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package product
 
 import (

vendor/github.com/hashicorp/hc-install/product/terraform.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package product
 
 import (

vendor/github.com/hashicorp/hc-install/product/vault.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package product
 
 import (

vendor/github.com/hashicorp/hc-install/releases/exact_version.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package releases
 
 import (

vendor/github.com/hashicorp/hc-install/releases/latest_version.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package releases
 
 import (

vendor/github.com/hashicorp/hc-install/releases/releases.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package releases
 
 import (

vendor/github.com/hashicorp/hc-install/releases/versions.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package releases
 
 import (

vendor/github.com/hashicorp/hc-install/src/src.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package src
 
 import (

vendor/github.com/hashicorp/hc-install/version/VERSION

@@ -1 +1 @@
-0.5.0
+0.5.2

vendor/github.com/hashicorp/hc-install/version/version.go

@@ -1,7 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package version
 
 import (
 	_ "embed"
+	"strings"
 
 	"github.com/hashicorp/go-version"
 )
@@ -9,6 +13,9 @@ import (
 //go:embed VERSION
 var rawVersion string
 
+// parsedVersion declared here ensures that invalid versions panic early, on import
+var parsedVersion = version.Must(version.NewVersion(strings.TrimSpace(rawVersion)))
+
 // Version returns the version of the library
 //
 // Note: This is only exposed as public function/package
@@ -16,5 +23,5 @@ var rawVersion string
 // In general downstream should not implement version-specific
 // logic and rely on this function to be present in future releases.
 func Version() *version.Version {
-	return version.Must(version.NewVersion(rawVersion))
+	return parsedVersion
 }

vendor/github.com/hashicorp/hcl/v2/CHANGELOG.md

@@ -1,5 +1,15 @@
 # HCL Changelog
 
+## v2.17.0 (May 31, 2023)
+
+### Enhancements
+
+* HCL now uses a newer version of the upstream `cty` library which has improved treatment of unknown values: it can now track additional optional information that reduces the range of an unknown value, which allows some operations against unknown values to return known or partially-known results. ([#590](https://github.com/hashicorp/hcl/pull/590))
+
+    **Note:** This change effectively passes on [`cty`'s notion of backward compatibility](https://github.com/zclconf/go-cty/blob/main/COMPATIBILITY.md) whereby unknown values can become "more known" in later releases. In particular, if your caller is using `cty.Value.RawEquals` in its tests against the results of operations with unknown values then you may see those tests begin failing after upgrading, due to the values now being more "refined".
+    
+    If so, you should review the refinements with consideration to [the `cty` refinements docs](https://github.com/zclconf/go-cty/blob/7dcbae46a6f247e983efb1fa774d2bb68781a333/docs/refinements.md) and update your expected results to match only if the reported refinements seem correct for the given situation. The `RawEquals` method is intended only for making exact value comparisons in test cases, so main application code should not use it; use `Equals` instead for real logic, which will take refinements into account automatically.
+
 ## v2.16.2 (March 9, 2023)
 
 ### Bugs Fixed

vendor/github.com/hashicorp/hcl/v2/hclsyntax/expression.go

@@ -696,7 +696,59 @@ func (e *ConditionalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostic
 		return cty.UnknownVal(resultType), diags
 	}
 	if !condResult.IsKnown() {
-		return cty.UnknownVal(resultType), diags
+		// We might be able to offer a refined range for the result based on
+		// the two possible outcomes.
+		if trueResult.Type() == cty.Number && falseResult.Type() == cty.Number {
+			// This case deals with the common case of (predicate ? 1 : 0) and
+			// significantly decreases the range of the result in that case.
+			if !(trueResult.IsNull() || falseResult.IsNull()) {
+				if gt := trueResult.GreaterThan(falseResult); gt.IsKnown() {
+					b := cty.UnknownVal(cty.Number).Refine()
+					if gt.True() {
+						b = b.
+							NumberRangeLowerBound(falseResult, true).
+							NumberRangeUpperBound(trueResult, true)
+					} else {
+						b = b.
+							NumberRangeLowerBound(trueResult, true).
+							NumberRangeUpperBound(falseResult, true)
+					}
+					b = b.NotNull() // If neither of the results is null then the result can't be either
+					return b.NewValue().WithSameMarks(condResult).WithSameMarks(trueResult).WithSameMarks(falseResult), diags
+				}
+			}
+		}
+		if trueResult.Type().IsCollectionType() && falseResult.Type().IsCollectionType() {
+			if trueResult.Type().Equals(falseResult.Type()) {
+				if !(trueResult.IsNull() || falseResult.IsNull()) {
+					trueLen := trueResult.Length()
+					falseLen := falseResult.Length()
+					if gt := trueLen.GreaterThan(falseLen); gt.IsKnown() {
+						b := cty.UnknownVal(resultType).Refine()
+						trueLen, _ := trueLen.AsBigFloat().Int64()
+						falseLen, _ := falseLen.AsBigFloat().Int64()
+						if gt.True() {
+							b = b.
+								CollectionLengthLowerBound(int(falseLen)).
+								CollectionLengthUpperBound(int(trueLen))
+						} else {
+							b = b.
+								CollectionLengthLowerBound(int(trueLen)).
+								CollectionLengthUpperBound(int(falseLen))
+						}
+						b = b.NotNull() // If neither of the results is null then the result can't be either
+						return b.NewValue().WithSameMarks(condResult).WithSameMarks(trueResult).WithSameMarks(falseResult), diags
+					}
+				}
+			}
+		}
+		trueRng := trueResult.Range()
+		falseRng := falseResult.Range()
+		ret := cty.UnknownVal(resultType)
+		if trueRng.DefinitelyNotNull() && falseRng.DefinitelyNotNull() {
+			ret = ret.RefineNotNull()
+		}
+		return ret.WithSameMarks(condResult).WithSameMarks(trueResult).WithSameMarks(falseResult), diags
 	}
 	condResult, err := convert.Convert(condResult, cty.Bool)
 	if err != nil {
@@ -1632,11 +1684,15 @@ func (e *SplatExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
 		// example, it is valid to use a splat on a single object to retrieve a
 		// list of a single attribute, but we still need to check if that
 		// attribute actually exists.
-		upgradedUnknown = !sourceVal.IsKnown()
+		if !sourceVal.IsKnown() {
+			sourceRng := sourceVal.Range()
+			if sourceRng.CouldBeNull() {
+				upgradedUnknown = true
+			}
+		}
 
 		sourceVal = cty.TupleVal([]cty.Value{sourceVal})
 		sourceTy = sourceVal.Type()
-
 	}
 
 	// We'll compute our result type lazily if we need it. In the normal case
@@ -1675,7 +1731,20 @@ func (e *SplatExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
 		// checking to proceed.
 		ty, tyDiags := resultTy()
 		diags = append(diags, tyDiags...)
-		return cty.UnknownVal(ty), diags
+		ret := cty.UnknownVal(ty)
+		if ty != cty.DynamicPseudoType {
+			ret = ret.RefineNotNull()
+		}
+		if ty.IsListType() && sourceVal.Type().IsCollectionType() {
+			// We can refine the length of an unknown list result based on
+			// the source collection's own length.
+			sourceRng := sourceVal.Range()
+			ret = ret.Refine().
+				CollectionLengthLowerBound(sourceRng.LengthLowerBound()).
+				CollectionLengthUpperBound(sourceRng.LengthUpperBound()).
+				NewValue()
+		}
+		return ret.WithSameMarks(sourceVal), diags
 	}
 
 	// Unmark the collection, and save the marks to apply to the returned

vendor/github.com/hashicorp/hcl/v2/hclsyntax/expression_template.go

@@ -38,11 +38,9 @@ func (e *TemplateExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics)
 
 		if partVal.IsNull() {
 			diags = append(diags, &hcl.Diagnostic{
-				Severity: hcl.DiagError,
-				Summary:  "Invalid template interpolation value",
-				Detail: fmt.Sprintf(
-					"The expression result is null. Cannot include a null value in a string template.",
-				),
+				Severity:    hcl.DiagError,
+				Summary:     "Invalid template interpolation value",
+				Detail:      "The expression result is null. Cannot include a null value in a string template.",
 				Subject:     part.Range().Ptr(),
 				Context:     &e.SrcRange,
 				Expression:  part,
@@ -83,16 +81,29 @@ func (e *TemplateExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics)
 			continue
 		}
 
-		buf.WriteString(strVal.AsString())
+		// If we're just continuing to validate after we found an unknown value
+		// then we'll skip appending so that "buf" will contain only the
+		// known prefix of the result.
+		if isKnown && !diags.HasErrors() {
+			buf.WriteString(strVal.AsString())
+		}
 	}
 
 	var ret cty.Value
 	if !isKnown {
 		ret = cty.UnknownVal(cty.String)
+		if !diags.HasErrors() { // Invalid input means our partial result buffer is suspect
+			if knownPrefix := buf.String(); knownPrefix != "" {
+				ret = ret.Refine().StringPrefix(knownPrefix).NewValue()
+			}
+		}
 	} else {
 		ret = cty.StringVal(buf.String())
 	}
 
+	// A template rendering result is never null.
+	ret = ret.RefineNotNull()
+
 	// Apply the full set of marks to the returned value
 	return ret.WithMarks(marks), diags
 }

vendor/github.com/hashicorp/terraform-json/.copywrite.hcl

@@ -0,0 +1,13 @@
+schema_version = 1
+
+project {
+  license        = "MPL-2.0"
+  copyright_year = 2019
+
+  # (OPTIONAL) A list of globs that should not have copyright/license headers.
+  # Supports doublestar glob patterns for more flexibility in defining which
+  # files or folders should be ignored
+  header_ignore = [
+    "testdata/**",
+  ]
+}

vendor/github.com/hashicorp/terraform-json/action.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfjson
 
 // Action is a valid action type for a resource change.

vendor/github.com/hashicorp/terraform-json/checks.go

@@ -0,0 +1,145 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package tfjson
+
+// CheckKind is a string representation of the type of conditional check
+// referenced in a check result.
+type CheckKind string
+
+const (
+	// CheckKindResource indicates the check result is from a pre- or
+	// post-condition on a resource or data source.
+	CheckKindResource CheckKind = "resource"
+
+	// CheckKindOutputValue indicates the check result is from an output
+	// post-condition.
+	CheckKindOutputValue CheckKind = "output_value"
+
+	// CheckKindCheckBlock indicates the check result is from a check block.
+	CheckKindCheckBlock CheckKind = "check"
+)
+
+// CheckStatus is a string representation of the status of a given conditional
+// check.
+type CheckStatus string
+
+const (
+	// CheckStatusPass indicates the check passed.
+	CheckStatusPass CheckStatus = "pass"
+
+	// CheckStatusFail indicates the check failed.
+	CheckStatusFail CheckStatus = "fail"
+
+	// CheckStatusError indicates the check errored. This is distinct from
+	// CheckStatusFail in that it represents a logical or configuration error
+	// within the check block that prevented the check from executing, as
+	// opposed to the check was attempted and evaluated to false.
+	CheckStatusError CheckStatus = "error"
+
+	// CheckStatusUnknown indicates the result of the check was not known. This
+	// could be because a value within the check could not be known at plan
+	// time, or because the overall plan failed for an unrelated reason before
+	// this check could be executed.
+	CheckStatusUnknown CheckStatus = "unknown"
+)
+
+// CheckStaticAddress details the address of the object that performed a given
+// check. The static address points to the overall resource, as opposed to the
+// dynamic address which contains the instance key for any resource that has
+// multiple instances.
+type CheckStaticAddress struct {
+	// ToDisplay is a formatted and ready to display representation of the
+	// address.
+	ToDisplay string `json:"to_display"`
+
+	// Kind represents the CheckKind of this check.
+	Kind CheckKind `json:"kind"`
+
+	// Module is the module part of the address. This will be empty for any
+	// resources in the root module.
+	Module string `json:"module,omitempty"`
+
+	// Mode is the ResourceMode of the resource that contains this check. This
+	// field is only set is Kind equals CheckKindResource.
+	Mode ResourceMode `json:"mode,omitempty"`
+
+	// Type is the resource type for the resource that contains this check. This
+	// field is only set if Kind equals CheckKindResource.
+	Type string `json:"type,omitempty"`
+
+	// Name is the name of the resource, check block, or output that contains
+	// this check.
+	Name string `json:"name,omitempty"`
+}
+
+// CheckDynamicAddress contains the InstanceKey field for any resources that
+// have multiple instances. A complete address can be built by combining the
+// CheckStaticAddress with the CheckDynamicAddress.
+type CheckDynamicAddress struct {
+	// ToDisplay is a formatted and ready to display representation of the
+	// full address, including the additional information from the relevant
+	// CheckStaticAddress.
+	ToDisplay string `json:"to_display"`
+
+	// Module is the module part of the address. This address will include the
+	// instance key for any module expansions resulting from foreach or count
+	// arguments. This field will be empty for any resources within the root
+	// module.
+	Module string `json:"module,omitempty"`
+
+	// InstanceKey is the instance key for any instances of a given resource.
+	//
+	// InstanceKey will be empty if there was no foreach or count argument
+	// defined on the containing object.
+	InstanceKey string `json:"instance_key,omitempty"`
+}
+
+// CheckResultStatic is the container for a "checkable object".
+//
+// A "checkable object" is a resource or data source, an output, or a check
+// block.
+type CheckResultStatic struct {
+	// Address is the absolute address of the "checkable object"
+	Address CheckStaticAddress `json:"address"`
+
+	// Status is the overall status for all the checks within this object.
+	Status CheckStatus `json:"status"`
+
+	// Instances contains the results for dynamic object that belongs to this
+	// static object. For example, any instances created from an object using
+	// the foreach or count meta arguments.
+	//
+	// Check blocks and outputs will only contain a single instance, while
+	// resources can contain 1 to many.
+	Instances []CheckResultDynamic `json:"instances,omitempty"`
+}
+
+// CheckResultDynamic describes the check result for a dynamic object that
+// results from the expansion of the containing object.
+type CheckResultDynamic struct {
+	// Address is the relative address of this instance given the Address in the
+	// parent object.
+	Address CheckDynamicAddress `json:"address"`
+
+	// Status is the overall status for the checks within this dynamic object.
+	Status CheckStatus `json:"status"`
+
+	// Problems describes any additional optional details about this check if
+	// the check failed.
+	//
+	// This will not include the errors resulting from this check block, as they
+	// will be exposed as diagnostics in the original terraform execution. It
+	// may contain any failure messages even if the overall status is
+	// CheckStatusError, however, as the instance could contain multiple checks
+	// that returned a mix of error and failure statuses.
+	Problems []CheckResultProblem `json:"problems,omitempty"`
+}
+
+// CheckResultProblem describes one of potentially several problems that led to
+// a check being classied as CheckStatusFail.
+type CheckResultProblem struct {
+	// Message is the condition error message provided by the original check
+	// author.
+	Message string `json:"message"`
+}

vendor/github.com/hashicorp/terraform-json/config.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfjson
 
 import (

vendor/github.com/hashicorp/terraform-json/expression.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfjson
 
 import "encoding/json"

vendor/github.com/hashicorp/terraform-json/metadata.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfjson
 
 import (

vendor/github.com/hashicorp/terraform-json/plan.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfjson
 
 import (
@@ -63,6 +66,14 @@ type Plan struct {
 	// RelevantAttributes represents any resource instances and their
 	// attributes which may have contributed to the planned changes
 	RelevantAttributes []ResourceAttribute `json:"relevant_attributes,omitempty"`
+
+	// Checks contains the results of any conditional checks executed, or
+	// planned to be executed, during this plan.
+	Checks []CheckResultStatic `json:"checks,omitempty"`
+
+	// Timestamp contains the static timestamp that Terraform considers to be
+	// the time this plan executed, in UTC.
+	Timestamp string `json:"timestamp,omitempty"`
 }
 
 // ResourceAttribute describes a full path to a resource attribute
@@ -197,6 +208,28 @@ type Change struct {
 	// display of sensitive values in user interfaces.
 	BeforeSensitive interface{} `json:"before_sensitive,omitempty"`
 	AfterSensitive  interface{} `json:"after_sensitive,omitempty"`
+
+	// Importing contains the import metadata about this operation. If importing
+	// is present (ie. not null) then the change is an import operation in
+	// addition to anything mentioned in the actions field. The actual contents
+	// of the Importing struct is subject to change, so downstream consumers
+	// should treat any values in here as strictly optional.
+	Importing *Importing `json:"importing,omitempty"`
+
+	// GeneratedConfig contains any HCL config generated for this resource
+	// during planning as a string.
+	//
+	// If this is populated, then Importing should also be populated but this
+	// might change in the future. However, not all Importing changes will
+	// contain generated config.
+	GeneratedConfig string `json:"generated_config,omitempty"`
+}
+
+// Importing is a nested object for the resource import metadata.
+type Importing struct {
+	// The original ID of this resource used to target it as part of planned
+	// import operation.
+	ID string `json:"id,omitempty"`
 }
 
 // PlanVariable is a top-level variable in the Terraform plan.

vendor/github.com/hashicorp/terraform-json/schemas.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfjson
 
 import (

vendor/github.com/hashicorp/terraform-json/state.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfjson
 
 import (
@@ -32,6 +35,10 @@ type State struct {
 
 	// The values that make up the state.
 	Values *StateValues `json:"values,omitempty"`
+
+	// Checks contains the results of any conditional checks when Values was
+	// last updated.
+	Checks *CheckResultStatic `json:"checks,omitempty"`
 }
 
 // UseJSONNumber controls whether the State will be decoded using the

vendor/github.com/hashicorp/terraform-json/tfjson.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Package tfjson is a de-coupled helper library containing types for
 // the plan format output by "terraform show -json" command. This
 // command is designed for the export of Terraform plan data in

vendor/github.com/hashicorp/terraform-json/validate.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfjson
 
 import (

vendor/github.com/hashicorp/terraform-json/version.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfjson
 
 // VersionOutput represents output from the version -json command

vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/context.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logging
 
 import (

vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/doc.go

@@ -1,2 +1,5 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Package logging contains shared environment variable and log functionality.
 package logging

vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/environment_variables.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logging
 
 // Environment variables.

vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/keys.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logging
 
 // Global logging keys attached to all requests.

vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/protocol.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logging
 
 import (