tfenv downloaded a Terraform 013.3 version that is being flagged as malware

[mdiianni]

Hello there, today MacOs on my machine reported terraform downloaded via tfenv as malware! Please review.

[mjuarez]

I would assume this is related to https://discuss.hashicorp.com/t/terraform-updates-for-hcsec-2021-12/23570

[mjuarez]

Actually, you may want to read this over in case this was a previously downloaded version: https://discuss.hashicorp.com/t/hcsec-2023-01-hashicorp-response-to-circleci-security-alert/48842/2

[mdiianni]

Looks like the issue has been contained and should not impact Terraform users. Simply remove and reinstall tf version of your choice.

[rpdelaney]

We are affected by this. Some guidance would be appreciated! Is it enough to uninstall and reinstall the terraform versions used in tfenv?

[boweeb]

Since it isn't clear what the thumbs-up reaction above actually means, I'll note here explicitly that reinstalling via tfenv uninstall <version> and tfenv install <version> will in fact clear the message. 🎉

[rpdelaney]

Yep! That fixed it. This script should reinstall all the versions (it's the only way to be sure):

#!/usr/bin/env bash
#

for version in $(tfenv list | tr -s ' ' | cut -d ' ' -f 2); do 
  (set -x ; tfenv uninstall "$version" && tfenv install "$version")
done

[nodesocket]

Would be nice to add a tfenv install --force <version> flag.