openTofu fails to install provider because of unknown issuer

[c-baumgartner]

Trying to initialize a most basic implementation of the Pattern Verified Module ALZ downloading this provider it fails with unkown issuer for the signing key.

I know there is official support for openTofu (yet) but the rest of the azure modules are installing fine. I am also not sure if it would be better to raise an issue at openTofu but the error is quite serious about the next step: 🤣

Providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://opentofu.org/docs/cli/plugins/signing/
╷
│ Error: Failed to install provider
│ 
│ Error while installing azure/alz v0.14.0: the provider is not signed with a valid signing key; please contact the provider author (authentication signature from unknown
│ issuer)
╵****

terraform {
  required_version = "~> 1.6"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
    azapi = {
      source  = "azure/azapi"
      version = "2.0.0-beta"
    }
    alz = {
      source  = "azure/alz"
      version = "~> 0.13"
    }
  }
}

I have tested with openTofu 1.8.2 on linux_amd64. Also tried to manually install the provider - without any luck so far.

Using terraform 1.9 works without any issue - but because of the licensing situation we cannot use terraform 1.6 or never and the module has a version constraint of terraform 1.6 or newer. So I am in a kind of deadlock :-D

[c-baumgartner]

Just in case this is something related to OpenTofu I have also raised an issue: opentofu/opentofu#2033

[matt-FFFFFF]

Hi! We had to give Hashicorp the public key so they could validate - perhaps we need to do the same for OpenTofu?

[matt-FFFFFF]

Done: opentofu/registry#1065

[matt-FFFFFF]

Looks like they need to allow per provider keys, hopefully it won't take long

[c-baumgartner]

Hey @matt-FFFFFF thank you very much for this quick response.

[c-baumgartner]

closed by mistake - reopened for tracking until resolved in upstream issue