Upgrade to 0.15 causes panic: value is marked, so must be unmarked first

[Rumbles]

I have upgraded from 0.14.10 to 0.15.1 and my otherwise unchanged code starting causing panics:

panic: value is marked, so must be unmarked first

goroutine 2472 [running]:
github.com/zclconf/go-cty/cty.Value.assertUnmarked(...)
        /go/pkg/mod/github.com/zclconf/go-cty@v1.8.2/cty/marks.go:141
github.com/zclconf/go-cty/cty.Value.LengthInt(0x3835dc0, 0xc001d6ce40, 0x30e7840, 0xc002aba288, 0x0)
        /go/pkg/mod/github.com/zclconf/go-cty@v1.8.2/cty/value_ops.go:1050 +0x4f
github.com/hashicorp/terraform/plans/objchange.proposedNewNestedBlock(0xc000b39d60, 0x3835dc0, 0xc001d6cfb0, 0x2fcf020, 0x48f1be0, 0x3835dc0, 0xc001d6ce40, 0x30e7840, 0xc002aba288, 0xc002aba288, ...)
        /home/circleci/project/project/plans/objchange/objchange.go:217 +0x11cc
github.com/hashicorp/terraform/plans/objchange.proposedNew(0xc000183650, 0x3835d88, 0xc001d6cfc0, 0x2fcf020, 0x48f1be0, 0x3835d88, 0xc001d6ce70, 0x2ff8cc0, 0xc002ab10b0, 0x6e, ...)
        /home/circleci/project/project/plans/objchange/objchange.go:89 +0x33c
github.com/hashicorp/terraform/plans/objchange.PlannedDataResourceObject(0xc000183650, 0x3835d88, 0xc001d6ce70, 0x2ff8cc0, 0xc002ab10b0, 0x1, 0x0, 0x0, 0x0)
        /home/circleci/project/project/plans/objchange/objchange.go:64 +0x89
github.com/hashicorp/terraform/terraform.(*NodeAbstractResourceInstance).planDataSource(0xc002adc1c0, 0x386ba90, 0xc00172c9c0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0)
        /home/circleci/project/project/terraform/node_resource_abstract_instance.go:1361 +0x7aa
github.com/hashicorp/terraform/terraform.(*NodePlannableResourceInstance).dataResourceExecute(0xc002646070, 0x386ba90, 0xc00172c9c0, 0xc000000001, 0xc001acae78, 0xc00168dc50)
        /home/circleci/project/project/terraform/node_resource_plan_instance.go:74 +0x478
github.com/hashicorp/terraform/terraform.(*NodePlannableResourceInstance).Execute(0xc002646070, 0x386ba90, 0xc00172c9c0, 0xc0001b2002, 0xc00168dce8, 0x100b805, 0x3042560)
        /home/circleci/project/project/terraform/node_resource_plan_instance.go:44 +0x10d
github.com/hashicorp/terraform/terraform.(*ContextGraphWalker).Execute(0xc000208d80, 0x386ba90, 0xc00172c9c0, 0x2d7508e0, 0xc002646070, 0x0, 0x0, 0x0)
        /home/circleci/project/project/terraform/graph_walk_context.go:127 +0xbf
github.com/hashicorp/terraform/terraform.(*Graph).walk.func1(0x3372960, 0xc002646070, 0x0, 0x0, 0x0)
        /home/circleci/project/project/terraform/graph.go:59 +0xbd3
github.com/hashicorp/terraform/dag.(*Walker).walkVertex(0xc0029e5c20, 0x3372960, 0xc002646070, 0xc002d6a6c0)
        /home/circleci/project/project/dag/walk.go:381 +0x288
created by github.com/hashicorp/terraform/dag.(*Walker).Update
        /home/circleci/project/project/dag/walk.go:304 +0x1246




!!!!!!!!!!!!!!!!!!!!!!!!!!! TERRAFORM CRASH !!!!!!!!!!!!!!!!!!!!!!!!!!!!

I have a crash log and can upload it if required, but since it's nearly 40k lines I would need to review it first.

I think I have isolated the cause of the panic and it's coming from my use of archive_file as commenting out the code causes the panic to go away:

data "archive_file" "certs" {
  type        = "zip"
  output_path = "${var.assets_dir}/${var.cluster_name}-emr.zip"

  source {
    content  = tls_private_key.emr.private_key_pem
    filename = "privateKey.pem"
  }

  source {
    content  = tls_self_signed_cert.emr.cert_pem
    filename = "certificateChain.pem"
  }

  source {
    content  = tls_self_signed_cert.emr.cert_pem
    filename = "trustedCertificates.pem"
  }
}

I have seen a number of similar issues raised recently, so I don't know if this is already fixed in 0.15.2, but I was hoping it would be fixed in 0.15.1 after first spotting it in 0.15.0 and was disappointed :(

I am using hashicorp/archive v2.1.0

I hope this gives you everything you need to replicate the issue :)

[alisdair]

Hi @Rumbles, thanks for reporting this. This has been fixed by #28539 and will go out in 0.15.2. Closing as duplicate of #28535.

Full configuration to reproduce this issue:

resource "tls_private_key" "emr" {
  algorithm   = "ECDSA"
  ecdsa_curve = "P384"
}

resource "tls_self_signed_cert" "emr" {
  key_algorithm   = "ECDSA"
  private_key_pem = tls_private_key.emr.private_key_pem

  subject {
    common_name  = "example.com"
    organization = "ACME Examples, Inc"
  }

  validity_period_hours = 8760


  allowed_uses = [
    "key_encipherment",
    "digital_signature",
  ]

}

data "archive_file" "certs" {
  type        = "zip"
  output_path = "${path.module}/emr.zip"

  source {
    content  = tls_private_key.emr.private_key_pem
    filename = "privateKey.pem"
  }

  source {
    content  = tls_self_signed_cert.emr.cert_pem
    filename = "certificateChain.pem"
  }

  source {
    content  = tls_self_signed_cert.emr.cert_pem
    filename = "trustedCertificates.pem"
  }
}

Crashes with 0.15.1, works with latest main branch:

• terraform init
• terraform apply

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.