Optional OpenTofu bundle

All bundles

bundles/opentofu supplies the official stable prebuilt OpenTofu CLI (tofu) for Linux AMD64 and ARM64. It has a separate catalog, lock, image, volume and /opt/bdock/opentofu mount. Providers are not bundled or pinned here; projects manage provider versions, lock files, credentials and licenses.

Published bundle

Version: 1.13.1-b1

Index digest: sha256:67bd27de607af0d950789a3a0308262141860a331bae31b3f2a9d170c0cb3414

Source: 84216f3a45e35ba741cc8245f96803b5b9a2a31f

Publication: run 38314225387, attempt 1

Pull this published carrier by its immutable index digest:

docker pull quay.io/bundledock/opentofu@sha256:67bd27de607af0d950789a3a0308262141860a331bae31b3f2a9d170c0cb3414

The source inventory below describes the current lock; this publication retains its exact source revision.

The official v1.13.1 release was checked October 12, 2026: it is stable, with both tofu_1.13.1_linux_amd64.tar.gz and tofu_1.13.1_linux_arm64.tar.gz assets. Pins use the publisher’s SHA256SUMS . The release also provides GPG and Sigstore signatures. The existing manager verifies publisher SHA256 values; signature verification is not implemented. Official prebuilt binaries remain unchanged. No Terraform binaries are rebranded and no third-party source compilation occurs.

The safe tar extractor selects tofu as the regular executable bin/tofu, retaining archive LICENSE, README.md and CHANGELOG.md as licenses/opentofu/... members in licenses.tar.gz. The full official MPL-2.0 license and source provenance remain complete. A plain licenses.index.json maps the retained members and their hashes; see notice access for the offline carrier helper and the change from loose installed paths. Traversal, links, special files, duplicate paths and non-executable selected files are rejected. Existing regular-file manifests and volume initialization verify hashes, modes and exact tree membership on first and repeated initialization. The smoke adapter also reads every OpenTofu notice through the carrier helper before checking the read-only consumer. A runtime launcher is unnecessary.

Consumer use

After explicit approval of the intended build and revision:

make bundle-build BUNDLE=opentofu
make bundle-smoke BUNDLE=opentofu
make bundle-volume BUNDLE=opentofu

Mount the printed bundledock-opentofu-<full image ID> volume read-only at /opt/bdock/opentofu, and add /opt/bdock/opentofu/bin to PATH. Use a stock language consumer image; the scratch carrier only initializes volumes. Publication run 38314225387, attempt 1 built and passed native smoke on Linux AMD64 and ARM64 with the Debian Trixie consumer at source 84216f3a45e35ba741cc8245f96803b5b9a2a31f . That evidence covers the exact version and immutable index recorded in the published bundle receipt , rather than later source locks.

Keep HOME, project directories, backend/local state, provider plugins, and caches writable outside the immutable bundle. OpenTofu’s existing .tofurc, TF_CLI_CONFIG_FILE, provider installation settings and environment pass through unchanged. The carrier writes no user configuration and sets no provider, cache, state or data-directory overrides. Project .terraform data and local state normally live in the writable project directory. If your consumer opts into TF_DATA_DIR or TF_PLUGIN_CACHE_DIR, create writable locations that agree with its existing configuration; never point them into the bundle. Remote backends and provider installation may require networking and credentials supplied by the consumer.

The offline native smoke uses the built-in terraform_data resource without downloading a provider. It checks init, validate, plan, apply, local state, output, repeated volume initialization, concurrent read-only consumers, and preservation of a consumer-owned .tofurc.

Updates and publication

bdock tools upgrade --directory bundles/opentofu resolves the CLI alone within >=1.13.1,<2.0.0. The Propose upgrades workflow runs at 06:50 UTC and manual dry runs default to true. It changes only this lock and generated inventory; upgrades do not build or dispatch publication.

The shared publication flow verifies an actual human wstein owner merge, exact merged-main CI and frozen-lock publication for eligible bot updater PRs. Manual publication requires the exact approved full main SHA. Native AMD64 and ARM64 smoke must pass before promotion. Immutable versions use <upstream-version>-b<packaging-revision> (initially 1.13.1-b1 when unreserved); successful approved publication creates an annotated opentofu/<immutable-version> source tag. Image build, tool execution, native smoke, publication, tagging and consumer activation remain separately gated.

Source checks cover official recipe/pin rejection, synthetic archives and notices, repeated volume initialization and tampering, bundle/registry parity, version allocation, fake Docker adapters and shared upgrade/approval routing. They establish source behavior only. The native publication evidence above covers the recorded carrier and offline smoke scenario. External provider workflows, other consumer environments and vulnerability scans remain unverified here; future source locks require their own native verification.