Submit GPG key to the OpenTofu registry

[tthompson-figma]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

---

Description

We would like to migrate to OpenTofu with all providers' GPG signatures validated. However, OpenTofu skips validation for this provider because the OpenTofu registry does not have this provider's GPG key.

You can follow this link to submit it: Submit new Provider Signing Key

If you don't have access to the public key anymore, you can retrieve it from the Terraform registry:

curl 'https://registry.terraform.io/v1/providers/okta/okta/4.3.0/download/linux/amd64' | jq --raw-output '.signing_keys | .gpg_public_keys | .[0] | .ascii_armor'

Note: For security reasons, it has to be submitted by the provider author for the OpenTofu registry to accept it.

Potential impact
Allows OpenTofu users to use this provider with the same security guarantees they would using Terraform.

New or Affected Resource(s)

None.

Potential Terraform Configuration

No change.

References

Submit new Provider Signing Key

OpenTofu is a fork of Terraform that is open-source, community-driven, and managed by the Linux Foundation.
Hashicorp opentofu/roadmap#24 (comment) for the terraform provider registry to disallow usage with things other than terraform, so OpenTofu had to build its own registry.