From b4a843c4e20bc1b7f9206ad9e959e83fce4328ef Mon Sep 17 00:00:00 2001
From: Lucas Bajolet <105649352+lbajolet-hashicorp@users.noreply.github.com>
Date: Thu, 30 May 2024 08:25:21 -0400
Subject: [PATCH] commands: reject constraints with pre-releases (#12999)

When remotely installing a plugin, constraints are used by Packer to
determine which version of a plugin to install.

These constraints can be arbitrarily complex, including operators and
ranges in which to look for valid versions.

However, the versions specified in those constraints should always be
final releases, and not a pre-release since we don't explicitly support
remotely installing pre-releases.

This commit therefore addds checks to make sure these are reported ASAP,
even before the source is contacted to list releases and picking one to
install.
---
 command/plugins_install.go             | 12 ++++++++++++
 hcl2template/types.required_plugins.go | 16 ++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/command/plugins_install.go b/command/plugins_install.go
index 3f086168cd8..b1d6c361318 100644
--- a/command/plugins_install.go
+++ b/command/plugins_install.go
@@ -160,6 +160,18 @@ func (c *PluginsInstallCommand) RunContext(buildCtx context.Context, args *Plugi
 			c.Ui.Error(err.Error())
 			return 1
 		}
+
+		hasPrerelease := false
+		for _, con := range constraints {
+			if con.Prerelease() {
+				hasPrerelease = true
+			}
+		}
+		if hasPrerelease {
+			c.Ui.Errorf("Unsupported prerelease for constraint %q", args.Version)
+			return 1
+		}
+
 		pluginRequirement.VersionConstraints = constraints
 	}
 
diff --git a/hcl2template/types.required_plugins.go b/hcl2template/types.required_plugins.go
index 59a8018004f..08fe694b3ac 100644
--- a/hcl2template/types.required_plugins.go
+++ b/hcl2template/types.required_plugins.go
@@ -141,6 +141,22 @@ func decodeRequiredPluginsBlock(block *hcl.Block) (*RequiredPlugins, hcl.Diagnos
 				})
 				continue
 			}
+
+			hadPrerelease := false
+			for _, constraint := range constraints {
+				if constraint.Prerelease() {
+					hadPrerelease = true
+				}
+			}
+			if hadPrerelease {
+				diags = diags.Append(&hcl.Diagnostic{
+					Severity: hcl.DiagError,
+					Summary:  "Invalid version constraint",
+					Detail:   fmt.Sprintf("Unsupported prerelease for constraint %q", constraintStr),
+					Subject:  attr.Expr.Range().Ptr(),
+				})
+			}
+
 			vc.Required = constraints
 			rp.Requirement = vc