Installation and Trust

The provider is distributed from a Terraform provider registry that Qumulo hosts on a public, read-only S3 bucket at qumulo-terraform-registry.s3.us-east-1.amazonaws.com. This page covers the standard installation, how Terraform verifies the provider, manual signature verification for compliance workflows, and air-gapped installation.

Quick Install

Prerequisites:

• Terraform 1.0 or later
• HTTPS (port 443) egress to qumulo-terraform-registry.s3.us-east-1.amazonaws.com. Downloads are anonymous. No AWS account or credentials are required.

Add the provider to your Terraform configuration:

terraform {
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

Then initialize:

terraform init

That's it. Terraform downloads the provider, verifies its GPG-signed checksums, and records the verified hashes in .terraform.lock.hcl. Commit the lock file so every teammate and CI run installs the identical, verified binary.

A self-signed key notice is expected

Because this provider is hosted outside registry.terraform.io, its releases are signed with Qumulo's GPG key rather than by HashiCorp. terraform init reports this as a self-signed key:

- Installed qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo v1.3.9 (self-signed, key ID <Qumulo's key ID>)

Partner and community providers are signed by their developers.

This does not indicate a security issue. Terraform still performs full signature and checksum verification. See How Terraform Verifies This Provider.

Upgrading later

To move to a newer release, raise the version constraint if needed and run terraform init -upgrade to refresh the lock file.

Next steps

• Copy-paste examples for common resources: Usage Examples
• Deploy your first cluster: AWS, Azure, GCP, or bare metal

How Terraform Verifies This Provider

When you run terraform init, Terraform automatically verifies the provider before installing it:

1. Fetches service discovery from qumulo-terraform-registry.s3.us-east-1.amazonaws.com/.well-known/terraform.json
2. Queries the version index at /v1/providers/qumulo/qumulo/versions and picks the newest version matching your constraint
3. Downloads per-platform metadata at /v1/providers/qumulo/qumulo/{version}/download/{os}/{arch}, which carries the download URL, the expected SHA-256, the checksum file URLs, and Qumulo's GPG public key
4. Downloads the provider zip, SHA256SUMS, and SHA256SUMS.sig
5. Verifies the GPG signature on SHA256SUMS using the key from the registry metadata
6. Verifies the zip checksum matches SHA256SUMS
7. Records the verified hashes in .terraform.lock.hcl

What each release publishes

Every release uploads these artifacts under https://qumulo-terraform-registry.s3.us-east-1.amazonaws.com/releases/qumulo/{version}/:

Artifact	Purpose
terraform-provider-qumulo_{version}_{os}_{arch}.zip	Provider binary, plus LICENSE and THIRD_PARTY_LICENSES.txt
terraform-provider-qumulo_{version}_SHA256SUMS	SHA-256 checksums of every platform zip
terraform-provider-qumulo_{version}_SHA256SUMS.sig	Detached GPG signature over the checksums file
sbom.json	CycloneDX software bill of materials for the release

Windows binaries carry a second signature

The .exe inside the Windows zip is additionally Authenticode-signed through Azure Trusted Signing with an RFC 3161 timestamp. You can inspect it in the file's Digital Signatures properties tab or with signtool verify /pa.

Manual Signature Verification

For compliance workflows that require out-of-band verification, you can manually verify the GPG signature and checksums.

1. Download the release artifacts

VERSION=1.3.9
PLATFORM=linux_amd64
BASE_URL="https://qumulo-terraform-registry.s3.us-east-1.amazonaws.com/releases/qumulo/${VERSION}"

curl -O "${BASE_URL}/terraform-provider-qumulo_${VERSION}_${PLATFORM}.zip"
curl -O "${BASE_URL}/terraform-provider-qumulo_${VERSION}_SHA256SUMS"
curl -O "${BASE_URL}/terraform-provider-qumulo_${VERSION}_SHA256SUMS.sig"

Substitute your platform from the Available Platforms table.

2. Import the GPG public key

gpg --import qumulo-terraform-gpg-public.asc

See Retrieving the GPG Public Key below for how to obtain the key.

3. Verify the signature

gpg --verify \
  "terraform-provider-qumulo_${VERSION}_SHA256SUMS.sig" \
  "terraform-provider-qumulo_${VERSION}_SHA256SUMS"

Expected output includes Good signature from "Qumulo ...". A WARNING: This key is not certified with a trusted signature message is normal if you haven't marked the key as trusted in your keyring.

4. Verify the checksum

LinuxmacOS

sha256sum -c "terraform-provider-qumulo_${VERSION}_SHA256SUMS" --ignore-missing

shasum -a 256 -c "terraform-provider-qumulo_${VERSION}_SHA256SUMS" --ignore-missing

Expected output:

terraform-provider-qumulo_1.3.9_linux_amd64.zip: OK

On Windows, compute the hash with PowerShell's Get-FileHash -Algorithm SHA256 and compare it to the matching line in the SHA256SUMS file.

Retrieving the GPG Public Key

From the registry metadata (recommended, always matches what Terraform sees; requires jq):

VERSION=1.3.9
curl -s "https://qumulo-terraform-registry.s3.us-east-1.amazonaws.com/v1/providers/qumulo/qumulo/${VERSION}/download/linux/amd64" \
  | jq -r '.signing_keys.gpg_public_keys[0].ascii_armor' \
  > qumulo-terraform-gpg-public.asc

The key ID is also available in the same response:

curl -s "https://qumulo-terraform-registry.s3.us-east-1.amazonaws.com/v1/providers/qumulo/qumulo/${VERSION}/download/linux/amd64" \
  | jq -r '.signing_keys.gpg_public_keys[0].key_id'

From your lock file: after a successful terraform init, the .terraform.lock.hcl file records h1: and zh: checksums for the provider. The lock file does not store the GPG key fingerprint directly, but the terraform init output displays the signing key ID. Compare that ID against the key extracted from the registry metadata above.

Air-Gapped Installation

For environments without internet access, download and verify the provider on a connected machine, transfer it, and configure Terraform on the air-gapped host to install from local files. Two approaches:

Provider mirror (recommended)dev_overrides

Terraform's built-in provider mirroring keeps version constraints and lock file verification working, so prefer it when you can run Terraform on a connected machine.

1. On a connected machine, in a directory containing a Terraform configuration with the required_providers block from Quick Install, download the provider into a local mirror directory (one -platform flag per target platform):

   terraform providers mirror -platform=linux_amd64 ./qumulo-mirror
   

2. Optionally verify the mirrored zips out of band using the manual verification steps. Terraform cannot re-check the GPG signature when installing from a local mirror, so this is the place to do it.

3. Transfer the mirror directory to the air-gapped host, for example to /opt/terraform/providers.

4. Point Terraform at the mirror. Create or edit ~/.terraformrc (Linux/macOS) or %APPDATA%/terraform.rc (Windows):

   provider_installation {
     filesystem_mirror {
       path    = "/opt/terraform/providers"
       include = ["qumulo-terraform-registry.s3.us-east-1.amazonaws.com/*/*"]
     }
     direct {
       exclude = ["qumulo-terraform-registry.s3.us-east-1.amazonaws.com/*/*"]
     }
   }
   

5. Run terraform init and then terraform plan / terraform apply as normal.

Use this when you cannot run Terraform on a connected machine and only need the raw binary.

1. Download and verify the zip for your platform on a connected machine using the manual verification steps.

2. Transfer the zip to the air-gapped host and unzip:

   VERSION=1.3.9
   PLATFORM=linux_amd64
   mkdir -p /opt/terraform/providers/qumulo
   unzip "terraform-provider-qumulo_${VERSION}_${PLATFORM}.zip" -d /opt/terraform/providers/qumulo
   

3. Configure Terraform to use the local binary. Create or edit ~/.terraformrc (Linux/macOS) or %APPDATA%/terraform.rc (Windows):

   provider_installation {
     dev_overrides {
       "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo" = "/opt/terraform/providers/qumulo"
     }
     direct {}
   }
   

4. Skip terraform init (it would try to reach the registry) and run terraform plan and terraform apply directly. Both print a warning that provider development overrides are in effect, which is expected.

dev_overrides bypasses Terraform's safety checks

With dev_overrides, Terraform ignores version constraints and lock file verification for this provider. Since you verified the binary out of band (GPG signature plus checksum), this is a reasonable tradeoff for air-gapped environments, but prefer the provider mirror approach when possible.

Available Platforms

The provider publishes binaries for these OS/architecture combinations:

OS	Architecture
Linux	amd64
Linux	arm64
macOS (darwin)	amd64
macOS (darwin)	arm64
Windows	amd64

Troubleshooting

"Failed to query available provider packages"

Terraform cannot reach the registry. Verify network access to qumulo-terraform-registry.s3.us-east-1.amazonaws.com on port 443 (add it to your proxy or firewall allowlist if needed). Test with:

curl -s "https://qumulo-terraform-registry.s3.us-east-1.amazonaws.com/.well-known/terraform.json"

Expected output:

{
  "providers.v1": "/v1/providers/"
}

If you are using an air-gapped setup, check the .terraformrc path and contents instead.

Provider reported as self-signed

Expected for all providers hosted outside registry.terraform.io. It does not indicate a security issue. The provider is signed by Qumulo's GPG key and Terraform still verifies the signature. See How Terraform Verifies This Provider.

Checksum or signature verification fails

Re-download the artifacts directly from the registry host and re-run the manual verification steps. A proxy that intercepts or rewrites downloads is the most common cause of a mismatch.

Warning about provider development overrides

When using the dev_overrides air-gapped method, terraform plan and terraform apply warn that overrides are in effect. This is expected. Skip terraform init entirely with this method.