From 0e85ef66503059cb7b4ba4f688a6a13da10c434e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 30 Oct 2026 09:13:30 +0000
Subject: [PATCH 1/6] Initial plan


From 9d69a76833f1b1cc2e71673b26093bbdc271ca2e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 30 Oct 2026 09:26:40 +0000
Subject: [PATCH 2/6] Fix Terraform tflint checksum fallback

Co-authored-by: v-Kaniska244 <186041440+v-Kaniska244@users.noreply.github.com>
---
 src/terraform/devcontainer-feature.json |  2 +-
 src/terraform/install.sh                | 10 +++++++++-
 test/terraform/scenarios.json           |  8 ++++++++
 test/terraform/tflint_checksum_test.sh  |  9 +++++++++
 4 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 test/terraform/tflint_checksum_test.sh

diff --git a/src/terraform/devcontainer-feature.json b/src/terraform/devcontainer-feature.json
index 634d865ef..5355239cd 100644
--- a/src/terraform/devcontainer-feature.json
+++ b/src/terraform/devcontainer-feature.json
@@ -1,6 +1,6 @@
 {
     "id": "terraform",
-    "version": "1.5.0",
+    "version": "1.5.1",
     "name": "Terraform, tflint, and TFGrunt",
     "documentationURL": "https://github.com/devcontainers/features/tree/main/src/terraform",
     "description": "Installs the Terraform CLI and optionally TFLint and Terragrunt. Auto-detects latest version and installs needed dependencies.",
diff --git a/src/terraform/install.sh b/src/terraform/install.sh
index 43779f825..8f32a926c 100755
--- a/src/terraform/install.sh
+++ b/src/terraform/install.sh
@@ -461,6 +461,10 @@ install_tflint() {
     curl -sSL -o /tmp/tf-downloads/${TFLINT_FILENAME} https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/${TFLINT_FILENAME}
 }
 
+download_tflint_checksums() {
+    curl -fsSL -o /tmp/tf-downloads/tflint_checksums.txt "https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/checksums.txt"
+}
+
 verify_tflint_attestations() {
     local checksums=$1
     local checksums_sha256=$(sha256sum "$checksums" | cut -d " " -f 1)
@@ -491,7 +495,11 @@ if [ "${TFLINT_VERSION}" != "none" ]; then
             echo "${TFLINT_SHA256} *${TFLINT_FILENAME}" > tflint_checksums.txt
             sha256sum --ignore-missing -c tflint_checksums.txt
         else
-            curl -sSL -o tflint_checksums.txt https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/checksums.txt
+            if ! download_tflint_checksums; then
+                echo "(!) Failed to fetch checksums for tflint v${TFLINT_VERSION}, trying the latest release."
+                install_previous_version TFLINT_VERSION "$tflint_url" "install_tflint"
+                download_tflint_checksums
+            fi
 
             # Attempt GitHub Attestation verification (0.51.1+)
             set +e
diff --git a/test/terraform/scenarios.json b/test/terraform/scenarios.json
index de897b5e9..1c52b5954 100644
--- a/test/terraform/scenarios.json
+++ b/test/terraform/scenarios.json
@@ -120,6 +120,14 @@
             }
         }
     },
+    "tflint_checksum_test": {
+        "image": "mcr.microsoft.com/devcontainers/base:jammy",
+        "features": {
+            "terraform": {
+                "tflint": "0.60.0"
+            }
+        }
+    },
     "older_tflint": {
         "image": "mcr.microsoft.com/devcontainers/base:jammy",
         "features": {
diff --git a/test/terraform/tflint_checksum_test.sh b/test/terraform/tflint_checksum_test.sh
new file mode 100644
index 000000000..c1ae1d418
--- /dev/null
+++ b/test/terraform/tflint_checksum_test.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+set -e
+
+source dev-container-features-test-lib
+
+check "tflint version" tflint --version | grep "0.60.0"
+
+reportResults

From 48ff90441ebbdce5f9bb9ada89bb53f33a60b97d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 30 Oct 2026 09:29:42 +0000
Subject: [PATCH 3/6] Harden tflint release fallback

Co-authored-by: v-Kaniska244 <186041440+v-Kaniska244@users.noreply.github.com>
---
 src/terraform/install.sh | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/src/terraform/install.sh b/src/terraform/install.sh
index 8f32a926c..192442153 100755
--- a/src/terraform/install.sh
+++ b/src/terraform/install.sh
@@ -463,6 +463,10 @@ install_tflint() {
 
 download_tflint_checksums() {
     curl -fsSL -o /tmp/tf-downloads/tflint_checksums.txt "https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/checksums.txt"
+    if [ ! -s "/tmp/tf-downloads/${TFLINT_FILENAME}" ] || grep -q "Not Found" "/tmp/tf-downloads/${TFLINT_FILENAME}"; then
+        return 1
+    fi
+    grep -Fq "${TFLINT_FILENAME}" /tmp/tf-downloads/tflint_checksums.txt
 }
 
 verify_tflint_attestations() {
@@ -495,11 +499,16 @@ if [ "${TFLINT_VERSION}" != "none" ]; then
             echo "${TFLINT_SHA256} *${TFLINT_FILENAME}" > tflint_checksums.txt
             sha256sum --ignore-missing -c tflint_checksums.txt
         else
-            if ! download_tflint_checksums; then
-                echo "(!) Failed to fetch checksums for tflint v${TFLINT_VERSION}, trying the latest release."
-                install_previous_version TFLINT_VERSION "$tflint_url" "install_tflint"
-                download_tflint_checksums
-            fi
+            while ! download_tflint_checksums; do
+                current_tflint_version="${TFLINT_VERSION}"
+                echo "(!) Failed to fetch checksums for tflint v${current_tflint_version}, trying the previous release."
+                find_prev_version_from_git_tags TFLINT_VERSION "$tflint_url"
+                if [ "${TFLINT_VERSION}" = "${current_tflint_version}" ]; then
+                    echo "(!) Unable to find a tflint release with downloadable checksums."
+                    exit 1
+                fi
+                install_tflint "$TFLINT_VERSION"
+            done
 
             # Attempt GitHub Attestation verification (0.51.1+)
             set +e
@@ -514,13 +523,13 @@ if [ "${TFLINT_VERSION}" != "none" ]; then
                 # Fallback to cosign verification
                 echo "(*) GitHub Attestation verification failed or not supported for this version, falling back to Cosign verification..."
                 set +e
-                curl -sSL -o checksums.txt.keyless.sig https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/checksums.txt.keyless.sig
+                curl -fsSL -o checksums.txt.keyless.sig https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/checksums.txt.keyless.sig
                 set -e
 
                 # Check that checksums.txt.keyless.sig exists and is not empty
                 if [ -s checksums.txt.keyless.sig ]; then
                     # Validate checksums with cosign
-                    curl -sSL -o checksums.txt.pem https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/checksums.txt.pem
+                    curl -fsSL -o checksums.txt.pem https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/checksums.txt.pem
                     ensure_cosign
                     cosign verify-blob \
                         --certificate=/tmp/tf-downloads/checksums.txt.pem \
@@ -529,12 +538,12 @@ if [ "${TFLINT_VERSION}" != "none" ]; then
                         --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
                         /tmp/tf-downloads/tflint_checksums.txt
                     # Ensure that checksums.txt has $TFLINT_FILENAME
-                    grep ${TFLINT_FILENAME} /tmp/tf-downloads/tflint_checksums.txt
+                    grep -F "${TFLINT_FILENAME}" /tmp/tf-downloads/tflint_checksums.txt
                     # Validate downloaded file
                     sha256sum --ignore-missing -c tflint_checksums.txt
                 else
                     # Fallback to older, GPG-based verification (pre-0.47.0 of tflint)
-                    curl -sSL -o tflint_checksums.txt.sig https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/checksums.txt.sig
+                    curl -fsSL -o tflint_checksums.txt.sig https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/checksums.txt.sig
                     curl -sSL -o tflint_key "${TFLINT_GPG_KEY_URI}"
                     gpg -q --import tflint_key
                     gpg --verify tflint_checksums.txt.sig tflint_checksums.txt

From 760e288690514f2691b18b33f88f7cfcb150d99e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 2 Nov 2026 16:37:09 +0000
Subject: [PATCH 4/6] Add tflint retry loop coverage

Co-authored-by: v-Kaniska244 <186041440+v-Kaniska244@users.noreply.github.com>
---
 src/terraform/install.sh                      | 24 ++++++----
 test/terraform/scenarios.json                 |  8 ++++
 .../tflint_checksum_fallback_test.sh          | 46 +++++++++++++++++++
 3 files changed, 68 insertions(+), 10 deletions(-)
 create mode 100644 test/terraform/tflint_checksum_fallback_test.sh

diff --git a/src/terraform/install.sh b/src/terraform/install.sh
index 192442153..0501ec88d 100755
--- a/src/terraform/install.sh
+++ b/src/terraform/install.sh
@@ -469,6 +469,19 @@ download_tflint_checksums() {
     grep -Fq "${TFLINT_FILENAME}" /tmp/tf-downloads/tflint_checksums.txt
 }
 
+install_tflint_with_checksum_fallback() {
+    while ! download_tflint_checksums; do
+        current_tflint_version="${TFLINT_VERSION}"
+        echo "(!) Failed to fetch checksums for tflint v${current_tflint_version}, trying the previous release."
+        find_prev_version_from_git_tags TFLINT_VERSION "$tflint_url"
+        if [ "${TFLINT_VERSION}" = "${current_tflint_version}" ]; then
+            echo "(!) Unable to find a tflint release with downloadable checksums."
+            exit 1
+        fi
+        install_tflint "$TFLINT_VERSION"
+    done
+}
+
 verify_tflint_attestations() {
     local checksums=$1
     local checksums_sha256=$(sha256sum "$checksums" | cut -d " " -f 1)
@@ -499,16 +512,7 @@ if [ "${TFLINT_VERSION}" != "none" ]; then
             echo "${TFLINT_SHA256} *${TFLINT_FILENAME}" > tflint_checksums.txt
             sha256sum --ignore-missing -c tflint_checksums.txt
         else
-            while ! download_tflint_checksums; do
-                current_tflint_version="${TFLINT_VERSION}"
-                echo "(!) Failed to fetch checksums for tflint v${current_tflint_version}, trying the previous release."
-                find_prev_version_from_git_tags TFLINT_VERSION "$tflint_url"
-                if [ "${TFLINT_VERSION}" = "${current_tflint_version}" ]; then
-                    echo "(!) Unable to find a tflint release with downloadable checksums."
-                    exit 1
-                fi
-                install_tflint "$TFLINT_VERSION"
-            done
+            install_tflint_with_checksum_fallback
 
             # Attempt GitHub Attestation verification (0.51.1+)
             set +e
diff --git a/test/terraform/scenarios.json b/test/terraform/scenarios.json
index 1c52b5954..d6b29fd1b 100644
--- a/test/terraform/scenarios.json
+++ b/test/terraform/scenarios.json
@@ -128,6 +128,14 @@
             }
         }
     },
+    "tflint_checksum_fallback_test": {
+        "image": "mcr.microsoft.com/devcontainers/base:jammy",
+        "features": {
+            "terraform": {
+                "tflint": "0.60.0"
+            }
+        }
+    },
     "older_tflint": {
         "image": "mcr.microsoft.com/devcontainers/base:jammy",
         "features": {
diff --git a/test/terraform/tflint_checksum_fallback_test.sh b/test/terraform/tflint_checksum_fallback_test.sh
new file mode 100644
index 000000000..8ac8605d5
--- /dev/null
+++ b/test/terraform/tflint_checksum_fallback_test.sh
@@ -0,0 +1,46 @@
+#!/bin/bash
+
+set -e
+
+source dev-container-features-test-lib
+
+TFLINT_VERSION="0.60.0"
+TFLINT_FILENAME="tflint_linux_amd64.zip"
+tflint_url="https://github.com/terraform-linters/tflint"
+checksum_attempts=0
+previous_version_requests=0
+downloaded_versions=()
+
+run_checksum_fallback() {
+    while ! download_tflint_checksums; do
+        current_tflint_version="${TFLINT_VERSION}"
+        find_prev_version_from_git_tags TFLINT_VERSION "$tflint_url"
+        if [ "${TFLINT_VERSION}" = "${current_tflint_version}" ]; then
+            return 1
+        fi
+        install_tflint "$TFLINT_VERSION"
+    done
+}
+
+download_tflint_checksums() {
+    checksum_attempts=$((checksum_attempts + 1))
+    [ "${checksum_attempts}" -gt 1 ]
+}
+
+find_prev_version_from_git_tags() {
+    previous_version_requests=$((previous_version_requests + 1))
+    TFLINT_VERSION="0.59.1"
+}
+
+install_tflint() {
+    downloaded_versions+=("$1")
+}
+
+run_checksum_fallback
+
+check "checksum download retried once" bash -c "[ \"${checksum_attempts}\" -eq 2 ]"
+check "previous tflint version requested once" bash -c "[ \"${previous_version_requests}\" -eq 1 ]"
+check "previous tflint archive downloaded" bash -c "[ \"${downloaded_versions[0]}\" = \"0.59.1\" ]"
+check "fallback resolved to previous tflint version" bash -c "[ \"${TFLINT_VERSION}\" = \"0.59.1\" ]"
+
+reportResults

From 7cf607416285cee5d7aa2eccd49f83b8c49055b3 Mon Sep 17 00:00:00 2001
From: Kaniska <kaniska244@github.com>
Date: Mon, 2 Nov 2026 17:10:53 +0000
Subject: [PATCH 5/6] Added test for the retry loop for tflint installation.

---
 test/terraform/scenarios.json                 |   4 +-
 .../tflint_checksum_fallback_helper.sh        | 118 ++++++++++++++++++
 .../tflint_checksum_fallback_test.sh          |  64 ++++------
 .../tflint_checksum_fallback_test/Dockerfile  |   2 +
 4 files changed, 149 insertions(+), 39 deletions(-)
 create mode 100644 test/terraform/tflint_checksum_fallback_helper.sh
 create mode 100644 test/terraform/tflint_checksum_fallback_test/Dockerfile

diff --git a/test/terraform/scenarios.json b/test/terraform/scenarios.json
index d6b29fd1b..1bef8f15b 100644
--- a/test/terraform/scenarios.json
+++ b/test/terraform/scenarios.json
@@ -129,7 +129,9 @@
         }
     },
     "tflint_checksum_fallback_test": {
-        "image": "mcr.microsoft.com/devcontainers/base:jammy",
+        "build": {
+            "dockerfile": "Dockerfile"
+        },
         "features": {
             "terraform": {
                 "tflint": "0.60.0"
diff --git a/test/terraform/tflint_checksum_fallback_helper.sh b/test/terraform/tflint_checksum_fallback_helper.sh
new file mode 100644
index 000000000..5b2d792ff
--- /dev/null
+++ b/test/terraform/tflint_checksum_fallback_helper.sh
@@ -0,0 +1,118 @@
+#!/bin/bash
+
+prepare_tflint_fixtures() {
+    local version
+    case "$(uname -m)" in
+        x86_64) architecture=amd64 ;;
+        aarch64) architecture=arm64 ;;
+        *) return 1 ;;
+    esac
+    TFLINT_FILENAME="tflint_linux_${architecture}.zip"
+    mkdir -p "${test_root}/fixtures"
+    for version in 0.60.0 0.59.1 0.58.1; do
+        mkdir -p "${test_root}/fixtures/${version}"
+        command curl -fsSL --retry 3 -o "${test_root}/fixtures/${version}/${TFLINT_FILENAME}" \
+            "https://github.com/terraform-linters/tflint/releases/download/v${version}/${TFLINT_FILENAME}" || return 1
+        command curl -fsSL --retry 3 -o "${test_root}/fixtures/${version}/checksums.txt" \
+            "https://github.com/terraform-linters/tflint/releases/download/v${version}/checksums.txt" || return 1
+        (cd "${test_root}/fixtures/${version}" && sha256sum --ignore-missing -c checksums.txt) || return 1
+    done
+}
+
+run_tflint_case() {
+    bash -e -c 'source "$1"; installer=$2; test_root=$3; architecture=$4; TFLINT_FILENAME=$5; execute_tflint_case "$6"' \
+        bash "$(realpath "${BASH_SOURCE[0]}")" "${installer}" "${test_root}" "${architecture}" "${TFLINT_FILENAME}" "$1"
+}
+
+execute_tflint_case() (
+    set -e
+    local mode=$1
+    local case_dir="${test_root}/${mode}"
+    mkdir -p "${case_dir}/downloads" "${case_dir}/bin"
+    cd "${case_dir}/downloads"
+    TFLINT_VERSION=0.60.0
+    TFLINT_SHA256=automatic
+    tflint_url=https://github.com/terraform-linters/tflint
+
+    curl() {
+        local destination url version asset
+        while [ "$#" -gt 0 ]; do
+            case "$1" in
+                -o) destination=$2; shift 2 ;;
+                https://*) url=$1; shift ;;
+                *) shift ;;
+            esac
+        done
+        version=${url%/*}
+        version=${version##*/v}
+        asset=${url##*/}
+        destination=${destination/\/tmp\/tf-downloads/${case_dir}/downloads}
+        printf '%s/%s\n' "${version}" "${asset}" >> "${case_dir}/requests"
+        if [ "${asset}" = checksums.txt ]; then
+            case "${mode}:${version}" in
+                missing:0.60.0|multiple:0.60.0|multiple:0.59.1|stalled:*) return 22 ;;
+                empty:0.60.0) : > "${destination}"; return 0 ;;
+                absent-entry:0.60.0) printf '%064d  other.zip\n' 0 > "${destination}"; return 0 ;;
+            esac
+        else
+            case "${mode}:${version}" in
+                empty-archive:0.60.0) : > "${destination}"; return 0 ;;
+                missing-archive:0.60.0) printf 'Not Found' > "${destination}"; return 0 ;;
+            esac
+        fi
+        cp "${test_root}/fixtures/${version}/${asset}" "${destination}"
+        if [ "${mode}" = corrupt ] && [ "${asset}" = "${TFLINT_FILENAME}" ]; then
+            printf 'corrupted' >> "${destination}"
+        fi
+    }
+
+    find_prev_version_from_git_tags() {
+        printf '%s\n' "${TFLINT_VERSION}" >> "${case_dir}/fallbacks"
+        [ "${mode}" != stalled ] || return 0
+        case "${TFLINT_VERSION}" in
+            0.60.0) TFLINT_VERSION=0.59.1 ;;
+            0.59.1) TFLINT_VERSION=0.58.1 ;;
+        esac
+    }
+
+    install_previous_version() {
+        find_prev_version_from_git_tags "$1" "$2"
+        "$3" "${TFLINT_VERSION}"
+    }
+
+    verify_tflint_attestations() {
+        [ -s "$1" ]
+    }
+
+    unzip() {
+        command unzip "${1/\/tmp\/tf-downloads/${case_dir}/downloads}"
+    }
+
+    mv() {
+        [ "$1" = -f ] && [ "$2" = tflint ] && [ "$3" = /usr/local/bin/ ]
+        command mv -f "$2" "${case_dir}/bin/"
+    }
+
+    source <(sed -n '/^install_tflint() {/,/^verify_tflint_attestations() {/p' "${installer}" | \
+        sed '$d;s|/tmp/tf-downloads|'"${case_dir}"'/downloads|g')
+    source <(sed -n '/^if \[ "${TFLINT_VERSION}" != "none" \]; then/,/^install_terragrunt() {/p' "${installer}" | \
+        sed '$d;s|/tmp/tf-downloads|'"${case_dir}"'/downloads|g')
+    printf '%s\n' "${TFLINT_VERSION}" > "${case_dir}/selected-version"
+)
+
+check_tflint_installation() {
+    local mode=$1 version=$2
+    run_tflint_case "${mode}" || return 1
+    [ "$(cat "${test_root}/${mode}/selected-version")" = "${version}" ] || return 1
+    "${test_root}/${mode}/bin/tflint" --version | grep -F "TFLint version ${version}" || return 1
+    cmp "${test_root}/fixtures/${version}/${TFLINT_FILENAME}" "${test_root}/${mode}/downloads/${TFLINT_FILENAME}" || return 1
+    cmp "${test_root}/fixtures/${version}/checksums.txt" "${test_root}/${mode}/downloads/tflint_checksums.txt"
+}
+
+check_tflint_rejected() {
+    local mode=$1
+    if run_tflint_case "${mode}" > "${test_root}/${mode}.log" 2>&1; then
+        return 1
+    fi
+    [ ! -e "${test_root}/${mode}/bin/tflint" ]
+}
\ No newline at end of file
diff --git a/test/terraform/tflint_checksum_fallback_test.sh b/test/terraform/tflint_checksum_fallback_test.sh
index 8ac8605d5..85fa76412 100644
--- a/test/terraform/tflint_checksum_fallback_test.sh
+++ b/test/terraform/tflint_checksum_fallback_test.sh
@@ -4,43 +4,31 @@ set -e
 
 source dev-container-features-test-lib
 
-TFLINT_VERSION="0.60.0"
-TFLINT_FILENAME="tflint_linux_amd64.zip"
-tflint_url="https://github.com/terraform-linters/tflint"
-checksum_attempts=0
-previous_version_requests=0
-downloaded_versions=()
-
-run_checksum_fallback() {
-    while ! download_tflint_checksums; do
-        current_tflint_version="${TFLINT_VERSION}"
-        find_prev_version_from_git_tags TFLINT_VERSION "$tflint_url"
-        if [ "${TFLINT_VERSION}" = "${current_tflint_version}" ]; then
-            return 1
-        fi
-        install_tflint "$TFLINT_VERSION"
-    done
-}
-
-download_tflint_checksums() {
-    checksum_attempts=$((checksum_attempts + 1))
-    [ "${checksum_attempts}" -gt 1 ]
-}
-
-find_prev_version_from_git_tags() {
-    previous_version_requests=$((previous_version_requests + 1))
-    TFLINT_VERSION="0.59.1"
-}
-
-install_tflint() {
-    downloaded_versions+=("$1")
-}
-
-run_checksum_fallback
-
-check "checksum download retried once" bash -c "[ \"${checksum_attempts}\" -eq 2 ]"
-check "previous tflint version requested once" bash -c "[ \"${previous_version_requests}\" -eq 1 ]"
-check "previous tflint archive downloaded" bash -c "[ \"${downloaded_versions[0]}\" = \"0.59.1\" ]"
-check "fallback resolved to previous tflint version" bash -c "[ \"${TFLINT_VERSION}\" = \"0.59.1\" ]"
+source "$(dirname "${BASH_SOURCE[0]}")/tflint_checksum_fallback_helper.sh"
+
+installer="${TFLINT_TEST_INSTALLER:-/usr/local/share/terraform/install.sh}"
+test_root=$(mktemp -d)
+trap 'rm -rf "${test_root}"' EXIT
+prepare_tflint_fixtures
+
+check "available checksums install the requested release" check_tflint_installation success 0.60.0
+check "missing checksums install the previous release" check_tflint_installation missing 0.59.1
+check "empty checksums trigger fallback" check_tflint_installation empty 0.59.1
+check "checksums without the archive entry trigger fallback" check_tflint_installation absent-entry 0.59.1
+check "empty archive triggers fallback" check_tflint_installation empty-archive 0.59.1
+check "Not Found archive triggers fallback" check_tflint_installation missing-archive 0.59.1
+check "multiple unavailable releases install matching archive and checksums" check_tflint_installation multiple 0.58.1
+check "each fallback downloads the replacement archive before its checksums" \
+    diff -u <(printf '%s\n' \
+        "0.60.0/${TFLINT_FILENAME}" 0.60.0/checksums.txt \
+        "0.59.1/${TFLINT_FILENAME}" 0.59.1/checksums.txt \
+        "0.58.1/${TFLINT_FILENAME}" 0.58.1/checksums.txt) "${test_root}/multiple/requests"
+check "checksum mismatch prevents installation" check_tflint_rejected corrupt
+check "checksum mismatch is reported" grep -F 'FAILED' "${test_root}/corrupt.log"
+check "unchanged previous version fails without installing" check_tflint_rejected stalled
+check "unchanged previous version stops after one attempt" \
+    test "$(wc -l < "${test_root}/stalled/fallbacks")" -eq 1
+check "exhausted fallback reports a useful error" \
+    grep -F 'Unable to find a tflint release with downloadable checksums.' "${test_root}/stalled.log"
 
 reportResults
diff --git a/test/terraform/tflint_checksum_fallback_test/Dockerfile b/test/terraform/tflint_checksum_fallback_test/Dockerfile
new file mode 100644
index 000000000..ce324efa1
--- /dev/null
+++ b/test/terraform/tflint_checksum_fallback_test/Dockerfile
@@ -0,0 +1,2 @@
+FROM mcr.microsoft.com/devcontainers/base:noble
+COPY terraform/install.sh /usr/local/share/terraform/install.sh
\ No newline at end of file

From e68cfc34c2503964d46cf9815829b895c67ab0a9 Mon Sep 17 00:00:00 2001
From: Kaniska <kaniska244@github.com>
Date: Tue, 3 Nov 2026 13:21:51 +0530
Subject: [PATCH 6/6] Update tflint checksum validation method

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 src/terraform/install.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/terraform/install.sh b/src/terraform/install.sh
index 0501ec88d..a5c74ff92 100755
--- a/src/terraform/install.sh
+++ b/src/terraform/install.sh
@@ -462,11 +462,11 @@ install_tflint() {
 }
 
 download_tflint_checksums() {
-    curl -fsSL -o /tmp/tf-downloads/tflint_checksums.txt "https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/checksums.txt"
+    curl -fsSL -o /tmp/tf-downloads/tflint_checksums.txt "https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/checksums.txt" || return 1
     if [ ! -s "/tmp/tf-downloads/${TFLINT_FILENAME}" ] || grep -q "Not Found" "/tmp/tf-downloads/${TFLINT_FILENAME}"; then
         return 1
     fi
-    grep -Fq "${TFLINT_FILENAME}" /tmp/tf-downloads/tflint_checksums.txt
+    awk -v filename="${TFLINT_FILENAME}" '$2 == filename || $2 == "*" filename { found = 1 } END { exit !found }' /tmp/tf-downloads/tflint_checksums.txt
 }
 
 install_tflint_with_checksum_fallback() {