Crate magma_plugin 

magma-plugin — HashiCorp go-plugin handshake + mTLS bootstrap + gRPC client lifecycle + subprocess management for Terraform / OpenTofu providers.

Load-bearing layer per theory/MAGMA.md §IV. Spawn a provider binary, complete the go-plugin handshake (magic cookie validation, stdout-handshake-line parse, mTLS cert exchange), and return a typed Plugin handle ready for gRPC calls.

Handshake protocol:

1. Parent generates a self-signed cert + key via rcgen; DER-encodes the cert; base64-encodes it; sets the env:
   • PLUGIN_MIN_PORT, PLUGIN_MAX_PORT (port range)
   • <MAGIC_COOKIE_KEY> = cookie value
   • PLUGIN_PROTOCOL_VERSIONS=5,6
   • PLUGIN_CLIENT_CERT=<base64 PEM>
2. Parent spawns provider as subprocess.
3. Provider validates magic cookie; exits 1 if mismatch.
4. Provider generates its own self-signed leaf cert, binds to a port in the allowed range, prints one handshake line: CORE_PROTOCOL|APP_PROTOCOL|NETWORK|ADDRESS|PROTO_TYPE|CERT.
5. Parent parses the line, builds a tonic gRPC Channel to the address. Production builds layer mTLS via tokio-rustls using parent_cert (own identity) + provider_cert (trusted root); M0 ships the plain TCP dial — the cert exchange happens but encryption layering ships in M0.x once tonic’s TLS config is pinned to a known-good rustls version pair.
6. Subsequent calls go over the gRPC channel.
7. Parent sends SIGTERM (then SIGKILL after grace period) on Drop.

Re-exports

pub use import::import_resource_state;

Modules

import

magma-plugin::import — the typed ImportResourceState gRPC client call.

provider

Typed provider-RPC wrappers (configure / plan / apply) over a dialed channel, speaking magma-cty values. The layer that makes apply real. Typed provider-RPC wrappers — the tfplugin5/6 Provider service over a dialed [Channel], speaking magma_cty values.

schema

Provider schema → cty implied type (terraform’s Block.ImpliedType). The bridge from GetProviderSchema to the magma-cty apply codec. Provider schema → cty implied type (terraform’s Block.ImpliedType).

Structs

H2Channel

A gRPC transport that drives a hyper HTTP/2 connection directly.

HandshakeLine

Result of parsing the provider’s stdout handshake line. Format: CORE_PROTOCOL|APP_PROTOCOL|NETWORK|ADDRESS|PROTO_TYPE|CERT.

ParentIdentity

Self-signed parent certificate generated for one Plugin spawn. Production: regenerate per-spawn (the cert is ephemeral, scoped to one provider session) so a leaked cert can’t compromise other providers spawned later.

Plugin

A live provider plugin. Holds the subprocess, the parsed handshake, the ephemeral parent identity used for mTLS, and (once dialed) the tonic gRPC Channel ready for typed RPC.

PluginSpec

Parameters required to spawn and handshake with a provider plugin.

ProviderCrash

A typed summary of a provider subprocess crash, assembled from the captured stderr/stdout crash-signal lines (and, best-effort, the process exit signal). Returned by Plugin::crash_summary iff any crash-signal line was seen. The operator’s anomaly classifier matches the typed EngineError::ProviderCrashed this enriches, never a substring.

Enums

PluginError

Functions

is_crash_line

Does a provider output line look like a runtime crash / fatal panic? Matches the documented Go-runtime fatal markers (case-insensitive). Used by the stderr/stdout drain tasks to route ONLY crash lines into the [CrashRing] (ordinary provider info logs stay at trace!).