Hotfix follow-up to v0.33.3. v0.33.3 made the lock-extender splice
emit both `h1:` and `zh:` for the other arch; this release fixes the
remaining apply failure that splice alone couldn't address.
Bug Fixes
- Apply-phase init now runs with `-lockfile=readonly` —
investigation of cdn-dev run 019eabff against the OpenTofu source
found the lock-extender splice is structurally worthless under
tofu's network_mirror code path. From
`internal/getproviders/http_mirror_source.go:223`, tofu only records
mirror-returned hashes for the target platform (TrustAllHashes
defaults to false); every spliced other-arch hash gets silently
dropped by apply-init. The 2-hash runtime lock then fails the
tfplan-recorded 4-hash check with "Inconsistent dependency lock
file". Passing `-lockfile=readonly` to apply-init makes tofu verify
but not rewrite (#471). Live A/B confirmed the lock is byte-identical
before and after.
Status
Stable — runner-image hotfix; no schema changes.
Full Changelog: v0.33.3...v0.33.4