Update mattermost library (#2152)

* Update mattermost library

* Fix linting

vendor/github.com/hashicorp/go-plugin/.gitignore

@@ -0,0 +1,2 @@
+.DS_Store
+.idea

vendor/github.com/hashicorp/go-plugin/CHANGELOG.md

@@ -0,0 +1,102 @@
+## v1.6.0
+
+CHANGES:
+
+* plugin: Plugins written in other languages can optionally start to advertise whether they support gRPC broker multiplexing.
+  If the environment variable `PLUGIN_MULTIPLEX_GRPC` is set, it is safe to include a seventh field containing a boolean 
+  value in the `|`-separated protocol negotiation line.
+
+ENHANCEMENTS:
+
+* Support muxing gRPC broker connections over a single listener [[GH-288](https://github.com/hashicorp/go-plugin/pull/288)]
+* client: Configurable buffer size for reading plugin log lines [[GH-265](https://github.com/hashicorp/go-plugin/pull/265)]
+* Use `buf` for proto generation [[GH-286](https://github.com/hashicorp/go-plugin/pull/286)]
+* deps: bump golang.org/x/net to v0.17.0 [[GH-285](https://github.com/hashicorp/go-plugin/pull/285)]
+* deps: bump golang.org/x/sys to v0.13.0 [[GH-285](https://github.com/hashicorp/go-plugin/pull/285)]
+* deps: bump golang.org/x/text to v0.13.0 [[GH-285](https://github.com/hashicorp/go-plugin/pull/285)]
+
+## v1.5.2
+
+ENHANCEMENTS:
+
+client: New `UnixSocketConfig.TempDir` option allows setting the directory to use when creating plugin-specific Unix socket directories [[GH-282](https://github.com/hashicorp/go-plugin/pull/282)]
+
+## v1.5.1
+
+BUGS:
+
+* server: `PLUGIN_UNIX_SOCKET_DIR` is consistently used for gRPC broker sockets as well as the initial socket [[GH-277](https://github.com/hashicorp/go-plugin/pull/277)]
+
+ENHANCEMENTS:
+
+* client: New `UnixSocketConfig` option in `ClientConfig` to support making the client's Unix sockets group-writable [[GH-277](https://github.com/hashicorp/go-plugin/pull/277)]
+
+## v1.5.0
+
+ENHANCEMENTS:
+
+* client: New `runner.Runner` interface to support clients providing custom plugin command runner implementations [[GH-270](https://github.com/hashicorp/go-plugin/pull/270)]
+    * Accessible via new `ClientConfig` field `RunnerFunc`, which is mutually exclusive with `Cmd` and `Reattach`
+    * Reattaching support via `ReattachConfig` field `ReattachFunc`
+* client: New `ClientConfig` field `SkipHostEnv` allows omitting the client process' own environment variables from the plugin command's environment [[GH-270](https://github.com/hashicorp/go-plugin/pull/270)]
+* client: Add `ID()` method to `Client` for retrieving the pid or other unique ID of a running plugin [[GH-272](https://github.com/hashicorp/go-plugin/pull/272)]
+* server: Support setting the directory to create Unix sockets in with the env var `PLUGIN_UNIX_SOCKET_DIR` [[GH-270](https://github.com/hashicorp/go-plugin/pull/270)]
+* server: Support setting group write permission and a custom group name or gid owner with the env var `PLUGIN_UNIX_SOCKET_GROUP` [[GH-270](https://github.com/hashicorp/go-plugin/pull/270)]
+
+## v1.4.11-rc1
+
+ENHANCEMENTS:
+
+* deps: bump protoreflect to v1.15.1 [[GH-264](https://github.com/hashicorp/go-plugin/pull/264)]
+
+## v1.4.10
+
+BUG FIXES:
+
+* additional notes: ensure to close files [[GH-241](https://github.com/hashicorp/go-plugin/pull/241)]
+
+ENHANCEMENTS:
+
+* deps: Remove direct dependency on golang.org/x/net [[GH-240](https://github.com/hashicorp/go-plugin/pull/240)]
+
+## v1.4.9
+
+ENHANCEMENTS:
+
+* client: Remove log warning introduced in 1.4.5 when SecureConfig is nil. [[GH-238](https://github.com/hashicorp/go-plugin/pull/238)]
+
+## v1.4.8
+
+BUG FIXES:
+
+* Fix windows build: [[GH-227](https://github.com/hashicorp/go-plugin/pull/227)]
+
+## v1.4.7
+
+ENHANCEMENTS:
+
+* More detailed error message on plugin start failure: [[GH-223](https://github.com/hashicorp/go-plugin/pull/223)]
+
+## v1.4.6
+
+BUG FIXES:
+
+* server: Prevent gRPC broker goroutine leak when using `GRPCServer` type `GracefulStop()` or `Stop()` methods [[GH-220](https://github.com/hashicorp/go-plugin/pull/220)]
+
+## v1.4.5
+
+ENHANCEMENTS:
+
+* client: log warning when SecureConfig is nil [[GH-207](https://github.com/hashicorp/go-plugin/pull/207)]
+
+
+## v1.4.4
+
+ENHANCEMENTS:
+
+* client: increase level of plugin exit logs [[GH-195](https://github.com/hashicorp/go-plugin/pull/195)]
+
+BUG FIXES:
+
+* Bidirectional communication: fix bidirectional communication when AutoMTLS is enabled [[GH-193](https://github.com/hashicorp/go-plugin/pull/193)]
+* RPC: Trim a spurious log message for plugins using RPC [[GH-186](https://github.com/hashicorp/go-plugin/pull/186)]

vendor/github.com/hashicorp/go-plugin/LICENSE

@@ -0,0 +1,355 @@
+Copyright (c) 2016 HashiCorp, Inc.
+
+Mozilla Public License, version 2.0
+
+1. Definitions
+
+1.1. “Contributor”
+
+     means each individual or legal entity that creates, contributes to the
+     creation of, or owns Covered Software.
+
+1.2. “Contributor Version”
+
+     means the combination of the Contributions of others (if any) used by a
+     Contributor and that particular Contributor’s Contribution.
+
+1.3. “Contribution”
+
+     means Covered Software of a particular Contributor.
+
+1.4. “Covered Software”
+
+     means Source Code Form to which the initial Contributor has attached the
+     notice in Exhibit A, the Executable Form of such Source Code Form, and
+     Modifications of such Source Code Form, in each case including portions
+     thereof.
+
+1.5. “Incompatible With Secondary Licenses”
+     means
+
+     a. that the initial Contributor has attached the notice described in
+        Exhibit B to the Covered Software; or
+
+     b. that the Covered Software was made available under the terms of version
+        1.1 or earlier of the License, but not also under the terms of a
+        Secondary License.
+
+1.6. “Executable Form”
+
+     means any form of the work other than Source Code Form.
+
+1.7. “Larger Work”
+
+     means a work that combines Covered Software with other material, in a separate
+     file or files, that is not Covered Software.
+
+1.8. “License”
+
+     means this document.
+
+1.9. “Licensable”
+
+     means having the right to grant, to the maximum extent possible, whether at the
+     time of the initial grant or subsequently, any and all of the rights conveyed by
+     this License.
+
+1.10. “Modifications”
+
+     means any of the following:
+
+     a. any file in Source Code Form that results from an addition to, deletion
+        from, or modification of the contents of Covered Software; or
+
+     b. any new file in Source Code Form that contains any Covered Software.
+
+1.11. “Patent Claims” of a Contributor
+
+      means any patent claim(s), including without limitation, method, process,
+      and apparatus claims, in any patent Licensable by such Contributor that
+      would be infringed, but for the grant of the License, by the making,
+      using, selling, offering for sale, having made, import, or transfer of
+      either its Contributions or its Contributor Version.
+
+1.12. “Secondary License”
+
+      means either the GNU General Public License, Version 2.0, the GNU Lesser
+      General Public License, Version 2.1, the GNU Affero General Public
+      License, Version 3.0, or any later versions of those licenses.
+
+1.13. “Source Code Form”
+
+      means the form of the work preferred for making modifications.
+
+1.14. “You” (or “Your”)
+
+      means an individual or a legal entity exercising rights under this
+      License. For legal entities, “You” includes any entity that controls, is
+      controlled by, or is under common control with You. For purposes of this
+      definition, “control” means (a) the power, direct or indirect, to cause
+      the direction or management of such entity, whether by contract or
+      otherwise, or (b) ownership of more than fifty percent (50%) of the
+      outstanding shares or beneficial ownership of such entity.
+
+
+2. License Grants and Conditions
+
+2.1. Grants
+
+     Each Contributor hereby grants You a world-wide, royalty-free,
+     non-exclusive license:
+
+     a. under intellectual property rights (other than patent or trademark)
+        Licensable by such Contributor to use, reproduce, make available,
+        modify, display, perform, distribute, and otherwise exploit its
+        Contributions, either on an unmodified basis, with Modifications, or as
+        part of a Larger Work; and
+
+     b. under Patent Claims of such Contributor to make, use, sell, offer for
+        sale, have made, import, and otherwise transfer either its Contributions
+        or its Contributor Version.
+
+2.2. Effective Date
+
+     The licenses granted in Section 2.1 with respect to any Contribution become
+     effective for each Contribution on the date the Contributor first distributes
+     such Contribution.
+
+2.3. Limitations on Grant Scope
+
+     The licenses granted in this Section 2 are the only rights granted under this
+     License. No additional rights or licenses will be implied from the distribution
+     or licensing of Covered Software under this License. Notwithstanding Section
+     2.1(b) above, no patent license is granted by a Contributor:
+
+     a. for any code that a Contributor has removed from Covered Software; or
+
+     b. for infringements caused by: (i) Your and any other third party’s
+        modifications of Covered Software, or (ii) the combination of its
+        Contributions with other software (except as part of its Contributor
+        Version); or
+
+     c. under Patent Claims infringed by Covered Software in the absence of its
+        Contributions.
+
+     This License does not grant any rights in the trademarks, service marks, or
+     logos of any Contributor (except as may be necessary to comply with the
+     notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+     No Contributor makes additional grants as a result of Your choice to
+     distribute the Covered Software under a subsequent version of this License
+     (see Section 10.2) or under the terms of a Secondary License (if permitted
+     under the terms of Section 3.3).
+
+2.5. Representation
+
+     Each Contributor represents that the Contributor believes its Contributions
+     are its original creation(s) or it has sufficient rights to grant the
+     rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+     This License is not intended to limit any rights You have under applicable
+     copyright doctrines of fair use, fair dealing, or other equivalents.
+
+2.7. Conditions
+
+     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
+     Section 2.1.
+
+
+3. Responsibilities
+
+3.1. Distribution of Source Form
+
+     All distribution of Covered Software in Source Code Form, including any
+     Modifications that You create or to which You contribute, must be under the
+     terms of this License. You must inform recipients that the Source Code Form
+     of the Covered Software is governed by the terms of this License, and how
+     they can obtain a copy of this License. You may not attempt to alter or
+     restrict the recipients’ rights in the Source Code Form.
+
+3.2. Distribution of Executable Form
+
+     If You distribute Covered Software in Executable Form then:
+
+     a. such Covered Software must also be made available in Source Code Form,
+        as described in Section 3.1, and You must inform recipients of the
+        Executable Form how they can obtain a copy of such Source Code Form by
+        reasonable means in a timely manner, at a charge no more than the cost
+        of distribution to the recipient; and
+
+     b. You may distribute such Executable Form under the terms of this License,
+        or sublicense it under different terms, provided that the license for
+        the Executable Form does not attempt to limit or alter the recipients’
+        rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+     You may create and distribute a Larger Work under terms of Your choice,
+     provided that You also comply with the requirements of this License for the
+     Covered Software. If the Larger Work is a combination of Covered Software
+     with a work governed by one or more Secondary Licenses, and the Covered
+     Software is not Incompatible With Secondary Licenses, this License permits
+     You to additionally distribute such Covered Software under the terms of
+     such Secondary License(s), so that the recipient of the Larger Work may, at
+     their option, further distribute the Covered Software under the terms of
+     either this License or such Secondary License(s).
+
+3.4. Notices
+
+     You may not remove or alter the substance of any license notices (including
+     copyright notices, patent notices, disclaimers of warranty, or limitations
+     of liability) contained within the Source Code Form of the Covered
+     Software, except that You may alter any license notices to the extent
+     required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+     You may choose to offer, and to charge a fee for, warranty, support,
+     indemnity or liability obligations to one or more recipients of Covered
+     Software. However, You may do so only on Your own behalf, and not on behalf
+     of any Contributor. You must make it absolutely clear that any such
+     warranty, support, indemnity, or liability obligation is offered by You
+     alone, and You hereby agree to indemnify every Contributor for any
+     liability incurred by such Contributor as a result of warranty, support,
+     indemnity or liability terms You offer. You may include additional
+     disclaimers of warranty and limitations of liability specific to any
+     jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+
+   If it is impossible for You to comply with any of the terms of this License
+   with respect to some or all of the Covered Software due to statute, judicial
+   order, or regulation then You must: (a) comply with the terms of this License
+   to the maximum extent possible; and (b) describe the limitations and the code
+   they affect. Such description must be placed in a text file included with all
+   distributions of the Covered Software under this License. Except to the
+   extent prohibited by statute or regulation, such description must be
+   sufficiently detailed for a recipient of ordinary skill to be able to
+   understand it.
+
+5. Termination
+
+5.1. The rights granted under this License will terminate automatically if You
+     fail to comply with any of its terms. However, if You become compliant,
+     then the rights granted under this License from a particular Contributor
+     are reinstated (a) provisionally, unless and until such Contributor
+     explicitly and finally terminates Your grants, and (b) on an ongoing basis,
+     if such Contributor fails to notify You of the non-compliance by some
+     reasonable means prior to 60 days after You have come back into compliance.
+     Moreover, Your grants from a particular Contributor are reinstated on an
+     ongoing basis if such Contributor notifies You of the non-compliance by
+     some reasonable means, this is the first time You have received notice of
+     non-compliance with this License from such Contributor, and You become
+     compliant prior to 30 days after Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+     infringement claim (excluding declaratory judgment actions, counter-claims,
+     and cross-claims) alleging that a Contributor Version directly or
+     indirectly infringes any patent, then the rights granted to You by any and
+     all Contributors for the Covered Software under Section 2.1 of this License
+     shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
+     license agreements (excluding distributors and resellers) which have been
+     validly granted by You or Your distributors under this License prior to
+     termination shall survive termination.
+
+6. Disclaimer of Warranty
+
+   Covered Software is provided under this License on an “as is” basis, without
+   warranty of any kind, either expressed, implied, or statutory, including,
+   without limitation, warranties that the Covered Software is free of defects,
+   merchantable, fit for a particular purpose or non-infringing. The entire
+   risk as to the quality and performance of the Covered Software is with You.
+   Should any Covered Software prove defective in any respect, You (not any
+   Contributor) assume the cost of any necessary servicing, repair, or
+   correction. This disclaimer of warranty constitutes an essential part of this
+   License. No use of  any Covered Software is authorized under this License
+   except under this disclaimer.
+
+7. Limitation of Liability
+
+   Under no circumstances and under no legal theory, whether tort (including
+   negligence), contract, or otherwise, shall any Contributor, or anyone who
+   distributes Covered Software as permitted above, be liable to You for any
+   direct, indirect, special, incidental, or consequential damages of any
+   character including, without limitation, damages for lost profits, loss of
+   goodwill, work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses, even if such party shall have been
+   informed of the possibility of such damages. This limitation of liability
+   shall not apply to liability for death or personal injury resulting from such
+   party’s negligence to the extent applicable law prohibits such limitation.
+   Some jurisdictions do not allow the exclusion or limitation of incidental or
+   consequential damages, so this exclusion and limitation may not apply to You.
+
+8. Litigation
+
+   Any litigation relating to this License may be brought only in the courts of
+   a jurisdiction where the defendant maintains its principal place of business
+   and such litigation shall be governed by laws of that jurisdiction, without
+   reference to its conflict-of-law provisions. Nothing in this Section shall
+   prevent a party’s ability to bring cross-claims or counter-claims.
+
+9. Miscellaneous
+
+   This License represents the complete agreement concerning the subject matter
+   hereof. If any provision of this License is held to be unenforceable, such
+   provision shall be reformed only to the extent necessary to make it
+   enforceable. Any law or regulation which provides that the language of a
+   contract shall be construed against the drafter shall not be used to construe
+   this License against a Contributor.
+
+
+10. Versions of the License
+
+10.1. New Versions
+
+      Mozilla Foundation is the license steward. Except as provided in Section
+      10.3, no one other than the license steward has the right to modify or
+      publish new versions of this License. Each version will be given a
+      distinguishing version number.
+
+10.2. Effect of New Versions
+
+      You may distribute the Covered Software under the terms of the version of
+      the License under which You originally received the Covered Software, or
+      under the terms of any subsequent version published by the license
+      steward.
+
+10.3. Modified Versions
+
+      If you create software not governed by this License, and you want to
+      create a new license for such software, you may create and use a modified
+      version of this License if you rename the license and remove any
+      references to the name of the license steward (except to note that such
+      modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary Licenses
+      If You choose to distribute Source Code Form that is Incompatible With
+      Secondary Licenses under the terms of this version of the License, the
+      notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+
+      This Source Code Form is subject to the
+      terms of the Mozilla Public License, v.
+      2.0. If a copy of the MPL was not
+      distributed with this file, You can
+      obtain one at
+      http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular file, then
+You may include the notice in a location (such as a LICENSE file in a relevant
+directory) where a recipient would be likely to look for such a notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - “Incompatible With Secondary Licenses” Notice
+
+      This Source Code Form is “Incompatible
+      With Secondary Licenses”, as defined by
+      the Mozilla Public License, v. 2.0.

vendor/github.com/hashicorp/go-plugin/README.md

@@ -0,0 +1,165 @@
+# Go Plugin System over RPC
+
+`go-plugin` is a Go (golang) plugin system over RPC. It is the plugin system
+that has been in use by HashiCorp tooling for over 4 years. While initially
+created for [Packer](https://www.packer.io), it is additionally in use by
+[Terraform](https://www.terraform.io), [Nomad](https://www.nomadproject.io),
+[Vault](https://www.vaultproject.io),
+[Boundary](https://www.boundaryproject.io),
+and [Waypoint](https://www.waypointproject.io).
+
+While the plugin system is over RPC, it is currently only designed to work
+over a local [reliable] network. Plugins over a real network are not supported
+and will lead to unexpected behavior.
+
+This plugin system has been used on millions of machines across many different
+projects and has proven to be battle hardened and ready for production use.
+
+## Features
+
+The HashiCorp plugin system supports a number of features:
+
+**Plugins are Go interface implementations.** This makes writing and consuming
+plugins feel very natural. To a plugin author: you just implement an
+interface as if it were going to run in the same process. For a plugin user:
+you just use and call functions on an interface as if it were in the same
+process. This plugin system handles the communication in between.
+
+**Cross-language support.** Plugins can be written (and consumed) by
+almost every major language. This library supports serving plugins via
+[gRPC](http://www.grpc.io). gRPC-based plugins enable plugins to be written
+in any language.
+
+**Complex arguments and return values are supported.** This library
+provides APIs for handling complex arguments and return values such
+as interfaces, `io.Reader/Writer`, etc. We do this by giving you a library
+(`MuxBroker`) for creating new connections between the client/server to
+serve additional interfaces or transfer raw data.
+
+**Bidirectional communication.** Because the plugin system supports
+complex arguments, the host process can send it interface implementations
+and the plugin can call back into the host process.
+
+**Built-in Logging.** Any plugins that use the `log` standard library
+will have log data automatically sent to the host process. The host
+process will mirror this output prefixed with the path to the plugin
+binary. This makes debugging with plugins simple. If the host system
+uses [hclog](https://github.com/hashicorp/go-hclog) then the log data
+will be structured. If the plugin also uses hclog, logs from the plugin
+will be sent to the host hclog and be structured.
+
+**Protocol Versioning.** A very basic "protocol version" is supported that
+can be incremented to invalidate any previous plugins. This is useful when
+interface signatures are changing, protocol level changes are necessary,
+etc. When a protocol version is incompatible, a human friendly error
+message is shown to the end user.
+
+**Stdout/Stderr Syncing.** While plugins are subprocesses, they can continue
+to use stdout/stderr as usual and the output will get mirrored back to
+the host process. The host process can control what `io.Writer` these
+streams go to to prevent this from happening.
+
+**TTY Preservation.** Plugin subprocesses are connected to the identical
+stdin file descriptor as the host process, allowing software that requires
+a TTY to work. For example, a plugin can execute `ssh` and even though there
+are multiple subprocesses and RPC happening, it will look and act perfectly
+to the end user.
+
+**Host upgrade while a plugin is running.** Plugins can be "reattached"
+so that the host process can be upgraded while the plugin is still running.
+This requires the host/plugin to know this is possible and daemonize
+properly. `NewClient` takes a `ReattachConfig` to determine if and how to
+reattach.
+
+**Cryptographically Secure Plugins.** Plugins can be verified with an expected
+checksum and RPC communications can be configured to use TLS. The host process
+must be properly secured to protect this configuration.
+
+## Architecture
+
+The HashiCorp plugin system works by launching subprocesses and communicating
+over RPC (using standard `net/rpc` or [gRPC](http://www.grpc.io)). A single
+connection is made between any plugin and the host process. For net/rpc-based
+plugins, we use a [connection multiplexing](https://github.com/hashicorp/yamux)
+library to multiplex any other connections on top. For gRPC-based plugins,
+the HTTP2 protocol handles multiplexing.
+
+This architecture has a number of benefits:
+
+  * Plugins can't crash your host process: A panic in a plugin doesn't
+    panic the plugin user.
+
+  * Plugins are very easy to write: just write a Go application and `go build`.
+    Or use any other language to write a gRPC server with a tiny amount of
+    boilerplate to support go-plugin.
+
+  * Plugins are very easy to install: just put the binary in a location where
+    the host will find it (depends on the host but this library also provides
+    helpers), and the plugin host handles the rest.
+
+  * Plugins can be relatively secure: The plugin only has access to the
+    interfaces and args given to it, not to the entire memory space of the
+    process. Additionally, go-plugin can communicate with the plugin over
+    TLS.
+
+## Usage
+
+To use the plugin system, you must take the following steps. These are
+high-level steps that must be done. Examples are available in the
+`examples/` directory.
+
+  1. Choose the interface(s) you want to expose for plugins.
+
+  2. For each interface, implement an implementation of that interface
+     that communicates over a `net/rpc` connection or over a
+     [gRPC](http://www.grpc.io) connection or both. You'll have to implement
+     both a client and server implementation.
+
+  3. Create a `Plugin` implementation that knows how to create the RPC
+     client/server for a given plugin type.
+
+  4. Plugin authors call `plugin.Serve` to serve a plugin from the
+     `main` function.
+
+  5. Plugin users use `plugin.Client` to launch a subprocess and request
+     an interface implementation over RPC.
+
+That's it! In practice, step 2 is the most tedious and time consuming step.
+Even so, it isn't very difficult and you can see examples in the `examples/`
+directory as well as throughout our various open source projects.
+
+For complete API documentation, see [GoDoc](https://godoc.org/github.com/hashicorp/go-plugin).
+
+## Roadmap
+
+Our plugin system is constantly evolving. As we use the plugin system for
+new projects or for new features in existing projects, we constantly find
+improvements we can make.
+
+At this point in time, the roadmap for the plugin system is:
+
+**Semantic Versioning.** Plugins will be able to implement a semantic version.
+This plugin system will give host processes a system for constraining
+versions. This is in addition to the protocol versioning already present
+which is more for larger underlying changes.
+
+## What About Shared Libraries?
+
+When we started using plugins (late 2012, early 2013), plugins over RPC
+were the only option since Go didn't support dynamic library loading. Today,
+Go supports the [plugin](https://golang.org/pkg/plugin/) standard library with
+a number of  limitations. Since 2012, our plugin system has stabilized 
+from tens of millions of users using it, and has many benefits we've come to 
+value greatly.
+
+For example, we use this plugin system in
+[Vault](https://www.vaultproject.io) where dynamic library loading is
+not acceptable for security reasons. That is an extreme
+example, but we believe our library system has more upsides than downsides
+over dynamic library loading and since we've had it built and tested for years,
+we'll continue to use it.
+
+Shared libraries have one major advantage over our system which is much
+higher performance. In real world scenarios across our various tools,
+we've never required any more performance out of our plugin system and it
+has seen very high throughput, so this isn't a concern for us at the moment.

vendor/github.com/hashicorp/go-plugin/buf.gen.yaml

@@ -0,0 +1,14 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+version: v1
+plugins:
+  - plugin: buf.build/protocolbuffers/go
+    out: .
+    opt:
+      - paths=source_relative
+  - plugin: buf.build/grpc/go:v1.3.0
+    out: .
+    opt:
+      - paths=source_relative
+      - require_unimplemented_servers=false

vendor/github.com/hashicorp/go-plugin/buf.yaml

@@ -0,0 +1,7 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+version: v1
+build:
+  excludes:
+    - examples/

vendor/github.com/hashicorp/go-plugin/constants.go

@@ -0,0 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+const (
+	// EnvUnixSocketDir specifies the directory that _plugins_ should create unix
+	// sockets in. Does not affect client behavior.
+	EnvUnixSocketDir = "PLUGIN_UNIX_SOCKET_DIR"
+
+	// EnvUnixSocketGroup specifies the owning, writable group to set for Unix
+	// sockets created by _plugins_. Does not affect client behavior.
+	EnvUnixSocketGroup = "PLUGIN_UNIX_SOCKET_GROUP"
+
+	envMultiplexGRPC = "PLUGIN_MULTIPLEX_GRPC"
+)

vendor/github.com/hashicorp/go-plugin/discover.go

@@ -0,0 +1,31 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"path/filepath"
+)
+
+// Discover discovers plugins that are in a given directory.
+//
+// The directory doesn't need to be absolute. For example, "." will work fine.
+//
+// This currently assumes any file matching the glob is a plugin.
+// In the future this may be smarter about checking that a file is
+// executable and so on.
+//
+// TODO: test
+func Discover(glob, dir string) ([]string, error) {
+	var err error
+
+	// Make the directory absolute if it isn't already
+	if !filepath.IsAbs(dir) {
+		dir, err = filepath.Abs(dir)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return filepath.Glob(filepath.Join(dir, glob))
+}

vendor/github.com/hashicorp/go-plugin/error.go

@@ -0,0 +1,27 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+// This is a type that wraps error types so that they can be messaged
+// across RPC channels. Since "error" is an interface, we can't always
+// gob-encode the underlying structure. This is a valid error interface
+// implementer that we will push across.
+type BasicError struct {
+	Message string
+}
+
+// NewBasicError is used to create a BasicError.
+//
+// err is allowed to be nil.
+func NewBasicError(err error) *BasicError {
+	if err == nil {
+		return nil
+	}
+
+	return &BasicError{err.Error()}
+}
+
+func (e *BasicError) Error() string {
+	return e.Message
+}

vendor/github.com/hashicorp/go-plugin/grpc_broker.go

@@ -0,0 +1,654 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"log"
+	"net"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/hashicorp/go-plugin/internal/grpcmux"
+	"github.com/hashicorp/go-plugin/internal/plugin"
+	"github.com/hashicorp/go-plugin/runner"
+
+	"github.com/oklog/run"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+)
+
+// streamer interface is used in the broker to send/receive connection
+// information.
+type streamer interface {
+	Send(*plugin.ConnInfo) error
+	Recv() (*plugin.ConnInfo, error)
+	Close()
+}
+
+// sendErr is used to pass errors back during a send.
+type sendErr struct {
+	i  *plugin.ConnInfo
+	ch chan error
+}
+
+// gRPCBrokerServer is used by the plugin to start a stream and to send
+// connection information to/from the plugin. Implements GRPCBrokerServer and
+// streamer interfaces.
+type gRPCBrokerServer struct {
+	plugin.UnimplementedGRPCBrokerServer
+
+	// send is used to send connection info to the gRPC stream.
+	send chan *sendErr
+
+	// recv is used to receive connection info from the gRPC stream.
+	recv chan *plugin.ConnInfo
+
+	// quit closes down the stream.
+	quit chan struct{}
+
+	// o is used to ensure we close the quit channel only once.
+	o sync.Once
+}
+
+func newGRPCBrokerServer() *gRPCBrokerServer {
+	return &gRPCBrokerServer{
+		send: make(chan *sendErr),
+		recv: make(chan *plugin.ConnInfo),
+		quit: make(chan struct{}),
+	}
+}
+
+// StartStream implements the GRPCBrokerServer interface and will block until
+// the quit channel is closed or the context reports Done. The stream will pass
+// connection information to/from the client.
+func (s *gRPCBrokerServer) StartStream(stream plugin.GRPCBroker_StartStreamServer) error {
+	doneCh := stream.Context().Done()
+	defer s.Close()
+
+	// Proccess send stream
+	go func() {
+		for {
+			select {
+			case <-doneCh:
+				return
+			case <-s.quit:
+				return
+			case se := <-s.send:
+				err := stream.Send(se.i)
+				se.ch <- err
+			}
+		}
+	}()
+
+	// Process receive stream
+	for {
+		i, err := stream.Recv()
+		if err != nil {
+			return err
+		}
+		select {
+		case <-doneCh:
+			return nil
+		case <-s.quit:
+			return nil
+		case s.recv <- i:
+		}
+	}
+
+	return nil
+}
+
+// Send is used by the GRPCBroker to pass connection information into the stream
+// to the client.
+func (s *gRPCBrokerServer) Send(i *plugin.ConnInfo) error {
+	ch := make(chan error)
+	defer close(ch)
+
+	select {
+	case <-s.quit:
+		return errors.New("broker closed")
+	case s.send <- &sendErr{
+		i:  i,
+		ch: ch,
+	}:
+	}
+
+	return <-ch
+}
+
+// Recv is used by the GRPCBroker to pass connection information that has been
+// sent from the client from the stream to the broker.
+func (s *gRPCBrokerServer) Recv() (*plugin.ConnInfo, error) {
+	select {
+	case <-s.quit:
+		return nil, errors.New("broker closed")
+	case i := <-s.recv:
+		return i, nil
+	}
+}
+
+// Close closes the quit channel, shutting down the stream.
+func (s *gRPCBrokerServer) Close() {
+	s.o.Do(func() {
+		close(s.quit)
+	})
+}
+
+// gRPCBrokerClientImpl is used by the client to start a stream and to send
+// connection information to/from the client. Implements GRPCBrokerClient and
+// streamer interfaces.
+type gRPCBrokerClientImpl struct {
+	// client is the underlying GRPC client used to make calls to the server.
+	client plugin.GRPCBrokerClient
+
+	// send is used to send connection info to the gRPC stream.
+	send chan *sendErr
+
+	// recv is used to receive connection info from the gRPC stream.
+	recv chan *plugin.ConnInfo
+
+	// quit closes down the stream.
+	quit chan struct{}
+
+	// o is used to ensure we close the quit channel only once.
+	o sync.Once
+}
+
+func newGRPCBrokerClient(conn *grpc.ClientConn) *gRPCBrokerClientImpl {
+	return &gRPCBrokerClientImpl{
+		client: plugin.NewGRPCBrokerClient(conn),
+		send:   make(chan *sendErr),
+		recv:   make(chan *plugin.ConnInfo),
+		quit:   make(chan struct{}),
+	}
+}
+
+// StartStream implements the GRPCBrokerClient interface and will block until
+// the quit channel is closed or the context reports Done. The stream will pass
+// connection information to/from the plugin.
+func (s *gRPCBrokerClientImpl) StartStream() error {
+	ctx, cancelFunc := context.WithCancel(context.Background())
+	defer cancelFunc()
+	defer s.Close()
+
+	stream, err := s.client.StartStream(ctx)
+	if err != nil {
+		return err
+	}
+	doneCh := stream.Context().Done()
+
+	go func() {
+		for {
+			select {
+			case <-doneCh:
+				return
+			case <-s.quit:
+				return
+			case se := <-s.send:
+				err := stream.Send(se.i)
+				se.ch <- err
+			}
+		}
+	}()
+
+	for {
+		i, err := stream.Recv()
+		if err != nil {
+			return err
+		}
+		select {
+		case <-doneCh:
+			return nil
+		case <-s.quit:
+			return nil
+		case s.recv <- i:
+		}
+	}
+
+	return nil
+}
+
+// Send is used by the GRPCBroker to pass connection information into the stream
+// to the plugin.
+func (s *gRPCBrokerClientImpl) Send(i *plugin.ConnInfo) error {
+	ch := make(chan error)
+	defer close(ch)
+
+	select {
+	case <-s.quit:
+		return errors.New("broker closed")
+	case s.send <- &sendErr{
+		i:  i,
+		ch: ch,
+	}:
+	}
+
+	return <-ch
+}
+
+// Recv is used by the GRPCBroker to pass connection information that has been
+// sent from the plugin to the broker.
+func (s *gRPCBrokerClientImpl) Recv() (*plugin.ConnInfo, error) {
+	select {
+	case <-s.quit:
+		return nil, errors.New("broker closed")
+	case i := <-s.recv:
+		return i, nil
+	}
+}
+
+// Close closes the quit channel, shutting down the stream.
+func (s *gRPCBrokerClientImpl) Close() {
+	s.o.Do(func() {
+		close(s.quit)
+	})
+}
+
+// GRPCBroker is responsible for brokering connections by unique ID.
+//
+// It is used by plugins to create multiple gRPC connections and data
+// streams between the plugin process and the host process.
+//
+// This allows a plugin to request a channel with a specific ID to connect to
+// or accept a connection from, and the broker handles the details of
+// holding these channels open while they're being negotiated.
+//
+// The Plugin interface has access to these for both Server and Client.
+// The broker can be used by either (optionally) to reserve and connect to
+// new streams. This is useful for complex args and return values,
+// or anything else you might need a data stream for.
+type GRPCBroker struct {
+	nextId   uint32
+	streamer streamer
+	tls      *tls.Config
+	doneCh   chan struct{}
+	o        sync.Once
+
+	clientStreams map[uint32]*gRPCBrokerPending
+	serverStreams map[uint32]*gRPCBrokerPending
+
+	unixSocketCfg  UnixSocketConfig
+	addrTranslator runner.AddrTranslator
+
+	dialMutex sync.Mutex
+
+	muxer grpcmux.GRPCMuxer
+
+	sync.Mutex
+}
+
+type gRPCBrokerPending struct {
+	ch     chan *plugin.ConnInfo
+	doneCh chan struct{}
+	once   sync.Once
+}
+
+func newGRPCBroker(s streamer, tls *tls.Config, unixSocketCfg UnixSocketConfig, addrTranslator runner.AddrTranslator, muxer grpcmux.GRPCMuxer) *GRPCBroker {
+	return &GRPCBroker{
+		streamer: s,
+		tls:      tls,
+		doneCh:   make(chan struct{}),
+
+		clientStreams: make(map[uint32]*gRPCBrokerPending),
+		serverStreams: make(map[uint32]*gRPCBrokerPending),
+		muxer:         muxer,
+
+		unixSocketCfg:  unixSocketCfg,
+		addrTranslator: addrTranslator,
+	}
+}
+
+// Accept accepts a connection by ID.
+//
+// This should not be called multiple times with the same ID at one time.
+func (b *GRPCBroker) Accept(id uint32) (net.Listener, error) {
+	if b.muxer.Enabled() {
+		p := b.getServerStream(id)
+		go func() {
+			err := b.listenForKnocks(id)
+			if err != nil {
+				log.Printf("[ERR]: error listening for knocks, id: %d, error: %s", id, err)
+			}
+		}()
+
+		ln, err := b.muxer.Listener(id, p.doneCh)
+		if err != nil {
+			return nil, err
+		}
+
+		ln = &rmListener{
+			Listener: ln,
+			close: func() error {
+				// We could have multiple listeners on the same ID, so use sync.Once
+				// for closing doneCh to ensure we don't get a panic.
+				p.once.Do(func() {
+					close(p.doneCh)
+				})
+
+				b.Lock()
+				defer b.Unlock()
+
+				// No longer need to listen for knocks once the listener is closed.
+				delete(b.serverStreams, id)
+
+				return nil
+			},
+		}
+
+		return ln, nil
+	}
+
+	listener, err := serverListener(b.unixSocketCfg)
+	if err != nil {
+		return nil, err
+	}
+
+	advertiseNet := listener.Addr().Network()
+	advertiseAddr := listener.Addr().String()
+	if b.addrTranslator != nil {
+		advertiseNet, advertiseAddr, err = b.addrTranslator.HostToPlugin(advertiseNet, advertiseAddr)
+		if err != nil {
+			return nil, err
+		}
+	}
+	err = b.streamer.Send(&plugin.ConnInfo{
+		ServiceId: id,
+		Network:   advertiseNet,
+		Address:   advertiseAddr,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return listener, nil
+}
+
+// AcceptAndServe is used to accept a specific stream ID and immediately
+// serve a gRPC server on that stream ID. This is used to easily serve
+// complex arguments. Each AcceptAndServe call opens a new listener socket and
+// sends the connection info down the stream to the dialer. Since a new
+// connection is opened every call, these calls should be used sparingly.
+// Multiple gRPC server implementations can be registered to a single
+// AcceptAndServe call.
+func (b *GRPCBroker) AcceptAndServe(id uint32, newGRPCServer func([]grpc.ServerOption) *grpc.Server) {
+	ln, err := b.Accept(id)
+	if err != nil {
+		log.Printf("[ERR] plugin: plugin acceptAndServe error: %s", err)
+		return
+	}
+	defer ln.Close()
+
+	var opts []grpc.ServerOption
+	if b.tls != nil {
+		opts = []grpc.ServerOption{grpc.Creds(credentials.NewTLS(b.tls))}
+	}
+
+	server := newGRPCServer(opts)
+
+	// Here we use a run group to close this goroutine if the server is shutdown
+	// or the broker is shutdown.
+	var g run.Group
+	{
+		// Serve on the listener, if shutting down call GracefulStop.
+		g.Add(func() error {
+			return server.Serve(ln)
+		}, func(err error) {
+			server.GracefulStop()
+		})
+	}
+	{
+		// block on the closeCh or the doneCh. If we are shutting down close the
+		// closeCh.
+		closeCh := make(chan struct{})
+		g.Add(func() error {
+			select {
+			case <-b.doneCh:
+			case <-closeCh:
+			}
+			return nil
+		}, func(err error) {
+			close(closeCh)
+		})
+	}
+
+	// Block until we are done
+	g.Run()
+}
+
+// Close closes the stream and all servers.
+func (b *GRPCBroker) Close() error {
+	b.streamer.Close()
+	b.o.Do(func() {
+		close(b.doneCh)
+	})
+	return nil
+}
+
+func (b *GRPCBroker) listenForKnocks(id uint32) error {
+	p := b.getServerStream(id)
+	for {
+		select {
+		case msg := <-p.ch:
+			// Shouldn't be possible.
+			if msg.ServiceId != id {
+				return fmt.Errorf("knock received with wrong service ID; expected %d but got %d", id, msg.ServiceId)
+			}
+
+			// Also shouldn't be possible.
+			if msg.Knock == nil || !msg.Knock.Knock || msg.Knock.Ack {
+				return fmt.Errorf("knock received for service ID %d with incorrect values; knock=%+v", id, msg.Knock)
+			}
+
+			// Successful knock, open the door for the given ID.
+			var ackError string
+			err := b.muxer.AcceptKnock(id)
+			if err != nil {
+				ackError = err.Error()
+			}
+
+			// Send back an acknowledgement to allow the client to start dialling.
+			err = b.streamer.Send(&plugin.ConnInfo{
+				ServiceId: id,
+				Knock: &plugin.ConnInfo_Knock{
+					Knock: true,
+					Ack:   true,
+					Error: ackError,
+				},
+			})
+			if err != nil {
+				return fmt.Errorf("error sending back knock acknowledgement: %w", err)
+			}
+		case <-p.doneCh:
+			return nil
+		}
+	}
+}
+
+func (b *GRPCBroker) knock(id uint32) error {
+	// Send a knock.
+	err := b.streamer.Send(&plugin.ConnInfo{
+		ServiceId: id,
+		Knock: &plugin.ConnInfo_Knock{
+			Knock: true,
+		},
+	})
+	if err != nil {
+		return err
+	}
+
+	// Wait for the ack.
+	p := b.getClientStream(id)
+	select {
+	case msg := <-p.ch:
+		if msg.ServiceId != id {
+			return fmt.Errorf("handshake failed for multiplexing on id %d; got response for %d", id, msg.ServiceId)
+		}
+		if msg.Knock == nil || !msg.Knock.Knock || !msg.Knock.Ack {
+			return fmt.Errorf("handshake failed for multiplexing on id %d; expected knock and ack, but got %+v", id, msg.Knock)
+		}
+		if msg.Knock.Error != "" {
+			return fmt.Errorf("failed to knock for id %d: %s", id, msg.Knock.Error)
+		}
+	case <-time.After(5 * time.Second):
+		return fmt.Errorf("timeout waiting for multiplexing knock handshake on id %d", id)
+	}
+
+	return nil
+}
+
+func (b *GRPCBroker) muxDial(id uint32) func(string, time.Duration) (net.Conn, error) {
+	return func(string, time.Duration) (net.Conn, error) {
+		b.dialMutex.Lock()
+		defer b.dialMutex.Unlock()
+
+		// Tell the other side the listener ID it should give the next stream to.
+		err := b.knock(id)
+		if err != nil {
+			return nil, fmt.Errorf("failed to knock before dialling client: %w", err)
+		}
+
+		conn, err := b.muxer.Dial()
+		if err != nil {
+			return nil, err
+		}
+
+		return conn, nil
+	}
+}
+
+// Dial opens a connection by ID.
+func (b *GRPCBroker) Dial(id uint32) (conn *grpc.ClientConn, err error) {
+	if b.muxer.Enabled() {
+		return dialGRPCConn(b.tls, b.muxDial(id))
+	}
+
+	var c *plugin.ConnInfo
+
+	// Open the stream
+	p := b.getClientStream(id)
+	select {
+	case c = <-p.ch:
+		close(p.doneCh)
+	case <-time.After(5 * time.Second):
+		return nil, fmt.Errorf("timeout waiting for connection info")
+	}
+
+	network, address := c.Network, c.Address
+	if b.addrTranslator != nil {
+		network, address, err = b.addrTranslator.PluginToHost(network, address)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	var addr net.Addr
+	switch network {
+	case "tcp":
+		addr, err = net.ResolveTCPAddr("tcp", address)
+	case "unix":
+		addr, err = net.ResolveUnixAddr("unix", address)
+	default:
+		err = fmt.Errorf("Unknown address type: %s", c.Address)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	return dialGRPCConn(b.tls, netAddrDialer(addr))
+}
+
+// NextId returns a unique ID to use next.
+//
+// It is possible for very long-running plugin hosts to wrap this value,
+// though it would require a very large amount of calls. In practice
+// we've never seen it happen.
+func (m *GRPCBroker) NextId() uint32 {
+	return atomic.AddUint32(&m.nextId, 1)
+}
+
+// Run starts the brokering and should be executed in a goroutine, since it
+// blocks forever, or until the session closes.
+//
+// Uses of GRPCBroker never need to call this. It is called internally by
+// the plugin host/client.
+func (m *GRPCBroker) Run() {
+	for {
+		msg, err := m.streamer.Recv()
+		if err != nil {
+			// Once we receive an error, just exit
+			break
+		}
+
+		// Initialize the waiter
+		var p *gRPCBrokerPending
+		if msg.Knock != nil && msg.Knock.Knock && !msg.Knock.Ack {
+			p = m.getServerStream(msg.ServiceId)
+			// The server side doesn't close the channel immediately as it needs
+			// to continuously listen for knocks.
+		} else {
+			p = m.getClientStream(msg.ServiceId)
+			go m.timeoutWait(msg.ServiceId, p)
+		}
+		select {
+		case p.ch <- msg:
+		default:
+		}
+	}
+}
+
+// getClientStream is a buffer to receive new connection info and knock acks
+// by stream ID.
+func (m *GRPCBroker) getClientStream(id uint32) *gRPCBrokerPending {
+	m.Lock()
+	defer m.Unlock()
+
+	p, ok := m.clientStreams[id]
+	if ok {
+		return p
+	}
+
+	m.clientStreams[id] = &gRPCBrokerPending{
+		ch:     make(chan *plugin.ConnInfo, 1),
+		doneCh: make(chan struct{}),
+	}
+	return m.clientStreams[id]
+}
+
+// getServerStream is a buffer to receive knocks to a multiplexed stream ID
+// that its side is listening on. Not used unless multiplexing is enabled.
+func (m *GRPCBroker) getServerStream(id uint32) *gRPCBrokerPending {
+	m.Lock()
+	defer m.Unlock()
+
+	p, ok := m.serverStreams[id]
+	if ok {
+		return p
+	}
+
+	m.serverStreams[id] = &gRPCBrokerPending{
+		ch:     make(chan *plugin.ConnInfo, 1),
+		doneCh: make(chan struct{}),
+	}
+	return m.serverStreams[id]
+}
+
+func (m *GRPCBroker) timeoutWait(id uint32, p *gRPCBrokerPending) {
+	// Wait for the stream to either be picked up and connected, or
+	// for a timeout.
+	select {
+	case <-p.doneCh:
+	case <-time.After(5 * time.Second):
+	}
+
+	m.Lock()
+	defer m.Unlock()
+
+	// Delete the stream so no one else can grab it
+	delete(m.clientStreams, id)
+}

vendor/github.com/hashicorp/go-plugin/grpc_client.go

@@ -0,0 +1,134 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"math"
+	"net"
+	"time"
+
+	"github.com/hashicorp/go-plugin/internal/plugin"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/health/grpc_health_v1"
+)
+
+func dialGRPCConn(tls *tls.Config, dialer func(string, time.Duration) (net.Conn, error), dialOpts ...grpc.DialOption) (*grpc.ClientConn, error) {
+	// Build dialing options.
+	opts := make([]grpc.DialOption, 0)
+
+	// We use a custom dialer so that we can connect over unix domain sockets.
+	opts = append(opts, grpc.WithDialer(dialer))
+
+	// Fail right away
+	opts = append(opts, grpc.FailOnNonTempDialError(true))
+
+	// If we have no TLS configuration set, we need to explicitly tell grpc
+	// that we're connecting with an insecure connection.
+	if tls == nil {
+		opts = append(opts, grpc.WithInsecure())
+	} else {
+		opts = append(opts, grpc.WithTransportCredentials(
+			credentials.NewTLS(tls)))
+	}
+
+	opts = append(opts,
+		grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(math.MaxInt32)),
+		grpc.WithDefaultCallOptions(grpc.MaxCallSendMsgSize(math.MaxInt32)))
+
+	// Add our custom options if we have any
+	opts = append(opts, dialOpts...)
+
+	// Connect. Note the first parameter is unused because we use a custom
+	// dialer that has the state to see the address.
+	conn, err := grpc.Dial("unused", opts...)
+	if err != nil {
+		return nil, err
+	}
+
+	return conn, nil
+}
+
+// newGRPCClient creates a new GRPCClient. The Client argument is expected
+// to be successfully started already with a lock held.
+func newGRPCClient(doneCtx context.Context, c *Client) (*GRPCClient, error) {
+	conn, err := dialGRPCConn(c.config.TLSConfig, c.dialer, c.config.GRPCDialOptions...)
+	if err != nil {
+		return nil, err
+	}
+
+	muxer, err := c.getGRPCMuxer(c.address)
+	if err != nil {
+		return nil, err
+	}
+
+	// Start the broker.
+	brokerGRPCClient := newGRPCBrokerClient(conn)
+	broker := newGRPCBroker(brokerGRPCClient, c.config.TLSConfig, c.unixSocketCfg, c.runner, muxer)
+	go broker.Run()
+	go brokerGRPCClient.StartStream()
+
+	// Start the stdio client
+	stdioClient, err := newGRPCStdioClient(doneCtx, c.logger.Named("stdio"), conn)
+	if err != nil {
+		return nil, err
+	}
+	go stdioClient.Run(c.config.SyncStdout, c.config.SyncStderr)
+
+	cl := &GRPCClient{
+		Conn:       conn,
+		Plugins:    c.config.Plugins,
+		doneCtx:    doneCtx,
+		broker:     broker,
+		controller: plugin.NewGRPCControllerClient(conn),
+	}
+
+	return cl, nil
+}
+
+// GRPCClient connects to a GRPCServer over gRPC to dispense plugin types.
+type GRPCClient struct {
+	Conn    *grpc.ClientConn
+	Plugins map[string]Plugin
+
+	doneCtx context.Context
+	broker  *GRPCBroker
+
+	controller plugin.GRPCControllerClient
+}
+
+// ClientProtocol impl.
+func (c *GRPCClient) Close() error {
+	c.broker.Close()
+	c.controller.Shutdown(c.doneCtx, &plugin.Empty{})
+	return c.Conn.Close()
+}
+
+// ClientProtocol impl.
+func (c *GRPCClient) Dispense(name string) (interface{}, error) {
+	raw, ok := c.Plugins[name]
+	if !ok {
+		return nil, fmt.Errorf("unknown plugin type: %s", name)
+	}
+
+	p, ok := raw.(GRPCPlugin)
+	if !ok {
+		return nil, fmt.Errorf("plugin %q doesn't support gRPC", name)
+	}
+
+	return p.GRPCClient(c.doneCtx, c.broker, c.Conn)
+}
+
+// ClientProtocol impl.
+func (c *GRPCClient) Ping() error {
+	client := grpc_health_v1.NewHealthClient(c.Conn)
+	_, err := client.Check(context.Background(), &grpc_health_v1.HealthCheckRequest{
+		Service: GRPCServiceName,
+	})
+
+	return err
+}

vendor/github.com/hashicorp/go-plugin/grpc_controller.go

@@ -0,0 +1,26 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"context"
+
+	"github.com/hashicorp/go-plugin/internal/plugin"
+)
+
+// GRPCControllerServer handles shutdown calls to terminate the server when the
+// plugin client is closed.
+type grpcControllerServer struct {
+	server *GRPCServer
+}
+
+// Shutdown stops the grpc server. It first will attempt a graceful stop, then a
+// full stop on the server.
+func (s *grpcControllerServer) Shutdown(ctx context.Context, _ *plugin.Empty) (*plugin.Empty, error) {
+	resp := &plugin.Empty{}
+
+	// TODO: figure out why GracefullStop doesn't work.
+	s.server.Stop()
+	return resp, nil
+}

vendor/github.com/hashicorp/go-plugin/grpc_server.go

@@ -0,0 +1,167 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"bytes"
+	"crypto/tls"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net"
+
+	hclog "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-plugin/internal/grpcmux"
+	"github.com/hashicorp/go-plugin/internal/plugin"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/health"
+	"google.golang.org/grpc/health/grpc_health_v1"
+	"google.golang.org/grpc/reflection"
+)
+
+// GRPCServiceName is the name of the service that the health check should
+// return as passing.
+const GRPCServiceName = "plugin"
+
+// DefaultGRPCServer can be used with the "GRPCServer" field for Server
+// as a default factory method to create a gRPC server with no extra options.
+func DefaultGRPCServer(opts []grpc.ServerOption) *grpc.Server {
+	return grpc.NewServer(opts...)
+}
+
+// GRPCServer is a ServerType implementation that serves plugins over
+// gRPC. This allows plugins to easily be written for other languages.
+//
+// The GRPCServer outputs a custom configuration as a base64-encoded
+// JSON structure represented by the GRPCServerConfig config structure.
+type GRPCServer struct {
+	// Plugins are the list of plugins to serve.
+	Plugins map[string]Plugin
+
+	// Server is the actual server that will accept connections. This
+	// will be used for plugin registration as well.
+	Server func([]grpc.ServerOption) *grpc.Server
+
+	// TLS should be the TLS configuration if available. If this is nil,
+	// the connection will not have transport security.
+	TLS *tls.Config
+
+	// DoneCh is the channel that is closed when this server has exited.
+	DoneCh chan struct{}
+
+	// Stdout/StderrLis are the readers for stdout/stderr that will be copied
+	// to the stdout/stderr connection that is output.
+	Stdout io.Reader
+	Stderr io.Reader
+
+	config      GRPCServerConfig
+	server      *grpc.Server
+	broker      *GRPCBroker
+	stdioServer *grpcStdioServer
+
+	logger hclog.Logger
+
+	muxer *grpcmux.GRPCServerMuxer
+}
+
+// ServerProtocol impl.
+func (s *GRPCServer) Init() error {
+	// Create our server
+	var opts []grpc.ServerOption
+	if s.TLS != nil {
+		opts = append(opts, grpc.Creds(credentials.NewTLS(s.TLS)))
+	}
+	s.server = s.Server(opts)
+
+	// Register the health service
+	healthCheck := health.NewServer()
+	healthCheck.SetServingStatus(
+		GRPCServiceName, grpc_health_v1.HealthCheckResponse_SERVING)
+	grpc_health_v1.RegisterHealthServer(s.server, healthCheck)
+
+	// Register the reflection service
+	reflection.Register(s.server)
+
+	// Register the broker service
+	brokerServer := newGRPCBrokerServer()
+	plugin.RegisterGRPCBrokerServer(s.server, brokerServer)
+	s.broker = newGRPCBroker(brokerServer, s.TLS, unixSocketConfigFromEnv(), nil, s.muxer)
+	go s.broker.Run()
+
+	// Register the controller
+	controllerServer := &grpcControllerServer{server: s}
+	plugin.RegisterGRPCControllerServer(s.server, controllerServer)
+
+	// Register the stdio service
+	s.stdioServer = newGRPCStdioServer(s.logger, s.Stdout, s.Stderr)
+	plugin.RegisterGRPCStdioServer(s.server, s.stdioServer)
+
+	// Register all our plugins onto the gRPC server.
+	for k, raw := range s.Plugins {
+		p, ok := raw.(GRPCPlugin)
+		if !ok {
+			return fmt.Errorf("%q is not a GRPC-compatible plugin", k)
+		}
+
+		if err := p.GRPCServer(s.broker, s.server); err != nil {
+			return fmt.Errorf("error registering %q: %s", k, err)
+		}
+	}
+
+	return nil
+}
+
+// Stop calls Stop on the underlying grpc.Server and Close on the underlying
+// grpc.Broker if present.
+func (s *GRPCServer) Stop() {
+	s.server.Stop()
+
+	if s.broker != nil {
+		s.broker.Close()
+		s.broker = nil
+	}
+}
+
+// GracefulStop calls GracefulStop on the underlying grpc.Server and Close on
+// the underlying grpc.Broker if present.
+func (s *GRPCServer) GracefulStop() {
+	s.server.GracefulStop()
+
+	if s.broker != nil {
+		s.broker.Close()
+		s.broker = nil
+	}
+}
+
+// Config is the GRPCServerConfig encoded as JSON then base64.
+func (s *GRPCServer) Config() string {
+	// Create a buffer that will contain our final contents
+	var buf bytes.Buffer
+
+	// Wrap the base64 encoding with JSON encoding.
+	if err := json.NewEncoder(&buf).Encode(s.config); err != nil {
+		// We panic since ths shouldn't happen under any scenario. We
+		// carefully control the structure being encoded here and it should
+		// always be successful.
+		panic(err)
+	}
+
+	return buf.String()
+}
+
+func (s *GRPCServer) Serve(lis net.Listener) {
+	defer close(s.DoneCh)
+	err := s.server.Serve(lis)
+	if err != nil {
+		s.logger.Error("grpc server", "error", err)
+	}
+}
+
+// GRPCServerConfig is the extra configuration passed along for consumers
+// to facilitate using GRPC plugins.
+type GRPCServerConfig struct {
+	StdoutAddr string `json:"stdout_addr"`
+	StderrAddr string `json:"stderr_addr"`
+}

vendor/github.com/hashicorp/go-plugin/grpc_stdio.go

@@ -0,0 +1,210 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"io"
+
+	empty "github.com/golang/protobuf/ptypes/empty"
+	hclog "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-plugin/internal/plugin"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// grpcStdioBuffer is the buffer size we try to fill when sending a chunk of
+// stdio data. This is currently 1 KB for no reason other than that seems like
+// enough (stdio data isn't that common) and is fairly low.
+const grpcStdioBuffer = 1 * 1024
+
+// grpcStdioServer implements the Stdio service and streams stdiout/stderr.
+type grpcStdioServer struct {
+	stdoutCh <-chan []byte
+	stderrCh <-chan []byte
+}
+
+// newGRPCStdioServer creates a new grpcStdioServer and starts the stream
+// copying for the given out and err readers.
+//
+// This must only be called ONCE per srcOut, srcErr.
+func newGRPCStdioServer(log hclog.Logger, srcOut, srcErr io.Reader) *grpcStdioServer {
+	stdoutCh := make(chan []byte)
+	stderrCh := make(chan []byte)
+
+	// Begin copying the streams
+	go copyChan(log, stdoutCh, srcOut)
+	go copyChan(log, stderrCh, srcErr)
+
+	// Construct our server
+	return &grpcStdioServer{
+		stdoutCh: stdoutCh,
+		stderrCh: stderrCh,
+	}
+}
+
+// StreamStdio streams our stdout/err as the response.
+func (s *grpcStdioServer) StreamStdio(
+	_ *empty.Empty,
+	srv plugin.GRPCStdio_StreamStdioServer,
+) error {
+	// Share the same data value between runs. Sending this over the wire
+	// marshals it so we can reuse this.
+	var data plugin.StdioData
+
+	for {
+		// Read our data
+		select {
+		case data.Data = <-s.stdoutCh:
+			data.Channel = plugin.StdioData_STDOUT
+
+		case data.Data = <-s.stderrCh:
+			data.Channel = plugin.StdioData_STDERR
+
+		case <-srv.Context().Done():
+			return nil
+		}
+
+		// Not sure if this is possible, but if we somehow got here and
+		// we didn't populate any data at all, then just continue.
+		if len(data.Data) == 0 {
+			continue
+		}
+
+		// Send our data to the client.
+		if err := srv.Send(&data); err != nil {
+			return err
+		}
+	}
+}
+
+// grpcStdioClient wraps the stdio service as a client to copy
+// the stdio data to output writers.
+type grpcStdioClient struct {
+	log         hclog.Logger
+	stdioClient plugin.GRPCStdio_StreamStdioClient
+}
+
+// newGRPCStdioClient creates a grpcStdioClient. This will perform the
+// initial connection to the stdio service. If the stdio service is unavailable
+// then this will be a no-op. This allows this to work without error for
+// plugins that don't support this.
+func newGRPCStdioClient(
+	ctx context.Context,
+	log hclog.Logger,
+	conn *grpc.ClientConn,
+) (*grpcStdioClient, error) {
+	client := plugin.NewGRPCStdioClient(conn)
+
+	// Connect immediately to the endpoint
+	stdioClient, err := client.StreamStdio(ctx, &empty.Empty{})
+
+	// If we get an Unavailable or Unimplemented error, this means that the plugin isn't
+	// updated and linking to the latest version of go-plugin that supports
+	// this. We fall back to the previous behavior of just not syncing anything.
+	if status.Code(err) == codes.Unavailable || status.Code(err) == codes.Unimplemented {
+		log.Warn("stdio service not available, stdout/stderr syncing unavailable")
+		stdioClient = nil
+		err = nil
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	return &grpcStdioClient{
+		log:         log,
+		stdioClient: stdioClient,
+	}, nil
+}
+
+// Run starts the loop that receives stdio data and writes it to the given
+// writers. This blocks and should be run in a goroutine.
+func (c *grpcStdioClient) Run(stdout, stderr io.Writer) {
+	// This will be nil if stdio is not supported by the plugin
+	if c.stdioClient == nil {
+		c.log.Warn("stdio service unavailable, run will do nothing")
+		return
+	}
+
+	for {
+		c.log.Trace("waiting for stdio data")
+		data, err := c.stdioClient.Recv()
+		if err != nil {
+			if err == io.EOF ||
+				status.Code(err) == codes.Unavailable ||
+				status.Code(err) == codes.Canceled ||
+				status.Code(err) == codes.Unimplemented ||
+				err == context.Canceled {
+				c.log.Debug("received EOF, stopping recv loop", "err", err)
+				return
+			}
+
+			c.log.Error("error receiving data", "err", err)
+			return
+		}
+
+		// Determine our output writer based on channel
+		var w io.Writer
+		switch data.Channel {
+		case plugin.StdioData_STDOUT:
+			w = stdout
+
+		case plugin.StdioData_STDERR:
+			w = stderr
+
+		default:
+			c.log.Warn("unknown channel, dropping", "channel", data.Channel)
+			continue
+		}
+
+		// Write! In the event of an error we just continue.
+		if c.log.IsTrace() {
+			c.log.Trace("received data", "channel", data.Channel.String(), "len", len(data.Data))
+		}
+		if _, err := io.Copy(w, bytes.NewReader(data.Data)); err != nil {
+			c.log.Error("failed to copy all bytes", "err", err)
+		}
+	}
+}
+
+// copyChan copies an io.Reader into a channel.
+func copyChan(log hclog.Logger, dst chan<- []byte, src io.Reader) {
+	bufsrc := bufio.NewReader(src)
+
+	for {
+		// Make our data buffer. We allocate a new one per loop iteration
+		// so that we can send it over the channel.
+		var data [1024]byte
+
+		// Read the data, this will block until data is available
+		n, err := bufsrc.Read(data[:])
+
+		// We have to check if we have data BEFORE err != nil. The bufio
+		// docs guarantee n == 0 on EOF but its better to be safe here.
+		if n > 0 {
+			// We have data! Send it on the channel. This will block if there
+			// is no reader on the other side. We expect that go-plugin will
+			// connect immediately to the stdio server to drain this so we want
+			// this block to happen for backpressure.
+			dst <- data[:n]
+		}
+
+		// If we hit EOF we're done copying
+		if err == io.EOF {
+			log.Debug("stdio EOF, exiting copy loop")
+			return
+		}
+
+		// Any other error we just exit the loop. We don't expect there to
+		// be errors since our use case for this is reading/writing from
+		// a in-process pipe (os.Pipe).
+		if err != nil {
+			log.Warn("error copying stdio data, stopping copy", "err", err)
+			return
+		}
+	}
+}

vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/addr_translator.go

@@ -0,0 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cmdrunner
+
+// addrTranslator implements stateless identity functions, as the host and plugin
+// run in the same context wrt Unix and network addresses.
+type addrTranslator struct{}
+
+func (*addrTranslator) PluginToHost(pluginNet, pluginAddr string) (string, string, error) {
+	return pluginNet, pluginAddr, nil
+}
+
+func (*addrTranslator) HostToPlugin(hostNet, hostAddr string) (string, string, error) {
+	return hostNet, hostAddr, nil
+}

vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/cmd_reattach.go

@@ -0,0 +1,63 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cmdrunner
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"os"
+
+	"github.com/hashicorp/go-plugin/runner"
+)
+
+// ReattachFunc returns a function that allows reattaching to a plugin running
+// as a plain process. The process may or may not be a child process.
+func ReattachFunc(pid int, addr net.Addr) runner.ReattachFunc {
+	return func() (runner.AttachedRunner, error) {
+		p, err := os.FindProcess(pid)
+		if err != nil {
+			// On Unix systems, FindProcess never returns an error.
+			// On Windows, for non-existent pids it returns:
+			// os.SyscallError - 'OpenProcess: the paremter is incorrect'
+			return nil, ErrProcessNotFound
+		}
+
+		// Attempt to connect to the addr since on Unix systems FindProcess
+		// doesn't actually return an error if it can't find the process.
+		conn, err := net.Dial(addr.Network(), addr.String())
+		if err != nil {
+			p.Kill()
+			return nil, ErrProcessNotFound
+		}
+		conn.Close()
+
+		return &CmdAttachedRunner{
+			pid:     pid,
+			process: p,
+		}, nil
+	}
+}
+
+// CmdAttachedRunner is mostly a subset of CmdRunner, except the Wait function
+// does not assume the process is a child of the host process, and so uses a
+// different implementation to wait on the process.
+type CmdAttachedRunner struct {
+	pid     int
+	process *os.Process
+
+	addrTranslator
+}
+
+func (c *CmdAttachedRunner) Wait(_ context.Context) error {
+	return pidWait(c.pid)
+}
+
+func (c *CmdAttachedRunner) Kill(_ context.Context) error {
+	return c.process.Kill()
+}
+
+func (c *CmdAttachedRunner) ID() string {
+	return fmt.Sprintf("%d", c.pid)
+}

vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/cmd_runner.go

@@ -0,0 +1,129 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cmdrunner
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-plugin/runner"
+)
+
+var (
+	_ runner.Runner = (*CmdRunner)(nil)
+
+	// ErrProcessNotFound is returned when a client is instantiated to
+	// reattach to an existing process and it isn't found.
+	ErrProcessNotFound = errors.New("Reattachment process not found")
+)
+
+const unrecognizedRemotePluginMessage = `This usually means
+  the plugin was not compiled for this architecture,
+  the plugin is missing dynamic-link libraries necessary to run,
+  the plugin is not executable by this process due to file permissions, or
+  the plugin failed to negotiate the initial go-plugin protocol handshake
+%s`
+
+// CmdRunner implements the runner.Runner interface. It mostly just passes through
+// to exec.Cmd methods.
+type CmdRunner struct {
+	logger hclog.Logger
+	cmd    *exec.Cmd
+
+	stdout io.ReadCloser
+	stderr io.ReadCloser
+
+	// Cmd info is persisted early, since the process information will be removed
+	// after Kill is called.
+	path string
+	pid  int
+
+	addrTranslator
+}
+
+// NewCmdRunner returns an implementation of runner.Runner for running a plugin
+// as a subprocess. It must be passed a cmd that hasn't yet been started.
+func NewCmdRunner(logger hclog.Logger, cmd *exec.Cmd) (*CmdRunner, error) {
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return nil, err
+	}
+
+	stderr, err := cmd.StderrPipe()
+	if err != nil {
+		return nil, err
+	}
+
+	return &CmdRunner{
+		logger: logger,
+		cmd:    cmd,
+		stdout: stdout,
+		stderr: stderr,
+		path:   cmd.Path,
+	}, nil
+}
+
+func (c *CmdRunner) Start(_ context.Context) error {
+	c.logger.Debug("starting plugin", "path", c.cmd.Path, "args", c.cmd.Args)
+	err := c.cmd.Start()
+	if err != nil {
+		return err
+	}
+
+	c.pid = c.cmd.Process.Pid
+	c.logger.Debug("plugin started", "path", c.path, "pid", c.pid)
+	return nil
+}
+
+func (c *CmdRunner) Wait(_ context.Context) error {
+	return c.cmd.Wait()
+}
+
+func (c *CmdRunner) Kill(_ context.Context) error {
+	if c.cmd.Process != nil {
+		err := c.cmd.Process.Kill()
+		// Swallow ErrProcessDone, we support calling Kill multiple times.
+		if !errors.Is(err, os.ErrProcessDone) {
+			return err
+		}
+		return nil
+	}
+
+	return nil
+}
+
+func (c *CmdRunner) Stdout() io.ReadCloser {
+	return c.stdout
+}
+
+func (c *CmdRunner) Stderr() io.ReadCloser {
+	return c.stderr
+}
+
+func (c *CmdRunner) Name() string {
+	return c.path
+}
+
+func (c *CmdRunner) ID() string {
+	return fmt.Sprintf("%d", c.pid)
+}
+
+// peTypes is a list of Portable Executable (PE) machine types from https://learn.microsoft.com/en-us/windows/win32/debug/pe-format
+// mapped to GOARCH types. It is not comprehensive, and only includes machine types that Go supports.
+var peTypes = map[uint16]string{
+	0x14c:  "386",
+	0x1c0:  "arm",
+	0x6264: "loong64",
+	0x8664: "amd64",
+	0xaa64: "arm64",
+}
+
+func (c *CmdRunner) Diagnose(_ context.Context) string {
+	return fmt.Sprintf(unrecognizedRemotePluginMessage, additionalNotesAboutCommand(c.cmd.Path))
+}

vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/notes_unix.go

@@ -0,0 +1,70 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build !windows
+// +build !windows
+
+package cmdrunner
+
+import (
+	"debug/elf"
+	"debug/macho"
+	"debug/pe"
+	"fmt"
+	"os"
+	"os/user"
+	"runtime"
+	"strconv"
+	"syscall"
+)
+
+// additionalNotesAboutCommand tries to get additional information about a command that might help diagnose
+// why it won't run correctly. It runs as a best effort only.
+func additionalNotesAboutCommand(path string) string {
+	notes := ""
+	stat, err := os.Stat(path)
+	if err != nil {
+		return notes
+	}
+
+	notes += "\nAdditional notes about plugin:\n"
+	notes += fmt.Sprintf("  Path: %s\n", path)
+	notes += fmt.Sprintf("  Mode: %s\n", stat.Mode())
+	statT, ok := stat.Sys().(*syscall.Stat_t)
+	if ok {
+		currentUsername := "?"
+		if u, err := user.LookupId(strconv.FormatUint(uint64(os.Getuid()), 10)); err == nil {
+			currentUsername = u.Username
+		}
+		currentGroup := "?"
+		if g, err := user.LookupGroupId(strconv.FormatUint(uint64(os.Getgid()), 10)); err == nil {
+			currentGroup = g.Name
+		}
+		username := "?"
+		if u, err := user.LookupId(strconv.FormatUint(uint64(statT.Uid), 10)); err == nil {
+			username = u.Username
+		}
+		group := "?"
+		if g, err := user.LookupGroupId(strconv.FormatUint(uint64(statT.Gid), 10)); err == nil {
+			group = g.Name
+		}
+		notes += fmt.Sprintf("  Owner: %d [%s] (current: %d [%s])\n", statT.Uid, username, os.Getuid(), currentUsername)
+		notes += fmt.Sprintf("  Group: %d [%s] (current: %d [%s])\n", statT.Gid, group, os.Getgid(), currentGroup)
+	}
+
+	if elfFile, err := elf.Open(path); err == nil {
+		defer elfFile.Close()
+		notes += fmt.Sprintf("  ELF architecture: %s (current architecture: %s)\n", elfFile.Machine, runtime.GOARCH)
+	} else if machoFile, err := macho.Open(path); err == nil {
+		defer machoFile.Close()
+		notes += fmt.Sprintf("  MachO architecture: %s (current architecture: %s)\n", machoFile.Cpu, runtime.GOARCH)
+	} else if peFile, err := pe.Open(path); err == nil {
+		defer peFile.Close()
+		machine, ok := peTypes[peFile.Machine]
+		if !ok {
+			machine = "unknown"
+		}
+		notes += fmt.Sprintf("  PE architecture: %s (current architecture: %s)\n", machine, runtime.GOARCH)
+	}
+	return notes
+}

vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/notes_windows.go

@@ -0,0 +1,46 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build windows
+// +build windows
+
+package cmdrunner
+
+import (
+	"debug/elf"
+	"debug/macho"
+	"debug/pe"
+	"fmt"
+	"os"
+	"runtime"
+)
+
+// additionalNotesAboutCommand tries to get additional information about a command that might help diagnose
+// why it won't run correctly. It runs as a best effort only.
+func additionalNotesAboutCommand(path string) string {
+	notes := ""
+	stat, err := os.Stat(path)
+	if err != nil {
+		return notes
+	}
+
+	notes += "\nAdditional notes about plugin:\n"
+	notes += fmt.Sprintf("  Path: %s\n", path)
+	notes += fmt.Sprintf("  Mode: %s\n", stat.Mode())
+
+	if elfFile, err := elf.Open(path); err == nil {
+		defer elfFile.Close()
+		notes += fmt.Sprintf("  ELF architecture: %s (current architecture: %s)\n", elfFile.Machine, runtime.GOARCH)
+	} else if machoFile, err := macho.Open(path); err == nil {
+		defer machoFile.Close()
+		notes += fmt.Sprintf("  MachO architecture: %s (current architecture: %s)\n", machoFile.Cpu, runtime.GOARCH)
+	} else if peFile, err := pe.Open(path); err == nil {
+		defer peFile.Close()
+		machine, ok := peTypes[peFile.Machine]
+		if !ok {
+			machine = "unknown"
+		}
+		notes += fmt.Sprintf("  PE architecture: %s (current architecture: %s)\n", machine, runtime.GOARCH)
+	}
+	return notes
+}

vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process.go

@@ -0,0 +1,25 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cmdrunner
+
+import "time"
+
+// pidAlive checks whether a pid is alive.
+func pidAlive(pid int) bool {
+	return _pidAlive(pid)
+}
+
+// pidWait blocks for a process to exit.
+func pidWait(pid int) error {
+	ticker := time.NewTicker(1 * time.Second)
+	defer ticker.Stop()
+
+	for range ticker.C {
+		if !pidAlive(pid) {
+			break
+		}
+	}
+
+	return nil
+}

vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process_posix.go

@@ -0,0 +1,23 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build !windows
+// +build !windows
+
+package cmdrunner
+
+import (
+	"os"
+	"syscall"
+)
+
+// _pidAlive tests whether a process is alive or not by sending it Signal 0,
+// since Go otherwise has no way to test this.
+func _pidAlive(pid int) bool {
+	proc, err := os.FindProcess(pid)
+	if err == nil {
+		err = proc.Signal(syscall.Signal(0))
+	}
+
+	return err == nil
+}

vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process_windows.go

@@ -0,0 +1,33 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cmdrunner
+
+import (
+	"syscall"
+)
+
+const (
+	// Weird name but matches the MSDN docs
+	exit_STILL_ACTIVE = 259
+
+	processDesiredAccess = syscall.STANDARD_RIGHTS_READ |
+		syscall.PROCESS_QUERY_INFORMATION |
+		syscall.SYNCHRONIZE
+)
+
+// _pidAlive tests whether a process is alive or not
+func _pidAlive(pid int) bool {
+	h, err := syscall.OpenProcess(processDesiredAccess, false, uint32(pid))
+	if err != nil {
+		return false
+	}
+	defer syscall.CloseHandle(h)
+
+	var ec uint32
+	if e := syscall.GetExitCodeProcess(h, &ec); e != nil {
+		return false
+	}
+
+	return ec == exit_STILL_ACTIVE
+}

vendor/github.com/hashicorp/go-plugin/internal/grpcmux/blocked_client_listener.go

@@ -0,0 +1,51 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package grpcmux
+
+import (
+	"io"
+	"net"
+
+	"github.com/hashicorp/yamux"
+)
+
+var _ net.Listener = (*blockedClientListener)(nil)
+
+// blockedClientListener accepts connections for a specific gRPC broker stream
+// ID on the client (host) side of the connection.
+type blockedClientListener struct {
+	session *yamux.Session
+	waitCh  chan struct{}
+	doneCh  <-chan struct{}
+}
+
+func newBlockedClientListener(session *yamux.Session, doneCh <-chan struct{}) *blockedClientListener {
+	return &blockedClientListener{
+		waitCh:  make(chan struct{}, 1),
+		doneCh:  doneCh,
+		session: session,
+	}
+}
+
+func (b *blockedClientListener) Accept() (net.Conn, error) {
+	select {
+	case <-b.waitCh:
+		return b.session.Accept()
+	case <-b.doneCh:
+		return nil, io.EOF
+	}
+}
+
+func (b *blockedClientListener) Addr() net.Addr {
+	return b.session.Addr()
+}
+
+func (b *blockedClientListener) Close() error {
+	// We don't close the session, the client muxer is responsible for that.
+	return nil
+}
+
+func (b *blockedClientListener) unblock() {
+	b.waitCh <- struct{}{}
+}

vendor/github.com/hashicorp/go-plugin/internal/grpcmux/blocked_server_listener.go

@@ -0,0 +1,49 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package grpcmux
+
+import (
+	"io"
+	"net"
+)
+
+var _ net.Listener = (*blockedServerListener)(nil)
+
+// blockedServerListener accepts connections for a specific gRPC broker stream
+// ID on the server (plugin) side of the connection.
+type blockedServerListener struct {
+	addr     net.Addr
+	acceptCh chan acceptResult
+	doneCh   <-chan struct{}
+}
+
+type acceptResult struct {
+	conn net.Conn
+	err  error
+}
+
+func newBlockedServerListener(addr net.Addr, doneCh <-chan struct{}) *blockedServerListener {
+	return &blockedServerListener{
+		addr:     addr,
+		acceptCh: make(chan acceptResult),
+		doneCh:   doneCh,
+	}
+}
+
+func (b *blockedServerListener) Accept() (net.Conn, error) {
+	select {
+	case accept := <-b.acceptCh:
+		return accept.conn, accept.err
+	case <-b.doneCh:
+		return nil, io.EOF
+	}
+}
+
+func (b *blockedServerListener) Addr() net.Addr {
+	return b.addr
+}
+
+func (b *blockedServerListener) Close() error {
+	return nil
+}

vendor/github.com/hashicorp/go-plugin/internal/grpcmux/grpc_client_muxer.go

@@ -0,0 +1,105 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package grpcmux
+
+import (
+	"fmt"
+	"net"
+	"sync"
+
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/yamux"
+)
+
+var _ GRPCMuxer = (*GRPCClientMuxer)(nil)
+
+// GRPCClientMuxer implements the client (host) side of the gRPC broker's
+// GRPCMuxer interface for multiplexing multiple gRPC broker connections over
+// a single net.Conn.
+//
+// The client dials the initial net.Conn eagerly, and creates a yamux.Session
+// as the implementation for multiplexing any additional connections.
+//
+// Each net.Listener returned from Listener will block until the client receives
+// a knock that matches its gRPC broker stream ID. There is no default listener
+// on the client, as it is a client for the gRPC broker's control services. (See
+// GRPCServerMuxer for more details).
+type GRPCClientMuxer struct {
+	logger  hclog.Logger
+	session *yamux.Session
+
+	acceptMutex     sync.Mutex
+	acceptListeners map[uint32]*blockedClientListener
+}
+
+func NewGRPCClientMuxer(logger hclog.Logger, addr net.Addr) (*GRPCClientMuxer, error) {
+	// Eagerly establish the underlying connection as early as possible.
+	logger.Debug("making new client mux initial connection", "addr", addr)
+	conn, err := net.Dial(addr.Network(), addr.String())
+	if err != nil {
+		return nil, err
+	}
+	if tcpConn, ok := conn.(*net.TCPConn); ok {
+		// Make sure to set keep alive so that the connection doesn't die
+		_ = tcpConn.SetKeepAlive(true)
+	}
+
+	cfg := yamux.DefaultConfig()
+	cfg.Logger = logger.Named("yamux").StandardLogger(&hclog.StandardLoggerOptions{
+		InferLevels: true,
+	})
+	cfg.LogOutput = nil
+	sess, err := yamux.Client(conn, cfg)
+	if err != nil {
+		return nil, err
+	}
+
+	logger.Debug("client muxer connected", "addr", addr)
+	m := &GRPCClientMuxer{
+		logger:          logger,
+		session:         sess,
+		acceptListeners: make(map[uint32]*blockedClientListener),
+	}
+
+	return m, nil
+}
+
+func (m *GRPCClientMuxer) Enabled() bool {
+	return m != nil
+}
+
+func (m *GRPCClientMuxer) Listener(id uint32, doneCh <-chan struct{}) (net.Listener, error) {
+	ln := newBlockedClientListener(m.session, doneCh)
+
+	m.acceptMutex.Lock()
+	m.acceptListeners[id] = ln
+	m.acceptMutex.Unlock()
+
+	return ln, nil
+}
+
+func (m *GRPCClientMuxer) AcceptKnock(id uint32) error {
+	m.acceptMutex.Lock()
+	defer m.acceptMutex.Unlock()
+
+	ln, ok := m.acceptListeners[id]
+	if !ok {
+		return fmt.Errorf("no listener for id %d", id)
+	}
+	ln.unblock()
+	return nil
+}
+
+func (m *GRPCClientMuxer) Dial() (net.Conn, error) {
+	stream, err := m.session.Open()
+	if err != nil {
+		return nil, fmt.Errorf("error dialling new client stream: %w", err)
+	}
+
+	return stream, nil
+}
+
+func (m *GRPCClientMuxer) Close() error {
+	return m.session.Close()
+}

vendor/github.com/hashicorp/go-plugin/internal/grpcmux/grpc_muxer.go

@@ -0,0 +1,41 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package grpcmux
+
+import (
+	"net"
+)
+
+// GRPCMuxer enables multiple implementations of net.Listener to accept
+// connections over a single "main" multiplexed net.Conn, and dial multiple
+// client connections over the same multiplexed net.Conn.
+//
+// The first multiplexed connection is used to serve the gRPC broker's own
+// control services: plugin.GRPCBroker, plugin.GRPCController, plugin.GRPCStdio.
+//
+// Clients must "knock" before dialling, to tell the server side that the
+// next net.Conn should be accepted onto a specific stream ID. The knock is a
+// bidirectional streaming message on the plugin.GRPCBroker service.
+type GRPCMuxer interface {
+	// Enabled determines whether multiplexing should be used. It saves users
+	// of the interface from having to compare an interface with nil, which
+	// is a bit awkward to do correctly.
+	Enabled() bool
+
+	// Listener returns a multiplexed listener that will wait until AcceptKnock
+	// is called with a matching ID before its Accept function returns.
+	Listener(id uint32, doneCh <-chan struct{}) (net.Listener, error)
+
+	// AcceptKnock unblocks the listener with the matching ID, and returns an
+	// error if it hasn't been created yet.
+	AcceptKnock(id uint32) error
+
+	// Dial makes a new multiplexed client connection. To dial a specific ID,
+	// a knock must be sent first.
+	Dial() (net.Conn, error)
+
+	// Close closes connections and releases any resources associated with the
+	// muxer.
+	Close() error
+}

vendor/github.com/hashicorp/go-plugin/internal/grpcmux/grpc_server_muxer.go

@@ -0,0 +1,190 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package grpcmux
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"sync"
+	"time"
+
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/yamux"
+)
+
+var _ GRPCMuxer = (*GRPCServerMuxer)(nil)
+var _ net.Listener = (*GRPCServerMuxer)(nil)
+
+// GRPCServerMuxer implements the server (plugin) side of the gRPC broker's
+// GRPCMuxer interface for multiplexing multiple gRPC broker connections over
+// a single net.Conn.
+//
+// The server side needs a listener to serve the gRPC broker's control services,
+// which includes the service we will receive knocks on. That means we always
+// accept the first connection onto a "default" main listener, and if we accept
+// any further connections without receiving a knock first, they are also given
+// to the default listener.
+//
+// When creating additional multiplexed listeners for specific stream IDs, we
+// can't control the order in which gRPC servers will call Accept() on each
+// listener, but we do need to control which gRPC server accepts which connection.
+// As such, each multiplexed listener blocks waiting on a channel. It will be
+// unblocked when a knock is received for the matching stream ID.
+type GRPCServerMuxer struct {
+	addr   net.Addr
+	logger hclog.Logger
+
+	sessionErrCh chan error
+	sess         *yamux.Session
+
+	knockCh chan uint32
+
+	acceptMutex    sync.Mutex
+	acceptChannels map[uint32]chan acceptResult
+}
+
+func NewGRPCServerMuxer(logger hclog.Logger, ln net.Listener) *GRPCServerMuxer {
+	m := &GRPCServerMuxer{
+		addr:   ln.Addr(),
+		logger: logger,
+
+		sessionErrCh: make(chan error),
+
+		knockCh:        make(chan uint32, 1),
+		acceptChannels: make(map[uint32]chan acceptResult),
+	}
+
+	go m.acceptSession(ln)
+
+	return m
+}
+
+// acceptSessionAndMuxAccept is responsible for establishing the yamux session,
+// and then kicking off the acceptLoop function.
+func (m *GRPCServerMuxer) acceptSession(ln net.Listener) {
+	defer close(m.sessionErrCh)
+
+	m.logger.Debug("accepting initial connection", "addr", m.addr)
+	conn, err := ln.Accept()
+	if err != nil {
+		m.sessionErrCh <- err
+		return
+	}
+
+	m.logger.Debug("initial server connection accepted", "addr", m.addr)
+	cfg := yamux.DefaultConfig()
+	cfg.Logger = m.logger.Named("yamux").StandardLogger(&hclog.StandardLoggerOptions{
+		InferLevels: true,
+	})
+	cfg.LogOutput = nil
+	m.sess, err = yamux.Server(conn, cfg)
+	if err != nil {
+		m.sessionErrCh <- err
+		return
+	}
+}
+
+func (m *GRPCServerMuxer) session() (*yamux.Session, error) {
+	select {
+	case err := <-m.sessionErrCh:
+		if err != nil {
+			return nil, err
+		}
+	case <-time.After(5 * time.Second):
+		return nil, errors.New("timed out waiting for connection to be established")
+	}
+
+	// Should never happen.
+	if m.sess == nil {
+		return nil, errors.New("no connection established and no error received")
+	}
+
+	return m.sess, nil
+}
+
+// Accept accepts all incoming connections and routes them to the correct
+// stream ID based on the most recent knock received.
+func (m *GRPCServerMuxer) Accept() (net.Conn, error) {
+	session, err := m.session()
+	if err != nil {
+		return nil, fmt.Errorf("error establishing yamux session: %w", err)
+	}
+
+	for {
+		conn, acceptErr := session.Accept()
+
+		select {
+		case id := <-m.knockCh:
+			m.acceptMutex.Lock()
+			acceptCh, ok := m.acceptChannels[id]
+			m.acceptMutex.Unlock()
+
+			if !ok {
+				if conn != nil {
+					_ = conn.Close()
+				}
+				return nil, fmt.Errorf("received knock on ID %d that doesn't have a listener", id)
+			}
+			m.logger.Debug("sending conn to brokered listener", "id", id)
+			acceptCh <- acceptResult{
+				conn: conn,
+				err:  acceptErr,
+			}
+		default:
+			m.logger.Debug("sending conn to default listener")
+			return conn, acceptErr
+		}
+	}
+}
+
+func (m *GRPCServerMuxer) Addr() net.Addr {
+	return m.addr
+}
+
+func (m *GRPCServerMuxer) Close() error {
+	session, err := m.session()
+	if err != nil {
+		return err
+	}
+
+	return session.Close()
+}
+
+func (m *GRPCServerMuxer) Enabled() bool {
+	return m != nil
+}
+
+func (m *GRPCServerMuxer) Listener(id uint32, doneCh <-chan struct{}) (net.Listener, error) {
+	sess, err := m.session()
+	if err != nil {
+		return nil, err
+	}
+
+	ln := newBlockedServerListener(sess.Addr(), doneCh)
+	m.acceptMutex.Lock()
+	m.acceptChannels[id] = ln.acceptCh
+	m.acceptMutex.Unlock()
+
+	return ln, nil
+}
+
+func (m *GRPCServerMuxer) Dial() (net.Conn, error) {
+	sess, err := m.session()
+	if err != nil {
+		return nil, err
+	}
+
+	stream, err := sess.OpenStream()
+	if err != nil {
+		return nil, fmt.Errorf("error dialling new server stream: %w", err)
+	}
+
+	return stream, nil
+}
+
+func (m *GRPCServerMuxer) AcceptKnock(id uint32) error {
+	m.knockCh <- id
+	return nil
+}

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.pb.go

@@ -0,0 +1,264 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.31.0
+// 	protoc        (unknown)
+// source: internal/plugin/grpc_broker.proto
+
+package plugin
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type ConnInfo struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ServiceId uint32          `protobuf:"varint,1,opt,name=service_id,json=serviceId,proto3" json:"service_id,omitempty"`
+	Network   string          `protobuf:"bytes,2,opt,name=network,proto3" json:"network,omitempty"`
+	Address   string          `protobuf:"bytes,3,opt,name=address,proto3" json:"address,omitempty"`
+	Knock     *ConnInfo_Knock `protobuf:"bytes,4,opt,name=knock,proto3" json:"knock,omitempty"`
+}
+
+func (x *ConnInfo) Reset() {
+	*x = ConnInfo{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_internal_plugin_grpc_broker_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ConnInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ConnInfo) ProtoMessage() {}
+
+func (x *ConnInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_internal_plugin_grpc_broker_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ConnInfo.ProtoReflect.Descriptor instead.
+func (*ConnInfo) Descriptor() ([]byte, []int) {
+	return file_internal_plugin_grpc_broker_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ConnInfo) GetServiceId() uint32 {
+	if x != nil {
+		return x.ServiceId
+	}
+	return 0
+}
+
+func (x *ConnInfo) GetNetwork() string {
+	if x != nil {
+		return x.Network
+	}
+	return ""
+}
+
+func (x *ConnInfo) GetAddress() string {
+	if x != nil {
+		return x.Address
+	}
+	return ""
+}
+
+func (x *ConnInfo) GetKnock() *ConnInfo_Knock {
+	if x != nil {
+		return x.Knock
+	}
+	return nil
+}
+
+type ConnInfo_Knock struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Knock bool   `protobuf:"varint,1,opt,name=knock,proto3" json:"knock,omitempty"`
+	Ack   bool   `protobuf:"varint,2,opt,name=ack,proto3" json:"ack,omitempty"`
+	Error string `protobuf:"bytes,3,opt,name=error,proto3" json:"error,omitempty"`
+}
+
+func (x *ConnInfo_Knock) Reset() {
+	*x = ConnInfo_Knock{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_internal_plugin_grpc_broker_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ConnInfo_Knock) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ConnInfo_Knock) ProtoMessage() {}
+
+func (x *ConnInfo_Knock) ProtoReflect() protoreflect.Message {
+	mi := &file_internal_plugin_grpc_broker_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ConnInfo_Knock.ProtoReflect.Descriptor instead.
+func (*ConnInfo_Knock) Descriptor() ([]byte, []int) {
+	return file_internal_plugin_grpc_broker_proto_rawDescGZIP(), []int{0, 0}
+}
+
+func (x *ConnInfo_Knock) GetKnock() bool {
+	if x != nil {
+		return x.Knock
+	}
+	return false
+}
+
+func (x *ConnInfo_Knock) GetAck() bool {
+	if x != nil {
+		return x.Ack
+	}
+	return false
+}
+
+func (x *ConnInfo_Knock) GetError() string {
+	if x != nil {
+		return x.Error
+	}
+	return ""
+}
+
+var File_internal_plugin_grpc_broker_proto protoreflect.FileDescriptor
+
+var file_internal_plugin_grpc_broker_proto_rawDesc = []byte{
+	0x0a, 0x21, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x6c, 0x75, 0x67, 0x69,
+	0x6e, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x5f, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x12, 0x06, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x22, 0xd2, 0x01, 0x0a, 0x08,
+	0x43, 0x6f, 0x6e, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
+	0x6b, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x2c, 0x0a, 0x05, 0x6b,
+	0x6e, 0x6f, 0x63, 0x6b, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70, 0x6c, 0x75,
+	0x67, 0x69, 0x6e, 0x2e, 0x43, 0x6f, 0x6e, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x4b, 0x6e, 0x6f,
+	0x63, 0x6b, 0x52, 0x05, 0x6b, 0x6e, 0x6f, 0x63, 0x6b, 0x1a, 0x45, 0x0a, 0x05, 0x4b, 0x6e, 0x6f,
+	0x63, 0x6b, 0x12, 0x14, 0x0a, 0x05, 0x6b, 0x6e, 0x6f, 0x63, 0x6b, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x05, 0x6b, 0x6e, 0x6f, 0x63, 0x6b, 0x12, 0x10, 0x0a, 0x03, 0x61, 0x63, 0x6b, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x03, 0x61, 0x63, 0x6b, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72,
+	0x72, 0x6f, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72,
+	0x32, 0x43, 0x0a, 0x0a, 0x47, 0x52, 0x50, 0x43, 0x42, 0x72, 0x6f, 0x6b, 0x65, 0x72, 0x12, 0x35,
+	0x0a, 0x0b, 0x53, 0x74, 0x61, 0x72, 0x74, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x12, 0x10, 0x2e,
+	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x43, 0x6f, 0x6e, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x1a,
+	0x10, 0x2e, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x43, 0x6f, 0x6e, 0x6e, 0x49, 0x6e, 0x66,
+	0x6f, 0x28, 0x01, 0x30, 0x01, 0x42, 0x0a, 0x5a, 0x08, 0x2e, 0x2f, 0x70, 0x6c, 0x75, 0x67, 0x69,
+	0x6e, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_internal_plugin_grpc_broker_proto_rawDescOnce sync.Once
+	file_internal_plugin_grpc_broker_proto_rawDescData = file_internal_plugin_grpc_broker_proto_rawDesc
+)
+
+func file_internal_plugin_grpc_broker_proto_rawDescGZIP() []byte {
+	file_internal_plugin_grpc_broker_proto_rawDescOnce.Do(func() {
+		file_internal_plugin_grpc_broker_proto_rawDescData = protoimpl.X.CompressGZIP(file_internal_plugin_grpc_broker_proto_rawDescData)
+	})
+	return file_internal_plugin_grpc_broker_proto_rawDescData
+}
+
+var file_internal_plugin_grpc_broker_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_internal_plugin_grpc_broker_proto_goTypes = []interface{}{
+	(*ConnInfo)(nil),       // 0: plugin.ConnInfo
+	(*ConnInfo_Knock)(nil), // 1: plugin.ConnInfo.Knock
+}
+var file_internal_plugin_grpc_broker_proto_depIdxs = []int32{
+	1, // 0: plugin.ConnInfo.knock:type_name -> plugin.ConnInfo.Knock
+	0, // 1: plugin.GRPCBroker.StartStream:input_type -> plugin.ConnInfo
+	0, // 2: plugin.GRPCBroker.StartStream:output_type -> plugin.ConnInfo
+	2, // [2:3] is the sub-list for method output_type
+	1, // [1:2] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_internal_plugin_grpc_broker_proto_init() }
+func file_internal_plugin_grpc_broker_proto_init() {
+	if File_internal_plugin_grpc_broker_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_internal_plugin_grpc_broker_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ConnInfo); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_internal_plugin_grpc_broker_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ConnInfo_Knock); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_internal_plugin_grpc_broker_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_internal_plugin_grpc_broker_proto_goTypes,
+		DependencyIndexes: file_internal_plugin_grpc_broker_proto_depIdxs,
+		MessageInfos:      file_internal_plugin_grpc_broker_proto_msgTypes,
+	}.Build()
+	File_internal_plugin_grpc_broker_proto = out.File
+	file_internal_plugin_grpc_broker_proto_rawDesc = nil
+	file_internal_plugin_grpc_broker_proto_goTypes = nil
+	file_internal_plugin_grpc_broker_proto_depIdxs = nil
+}

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.proto

@@ -0,0 +1,22 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+package plugin;
+option go_package = "./plugin";
+
+message ConnInfo {
+    uint32 service_id = 1;
+    string network = 2;
+    string address = 3;
+    message Knock {
+        bool knock = 1;
+        bool ack = 2;
+        string error = 3;
+    }
+    Knock knock = 4;
+}
+
+service GRPCBroker {
+    rpc StartStream(stream ConnInfo) returns (stream ConnInfo);
+}

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker_grpc.pb.go

@@ -0,0 +1,142 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             (unknown)
+// source: internal/plugin/grpc_broker.proto
+
+package plugin
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+const (
+	GRPCBroker_StartStream_FullMethodName = "/plugin.GRPCBroker/StartStream"
+)
+
+// GRPCBrokerClient is the client API for GRPCBroker service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type GRPCBrokerClient interface {
+	StartStream(ctx context.Context, opts ...grpc.CallOption) (GRPCBroker_StartStreamClient, error)
+}
+
+type gRPCBrokerClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewGRPCBrokerClient(cc grpc.ClientConnInterface) GRPCBrokerClient {
+	return &gRPCBrokerClient{cc}
+}
+
+func (c *gRPCBrokerClient) StartStream(ctx context.Context, opts ...grpc.CallOption) (GRPCBroker_StartStreamClient, error) {
+	stream, err := c.cc.NewStream(ctx, &GRPCBroker_ServiceDesc.Streams[0], GRPCBroker_StartStream_FullMethodName, opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &gRPCBrokerStartStreamClient{stream}
+	return x, nil
+}
+
+type GRPCBroker_StartStreamClient interface {
+	Send(*ConnInfo) error
+	Recv() (*ConnInfo, error)
+	grpc.ClientStream
+}
+
+type gRPCBrokerStartStreamClient struct {
+	grpc.ClientStream
+}
+
+func (x *gRPCBrokerStartStreamClient) Send(m *ConnInfo) error {
+	return x.ClientStream.SendMsg(m)
+}
+
+func (x *gRPCBrokerStartStreamClient) Recv() (*ConnInfo, error) {
+	m := new(ConnInfo)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// GRPCBrokerServer is the server API for GRPCBroker service.
+// All implementations should embed UnimplementedGRPCBrokerServer
+// for forward compatibility
+type GRPCBrokerServer interface {
+	StartStream(GRPCBroker_StartStreamServer) error
+}
+
+// UnimplementedGRPCBrokerServer should be embedded to have forward compatible implementations.
+type UnimplementedGRPCBrokerServer struct {
+}
+
+func (UnimplementedGRPCBrokerServer) StartStream(GRPCBroker_StartStreamServer) error {
+	return status.Errorf(codes.Unimplemented, "method StartStream not implemented")
+}
+
+// UnsafeGRPCBrokerServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to GRPCBrokerServer will
+// result in compilation errors.
+type UnsafeGRPCBrokerServer interface {
+	mustEmbedUnimplementedGRPCBrokerServer()
+}
+
+func RegisterGRPCBrokerServer(s grpc.ServiceRegistrar, srv GRPCBrokerServer) {
+	s.RegisterService(&GRPCBroker_ServiceDesc, srv)
+}
+
+func _GRPCBroker_StartStream_Handler(srv interface{}, stream grpc.ServerStream) error {
+	return srv.(GRPCBrokerServer).StartStream(&gRPCBrokerStartStreamServer{stream})
+}
+
+type GRPCBroker_StartStreamServer interface {
+	Send(*ConnInfo) error
+	Recv() (*ConnInfo, error)
+	grpc.ServerStream
+}
+
+type gRPCBrokerStartStreamServer struct {
+	grpc.ServerStream
+}
+
+func (x *gRPCBrokerStartStreamServer) Send(m *ConnInfo) error {
+	return x.ServerStream.SendMsg(m)
+}
+
+func (x *gRPCBrokerStartStreamServer) Recv() (*ConnInfo, error) {
+	m := new(ConnInfo)
+	if err := x.ServerStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// GRPCBroker_ServiceDesc is the grpc.ServiceDesc for GRPCBroker service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var GRPCBroker_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "plugin.GRPCBroker",
+	HandlerType: (*GRPCBrokerServer)(nil),
+	Methods:     []grpc.MethodDesc{},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "StartStream",
+			Handler:       _GRPCBroker_StartStream_Handler,
+			ServerStreams: true,
+			ClientStreams: true,
+		},
+	},
+	Metadata: "internal/plugin/grpc_broker.proto",
+}

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.pb.go

@@ -0,0 +1,141 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.31.0
+// 	protoc        (unknown)
+// source: internal/plugin/grpc_controller.proto
+
+package plugin
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type Empty struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *Empty) Reset() {
+	*x = Empty{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_internal_plugin_grpc_controller_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Empty) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Empty) ProtoMessage() {}
+
+func (x *Empty) ProtoReflect() protoreflect.Message {
+	mi := &file_internal_plugin_grpc_controller_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Empty.ProtoReflect.Descriptor instead.
+func (*Empty) Descriptor() ([]byte, []int) {
+	return file_internal_plugin_grpc_controller_proto_rawDescGZIP(), []int{0}
+}
+
+var File_internal_plugin_grpc_controller_proto protoreflect.FileDescriptor
+
+var file_internal_plugin_grpc_controller_proto_rawDesc = []byte{
+	0x0a, 0x25, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x6c, 0x75, 0x67, 0x69,
+	0x6e, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
+	0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x06, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x22,
+	0x07, 0x0a, 0x05, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x32, 0x3a, 0x0a, 0x0e, 0x47, 0x52, 0x50, 0x43,
+	0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x12, 0x28, 0x0a, 0x08, 0x53, 0x68,
+	0x75, 0x74, 0x64, 0x6f, 0x77, 0x6e, 0x12, 0x0d, 0x2e, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e,
+	0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0d, 0x2e, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x45,
+	0x6d, 0x70, 0x74, 0x79, 0x42, 0x0a, 0x5a, 0x08, 0x2e, 0x2f, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
+	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_internal_plugin_grpc_controller_proto_rawDescOnce sync.Once
+	file_internal_plugin_grpc_controller_proto_rawDescData = file_internal_plugin_grpc_controller_proto_rawDesc
+)
+
+func file_internal_plugin_grpc_controller_proto_rawDescGZIP() []byte {
+	file_internal_plugin_grpc_controller_proto_rawDescOnce.Do(func() {
+		file_internal_plugin_grpc_controller_proto_rawDescData = protoimpl.X.CompressGZIP(file_internal_plugin_grpc_controller_proto_rawDescData)
+	})
+	return file_internal_plugin_grpc_controller_proto_rawDescData
+}
+
+var file_internal_plugin_grpc_controller_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_internal_plugin_grpc_controller_proto_goTypes = []interface{}{
+	(*Empty)(nil), // 0: plugin.Empty
+}
+var file_internal_plugin_grpc_controller_proto_depIdxs = []int32{
+	0, // 0: plugin.GRPCController.Shutdown:input_type -> plugin.Empty
+	0, // 1: plugin.GRPCController.Shutdown:output_type -> plugin.Empty
+	1, // [1:2] is the sub-list for method output_type
+	0, // [0:1] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_internal_plugin_grpc_controller_proto_init() }
+func file_internal_plugin_grpc_controller_proto_init() {
+	if File_internal_plugin_grpc_controller_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_internal_plugin_grpc_controller_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Empty); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_internal_plugin_grpc_controller_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_internal_plugin_grpc_controller_proto_goTypes,
+		DependencyIndexes: file_internal_plugin_grpc_controller_proto_depIdxs,
+		MessageInfos:      file_internal_plugin_grpc_controller_proto_msgTypes,
+	}.Build()
+	File_internal_plugin_grpc_controller_proto = out.File
+	file_internal_plugin_grpc_controller_proto_rawDesc = nil
+	file_internal_plugin_grpc_controller_proto_goTypes = nil
+	file_internal_plugin_grpc_controller_proto_depIdxs = nil
+}

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.proto

@@ -0,0 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+package plugin;
+option go_package = "./plugin";
+
+message Empty {
+}
+
+// The GRPCController is responsible for telling the plugin server to shutdown.
+service GRPCController {
+    rpc Shutdown(Empty) returns (Empty);
+}

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller_grpc.pb.go

@@ -0,0 +1,110 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             (unknown)
+// source: internal/plugin/grpc_controller.proto
+
+package plugin
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+const (
+	GRPCController_Shutdown_FullMethodName = "/plugin.GRPCController/Shutdown"
+)
+
+// GRPCControllerClient is the client API for GRPCController service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type GRPCControllerClient interface {
+	Shutdown(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*Empty, error)
+}
+
+type gRPCControllerClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewGRPCControllerClient(cc grpc.ClientConnInterface) GRPCControllerClient {
+	return &gRPCControllerClient{cc}
+}
+
+func (c *gRPCControllerClient) Shutdown(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*Empty, error) {
+	out := new(Empty)
+	err := c.cc.Invoke(ctx, GRPCController_Shutdown_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// GRPCControllerServer is the server API for GRPCController service.
+// All implementations should embed UnimplementedGRPCControllerServer
+// for forward compatibility
+type GRPCControllerServer interface {
+	Shutdown(context.Context, *Empty) (*Empty, error)
+}
+
+// UnimplementedGRPCControllerServer should be embedded to have forward compatible implementations.
+type UnimplementedGRPCControllerServer struct {
+}
+
+func (UnimplementedGRPCControllerServer) Shutdown(context.Context, *Empty) (*Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Shutdown not implemented")
+}
+
+// UnsafeGRPCControllerServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to GRPCControllerServer will
+// result in compilation errors.
+type UnsafeGRPCControllerServer interface {
+	mustEmbedUnimplementedGRPCControllerServer()
+}
+
+func RegisterGRPCControllerServer(s grpc.ServiceRegistrar, srv GRPCControllerServer) {
+	s.RegisterService(&GRPCController_ServiceDesc, srv)
+}
+
+func _GRPCController_Shutdown_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(GRPCControllerServer).Shutdown(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: GRPCController_Shutdown_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(GRPCControllerServer).Shutdown(ctx, req.(*Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// GRPCController_ServiceDesc is the grpc.ServiceDesc for GRPCController service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var GRPCController_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "plugin.GRPCController",
+	HandlerType: (*GRPCControllerServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Shutdown",
+			Handler:    _GRPCController_Shutdown_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "internal/plugin/grpc_controller.proto",
+}

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_stdio.pb.go

@@ -0,0 +1,225 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.31.0
+// 	protoc        (unknown)
+// source: internal/plugin/grpc_stdio.proto
+
+package plugin
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type StdioData_Channel int32
+
+const (
+	StdioData_INVALID StdioData_Channel = 0
+	StdioData_STDOUT  StdioData_Channel = 1
+	StdioData_STDERR  StdioData_Channel = 2
+)
+
+// Enum value maps for StdioData_Channel.
+var (
+	StdioData_Channel_name = map[int32]string{
+		0: "INVALID",
+		1: "STDOUT",
+		2: "STDERR",
+	}
+	StdioData_Channel_value = map[string]int32{
+		"INVALID": 0,
+		"STDOUT":  1,
+		"STDERR":  2,
+	}
+)
+
+func (x StdioData_Channel) Enum() *StdioData_Channel {
+	p := new(StdioData_Channel)
+	*p = x
+	return p
+}
+
+func (x StdioData_Channel) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (StdioData_Channel) Descriptor() protoreflect.EnumDescriptor {
+	return file_internal_plugin_grpc_stdio_proto_enumTypes[0].Descriptor()
+}
+
+func (StdioData_Channel) Type() protoreflect.EnumType {
+	return &file_internal_plugin_grpc_stdio_proto_enumTypes[0]
+}
+
+func (x StdioData_Channel) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use StdioData_Channel.Descriptor instead.
+func (StdioData_Channel) EnumDescriptor() ([]byte, []int) {
+	return file_internal_plugin_grpc_stdio_proto_rawDescGZIP(), []int{0, 0}
+}
+
+// StdioData is a single chunk of stdout or stderr data that is streamed
+// from GRPCStdio.
+type StdioData struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Channel StdioData_Channel `protobuf:"varint,1,opt,name=channel,proto3,enum=plugin.StdioData_Channel" json:"channel,omitempty"`
+	Data    []byte            `protobuf:"bytes,2,opt,name=data,proto3" json:"data,omitempty"`
+}
+
+func (x *StdioData) Reset() {
+	*x = StdioData{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_internal_plugin_grpc_stdio_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *StdioData) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StdioData) ProtoMessage() {}
+
+func (x *StdioData) ProtoReflect() protoreflect.Message {
+	mi := &file_internal_plugin_grpc_stdio_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StdioData.ProtoReflect.Descriptor instead.
+func (*StdioData) Descriptor() ([]byte, []int) {
+	return file_internal_plugin_grpc_stdio_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *StdioData) GetChannel() StdioData_Channel {
+	if x != nil {
+		return x.Channel
+	}
+	return StdioData_INVALID
+}
+
+func (x *StdioData) GetData() []byte {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+var File_internal_plugin_grpc_stdio_proto protoreflect.FileDescriptor
+
+var file_internal_plugin_grpc_stdio_proto_rawDesc = []byte{
+	0x0a, 0x20, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x6c, 0x75, 0x67, 0x69,
+	0x6e, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x5f, 0x73, 0x74, 0x64, 0x69, 0x6f, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x12, 0x06, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x1a, 0x1b, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x65, 0x6d, 0x70, 0x74,
+	0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x84, 0x01, 0x0a, 0x09, 0x53, 0x74, 0x64, 0x69,
+	0x6f, 0x44, 0x61, 0x74, 0x61, 0x12, 0x33, 0x0a, 0x07, 0x63, 0x68, 0x61, 0x6e, 0x6e, 0x65, 0x6c,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x19, 0x2e, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e,
+	0x53, 0x74, 0x64, 0x69, 0x6f, 0x44, 0x61, 0x74, 0x61, 0x2e, 0x43, 0x68, 0x61, 0x6e, 0x6e, 0x65,
+	0x6c, 0x52, 0x07, 0x63, 0x68, 0x61, 0x6e, 0x6e, 0x65, 0x6c, 0x12, 0x12, 0x0a, 0x04, 0x64, 0x61,
+	0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x22, 0x2e,
+	0x0a, 0x07, 0x43, 0x68, 0x61, 0x6e, 0x6e, 0x65, 0x6c, 0x12, 0x0b, 0x0a, 0x07, 0x49, 0x4e, 0x56,
+	0x41, 0x4c, 0x49, 0x44, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06, 0x53, 0x54, 0x44, 0x4f, 0x55, 0x54,
+	0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x53, 0x54, 0x44, 0x45, 0x52, 0x52, 0x10, 0x02, 0x32, 0x47,
+	0x0a, 0x09, 0x47, 0x52, 0x50, 0x43, 0x53, 0x74, 0x64, 0x69, 0x6f, 0x12, 0x3a, 0x0a, 0x0b, 0x53,
+	0x74, 0x72, 0x65, 0x61, 0x6d, 0x53, 0x74, 0x64, 0x69, 0x6f, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70,
+	0x74, 0x79, 0x1a, 0x11, 0x2e, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x53, 0x74, 0x64, 0x69,
+	0x6f, 0x44, 0x61, 0x74, 0x61, 0x30, 0x01, 0x42, 0x0a, 0x5a, 0x08, 0x2e, 0x2f, 0x70, 0x6c, 0x75,
+	0x67, 0x69, 0x6e, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_internal_plugin_grpc_stdio_proto_rawDescOnce sync.Once
+	file_internal_plugin_grpc_stdio_proto_rawDescData = file_internal_plugin_grpc_stdio_proto_rawDesc
+)
+
+func file_internal_plugin_grpc_stdio_proto_rawDescGZIP() []byte {
+	file_internal_plugin_grpc_stdio_proto_rawDescOnce.Do(func() {
+		file_internal_plugin_grpc_stdio_proto_rawDescData = protoimpl.X.CompressGZIP(file_internal_plugin_grpc_stdio_proto_rawDescData)
+	})
+	return file_internal_plugin_grpc_stdio_proto_rawDescData
+}
+
+var file_internal_plugin_grpc_stdio_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_internal_plugin_grpc_stdio_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_internal_plugin_grpc_stdio_proto_goTypes = []interface{}{
+	(StdioData_Channel)(0), // 0: plugin.StdioData.Channel
+	(*StdioData)(nil),      // 1: plugin.StdioData
+	(*emptypb.Empty)(nil),  // 2: google.protobuf.Empty
+}
+var file_internal_plugin_grpc_stdio_proto_depIdxs = []int32{
+	0, // 0: plugin.StdioData.channel:type_name -> plugin.StdioData.Channel
+	2, // 1: plugin.GRPCStdio.StreamStdio:input_type -> google.protobuf.Empty
+	1, // 2: plugin.GRPCStdio.StreamStdio:output_type -> plugin.StdioData
+	2, // [2:3] is the sub-list for method output_type
+	1, // [1:2] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_internal_plugin_grpc_stdio_proto_init() }
+func file_internal_plugin_grpc_stdio_proto_init() {
+	if File_internal_plugin_grpc_stdio_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_internal_plugin_grpc_stdio_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StdioData); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_internal_plugin_grpc_stdio_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_internal_plugin_grpc_stdio_proto_goTypes,
+		DependencyIndexes: file_internal_plugin_grpc_stdio_proto_depIdxs,
+		EnumInfos:         file_internal_plugin_grpc_stdio_proto_enumTypes,
+		MessageInfos:      file_internal_plugin_grpc_stdio_proto_msgTypes,
+	}.Build()
+	File_internal_plugin_grpc_stdio_proto = out.File
+	file_internal_plugin_grpc_stdio_proto_rawDesc = nil
+	file_internal_plugin_grpc_stdio_proto_goTypes = nil
+	file_internal_plugin_grpc_stdio_proto_depIdxs = nil
+}

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_stdio.proto

@@ -0,0 +1,33 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+package plugin;
+option go_package = "./plugin";
+
+import "google/protobuf/empty.proto";
+
+// GRPCStdio is a service that is automatically run by the plugin process
+// to stream any stdout/err data so that it can be mirrored on the plugin
+// host side.
+service GRPCStdio {
+  // StreamStdio returns a stream that contains all the stdout/stderr.
+  // This RPC endpoint must only be called ONCE. Once stdio data is consumed
+  // it is not sent again.
+  //
+  // Callers should connect early to prevent blocking on the plugin process.
+  rpc StreamStdio(google.protobuf.Empty) returns (stream StdioData);
+}
+
+// StdioData is a single chunk of stdout or stderr data that is streamed
+// from GRPCStdio.
+message StdioData {
+  enum Channel {
+    INVALID = 0;
+    STDOUT = 1;
+    STDERR = 2;
+  }
+
+  Channel channel = 1;
+  bytes data = 2;
+}

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_stdio_grpc.pb.go

@@ -0,0 +1,148 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             (unknown)
+// source: internal/plugin/grpc_stdio.proto
+
+package plugin
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+const (
+	GRPCStdio_StreamStdio_FullMethodName = "/plugin.GRPCStdio/StreamStdio"
+)
+
+// GRPCStdioClient is the client API for GRPCStdio service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type GRPCStdioClient interface {
+	// StreamStdio returns a stream that contains all the stdout/stderr.
+	// This RPC endpoint must only be called ONCE. Once stdio data is consumed
+	// it is not sent again.
+	//
+	// Callers should connect early to prevent blocking on the plugin process.
+	StreamStdio(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (GRPCStdio_StreamStdioClient, error)
+}
+
+type gRPCStdioClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewGRPCStdioClient(cc grpc.ClientConnInterface) GRPCStdioClient {
+	return &gRPCStdioClient{cc}
+}
+
+func (c *gRPCStdioClient) StreamStdio(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (GRPCStdio_StreamStdioClient, error) {
+	stream, err := c.cc.NewStream(ctx, &GRPCStdio_ServiceDesc.Streams[0], GRPCStdio_StreamStdio_FullMethodName, opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &gRPCStdioStreamStdioClient{stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+type GRPCStdio_StreamStdioClient interface {
+	Recv() (*StdioData, error)
+	grpc.ClientStream
+}
+
+type gRPCStdioStreamStdioClient struct {
+	grpc.ClientStream
+}
+
+func (x *gRPCStdioStreamStdioClient) Recv() (*StdioData, error) {
+	m := new(StdioData)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// GRPCStdioServer is the server API for GRPCStdio service.
+// All implementations should embed UnimplementedGRPCStdioServer
+// for forward compatibility
+type GRPCStdioServer interface {
+	// StreamStdio returns a stream that contains all the stdout/stderr.
+	// This RPC endpoint must only be called ONCE. Once stdio data is consumed
+	// it is not sent again.
+	//
+	// Callers should connect early to prevent blocking on the plugin process.
+	StreamStdio(*emptypb.Empty, GRPCStdio_StreamStdioServer) error
+}
+
+// UnimplementedGRPCStdioServer should be embedded to have forward compatible implementations.
+type UnimplementedGRPCStdioServer struct {
+}
+
+func (UnimplementedGRPCStdioServer) StreamStdio(*emptypb.Empty, GRPCStdio_StreamStdioServer) error {
+	return status.Errorf(codes.Unimplemented, "method StreamStdio not implemented")
+}
+
+// UnsafeGRPCStdioServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to GRPCStdioServer will
+// result in compilation errors.
+type UnsafeGRPCStdioServer interface {
+	mustEmbedUnimplementedGRPCStdioServer()
+}
+
+func RegisterGRPCStdioServer(s grpc.ServiceRegistrar, srv GRPCStdioServer) {
+	s.RegisterService(&GRPCStdio_ServiceDesc, srv)
+}
+
+func _GRPCStdio_StreamStdio_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(emptypb.Empty)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(GRPCStdioServer).StreamStdio(m, &gRPCStdioStreamStdioServer{stream})
+}
+
+type GRPCStdio_StreamStdioServer interface {
+	Send(*StdioData) error
+	grpc.ServerStream
+}
+
+type gRPCStdioStreamStdioServer struct {
+	grpc.ServerStream
+}
+
+func (x *gRPCStdioStreamStdioServer) Send(m *StdioData) error {
+	return x.ServerStream.SendMsg(m)
+}
+
+// GRPCStdio_ServiceDesc is the grpc.ServiceDesc for GRPCStdio service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var GRPCStdio_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "plugin.GRPCStdio",
+	HandlerType: (*GRPCStdioServer)(nil),
+	Methods:     []grpc.MethodDesc{},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "StreamStdio",
+			Handler:       _GRPCStdio_StreamStdio_Handler,
+			ServerStreams: true,
+		},
+	},
+	Metadata: "internal/plugin/grpc_stdio.proto",
+}

vendor/github.com/hashicorp/go-plugin/log_entry.go

@@ -0,0 +1,76 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"encoding/json"
+	"time"
+)
+
+// logEntry is the JSON payload that gets sent to Stderr from the plugin to the host
+type logEntry struct {
+	Message   string        `json:"@message"`
+	Level     string        `json:"@level"`
+	Timestamp time.Time     `json:"timestamp"`
+	KVPairs   []*logEntryKV `json:"kv_pairs"`
+}
+
+// logEntryKV is a key value pair within the Output payload
+type logEntryKV struct {
+	Key   string      `json:"key"`
+	Value interface{} `json:"value"`
+}
+
+// flattenKVPairs is used to flatten KVPair slice into []interface{}
+// for hclog consumption.
+func flattenKVPairs(kvs []*logEntryKV) []interface{} {
+	var result []interface{}
+	for _, kv := range kvs {
+		result = append(result, kv.Key)
+		result = append(result, kv.Value)
+	}
+
+	return result
+}
+
+// parseJSON handles parsing JSON output
+func parseJSON(input []byte) (*logEntry, error) {
+	var raw map[string]interface{}
+	entry := &logEntry{}
+
+	err := json.Unmarshal(input, &raw)
+	if err != nil {
+		return nil, err
+	}
+
+	// Parse hclog-specific objects
+	if v, ok := raw["@message"]; ok {
+		entry.Message = v.(string)
+		delete(raw, "@message")
+	}
+
+	if v, ok := raw["@level"]; ok {
+		entry.Level = v.(string)
+		delete(raw, "@level")
+	}
+
+	if v, ok := raw["@timestamp"]; ok {
+		t, err := time.Parse("2006-01-02T15:04:05.000000Z07:00", v.(string))
+		if err != nil {
+			return nil, err
+		}
+		entry.Timestamp = t
+		delete(raw, "@timestamp")
+	}
+
+	// Parse dynamic KV args from the hclog payload.
+	for k, v := range raw {
+		entry.KVPairs = append(entry.KVPairs, &logEntryKV{
+			Key:   k,
+			Value: v,
+		})
+	}
+
+	return entry, nil
+}

vendor/github.com/hashicorp/go-plugin/mtls.go

@@ -0,0 +1,76 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"bytes"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"time"
+)
+
+// generateCert generates a temporary certificate for plugin authentication. The
+// certificate and private key are returns in PEM format.
+func generateCert() (cert []byte, privateKey []byte, err error) {
+	key, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
+	sn, err := rand.Int(rand.Reader, serialNumberLimit)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	host := "localhost"
+
+	template := &x509.Certificate{
+		Subject: pkix.Name{
+			CommonName:   host,
+			Organization: []string{"HashiCorp"},
+		},
+		DNSNames: []string{host},
+		ExtKeyUsage: []x509.ExtKeyUsage{
+			x509.ExtKeyUsageClientAuth,
+			x509.ExtKeyUsageServerAuth,
+		},
+		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment | x509.KeyUsageKeyAgreement | x509.KeyUsageCertSign,
+		BasicConstraintsValid: true,
+		SerialNumber:          sn,
+		NotBefore:             time.Now().Add(-30 * time.Second),
+		NotAfter:              time.Now().Add(262980 * time.Hour),
+		IsCA:                  true,
+	}
+
+	der, err := x509.CreateCertificate(rand.Reader, template, template, key.Public(), key)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	var certOut bytes.Buffer
+	if err := pem.Encode(&certOut, &pem.Block{Type: "CERTIFICATE", Bytes: der}); err != nil {
+		return nil, nil, err
+	}
+
+	keyBytes, err := x509.MarshalECPrivateKey(key)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	var keyOut bytes.Buffer
+	if err := pem.Encode(&keyOut, &pem.Block{Type: "EC PRIVATE KEY", Bytes: keyBytes}); err != nil {
+		return nil, nil, err
+	}
+
+	cert = certOut.Bytes()
+	privateKey = keyOut.Bytes()
+
+	return cert, privateKey, nil
+}

vendor/github.com/hashicorp/go-plugin/mux_broker.go

@@ -0,0 +1,207 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"encoding/binary"
+	"fmt"
+	"log"
+	"net"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/hashicorp/yamux"
+)
+
+// MuxBroker is responsible for brokering multiplexed connections by unique ID.
+//
+// It is used by plugins to multiplex multiple RPC connections and data
+// streams on top of a single connection between the plugin process and the
+// host process.
+//
+// This allows a plugin to request a channel with a specific ID to connect to
+// or accept a connection from, and the broker handles the details of
+// holding these channels open while they're being negotiated.
+//
+// The Plugin interface has access to these for both Server and Client.
+// The broker can be used by either (optionally) to reserve and connect to
+// new multiplexed streams. This is useful for complex args and return values,
+// or anything else you might need a data stream for.
+type MuxBroker struct {
+	nextId  uint32
+	session *yamux.Session
+	streams map[uint32]*muxBrokerPending
+
+	sync.Mutex
+}
+
+type muxBrokerPending struct {
+	ch     chan net.Conn
+	doneCh chan struct{}
+}
+
+func newMuxBroker(s *yamux.Session) *MuxBroker {
+	return &MuxBroker{
+		session: s,
+		streams: make(map[uint32]*muxBrokerPending),
+	}
+}
+
+// Accept accepts a connection by ID.
+//
+// This should not be called multiple times with the same ID at one time.
+func (m *MuxBroker) Accept(id uint32) (net.Conn, error) {
+	var c net.Conn
+	p := m.getStream(id)
+	select {
+	case c = <-p.ch:
+		close(p.doneCh)
+	case <-time.After(5 * time.Second):
+		m.Lock()
+		defer m.Unlock()
+		delete(m.streams, id)
+
+		return nil, fmt.Errorf("timeout waiting for accept")
+	}
+
+	// Ack our connection
+	if err := binary.Write(c, binary.LittleEndian, id); err != nil {
+		c.Close()
+		return nil, err
+	}
+
+	return c, nil
+}
+
+// AcceptAndServe is used to accept a specific stream ID and immediately
+// serve an RPC server on that stream ID. This is used to easily serve
+// complex arguments.
+//
+// The served interface is always registered to the "Plugin" name.
+func (m *MuxBroker) AcceptAndServe(id uint32, v interface{}) {
+	conn, err := m.Accept(id)
+	if err != nil {
+		log.Printf("[ERR] plugin: plugin acceptAndServe error: %s", err)
+		return
+	}
+
+	serve(conn, "Plugin", v)
+}
+
+// Close closes the connection and all sub-connections.
+func (m *MuxBroker) Close() error {
+	return m.session.Close()
+}
+
+// Dial opens a connection by ID.
+func (m *MuxBroker) Dial(id uint32) (net.Conn, error) {
+	// Open the stream
+	stream, err := m.session.OpenStream()
+	if err != nil {
+		return nil, err
+	}
+
+	// Write the stream ID onto the wire.
+	if err := binary.Write(stream, binary.LittleEndian, id); err != nil {
+		stream.Close()
+		return nil, err
+	}
+
+	// Read the ack that we connected. Then we're off!
+	var ack uint32
+	if err := binary.Read(stream, binary.LittleEndian, &ack); err != nil {
+		stream.Close()
+		return nil, err
+	}
+	if ack != id {
+		stream.Close()
+		return nil, fmt.Errorf("bad ack: %d (expected %d)", ack, id)
+	}
+
+	return stream, nil
+}
+
+// NextId returns a unique ID to use next.
+//
+// It is possible for very long-running plugin hosts to wrap this value,
+// though it would require a very large amount of RPC calls. In practice
+// we've never seen it happen.
+func (m *MuxBroker) NextId() uint32 {
+	return atomic.AddUint32(&m.nextId, 1)
+}
+
+// Run starts the brokering and should be executed in a goroutine, since it
+// blocks forever, or until the session closes.
+//
+// Uses of MuxBroker never need to call this. It is called internally by
+// the plugin host/client.
+func (m *MuxBroker) Run() {
+	for {
+		stream, err := m.session.AcceptStream()
+		if err != nil {
+			// Once we receive an error, just exit
+			break
+		}
+
+		// Read the stream ID from the stream
+		var id uint32
+		if err := binary.Read(stream, binary.LittleEndian, &id); err != nil {
+			stream.Close()
+			continue
+		}
+
+		// Initialize the waiter
+		p := m.getStream(id)
+		select {
+		case p.ch <- stream:
+		default:
+		}
+
+		// Wait for a timeout
+		go m.timeoutWait(id, p)
+	}
+}
+
+func (m *MuxBroker) getStream(id uint32) *muxBrokerPending {
+	m.Lock()
+	defer m.Unlock()
+
+	p, ok := m.streams[id]
+	if ok {
+		return p
+	}
+
+	m.streams[id] = &muxBrokerPending{
+		ch:     make(chan net.Conn, 1),
+		doneCh: make(chan struct{}),
+	}
+	return m.streams[id]
+}
+
+func (m *MuxBroker) timeoutWait(id uint32, p *muxBrokerPending) {
+	// Wait for the stream to either be picked up and connected, or
+	// for a timeout.
+	timeout := false
+	select {
+	case <-p.doneCh:
+	case <-time.After(5 * time.Second):
+		timeout = true
+	}
+
+	m.Lock()
+	defer m.Unlock()
+
+	// Delete the stream so no one else can grab it
+	delete(m.streams, id)
+
+	// If we timed out, then check if we have a channel in the buffer,
+	// and if so, close it.
+	if timeout {
+		select {
+		case s := <-p.ch:
+			s.Close()
+		}
+	}
+}

vendor/github.com/hashicorp/go-plugin/plugin.go

@@ -0,0 +1,61 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// The plugin package exposes functions and helpers for communicating to
+// plugins which are implemented as standalone binary applications.
+//
+// plugin.Client fully manages the lifecycle of executing the application,
+// connecting to it, and returning the RPC client for dispensing plugins.
+//
+// plugin.Serve fully manages listeners to expose an RPC server from a binary
+// that plugin.Client can connect to.
+package plugin
+
+import (
+	"context"
+	"errors"
+	"net/rpc"
+
+	"google.golang.org/grpc"
+)
+
+// Plugin is the interface that is implemented to serve/connect to an
+// inteface implementation.
+type Plugin interface {
+	// Server should return the RPC server compatible struct to serve
+	// the methods that the Client calls over net/rpc.
+	Server(*MuxBroker) (interface{}, error)
+
+	// Client returns an interface implementation for the plugin you're
+	// serving that communicates to the server end of the plugin.
+	Client(*MuxBroker, *rpc.Client) (interface{}, error)
+}
+
+// GRPCPlugin is the interface that is implemented to serve/connect to
+// a plugin over gRPC.
+type GRPCPlugin interface {
+	// GRPCServer should register this plugin for serving with the
+	// given GRPCServer. Unlike Plugin.Server, this is only called once
+	// since gRPC plugins serve singletons.
+	GRPCServer(*GRPCBroker, *grpc.Server) error
+
+	// GRPCClient should return the interface implementation for the plugin
+	// you're serving via gRPC. The provided context will be canceled by
+	// go-plugin in the event of the plugin process exiting.
+	GRPCClient(context.Context, *GRPCBroker, *grpc.ClientConn) (interface{}, error)
+}
+
+// NetRPCUnsupportedPlugin implements Plugin but returns errors for the
+// Server and Client functions. This will effectively disable support for
+// net/rpc based plugins.
+//
+// This struct can be embedded in your struct.
+type NetRPCUnsupportedPlugin struct{}
+
+func (p NetRPCUnsupportedPlugin) Server(*MuxBroker) (interface{}, error) {
+	return nil, errors.New("net/rpc plugin protocol not supported")
+}
+
+func (p NetRPCUnsupportedPlugin) Client(*MuxBroker, *rpc.Client) (interface{}, error) {
+	return nil, errors.New("net/rpc plugin protocol not supported")
+}

vendor/github.com/hashicorp/go-plugin/process.go

@@ -0,0 +1,4 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin

vendor/github.com/hashicorp/go-plugin/protocol.go

@@ -0,0 +1,48 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"io"
+	"net"
+)
+
+// Protocol is an enum representing the types of protocols.
+type Protocol string
+
+const (
+	ProtocolInvalid Protocol = ""
+	ProtocolNetRPC  Protocol = "netrpc"
+	ProtocolGRPC    Protocol = "grpc"
+)
+
+// ServerProtocol is an interface that must be implemented for new plugin
+// protocols to be servers.
+type ServerProtocol interface {
+	// Init is called once to configure and initialize the protocol, but
+	// not start listening. This is the point at which all validation should
+	// be done and errors returned.
+	Init() error
+
+	// Config is extra configuration to be outputted to stdout. This will
+	// be automatically base64 encoded to ensure it can be parsed properly.
+	// This can be an empty string if additional configuration is not needed.
+	Config() string
+
+	// Serve is called to serve connections on the given listener. This should
+	// continue until the listener is closed.
+	Serve(net.Listener)
+}
+
+// ClientProtocol is an interface that must be implemented for new plugin
+// protocols to be clients.
+type ClientProtocol interface {
+	io.Closer
+
+	// Dispense dispenses a new instance of the plugin with the given name.
+	Dispense(string) (interface{}, error)
+
+	// Ping checks that the client connection is still healthy.
+	Ping() error
+}

vendor/github.com/hashicorp/go-plugin/rpc_client.go

@@ -0,0 +1,173 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"crypto/tls"
+	"fmt"
+	"io"
+	"net"
+	"net/rpc"
+
+	"github.com/hashicorp/yamux"
+)
+
+// RPCClient connects to an RPCServer over net/rpc to dispense plugin types.
+type RPCClient struct {
+	broker  *MuxBroker
+	control *rpc.Client
+	plugins map[string]Plugin
+
+	// These are the streams used for the various stdout/err overrides
+	stdout, stderr net.Conn
+}
+
+// newRPCClient creates a new RPCClient. The Client argument is expected
+// to be successfully started already with a lock held.
+func newRPCClient(c *Client) (*RPCClient, error) {
+	// Connect to the client
+	conn, err := net.Dial(c.address.Network(), c.address.String())
+	if err != nil {
+		return nil, err
+	}
+	if tcpConn, ok := conn.(*net.TCPConn); ok {
+		// Make sure to set keep alive so that the connection doesn't die
+		tcpConn.SetKeepAlive(true)
+	}
+
+	if c.config.TLSConfig != nil {
+		conn = tls.Client(conn, c.config.TLSConfig)
+	}
+
+	// Create the actual RPC client
+	result, err := NewRPCClient(conn, c.config.Plugins)
+	if err != nil {
+		conn.Close()
+		return nil, err
+	}
+
+	// Begin the stream syncing so that stdin, out, err work properly
+	err = result.SyncStreams(
+		c.config.SyncStdout,
+		c.config.SyncStderr)
+	if err != nil {
+		result.Close()
+		return nil, err
+	}
+
+	return result, nil
+}
+
+// NewRPCClient creates a client from an already-open connection-like value.
+// Dial is typically used instead.
+func NewRPCClient(conn io.ReadWriteCloser, plugins map[string]Plugin) (*RPCClient, error) {
+	// Create the yamux client so we can multiplex
+	mux, err := yamux.Client(conn, nil)
+	if err != nil {
+		conn.Close()
+		return nil, err
+	}
+
+	// Connect to the control stream.
+	control, err := mux.Open()
+	if err != nil {
+		mux.Close()
+		return nil, err
+	}
+
+	// Connect stdout, stderr streams
+	stdstream := make([]net.Conn, 2)
+	for i, _ := range stdstream {
+		stdstream[i], err = mux.Open()
+		if err != nil {
+			mux.Close()
+			return nil, err
+		}
+	}
+
+	// Create the broker and start it up
+	broker := newMuxBroker(mux)
+	go broker.Run()
+
+	// Build the client using our broker and control channel.
+	return &RPCClient{
+		broker:  broker,
+		control: rpc.NewClient(control),
+		plugins: plugins,
+		stdout:  stdstream[0],
+		stderr:  stdstream[1],
+	}, nil
+}
+
+// SyncStreams should be called to enable syncing of stdout,
+// stderr with the plugin.
+//
+// This will return immediately and the syncing will continue to happen
+// in the background. You do not need to launch this in a goroutine itself.
+//
+// This should never be called multiple times.
+func (c *RPCClient) SyncStreams(stdout io.Writer, stderr io.Writer) error {
+	go copyStream("stdout", stdout, c.stdout)
+	go copyStream("stderr", stderr, c.stderr)
+	return nil
+}
+
+// Close closes the connection. The client is no longer usable after this
+// is called.
+func (c *RPCClient) Close() error {
+	// Call the control channel and ask it to gracefully exit. If this
+	// errors, then we save it so that we always return an error but we
+	// want to try to close the other channels anyways.
+	var empty struct{}
+	returnErr := c.control.Call("Control.Quit", true, &empty)
+
+	// Close the other streams we have
+	if err := c.control.Close(); err != nil {
+		return err
+	}
+	if err := c.stdout.Close(); err != nil {
+		return err
+	}
+	if err := c.stderr.Close(); err != nil {
+		return err
+	}
+	if err := c.broker.Close(); err != nil {
+		return err
+	}
+
+	// Return back the error we got from Control.Quit. This is very important
+	// since we MUST return non-nil error if this fails so that Client.Kill
+	// will properly try a process.Kill.
+	return returnErr
+}
+
+func (c *RPCClient) Dispense(name string) (interface{}, error) {
+	p, ok := c.plugins[name]
+	if !ok {
+		return nil, fmt.Errorf("unknown plugin type: %s", name)
+	}
+
+	var id uint32
+	if err := c.control.Call(
+		"Dispenser.Dispense", name, &id); err != nil {
+		return nil, err
+	}
+
+	conn, err := c.broker.Dial(id)
+	if err != nil {
+		return nil, err
+	}
+
+	return p.Client(c.broker, rpc.NewClient(conn))
+}
+
+// Ping pings the connection to ensure it is still alive.
+//
+// The error from the RPC call is returned exactly if you want to inspect
+// it for further error analysis. Any error returned from here would indicate
+// that the connection to the plugin is not healthy.
+func (c *RPCClient) Ping() error {
+	var empty struct{}
+	return c.control.Call("Control.Ping", true, &empty)
+}

vendor/github.com/hashicorp/go-plugin/rpc_server.go

@@ -0,0 +1,209 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"net/rpc"
+	"sync"
+
+	"github.com/hashicorp/yamux"
+)
+
+// RPCServer listens for network connections and then dispenses interface
+// implementations over net/rpc.
+//
+// After setting the fields below, they shouldn't be read again directly
+// from the structure which may be reading/writing them concurrently.
+type RPCServer struct {
+	Plugins map[string]Plugin
+
+	// Stdout, Stderr are what this server will use instead of the
+	// normal stdin/out/err. This is because due to the multi-process nature
+	// of our plugin system, we can't use the normal process values so we
+	// make our own custom one we pipe across.
+	Stdout io.Reader
+	Stderr io.Reader
+
+	// DoneCh should be set to a non-nil channel that will be closed
+	// when the control requests the RPC server to end.
+	DoneCh chan<- struct{}
+
+	lock sync.Mutex
+}
+
+// ServerProtocol impl.
+func (s *RPCServer) Init() error { return nil }
+
+// ServerProtocol impl.
+func (s *RPCServer) Config() string { return "" }
+
+// ServerProtocol impl.
+func (s *RPCServer) Serve(lis net.Listener) {
+	defer s.done()
+
+	for {
+		conn, err := lis.Accept()
+		if err != nil {
+			severity := "ERR"
+			if errors.Is(err, net.ErrClosed) {
+				severity = "DEBUG"
+			}
+			log.Printf("[%s] plugin: plugin server: %s", severity, err)
+			return
+		}
+
+		go s.ServeConn(conn)
+	}
+}
+
+// ServeConn runs a single connection.
+//
+// ServeConn blocks, serving the connection until the client hangs up.
+func (s *RPCServer) ServeConn(conn io.ReadWriteCloser) {
+	// First create the yamux server to wrap this connection
+	mux, err := yamux.Server(conn, nil)
+	if err != nil {
+		conn.Close()
+		log.Printf("[ERR] plugin: error creating yamux server: %s", err)
+		return
+	}
+
+	// Accept the control connection
+	control, err := mux.Accept()
+	if err != nil {
+		mux.Close()
+		if err != io.EOF {
+			log.Printf("[ERR] plugin: error accepting control connection: %s", err)
+		}
+
+		return
+	}
+
+	// Connect the stdstreams (in, out, err)
+	stdstream := make([]net.Conn, 2)
+	for i := range stdstream {
+		stdstream[i], err = mux.Accept()
+		if err != nil {
+			mux.Close()
+			log.Printf("[ERR] plugin: accepting stream %d: %s", i, err)
+			return
+		}
+	}
+
+	// Copy std streams out to the proper place
+	go copyStream("stdout", stdstream[0], s.Stdout)
+	go copyStream("stderr", stdstream[1], s.Stderr)
+
+	// Create the broker and start it up
+	broker := newMuxBroker(mux)
+	go broker.Run()
+
+	// Use the control connection to build the dispenser and serve the
+	// connection.
+	server := rpc.NewServer()
+	server.RegisterName("Control", &controlServer{
+		server: s,
+	})
+	server.RegisterName("Dispenser", &dispenseServer{
+		broker:  broker,
+		plugins: s.Plugins,
+	})
+	server.ServeConn(control)
+}
+
+// done is called internally by the control server to trigger the
+// doneCh to close which is listened to by the main process to cleanly
+// exit.
+func (s *RPCServer) done() {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	if s.DoneCh != nil {
+		close(s.DoneCh)
+		s.DoneCh = nil
+	}
+}
+
+// dispenseServer dispenses variousinterface implementations for Terraform.
+type controlServer struct {
+	server *RPCServer
+}
+
+// Ping can be called to verify the connection (and likely the binary)
+// is still alive to a plugin.
+func (c *controlServer) Ping(
+	null bool, response *struct{},
+) error {
+	*response = struct{}{}
+	return nil
+}
+
+func (c *controlServer) Quit(
+	null bool, response *struct{},
+) error {
+	// End the server
+	c.server.done()
+
+	// Always return true
+	*response = struct{}{}
+
+	return nil
+}
+
+// dispenseServer dispenses variousinterface implementations for Terraform.
+type dispenseServer struct {
+	broker  *MuxBroker
+	plugins map[string]Plugin
+}
+
+func (d *dispenseServer) Dispense(
+	name string, response *uint32,
+) error {
+	// Find the function to create this implementation
+	p, ok := d.plugins[name]
+	if !ok {
+		return fmt.Errorf("unknown plugin type: %s", name)
+	}
+
+	// Create the implementation first so we know if there is an error.
+	impl, err := p.Server(d.broker)
+	if err != nil {
+		// We turn the error into an errors error so that it works across RPC
+		return errors.New(err.Error())
+	}
+
+	// Reserve an ID for our implementation
+	id := d.broker.NextId()
+	*response = id
+
+	// Run the rest in a goroutine since it can only happen once this RPC
+	// call returns. We wait for a connection for the plugin implementation
+	// and serve it.
+	go func() {
+		conn, err := d.broker.Accept(id)
+		if err != nil {
+			log.Printf("[ERR] go-plugin: plugin dispense error: %s: %s", name, err)
+			return
+		}
+
+		serve(conn, "Plugin", impl)
+	}()
+
+	return nil
+}
+
+func serve(conn io.ReadWriteCloser, name string, v interface{}) {
+	server := rpc.NewServer()
+	if err := server.RegisterName(name, v); err != nil {
+		log.Printf("[ERR] go-plugin: plugin dispense error: %s", err)
+		return
+	}
+
+	server.ServeConn(conn)
+}

vendor/github.com/hashicorp/go-plugin/runner/runner.go

@@ -0,0 +1,72 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package runner
+
+import (
+	"context"
+	"io"
+)
+
+// Runner defines the interface required by go-plugin to manage the lifecycle of
+// of a plugin and attempt to negotiate a connection with it. Note that this
+// is orthogonal to the protocol and transport used, which is negotiated over stdout.
+type Runner interface {
+	// Start should start the plugin and ensure any work required for servicing
+	// other interface methods is done. If the context is cancelled, it should
+	// only abort any attempts to _start_ the plugin. Waiting and shutdown are
+	// handled separately.
+	Start(ctx context.Context) error
+
+	// Diagnose makes a best-effort attempt to return any debug information that
+	// might help users understand why a plugin failed to start and negotiate a
+	// connection.
+	Diagnose(ctx context.Context) string
+
+	// Stdout is used to negotiate the go-plugin protocol.
+	Stdout() io.ReadCloser
+
+	// Stderr is used for forwarding plugin logs to the host process logger.
+	Stderr() io.ReadCloser
+
+	// Name is a human-friendly name for the plugin, such as the path to the
+	// executable. It does not have to be unique.
+	Name() string
+
+	AttachedRunner
+}
+
+// AttachedRunner defines a limited subset of Runner's interface to represent the
+// reduced responsibility for plugin lifecycle when attaching to an already running
+// plugin.
+type AttachedRunner interface {
+	// Wait should wait until the plugin stops running, whether in response to
+	// an out of band signal or in response to calling Kill().
+	Wait(ctx context.Context) error
+
+	// Kill should stop the plugin and perform any cleanup required.
+	Kill(ctx context.Context) error
+
+	// ID is a unique identifier to represent the running plugin. e.g. pid or
+	// container ID.
+	ID() string
+
+	AddrTranslator
+}
+
+// AddrTranslator translates addresses between the execution context of the host
+// process and the plugin. For example, if the plugin is in a container, the file
+// path for a Unix socket may be different between the host and the container.
+//
+// It is only intended to be used by the host process.
+type AddrTranslator interface {
+	// Called before connecting on any addresses received back from the plugin.
+	PluginToHost(pluginNet, pluginAddr string) (hostNet string, hostAddr string, err error)
+
+	// Called on any host process addresses before they are sent to the plugin.
+	HostToPlugin(hostNet, hostAddr string) (pluginNet string, pluginAddr string, err error)
+}
+
+// ReattachFunc can be passed to a client's reattach config to reattach to an
+// already running plugin instead of starting it ourselves.
+type ReattachFunc func() (AttachedRunner, error)

vendor/github.com/hashicorp/go-plugin/server.go

@@ -0,0 +1,665 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"os/signal"
+	"os/user"
+	"runtime"
+	"sort"
+	"strconv"
+	"strings"
+
+	hclog "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-plugin/internal/grpcmux"
+	"google.golang.org/grpc"
+)
+
+// CoreProtocolVersion is the ProtocolVersion of the plugin system itself.
+// We will increment this whenever we change any protocol behavior. This
+// will invalidate any prior plugins but will at least allow us to iterate
+// on the core in a safe way. We will do our best to do this very
+// infrequently.
+const CoreProtocolVersion = 1
+
+// HandshakeConfig is the configuration used by client and servers to
+// handshake before starting a plugin connection. This is embedded by
+// both ServeConfig and ClientConfig.
+//
+// In practice, the plugin host creates a HandshakeConfig that is exported
+// and plugins then can easily consume it.
+type HandshakeConfig struct {
+	// ProtocolVersion is the version that clients must match on to
+	// agree they can communicate. This should match the ProtocolVersion
+	// set on ClientConfig when using a plugin.
+	// This field is not required if VersionedPlugins are being used in the
+	// Client or Server configurations.
+	ProtocolVersion uint
+
+	// MagicCookieKey and value are used as a very basic verification
+	// that a plugin is intended to be launched. This is not a security
+	// measure, just a UX feature. If the magic cookie doesn't match,
+	// we show human-friendly output.
+	MagicCookieKey   string
+	MagicCookieValue string
+}
+
+// PluginSet is a set of plugins provided to be registered in the plugin
+// server.
+type PluginSet map[string]Plugin
+
+// ServeConfig configures what sorts of plugins are served.
+type ServeConfig struct {
+	// HandshakeConfig is the configuration that must match clients.
+	HandshakeConfig
+
+	// TLSProvider is a function that returns a configured tls.Config.
+	TLSProvider func() (*tls.Config, error)
+
+	// Plugins are the plugins that are served.
+	// The implied version of this PluginSet is the Handshake.ProtocolVersion.
+	Plugins PluginSet
+
+	// VersionedPlugins is a map of PluginSets for specific protocol versions.
+	// These can be used to negotiate a compatible version between client and
+	// server. If this is set, Handshake.ProtocolVersion is not required.
+	VersionedPlugins map[int]PluginSet
+
+	// GRPCServer should be non-nil to enable serving the plugins over
+	// gRPC. This is a function to create the server when needed with the
+	// given server options. The server options populated by go-plugin will
+	// be for TLS if set. You may modify the input slice.
+	//
+	// Note that the grpc.Server will automatically be registered with
+	// the gRPC health checking service. This is not optional since go-plugin
+	// relies on this to implement Ping().
+	GRPCServer func([]grpc.ServerOption) *grpc.Server
+
+	// Logger is used to pass a logger into the server. If none is provided the
+	// server will create a default logger.
+	Logger hclog.Logger
+
+	// Test, if non-nil, will put plugin serving into "test mode". This is
+	// meant to be used as part of `go test` within a plugin's codebase to
+	// launch the plugin in-process and output a ReattachConfig.
+	//
+	// This changes the behavior of the server in a number of ways to
+	// accomodate the expectation of running in-process:
+	//
+	//   * The handshake cookie is not validated.
+	//   * Stdout/stderr will receive plugin reads and writes
+	//   * Connection information will not be sent to stdout
+	//
+	Test *ServeTestConfig
+}
+
+// ServeTestConfig configures plugin serving for test mode. See ServeConfig.Test.
+type ServeTestConfig struct {
+	// Context, if set, will force the plugin serving to end when cancelled.
+	// This is only a test configuration because the non-test configuration
+	// expects to take over the process and therefore end on an interrupt or
+	// kill signal. For tests, we need to kill the plugin serving routinely
+	// and this provides a way to do so.
+	//
+	// If you want to wait for the plugin process to close before moving on,
+	// you can wait on CloseCh.
+	Context context.Context
+
+	// If this channel is non-nil, we will send the ReattachConfig via
+	// this channel. This can be encoded (via JSON recommended) to the
+	// plugin client to attach to this plugin.
+	ReattachConfigCh chan<- *ReattachConfig
+
+	// CloseCh, if non-nil, will be closed when serving exits. This can be
+	// used along with Context to determine when the server is fully shut down.
+	// If this is not set, you can still use Context on its own, but note there
+	// may be a period of time between canceling the context and the plugin
+	// server being shut down.
+	CloseCh chan<- struct{}
+
+	// SyncStdio, if true, will enable the client side "SyncStdout/Stderr"
+	// functionality to work. This defaults to false because the implementation
+	// of making this work within test environments is particularly messy
+	// and SyncStdio functionality is fairly rare, so we default to the simple
+	// scenario.
+	SyncStdio bool
+}
+
+func unixSocketConfigFromEnv() UnixSocketConfig {
+	return UnixSocketConfig{
+		Group:     os.Getenv(EnvUnixSocketGroup),
+		socketDir: os.Getenv(EnvUnixSocketDir),
+	}
+}
+
+// protocolVersion determines the protocol version and plugin set to be used by
+// the server. In the event that there is no suitable version, the last version
+// in the config is returned leaving the client to report the incompatibility.
+func protocolVersion(opts *ServeConfig) (int, Protocol, PluginSet) {
+	protoVersion := int(opts.ProtocolVersion)
+	pluginSet := opts.Plugins
+	protoType := ProtocolNetRPC
+	// Check if the client sent a list of acceptable versions
+	var clientVersions []int
+	if vs := os.Getenv("PLUGIN_PROTOCOL_VERSIONS"); vs != "" {
+		for _, s := range strings.Split(vs, ",") {
+			v, err := strconv.Atoi(s)
+			if err != nil {
+				fmt.Fprintf(os.Stderr, "server sent invalid plugin version %q", s)
+				continue
+			}
+			clientVersions = append(clientVersions, v)
+		}
+	}
+
+	// We want to iterate in reverse order, to ensure we match the newest
+	// compatible plugin version.
+	sort.Sort(sort.Reverse(sort.IntSlice(clientVersions)))
+
+	// set the old un-versioned fields as if they were versioned plugins
+	if opts.VersionedPlugins == nil {
+		opts.VersionedPlugins = make(map[int]PluginSet)
+	}
+
+	if pluginSet != nil {
+		opts.VersionedPlugins[protoVersion] = pluginSet
+	}
+
+	// Sort the version to make sure we match the latest first
+	var versions []int
+	for v := range opts.VersionedPlugins {
+		versions = append(versions, v)
+	}
+
+	sort.Sort(sort.Reverse(sort.IntSlice(versions)))
+
+	// See if we have multiple versions of Plugins to choose from
+	for _, version := range versions {
+		// Record each version, since we guarantee that this returns valid
+		// values even if they are not a protocol match.
+		protoVersion = version
+		pluginSet = opts.VersionedPlugins[version]
+
+		// If we have a configured gRPC server we should select a protocol
+		if opts.GRPCServer != nil {
+			// All plugins in a set must use the same transport, so check the first
+			// for the protocol type
+			for _, p := range pluginSet {
+				switch p.(type) {
+				case GRPCPlugin:
+					protoType = ProtocolGRPC
+				default:
+					protoType = ProtocolNetRPC
+				}
+				break
+			}
+		}
+
+		for _, clientVersion := range clientVersions {
+			if clientVersion == protoVersion {
+				return protoVersion, protoType, pluginSet
+			}
+		}
+	}
+
+	// Return the lowest version as the fallback.
+	// Since we iterated over all the versions in reverse order above, these
+	// values are from the lowest version number plugins (which may be from
+	// a combination of the Handshake.ProtocolVersion and ServeConfig.Plugins
+	// fields). This allows serving the oldest version of our plugins to a
+	// legacy client that did not send a PLUGIN_PROTOCOL_VERSIONS list.
+	return protoVersion, protoType, pluginSet
+}
+
+// Serve serves the plugins given by ServeConfig.
+//
+// Serve doesn't return until the plugin is done being executed. Any
+// fixable errors will be output to os.Stderr and the process will
+// exit with a status code of 1. Serve will panic for unexpected
+// conditions where a user's fix is unknown.
+//
+// This is the method that plugins should call in their main() functions.
+func Serve(opts *ServeConfig) {
+	exitCode := -1
+	// We use this to trigger an `os.Exit` so that we can execute our other
+	// deferred functions. In test mode, we just output the err to stderr
+	// and return.
+	defer func() {
+		if opts.Test == nil && exitCode >= 0 {
+			os.Exit(exitCode)
+		}
+
+		if opts.Test != nil && opts.Test.CloseCh != nil {
+			close(opts.Test.CloseCh)
+		}
+	}()
+
+	if opts.Test == nil {
+		// Validate the handshake config
+		if opts.MagicCookieKey == "" || opts.MagicCookieValue == "" {
+			fmt.Fprintf(os.Stderr,
+				"Misconfigured ServeConfig given to serve this plugin: no magic cookie\n"+
+					"key or value was set. Please notify the plugin author and report\n"+
+					"this as a bug.\n")
+			exitCode = 1
+			return
+		}
+
+		// First check the cookie
+		if os.Getenv(opts.MagicCookieKey) != opts.MagicCookieValue {
+			fmt.Fprintf(os.Stderr,
+				"This binary is a plugin. These are not meant to be executed directly.\n"+
+					"Please execute the program that consumes these plugins, which will\n"+
+					"load any plugins automatically\n")
+			exitCode = 1
+			return
+		}
+	}
+
+	// negotiate the version and plugins
+	// start with default version in the handshake config
+	protoVersion, protoType, pluginSet := protocolVersion(opts)
+
+	logger := opts.Logger
+	if logger == nil {
+		// internal logger to os.Stderr
+		logger = hclog.New(&hclog.LoggerOptions{
+			Level:      hclog.Trace,
+			Output:     os.Stderr,
+			JSONFormat: true,
+		})
+	}
+
+	// Register a listener so we can accept a connection
+	listener, err := serverListener(unixSocketConfigFromEnv())
+	if err != nil {
+		logger.Error("plugin init error", "error", err)
+		return
+	}
+
+	// Close the listener on return. We wrap this in a func() on purpose
+	// because the "listener" reference may change to TLS.
+	defer func() {
+		listener.Close()
+	}()
+
+	var tlsConfig *tls.Config
+	if opts.TLSProvider != nil {
+		tlsConfig, err = opts.TLSProvider()
+		if err != nil {
+			logger.Error("plugin tls init", "error", err)
+			return
+		}
+	}
+
+	var serverCert string
+	clientCert := os.Getenv("PLUGIN_CLIENT_CERT")
+	// If the client is configured using AutoMTLS, the certificate will be here,
+	// and we need to generate our own in response.
+	if tlsConfig == nil && clientCert != "" {
+		logger.Info("configuring server automatic mTLS")
+		clientCertPool := x509.NewCertPool()
+		if !clientCertPool.AppendCertsFromPEM([]byte(clientCert)) {
+			logger.Error("client cert provided but failed to parse", "cert", clientCert)
+		}
+
+		certPEM, keyPEM, err := generateCert()
+		if err != nil {
+			logger.Error("failed to generate server certificate", "error", err)
+			panic(err)
+		}
+
+		cert, err := tls.X509KeyPair(certPEM, keyPEM)
+		if err != nil {
+			logger.Error("failed to parse server certificate", "error", err)
+			panic(err)
+		}
+
+		tlsConfig = &tls.Config{
+			Certificates: []tls.Certificate{cert},
+			ClientAuth:   tls.RequireAndVerifyClientCert,
+			ClientCAs:    clientCertPool,
+			MinVersion:   tls.VersionTLS12,
+			RootCAs:      clientCertPool,
+			ServerName:   "localhost",
+		}
+
+		// We send back the raw leaf cert data for the client rather than the
+		// PEM, since the protocol can't handle newlines.
+		serverCert = base64.RawStdEncoding.EncodeToString(cert.Certificate[0])
+	}
+
+	// Create the channel to tell us when we're done
+	doneCh := make(chan struct{})
+
+	// Create our new stdout, stderr files. These will override our built-in
+	// stdout/stderr so that it works across the stream boundary.
+	var stdout_r, stderr_r io.Reader
+	stdout_r, stdout_w, err := os.Pipe()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error preparing plugin: %s\n", err)
+		os.Exit(1)
+	}
+	stderr_r, stderr_w, err := os.Pipe()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error preparing plugin: %s\n", err)
+		os.Exit(1)
+	}
+
+	// If we're in test mode, we tee off the reader and write the data
+	// as-is to our normal Stdout and Stderr so that they continue working
+	// while stdio works. This is because in test mode, we assume we're running
+	// in `go test` or some equivalent and we want output to go to standard
+	// locations.
+	if opts.Test != nil {
+		// TODO(mitchellh): This isn't super ideal because a TeeReader
+		// only works if the reader side is actively read. If we never
+		// connect via a plugin client, the output still gets swallowed.
+		stdout_r = io.TeeReader(stdout_r, os.Stdout)
+		stderr_r = io.TeeReader(stderr_r, os.Stderr)
+	}
+
+	// Build the server type
+	var server ServerProtocol
+	switch protoType {
+	case ProtocolNetRPC:
+		// If we have a TLS configuration then we wrap the listener
+		// ourselves and do it at that level.
+		if tlsConfig != nil {
+			listener = tls.NewListener(listener, tlsConfig)
+		}
+
+		// Create the RPC server to dispense
+		server = &RPCServer{
+			Plugins: pluginSet,
+			Stdout:  stdout_r,
+			Stderr:  stderr_r,
+			DoneCh:  doneCh,
+		}
+
+	case ProtocolGRPC:
+		var muxer *grpcmux.GRPCServerMuxer
+		if multiplex, _ := strconv.ParseBool(os.Getenv(envMultiplexGRPC)); multiplex {
+			muxer = grpcmux.NewGRPCServerMuxer(logger, listener)
+			listener = muxer
+		}
+
+		// Create the gRPC server
+		server = &GRPCServer{
+			Plugins: pluginSet,
+			Server:  opts.GRPCServer,
+			TLS:     tlsConfig,
+			Stdout:  stdout_r,
+			Stderr:  stderr_r,
+			DoneCh:  doneCh,
+			logger:  logger,
+			muxer:   muxer,
+		}
+
+	default:
+		panic("unknown server protocol: " + protoType)
+	}
+
+	// Initialize the servers
+	if err := server.Init(); err != nil {
+		logger.Error("protocol init", "error", err)
+		return
+	}
+
+	logger.Debug("plugin address", "network", listener.Addr().Network(), "address", listener.Addr().String())
+
+	// Output the address and service name to stdout so that the client can
+	// bring it up. In test mode, we don't do this because clients will
+	// attach via a reattach config.
+	if opts.Test == nil {
+		const grpcBrokerMultiplexingSupported = true
+		protocolLine := fmt.Sprintf("%d|%d|%s|%s|%s|%s",
+			CoreProtocolVersion,
+			protoVersion,
+			listener.Addr().Network(),
+			listener.Addr().String(),
+			protoType,
+			serverCert)
+
+		// Old clients will error with new plugins if we blindly append the
+		// seventh segment for gRPC broker multiplexing support, because old
+		// client code uses strings.SplitN(line, "|", 6), which means a seventh
+		// segment will get appended to the sixth segment as "sixthpart|true".
+		//
+		// If the environment variable is set, we assume the client is new enough
+		// to handle a seventh segment, as it should now use
+		// strings.Split(line, "|") and always handle each segment individually.
+		if os.Getenv(envMultiplexGRPC) != "" {
+			protocolLine += fmt.Sprintf("|%v", grpcBrokerMultiplexingSupported)
+		}
+		fmt.Printf("%s\n", protocolLine)
+		os.Stdout.Sync()
+	} else if ch := opts.Test.ReattachConfigCh; ch != nil {
+		// Send back the reattach config that can be used. This isn't
+		// quite ready if they connect immediately but the client should
+		// retry a few times.
+		ch <- &ReattachConfig{
+			Protocol:        protoType,
+			ProtocolVersion: protoVersion,
+			Addr:            listener.Addr(),
+			Pid:             os.Getpid(),
+			Test:            true,
+		}
+	}
+
+	// Eat the interrupts. In test mode we disable this so that go test
+	// can be cancelled properly.
+	if opts.Test == nil {
+		ch := make(chan os.Signal, 1)
+		signal.Notify(ch, os.Interrupt)
+		go func() {
+			count := 0
+			for {
+				<-ch
+				count++
+				logger.Trace("plugin received interrupt signal, ignoring", "count", count)
+			}
+		}()
+	}
+
+	// Set our stdout, stderr to the stdio stream that clients can retrieve
+	// using ClientConfig.SyncStdout/err. We only do this for non-test mode
+	// or if the test mode explicitly requests it.
+	//
+	// In test mode, we use a multiwriter so that the data continues going
+	// to the normal stdout/stderr so output can show up in test logs. We
+	// also send to the stdio stream so that clients can continue working
+	// if they depend on that.
+	if opts.Test == nil || opts.Test.SyncStdio {
+		if opts.Test != nil {
+			// In test mode we need to maintain the original values so we can
+			// reset it.
+			defer func(out, err *os.File) {
+				os.Stdout = out
+				os.Stderr = err
+			}(os.Stdout, os.Stderr)
+		}
+		os.Stdout = stdout_w
+		os.Stderr = stderr_w
+	}
+
+	// Accept connections and wait for completion
+	go server.Serve(listener)
+
+	ctx := context.Background()
+	if opts.Test != nil && opts.Test.Context != nil {
+		ctx = opts.Test.Context
+	}
+	select {
+	case <-ctx.Done():
+		// Cancellation. We can stop the server by closing the listener.
+		// This isn't graceful at all but this is currently only used by
+		// tests and its our only way to stop.
+		listener.Close()
+
+		// If this is a grpc server, then we also ask the server itself to
+		// end which will kill all connections. There isn't an easy way to do
+		// this for net/rpc currently but net/rpc is more and more unused.
+		if s, ok := server.(*GRPCServer); ok {
+			s.Stop()
+		}
+
+		// Wait for the server itself to shut down
+		<-doneCh
+
+	case <-doneCh:
+		// Note that given the documentation of Serve we should probably be
+		// setting exitCode = 0 and using os.Exit here. That's how it used to
+		// work before extracting this library. However, for years we've done
+		// this so we'll keep this functionality.
+	}
+}
+
+func serverListener(unixSocketCfg UnixSocketConfig) (net.Listener, error) {
+	if runtime.GOOS == "windows" {
+		return serverListener_tcp()
+	}
+
+	return serverListener_unix(unixSocketCfg)
+}
+
+func serverListener_tcp() (net.Listener, error) {
+	envMinPort := os.Getenv("PLUGIN_MIN_PORT")
+	envMaxPort := os.Getenv("PLUGIN_MAX_PORT")
+
+	var minPort, maxPort int64
+	var err error
+
+	switch {
+	case len(envMinPort) == 0:
+		minPort = 0
+	default:
+		minPort, err = strconv.ParseInt(envMinPort, 10, 32)
+		if err != nil {
+			return nil, fmt.Errorf("Couldn't get value from PLUGIN_MIN_PORT: %v", err)
+		}
+	}
+
+	switch {
+	case len(envMaxPort) == 0:
+		maxPort = 0
+	default:
+		maxPort, err = strconv.ParseInt(envMaxPort, 10, 32)
+		if err != nil {
+			return nil, fmt.Errorf("Couldn't get value from PLUGIN_MAX_PORT: %v", err)
+		}
+	}
+
+	if minPort > maxPort {
+		return nil, fmt.Errorf("PLUGIN_MIN_PORT value of %d is greater than PLUGIN_MAX_PORT value of %d", minPort, maxPort)
+	}
+
+	for port := minPort; port <= maxPort; port++ {
+		address := fmt.Sprintf("127.0.0.1:%d", port)
+		listener, err := net.Listen("tcp", address)
+		if err == nil {
+			return listener, nil
+		}
+	}
+
+	return nil, errors.New("Couldn't bind plugin TCP listener")
+}
+
+func serverListener_unix(unixSocketCfg UnixSocketConfig) (net.Listener, error) {
+	tf, err := os.CreateTemp(unixSocketCfg.socketDir, "plugin")
+	if err != nil {
+		return nil, err
+	}
+	path := tf.Name()
+
+	// Close the file and remove it because it has to not exist for
+	// the domain socket.
+	if err := tf.Close(); err != nil {
+		return nil, err
+	}
+	if err := os.Remove(path); err != nil {
+		return nil, err
+	}
+
+	l, err := net.Listen("unix", path)
+	if err != nil {
+		return nil, err
+	}
+
+	// By default, unix sockets are only writable by the owner. Set up a custom
+	// group owner and group write permissions if configured.
+	if unixSocketCfg.Group != "" {
+		err = setGroupWritable(path, unixSocketCfg.Group, 0o660)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// Wrap the listener in rmListener so that the Unix domain socket file
+	// is removed on close.
+	return newDeleteFileListener(l, path), nil
+}
+
+func setGroupWritable(path, groupString string, mode os.FileMode) error {
+	groupID, err := strconv.Atoi(groupString)
+	if err != nil {
+		group, err := user.LookupGroup(groupString)
+		if err != nil {
+			return fmt.Errorf("failed to find gid from %q: %w", groupString, err)
+		}
+		groupID, err = strconv.Atoi(group.Gid)
+		if err != nil {
+			return fmt.Errorf("failed to parse %q group's gid as an integer: %w", groupString, err)
+		}
+	}
+
+	err = os.Chown(path, -1, groupID)
+	if err != nil {
+		return err
+	}
+
+	err = os.Chmod(path, mode)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// rmListener is an implementation of net.Listener that forwards most
+// calls to the listener but also calls an additional close function. We
+// use this to cleanup the unix domain socket on close, as well as clean
+// up multiplexed listeners.
+type rmListener struct {
+	net.Listener
+	close func() error
+}
+
+func newDeleteFileListener(ln net.Listener, path string) *rmListener {
+	return &rmListener{
+		Listener: ln,
+		close: func() error {
+			return os.Remove(path)
+		},
+	}
+}
+
+func (l *rmListener) Close() error {
+	// Close the listener itself
+	if err := l.Listener.Close(); err != nil {
+		return err
+	}
+
+	// Remove the file
+	return l.close()
+}

vendor/github.com/hashicorp/go-plugin/server_mux.go

@@ -0,0 +1,34 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"fmt"
+	"os"
+)
+
+// ServeMuxMap is the type that is used to configure ServeMux
+type ServeMuxMap map[string]*ServeConfig
+
+// ServeMux is like Serve, but serves multiple types of plugins determined
+// by the argument given on the command-line.
+//
+// This command doesn't return until the plugin is done being executed. Any
+// errors are logged or output to stderr.
+func ServeMux(m ServeMuxMap) {
+	if len(os.Args) != 2 {
+		fmt.Fprintf(os.Stderr,
+			"Invoked improperly. This is an internal command that shouldn't\n"+
+				"be manually invoked.\n")
+		os.Exit(1)
+	}
+
+	opts, ok := m[os.Args[1]]
+	if !ok {
+		fmt.Fprintf(os.Stderr, "Unknown plugin: %s\n", os.Args[1])
+		os.Exit(1)
+	}
+
+	Serve(opts)
+}

vendor/github.com/hashicorp/go-plugin/stream.go

@@ -0,0 +1,21 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"io"
+	"log"
+)
+
+func copyStream(name string, dst io.Writer, src io.Reader) {
+	if src == nil {
+		panic(name + ": src is nil")
+	}
+	if dst == nil {
+		panic(name + ": dst is nil")
+	}
+	if _, err := io.Copy(dst, src); err != nil && err != io.EOF {
+		log.Printf("[ERR] plugin: stream copy '%s' error: %s", name, err)
+	}
+}

vendor/github.com/hashicorp/go-plugin/testing.go

@@ -0,0 +1,185 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"net"
+	"net/rpc"
+
+	hclog "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-plugin/internal/grpcmux"
+	"github.com/mitchellh/go-testing-interface"
+	"google.golang.org/grpc"
+)
+
+// TestOptions allows specifying options that can affect the behavior of the
+// test functions
+type TestOptions struct {
+	//ServerStdout causes the given value to be used in place of a blank buffer
+	//for RPCServer's Stdout
+	ServerStdout io.ReadCloser
+
+	//ServerStderr causes the given value to be used in place of a blank buffer
+	//for RPCServer's Stderr
+	ServerStderr io.ReadCloser
+}
+
+// The testing file contains test helpers that you can use outside of
+// this package for making it easier to test plugins themselves.
+
+// TestConn is a helper function for returning a client and server
+// net.Conn connected to each other.
+func TestConn(t testing.T) (net.Conn, net.Conn) {
+	// Listen to any local port. This listener will be closed
+	// after a single connection is established.
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	// Start a goroutine to accept our client connection
+	var serverConn net.Conn
+	doneCh := make(chan struct{})
+	go func() {
+		defer close(doneCh)
+		defer l.Close()
+		var err error
+		serverConn, err = l.Accept()
+		if err != nil {
+			t.Fatalf("err: %s", err)
+		}
+	}()
+
+	// Connect to the server
+	clientConn, err := net.Dial("tcp", l.Addr().String())
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	// Wait for the server side to acknowledge it has connected
+	<-doneCh
+
+	return clientConn, serverConn
+}
+
+// TestRPCConn returns a rpc client and server connected to each other.
+func TestRPCConn(t testing.T) (*rpc.Client, *rpc.Server) {
+	clientConn, serverConn := TestConn(t)
+
+	server := rpc.NewServer()
+	go server.ServeConn(serverConn)
+
+	client := rpc.NewClient(clientConn)
+	return client, server
+}
+
+// TestPluginRPCConn returns a plugin RPC client and server that are connected
+// together and configured.
+func TestPluginRPCConn(t testing.T, ps map[string]Plugin, opts *TestOptions) (*RPCClient, *RPCServer) {
+	// Create two net.Conns we can use to shuttle our control connection
+	clientConn, serverConn := TestConn(t)
+
+	// Start up the server
+	server := &RPCServer{Plugins: ps, Stdout: new(bytes.Buffer), Stderr: new(bytes.Buffer)}
+	if opts != nil {
+		if opts.ServerStdout != nil {
+			server.Stdout = opts.ServerStdout
+		}
+		if opts.ServerStderr != nil {
+			server.Stderr = opts.ServerStderr
+		}
+	}
+	go server.ServeConn(serverConn)
+
+	// Connect the client to the server
+	client, err := NewRPCClient(clientConn, ps)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	return client, server
+}
+
+// TestGRPCConn returns a gRPC client conn and grpc server that are connected
+// together and configured. The register function is used to register services
+// prior to the Serve call. This is used to test gRPC connections.
+func TestGRPCConn(t testing.T, register func(*grpc.Server)) (*grpc.ClientConn, *grpc.Server) {
+	// Create a listener
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	server := grpc.NewServer()
+	register(server)
+	go server.Serve(l)
+
+	// Connect to the server
+	conn, err := grpc.Dial(
+		l.Addr().String(),
+		grpc.WithBlock(),
+		grpc.WithInsecure())
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	// Connection successful, close the listener
+	l.Close()
+
+	return conn, server
+}
+
+// TestPluginGRPCConn returns a plugin gRPC client and server that are connected
+// together and configured. This is used to test gRPC connections.
+func TestPluginGRPCConn(t testing.T, multiplex bool, ps map[string]Plugin) (*GRPCClient, *GRPCServer) {
+	// Create a listener
+	ln, err := serverListener(UnixSocketConfig{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	logger := hclog.New(&hclog.LoggerOptions{
+		Level: hclog.Debug,
+	})
+
+	// Start up the server
+	var muxer *grpcmux.GRPCServerMuxer
+	if multiplex {
+		muxer = grpcmux.NewGRPCServerMuxer(logger, ln)
+		ln = muxer
+	}
+	server := &GRPCServer{
+		Plugins: ps,
+		DoneCh:  make(chan struct{}),
+		Server:  DefaultGRPCServer,
+		Stdout:  new(bytes.Buffer),
+		Stderr:  new(bytes.Buffer),
+		logger:  logger,
+		muxer:   muxer,
+	}
+	if err := server.Init(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	go server.Serve(ln)
+
+	client := &Client{
+		address:  ln.Addr(),
+		protocol: ProtocolGRPC,
+		config: &ClientConfig{
+			Plugins:             ps,
+			GRPCBrokerMultiplex: multiplex,
+		},
+		logger: logger,
+	}
+
+	grpcClient, err := newGRPCClient(context.Background(), client)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return grpcClient, server
+}