From 04b59f4591e51fa47db6165feed3bcb94c7dbe69 Mon Sep 17 00:00:00 2001
From: koralowiec <36413794+koralowiec@users.noreply.github.com>
Date: Sat, 18 Oct 2025 16:13:40 +0000
Subject: [PATCH 1/4] feat(opentofu): init

---
 src/opentofu/devcontainer-feature.json |  25 ++++
 src/opentofu/install.sh                |  21 +++
 src/opentofu/library_scripts.sh        | 173 +++++++++++++++++++++++++
 test/opentofu/scenarios.json           |  16 +++
 test/opentofu/test.sh                  |   9 ++
 test/opentofu/test_debian.sh           |   9 ++
 test/opentofu/test_specific_version.sh |   9 ++
 7 files changed, 262 insertions(+)
 create mode 100644 src/opentofu/devcontainer-feature.json
 create mode 100644 src/opentofu/install.sh
 create mode 100644 src/opentofu/library_scripts.sh
 create mode 100644 test/opentofu/scenarios.json
 create mode 100644 test/opentofu/test.sh
 create mode 100644 test/opentofu/test_debian.sh
 create mode 100644 test/opentofu/test_specific_version.sh

diff --git a/src/opentofu/devcontainer-feature.json b/src/opentofu/devcontainer-feature.json
new file mode 100644
index 000000000..9d1f4252a
--- /dev/null
+++ b/src/opentofu/devcontainer-feature.json
@@ -0,0 +1,25 @@
+{
+    "id": "opentofu",
+    "version": "1.0.0",
+    "name": "opentofu (via Github Releases)",
+    "documentationURL": "http://github.com/devcontainers-extra/features/tree/main/src/opentofu",
+    "description": "OpenTofu is an OSS tool for building, changing, and versioning infrastructure safely and efficiently.",
+    "options": {
+        "version": {
+            "default": "latest",
+            "description": "Select the version to install.",
+            "proposals": [
+                "latest"
+            ],
+            "type": "string"
+        }
+    },
+    "customizations": {
+        "vscode": {
+            "extensions": [
+                "opentofu.vscode-opentofu"
+            ]
+        }
+    },
+    "installsAfter": []
+}
\ No newline at end of file
diff --git a/src/opentofu/install.sh b/src/opentofu/install.sh
new file mode 100644
index 000000000..7291a15c2
--- /dev/null
+++ b/src/opentofu/install.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+set -e
+
+source ./library_scripts.sh
+
+# nanolayer is a cli utility which keeps container layers as small as possible
+# source code: https://github.com/devcontainers-extra/nanolayer
+# `ensure_nanolayer` is a bash function that will find any existing nanolayer installations,
+# and if missing - will download a temporary copy that automatically get deleted at the end
+# of the script
+ensure_nanolayer nanolayer_location "v0.5.6"
+
+# Example nanolayer installation via devcontainer-feature
+$nanolayer_location \
+    install \
+    devcontainer-feature \
+    "ghcr.io/devcontainers-extra/features/gh-release:1" \
+    --option repo='opentofu/opentofu' --option binaryNames='tofu' --option version="$VERSION"
+
+echo 'Done!'
diff --git a/src/opentofu/library_scripts.sh b/src/opentofu/library_scripts.sh
new file mode 100644
index 000000000..f6d0760d7
--- /dev/null
+++ b/src/opentofu/library_scripts.sh
@@ -0,0 +1,173 @@
+#!/usr/bin/env bash
+
+clean_download() {
+    # The purpose of this function is to download a file with minimal impact on container layer size
+    # this means if no valid downloader is found (curl or wget) then we install a downloader (currently wget) in a
+    # temporary manner, and making sure to
+    # 1. uninstall the downloader at the return of the function
+    # 2. revert back any changes to the package installer database/cache (for example apt-get lists)
+    # The above steps will minimize the leftovers being created while installing the downloader
+    # Supported distros:
+    #  debian/ubuntu/alpine
+
+    url=$1
+    output_location=$2
+    tempdir=$(mktemp -d)
+    downloader_installed=""
+
+    function _apt_get_install() {
+        tempdir=$1
+
+        # copy current state of apt list - in order to revert back later (minimize contianer layer size)
+        cp -p -R /var/lib/apt/lists $tempdir
+        apt-get update -y
+        apt-get -y install --no-install-recommends wget ca-certificates
+    }
+
+    function _apt_get_cleanup() {
+        tempdir=$1
+
+        echo "removing wget"
+        apt-get -y purge wget --auto-remove
+
+        echo "revert back apt lists"
+        rm -rf /var/lib/apt/lists/*
+        rm -r /var/lib/apt/lists && mv $tempdir/lists /var/lib/apt/lists
+    }
+
+    function _apk_install() {
+        tempdir=$1
+        # copy current state of apk cache - in order to revert back later (minimize contianer layer size)
+        cp -p -R /var/cache/apk $tempdir
+
+        apk add --no-cache wget
+    }
+
+    function _apk_cleanup() {
+        tempdir=$1
+
+        echo "removing wget"
+        apk del wget
+    }
+    # try to use either wget or curl if one of them already installer
+    if type curl >/dev/null 2>&1; then
+        downloader=curl
+    elif type wget >/dev/null 2>&1; then
+        downloader=wget
+    else
+        downloader=""
+    fi
+
+    # in case none of them is installed, install wget temporarly
+    if [ -z $downloader ]; then
+        if [ -x "/usr/bin/apt-get" ]; then
+            _apt_get_install $tempdir
+        elif [ -x "/sbin/apk" ]; then
+            _apk_install $tempdir
+        else
+            echo "distro not supported"
+            exit 1
+        fi
+        downloader="wget"
+        downloader_installed="true"
+    fi
+
+    if [ $downloader = "wget" ]; then
+        wget -q $url -O $output_location
+    else
+        curl -sfL $url -o $output_location
+    fi
+
+    # NOTE: the cleanup procedure was not implemented using `trap X RETURN` only because
+    # alpine lack bash, and RETURN is not a valid signal under sh shell
+    if ! [ -z $downloader_installed ]; then
+        if [ -x "/usr/bin/apt-get" ]; then
+            _apt_get_cleanup $tempdir
+        elif [ -x "/sbin/apk" ]; then
+            _apk_cleanup $tempdir
+        else
+            echo "distro not supported"
+            exit 1
+        fi
+    fi
+
+}
+
+ensure_nanolayer() {
+    # Ensure existance of the nanolayer cli program
+    local variable_name=$1
+
+    local required_version=$2
+    # normalize version
+    if ! [[ $required_version == v* ]]; then
+        required_version=v$required_version
+    fi
+
+    local nanolayer_location=""
+
+    # If possible - try to use an already installed nanolayer
+    if [[ -z "${NANOLAYER_FORCE_CLI_INSTALLATION}" ]]; then
+        if [[ -z "${NANOLAYER_CLI_LOCATION}" ]]; then
+            if type nanolayer >/dev/null 2>&1; then
+                echo "Found a pre-existing nanolayer in PATH"
+                nanolayer_location=nanolayer
+            fi
+        elif [ -f "${NANOLAYER_CLI_LOCATION}" ] && [ -x "${NANOLAYER_CLI_LOCATION}" ]; then
+            nanolayer_location=${NANOLAYER_CLI_LOCATION}
+            echo "Found a pre-existing nanolayer which were given in env variable: $nanolayer_location"
+        fi
+
+        # make sure its of the required version
+        if ! [[ -z "${nanolayer_location}" ]]; then
+            local current_version
+            current_version=$($nanolayer_location --version)
+            if ! [[ $current_version == v* ]]; then
+                current_version=v$current_version
+            fi
+
+            if ! [ $current_version == $required_version ]; then
+                echo "skipping usage of pre-existing nanolayer. (required version $required_version does not match existing version $current_version)"
+                nanolayer_location=""
+            fi
+        fi
+
+    fi
+
+    # If not previuse installation found, download it temporarly and delete at the end of the script
+    if [[ -z "${nanolayer_location}" ]]; then
+
+        if [ "$(uname -sm)" == "Linux x86_64" ] || [ "$(uname -sm)" == "Linux aarch64" ]; then
+            tmp_dir=$(mktemp -d -t nanolayer-XXXXXXXXXX)
+
+            clean_up() {
+                ARG=$?
+                rm -rf $tmp_dir
+                exit $ARG
+            }
+            trap clean_up EXIT
+
+            if [ -x "/sbin/apk" ]; then
+                clib_type=musl
+            else
+                clib_type=gnu
+            fi
+
+            tar_filename=nanolayer-"$(uname -m)"-unknown-linux-$clib_type.tgz
+
+            # clean download will minimize leftover in case a downloaderlike wget or curl need to be installed
+            clean_download https://github.com/devcontainers-extra/nanolayer/releases/download/$required_version/$tar_filename $tmp_dir/$tar_filename
+
+            tar xfzv $tmp_dir/$tar_filename -C "$tmp_dir"
+            chmod a+x $tmp_dir/nanolayer
+            nanolayer_location=$tmp_dir/nanolayer
+
+        else
+            echo "No binaries compiled for non-x86-linux architectures yet: $(uname -m)"
+            exit 1
+        fi
+    fi
+
+    # Expose outside the resolved location
+    declare -g ${variable_name}=$nanolayer_location
+
+}
diff --git a/test/opentofu/scenarios.json b/test/opentofu/scenarios.json
new file mode 100644
index 000000000..0e69056b6
--- /dev/null
+++ b/test/opentofu/scenarios.json
@@ -0,0 +1,16 @@
+{
+    "test_debian": {
+        "image": "mcr.microsoft.com/devcontainers/base:debian",
+        "features": {
+            "opentofu": {}
+        }
+    },
+    "test_specific_version": {
+        "image": "mcr.microsoft.com/devcontainers/base:debian",
+        "features": {
+            "opentofu": {
+                "version": "1.9.4"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/test/opentofu/test.sh b/test/opentofu/test.sh
new file mode 100644
index 000000000..e2ee7c632
--- /dev/null
+++ b/test/opentofu/test.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+set -e
+
+source dev-container-features-test-lib
+
+check "tofu is installed" tofu --version
+
+reportResults
diff --git a/test/opentofu/test_debian.sh b/test/opentofu/test_debian.sh
new file mode 100644
index 000000000..e2ee7c632
--- /dev/null
+++ b/test/opentofu/test_debian.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+set -e
+
+source dev-container-features-test-lib
+
+check "tofu is installed" tofu --version
+
+reportResults
diff --git a/test/opentofu/test_specific_version.sh b/test/opentofu/test_specific_version.sh
new file mode 100644
index 000000000..89b61bc2a
--- /dev/null
+++ b/test/opentofu/test_specific_version.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+set -e
+
+source dev-container-features-test-lib
+
+check "tofu version is equal to 1.9.4" sh -c "tofu --version | grep '1.9.4'"
+
+reportResults

From 305ec57e4894ca4613cebc560f0de62a6329e160 Mon Sep 17 00:00:00 2001
From: koralowiec <36413794+koralowiec@users.noreply.github.com>
Date: Sat, 18 Oct 2025 16:16:23 +0000
Subject: [PATCH 2/4] chore(opentofu): add missing newlines

---
 src/opentofu/devcontainer-feature.json | 2 +-
 test/opentofu/scenarios.json           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/opentofu/devcontainer-feature.json b/src/opentofu/devcontainer-feature.json
index 9d1f4252a..606e1834f 100644
--- a/src/opentofu/devcontainer-feature.json
+++ b/src/opentofu/devcontainer-feature.json
@@ -22,4 +22,4 @@
         }
     },
     "installsAfter": []
-}
\ No newline at end of file
+}
diff --git a/test/opentofu/scenarios.json b/test/opentofu/scenarios.json
index 0e69056b6..79f90bf6c 100644
--- a/test/opentofu/scenarios.json
+++ b/test/opentofu/scenarios.json
@@ -13,4 +13,4 @@
             }
         }
     }
-}
\ No newline at end of file
+}

From f9fcf922683e17893d88439ff288a2b26bcdfe5d Mon Sep 17 00:00:00 2001
From: koralowiec <36413794+koralowiec@users.noreply.github.com>
Date: Sat, 18 Oct 2025 18:37:37 +0200
Subject: [PATCH 3/4] fix(opentofu): add asset regex

---
 src/opentofu/install.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/opentofu/install.sh b/src/opentofu/install.sh
index 7291a15c2..ac563f603 100644
--- a/src/opentofu/install.sh
+++ b/src/opentofu/install.sh
@@ -16,6 +16,7 @@ $nanolayer_location \
     install \
     devcontainer-feature \
     "ghcr.io/devcontainers-extra/features/gh-release:1" \
-    --option repo='opentofu/opentofu' --option binaryNames='tofu' --option version="$VERSION"
+    --option repo='opentofu/opentofu' --option binaryNames='tofu' --option version="$VERSION" \
+    --option assetRegex='^.*\.tar\.gz$'
 
 echo 'Done!'

From a937d71157612b90845ccd9c223317d7331746ba Mon Sep 17 00:00:00 2001
From: koralowiec <36413794+koralowiec@users.noreply.github.com>
Date: Sat, 18 Oct 2025 18:41:52 +0200
Subject: [PATCH 4/4] docs(opentofu): add README

---
 src/opentofu/README.md | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 src/opentofu/README.md

diff --git a/src/opentofu/README.md b/src/opentofu/README.md
new file mode 100644
index 000000000..7feb44295
--- /dev/null
+++ b/src/opentofu/README.md
@@ -0,0 +1,30 @@
+
+# opentofu (via Github Releases) (opentofu)
+
+OpenTofu is an OSS tool for building, changing, and versioning infrastructure safely and efficiently.
+
+## Example Usage
+
+```json
+"features": {
+    "ghcr.io/devcontainers-extra/features/opentofu:1": {}
+}
+```
+
+## Options
+
+| Options Id | Description | Type | Default Value |
+|-----|-----|-----|-----|
+| version | Select the version to install. | string | latest |
+
+## Customizations
+
+### VS Code Extensions
+
+- `opentofu.vscode-opentofu`
+
+
+
+---
+
+_Note: This file was auto-generated from the [devcontainer-feature.json](devcontainer-feature.json).  Add additional notes to a `NOTES.md`._