Update terraform-ls release verification to use new public key

[aeschright]

HashiCorp has rotated and revoked the public GPG key we use to verify terraform-ls packages due to a reported vulnerability. For this project, that means that the dependency js-releases needs to be updated with the new GPG key. As soon as that update is published and we can verify that previous terraform-ls releases have been re-signed, we'll push out an update.

In the interim, new users of this extension might experience errors when installing the language server. Existing users should be unaffected, since terraform-ls releases are on hold while this incident is being resolved. Please see the security discussion thread if you have questions about the incident as a whole.

[thmslx]

Not sure where to mention this, but it looks like the release containing this fix (2.10.1) is not available in https://open-vsx.org/extension/hashicorp/terraform . The latest available is 2.10.0 as far as I can see.

There's this message on the page, might be related:

This version of the “HashiCorp Terraform” extension was published by open-vsx. That user account is not a verified publisher of the namespace “hashicorp” of this extension. See the documentation to learn how we handle namespaces and what you can do to eliminate this warning.

[aeschright]

There was a request for us to start publishing there but I haven't looked into it yet. For now, the VSCode Marketplace is the only official release.

[thmslx]

Ok thanks, I was not aware that code OSS switched from marketplace for openVSX. I've added my 👍 on the other issue

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the context necessary to investigate further.