OpenTofu/Terraform Registry
Overview
Section titled “Overview”A registry address is an indirection: the registry resolves a module and version to an underlying archive, such as a versioned tarball or a Git commit. The CAS keys that resolved archive, so caching tracks the immutable artifact rather than the registry address.
The cheap probe
Section titled “The cheap probe”The probe Terragrunt uses to attempt to avoid fetching tfr sources is the registry’s service-discovery and module-download protocol against the registry host. When the URL omits a host (the tfr:/// form), the default registry is used. The probe requires an explicit version in the URL.
It resolves the module to the download location the registry returns and uses that location as the cache key. A //subdir selector is stripped before the probe, so two requests that differ only by subdirectory share one key; the download still extracts the requested subdirectory.
Cache key & deduplication
Section titled “Cache key & deduplication”The resolved archive location is content-addressed, so two tfr:// requests that resolve to the same archive share one CAS entry. Because the key tracks the underlying archive rather than the version string, republishing a different artifact under the same version resolves to a new key instead of serving stale content. File blobs are content-addressed.
Cache miss
Section titled “Cache miss”When the resolved archive location is not yet in the store, Terragrunt downloads the archive, ingests it, and links it into the target.
Cache hit
Section titled “Cache hit”When the resolved location is already present, Terragrunt links the cached tree without downloading.
Fallback behavior
Section titled “Fallback behavior”A malformed URL, a missing version, or any registry error makes the probe yield no key, and Terragrunt falls back to downloading and content-hashing the result. If the download itself fails, that underlying error surfaces on the real fetch attempt.