Some Alpine-based packages must be locked when building with terraform

Start by reproducing the Alpine package configuration with terraform apply and inspect .terraform/modules/latest.this/main.tf at line 72, where the Invalid index error is reported. Trace how unpinned packages are represented before that expression runs. Done means the configuration completes without the Invalid index errors while retaining package locking behavior.

With the following config (alpine-base):

contents:
  packages:
    - alpine-baselayout-data
    - alpine-release
    - apk-tools
    - busybox
    - libc-utils

on terraform apply, we get the following obscure error:

╷
│ Warning: unable to lock certain packages
│ 
│   with module.latest.module.this.data.apko_config.this,
│   on .terraform/modules/latest.this/main.tf line 17, in data "apko_config" "this":
│   17: data "apko_config" "this" {
│ 
│ [alpine-release]
╵
╷
│ Warning: unable to lock certain packages for 386
│ 
│   with module.latest.module.this.data.apko_config.this,
│   on .terraform/modules/latest.this/main.tf line 17, in data "apko_config" "this":
│   17: data "apko_config" "this" {
│ 
│ [libcrypto3 libssl3 musl musl-utils]
╵
╷
│ Warning: unable to lock certain packages for amd64
│ 
│   with module.latest.module.this.data.apko_config.this,
│   on .terraform/modules/latest.this/main.tf line 17, in data "apko_config" "this":
│   17: data "apko_config" "this" {
│ 
│ [libcrypto3 libssl3 musl musl-utils]
╵
╷
│ Warning: unable to lock certain packages for arm/v6
│ 
│   with module.latest.module.this.data.apko_config.this,
│   on .terraform/modules/latest.this/main.tf line 17, in data "apko_config" "this":
│   17: data "apko_config" "this" {
│ 
│ [libcrypto3 libssl3 musl musl-utils]
╵
╷
│ Warning: unable to lock certain packages for arm/v7
│ 
│   with module.latest.module.this.data.apko_config.this,
│   on .terraform/modules/latest.this/main.tf line 17, in data "apko_config" "this":
│   17: data "apko_config" "this" {
│ 
│ [libcrypto3 libssl3 musl musl-utils]
╵
╷
│ Warning: unable to lock certain packages for arm64
│ 
│   with module.latest.module.this.data.apko_config.this,
│   on .terraform/modules/latest.this/main.tf line 17, in data "apko_config" "this":
│   17: data "apko_config" "this" {
│ 
│ [libcrypto3 libssl3 musl musl-utils]
╵
╷
│ Warning: unable to lock certain packages for ppc64le
│ 
│   with module.latest.module.this.data.apko_config.this,
│   on .terraform/modules/latest.this/main.tf line 17, in data "apko_config" "this":
│   17: data "apko_config" "this" {
│ 
│ [libcrypto3 libssl3 musl musl-utils]
╵
╷
│ Warning: unable to lock certain packages for riscv64
│ 
│   with module.latest.module.this.data.apko_config.this,
│   on .terraform/modules/latest.this/main.tf line 17, in data "apko_config" "this":
│   17: data "apko_config" "this" {
│ 
│ [libcrypto3 libssl3 musl musl-utils]
╵
╷
│ Warning: unable to lock certain packages for s390x
│ 
│   with module.latest.module.this.data.apko_config.this,
│   on .terraform/modules/latest.this/main.tf line 17, in data "apko_config" "this":
│   17: data "apko_config" "this" {
│ 
│ [libcrypto3 libssl3 musl musl-utils]
╵
╷
│ Error: Invalid index
│ 
│   on .terraform/modules/latest.this/main.tf line 72, in resource "cosign_attest" "slsa-provenance":
│   72:         for k in data.apko_config.this.config.contents.packages : split("=", k)[0] => split("=", k)[1]
│ 
│ The given key does not identify an element in this collection value: the given index is greater than or equal to the length of the
│ collection.
╵
╷
│ Error: Invalid index
│ 
│   on .terraform/modules/latest.this/main.tf line 72, in resource "cosign_attest" "slsa-provenance":
│   72:         for k in data.apko_config.this.config.contents.packages : split("=", k)[0] => split("=", k)[1]
│ 
│ The given key does not identify an element in this collection value: the given index is greater than or equal to the length of the
│ collection.
╵
╷
│ Error: Invalid index
│ 
│   on .terraform/modules/latest.this/main.tf line 72, in resource "cosign_attest" "slsa-provenance":
│   72:         for k in data.apko_config.this.config.contents.packages : split("=", k)[0] => split("=", k)[1]
│ 
│ The given key does not identify an element in this collection value: the given index is greater than or equal to the length of the
│ collection.
╵
╷
│ Error: Invalid index
│ 
│   on .terraform/modules/latest.this/main.tf line 72, in resource "cosign_attest" "slsa-provenance":
│   72:         for k in data.apko_config.this.config.contents.packages : split("=", k)[0] => split("=", k)[1]
│ 
│ The given key does not identify an element in this collection value: the given index is greater than or equal to the length of the
│ collection.
╵
╷
│ Error: Invalid index
│ 
│   on .terraform/modules/latest.this/main.tf line 72, in resource "cosign_attest" "slsa-provenance":
│   72:         for k in data.apko_config.this.config.contents.packages : split("=", k)[0] => split("=", k)[1]
│ 
│ The given key does not identify an element in this collection value: the given index is greater than or equal to the length of the
│ collection.
╵
╷
│ Error: Invalid index
│ 
│   on .terraform/modules/latest.this/main.tf line 72, in resource "cosign_attest" "slsa-provenance":
│   72:         for k in data.apko_config.this.config.contents.packages : split("=", k)[0] => split("=", k)[1]
│ 
│ The given key does not identify an element in this collection value: the given index is greater than or equal to the length of the
│ collection.
╵
╷
│ Error: Invalid index
│ 
│   on .terraform/modules/latest.this/main.tf line 72, in resource "cosign_attest" "slsa-provenance":
│   72:         for k in data.apko_config.this.config.contents.packages : split("=", k)[0] => split("=", k)[1]
│ 
│ The given key does not identify an element in this collection value: the given index is greater than or equal to the length of the
│ collection.
╵
╷
│ Error: Invalid index
│ 
│   on .terraform/modules/latest.this/main.tf line 72, in resource "cosign_attest" "slsa-provenance":
│   72:         for k in data.apko_config.this.config.contents.packages : split("=", k)[0] => split("=", k)[1]
│ 
│ The given key does not identify an element in this collection value: the given index is greater than or equal to the length of the
│ collection.
╵
╷
│ Error: Invalid index
│ 
│   on .terraform/modules/latest.this/main.tf line 72, in resource "cosign_attest" "slsa-provenance":
│   72:         for k in data.apko_config.this.config.contents.packages : split("=", k)[0] => split("=", k)[1]
│ 
│ The given key does not identify an element in this collection value: the given index is greater than or equal to the length of the
│ collection.
╵

this is resolved by locking the package referred to in the error:

contents:
  packages:
    - alpine-baselayout-data
    - alpine-release==3 # <--------
    - apk-tools
    - busybox
    - libc-utils