OpenTofu 1.13: convert and assume Functions, WinRM Removed, script_path Fix

OpenTofu 1.13.0, released on September 30, adds functions that let module authors tell OpenTofu more about values it cannot know until apply. It also removes the WinRM connection type, escapes connection.script_path to stop extra commands running on remote hosts, and adds official Windows ARM64 builds. The 1.13 line is supported until August 1, 2027.

The new functions work in this order, as the blog's two examples show:

1. convert attaches a type to a value whose type OpenTofu cannot infer, such as the result of jsondecode on an unknown string.
2. The result is still unknown, but OpenTofu now knows, for example, that its id attribute is a string.
3. The assume... functions add promises about the final value, such as that it is not null or starts with a given prefix.
4. Comparisons that depend only on those promises, such as a test against null or "", become known during planning.
5. During apply, OpenTofu checks each promise, and a broken one fails the apply.

convert: Typing a Value OpenTofu Cannot Infer #

Passing an unknown string to jsondecode normally gives an unknown result of unknown type. With convert, the author states the expected shape, for example convert(jsondecode(...), object({ id = string, tags = map(string) })). The blog is explicit that the result is still an unknown value, but one where accessing id is known to produce a string, so downstream expressions can rely on the type.

assume Functions: Known Answers From Unknown Values #

A provider often cannot say anything about an attribute, such as a VPC ID, until the object exists, so comparing it to null produces an unknown boolean. The blog's example wraps it in two promises:

output "vpc_id" {
  value = assumenotnull(
    assumestringprefix(
      aws_vpc.example.id,
      "vpc-",
    )
  )
}

Any expression that compares this output to null or "" now produces a known false, which helps modules that switch features on or off by whether an input is set. The value itself stays unknown, so it still cannot drive for_each keys. The promise must hold: if the ID turns out to start with subnet-, assumestringprefix fails during the apply phase, after planning has accepted it.

Upgrade Notes: WinRM, base64gzip, macOS and 32-bit Builds #

The 1.13.0 release notes list the changes that can break existing setups. The WinRM connection type for provisioners, deprecated in 1.12, is removed; the notes suggest moving to SSH, which modern Windows supports. base64gzip now produces equivalent but not identical output, so resources that take it as an argument may show updates or replacements. macOS 13 Ventura or later is required, and 1.13 is the last series with official 32-bit builds. Stricter SSH parsers for remote provisioners may reject invalid input they previously accepted.

Among the fixes, connection.script_path is now escaped so additional commands can no longer run on the remote host along with the script path (#4330). Other additions include errored.tfstate written on a Go runtime panic, new state encryption parameters for AWS KMS (encryption_context), GCP KMS (additional_authenticated_data) and OpenBao (associated_data), providers lock -oci-mirror, and tofu test overrides with wildcards. The experimental linting runs with the -lint flag on supported commands, and symbol libraries are a separate experiment.

Patch releases followed: 1.13.2 on October 21 fixed excessive CPU use when tofu init connects to an attacker-controlled HTTP/2 server and filters out compromised intermediate certificates, and the line has since reached 1.13.9.