The OpenTofu project has released version 1.10, continuing to differentiate itself from HashiCorp's Terraform with community-driven features.
Encrypted State by Default
New projects now generate state files encrypted with AES-256-GCM, with keys sourced from HashiCorp Vault, AWS KMS, GCP KMS, Azure Key Vault, or a local keyring. Encryption metadata is stored alongside ciphertext, enabling seamless key rotation.
Backwards-Compatible Migration
Existing projects can opt in via terraform { encryption { state { enforced = true } } }. OpenTofu transparently reads legacy plaintext state and writes encrypted state going forward — no breaking change for CI/CD pipelines.
Provider Lock File Signing
The .terraform.lock.hcl file now supports Sigstore-based signatures, allowing teams to verify that provider binaries haven't been tampered with in air-gapped or supply-chain-conscious environments.
OpenTofu 1.10 is a drop-in replacement for Terraform 1.9 configurations.
