Repository: opentofu/opentofu
File: internal/providercache/installer.go (Go)

Code before:
		go func(provider addrs.Provider, version getproviders.Version) {
			traceCtx, span := tracing.Tracer().Start(ctx,
				fmt.Sprintf("Install Provider %q", provider.String()),
				trace.WithAttributes(
					otelAttr.String(traceattrs.ProviderAddress, provider.String()),
					otelAttr.String(traceattrs.ProviderVersion, version.String()),
					otelAttr.String(traceattrs.TargetPlatform, targetPlatform.String()),
				),
			)
			defer span.End()

			authResult, newHashes, err := i.ensureProviderVersionInstalled(traceCtx, locks.Provider(provider), reqs[provider], mode, provider, version, targetPlatform)
			if err != nil {
				tracing.SetSpanError(span, err)
			}
			results <- providerInstallResult{
				provider:   provider,
				version:    version,
				authResult: authResult,
				newHashes:  newHashes,
				err:        err,
			}
		}(provider, version)
	}

	for range need {
		i := <-results

		if i.authResult != nil {
			authResults[i.provider] = i.authResult
		}
		if len(i.newHashes) > 0 {
			locks.SetProvider(i.provider, i.version, reqs[i.provider], i.newHashes)
		}
		if i.err != nil {
			errs[i.provider] = i.err
		}
	}

	return authResults, nil
}

func (i *Installer) ensureProviderVersionInstalled(
	ctx context.Context,
	lock *depsfile.ProviderLock,
	constraint getproviders.VersionConstraints,
	mode InstallMode,
	provider addrs.Provider,
	version getproviders.Version,
	targetPlatform getproviders.Platform,
) (*getproviders.PackageAuthenticationResult, []getproviders.Hash, error) {

Review comment (bug):
I would use above the new [`WaitGroup.Go()`](https://pkg.go.dev/sync#WaitGroup.Go) and after `wg.Wait()` call close on the channel and change this iteration on the channel. That way there is no way for this bit to go wrong.

Code after:
			// Update results
			updateLock.Lock()
			defer updateLock.Unlock()

			if err != nil {
				tracing.SetSpanError(span, err)
				errs[provider] = err
			}

			if authResult != nil {
				authResults[provider] = authResult
			}
			if len(newHashes) > 0 {
				locks.SetProvider(provider, version, reqs[provider], newHashes)
			}
		})
	}

	wg.Wait()

	return authResults, nil
}

func (i *Installer) ensureProviderVersionInstalled(
	ctx context.Context,
	lock *depsfile.ProviderLock,
	mode InstallMode,
	provider addrs.Provider,
	version getproviders.Version,
	targetPlatform getproviders.Platform,
) (*getproviders.PackageAuthenticationResult, []getproviders.Hash, error) {
	evts := installerEventsForContext(ctx)

	var preferredHashes []getproviders.Hash
	if lock != nil && lock.Version() == version { // hash changes are expected if the version is also changing
		preferredHashes = lock.PreferredHashes()
	}

	// If our target directory already has the provider version that fulfills the lock file, carry on
	if installed := i.targetDir.ProviderVersion(provider, version); installed != nil {
		if len(preferredHashes) > 0 {
			if matches, _ := installed.MatchesAnyHash(preferredHashes); matches {
				if cb := evts.ProviderAlreadyInstalled; cb != nil {
					cb(provider, version, false)
				}
				// Even though the package is installed, the requirements in the lockfile may still need to be updated
				return nil, lock.AllHashes(), nil
			}
		}
	}