{"record":{"id":"14953cc4a18158fc","repo":"hashicorp/terraform","slug":"checksum-list-has-unexpected-sha-256-hash-x-expe","errorCode":null,"errorMessage":"checksum list has unexpected SHA-256 hash %x (expected %x)","messagePattern":"checksum list has unexpected SHA-256 hash %x \\(expected %x\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/package_authentication.go","lineNumber":372,"sourceCode":"\t\tparts := bytes.Fields(line)\n\t\tif len(parts) > 1 && bytes.Equal(parts[1], filename) {\n\t\t\tchecksum = parts[0]\n\t\t\tbreak\n\t\t}\n\t}\n\tif checksum == nil {\n\t\treturn nil, fmt.Errorf(\"checksum list has no SHA-256 hash for %q\", m.Filename)\n\t}\n\n\t// Decode the ASCII checksum into a byte array for comparison.\n\tvar gotSHA256Sum [sha256.Size]byte\n\tif _, err := hex.Decode(gotSHA256Sum[:], checksum); err != nil {\n\t\treturn nil, fmt.Errorf(\"checksum list has invalid SHA256 hash %q: %s\", string(checksum), err)\n\t}\n\n\t// If the checksums don't match, authentication fails.\n\tif !bytes.Equal(gotSHA256Sum[:], m.WantSHA256Sum[:]) {\n\t\treturn nil, fmt.Errorf(\"checksum list has unexpected SHA-256 hash %x (expected %x)\", gotSHA256Sum, m.WantSHA256Sum[:])\n\t}\n\n\t// Success! But this doesn't result in any real authentication, only a\n\t// lack of authentication errors, so we return a nil result.\n\treturn nil, nil\n}\n\ntype signatureAuthentication struct {\n\tDocument  []byte\n\tSignature []byte\n\tKeys      []SigningKey\n}\n\n// NewSignatureAuthentication returns a PackageAuthentication implementation\n// that verifies the cryptographic signature for a package against any of the\n// provided keys.\n//\n// The signing key for a package will be auto detected by attempting each key","sourceCodeStart":354,"sourceCodeEnd":390,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/package_authentication.go#L354-L390","documentation":"From matchingChecksumAuthentication.AuthenticatePackage. The line for the filename was found and decoded cleanly, but the decoded SHA256 does not equal the WantSHA256Sum declared for the package. This cross-check guarantees the signed sums file authenticates the specific declared hash; a mismatch means the sums file and the package metadata disagree.","triggerScenarios":"bytes.Equal(gotSHA256Sum[:], m.WantSHA256Sum[:]) is false at line 371. The SHA256SUMS lists one hash for the filename while the caller's WantSHA256Sum (typically from the registry version manifest) is different.","commonSituations":"A provider version was republished so the manifest's hash and the signed sums file are from different builds. A registry bug where the version manifest and SHA256SUMS are out of sync. A mirror assembled from mismatched artifacts. Replay/cache of an old sums file against a refreshed manifest.","solutions":["Treat this as a registry/mirror consistency problem and report/follow the provider's published release; pin to a version where manifest and sums agree.","Clear any caches (local and proxy) that may serve a stale sums file or manifest, then re-init.","Use the official registry rather than a mirror until the inconsistency is resolved.","If you publish the provider, ensure the version manifest hash and the SHA256SUMS file are generated from the same artifact in the same release step."],"exampleFix":"// before: manifest hash and signed sums disagree\n// after: pin to a consistent release\nrequired_version = \">= 5.2.0\"  # version with consistent manifest+sums","handlingStrategy":"validation","validationCode":"// Cross-check the declared hash against the sums doc yourself first.\nfunc declaredMatchesSums(doc []byte, filename string, want [sha256.Size]byte) bool {\n    for _, line := range bytes.Split(doc, []byte(\"\\n\")) {\n        p := bytes.Fields(line)\n        if len(p) > 1 && bytes.Equal(p[1], []byte(filename)) {\n            var got [sha256.Size]byte\n            if _, err := hex.Decode(got[:], p[0]); err == nil { return bytes.Equal(got[:], want[:]) }\n        }\n    }\n    return false\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Publish manifest and SHA256SUMS from the same build step.","Treat manifest/sums disagreement as a release-blocking bug.","Avoid provider republishes that change bytes at a fixed version."],"tags":["integrity","checksum","registry","sha256sums","signing"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}