{"record":{"id":"274079e8d7c7e252","repo":"hashicorp/terraform","slug":"failed-to-verify-checksum-of-s-s-package-cached","errorCode":null,"errorMessage":"failed to verify checksum of %s %s package cached in in %s: %s","messagePattern":"failed to verify checksum of (.+?) (.+?) package cached in in (.+?): (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/command/meta_providers.go","lineNumber":413,"sourceCode":"\t\t\t// loops below, for dev overrides etc.\n\t\t\tcontinue\n\t\t}\n\n\t\tversion := lock.Version()\n\t\tcached := cacheDir.ProviderVersion(provider, version)\n\t\tif cached == nil {\n\t\t\treportError(fmt.Errorf(\n\t\t\t\t\"there is no package for %s %s cached in %s\",\n\t\t\t\tprovider, version, cacheDir.BasePath(),\n\t\t\t))\n\t\t\tcontinue\n\t\t}\n\t\t// The cached package must match one of the checksums recorded in\n\t\t// the lock file, if any.\n\t\tif allowedHashes := lock.PreferredHashes(); len(allowedHashes) != 0 {\n\t\t\tmatched, err := cached.MatchesAnyHash(allowedHashes)\n\t\t\tif err != nil {\n\t\t\t\treportError(fmt.Errorf(\n\t\t\t\t\t\"failed to verify checksum of %s %s package cached in in %s: %s\",\n\t\t\t\t\tprovider, version, cacheDir.BasePath(), err,\n\t\t\t\t))\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif !matched {\n\t\t\t\treportError(fmt.Errorf(\n\t\t\t\t\t\"the cached package for %s %s (in %s) does not match any of the checksums recorded in the dependency lock file\",\n\t\t\t\t\tprovider, version, cacheDir.BasePath(),\n\t\t\t\t))\n\t\t\t\tcontinue\n\t\t\t}\n\t\t}\n\t\tfactories[provider] = providerFactory(cached)\n\t}\n\tfor provider, localDir := range devOverrideProviders {\n\t\tfactories[provider] = devOverrideProviderFactory(provider, localDir)\n\t}","sourceCodeStart":395,"sourceCodeEnd":431,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/command/meta_providers.go#L395-L431","documentation":"Raised when checksum verification of a cached provider package against the lock file's preferred hashes fails with an error (not merely a mismatch). cached.MatchesAnyHash(allowedHashes) returned a non-nil err — e.g. the cached package archive/directory is corrupt, unreadable, or the hashing operation itself failed. Note the message contains a literal typo ('cached in in').","triggerScenarios":"providerFactoriesFromLocks: cached.MatchesAnyHash(allowedHashes) returns (false, err) with err!=nil. Triggered by a corrupt or truncated provider package in .terraform/providers, a permissions error reading the package, or a partially downloaded zip that cannot be hashed.","commonSituations":"A previous init download was interrupted leaving a corrupt package; antivirus/EDR quarantined part of the provider; filesystem corruption; manual tampering with the cache; disk filled mid-download.","solutions":["Remove the corrupt provider package from .terraform/providers and re-run `terraform init` to re-download.","If TF_PLUGIN_CACHE_DIR is set, clear the offending provider entry there too.","Run `terraform init -upgrade` to refresh the package and its lock hashes.","Check disk health / antivirus interference if corruption recurs."],"exampleFix":"// before\n// terraform plan -> failed to verify checksum of aws 4.0 package cached in in .terraform/providers: ...\n\n// after\nrm -rf .terraform/providers/registry.terraform.io/hashicorp/aws\nterraform init   # re-downloads and re-verifies","handlingStrategy":"validation","validationCode":"// Verify a cached provider package hashes cleanly before use\nfunc providerIntact(pkgPath string, allowedHashes []string) (bool, error) {\n    // use the same hashing as getprovider.PackageHash\n    h, err := getprovider.PackageHash(pkgPath)\n    if err != nil { return false, err }\n    for _, ah := range allowedHashes {\n        if ah == h { return true, nil }\n    }\n    return false, nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Do not interrupt init mid-download to avoid corrupt provider packages.","Clear and re-download a provider if verification fails: rm -rf the provider dir then terraform init.","Run terraform init -upgrade to refresh both package and lock hashes.","Investigate disk/antivirus issues if corruption recurs."],"tags":["terraform","providers","checksum","integrity","cache"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}