{"record":{"id":"31f044c394a75aec","repo":"hashicorp/terraform","slug":"error-checking-signature-s","errorCode":null,"errorMessage":"error checking signature: %s","messagePattern":"error checking signature: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/package_authentication.go","lineNumber":549,"sourceCode":"// the future.\nfunc (s signatureAuthentication) findSigningKey() (*SigningKey, string, error) {\n\tfor _, key := range s.Keys {\n\t\tkeyring, err := openpgp.ReadArmoredKeyRing(strings.NewReader(key.ASCIIArmor))\n\t\tif err != nil {\n\t\t\treturn nil, \"\", fmt.Errorf(\"error decoding signing key: %s\", err)\n\t\t}\n\n\t\tentity, err := s.checkDetachedSignature(keyring, bytes.NewReader(s.Document), bytes.NewReader(s.Signature), nil)\n\n\t\t// If the signature issuer does not match the key, keep trying the\n\t\t// rest of the provided keys.\n\t\tif err == openpgpErrors.ErrUnknownIssuer {\n\t\t\tcontinue\n\t\t}\n\n\t\t// Any other signature error is terminal.\n\t\tif err != nil {\n\t\t\treturn nil, \"\", fmt.Errorf(\"error checking signature: %s\", err)\n\t\t}\n\n\t\tkeyID := \"n/a\"\n\t\tif entity.PrimaryKey != nil {\n\t\t\tkeyID = entity.PrimaryKey.KeyIdString()\n\t\t}\n\n\t\tlog.Printf(\"[DEBUG] Provider signed by %s\", entityString(entity))\n\t\treturn &key, keyID, nil\n\t}\n\n\t// If none of the provided keys issued the signature, this package is\n\t// unsigned. This is currently a terminal authentication error.\n\treturn nil, \"\", fmt.Errorf(\"authentication signature from unknown issuer\")\n}\n\n// entityString extracts the key ID and identity name(s) from an openpgp.Entity\n// for logging.","sourceCodeStart":531,"sourceCodeEnd":567,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/package_authentication.go#L531-L567","documentation":"From signatureAuthentication.findSigningKey. For each candidate key it calls checkDetachedSignature over the document+signature; if the result is neither nil (success) nor ErrUnknownIssuer (which means 'try the next key'), it is treated as a terminal error and returned here. So this covers structural signature problems that are not 'wrong key' - e.g. malformed signature packet, unsupported algorithm, or hash mismatch for the candidate key.","triggerScenarios":"entity, err := s.checkDetachedSignature(...) at line 539 returns err that is not openpgpErrors.ErrUnknownIssuer and not nil; line 548 wraps it. Possible causes: broken ASCII-armored signature payload, unsupported public-key algorithm, hash algorithm mismatch, truncated signature, or a signature that does not structurally match the document for this key.","commonSituations":"The registry's signature artifact (the .sig file) is corrupted or truncated. A proxy altered the signature or the signed document. The signing key uses an algorithm the go-crypto build does not support. A version skew between the sums document and the signature (re-signed after the sums changed).","solutions":["Re-fetch the signature and the signed document from the authoritative registry; cache corruption is the most common cause.","Report the provider version if the signature is consistently malformed upstream.","If you operate a mirror, ensure the .sig and SHA256SUMS files come from the same release artifact, byte-for-byte.","Confirm the go-crypto dependency supports the key/signature algorithm in use (avoid exotic or legacy algorithms when publishing)."],"exampleFix":"// before: mirror served a truncated .sig\nError: error checking signature: unexpected EOF\n// after: re-mirror the full signed artifact set\n$ rm mirror-cache/<provider>/<version>/* && sync-mirror && terraform init","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Distinguish structural signature errors from 'unknown issuer' (917).\n_, err := auth.AuthenticatePackage(loc)\nif err != nil && strings.Contains(err.Error(), \"error checking signature\") {\n    // likely corrupt .sig or document; re-fetch the signed artifact set.\n}","preventionTips":["Mirror the .sig and SHA256SUMS from the same release artifact together.","Never alter the signed document or signature in transit.","Use signature algorithms supported by the bundled go-crypto build."],"tags":["crypto","openpgp","signature","registry","integrity"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}