{"record":{"id":"3329deff1de5df34","repo":"hashicorp/terraform","slug":"invalid-md5","errorCode":null,"errorMessage":"invalid md5","messagePattern":"invalid md5","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oss/client.go","lineNumber":247,"sourceCode":"\n\tlog.Printf(\"[DEBUG] Retrieving state serial in tablestore: %#v\", getParams)\n\n\tobject, err := c.otsClient.GetRow(&tablestore.GetRowRequest{\n\t\tSingleRowQueryCriteria: getParams,\n\t})\n\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar val string\n\tif v, ok := object.GetColumnMap().Columns[\"Digest\"]; ok && len(v) > 0 {\n\t\tval = v[0].Value.(string)\n\t}\n\n\tsum, err := hex.DecodeString(val)\n\tif err != nil || len(sum) != md5.Size {\n\t\treturn nil, errors.New(\"invalid md5\")\n\t}\n\n\treturn sum, nil\n}\n\n// store the hash of the state to that clients can check for stale state files.\nfunc (c *RemoteClient) putMD5(sum []byte) error {\n\tif c.otsTable == \"\" {\n\t\treturn nil\n\t}\n\n\tif len(sum) != md5.Size {\n\t\treturn errors.New(\"invalid payload md5\")\n\t}\n\n\tputParams := &tablestore.PutRowChange{\n\t\tTableName: c.otsTable,\n\t\tPrimaryKey: &tablestore.PrimaryKey{","sourceCodeStart":229,"sourceCodeEnd":265,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/oss/client.go#L229-L265","documentation":"Returned by RemoteClient.getMD5 (internal/backend/remote-state/oss/client.go:247) when the 'Digest' value read from Alibaba TableStore fails to hex-decode or its decoded length is not md5.Size (16 bytes). The Digest column is used for state consistency checks; a malformed digest means the integrity metadata is corrupt and the state cannot be verified. Get() will log this and, if a payload exists, may proceed without comparison, but if comparison is forced it fails.","triggerScenarios":"The TableStore 'Digest' column for the state's lockPath+stateIDSuffix contains a non-hex string, an empty string, or a truncated/overlength value; external modification of the TableStore row; a partial/corrupt write left a bad digest.","commonSituations":"Manual edits to the OTS table; a failed/aborted Put that left a malformed Digest; version-mismatch bugs writing the digest in a different format; someone clearing or truncating the Digest field.","solutions":["Inspect the TableStore row and correct or delete the malformed Digest value so it is a 32-char hex MD5.","Re-push a known-good state with 'terraform state push' to overwrite the corrupt digest.","Verify no external process is writing malformed digests to the OTS table."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Verify the digest is well-formed before relying on it.\nif d, err := hex.DecodeString(storedDigest); err != nil || len(d) != md5.Size {\n    log.Println(\"[WARN] TableStore Digest is malformed; state integrity check skipped\")\n}","typeGuard":null,"tryCatchPattern":"if _, err := client.getMD5(); err != nil {\n    if strings.Contains(err.Error(), \"invalid md5\") {\n        // Malformed integrity metadata; investigate the TableStore row.\n        log.Println(\"[ERROR] OTS Digest corrupt; consider 'terraform state push' to repair\")\n    }\n}","preventionTips":["Do not manually edit the TableStore Digest column.","After aborted applies, verify the Digest matches the S3 state via 'terraform state pull/push'.","Restrict write access to the OTS table to terraform only."],"tags":["backend","oss","alibaba","tablestore","md5","data-integrity"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}