{"record":{"id":"3cb0c8bd18012840","repo":"hashicorp/terraform","slug":"checksum-list-has-invalid-sha256-hash-q-s","errorCode":null,"errorMessage":"checksum list has invalid SHA256 hash %q: %s","messagePattern":"checksum list has invalid SHA256 hash %q: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/package_authentication.go","lineNumber":367,"sourceCode":"\t// Find the checksum in the list with matching filename. The document is\n\t// in the form \"0123456789abcdef filename.zip\".\n\tfilename := []byte(m.Filename)\n\tvar checksum []byte\n\tfor _, line := range bytes.Split(m.Document, []byte(\"\\n\")) {\n\t\tparts := bytes.Fields(line)\n\t\tif len(parts) > 1 && bytes.Equal(parts[1], filename) {\n\t\t\tchecksum = parts[0]\n\t\t\tbreak\n\t\t}\n\t}\n\tif checksum == nil {\n\t\treturn nil, fmt.Errorf(\"checksum list has no SHA-256 hash for %q\", m.Filename)\n\t}\n\n\t// Decode the ASCII checksum into a byte array for comparison.\n\tvar gotSHA256Sum [sha256.Size]byte\n\tif _, err := hex.Decode(gotSHA256Sum[:], checksum); err != nil {\n\t\treturn nil, fmt.Errorf(\"checksum list has invalid SHA256 hash %q: %s\", string(checksum), err)\n\t}\n\n\t// If the checksums don't match, authentication fails.\n\tif !bytes.Equal(gotSHA256Sum[:], m.WantSHA256Sum[:]) {\n\t\treturn nil, fmt.Errorf(\"checksum list has unexpected SHA-256 hash %x (expected %x)\", gotSHA256Sum, m.WantSHA256Sum[:])\n\t}\n\n\t// Success! But this doesn't result in any real authentication, only a\n\t// lack of authentication errors, so we return a nil result.\n\treturn nil, nil\n}\n\ntype signatureAuthentication struct {\n\tDocument  []byte\n\tSignature []byte\n\tKeys      []SigningKey\n}\n","sourceCodeStart":349,"sourceCodeEnd":385,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/package_authentication.go#L349-L385","documentation":"From matchingChecksumAuthentication.AuthenticatePackage. A matching line was found, but hex.Decode failed turning the first field into a 32-byte SHA256. The '%q' is the offending token and '%s' the hex decoder's error. The sums file is malformed: the checksum field is not valid lowercase/uppercase hex of the right length.","triggerScenarios":"Line 353 found a row where parts[1]==filename, but parts[0] is not 64 valid hex characters; hex.Decode at line 366 returns an error (e.g. odd length, non-hex char, wrong byte count).","commonSituations":"A corrupted or hand-edited SHA256SUMS file. A mirror that re-encoded the file (uppercase, whitespace, line-ending changes producing stray characters). A registry/proxy that mangled the sums (truncation, HTML escaping turning a digit into an entity). A sums file using a different hash that happens to share the filename.","solutions":["Fetch the SHA256SUMS document directly from the authoritative registry and confirm it is well-formed 64-hex-digit lines.","Fix or replace the mirror that is serving a malformed sums file.","Verify no proxy is altering response bodies (gzip/HTML-escape/charset rewriting).","If you generated the document yourself, emit standard '<64 lowercase hex>  <filename>' lines."],"exampleFix":"// before: sums file has a bad token\nABCD....  terraform-provider-aws_5.0.0_linux_amd64.zip   // not 64 hex\n// after: well-formed line\n9c7f...64hex...  terraform-provider-aws_5.0.0_linux_amd64.zip","handlingStrategy":"validation","validationCode":"// Reject malformed sums lines before handing them to the authenticator.\nfunc validSums(doc []byte) error {\n    for i, line := range bytes.Split(doc, []byte(\"\\n\")) {\n        if len(bytes.TrimSpace(line)) == 0 { continue }\n        p := bytes.Fields(line)\n        if len(p) < 2 || len(p[0]) != 64 { return fmt.Errorf(\"line %d: malformed\", i+1) }\n        if _, err := hex.DecodeString(string(p[0])); err != nil { return err }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate sums files at ingestion time in your mirror.","Serve sums files as plain text without re-encoding.","Log the offending token when this fires to pinpoint the bad line."],"tags":["checksum","parsing","registry","sha256sums","hex"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}