{"record":{"id":"3d89cd6e8332565e","repo":"hashicorp/terraform","slug":"failed-to-retrieve-cryptographic-signature-for-pro","errorCode":null,"errorMessage":"failed to retrieve cryptographic signature for provider: %s","messagePattern":"failed to retrieve cryptographic signature for provider: (.+?)","errorType":"exception","errorClass":"ErrQueryFailed","httpStatus":null,"severity":"error","filePath":"internal/getproviders/registry_client.go","lineNumber":348,"sourceCode":"\tif err != nil {\n\t\treturn PackageMeta{}, c.errQueryFailed(\n\t\t\tprovider,\n\t\t\tfmt.Errorf(\"failed to retrieve authentication checksums for provider: %s\", err),\n\t\t)\n\t}\n\tsignatureURL, err := url.Parse(body.SHA256SumsSignatureURL)\n\tif err != nil {\n\t\treturn PackageMeta{}, fmt.Errorf(\"registry response includes invalid SHASUMS signature URL: %s\", err)\n\t}\n\tsignatureURL = resp.Request.URL.ResolveReference(signatureURL)\n\tif signatureURL.Scheme != \"http\" && signatureURL.Scheme != \"https\" {\n\t\treturn PackageMeta{}, fmt.Errorf(\"registry response includes invalid SHASUMS signature URL: must use http or https scheme\")\n\t}\n\tsignature, err := c.getFile(signatureURL)\n\tif err != nil {\n\t\treturn PackageMeta{}, c.errQueryFailed(\n\t\t\tprovider,\n\t\t\tfmt.Errorf(\"failed to retrieve cryptographic signature for provider: %s\", err),\n\t\t)\n\t}\n\n\tkeys := make([]SigningKey, len(body.SigningKeys.GPGPublicKeys))\n\tfor i, key := range body.SigningKeys.GPGPublicKeys {\n\t\tkeys[i] = *key\n\t}\n\n\tret.Authentication = PackageAuthenticationAll(\n\t\tNewMatchingChecksumAuthentication(document, body.Filename, checksum),\n\t\tNewArchiveChecksumAuthentication(ret.TargetPlatform, checksum),\n\t\tNewSignatureAuthentication(document, signature, keys),\n\t)\n\n\treturn ret, nil\n}\n\n// findClosestProtocolCompatibleVersion searches for the provider version with the closest protocol match.","sourceCodeStart":330,"sourceCodeEnd":366,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/registry_client.go#L330-L366","documentation":"PackageMeta calls getFile on the validated shasums_signature_url to fetch the detached cryptographic signature and the HTTP fetch failed — transport error or non-200 status. The signature is required for trust verification of the checksums, so the install aborts via errQueryFailed (ErrQueryFailed).","triggerScenarios":"The signature URL is valid http(s) but unreachable: connection refused, DNS failure, TLS error, timeout, 403/404/500, or body read failure. Distinct from a bad signature *content* — this is a fetch-layer failure.","commonSituations":"Signature host (often a separate CDN/keyserver) down or firewalled; signed URL expired; corporate proxy blocks the signature host; TF_REGISTRY_CLIENT_TIMEOUT too low; transient 5xx on the signature endpoint.","solutions":["Retry after confirming the signature URL is fetchable (curl).","Increase TF_REGISTRY_CLIENT_TIMEOUT / TF_REGISTRY_DISCOVERY_RETRY.","Open egress to the signature host / configure HTTPS_PROXY.","Refresh expired signed URLs before the Terraform run."],"exampleFix":"# before\nexport TF_REGISTRY_DISCOVERY_RETRY=1\n# after\nexport TF_REGISTRY_DISCOVERY_RETRY=3","handlingStrategy":"retry","validationCode":"// Informational pre-flight: can we reach the signature host?\nfunc signatureHostReachable(rawURL string) error {\n    u, err := url.Parse(rawURL)\n    if err != nil {\n        return err\n    }\n    conn, err := net.DialTimeout(\"tcp\", u.Host, 5*time.Second)\n    if err != nil {\n        return err\n    }\n    conn.Close()\n    return nil\n}","typeGuard":"func isSignatureFetchErr(err error) bool {\n    var qf getproviders.ErrQueryFailed\n    if errors.As(err, &qf) {\n        return strings.Contains(qf.Wrapped.Error(), \"failed to retrieve cryptographic signature\")\n    }\n    return false\n}","tryCatchPattern":"var meta getproviders.PackageMeta\nvar err error\nfor i := 0; i < 3; i++ {\n    meta, err = client.PackageMeta(ctx, provider, ver, plat)\n    if err == nil || !isSignatureFetchErr(err) {\n        break\n    }\n    time.Sleep(backoff(i))\n}","preventionTips":["Ensure egress to the signature host (often a separate CDN/keyserver).","Refresh signed URLs before running if they expire.","Tune TF_REGISTRY_DISCOVERY_RETRY / TF_REGISTRY_CLIENT_TIMEOUT for flaky networks."],"tags":["terraform","registry","signature","network","fetch"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}