{"record":{"id":"540cac28954ba811","repo":"hashicorp/terraform","slug":"init-determineifprovidertrusted-unexpected-prov","errorCode":null,"errorMessage":"init (determineIfProviderTrusted): unexpected provider location type for state storage provider %q: %T","messagePattern":"init \\(determineIfProviderTrusted\\): unexpected provider location type for state storage provider %q: %T","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/command/meta_backend.go","lineNumber":3105,"sourceCode":"\t\t//\n\t\t// In both cases trust is already established; skip requesting approval.\n\t\tlog.Printf(\"[TRACE] init (determineIfProviderTrusted): the state storage provider %s (%q) was present in a dependency lock file during provider installation, so we consider it safe\", provider.Type, provider)\n\t\treturn Trusted\n\t} else {\n\t\t// The provider wasn't in the dependency lock file so it's being download for the first time\n\t\t// (we block upgrading the state store provider in this method).\n\t\tlog.Printf(\"[TRACE] init (determineIfProviderTrusted): the state storage provider %s (%q) will be changed in the dependency lock file during provider installation.\", provider.Type, provider)\n\t\tswitch location.(type) {\n\t\tcase getproviders.PackageLocalArchive, getproviders.PackageLocalDir:\n\t\t\t// If the provider is downloaded from a local source we assume it's safe.\n\t\t\t// We don't require presence of the -safe-init flag, or require input from the user to approve its usage.\n\t\t\tlog.Printf(\"[TRACE] init (determineIfProviderTrusted): the state storage provider %s (%q) is downloaded from a local source, so we consider it safe.\", provider.Type, provider)\n\t\t\treturn Trusted\n\t\tcase getproviders.PackageHTTPURL:\n\t\t\tlog.Printf(\"[DEBUG] init (determineIfProviderTrusted): the state storage provider %s (%q) is downloaded via HTTP, so we consider it potentially unsafe.\", provider.Type, provider)\n\t\t\treturn RequiresApproval\n\t\tdefault:\n\t\t\tpanic(fmt.Sprintf(\"init (determineIfProviderTrusted): unexpected provider location type for state storage provider %q: %T\", provider, location))\n\t\t}\n\t}\n}\n\n// confirmProviderIsTrusted takes the action determined by `determineIfProviderTrusted` and either prompts the user for approval, or returns an error if something has gone wrong with pre-supplied locks when Terraform was run in automation.\n//\n// NOTE: the command parameter is used to determine which command is being run, so that we can provide more specific guidance to the user. Do not use that parameter for any other purpose!\nfunc (m *Meta) confirmProviderIsTrusted(trust ProviderTrust, provider addrs.Provider, stateStoreProviderAuthResult *getproviders.PackageAuthenticationResult, stateStoreProviderLock, locksBeforeInstall *depsfile.Locks, flagLockfilePath string, command cli.Command, view views.StateStoreProviderTrustLogger) tfdiags.Diagnostics {\n\tvar diags tfdiags.Diagnostics\n\n\tswitch trust {\n\tcase Trusted:\n\t\t// do nothing; provider is already trusted and there's no need to notify the user.\n\n\t\tif flagLockfilePath != \"\" {\n\t\t\t// If the user supplied a lock file path via CLI flag, we should notify them that it was used.\n\t\t\tview.LogAutomaticApproval()\n\t\t\tview.Spacer()","sourceCodeStart":3087,"sourceCodeEnd":3123,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/command/meta_backend.go#L3087-L3123","documentation":"Programmer-error panic in determineIfProviderTrusted: the provider's install location type is not one of the recognized package types (PackageLocalArchive, PackageLocalDir, PackageHTTPURL). The switch falls to default and panics with the provider address and the concrete location type. This guards the trust-decision logic for state-store providers against an unanticipated location kind.","triggerScenarios":"The state-store provider install resolved to a location type the trust logic does not handle (e.g. a future PackageLocalMirror, PackageNetworkMirror artifact, or a custom getproviders.PackageMeta type).","commonSituations":"New provider source / installation method not yet covered by the safe-init trust switch, experimental mirror installs, or a Terraform build that introduced a new location type without updating this switch.","solutions":["Upgrade Terraform to a version where the new location type is handled.","Avoid the unsupported install source (switch to a registry or local-dir source for the state-store provider).","Report the location type (%T value in the message) so maintainers can add a case."],"exampleFix":"// before (library code)\ndefault:\n    panic(fmt.Sprintf(\"...unexpected provider location type...%T\", location))\n\n// after (defensive)\ndefault:\n    return RequiresApproval // unknown -> ask the user","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Defensive: treat unknown location types as RequiresApproval\nswitch location.(type) {\ncase getproviders.PackageLocalArchive, getproviders.PackageLocalDir:\n    return Trusted\ncase getproviders.PackageHTTPURL:\n    return RequiresApproval\ndefault:\n    return RequiresApproval\n}","preventionTips":["Use a supported install source (registry, local dir/archive, HTTP) for state-store providers.","Upgrade Terraform when adopting new install methods.","Report unexpected location types shown in the panic message."],"tags":["terraform","state-store","provider-install","panic","internal-bug"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}