{"record":{"id":"5fe39f44e9b839b7","repo":"hashicorp/terraform","slug":"this-version-of-terraform-does-not-support-any-of","errorCode":null,"errorMessage":"this version of Terraform does not support any of the checksum formats given for this provider","messagePattern":"this version of Terraform does not support any of the checksum formats given for this provider","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/package_authentication.go","lineNumber":247,"sourceCode":"// This uses the hash algorithms implemented by functions PackageHash and\n// MatchesHash. The PreferredHashes function will select which of the given\n// hashes are considered by Terraform to be the strongest verification, and\n// authentication succeeds as long as one of those matches.\nfunc NewPackageHashAuthentication(platform Platform, validHashes []Hash) PackageAuthentication {\n\trequiredHashes := PreferredHashes(validHashes)\n\treturn packageHashAuthentication{\n\t\tRequiredHashes: requiredHashes,\n\t\tAllHashes:      validHashes,\n\t\tPlatform:       platform,\n\t}\n}\n\nfunc (a packageHashAuthentication) AuthenticatePackage(localLocation PackageLocation) (*PackageAuthenticationResult, error) {\n\tif len(a.RequiredHashes) == 0 {\n\t\t// Indicates that none of the hashes given to\n\t\t// NewPackageHashAuthentication were considered to be usable by this\n\t\t// version of Terraform.\n\t\treturn nil, fmt.Errorf(\"this version of Terraform does not support any of the checksum formats given for this provider\")\n\t}\n\n\tmatches, err := PackageMatchesAnyHash(localLocation, a.RequiredHashes)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to verify provider package checksums: %s\", err)\n\t}\n\n\tif matches {\n\t\treturn &PackageAuthenticationResult{result: verifiedChecksum}, nil\n\t}\n\tif len(a.RequiredHashes) == 1 {\n\t\treturn nil, fmt.Errorf(\"provider package doesn't match the expected checksum %q\", a.RequiredHashes[0].String())\n\t}\n\t// It's non-ideal that this doesn't actually list the expected checksums,\n\t// but in the many-checksum case the message would get pretty unweildy.\n\t// In practice today we typically use this authenticator only with a\n\t// single hash returned from a network mirror, so the better message\n\t// above will prevail in that case. Maybe we'll improve on this somehow","sourceCodeStart":229,"sourceCodeEnd":265,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/package_authentication.go#L229-L265","documentation":"Thrown by packageHashAuthentication.AuthenticatePackage when the RequiredHashes set is empty. RequiredHashes is built by PreferredHashes(validHashes), which only keeps hashes whose scheme is HashScheme1 ('h1:') or HashSchemeZip ('zh:'). So this error means every hash supplied to NewPackageHashAuthentication used a scheme this Terraform build does not recognize, and therefore no checksum verification can be attempted at all.","triggerScenarios":"NewPackageHashAuthentication is called with a validHashes slice containing only hashes with schemes other than 'h1:'/'zh:' (e.g. a future 'h2:' scheme, a bare hex string with no scheme, or an unrecognized prefix). On AuthenticatePackage, len(a.RequiredHashes)==0 at line 243 triggers the error before any package bytes are read.","commonSituations":"A .terraform.lock.hcl written by a NEWER Terraform/Opentofu version that recorded a hash scheme the running (older) binary cannot parse. A filesystem/network mirror that returns only legacy 'zh:' hashes while the binary only understands 'h1:' (or vice versa in a degenerate build). Manually-edited lock files with mangled hash values that lost their scheme prefix.","solutions":["Upgrade the Terraform/OpenTofu binary to a version that understands the hash scheme present in the lock file (newer binaries accept both 'h1:' and 'zh:').","If upgrading is impossible, delete the offending hash line(s) from .terraform.lock.hcl and run 'terraform init' so the current binary recomputes and records a supported scheme.","Confirm the source (registry or mirror) actually publishes SHA256SUMS / lock hashes; if a custom mirror serves only unknown schemes, fix the mirror to emit 'h1:' hashes.","If you constructed the authenticator in your own code, ensure validHashes contains at least one 'h1:' or 'zh:' hash before calling AuthenticatePackage."],"exampleFix":"// before: lock file has only an unknown scheme\nproviders = {\n  registry.terraform.io/hashicorp/aws = { version = \"5.0.0\", hashes = [\"h9:deadbeef...\"] }\n}\n// after: delete the line and let init regenerate, or upgrade binary\n$ rm .terraform.lock.hcl && terraform init","handlingStrategy":"validation","validationCode":"// Before authenticating, ensure at least one supplied hash uses a\n// scheme this binary understands. PreferredHashes mirrors the same filter\n// the authenticator applies internally.\nfunc hasUsableHash(hashes []providerreqs.Hash) bool {\n    return len(getproviders.PreferredHashes(hashes)) > 0\n}\n\nif !hasUsableHash(validHashes) {\n    return fmt.Errorf(\"no supported hash scheme (want h1: or zh:); upgrade or regenerate lock file\")\n}","typeGuard":null,"tryCatchPattern":"// Distinguish \"unsupported scheme\" (902/903's precondition) from real I/O/integrity\n// errors by checking the precondition before calling AuthenticatePackage.\nif len(getproviders.PreferredHashes(validHashes)) == 0 {\n    // version/lock-file mismatch path: upgrade or regenerate\n}\nresult, err := auth.AuthenticatePackage(loc)\nif err != nil {\n    return fmt.Errorf(\"authenticate provider %s: %w\", loc, err)\n}","preventionTips":["Commit .terraform.lock.hcl and regenerate it only with the oldest Terraform version your team uses, so all members understand the schemes it contains.","Never hand-edit hash values; always regenerate with terraform init.","When building a custom mirror, publish both h1: and zh: hashes."],"tags":["terraform","provider","checksum","hash","version-compat","lock-file"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}