{"record":{"id":"6a633d49206762bf","repo":"hashicorp/terraform","slug":"checksum-list-has-no-sha-256-hash-for-q","errorCode":null,"errorMessage":"checksum list has no SHA-256 hash for %q","messagePattern":"checksum list has no SHA-256 hash for %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/package_authentication.go","lineNumber":361,"sourceCode":"\t\tFilename:      filename,\n\t\tWantSHA256Sum: wantSHA256Sum,\n\t}\n}\n\nfunc (m matchingChecksumAuthentication) AuthenticatePackage(location PackageLocation) (*PackageAuthenticationResult, error) {\n\t// Find the checksum in the list with matching filename. The document is\n\t// in the form \"0123456789abcdef filename.zip\".\n\tfilename := []byte(m.Filename)\n\tvar checksum []byte\n\tfor _, line := range bytes.Split(m.Document, []byte(\"\\n\")) {\n\t\tparts := bytes.Fields(line)\n\t\tif len(parts) > 1 && bytes.Equal(parts[1], filename) {\n\t\t\tchecksum = parts[0]\n\t\t\tbreak\n\t\t}\n\t}\n\tif checksum == nil {\n\t\treturn nil, fmt.Errorf(\"checksum list has no SHA-256 hash for %q\", m.Filename)\n\t}\n\n\t// Decode the ASCII checksum into a byte array for comparison.\n\tvar gotSHA256Sum [sha256.Size]byte\n\tif _, err := hex.Decode(gotSHA256Sum[:], checksum); err != nil {\n\t\treturn nil, fmt.Errorf(\"checksum list has invalid SHA256 hash %q: %s\", string(checksum), err)\n\t}\n\n\t// If the checksums don't match, authentication fails.\n\tif !bytes.Equal(gotSHA256Sum[:], m.WantSHA256Sum[:]) {\n\t\treturn nil, fmt.Errorf(\"checksum list has unexpected SHA-256 hash %x (expected %x)\", gotSHA256Sum, m.WantSHA256Sum[:])\n\t}\n\n\t// Success! But this doesn't result in any real authentication, only a\n\t// lack of authentication errors, so we return a nil result.\n\treturn nil, nil\n}\n","sourceCodeStart":343,"sourceCodeEnd":379,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/package_authentication.go#L343-L379","documentation":"From matchingChecksumAuthentication.AuthenticatePackage. It scans the registry-provided SHA256SUMS document line-by-line for a line whose second field equals the target filename. If no line references that filename, checksum stays nil and the error is returned. This means the signed sums file does not cover the package the caller asked about.","triggerScenarios":"NewMatchingChecksumAuthentication was constructed with a Document (the SHA256SUMS bytes) and a Filename, but Document contains no line of the form '<hex> <Filename>'. Reached at line 360 when the loop at 353 finds no match.","commonSituations":"The registry returned a SHA256SUMS for a different provider version than the package being installed. A filename mismatch (e.g. wrong OS/arch suffix like _linux_amd64 vs _linux_arm64, or a missing/extra version token in the zip name). A mirror that stripped or rewrote the sums file. A custom registry that omits the requested platform's entry.","solutions":["Verify the requested provider version, OS, and arch map to a filename that actually appears in the registry's SHA256SUMS for that version.","Update the provider version constraint to one the registry fully publishes for your platform.","If using a mirror, ensure it mirrors the complete SHA256SUMS file, not a partial one.","Confirm the filename passed to NewMatchingChecksumAuthentication matches the registry's naming exactly."],"exampleFix":"// before: arch mismatch -> filename not in sums\nrequired_version = \"= 5.0.0\"  // sums only list _linux_arm64\n// after\nrequired_version = \">= 5.1.0\"  // version that publishes linux_amd64","handlingStrategy":"validation","validationCode":"// Confirm the filename exists in the sums doc before authenticating.\nfunc sumsHasFilename(doc []byte, filename string) bool {\n    for _, line := range bytes.Split(doc, []byte(\"\\n\")) {\n        p := bytes.Fields(line)\n        if len(p) > 1 && bytes.Equal(p[1], []byte(filename)) { return true }\n    }\n    return false\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Confirm the registry publishes a sums entry for your exact OS/arch.","Match the filename string to the registry's naming convention exactly (version + platform suffix).","Mirror the complete SHA256SUMS file, never a subset."],"tags":["checksum","registry","sha256sums","platform","mirror"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}