{"record":{"id":"6cde9013e625e650","repo":"hashicorp/terraform","slug":"registry-response-includes-invalid-shasums-signatu-6cde90","errorCode":null,"errorMessage":"registry response includes invalid SHASUMS signature URL: must use http or https scheme","messagePattern":"registry response includes invalid SHASUMS signature URL: must use http or https scheme","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/registry_client.go","lineNumber":342,"sourceCode":"\t}\n\tshasumsURL = resp.Request.URL.ResolveReference(shasumsURL)\n\tif shasumsURL.Scheme != \"http\" && shasumsURL.Scheme != \"https\" {\n\t\treturn PackageMeta{}, fmt.Errorf(\"registry response includes invalid SHASUMS URL: must use http or https scheme\")\n\t}\n\tdocument, err := c.getFile(shasumsURL)\n\tif err != nil {\n\t\treturn PackageMeta{}, c.errQueryFailed(\n\t\t\tprovider,\n\t\t\tfmt.Errorf(\"failed to retrieve authentication checksums for provider: %s\", err),\n\t\t)\n\t}\n\tsignatureURL, err := url.Parse(body.SHA256SumsSignatureURL)\n\tif err != nil {\n\t\treturn PackageMeta{}, fmt.Errorf(\"registry response includes invalid SHASUMS signature URL: %s\", err)\n\t}\n\tsignatureURL = resp.Request.URL.ResolveReference(signatureURL)\n\tif signatureURL.Scheme != \"http\" && signatureURL.Scheme != \"https\" {\n\t\treturn PackageMeta{}, fmt.Errorf(\"registry response includes invalid SHASUMS signature URL: must use http or https scheme\")\n\t}\n\tsignature, err := c.getFile(signatureURL)\n\tif err != nil {\n\t\treturn PackageMeta{}, c.errQueryFailed(\n\t\t\tprovider,\n\t\t\tfmt.Errorf(\"failed to retrieve cryptographic signature for provider: %s\", err),\n\t\t)\n\t}\n\n\tkeys := make([]SigningKey, len(body.SigningKeys.GPGPublicKeys))\n\tfor i, key := range body.SigningKeys.GPGPublicKeys {\n\t\tkeys[i] = *key\n\t}\n\n\tret.Authentication = PackageAuthenticationAll(\n\t\tNewMatchingChecksumAuthentication(document, body.Filename, checksum),\n\t\tNewArchiveChecksumAuthentication(ret.TargetPlatform, checksum),\n\t\tNewSignatureAuthentication(document, signature, keys),","sourceCodeStart":324,"sourceCodeEnd":360,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/registry_client.go#L324-L360","documentation":"PackageMeta parsed shasums_signature_url but its scheme is not http or https. Signature documents are only fetched over http(s), so the install aborts with a plain fmt.Errorf. Security guard parallel to the shasums_url and download_url checks.","triggerScenarios":"Registry response's shasums_signature_url resolves to a non-http(s) scheme: file://, ftp://, gpg://, etc.","commonSituations":"Private registry serving the .sig from internal storage with a file:// URL; dev/staging registry; proxy stripping the scheme.","solutions":["Serve the signature file over https and reference it with an https:// URL.","Ensure relative signature URL resolves against an http(s) request URL.","Fix any proxy/CDN that rewrites the scheme."],"exampleFix":"// before\n{\"shasums_signature_url\":\"file:///srv/sums/SHA256SUMS.sig\"}\n// after\n{\"shasums_signature_url\":\"https://registry.example/s/SHA256SUMS.sig\"}","handlingStrategy":"validation","validationCode":"func validSignatureScheme(u string) error {\n    parsed, err := url.Parse(u)\n    if err != nil {\n        return err\n    }\n    if parsed.Scheme != \"http\" && parsed.Scheme != \"https\" {\n        return fmt.Errorf(\"signature URL scheme %q not allowed\", parsed.Scheme)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"meta, err := client.PackageMeta(ctx, provider, ver, plat)\nif err != nil && strings.Contains(err.Error(), \"SHASUMS signature URL: must use http or https scheme\") {\n    // registry signature URL uses a disallowed scheme\n}","preventionTips":["Serve signature files over https only.","Ensure relative signature URLs resolve against https request URLs.","Audit proxies that may rewrite the scheme."],"tags":["terraform","registry","shasums","signature","security","scheme"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}