{"record":{"id":"75f3404c418a12ca","repo":"hashicorp/terraform","slug":"registry-response-includes-invalid-shasums-signatu","errorCode":null,"errorMessage":"registry response includes invalid SHASUMS signature URL: %s","messagePattern":"registry response includes invalid SHASUMS signature URL: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/registry_client.go","lineNumber":338,"sourceCode":"\n\tshasumsURL, err := url.Parse(body.SHA256SumsURL)\n\tif err != nil {\n\t\treturn PackageMeta{}, fmt.Errorf(\"registry response includes invalid SHASUMS URL: %s\", err)\n\t}\n\tshasumsURL = resp.Request.URL.ResolveReference(shasumsURL)\n\tif shasumsURL.Scheme != \"http\" && shasumsURL.Scheme != \"https\" {\n\t\treturn PackageMeta{}, fmt.Errorf(\"registry response includes invalid SHASUMS URL: must use http or https scheme\")\n\t}\n\tdocument, err := c.getFile(shasumsURL)\n\tif err != nil {\n\t\treturn PackageMeta{}, c.errQueryFailed(\n\t\t\tprovider,\n\t\t\tfmt.Errorf(\"failed to retrieve authentication checksums for provider: %s\", err),\n\t\t)\n\t}\n\tsignatureURL, err := url.Parse(body.SHA256SumsSignatureURL)\n\tif err != nil {\n\t\treturn PackageMeta{}, fmt.Errorf(\"registry response includes invalid SHASUMS signature URL: %s\", err)\n\t}\n\tsignatureURL = resp.Request.URL.ResolveReference(signatureURL)\n\tif signatureURL.Scheme != \"http\" && signatureURL.Scheme != \"https\" {\n\t\treturn PackageMeta{}, fmt.Errorf(\"registry response includes invalid SHASUMS signature URL: must use http or https scheme\")\n\t}\n\tsignature, err := c.getFile(signatureURL)\n\tif err != nil {\n\t\treturn PackageMeta{}, c.errQueryFailed(\n\t\t\tprovider,\n\t\t\tfmt.Errorf(\"failed to retrieve cryptographic signature for provider: %s\", err),\n\t\t)\n\t}\n\n\tkeys := make([]SigningKey, len(body.SigningKeys.GPGPublicKeys))\n\tfor i, key := range body.SigningKeys.GPGPublicKeys {\n\t\tkeys[i] = *key\n\t}\n","sourceCodeStart":320,"sourceCodeEnd":356,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/registry_client.go#L320-L356","documentation":"PackageMeta tries to url.Parse the shasums_signature_url (the GPG/PGP detached signature for the SHASUMS document) and parsing fails, so the signature cannot be fetched. Aborted with a plain fmt.Errorf before any network call.","triggerScenarios":"Registry response's shasums_signature_url contains characters/structure that Go url.Parse rejects: invalid percent-encoding, control characters, malformed scheme.","commonSituations":"Custom registry omits the field then a shim emits a broken placeholder; templating bug injecting an unencoded path; field contains a stray quote or newline from JSON assembly.","solutions":["Inspect the raw shasums_signature_url for invalid characters.","Have the registry emit a well-formed absolute or relative http(s) URL (or omit signing if unsigned).","URL-encode dynamic segments."],"exampleFix":"// before\n{\"shasums_signature_url\":\"https://reg/s/SHA256SUMS .sig\"}\n// after\n{\"shasums_signature_url\":\"https://reg/s/SHA256SUMS.sig\"}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"meta, err := client.PackageMeta(ctx, provider, ver, plat)\nif err != nil && strings.Contains(err.Error(), \"invalid SHASUMS signature URL\") && !strings.Contains(err.Error(), \"scheme\") {\n    // registry signature URL failed to parse; report upstream\n}","preventionTips":["Return well-formed http(s) signature URLs from the registry.","URL-encode dynamic path segments.","Lint registry responses against a schema in CI."],"tags":["terraform","registry","shasums","signature","url-parsing"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}