{"record":{"id":"813eb756dc400b65","repo":"hashicorp/terraform","slug":"error-verifying-trust-signature-s","errorCode":null,"errorMessage":"error verifying trust signature: %s","messagePattern":"error verifying trust signature: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/package_authentication.go","lineNumber":449,"sourceCode":"\tif signingKey.TrustSignature != \"\" {\n\t\thashicorpPartnersKeyring, err := openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPartnersKey))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error creating HashiCorp Partners keyring: %s\", err)\n\t\t}\n\n\t\tauthorKey, err := openpgpArmor.Decode(strings.NewReader(signingKey.ASCIIArmor))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error decoding signing key: %s\", err)\n\t\t}\n\n\t\ttrustSignature, err := openpgpArmor.Decode(strings.NewReader(signingKey.TrustSignature))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error decoding trust signature: %s\", err)\n\t\t}\n\n\t\t_, err = s.checkDetachedSignature(hashicorpPartnersKeyring, authorKey.Body, trustSignature.Body, nil)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error verifying trust signature: %s\", err)\n\t\t}\n\n\t\treturn &PackageAuthenticationResult{result: partnerProvider, KeyID: keyID}, nil\n\t}\n\n\t// We have a valid signature, but it's not from the HashiCorp key, and it\n\t// also isn't a trusted partner. This is a community provider.\n\treturn &PackageAuthenticationResult{result: communityProvider, KeyID: keyID}, nil\n}\n\nfunc (s signatureAuthentication) checkDetachedSignature(keyring openpgp.KeyRing, signed, signature io.Reader, config *packet.Config) (*openpgp.Entity, error) {\n\tentity, err := openpgp.CheckDetachedSignature(keyring, signed, signature, config)\n\t// FIXME: it's not clear what should be done with provider signing key\n\t// expiration. This check reverts the validation behavior to match that of\n\t// the original x/crypto/openpgp package.\n\t//\n\t// We don't force providers to update keys for older releases, so they may\n\t// have since expired. We are validating the original signature however,","sourceCodeStart":431,"sourceCodeEnd":467,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/package_authentication.go#L431-L467","documentation":"From signatureAuthentication.AuthenticatePackage partner branch. Both the author key and trust signature armor decoded, but checkDetachedSignature verifying the trust signature against the HashiCorpPartnersKeyring failed. This means the trust signature does not actually vouch for the partner key using the HashiCorp Partners key (e.g. wrong signer, tampered signature, or hash mismatch).","triggerScenarios":"s.checkDetachedSignature(hashicorpPartnersKeyring, authorKey.Body, trustSignature.Body, nil) at line 447 returns a non-nil, non-ErrKeyExpired error. The detached signature over the author's key body does not validate under the partners keyring.","commonSituations":"A partner provider rotated its signing key but the registry still serves an old trust signature that was made over a different key. A mirror re-combined a signing key with a trust signature from another publisher. Tampering with either the key or the signature. A trust signature signed by a key other than the official HashiCorp Partners key.","solutions":["Report the publisher/registry mismatch; the trust signature must be a valid detached signature by the HashiCorp Partners key over the served signing key.","Pin to a provider version whose signing key and trust signature are consistent (an older known-good release).","Switch to the official registry/mirror to rule out mirror-side tampering.","If you are the publisher, re-issue the trust signature with the current HashiCorp Partners process and republish."],"exampleFix":"// before: rotated key paired with stale trust signature\n{\"ascii_armor\":\"<new key>\",\"trust_signature\":\"<old sig over previous key>\"}\n// after: re-sign and publish a matching pair\n{\"ascii_armor\":\"<new key>\",\"trust_signature\":\"<fresh detached sig over new key body>\"}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Trust-signature verification failure indicates key/sig pair drift;\n// pin to a consistent release rather than weakening verification.\n_, err := auth.AuthenticatePackage(loc)\nif err != nil && strings.Contains(err.Error(), \"verifying trust signature\") {\n    return fmt.Errorf(\"provider %s signing key / trust signature mismatch; pin a consistent release: %w\", loc, err)\n}","preventionTips":["Publishers must re-issue trust signatures whenever they rotate signing keys.","Pin provider versions whose key+trust-signature pair is known consistent.","Do not recombine keys and signatures from different publisher releases."],"tags":["crypto","openpgp","trust-signature","signing","partner","integrity"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}