{"record":{"id":"881d43d8c3bab201","repo":"hashicorp/terraform","slug":"authentication-signature-from-unknown-issuer","errorCode":null,"errorMessage":"authentication signature from unknown issuer","messagePattern":"authentication signature from unknown issuer","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/package_authentication.go","lineNumber":563,"sourceCode":"\t\t}\n\n\t\t// Any other signature error is terminal.\n\t\tif err != nil {\n\t\t\treturn nil, \"\", fmt.Errorf(\"error checking signature: %s\", err)\n\t\t}\n\n\t\tkeyID := \"n/a\"\n\t\tif entity.PrimaryKey != nil {\n\t\t\tkeyID = entity.PrimaryKey.KeyIdString()\n\t\t}\n\n\t\tlog.Printf(\"[DEBUG] Provider signed by %s\", entityString(entity))\n\t\treturn &key, keyID, nil\n\t}\n\n\t// If none of the provided keys issued the signature, this package is\n\t// unsigned. This is currently a terminal authentication error.\n\treturn nil, \"\", fmt.Errorf(\"authentication signature from unknown issuer\")\n}\n\n// entityString extracts the key ID and identity name(s) from an openpgp.Entity\n// for logging.\nfunc entityString(entity *openpgp.Entity) string {\n\tif entity == nil {\n\t\treturn \"\"\n\t}\n\n\tkeyID := \"n/a\"\n\tif entity.PrimaryKey != nil {\n\t\tkeyID = entity.PrimaryKey.KeyIdString()\n\t}\n\n\tvar names []string\n\tfor _, identity := range entity.Identities {\n\t\tnames = append(names, identity.Name)\n\t}","sourceCodeStart":545,"sourceCodeEnd":581,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/package_authentication.go#L545-L581","documentation":"From signatureAuthentication.findSigningKey after exhausting all keys. For every registry-supplied key, checkDetachedSignature returned ErrUnknownIssuer (this key did not produce the signature) or the key failed to decode; if no key validated, the package is treated as unsigned/tampered and verification fails terminally. The code comment notes unsigned packages are currently a hard authentication error.","triggerScenarios":"The loop at 533 finishes without returning; none of s.Keys could verify s.Signature over s.Document. Reachable when the package is unsigned, when the signature was made by a key absent from the registry response, or when the signature/document were altered so the issuer no longer matches any key.","commonSituations":"A mirror or proxy serves a tampered package/signature. A registry response that omitted the signing_keys for the version. A provider release where the signing key was not registered before publishing. Network MITM altering the signed document or signature. An unsigned community provider being installed from a source that requires signing.","solutions":["Re-download from the official registry to rule out mirror tampering; clear caches first.","Confirm the provider version was published with a signing key and that the registry exposes that key for the version.","Pin to a known-good provider release that is properly signed.","If installing a genuinely unsigned community provider, use a source/configuration that does not require signature authentication (e.g. dev overrides) and accept the trust trade-off explicitly."],"exampleFix":"// before: unsigned/tampered provider from a bad mirror\nError: authentication signature from unknown issuer\n// after: install signed version from official registry\n$ rm -rf .terraform/providers ~/.cache/terraform/plugin-cache/<provider>\n$ terraform init   # against registry.terraform.io","handlingStrategy":"try-catch","validationCode":"// Confirm at least one registry key could plausibly have signed the doc.\nif len(keys) == 0 {\n    return fmt.Errorf(\"registry returned no signing keys; cannot verify signature\")\n}","typeGuard":null,"tryCatchPattern":"// Unsigned/unknown-issuer is terminal and security-relevant; never downgrade.\n_, err := auth.AuthenticatePackage(loc)\nif err != nil && strings.Contains(err.Error(), \"unknown issuer\") {\n    return fmt.Errorf(\"provider package signature could not be verified against any registry key; refusing to install: %w\", err)\n}","preventionTips":["Install providers only from registries that publish signing keys.","Do not disable signature authentication as a workaround.","For genuinely unsigned dev providers, use dev_overrides and never in production."],"tags":["crypto","openpgp","signature","unsigned","integrity","registry"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}