{"record":{"id":"8b151127214a631e","repo":"hashicorp/terraform","slug":"unsupported-hash-format-this-may-require-a-newer","errorCode":null,"errorMessage":"unsupported hash format (this may require a newer version of Terraform)","messagePattern":"unsupported hash format \\(this may require a newer version of Terraform\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/hash.go","lineNumber":130,"sourceCode":"\tswitch want.Scheme() {\n\tcase HashScheme1:\n\t\tgot, err := PackageHashV1(loc)\n\t\tif err != nil {\n\t\t\treturn false, err\n\t\t}\n\t\treturn got == want, nil\n\tcase HashSchemeZip:\n\t\tarchiveLoc, ok := loc.(PackageLocalArchive)\n\t\tif !ok {\n\t\t\treturn false, fmt.Errorf(`ziphash scheme (\"zh:\" prefix) is not supported for unpacked provider packages`)\n\t\t}\n\t\tgot, err := PackageHashLegacyZipSHA(archiveLoc)\n\t\tif err != nil {\n\t\t\treturn false, err\n\t\t}\n\t\treturn got == want, nil\n\tdefault:\n\t\treturn false, fmt.Errorf(\"unsupported hash format (this may require a newer version of Terraform)\")\n\t}\n}\n\n// PackageMatchesAnyHash returns true if the package at the given location\n// matches at least one of the given hashes, or false otherwise.\n//\n// If it cannot read from the given location, PackageMatchesAnyHash returns an\n// error. Unlike the singular PackageMatchesHash, PackageMatchesAnyHash\n// considers unsupported hash formats as successfully non-matching, rather\n// than returning an error.\n//\n// PackageMatchesAnyHash can be used only with the two local package location\n// types PackageLocalDir and PackageLocalArchive, because it needs to access the\n// contents of the indicated package in order to compute the hash. If given\n// a non-local location this function will always return an error.\nfunc PackageMatchesAnyHash(loc PackageLocation, allowed []providerreqs.Hash) (bool, error) {\n\t// It's likely that we'll have multiple hashes of the same scheme in\n\t// the \"allowed\" set, in which case we'll avoid repeatedly re-reading the","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/hash.go#L112-L148","documentation":"Raised in PackageMatchesHash (internal/getproviders/hash.go:130). The supplied hash uses a scheme prefix that is neither 'h1:' (HashScheme1) nor 'zh:' (HashSchemeZip). The current Terraform build does not know how to verify that scheme, so it cannot confirm or deny a match and returns this error. The message hints a newer Terraform may be required.","triggerScenarios":"Verifying against a hash from a lockfile or registry written by a newer Terraform that introduced an additional hash scheme (e.g. a future 'h2:'). The switch's default branch catches the unknown scheme.","commonSituations":"Downgrading Terraform after a newer version wrote a lockfile with a new hash scheme; a registry listing including hashes for newer schemes; a hand-edited lock entry with a typo'd prefix.","solutions":["Upgrade Terraform to a version that supports the hash scheme in use.","Regenerate the lockfile (.terraform.lock.hcl) with the current Terraform so it records only supported schemes.","Use PackageMatchesAnyHash, which silently skips unknown schemes and returns false instead of erroring.","Filter the allowed hashes to supported schemes (h1:, zh:) before calling PackageMatchesHash."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// Keep only hash schemes this Terraform build can verify.\nfunc filterSupportedHashes(hashes []Hash) []Hash {\n\tout := make([]Hash, 0, len(hashes))\n\tfor _, h := range hashes {\n\t\tswitch h.Scheme() {\n\t\tcase HashScheme1, HashSchemeZip:\n\t\t\tout = append(out, h)\n\t\t}\n\t}\n\treturn out\n}","typeGuard":null,"tryCatchPattern":"// PackageMatchesAnyHash treats unknown schemes as non-matches (no error).\nok, err := PackageMatchesAnyHash(loc, allowed)\nif err != nil {\n    return false, err\n}","preventionTips":["Use PackageMatchesAnyHash rather than PackageMatchesHash when hashes may include unknown schemes.","Keep the Terraform version that wrote a lockfile aligned with the version verifying it.","Regenerate the lockfile with the current Terraform if you downgrade."],"tags":["hash","provider","version-compat","verification"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}