{"record":{"id":"91ffe69483487961","repo":"hashicorp/terraform","slug":"s-returned-from-s","errorCode":null,"errorMessage":"%s returned from %s","messagePattern":"(.+?) returned from (.+?)","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/registry_client.go","lineNumber":441,"sourceCode":"\t}\n}\n\nfunc (c *registryClient) errUnauthorized(hostname svchost.Hostname) error {\n\treturn ErrUnauthorized{\n\t\tHostname:        hostname,\n\t\tHaveCredentials: c.creds != nil,\n\t}\n}\n\nfunc (c *registryClient) getFile(url *url.URL) ([]byte, error) {\n\tresp, err := c.httpClient.Get(url.String())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tdefer resp.Body.Close()\n\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn nil, fmt.Errorf(\"%s returned from %s\", resp.Status, HostFromRequest(resp.Request))\n\t}\n\n\tdata, err := ioutil.ReadAll(resp.Body)\n\tif err != nil {\n\t\treturn data, err\n\t}\n\n\treturn data, nil\n}\n\n// configureDiscoveryRetry configures the number of retries the registry client\n// will attempt for requests with retryable errors, like 502 status codes\nfunc configureDiscoveryRetry() {\n\tdiscoveryRetry = defaultRetry\n\n\tif v := os.Getenv(registryDiscoveryRetryEnvName); v != \"\" {\n\t\tretry, err := strconv.Atoi(v)\n\t\tif err == nil && retry > 0 {","sourceCodeStart":423,"sourceCodeEnd":459,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/registry_client.go#L423-L459","documentation":"getFile (used to fetch SHASUMS documents and signature files) returned an HTTP response whose status was not 200 OK. The status text and host are formatted into the error. It is returned raw (plain fmt.Errorf), then typically wrapped in ErrQueryFailed by the caller PackageMeta.","triggerScenarios":"The shasums_url or shasums_signature_url responded with any non-200 status: 401/403 (auth), 404 (missing artifact), 410 (gone), 429 (rate limit), 5xx (server error), or a redirect that did not land on 200.","commonSituations":"Signed registry URL expired (403); artifact not published for that version (404); registry rate-limiting (429); registry 5xx outage; reverse proxy returning a default error page with a non-200 status; private registry requiring auth the client lacks.","solutions":["curl -I the cited URL to see the exact status and host.","For 401/403: supply registry credentials (terraform login / credentials helper).","For 404: confirm the provider version actually published SHASUMS/signature artifacts; try another version.","For 429/5xx: raise TF_REGISTRY_DISCOVERY_RETRY and retry later.","Verify the registry's reverse proxy permits the host/path."],"exampleFix":"# diagnose\n$ curl -I https://registry.example/s/SHA256SUMS.sig\nHTTP/2 404\n# fix: publish the missing signature artifact on the registry","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"doc, err := client.getFile(shasumsURL)\nif err != nil {\n    if strings.Contains(err.Error(), \"returned from\") {\n        // non-200 status from host; inspect status, possibly auth or 404\n    }\n    return err\n}","preventionTips":["Confirm SHASUMS/signature artifacts are published for every provider version.","Provide registry credentials via terraform login when the registry requires auth.","Monitor the registry for 4xx/5xx on checksum and signature endpoints."],"tags":["terraform","registry","http-status","shasums","signature","network"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}