{"record":{"id":"9216ec851abfc726","repo":"hashicorp/terraform","slug":"provider-package-doesn-t-match-the-any-of-the-expe","errorCode":null,"errorMessage":"provider package doesn't match the any of the expected checksums","messagePattern":"provider package doesn't match the any of the expected checksums","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/package_authentication.go","lineNumber":268,"sourceCode":"\tmatches, err := PackageMatchesAnyHash(localLocation, a.RequiredHashes)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to verify provider package checksums: %s\", err)\n\t}\n\n\tif matches {\n\t\treturn &PackageAuthenticationResult{result: verifiedChecksum}, nil\n\t}\n\tif len(a.RequiredHashes) == 1 {\n\t\treturn nil, fmt.Errorf(\"provider package doesn't match the expected checksum %q\", a.RequiredHashes[0].String())\n\t}\n\t// It's non-ideal that this doesn't actually list the expected checksums,\n\t// but in the many-checksum case the message would get pretty unweildy.\n\t// In practice today we typically use this authenticator only with a\n\t// single hash returned from a network mirror, so the better message\n\t// above will prevail in that case. Maybe we'll improve on this somehow\n\t// if the future introduction of a new hash scheme causes there to more\n\t// commonly be multiple hashes.\n\treturn nil, fmt.Errorf(\"provider package doesn't match the any of the expected checksums\")\n}\n\nfunc (a packageHashAuthentication) AcceptableHashes() []Hash {\n\t// In this case we include even hashes the current version of Terraform\n\t// doesn't prefer, because this result is used for building a lock file\n\t// and so it's helpful to include older hash formats that other Terraform\n\t// versions might need in order to do authentication successfully.\n\treturn a.AllHashes\n}\n\ntype archiveHashAuthentication struct {\n\tPlatform      Platform\n\tWantSHA256Sum [sha256.Size]byte\n}\n\n// NewArchiveChecksumAuthentication returns a PackageAuthentication\n// implementation that checks that the original distribution archive matches\n// the given hash.","sourceCodeStart":250,"sourceCodeEnd":286,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/package_authentication.go#L250-L286","documentation":"Multi-hash mismatch from packageHashAuthentication.AuthenticatePackage. Multiple RequiredHashes were acceptable but PackageMatchesAnyHash returned false for all of them. The package was readable and hashed successfully but matched none of the accepted checksums. As the code comment notes, the expected hashes are deliberately not listed to keep the message readable.","triggerScenarios":"len(a.RequiredHashes) > 1 and PackageMatchesAnyHash returns (false, nil), reaching line 268. Common with the registry path where both 'h1:' and 'zh:' hashes are supplied yet the package matches neither.","commonSituations":"Lock file generated against one provider build but the registry/mirror now serves a different build of the same version (republished artifact). Mixed lock files shared across teams where one side recomputed hashes from a different source. A mirror that serves a repackaged zip (which breaks 'zh:' hashes) while the contents also differ (breaking 'h1:').","solutions":["Regenerate the lock file: 'terraform init -upgrade' (or delete the provider block in .terraform.lock.hcl) so hashes match the currently served artifact.","Verify everyone on the team uses the same registry/mirror so recomputed hashes are consistent.","If a custom mirror repackaged the zip, serve the original upstream .zip so 'zh:' hashes match again.","Confirm the provider version was not yanked and re-released; pin to a version that has not been republished."],"exampleFix":"// before\n$ terraform init\nError: provider package doesn't match the any of the expected checksums\n// after\n$ terraform init -upgrade","handlingStrategy":"validation","validationCode":"// Pre-check all candidate hashes against the staged package so you surface\n// the actual expected set, not the generic message.\nfor _, h := range getproviders.PreferredHashes(validHashes) {\n    if ok, _ := getproviders.PackageMatchesAnyHash(loc, []providerreqs.Hash{h}); ok { return nil }\n}\nreturn fmt.Errorf(\"matched none of %d candidate hashes\", len(validHashes))","typeGuard":null,"tryCatchPattern":"_, err := auth.AuthenticatePackage(loc)\nif err != nil && strings.Contains(err.Error(), \"any of the expected checksums\") {\n    // multi-hash drift: regenerate lock against the artifact you actually serve.\n}\nreturn err","preventionTips":["Standardize the team on one registry/mirror so recomputed hashes are consistent.","Run terraform init -upgrade after provider republishes, not before.","Do not serve repackaged zips from mirrors (breaks zh: hashes)."],"tags":["checksum","integrity","provider","mirror","lock-file"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}