{"record":{"id":"9bb36b5fd2145d5a","repo":"hashicorp/terraform","slug":"failed-to-verify-provider-package-checksums-s","errorCode":null,"errorMessage":"failed to verify provider package checksums: %s","messagePattern":"failed to verify provider package checksums: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/package_authentication.go","lineNumber":252,"sourceCode":"\trequiredHashes := PreferredHashes(validHashes)\n\treturn packageHashAuthentication{\n\t\tRequiredHashes: requiredHashes,\n\t\tAllHashes:      validHashes,\n\t\tPlatform:       platform,\n\t}\n}\n\nfunc (a packageHashAuthentication) AuthenticatePackage(localLocation PackageLocation) (*PackageAuthenticationResult, error) {\n\tif len(a.RequiredHashes) == 0 {\n\t\t// Indicates that none of the hashes given to\n\t\t// NewPackageHashAuthentication were considered to be usable by this\n\t\t// version of Terraform.\n\t\treturn nil, fmt.Errorf(\"this version of Terraform does not support any of the checksum formats given for this provider\")\n\t}\n\n\tmatches, err := PackageMatchesAnyHash(localLocation, a.RequiredHashes)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to verify provider package checksums: %s\", err)\n\t}\n\n\tif matches {\n\t\treturn &PackageAuthenticationResult{result: verifiedChecksum}, nil\n\t}\n\tif len(a.RequiredHashes) == 1 {\n\t\treturn nil, fmt.Errorf(\"provider package doesn't match the expected checksum %q\", a.RequiredHashes[0].String())\n\t}\n\t// It's non-ideal that this doesn't actually list the expected checksums,\n\t// but in the many-checksum case the message would get pretty unweildy.\n\t// In practice today we typically use this authenticator only with a\n\t// single hash returned from a network mirror, so the better message\n\t// above will prevail in that case. Maybe we'll improve on this somehow\n\t// if the future introduction of a new hash scheme causes there to more\n\t// commonly be multiple hashes.\n\treturn nil, fmt.Errorf(\"provider package doesn't match the any of the expected checksums\")\n}\n","sourceCodeStart":234,"sourceCodeEnd":270,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/package_authentication.go#L234-L270","documentation":"Wrapper error from packageHashAuthentication.AuthenticatePackage when PackageMatchesAnyHash returns a non-nil error. The inner '%s' is the real cause: it comes from PackageHashV1 or PackageHashLegacyZipSHA failing to read/hash the on-disk package (EvalSymlinks/Open/io.Copy errors). Authentication is aborted before any match decision is made.","triggerScenarios":"PackageMatchesAnyHash(localLocation, a.RequiredHashes) is called at line 250; for an 'h1:' hash it runs PackageHashV1 (which walks the unpacked dir) and for a 'zh:' hash it runs PackageHashLegacyZipSHA (which opens the .zip). Any I/O failure - file deleted between download and verify, permission denied, broken symlink, truncated/corrupt zip - surfaces here.","commonSituations":"Antivirus or a concurrent process deleting the staged provider zip mid-install. A filesystem path with restrictive permissions (downloaded to a cache the user cannot read). A partially-downloaded package where the archive is truncated. Network filesystem flakiness causing read errors on the plugin cache.","solutions":["Re-run 'terraform init' to re-stage the provider (the most common fix; transient I/O errors resolve on retry).","Inspect the inner error string for the I/O cause (ENOENT, EACCES, EOF) and fix that specifically: chmod the cache dir, free disk space, or remove a corrupt cache entry.","Clear the plugin cache: remove .terraform/providers/<provider> and the user-level plugin cache, then init again.","If using a shared plugin cache over a network mount, move the cache to local disk."],"exampleFix":"// before: stale/corrupt staged provider\n$ terraform init\nError: failed to verify provider package checksums: open .../.terraform/providers/.../terraform-provider-aws_v5.0.0: no such file\n// after\n$ rm -rf .terraform/providers && terraform init","handlingStrategy":"retry","validationCode":"// Ensure the staged location is readable before authenticating.\nfunc readable(loc getproviders.PackageLocation) error {\n    if p, ok := loc.(getproviders.PackageLocalArchive); ok {\n        f, err := os.Open(string(p)); if err != nil { return err }; f.Close()\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// 901 wraps transient I/O; retry re-staging once before surfacing.\nvar lastErr error\nfor attempt := 0; attempt < 2; attempt++ {\n    _, err := auth.AuthenticatePackage(loc)\n    if err == nil { return nil }\n    lastErr = err\n    if !isTransientIO(err) { break }\n    _ = restageProvider()\n}\nreturn lastErr","preventionTips":["Keep the plugin cache on local disk, not a network mount.","Avoid concurrent processes that delete the staged provider dir.","Treat wrapped I/O errors as transient and re-stage before failing hard."],"tags":["io","checksum","provider","filesystem","cache"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}