{"record":{"id":"a737cce9eb7847f6","repo":"hashicorp/terraform","slug":"errinvalidsha256hash","errorCode":"ErrInvalidSHA256Hash","errorMessage":"the value was not a valid SHA-256 hash","messagePattern":"the value was not a valid SHA-256 hash","errorType":"exception","errorClass":"ErrInvalidSHA256Hash","httpStatus":null,"severity":"error","filePath":"internal/releaseauth/hash.go","lineNumber":19,"sourceCode":"// Copyright IBM Corp. 2014, 2026\n// SPDX-License-Identifier: BUSL-1.1\n\npackage releaseauth\n\nimport (\n\t\"bytes\"\n\t\"crypto/sha256\"\n\t\"encoding/hex\"\n\t\"errors\"\n\t\"fmt\"\n\t\"log\"\n)\n\n// SHA256Hash represents a 256-bit SHA hash\ntype SHA256Hash [sha256.Size]byte\n\n// ErrInvalidSHA256Hash is returned when the hash is invalid\nvar ErrInvalidSHA256Hash = errors.New(\"the value was not a valid SHA-256 hash\")\n\n// SHA256FromHex decodes a SHA256Hash from a hex string dump\nfunc SHA256FromHex(hashHex string) (SHA256Hash, error) {\n\tvar result [sha256.Size]byte\n\thash, err := hex.DecodeString(hashHex)\n\tif err != nil || len(hash) != sha256.Size {\n\t\treturn result, ErrInvalidSHA256Hash\n\t}\n\n\tif copy(result[:], hash) != sha256.Size {\n\t\tpanic(\"could not copy hash value\")\n\t}\n\n\treturn result, nil\n}\n\n// SHA256Checksums decodes a file generated by the sha256sum program\ntype SHA256Checksums map[string]SHA256Hash","sourceCodeStart":1,"sourceCodeEnd":37,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/releaseauth/hash.go#L1-L37","documentation":"ErrInvalidSHA256Hash is a sentinel returned by SHA256FromHex when the supplied string cannot be decoded as hex, or decodes to a length other than sha256.Size (32 bytes / 64 hex chars). It guards the parser used to turn the textual SHA256SUMS lines into a SHA256Hash, so a malformed hash line bubbles up as 'failed to parse checksums' from ParseChecksums.","triggerScenarios":"Returned at internal/releaseauth/hash.go:26 when hex.DecodeString(hashHex) errors OR len(hash) != sha256.Size. ParseChecksums (line 51) wraps it: 'failed to parse checksums: %w'.","commonSituations":"A SHA256SUMS file that is not in the standard `<64-hex>  <filename>` format (extra whitespace, wrong separator, base64). A truncated or hand-edited sums file. A sums file from a different algorithm (SHA1/MD5). A registry/mirror that reformatted the file. An empty or garbage response served in place of SHA256SUMS.","solutions":["Re-fetch the genuine SHA256SUMS file from the publisher (hashicorp/releases) and ensure it is the verbatim `<64 lowercase hex>  <name>` format.","Validate each hash token is exactly 64 lowercase hex characters before parsing.","If the sums come from a custom mirror, fix the mirror to serve the unmodified upstream file.","Check the file wasn't CRLF-converted or re-encoded on the way through a proxy."],"exampleFix":"// validate a hex hash before calling SHA256FromHex\nfunc validSHA256Hex(s string) bool {\n    if len(s) != 64 { return false }\n    for _, r := range s {\n        if !((r >= '0' && r <= '9') || (r >= 'a' && r <= 'f')) { return false }\n    }\n    return true\n}","handlingStrategy":"validation","validationCode":"// Validate hex before parsing.\nfunc validSHA256Hex(s string) bool {\n    if len(s) != 64 { return false }\n    _, err := hex.DecodeString(s)\n    return err == nil\n}\nif !validSHA256Hex(token) { return errors.New(\"malformed sha256\") }","typeGuard":"func isInvalidSHA256Hash(err error) bool {\n    return errors.Is(err, releaseauth.ErrInvalidSHA256Hash)\n}","tryCatchPattern":"h, err := releaseauth.SHA256FromHex(raw)\nif errors.Is(err, releaseauth.ErrInvalidSHA256Hash) {\n    // skip / reject the malformed sums line rather than aborting the whole file\n    continue\n}","preventionTips":["Only consume verbatim SHA256SUMS files from the publisher.","Sanitize sums through a custom mirror that preserves the canonical format.","Unit-test your sums parser against the real upstream format."],"tags":["release-auth","sha256","parsing","validation"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}