{"record":{"id":"aa6345d13d6ccf2c","repo":"hashicorp/terraform","slug":"the-value-was-not-a-valid-sha-256-hash","errorCode":null,"errorMessage":"the value was not a valid SHA-256 hash","messagePattern":"the value was not a valid SHA-256 hash","errorType":"validation","errorClass":"ErrInvalidSHA256Hash","httpStatus":null,"severity":"error","filePath":"internal/releaseauth/hash.go","lineNumber":19,"sourceCode":"// Copyright IBM Corp. 2014, 2026\n// SPDX-License-Identifier: BUSL-1.1\n\npackage releaseauth\n\nimport (\n\t\"bytes\"\n\t\"crypto/sha256\"\n\t\"encoding/hex\"\n\t\"errors\"\n\t\"fmt\"\n\t\"log\"\n)\n\n// SHA256Hash represents a 256-bit SHA hash\ntype SHA256Hash [sha256.Size]byte\n\n// ErrInvalidSHA256Hash is returned when the hash is invalid\nvar ErrInvalidSHA256Hash = errors.New(\"the value was not a valid SHA-256 hash\")\n\n// SHA256FromHex decodes a SHA256Hash from a hex string dump\nfunc SHA256FromHex(hashHex string) (SHA256Hash, error) {\n\tvar result [sha256.Size]byte\n\thash, err := hex.DecodeString(hashHex)\n\tif err != nil || len(hash) != sha256.Size {\n\t\treturn result, ErrInvalidSHA256Hash\n\t}\n\n\tif copy(result[:], hash) != sha256.Size {\n\t\tpanic(\"could not copy hash value\")\n\t}\n\n\treturn result, nil\n}\n\n// SHA256Checksums decodes a file generated by the sha256sum program\ntype SHA256Checksums map[string]SHA256Hash","sourceCodeStart":1,"sourceCodeEnd":37,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/releaseauth/hash.go#L1-L37","documentation":"ErrInvalidSHA256Hash is returned by SHA256FromHex when the input string is not a valid 64-character hex-encoded SHA-256 digest — either hex.DecodeString fails (non-hex characters / odd length) or the decoded byte length is not sha256.Size (32 bytes). It is also surfaced (wrapped) by ParseChecksums when a line of a SHA256SUMS file is malformed.","triggerScenarios":"Calling SHA256FromHex with a string that is the wrong length (not 64 hex chars), contains whitespace/non-hex characters, or is a different hash algorithm's digest. ParseChecksums hits this when a SHA256SUMS line's first field is malformed.","commonSituations":"Hardcoded/pasted checksum with a stray space or newline; a SHA-1/MD5 digest passed instead of SHA-256; truncated digest; copy-paste from a checksum listing that uses a different format.","solutions":["Provide exactly 64 lowercase hex characters (sha256.Size*2) with no leading/trailing whitespace.","Trim any whitespace/newlines from the hex string before calling SHA256FromHex.","If parsing SHA256SUMS, ensure the file uses the standard '<64-hex>  <filename>' two-space format.","Cross-check the digest length: len(hashHex) must equal 64."],"exampleFix":"// before\nh, err := releaseauth.SHA256FromHex(\"abc123\")\n\n// after\nh, err := releaseauth.SHA256FromHex(strings.TrimSpace(rawDigest))\nif err != nil {\n    return fmt.Errorf(\"invalid sha256 in config (need 64 hex chars): %w\", err)\n}","handlingStrategy":"validation","validationCode":"// Pre-validate length and charset\nraw := strings.TrimSpace(rawDigest)\nif len(raw) != 64 || !regexp.MustCompile(`^[0-9a-fA-F]{64}$`).MatchString(raw) {\n    return fmt.Errorf(\"digest must be 64 hex chars\")\n}","typeGuard":"func isValidSHA256Hex(s string) bool {\n    s = strings.TrimSpace(s)\n    return len(s) == 64 && regexp.MustCompile(`^[0-9a-fA-F]{64}$`).MatchString(s)\n}","tryCatchPattern":"h, err := releaseauth.SHA256FromHex(strings.TrimSpace(raw))\nif errors.Is(err, releaseauth.ErrInvalidSHA256Hash) {\n    return fmt.Errorf(\"config has an invalid sha256 (need 64 hex chars): %w\", err)\n}","preventionTips":["Trim whitespace/newlines from pasted digests.","Store checksums in their canonical 64-hex-char form.","Validate length and charset before calling SHA256FromHex for a clearer upstream error."],"tags":["sha256","validation","parsing","terraform"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}