{"record":{"id":"b0cfb0f3980d009c","repo":"hashicorp/terraform","slug":"error-creating-hashicorp-partners-keyring-s","errorCode":null,"errorMessage":"error creating HashiCorp Partners keyring: %s","messagePattern":"error creating HashiCorp Partners keyring: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/getproviders/package_authentication.go","lineNumber":434,"sourceCode":"\t}\n\n\t// Verify the signature using the HashiCorp public key. If this succeeds,\n\t// this is an official provider.\n\thashicorpKeyring, err := openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPublicKey))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error creating HashiCorp keyring: %s\", err)\n\t}\n\t_, err = s.checkDetachedSignature(hashicorpKeyring, bytes.NewReader(s.Document), bytes.NewReader(s.Signature), nil)\n\tif err == nil {\n\t\treturn &PackageAuthenticationResult{result: officialProvider, KeyID: keyID}, nil\n\t}\n\n\t// If the signing key has a trust signature, attempt to verify it with the\n\t// HashiCorp partners public key.\n\tif signingKey.TrustSignature != \"\" {\n\t\thashicorpPartnersKeyring, err := openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPartnersKey))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error creating HashiCorp Partners keyring: %s\", err)\n\t\t}\n\n\t\tauthorKey, err := openpgpArmor.Decode(strings.NewReader(signingKey.ASCIIArmor))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error decoding signing key: %s\", err)\n\t\t}\n\n\t\ttrustSignature, err := openpgpArmor.Decode(strings.NewReader(signingKey.TrustSignature))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error decoding trust signature: %s\", err)\n\t\t}\n\n\t\t_, err = s.checkDetachedSignature(hashicorpPartnersKeyring, authorKey.Body, trustSignature.Body, nil)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error verifying trust signature: %s\", err)\n\t\t}\n\n\t\treturn &PackageAuthenticationResult{result: partnerProvider, KeyID: keyID}, nil","sourceCodeStart":416,"sourceCodeEnd":452,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/getproviders/package_authentication.go#L416-L452","documentation":"Thrown by signatureAuthentication.AuthenticatePackage when openpgp.ReadArmoredKeyRing fails to parse the compiled-in HashicorpPartnersKey constant. This key validates trust signatures that promote a third-party-signed provider to 'partner' status. As with the official key, this constant is embedded at build time, so a parse failure is a build/binary/library defect rather than a runtime-input problem.","triggerScenarios":"AuthenticatePackage reaches the partners-keyring branch (signingKey.TrustSignature != '') at package_authentication.go:432-434 and ReadArmoredKeyRing(HashicorpPartnersKey) returns err. Only hit when verifying a provider whose signing key carries a trust signature.","commonSituations":"A fork/custom build altered the HashicorpPartnersKey constant; an openpgp dependency bump broke armored parsing; constant truncated during build; verifying a partner provider (e.g. AWS official partner) on a corrupted binary.","solutions":["Use an official unmodified build; if reproducing only on a fork, fix the embedded HashicorpPartnersKey constant.","Add a unit test asserting openpgp.ReadArmoredKeyRing(HashicorpPartnersKey) succeeds in CI.","Pin/upgrade go-crypto/openpgp to a version compatible with the embedded armored key.","Report upstream if a stock build reproduces."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"func checkHashicorpPartnersKey() error {\n    _, err := openpgp.ReadArmoredKeyRing(strings.NewReader(getproviders.HashicorpPartnersKey))\n    return err\n}","typeGuard":null,"tryCatchPattern":"_, err := auth.AuthenticatePackage(loc)\nif err != nil && strings.Contains(err.Error(), \"error creating HashiCorp Partners keyring\") {\n    return fmt.Errorf(\"embedded HashiCorp Partners key failed to parse; use an official build: %w\", err)\n}","preventionTips":["Use official unmodified builds.","Add a CI test asserting ReadArmoredKeyRing(HashicorpPartnersKey) succeeds.","Do not strip the partners key when forking."],"tags":["authentication","signature","pgp","openpgp","build","keyring","partner"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}