{"record":{"id":"b0cfb0f3980d009c","repo":"hashicorp/terraform","slug":"error-creating-hashicorp-partners-keyring-s","errorCode":null,"errorMessage":"error creating HashiCorp Partners keyring: %s","messagePattern":"error creating HashiCorp Partners keyring: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/package_authentication.go","lineNumber":434,"sourceCode":"\t}\n\n\t// Verify the signature using the HashiCorp public key. If this succeeds,\n\t// this is an official provider.\n\thashicorpKeyring, err := openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPublicKey))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error creating HashiCorp keyring: %s\", err)\n\t}\n\t_, err = s.checkDetachedSignature(hashicorpKeyring, bytes.NewReader(s.Document), bytes.NewReader(s.Signature), nil)\n\tif err == nil {\n\t\treturn &PackageAuthenticationResult{result: officialProvider, KeyID: keyID}, nil\n\t}\n\n\t// If the signing key has a trust signature, attempt to verify it with the\n\t// HashiCorp partners public key.\n\tif signingKey.TrustSignature != \"\" {\n\t\thashicorpPartnersKeyring, err := openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPartnersKey))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error creating HashiCorp Partners keyring: %s\", err)\n\t\t}\n\n\t\tauthorKey, err := openpgpArmor.Decode(strings.NewReader(signingKey.ASCIIArmor))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error decoding signing key: %s\", err)\n\t\t}\n\n\t\ttrustSignature, err := openpgpArmor.Decode(strings.NewReader(signingKey.TrustSignature))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error decoding trust signature: %s\", err)\n\t\t}\n\n\t\t_, err = s.checkDetachedSignature(hashicorpPartnersKeyring, authorKey.Body, trustSignature.Body, nil)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error verifying trust signature: %s\", err)\n\t\t}\n\n\t\treturn &PackageAuthenticationResult{result: partnerProvider, KeyID: keyID}, nil","sourceCodeStart":416,"sourceCodeEnd":452,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/package_authentication.go#L416-L452","documentation":"From signatureAuthentication.AuthenticatePackage, in the partner-trust branch. It builds a keyring from the compile-time constant HashicorpPartnersKey (public_keys.go) to verify the trust signature on a partner provider's signing key. As with 910, the key is a hardcoded constant, so a failure here is essentially a build/linkage defect.","triggerScenarios":"signingKey.TrustSignature != \"\" (line 431) and openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPartnersKey)) at line 432 returns an error. Only reached when authenticating a provider whose registry key carries a trust signature (i.e. a HashiCorp partner).","commonSituations":"A forked/custom build with an edited or truncated HashicorpPartnersKey constant. An incompatible go-crypto version that rejects the armored partner key. A build that embedded a placeholder instead of the real key. Not expected from stock release binaries.","solutions":["Restore the unmodified HashicorpPartnersKey constant from upstream and rebuild.","Align the go-crypto dependency version with the upstream release.","If using a stock binary, report upstream - the bundled partner key should always parse.","If you intentionally run a custom key set, also replace HashicorpPartnersKey with a valid armored key you publish."],"exampleFix":"// before: placeholder partner key in a fork\nconst HashicorpPartnersKey = ``\n// after: real armored partner key\nconst HashicorpPartnersKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----\n...full block...\n-----END PGP PUBLIC KEY BLOCK-----`","handlingStrategy":"try-catch","validationCode":"// Build-time guard for the partner key constant.\nfunc TestHashicorpPartnersKeyParses(t *testing.T) {\n    _, err := openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPartnersKey))\n    if err != nil { t.Fatalf(\"bundled HashicorpPartnersKey invalid: %v\", err) }\n}","typeGuard":null,"tryCatchPattern":"// Partner keyring parse failure is a build defect; do not retry on data.\n_, err := auth.AuthenticatePackage(loc)\nif err != nil && strings.Contains(err.Error(), \"HashiCorp Partners keyring\") {\n    return fmt.Errorf(\"bundled HashiCorp Partners key invalid in this build; use an official release: %w\", err)\n}","preventionTips":["Do not edit bundled key constants without re-validating them.","Add a parse test for both key constants in CI.","Track go-crypto version changes that tighten armor parsing."],"tags":["crypto","openpgp","signing","partner","build","internal-constant"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}