{"record":{"id":"d13c50f1a2dd4e2c","repo":"hashicorp/terraform","slug":"failed-to-retrieve-authentication-checksums-for-pr","errorCode":null,"errorMessage":"failed to retrieve authentication checksums for provider: %s","messagePattern":"failed to retrieve authentication checksums for provider: (.+?)","errorType":"exception","errorClass":"ErrQueryFailed","httpStatus":null,"severity":"error","filePath":"internal/getproviders/registry_client.go","lineNumber":333,"sourceCode":"\t\treturn PackageMeta{}, c.errQueryFailed(\n\t\t\tprovider,\n\t\t\tfmt.Errorf(\"registry response includes invalid SHA256 hash %q: %s\", body.SHA256Sum, err),\n\t\t)\n\t}\n\n\tshasumsURL, err := url.Parse(body.SHA256SumsURL)\n\tif err != nil {\n\t\treturn PackageMeta{}, fmt.Errorf(\"registry response includes invalid SHASUMS URL: %s\", err)\n\t}\n\tshasumsURL = resp.Request.URL.ResolveReference(shasumsURL)\n\tif shasumsURL.Scheme != \"http\" && shasumsURL.Scheme != \"https\" {\n\t\treturn PackageMeta{}, fmt.Errorf(\"registry response includes invalid SHASUMS URL: must use http or https scheme\")\n\t}\n\tdocument, err := c.getFile(shasumsURL)\n\tif err != nil {\n\t\treturn PackageMeta{}, c.errQueryFailed(\n\t\t\tprovider,\n\t\t\tfmt.Errorf(\"failed to retrieve authentication checksums for provider: %s\", err),\n\t\t)\n\t}\n\tsignatureURL, err := url.Parse(body.SHA256SumsSignatureURL)\n\tif err != nil {\n\t\treturn PackageMeta{}, fmt.Errorf(\"registry response includes invalid SHASUMS signature URL: %s\", err)\n\t}\n\tsignatureURL = resp.Request.URL.ResolveReference(signatureURL)\n\tif signatureURL.Scheme != \"http\" && signatureURL.Scheme != \"https\" {\n\t\treturn PackageMeta{}, fmt.Errorf(\"registry response includes invalid SHASUMS signature URL: must use http or https scheme\")\n\t}\n\tsignature, err := c.getFile(signatureURL)\n\tif err != nil {\n\t\treturn PackageMeta{}, c.errQueryFailed(\n\t\t\tprovider,\n\t\t\tfmt.Errorf(\"failed to retrieve cryptographic signature for provider: %s\", err),\n\t\t)\n\t}\n","sourceCodeStart":315,"sourceCodeEnd":351,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/registry_client.go#L315-L351","documentation":"PackageMeta calls getFile on the (validated) shasums_url to download the SHASUMS checksum document and the HTTP fetch failed — either a transport error or a non-200 status (getFile returns its own error string for non-200). The package install is aborted via errQueryFailed (ErrQueryFailed).","triggerScenarios":"The shasums_url is valid http(s) but unreachable: connection refused, DNS failure, TLS error, timeout, 403/404/500 from the host, or the body read failed.","commonSituations":"Registry is temporarily down or returning 403 (auth/signed URLs expired); corporate proxy blocking the checksum host; the host differs from the registry host (CDN) and is firewalled; TF_REGISTRY_CLIENT_TIMEOUT too low for a slow artifact store; transient 5xx.","solutions":["Retry the install after confirming the shasums_url is reachable in a browser or curl.","Raise TF_REGISTRY_CLIENT_TIMEOUT and/or TF_REGISTRY_DISCOVERY_RETRY.","Check proxy/firewall egress to the checksum host; configure HTTPS_PROXY if needed.","If using signed URLs, ensure they have not expired before Terraform runs."],"exampleFix":"# before\nexport TF_REGISTRY_CLIENT_TIMEOUT=10\n# after\nexport TF_REGISTRY_CLIENT_TIMEOUT=60","handlingStrategy":"retry","validationCode":"// Pre-flight reachability check for the shasums host (informational only).\nfunc hostReachable(rawURL string) error {\n    u, err := url.Parse(rawURL)\n    if err != nil {\n        return err\n    }\n    conn, err := net.DialTimeout(\"tcp\", u.Host, 5*time.Second)\n    if err != nil {\n        return err\n    }\n    conn.Close()\n    return nil\n}","typeGuard":"func isShasumsFetchErr(err error) bool {\n    var qf getproviders.ErrQueryFailed\n    if errors.As(err, &qf) {\n        return strings.Contains(qf.Wrapped.Error(), \"failed to retrieve authentication checksums\")\n    }\n    return false\n}","tryCatchPattern":"var meta getproviders.PackageMeta\nvar err error\nfor i := 0; i < 3; i++ {\n    meta, err = client.PackageMeta(ctx, provider, ver, plat)\n    if err == nil || !isShasumsFetchErr(err) {\n        break\n    }\n    time.Sleep(backoff(i))\n}","preventionTips":["Set TF_REGISTRY_DISCOVERY_RETRY and TF_REGISTRY_CLIENT_TIMEOUT generously in CI.","Ensure egress/proxy access to the registry's checksum host.","Refresh signed SHASUMS URLs before running if they expire."],"tags":["terraform","registry","shasums","network","fetch"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}