{"record":{"id":"d2271aeb87c82781","repo":"hashicorp/terraform","slug":"registry-response-includes-invalid-shasums-url-s","errorCode":null,"errorMessage":"registry response includes invalid SHASUMS URL: %s","messagePattern":"registry response includes invalid SHASUMS URL: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/registry_client.go","lineNumber":323,"sourceCode":"\tif len(body.SHA256Sum) != sha256.Size*2 { // *2 because it's hex-encoded\n\t\treturn PackageMeta{}, c.errQueryFailed(\n\t\t\tprovider,\n\t\t\tfmt.Errorf(\"registry response includes invalid SHA256 hash %q: %s\", body.SHA256Sum, err),\n\t\t)\n\t}\n\n\tvar checksum [sha256.Size]byte\n\t_, err = hex.Decode(checksum[:], []byte(body.SHA256Sum))\n\tif err != nil {\n\t\treturn PackageMeta{}, c.errQueryFailed(\n\t\t\tprovider,\n\t\t\tfmt.Errorf(\"registry response includes invalid SHA256 hash %q: %s\", body.SHA256Sum, err),\n\t\t)\n\t}\n\n\tshasumsURL, err := url.Parse(body.SHA256SumsURL)\n\tif err != nil {\n\t\treturn PackageMeta{}, fmt.Errorf(\"registry response includes invalid SHASUMS URL: %s\", err)\n\t}\n\tshasumsURL = resp.Request.URL.ResolveReference(shasumsURL)\n\tif shasumsURL.Scheme != \"http\" && shasumsURL.Scheme != \"https\" {\n\t\treturn PackageMeta{}, fmt.Errorf(\"registry response includes invalid SHASUMS URL: must use http or https scheme\")\n\t}\n\tdocument, err := c.getFile(shasumsURL)\n\tif err != nil {\n\t\treturn PackageMeta{}, c.errQueryFailed(\n\t\t\tprovider,\n\t\t\tfmt.Errorf(\"failed to retrieve authentication checksums for provider: %s\", err),\n\t\t)\n\t}\n\tsignatureURL, err := url.Parse(body.SHA256SumsSignatureURL)\n\tif err != nil {\n\t\treturn PackageMeta{}, fmt.Errorf(\"registry response includes invalid SHASUMS signature URL: %s\", err)\n\t}\n\tsignatureURL = resp.Request.URL.ResolveReference(signatureURL)\n\tif signatureURL.Scheme != \"http\" && signatureURL.Scheme != \"https\" {","sourceCodeStart":305,"sourceCodeEnd":341,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/registry_client.go#L305-L341","documentation":"PackageMeta tries to url.Parse the shasums_url field (the URL of the SHASUMS checksum document) and parsing fails, so the checksum document cannot be retrieved. Aborted with a plain fmt.Errorf before any fetch.","triggerScenarios":"Registry response's shasums_url contains characters/structure that Go url.Parse rejects: bad percent-encoding, stray control characters, malformed scheme.","commonSituations":"Custom registry builds shasums_url by concatenation and injects an unencoded version or path; field accidentally contains a newline or quote from a templating bug; registry schema drift renamed the field and a shim emits garbage.","solutions":["Inspect the raw shasums_url value for invalid characters.","Have the registry emit a well-formed absolute or relative http(s) URL.","URL-encode any dynamic segments in the shasums URL."],"exampleFix":"// before\n{\"shasums_url\":\"https://reg/s/terraform-provider v1.0_SHA256SUMS\"}\n// after\n{\"shasums_url\":\"https://reg/s/terraform-provider%20v1.0_SHA256SUMS\"}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"meta, err := client.PackageMeta(ctx, provider, ver, plat)\nif err != nil && strings.Contains(err.Error(), \"invalid SHASUMS URL\") && !strings.Contains(err.Error(), \"scheme\") {\n    // registry shasums_url failed to parse; report upstream\n}","preventionTips":["Registries should return well-formed http(s) shasums_url values.","URL-encode any dynamic path segment in the SHASUMS URL.","Lint registry responses against a JSON schema in CI."],"tags":["terraform","registry","shasums","url-parsing"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}