{"record":{"id":"d3d2d58f96a8c202","repo":"hashicorp/terraform","slug":"error-decoding-trust-signature-s","errorCode":null,"errorMessage":"error decoding trust signature: %s","messagePattern":"error decoding trust signature: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/package_authentication.go","lineNumber":444,"sourceCode":"\t\treturn &PackageAuthenticationResult{result: officialProvider, KeyID: keyID}, nil\n\t}\n\n\t// If the signing key has a trust signature, attempt to verify it with the\n\t// HashiCorp partners public key.\n\tif signingKey.TrustSignature != \"\" {\n\t\thashicorpPartnersKeyring, err := openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPartnersKey))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error creating HashiCorp Partners keyring: %s\", err)\n\t\t}\n\n\t\tauthorKey, err := openpgpArmor.Decode(strings.NewReader(signingKey.ASCIIArmor))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error decoding signing key: %s\", err)\n\t\t}\n\n\t\ttrustSignature, err := openpgpArmor.Decode(strings.NewReader(signingKey.TrustSignature))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error decoding trust signature: %s\", err)\n\t\t}\n\n\t\t_, err = s.checkDetachedSignature(hashicorpPartnersKeyring, authorKey.Body, trustSignature.Body, nil)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error verifying trust signature: %s\", err)\n\t\t}\n\n\t\treturn &PackageAuthenticationResult{result: partnerProvider, KeyID: keyID}, nil\n\t}\n\n\t// We have a valid signature, but it's not from the HashiCorp key, and it\n\t// also isn't a trusted partner. This is a community provider.\n\treturn &PackageAuthenticationResult{result: communityProvider, KeyID: keyID}, nil\n}\n\nfunc (s signatureAuthentication) checkDetachedSignature(keyring openpgp.KeyRing, signed, signature io.Reader, config *packet.Config) (*openpgp.Entity, error) {\n\tentity, err := openpgp.CheckDetachedSignature(keyring, signed, signature, config)\n\t// FIXME: it's not clear what should be done with provider signing key","sourceCodeStart":426,"sourceCodeEnd":462,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/package_authentication.go#L426-L462","documentation":"From signatureAuthentication.AuthenticatePackage partner branch. After decoding the author's signing key, it decodes signingKey.TrustSignature with openpgpArmor.Decode; a parse failure yields this error. The trust signature is the detached signature proving the partner key was vouched for by HashiCorp, and the registry must deliver it as a valid ASCII-armored (typically PGP SIGNATURE) block.","triggerScenarios":"signingKey.TrustSignature != \"\" and signing key armor decoded OK, but openpgpArmor.Decode(signingKey.TrustSignature) at line 442 errors. The trust_signature field is empty-but-set, truncated, wrong block type (e.g. a public key block instead of a signature), or otherwise not parseable armor.","commonSituations":"Registry returns a trust_signature that is malformed, contains a binary signature not armored, was copy-pasted incompletely, or was HTML-escaped by a proxy. A mirror that drops newlines from the JSON field. Mismatch between the declared ascii_armor key and the trust signature block type.","solutions":["Report the issue to the registry: trust_signature must be a complete ASCII-armored PGP signature block.","Use the official registry or a mirror known to preserve the trust signature verbatim.","If you operate the registry/mirror, ensure JSON encoding preserves newlines and the block is served from the same source as the signing key.","If publishing a partner provider, regenerate the trust signature and re-submit it as clean ASCII armor."],"exampleFix":"// before: trust signature missing its header\n{\"trust_signature\":\"base64-or-binary-blob\"}\n// after: proper armored detached signature\n{\"trust_signature\":\"-----BEGIN PGP SIGNATURE-----\\n...\\n-----END PGP SIGNATURE-----\"}","handlingStrategy":"validation","validationCode":"// Validate the trust signature armor block shape before authenticating.\nfor _, k := range keys {\n    if k.TrustSignature != \"\" {\n        if _, err := openpgpArmor.Decode(strings.NewReader(k.TrustSignature)); err != nil {\n            return fmt.Errorf(\"malformed trust_signature: %w\", err)\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Serve registry JSON without HTML-escaping or newline stripping.","Validate trust_signature blocks at registry publish time.","Mirror the keys endpoint with content-type application/json and no body rewriting."],"tags":["crypto","openpgp","trust-signature","registry","armor","partner"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}