{"record":{"id":"d8afd0ef616061dc","repo":"hashicorp/terraform","slug":"invalid-provider-mirror-base-url-s-s","errorCode":null,"errorMessage":"invalid provider mirror base URL %s: %s","messagePattern":"invalid provider mirror base URL (.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/http_mirror_source.go","lineNumber":304,"sourceCode":"//\n// If the returned error is non-nil then the given hostname doesn't comply\n// with the IETF RFC 5891 section 5.3 and 5.4 validation rules, and thus cannot\n// be interpreted as a valid Terraform service host. The IDNA validation errors\n// are unfortunately usually not very user-friendly, but they are also\n// relatively rare because the IDNA normalization rules are quite tolerant.\nfunc (s *HTTPMirrorSource) mirrorHost() (svchost.Hostname, error) {\n\treturn svchostFromURL(s.baseURL)\n}\n\n// mirrorHostCredentials returns the HostCredentials, if any, for the hostname\n// included in the mirror base URL.\n//\n// It might return an error if the mirror base URL is invalid, or if the\n// credentials lookup itself fails.\nfunc (s *HTTPMirrorSource) mirrorHostCredentials() (svcauth.HostCredentials, error) {\n\thostname, err := s.mirrorHost()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid provider mirror base URL %s: %s\", s.baseURL.String(), err)\n\t}\n\n\tif s.creds == nil {\n\t\t// No host-specific credentials, then.\n\t\treturn nil, nil\n\t}\n\n\treturn s.creds.ForHost(hostname)\n}\n\n// get is the shared functionality for querying a JSON index from a mirror.\n//\n// It only handles the raw HTTP request. The \"body\" return value is the\n// reader from the response if and only if the response status code is 200 OK\n// and the Content-Type is application/json. In all other cases it's nil.\n// If body is non-nil then the caller must close it after reading it.\n//\n// If the \"finalURL\" return value is not empty then it's the URL that actually","sourceCodeStart":286,"sourceCodeEnd":322,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/http_mirror_source.go#L286-L322","documentation":"mirrorHostCredentials() first derives a svchost.Hostname from the configured base URL via mirrorHost() -> svchostFromURL(), which runs IDNA normalization. If the host portion fails IDNA validation (RFC 5891) this error is returned, naming the base URL and the normalization error. It means the configured mirror URL has a hostname Terraform cannot treat as a service host.","triggerScenarios":"The base URL host contains invalid characters, invalid punycode, or otherwise fails idna.Display.ToUnicode / svchost.ForComparison. Triggered when credentials are being attached to a request (so typically when a creds source is configured).","commonSituations":"Typo in the mirror URL (e.g. underscore in hostname, which IDNA rejects); a URL with a port that normalizes oddly; copy-pasted URL with stray characters.","solutions":["Correct the hostname in the network_mirror URL to a valid DNS/IDNA name (letters, digits, hyphens).","Avoid underscores and other characters IDNA forbids in hostnames.","Re-enter the URL by hand rather than copy-pasting to drop stray characters."],"exampleFix":"# before\nprovider_installation {\n  network_mirror { url = \"https://tf_mirror.local/\" }  # underscore invalid\n}\n\n# after\nprovider_installation {\n  network_mirror { url = \"https://tf-mirror.local/\" }\n}","handlingStrategy":"validation","validationCode":"// Validate a configured mirror URL up front.\nif _, err := svchost.ForCompatibility(strings.SplitN(u.Host, \":\", 2)[0]); err != nil {\n    return fmt.Errorf(\"mirror hostname invalid: %w\", err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use hyphens, not underscores, in mirror hostnames.","Validate the mirror URL host with svchost at config load time.","Hand-type URLs to avoid stray characters from copy-paste."],"tags":["config","url","mirror","hostname"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}