{"record":{"id":"d9cbc59d258d17ab","repo":"hashicorp/terraform","slug":"error-creating-hashicorp-keyring-s","errorCode":null,"errorMessage":"error creating HashiCorp keyring: %s","messagePattern":"error creating HashiCorp keyring: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/package_authentication.go","lineNumber":422,"sourceCode":"\t\tDocument:  document,\n\t\tSignature: signature,\n\t\tKeys:      keys,\n\t}\n}\n\nfunc (s signatureAuthentication) AuthenticatePackage(location PackageLocation) (*PackageAuthenticationResult, error) {\n\t// Find the key that signed the checksum file. This can fail if there is no\n\t// valid signature for any of the provided keys.\n\tsigningKey, keyID, err := s.findSigningKey()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// Verify the signature using the HashiCorp public key. If this succeeds,\n\t// this is an official provider.\n\thashicorpKeyring, err := openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPublicKey))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error creating HashiCorp keyring: %s\", err)\n\t}\n\t_, err = s.checkDetachedSignature(hashicorpKeyring, bytes.NewReader(s.Document), bytes.NewReader(s.Signature), nil)\n\tif err == nil {\n\t\treturn &PackageAuthenticationResult{result: officialProvider, KeyID: keyID}, nil\n\t}\n\n\t// If the signing key has a trust signature, attempt to verify it with the\n\t// HashiCorp partners public key.\n\tif signingKey.TrustSignature != \"\" {\n\t\thashicorpPartnersKeyring, err := openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPartnersKey))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error creating HashiCorp Partners keyring: %s\", err)\n\t\t}\n\n\t\tauthorKey, err := openpgpArmor.Decode(strings.NewReader(signingKey.ASCIIArmor))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error decoding signing key: %s\", err)\n\t\t}","sourceCodeStart":404,"sourceCodeEnd":440,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/package_authentication.go#L404-L440","documentation":"From signatureAuthentication.AuthenticatePackage. It builds the HashiCorp official keyring from the compile-time constant HashicorpPublicKey (defined in public_keys.go) via openpgp.ReadArmoredKeyRing. Because the key is a hardcoded constant bundled with the binary, this error almost always indicates a build/linkage problem rather than runtime data.","triggerScenarios":"openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPublicKey)) at line 420 returns an error. Reachable on every signed-provider authentication attempt, immediately after a signing key is located.","commonSituations":"A custom/forked build where HashicorpPublicKey was edited or truncated and no longer parses as valid ASCII-armored OpenPGP. A dependency downgrade/upgrade of github.com/ProtonMail/go-crypto that changed the armored-key parser strictness. Memory corruption or a build flag stripping the constant. Not expected from a stock release binary.","solutions":["If running a stock binary, this is a bug - report it upstream with the full error string.","If running a fork/custom build, restore the unmodified HashicorpPublicKey constant from the upstream source and rebuild.","Pin or align the go-crypto dependency version to the one the release was built against.","As a last resort for a custom build, replace HashicorpPublicKey with a known-good armored public key you control and republish providers under it."],"exampleFix":"// before: custom build with truncated key\nconst HashicorpPublicKey = `-----BEGIN PGP...` // truncated\n// after: restore full armored key from upstream public_keys.go\nconst HashicorpPublicKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----\n...full block...\n-----END PGP PUBLIC KEY BLOCK-----`","handlingStrategy":"try-catch","validationCode":"// Not a runtime-input error; validate at build/test time that the constant parses.\nfunc TestHashicorpPublicKeyParses(t *testing.T) {\n    _, err := openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPublicKey))\n    if err != nil { t.Fatalf(\"bundled HashicorpPublicKey invalid: %v\", err) }\n}","typeGuard":null,"tryCatchPattern":"// Surface the error; users cannot fix it via config. Recommend a stock binary.\n_, err := auth.AuthenticatePackage(loc)\nif err != nil && strings.Contains(err.Error(), \"creating HashiCorp keyring\") {\n    return fmt.Errorf(\"bundled HashiCorp signing key is invalid in this build; use an official release: %w\", err)\n}","preventionTips":["Run stock official binaries for production.","If you fork, keep a CI test that parses both bundled key constants.","Pin the go-crypto dependency version to the upstream release."],"tags":["crypto","openpgp","signing","build","internal-constant"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}