{"record":{"id":"da1bce115ca6e0f8","repo":"hashicorp/terraform","slug":"the-cached-package-for-s-s-in-s-does-not-matc","errorCode":null,"errorMessage":"the cached package for %s %s (in %s) does not match any of the checksums recorded in the dependency lock file","messagePattern":"the cached package for (.+?) (.+?) \\(in (.+?)\\) does not match any of the checksums recorded in the dependency lock file","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/command/meta_providers.go","lineNumber":420,"sourceCode":"\t\t\treportError(fmt.Errorf(\n\t\t\t\t\"there is no package for %s %s cached in %s\",\n\t\t\t\tprovider, version, cacheDir.BasePath(),\n\t\t\t))\n\t\t\tcontinue\n\t\t}\n\t\t// The cached package must match one of the checksums recorded in\n\t\t// the lock file, if any.\n\t\tif allowedHashes := lock.PreferredHashes(); len(allowedHashes) != 0 {\n\t\t\tmatched, err := cached.MatchesAnyHash(allowedHashes)\n\t\t\tif err != nil {\n\t\t\t\treportError(fmt.Errorf(\n\t\t\t\t\t\"failed to verify checksum of %s %s package cached in in %s: %s\",\n\t\t\t\t\tprovider, version, cacheDir.BasePath(), err,\n\t\t\t\t))\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif !matched {\n\t\t\t\treportError(fmt.Errorf(\n\t\t\t\t\t\"the cached package for %s %s (in %s) does not match any of the checksums recorded in the dependency lock file\",\n\t\t\t\t\tprovider, version, cacheDir.BasePath(),\n\t\t\t\t))\n\t\t\t\tcontinue\n\t\t\t}\n\t\t}\n\t\tfactories[provider] = providerFactory(cached)\n\t}\n\tfor provider, localDir := range devOverrideProviders {\n\t\tfactories[provider] = devOverrideProviderFactory(provider, localDir)\n\t}\n\tfor provider, reattach := range unmanagedProviders {\n\t\tfactories[provider] = unmanagedProviderFactory(provider, reattach)\n\t}\n\tif m.testingOverrides != nil {\n\t\t// Allow tests, where testingOverrides is set, to see test providers in locks\n\t\tfor provider, factory := range m.testingOverrides.Providers {\n\t\t\tfactories[provider] = factory","sourceCodeStart":402,"sourceCodeEnd":438,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/command/meta_providers.go#L402-L438","documentation":"This error is raised in Meta.providerFactoriesFromLocks when verifying a cached provider plugin against the dependency lock file (.terraform.lock.hcl). For each provider locked entry, Terraform computes the hashes of the package in the local plugin cache (CachedProvider.MatchesAnyHash) and compares them against lock.PreferredHashes(). If none match, the cached package is considered corrupt, tampered, or stale and is rejected to prevent executing an untrusted provider binary.","triggerScenarios":"Triggered during any command that initializes providers (init, plan, apply, etc.) when lock.PreferredHashes() is non-empty AND cached.MatchesAnyHash(allowedHashes) returns matched=false. The provider entry in .terraform.lock.hcl has hashes that the package in the cache directory (~/.terraform.d/plugin-cache or .terraform/providers) cannot reproduce.","commonSituations":"The cache directory was populated by a different Terraform version that recorded different hash algorithms (e.g. zh: vs h1:); the lock file was hand-edited or regenerated by a teammate on another platform; a CI cache restore mixed packages from incompatible runs; the provider zip was partially downloaded/corrupted; manual tampering with cached plugin files.","solutions":["Run 'terraform providers lock -platform=<your_platform>' to regenerate correct hashes for the cached package.","Remove the offending provider from the cache directory and re-run 'terraform init' to re-download a clean package.","Delete .terraform.lock.hcl and .terraform/providers, then run 'terraform init' fresh to rebuild both.","Verify the CI cache key includes the Terraform version so mismatched hash algorithms aren't restored across upgrades.","Ensure all team members use a Terraform version that supports the same hash schemes (>= 0.13 for zh: hashes)."],"exampleFix":"// before: lock file pins h1: hashes but cache has zh: only provider\n// fix: regenerate the lock entry for your platform\n$ terraform providers lock -platform=linux_amd64 -platform=darwin_arm64\n// then re-init\n$ terraform init","handlingStrategy":"validation","validationCode":"// Before running Terraform, verify cached provider hashes match the lock file\npackage main\n\nimport (\n\t\"os\"\n\t\"path/filepath\"\n)\n\nfunc verifyProviderCacheLockConsistent(cacheDir, lockFile string) error {\n\tinfo, err := os.Stat(lockFile)\n\tif err != nil { return nil /* no lock yet, nothing to validate */ }\n\tif info.IsDir() { return nil }\n\t// Ensure the cache dir referenced by the lock entries exists and is non-empty\n\tentries, err := os.ReadDir(cacheDir)\n\tif err != nil { return err }\n\tif len(entries) == 0 {\n\t\treturn fmt.Errorf(\"provider cache %s empty; run 'terraform init' first\", cacheDir)\n\t}\n\t// Best signal: run the real check via CLI before your pipeline step\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run 'terraform init -upgrade' after upgrading Terraform CLI so lock hashes are recomputed with the supported algorithm.","Pin CI cache keys to the Terraform version + lock file hash so stale provider packages are not restored.","Commit .terraform.lock.hcl and require it in CI rather than regenerating per-runner.","Never hand-edit .terraform.lock.hcl; always use 'terraform providers lock'."],"tags":["provider-plugin","checksum","lock-file","cache","security"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}