{"record":{"id":"de63ce8e68235eff","repo":"hashicorp/terraform","slug":"registry-response-includes-invalid-shasums-url-mu","errorCode":null,"errorMessage":"registry response includes invalid SHASUMS URL: must use http or https scheme","messagePattern":"registry response includes invalid SHASUMS URL: must use http or https scheme","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/registry_client.go","lineNumber":327,"sourceCode":"\t\t)\n\t}\n\n\tvar checksum [sha256.Size]byte\n\t_, err = hex.Decode(checksum[:], []byte(body.SHA256Sum))\n\tif err != nil {\n\t\treturn PackageMeta{}, c.errQueryFailed(\n\t\t\tprovider,\n\t\t\tfmt.Errorf(\"registry response includes invalid SHA256 hash %q: %s\", body.SHA256Sum, err),\n\t\t)\n\t}\n\n\tshasumsURL, err := url.Parse(body.SHA256SumsURL)\n\tif err != nil {\n\t\treturn PackageMeta{}, fmt.Errorf(\"registry response includes invalid SHASUMS URL: %s\", err)\n\t}\n\tshasumsURL = resp.Request.URL.ResolveReference(shasumsURL)\n\tif shasumsURL.Scheme != \"http\" && shasumsURL.Scheme != \"https\" {\n\t\treturn PackageMeta{}, fmt.Errorf(\"registry response includes invalid SHASUMS URL: must use http or https scheme\")\n\t}\n\tdocument, err := c.getFile(shasumsURL)\n\tif err != nil {\n\t\treturn PackageMeta{}, c.errQueryFailed(\n\t\t\tprovider,\n\t\t\tfmt.Errorf(\"failed to retrieve authentication checksums for provider: %s\", err),\n\t\t)\n\t}\n\tsignatureURL, err := url.Parse(body.SHA256SumsSignatureURL)\n\tif err != nil {\n\t\treturn PackageMeta{}, fmt.Errorf(\"registry response includes invalid SHASUMS signature URL: %s\", err)\n\t}\n\tsignatureURL = resp.Request.URL.ResolveReference(signatureURL)\n\tif signatureURL.Scheme != \"http\" && signatureURL.Scheme != \"https\" {\n\t\treturn PackageMeta{}, fmt.Errorf(\"registry response includes invalid SHASUMS signature URL: must use http or https scheme\")\n\t}\n\tsignature, err := c.getFile(signatureURL)\n\tif err != nil {","sourceCodeStart":309,"sourceCodeEnd":345,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/registry_client.go#L309-L345","documentation":"PackageMeta parsed shasums_url but its scheme is not http or https. Terraform refuses to fetch checksum documents over other schemes, so the install aborts with a plain fmt.Errorf. This is a security guard parallel to the download_url scheme check.","triggerScenarios":"Registry response's shasums_url resolves to a non-http(s) scheme: file://, ftp://, smb://, etc.","commonSituations":"Private registry serving SHASUMS from internal storage emitting a file:// or smb:// URL; dev registry; misconfigured reverse proxy stripping the scheme.","solutions":["Serve the SHASUMS document over https and reference it with an https:// URL.","Ensure relative shasums_url resolves against an http(s) request URL.","Fix any proxy/CDN rewriting the scheme."],"exampleFix":"// before\n{\"shasums_url\":\"file:///srv/sums/SHA256SUMS\"}\n// after\n{\"shasums_url\":\"https://registry.example/s/SHA256SUMS\"}","handlingStrategy":"validation","validationCode":"func validShasumsScheme(u string) error {\n    parsed, err := url.Parse(u)\n    if err != nil {\n        return err\n    }\n    if parsed.Scheme != \"http\" && parsed.Scheme != \"https\" {\n        return fmt.Errorf(\"shasums_url scheme %q not allowed\", parsed.Scheme)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"meta, err := client.PackageMeta(ctx, provider, ver, plat)\nif err != nil && strings.Contains(err.Error(), \"SHASUMS URL: must use http or https scheme\") {\n    // registry emitted a non-http shasums URL; fix registry config\n}","preventionTips":["Serve SHASUMS documents over https only.","Ensure relative shasums_url resolves against an https request URL.","Audit proxies that may rewrite the scheme."],"tags":["terraform","registry","shasums","security","scheme"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}