{"record":{"id":"edb7f1dc652f68e8","repo":"hashicorp/terraform","slug":"archive-has-incorrect-checksum-s-expected-s","errorCode":null,"errorMessage":"archive has incorrect checksum %s (expected %s)","messagePattern":"archive has incorrect checksum (.+?) \\(expected (.+?)\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/package_authentication.go","lineNumber":315,"sourceCode":"func NewArchiveChecksumAuthentication(platform Platform, wantSHA256Sum [sha256.Size]byte) PackageAuthentication {\n\treturn archiveHashAuthentication{platform, wantSHA256Sum}\n}\n\nfunc (a archiveHashAuthentication) AuthenticatePackage(localLocation PackageLocation) (*PackageAuthenticationResult, error) {\n\tarchiveLocation, ok := localLocation.(PackageLocalArchive)\n\tif !ok {\n\t\t// A source should not use this authentication type for non-archive\n\t\t// locations.\n\t\treturn nil, fmt.Errorf(\"cannot check archive hash for non-archive location %s\", localLocation)\n\t}\n\n\tgotHash, err := PackageHashLegacyZipSHA(archiveLocation)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to compute checksum for %s: %s\", archiveLocation, err)\n\t}\n\twantHash := HashLegacyZipSHAFromSHA(a.WantSHA256Sum)\n\tif gotHash != wantHash {\n\t\treturn nil, fmt.Errorf(\"archive has incorrect checksum %s (expected %s)\", gotHash, wantHash)\n\t}\n\treturn &PackageAuthenticationResult{result: verifiedChecksum}, nil\n}\n\nfunc (a archiveHashAuthentication) AcceptableHashes() []Hash {\n\treturn []Hash{HashLegacyZipSHAFromSHA(a.WantSHA256Sum)}\n}\n\ntype matchingChecksumAuthentication struct {\n\tDocument      []byte\n\tFilename      string\n\tWantSHA256Sum [sha256.Size]byte\n}\n\n// NewMatchingChecksumAuthentication returns a PackageAuthentication\n// implementation that scans a registry-provided SHA256SUMS document for a\n// specified filename, and compares the SHA256 hash against the expected hash.\n// This is necessary to ensure that the signed SHA256SUMS document matches the","sourceCodeStart":297,"sourceCodeEnd":333,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/package_authentication.go#L297-L333","documentation":"Integrity failure from archiveHashAuthentication.AuthenticatePackage. PackageHashLegacyZipSHA succeeded but the computed 'zh:' hash differs from HashLegacyZipSHAFromSHA(a.WantSHA256Sum). The downloaded .zip's SHA256 does not match the checksum declared by the registry/mirror for this provider version.","triggerScenarios":"gotHash != wantHash at line 314, error at 315. The archive is readable but its bytes do not hash to the expected SHA256 sum that was passed into NewArchiveChecksumAuthentication.","commonSituations":"Mirror serves a different/older .zip than the one the checksum was computed from. A truncated or re-zipped download (re-compression changes the archive bytes even if contents match, breaking the legacy zip hash). CDN serving a stale cached artifact. Tampering/MITM altering the archive in transit.","solutions":["Re-download from the authoritative registry or a corrected mirror after purging the cache.","If you operate the mirror, ensure the served .zip is byte-identical to the upstream release and republish its SHA256.","Avoid repackaging zips (which invalidates 'zh:' hashes); prefer the 'h1:' content hash if you must repack.","Pin the provider version to a release whose published checksum matches the artifact you can actually fetch."],"exampleFix":"// before: mirror served a repackaged zip\nError: archive has incorrect checksum zh:aaa... (expected zh:bbb...)\n// after: purge mirror cache and serve upstream zip\n$ rm -rf ~/.cache/terraform/plugin-cache/<provider> && terraform init","handlingStrategy":"validation","validationCode":"// Compute the zip hash and compare to expected before relying on it.\ngot, err := getproviders.PackageHashLegacyZipSHA(archiveLoc)\nif err != nil { return err }\nwant := getproviders.HashLegacyZipSHAFromSHA(shaSum)\nif got != want { return fmt.Errorf(\"zip hash mismatch: got %s want %s\", got, want) }","typeGuard":null,"tryCatchPattern":"_, err := auth.AuthenticatePackage(loc)\nif err != nil && strings.Contains(err.Error(), \"archive has incorrect checksum\") {\n    // artifact drift: re-fetch from authoritative source, never weaken the check.\n}\nreturn err","preventionTips":["Never repack provider zips; serve upstream bytes verbatim.","Validate mirror checksums against the registry periodically.","Pin to versions whose published zip hash you can independently verify."],"tags":["integrity","checksum","archive","mirror","zip"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}