{"record":{"id":"f623e3903c65d17c","repo":"hashicorp/terraform","slug":"error-decoding-signing-key-s","errorCode":null,"errorMessage":"error decoding signing key: %s","messagePattern":"error decoding signing key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/package_authentication.go","lineNumber":439,"sourceCode":"\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error creating HashiCorp keyring: %s\", err)\n\t}\n\t_, err = s.checkDetachedSignature(hashicorpKeyring, bytes.NewReader(s.Document), bytes.NewReader(s.Signature), nil)\n\tif err == nil {\n\t\treturn &PackageAuthenticationResult{result: officialProvider, KeyID: keyID}, nil\n\t}\n\n\t// If the signing key has a trust signature, attempt to verify it with the\n\t// HashiCorp partners public key.\n\tif signingKey.TrustSignature != \"\" {\n\t\thashicorpPartnersKeyring, err := openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPartnersKey))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error creating HashiCorp Partners keyring: %s\", err)\n\t\t}\n\n\t\tauthorKey, err := openpgpArmor.Decode(strings.NewReader(signingKey.ASCIIArmor))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error decoding signing key: %s\", err)\n\t\t}\n\n\t\ttrustSignature, err := openpgpArmor.Decode(strings.NewReader(signingKey.TrustSignature))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error decoding trust signature: %s\", err)\n\t\t}\n\n\t\t_, err = s.checkDetachedSignature(hashicorpPartnersKeyring, authorKey.Body, trustSignature.Body, nil)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error verifying trust signature: %s\", err)\n\t\t}\n\n\t\treturn &PackageAuthenticationResult{result: partnerProvider, KeyID: keyID}, nil\n\t}\n\n\t// We have a valid signature, but it's not from the HashiCorp key, and it\n\t// also isn't a trusted partner. This is a community provider.\n\treturn &PackageAuthenticationResult{result: communityProvider, KeyID: keyID}, nil","sourceCodeStart":421,"sourceCodeEnd":457,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/package_authentication.go#L421-L457","documentation":"From signatureAuthentication.AuthenticatePackage partner branch. The signing key returned by the registry is ASCII-armored; openpgpArmor.Decode(signingKey.ASCIIArmor) failed to parse that armor block. The '%s' is the armor decoder's error. This is a registry-data problem: the key material the registry advertised is not valid OpenPGP armor.","triggerScenarios":"Reached only when signingKey.TrustSignature is non-empty (line 431) and openpgpArmor.Decode on signingKey.ASCIIArmor at line 437 errors. The registry-supplied SigningKey.ASCIIArmor is missing/empty/malformed (no 'BEGIN PGP' header, wrong block type, or corrupted body).","commonSituations":"The registry returns a signing_key JSON object whose ascii_armor field is empty or contains a public key in non-armored (binary) form. A mirror or proxy stripped/mangled the key JSON. A registry bug returning the trust_signature field for a key whose armor was not populated.","solutions":["Report the malformed signing key to the registry/mirror operator; the ascii_armor field must be a complete ASCII-armored OpenPGP public key block.","Switch to the official registry or a corrected mirror until the key data is fixed.","If you publish the provider, re-upload a valid armored public key and a valid trust signature.","Clear any local/intermediate cache that may have truncated the key JSON before retrying."],"exampleFix":"// before: registry returns empty armor\n{\"ascii_armor\":\"\",\"trust_signature\":\"-----BEGIN PGP SIGNATURE-----...\"}\n// after: registry returns a full armored public key\n{\"ascii_armor\":\"-----BEGIN PGP PUBLIC KEY BLOCK-----\\n...\\n-----END PGP PUBLIC KEY BLOCK-----\",\"trust_signature\":\"-----BEGIN PGP SIGNATURE-----\\n...\\n-----END PGP SIGNATURE-----\"}","handlingStrategy":"validation","validationCode":"// Validate registry-supplied signing keys before authentication.\nfunc validArmorBlock(armor string) bool {\n    return strings.Contains(armor, \"-----BEGIN PGP\") && strings.Contains(armor, \"-----END PGP\")\n}\nfor _, k := range keys {\n    if k.TrustSignature != \"\" && !validArmorBlock(k.ASCIIArmor) {\n        return fmt.Errorf(\"registry signing key has trust_signature but invalid ascii_armor\")\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Mirror the registry's signing_keys JSON verbatim.","Validate ascii_armor is a full PGP block before persisting.","Report partner keys missing armor to the registry operator."],"tags":["crypto","openpgp","signing-key","registry","armor","partner"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}