hashicorp/packer · error

download failed: HTTP

Error message

download failed: HTTP %d for %s

What it means

The HTTP request for the SHA256SUMS file succeeded at the transport level, but the server responded with a status other than 200 OK. The code deliberately rejects any non-200 status instead of reading the body, reporting the numeric status and URL so the developer can see whether the resource is missing, forbidden, or the server is erroring.

Solutions

1. Check the HTTP status in the message: 404 usually means the checksum file is not yet published for that version — wait and retry, or pin an older stable Packer version
2. Verify releases.hashicorp.com status (curl -I <url from message>) and check HashiCorp service status for outages
3. If behind a corporate proxy/firewall, confirm releases.hashicorp.com is allowlisted
4. If using a custom/mirror base URL, confirm it mirrors the full releases layout including packer_<v>_SHA256SUMS
5. The download flow already retries 3 times; persistent 404s on a brand-new release usually resolve once CDN propagation completes

Example fix

// before: racing a just-released version whose SHA256SUMS is not yet on the CDN
// after: pin a known-good Packer version until artifacts are fully published
// (wait/retry, or use a previous stable release in your datasource config)
// $ curl -I https://releases.hashicorp.com/packer/1.13.0/packer_1.13.0_SHA256SUMS
// HTTP/2 404  -> retry later or pin 1.12.2

// probe the exact SHA256SUMS URL and inspect the status before proceeding
shaSumsURL := fmt.Sprintf("%s/packer/%s/packer_%s_SHA256SUMS", base, v, v)
resp, err := client.Head(shaSumsURL)
if err != nil {
    return err
}
_ = resp.Body.Close()
if resp.StatusCode == http.StatusNotFound {
    return fmt.Errorf("SHA256SUMS for %s not yet published; pin an older stable version or retry later", v)
}

// distinguish HTTP-status failures from other download errors so you can react to 404 vs 5xx
var statusErr interface{ HTTPStatus() int }
// or, matching this package's message format:
func parseHTTPStatus(err error) (int, bool) {
    m := regexp.MustCompile(`HTTP (\d{3})`).FindStringSubmatch(err.Error())
    if m == nil {
        return 0, false
    }
    code, _ := strconv.Atoi(m[1])
    return code, true
}

_, err := downloadChecksumFile(ctx, client, shaSumsURL)
if err != nil {
    if code, ok := parseHTTPStatus(err); ok {
        switch {
        case code == http.StatusNotFound:
            return fmt.Errorf("checksums not published yet for this version; retry or pin older version")
        case code >= 500:
            return retryErr{err} // transient, safe to retry
        }
        return err
    }
    return err
}

When it happens

Trigger: client.Do returns a response with resp.StatusCode != http.StatusOK for <base>/packer/<v>/packer_<v>_SHA256SUMS — e.g. 404 when the resolved Packer version has no published SHA256SUMS file, 403 from a proxy/CDN block, 5xx from releases.hashicorp.com, or a captive portal returning 302/403 HTML.

Common situations: Newly released Packer version whose checksum files are not yet propagated on the CDN (race between index.json update and artifact publication); vendor/proxy blocking; HashiCorp releases service outage; a mirror or overridden base URL that lacks the SHA256SUMS layout.

Related errors

• create GitHub OIDC request
• empty response body for
• failed reading response body for
• failed to build request for
• failed to download

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/0d0e8abdf6e181b6. Report an issue: GitHub.

Appendix: source

Thrown at provisioner/hcp-sbom/packer_release_fetch.go:158

	return tmpPath, nil
}

// downloadChecksumFile fetches the SHA256SUMS text file at url.
func downloadChecksumFile(ctx context.Context, client *http.Client, url string) (string, error) {
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
	if err != nil {
		return "", fmt.Errorf("failed to build request for %s: %w", url, err)
	}

	resp, err := client.Do(req)
	if err != nil {
		return "", fmt.Errorf("failed to download %s: %w", url, err)
	}
	defer func() { _ = resp.Body.Close() }()

	if resp.StatusCode != http.StatusOK {
		return "", fmt.Errorf("download failed: HTTP %d for %s", resp.StatusCode, url)
	}

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		return "", fmt.Errorf("failed reading response body for %s: %w", url, err)
	}
	if len(strings.TrimSpace(string(body))) == 0 {
		return "", fmt.Errorf("empty response body for %s", url)
	}

	return string(body), nil
}

func isValidSHA256Hex(s string) bool {
	if len(s) != 64 {
		return false
	}
	_, err := hex.DecodeString(s)

View on GitHub (pinned to eb36e3c3e4)