hashicorp/terraform · error

cannot check archive hash for non-archive location %s

Error message

cannot check archive hash for non-archive location %s

What it means

Programmer-error from archiveHashAuthentication.AuthenticatePackage. NewArchiveChecksumAuthentication verifies the SHA256 of the original .zip archive, so it requires a PackageLocalArchive location. If the supplied localLocation is anything else (typically PackageLocalDir, an unpacked directory) the type assertion at line 302 fails and this error is returned. The doc on NewArchiveChecksumAuthentication states this explicitly.

Source

Thrown at internal/getproviders/package_authentication.go:306

// This authentication is suitable only for PackageHTTPURL and
// PackageLocalArchive source locations, because the unpacked layout
// (represented by PackageLocalDir) does not retain access to the original
// source archive. Therefore this authenticator will return an error if its
// given localLocation is not PackageLocalArchive.
//
// NewPackageHashAuthentication is preferable to use when possible because
// it uses the newer hashing scheme (implemented by function PackageHash) that
// can work with both packed and unpacked provider packages.
func NewArchiveChecksumAuthentication(platform Platform, wantSHA256Sum [sha256.Size]byte) PackageAuthentication {
	return archiveHashAuthentication{platform, wantSHA256Sum}
}

func (a archiveHashAuthentication) AuthenticatePackage(localLocation PackageLocation) (*PackageAuthenticationResult, error) {
	archiveLocation, ok := localLocation.(PackageLocalArchive)
	if !ok {
		// A source should not use this authentication type for non-archive
		// locations.
		return nil, fmt.Errorf("cannot check archive hash for non-archive location %s", localLocation)
	}

	gotHash, err := PackageHashLegacyZipSHA(archiveLocation)
	if err != nil {
		return nil, fmt.Errorf("failed to compute checksum for %s: %s", archiveLocation, err)
	}
	wantHash := HashLegacyZipSHAFromSHA(a.WantSHA256Sum)
	if gotHash != wantHash {
		return nil, fmt.Errorf("archive has incorrect checksum %s (expected %s)", gotHash, wantHash)
	}
	return &PackageAuthenticationResult{result: verifiedChecksum}, nil
}

func (a archiveHashAuthentication) AcceptableHashes() []Hash {
	return []Hash{HashLegacyZipSHAFromSHA(a.WantSHA256Sum)}
}

type matchingChecksumAuthentication struct {

View on GitHub (pinned to c9def3e214)

Solutions

1. Switch to NewPackageHashAuthentication (the 'h1:' scheme), which works on both packed archives and unpacked directories.
2. If you must verify the raw archive, ensure the location passed to AuthenticatePackage is a PackageLocalArchive (i.e. authenticate before unpacking).
3. Reorder your pipeline so archive checksum verification happens on the staged .zip, not on the extracted dir.

Example fix

// before: authenticating an unpacked dir as an archive
auth := getproviders.NewArchiveChecksumAuthentication(platform, wantSHA)
_, err := auth.AuthenticatePackage(unpackedDir) // PackageLocalDir
// after: use the hash authenticator that accepts directories
auth := getproviders.NewPackageHashAuthentication(platform, validHashes)
_, err := auth.AuthenticatePackage(unpackedDir)

// Pick the authenticator based on the concrete location type.
func pickAuth(loc getproviders.PackageLocation, want [sha256.Size]byte, hashes []providerreqs.Hash) getproviders.PackageAuthentication {
    switch loc.(type) {
    case getproviders.PackageLocalArchive:
        return getproviders.NewArchiveChecksumAuthentication(platform, want)
    default:
        return getproviders.NewPackageHashAuthentication(platform, hashes)
    }
}

// Guard the location type before choosing an archive authenticator.
func isArchive(loc getproviders.PackageLocation) bool {
    _, ok := loc.(getproviders.PackageLocalArchive)
    return ok
}

When it happens

Trigger: A source constructs archiveHashAuthentication and hands AuthenticatePackage a PackageLocalDir (unpacked provider) or a PackageHTTPURL (remote, which the framework never passes here). The location is not a PackageLocalArchive, so the cast `localLocation.(PackageLocalArchive)` fails.

Common situations: A custom Source implementation that unpacks the provider before authenticating, then wires up NewArchiveChecksumAuthentication instead of NewPackageHashAuthentication. Misuse when porting an older code path that used to verify archives but now stages directories. Calling AuthenticatePackage on a location after the framework extracted the zip.

Related errors

• default workspace not supported You can create a new workspa
• Attempted to initialize pluggable state with a nil provider
• Attempted to initialize pluggable state with an empty string
• failed to append certs
• the secret name %v is invalid, {validationErrors} This is a

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/580a8393dd238b75. Report an issue: GitHub.