hashicorp/terraform · error

checksum list has no SHA-256 hash for %q

Error message

checksum list has no SHA-256 hash for %q

What it means

From matchingChecksumAuthentication.AuthenticatePackage. It scans the registry-provided SHA256SUMS document line-by-line for a line whose second field equals the target filename. If no line references that filename, checksum stays nil and the error is returned. This means the signed sums file does not cover the package the caller asked about.

Source

Thrown at internal/getproviders/package_authentication.go:361

		Filename:      filename,
		WantSHA256Sum: wantSHA256Sum,
	}
}

func (m matchingChecksumAuthentication) AuthenticatePackage(location PackageLocation) (*PackageAuthenticationResult, error) {
	// Find the checksum in the list with matching filename. The document is
	// in the form "0123456789abcdef filename.zip".
	filename := []byte(m.Filename)
	var checksum []byte
	for _, line := range bytes.Split(m.Document, []byte("\n")) {
		parts := bytes.Fields(line)
		if len(parts) > 1 && bytes.Equal(parts[1], filename) {
			checksum = parts[0]
			break
		}
	}
	if checksum == nil {
		return nil, fmt.Errorf("checksum list has no SHA-256 hash for %q", m.Filename)
	}

	// Decode the ASCII checksum into a byte array for comparison.
	var gotSHA256Sum [sha256.Size]byte
	if _, err := hex.Decode(gotSHA256Sum[:], checksum); err != nil {
		return nil, fmt.Errorf("checksum list has invalid SHA256 hash %q: %s", string(checksum), err)
	}

	// If the checksums don't match, authentication fails.
	if !bytes.Equal(gotSHA256Sum[:], m.WantSHA256Sum[:]) {
		return nil, fmt.Errorf("checksum list has unexpected SHA-256 hash %x (expected %x)", gotSHA256Sum, m.WantSHA256Sum[:])
	}

	// Success! But this doesn't result in any real authentication, only a
	// lack of authentication errors, so we return a nil result.
	return nil, nil
}

View on GitHub (pinned to c9def3e214)

Solutions

1. Verify the requested provider version, OS, and arch map to a filename that actually appears in the registry's SHA256SUMS for that version.
2. Update the provider version constraint to one the registry fully publishes for your platform.
3. If using a mirror, ensure it mirrors the complete SHA256SUMS file, not a partial one.
4. Confirm the filename passed to NewMatchingChecksumAuthentication matches the registry's naming exactly.

Example fix

// before: arch mismatch -> filename not in sums
required_version = "= 5.0.0"  // sums only list _linux_arm64
// after
required_version = ">= 5.1.0"  // version that publishes linux_amd64

// Confirm the filename exists in the sums doc before authenticating.
func sumsHasFilename(doc []byte, filename string) bool {
    for _, line := range bytes.Split(doc, []byte("\n")) {
        p := bytes.Fields(line)
        if len(p) > 1 && bytes.Equal(p[1], []byte(filename)) { return true }
    }
    return false
}

When it happens

Trigger: NewMatchingChecksumAuthentication was constructed with a Document (the SHA256SUMS bytes) and a Filename, but Document contains no line of the form '<hex> <Filename>'. Reached at line 360 when the loop at 353 finds no match.

Common situations: The registry returned a SHA256SUMS for a different provider version than the package being installed. A filename mismatch (e.g. wrong OS/arch suffix like _linux_amd64 vs _linux_arm64, or a missing/extra version token in the zip name). A mirror that stripped or rewrote the sums file. A custom registry that omits the requested platform's entry.

Related errors

• checksum list has invalid SHA256 hash %q: %s
• checksum list has unexpected SHA-256 hash %x (expected %x)
• provider package doesn't match the expected checksum %q
• provider package doesn't match the any of the expected check
• archive has incorrect checksum %s (expected %s)

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/6a633d49206762bf. Report an issue: GitHub.