hashicorp/terraform · error

error checking signature: %s

Error message

error checking signature: %s

What it means

From signatureAuthentication.findSigningKey. For each candidate key it calls checkDetachedSignature over the document+signature; if the result is neither nil (success) nor ErrUnknownIssuer (which means 'try the next key'), it is treated as a terminal error and returned here. So this covers structural signature problems that are not 'wrong key' - e.g. malformed signature packet, unsupported algorithm, or hash mismatch for the candidate key.

Source

Thrown at internal/getproviders/package_authentication.go:549

// the future.
func (s signatureAuthentication) findSigningKey() (*SigningKey, string, error) {
	for _, key := range s.Keys {
		keyring, err := openpgp.ReadArmoredKeyRing(strings.NewReader(key.ASCIIArmor))
		if err != nil {
			return nil, "", fmt.Errorf("error decoding signing key: %s", err)
		}

		entity, err := s.checkDetachedSignature(keyring, bytes.NewReader(s.Document), bytes.NewReader(s.Signature), nil)

		// If the signature issuer does not match the key, keep trying the
		// rest of the provided keys.
		if err == openpgpErrors.ErrUnknownIssuer {
			continue
		}

		// Any other signature error is terminal.
		if err != nil {
			return nil, "", fmt.Errorf("error checking signature: %s", err)
		}

		keyID := "n/a"
		if entity.PrimaryKey != nil {
			keyID = entity.PrimaryKey.KeyIdString()
		}

		log.Printf("[DEBUG] Provider signed by %s", entityString(entity))
		return &key, keyID, nil
	}

	// If none of the provided keys issued the signature, this package is
	// unsigned. This is currently a terminal authentication error.
	return nil, "", fmt.Errorf("authentication signature from unknown issuer")
}

// entityString extracts the key ID and identity name(s) from an openpgp.Entity
// for logging.

View on GitHub (pinned to c9def3e214)

Solutions

  1. Re-fetch the signature and the signed document from the authoritative registry; cache corruption is the most common cause.
  2. Report the provider version if the signature is consistently malformed upstream.
  3. If you operate a mirror, ensure the .sig and SHA256SUMS files come from the same release artifact, byte-for-byte.
  4. Confirm the go-crypto dependency supports the key/signature algorithm in use (avoid exotic or legacy algorithms when publishing).

Example fix

// before: mirror served a truncated .sig
Error: error checking signature: unexpected EOF
// after: re-mirror the full signed artifact set
$ rm mirror-cache/<provider>/<version>/* && sync-mirror && terraform init
Defensive patterns

Strategy: try-catch

Try / catch

// Distinguish structural signature errors from 'unknown issuer' (917).
_, err := auth.AuthenticatePackage(loc)
if err != nil && strings.Contains(err.Error(), "error checking signature") {
    // likely corrupt .sig or document; re-fetch the signed artifact set.
}

Prevention

When it happens

Trigger: entity, err := s.checkDetachedSignature(...) at line 539 returns err that is not openpgpErrors.ErrUnknownIssuer and not nil; line 548 wraps it. Possible causes: broken ASCII-armored signature payload, unsupported public-key algorithm, hash algorithm mismatch, truncated signature, or a signature that does not structurally match the document for this key.

Common situations: The registry's signature artifact (the .sig file) is corrupted or truncated. A proxy altered the signature or the signed document. The signing key uses an algorithm the go-crypto build does not support. A version skew between the sums document and the signature (re-signed after the sums changed).

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/31f044c394a75aec. Report an issue: GitHub.