hashicorp/terraform · error

error creating HashiCorp keyring: %s

Error message

error creating HashiCorp keyring: %s

What it means

From signatureAuthentication.AuthenticatePackage. It builds the HashiCorp official keyring from the compile-time constant HashicorpPublicKey (defined in public_keys.go) via openpgp.ReadArmoredKeyRing. Because the key is a hardcoded constant bundled with the binary, this error almost always indicates a build/linkage problem rather than runtime data.

Source

Thrown at internal/getproviders/package_authentication.go:422

		Document:  document,
		Signature: signature,
		Keys:      keys,
	}
}

func (s signatureAuthentication) AuthenticatePackage(location PackageLocation) (*PackageAuthenticationResult, error) {
	// Find the key that signed the checksum file. This can fail if there is no
	// valid signature for any of the provided keys.
	signingKey, keyID, err := s.findSigningKey()
	if err != nil {
		return nil, err
	}

	// Verify the signature using the HashiCorp public key. If this succeeds,
	// this is an official provider.
	hashicorpKeyring, err := openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPublicKey))
	if err != nil {
		return nil, fmt.Errorf("error creating HashiCorp keyring: %s", err)
	}
	_, err = s.checkDetachedSignature(hashicorpKeyring, bytes.NewReader(s.Document), bytes.NewReader(s.Signature), nil)
	if err == nil {
		return &PackageAuthenticationResult{result: officialProvider, KeyID: keyID}, nil
	}

	// If the signing key has a trust signature, attempt to verify it with the
	// HashiCorp partners public key.
	if signingKey.TrustSignature != "" {
		hashicorpPartnersKeyring, err := openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPartnersKey))
		if err != nil {
			return nil, fmt.Errorf("error creating HashiCorp Partners keyring: %s", err)
		}

		authorKey, err := openpgpArmor.Decode(strings.NewReader(signingKey.ASCIIArmor))
		if err != nil {
			return nil, fmt.Errorf("error decoding signing key: %s", err)
		}

View on GitHub (pinned to c9def3e214)

Solutions

1. If running a stock binary, this is a bug - report it upstream with the full error string.
2. If running a fork/custom build, restore the unmodified HashicorpPublicKey constant from the upstream source and rebuild.
3. Pin or align the go-crypto dependency version to the one the release was built against.
4. As a last resort for a custom build, replace HashicorpPublicKey with a known-good armored public key you control and republish providers under it.

Example fix

// before: custom build with truncated key
const HashicorpPublicKey = `-----BEGIN PGP...` // truncated
// after: restore full armored key from upstream public_keys.go
const HashicorpPublicKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
...full block...
-----END PGP PUBLIC KEY BLOCK-----`

// Not a runtime-input error; validate at build/test time that the constant parses.
func TestHashicorpPublicKeyParses(t *testing.T) {
    _, err := openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPublicKey))
    if err != nil { t.Fatalf("bundled HashicorpPublicKey invalid: %v", err) }
}

// Surface the error; users cannot fix it via config. Recommend a stock binary.
_, err := auth.AuthenticatePackage(loc)
if err != nil && strings.Contains(err.Error(), "creating HashiCorp keyring") {
    return fmt.Errorf("bundled HashiCorp signing key is invalid in this build; use an official release: %w", err)
}

When it happens

Trigger: openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPublicKey)) at line 420 returns an error. Reachable on every signed-provider authentication attempt, immediately after a signing key is located.

Common situations: A custom/forked build where HashicorpPublicKey was edited or truncated and no longer parses as valid ASCII-armored OpenPGP. A dependency downgrade/upgrade of github.com/ProtonMail/go-crypto that changed the armored-key parser strictness. Memory corruption or a build flag stripping the constant. Not expected from a stock release binary.

Related errors

• error creating HashiCorp Partners keyring: %s
• error verifying trust signature: %s
• error decoding signing key: %s
• error decoding trust signature: %s
• error checking signature: %s

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/d9cbc59d258d17ab. Report an issue: GitHub.