hashicorp/terraform · error

error creating HashiCorp Partners keyring: %s

Error message

error creating HashiCorp Partners keyring: %s

What it means

From signatureAuthentication.AuthenticatePackage, in the partner-trust branch. It builds a keyring from the compile-time constant HashicorpPartnersKey (public_keys.go) to verify the trust signature on a partner provider's signing key. As with 910, the key is a hardcoded constant, so a failure here is essentially a build/linkage defect.

Source

Thrown at internal/getproviders/package_authentication.go:434

	}

	// Verify the signature using the HashiCorp public key. If this succeeds,
	// this is an official provider.
	hashicorpKeyring, err := openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPublicKey))
	if err != nil {
		return nil, fmt.Errorf("error creating HashiCorp keyring: %s", err)
	}
	_, err = s.checkDetachedSignature(hashicorpKeyring, bytes.NewReader(s.Document), bytes.NewReader(s.Signature), nil)
	if err == nil {
		return &PackageAuthenticationResult{result: officialProvider, KeyID: keyID}, nil
	}

	// If the signing key has a trust signature, attempt to verify it with the
	// HashiCorp partners public key.
	if signingKey.TrustSignature != "" {
		hashicorpPartnersKeyring, err := openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPartnersKey))
		if err != nil {
			return nil, fmt.Errorf("error creating HashiCorp Partners keyring: %s", err)
		}

		authorKey, err := openpgpArmor.Decode(strings.NewReader(signingKey.ASCIIArmor))
		if err != nil {
			return nil, fmt.Errorf("error decoding signing key: %s", err)
		}

		trustSignature, err := openpgpArmor.Decode(strings.NewReader(signingKey.TrustSignature))
		if err != nil {
			return nil, fmt.Errorf("error decoding trust signature: %s", err)
		}

		_, err = s.checkDetachedSignature(hashicorpPartnersKeyring, authorKey.Body, trustSignature.Body, nil)
		if err != nil {
			return nil, fmt.Errorf("error verifying trust signature: %s", err)
		}

		return &PackageAuthenticationResult{result: partnerProvider, KeyID: keyID}, nil

View on GitHub (pinned to c9def3e214)

Solutions

  1. Restore the unmodified HashicorpPartnersKey constant from upstream and rebuild.
  2. Align the go-crypto dependency version with the upstream release.
  3. If using a stock binary, report upstream - the bundled partner key should always parse.
  4. If you intentionally run a custom key set, also replace HashicorpPartnersKey with a valid armored key you publish.

Example fix

// before: placeholder partner key in a fork
const HashicorpPartnersKey = ``
// after: real armored partner key
const HashicorpPartnersKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
...full block...
-----END PGP PUBLIC KEY BLOCK-----`
Defensive patterns

Strategy: try-catch

Validate before calling

// Build-time guard for the partner key constant.
func TestHashicorpPartnersKeyParses(t *testing.T) {
    _, err := openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPartnersKey))
    if err != nil { t.Fatalf("bundled HashicorpPartnersKey invalid: %v", err) }
}

Try / catch

// Partner keyring parse failure is a build defect; do not retry on data.
_, err := auth.AuthenticatePackage(loc)
if err != nil && strings.Contains(err.Error(), "HashiCorp Partners keyring") {
    return fmt.Errorf("bundled HashiCorp Partners key invalid in this build; use an official release: %w", err)
}

Prevention

When it happens

Trigger: signingKey.TrustSignature != "" (line 431) and openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPartnersKey)) at line 432 returns an error. Only reached when authenticating a provider whose registry key carries a trust signature (i.e. a HashiCorp partner).

Common situations: A forked/custom build with an edited or truncated HashicorpPartnersKey constant. An incompatible go-crypto version that rejects the armored partner key. A build that embedded a placeholder instead of the real key. Not expected from stock release binaries.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/b0cfb0f3980d009c. Report an issue: GitHub.