hashicorp/terraform · error

error decoding signing key: %s

Error message

error decoding signing key: %s

What it means

From signatureAuthentication.AuthenticatePackage partner branch. The signing key returned by the registry is ASCII-armored; openpgpArmor.Decode(signingKey.ASCIIArmor) failed to parse that armor block. The '%s' is the armor decoder's error. This is a registry-data problem: the key material the registry advertised is not valid OpenPGP armor.

Source

Thrown at internal/getproviders/package_authentication.go:439

	if err != nil {
		return nil, fmt.Errorf("error creating HashiCorp keyring: %s", err)
	}
	_, err = s.checkDetachedSignature(hashicorpKeyring, bytes.NewReader(s.Document), bytes.NewReader(s.Signature), nil)
	if err == nil {
		return &PackageAuthenticationResult{result: officialProvider, KeyID: keyID}, nil
	}

	// If the signing key has a trust signature, attempt to verify it with the
	// HashiCorp partners public key.
	if signingKey.TrustSignature != "" {
		hashicorpPartnersKeyring, err := openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPartnersKey))
		if err != nil {
			return nil, fmt.Errorf("error creating HashiCorp Partners keyring: %s", err)
		}

		authorKey, err := openpgpArmor.Decode(strings.NewReader(signingKey.ASCIIArmor))
		if err != nil {
			return nil, fmt.Errorf("error decoding signing key: %s", err)
		}

		trustSignature, err := openpgpArmor.Decode(strings.NewReader(signingKey.TrustSignature))
		if err != nil {
			return nil, fmt.Errorf("error decoding trust signature: %s", err)
		}

		_, err = s.checkDetachedSignature(hashicorpPartnersKeyring, authorKey.Body, trustSignature.Body, nil)
		if err != nil {
			return nil, fmt.Errorf("error verifying trust signature: %s", err)
		}

		return &PackageAuthenticationResult{result: partnerProvider, KeyID: keyID}, nil
	}

	// We have a valid signature, but it's not from the HashiCorp key, and it
	// also isn't a trusted partner. This is a community provider.
	return &PackageAuthenticationResult{result: communityProvider, KeyID: keyID}, nil

View on GitHub (pinned to c9def3e214)

Solutions

1. Report the malformed signing key to the registry/mirror operator; the ascii_armor field must be a complete ASCII-armored OpenPGP public key block.
2. Switch to the official registry or a corrected mirror until the key data is fixed.
3. If you publish the provider, re-upload a valid armored public key and a valid trust signature.
4. Clear any local/intermediate cache that may have truncated the key JSON before retrying.

Example fix

// before: registry returns empty armor
{"ascii_armor":"","trust_signature":"-----BEGIN PGP SIGNATURE-----..."}
// after: registry returns a full armored public key
{"ascii_armor":"-----BEGIN PGP PUBLIC KEY BLOCK-----\n...\n-----END PGP PUBLIC KEY BLOCK-----","trust_signature":"-----BEGIN PGP SIGNATURE-----\n...\n-----END PGP SIGNATURE-----"}

// Validate registry-supplied signing keys before authentication.
func validArmorBlock(armor string) bool {
    return strings.Contains(armor, "-----BEGIN PGP") && strings.Contains(armor, "-----END PGP")
}
for _, k := range keys {
    if k.TrustSignature != "" && !validArmorBlock(k.ASCIIArmor) {
        return fmt.Errorf("registry signing key has trust_signature but invalid ascii_armor")
    }
}

When it happens

Trigger: Reached only when signingKey.TrustSignature is non-empty (line 431) and openpgpArmor.Decode on signingKey.ASCIIArmor at line 437 errors. The registry-supplied SigningKey.ASCIIArmor is missing/empty/malformed (no 'BEGIN PGP' header, wrong block type, or corrupted body).

Common situations: The registry returns a signing_key JSON object whose ascii_armor field is empty or contains a public key in non-armored (binary) form. A mirror or proxy stripped/mangled the key JSON. A registry bug returning the trust_signature field for a key whose armor was not populated.

Related errors

• error decoding trust signature: %s
• error creating HashiCorp Partners keyring: %s
• error verifying trust signature: %s
• error checking signature: %s
• authentication signature from unknown issuer

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/f623e3903c65d17c. Report an issue: GitHub.