hashicorp/terraform · error

error decoding trust signature: %s

Error message

error decoding trust signature: %s

What it means

From signatureAuthentication.AuthenticatePackage partner branch. After decoding the author's signing key, it decodes signingKey.TrustSignature with openpgpArmor.Decode; a parse failure yields this error. The trust signature is the detached signature proving the partner key was vouched for by HashiCorp, and the registry must deliver it as a valid ASCII-armored (typically PGP SIGNATURE) block.

Source

Thrown at internal/getproviders/package_authentication.go:444

		return &PackageAuthenticationResult{result: officialProvider, KeyID: keyID}, nil
	}

	// If the signing key has a trust signature, attempt to verify it with the
	// HashiCorp partners public key.
	if signingKey.TrustSignature != "" {
		hashicorpPartnersKeyring, err := openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPartnersKey))
		if err != nil {
			return nil, fmt.Errorf("error creating HashiCorp Partners keyring: %s", err)
		}

		authorKey, err := openpgpArmor.Decode(strings.NewReader(signingKey.ASCIIArmor))
		if err != nil {
			return nil, fmt.Errorf("error decoding signing key: %s", err)
		}

		trustSignature, err := openpgpArmor.Decode(strings.NewReader(signingKey.TrustSignature))
		if err != nil {
			return nil, fmt.Errorf("error decoding trust signature: %s", err)
		}

		_, err = s.checkDetachedSignature(hashicorpPartnersKeyring, authorKey.Body, trustSignature.Body, nil)
		if err != nil {
			return nil, fmt.Errorf("error verifying trust signature: %s", err)
		}

		return &PackageAuthenticationResult{result: partnerProvider, KeyID: keyID}, nil
	}

	// We have a valid signature, but it's not from the HashiCorp key, and it
	// also isn't a trusted partner. This is a community provider.
	return &PackageAuthenticationResult{result: communityProvider, KeyID: keyID}, nil
}

func (s signatureAuthentication) checkDetachedSignature(keyring openpgp.KeyRing, signed, signature io.Reader, config *packet.Config) (*openpgp.Entity, error) {
	entity, err := openpgp.CheckDetachedSignature(keyring, signed, signature, config)
	// FIXME: it's not clear what should be done with provider signing key

View on GitHub (pinned to c9def3e214)

Solutions

1. Report the issue to the registry: trust_signature must be a complete ASCII-armored PGP signature block.
2. Use the official registry or a mirror known to preserve the trust signature verbatim.
3. If you operate the registry/mirror, ensure JSON encoding preserves newlines and the block is served from the same source as the signing key.
4. If publishing a partner provider, regenerate the trust signature and re-submit it as clean ASCII armor.

Example fix

// before: trust signature missing its header
{"trust_signature":"base64-or-binary-blob"}
// after: proper armored detached signature
{"trust_signature":"-----BEGIN PGP SIGNATURE-----\n...\n-----END PGP SIGNATURE-----"}

// Validate the trust signature armor block shape before authenticating.
for _, k := range keys {
    if k.TrustSignature != "" {
        if _, err := openpgpArmor.Decode(strings.NewReader(k.TrustSignature)); err != nil {
            return fmt.Errorf("malformed trust_signature: %w", err)
        }
    }
}

When it happens

Trigger: signingKey.TrustSignature != "" and signing key armor decoded OK, but openpgpArmor.Decode(signingKey.TrustSignature) at line 442 errors. The trust_signature field is empty-but-set, truncated, wrong block type (e.g. a public key block instead of a signature), or otherwise not parseable armor.

Common situations: Registry returns a trust_signature that is malformed, contains a binary signature not armored, was copy-pasted incompletely, or was HTML-escaped by a proxy. A mirror that drops newlines from the JSON field. Mismatch between the declared ascii_armor key and the trust signature block type.

Related errors

• error decoding signing key: %s
• error verifying trust signature: %s
• error creating HashiCorp Partners keyring: %s
• error checking signature: %s
• authentication signature from unknown issuer

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/d3d2d58f96a8c202. Report an issue: GitHub.