hashicorp/terraform · error

error verifying trust signature: %s

Error message

error verifying trust signature: %s

What it means

From signatureAuthentication.AuthenticatePackage partner branch. Both the author key and trust signature armor decoded, but checkDetachedSignature verifying the trust signature against the HashiCorpPartnersKeyring failed. This means the trust signature does not actually vouch for the partner key using the HashiCorp Partners key (e.g. wrong signer, tampered signature, or hash mismatch).

Source

Thrown at internal/getproviders/package_authentication.go:449

	if signingKey.TrustSignature != "" {
		hashicorpPartnersKeyring, err := openpgp.ReadArmoredKeyRing(strings.NewReader(HashicorpPartnersKey))
		if err != nil {
			return nil, fmt.Errorf("error creating HashiCorp Partners keyring: %s", err)
		}

		authorKey, err := openpgpArmor.Decode(strings.NewReader(signingKey.ASCIIArmor))
		if err != nil {
			return nil, fmt.Errorf("error decoding signing key: %s", err)
		}

		trustSignature, err := openpgpArmor.Decode(strings.NewReader(signingKey.TrustSignature))
		if err != nil {
			return nil, fmt.Errorf("error decoding trust signature: %s", err)
		}

		_, err = s.checkDetachedSignature(hashicorpPartnersKeyring, authorKey.Body, trustSignature.Body, nil)
		if err != nil {
			return nil, fmt.Errorf("error verifying trust signature: %s", err)
		}

		return &PackageAuthenticationResult{result: partnerProvider, KeyID: keyID}, nil
	}

	// We have a valid signature, but it's not from the HashiCorp key, and it
	// also isn't a trusted partner. This is a community provider.
	return &PackageAuthenticationResult{result: communityProvider, KeyID: keyID}, nil
}

func (s signatureAuthentication) checkDetachedSignature(keyring openpgp.KeyRing, signed, signature io.Reader, config *packet.Config) (*openpgp.Entity, error) {
	entity, err := openpgp.CheckDetachedSignature(keyring, signed, signature, config)
	// FIXME: it's not clear what should be done with provider signing key
	// expiration. This check reverts the validation behavior to match that of
	// the original x/crypto/openpgp package.
	//
	// We don't force providers to update keys for older releases, so they may
	// have since expired. We are validating the original signature however,

View on GitHub (pinned to c9def3e214)

Solutions

1. Report the publisher/registry mismatch; the trust signature must be a valid detached signature by the HashiCorp Partners key over the served signing key.
2. Pin to a provider version whose signing key and trust signature are consistent (an older known-good release).
3. Switch to the official registry/mirror to rule out mirror-side tampering.
4. If you are the publisher, re-issue the trust signature with the current HashiCorp Partners process and republish.

Example fix

// before: rotated key paired with stale trust signature
{"ascii_armor":"<new key>","trust_signature":"<old sig over previous key>"}
// after: re-sign and publish a matching pair
{"ascii_armor":"<new key>","trust_signature":"<fresh detached sig over new key body>"}

// Trust-signature verification failure indicates key/sig pair drift;
// pin to a consistent release rather than weakening verification.
_, err := auth.AuthenticatePackage(loc)
if err != nil && strings.Contains(err.Error(), "verifying trust signature") {
    return fmt.Errorf("provider %s signing key / trust signature mismatch; pin a consistent release: %w", loc, err)
}

When it happens

Trigger: s.checkDetachedSignature(hashicorpPartnersKeyring, authorKey.Body, trustSignature.Body, nil) at line 447 returns a non-nil, non-ErrKeyExpired error. The detached signature over the author's key body does not validate under the partners keyring.

Common situations: A partner provider rotated its signing key but the registry still serves an old trust signature that was made over a different key. A mirror re-combined a signing key with a trust signature from another publisher. Tampering with either the key or the signature. A trust signature signed by a key other than the official HashiCorp Partners key.

Related errors

• error creating HashiCorp Partners keyring: %s
• error decoding trust signature: %s
• error creating HashiCorp keyring: %s
• error decoding signing key: %s
• error checking signature: %s

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/813eb756dc400b65. Report an issue: GitHub.