hashicorp/terraform · error

failed to compute checksum for %s: %s

Error message

failed to compute checksum for %s: %s

What it means

Wrapper from archiveHashAuthentication.AuthenticatePackage when PackageHashLegacyZipSHA cannot hash the archive. The inner '%s' is the I/O cause from EvalSymlinks, os.Open, or io.Copy over the archive file. The '%s' before it is the archive location path.

Source

Thrown at internal/getproviders/package_authentication.go:311

//
// NewPackageHashAuthentication is preferable to use when possible because
// it uses the newer hashing scheme (implemented by function PackageHash) that
// can work with both packed and unpacked provider packages.
func NewArchiveChecksumAuthentication(platform Platform, wantSHA256Sum [sha256.Size]byte) PackageAuthentication {
	return archiveHashAuthentication{platform, wantSHA256Sum}
}

func (a archiveHashAuthentication) AuthenticatePackage(localLocation PackageLocation) (*PackageAuthenticationResult, error) {
	archiveLocation, ok := localLocation.(PackageLocalArchive)
	if !ok {
		// A source should not use this authentication type for non-archive
		// locations.
		return nil, fmt.Errorf("cannot check archive hash for non-archive location %s", localLocation)
	}

	gotHash, err := PackageHashLegacyZipSHA(archiveLocation)
	if err != nil {
		return nil, fmt.Errorf("failed to compute checksum for %s: %s", archiveLocation, err)
	}
	wantHash := HashLegacyZipSHAFromSHA(a.WantSHA256Sum)
	if gotHash != wantHash {
		return nil, fmt.Errorf("archive has incorrect checksum %s (expected %s)", gotHash, wantHash)
	}
	return &PackageAuthenticationResult{result: verifiedChecksum}, nil
}

func (a archiveHashAuthentication) AcceptableHashes() []Hash {
	return []Hash{HashLegacyZipSHAFromSHA(a.WantSHA256Sum)}
}

type matchingChecksumAuthentication struct {
	Document      []byte
	Filename      string
	WantSHA256Sum [sha256.Size]byte
}

View on GitHub (pinned to c9def3e214)

Solutions

1. Re-stage the provider: remove the cached archive and run 'terraform init' again.
2. Read the inner error and fix the underlying I/O problem (chmod, free space, fix symlinks).
3. Move the plugin cache off a flaky network filesystem onto local disk.

Example fix

// before
$ terraform init
Error: failed to compute checksum for .terraform/.../zip: open ...: permission denied
// after
$ chmod -R u+rwX .terraform/providers && terraform init

// Verify the archive is openable before authenticating.
if _, err := os.Stat(string(archiveLoc)); err != nil { return err }
f, err := os.Open(string(archiveLoc)); if err != nil { return err }; f.Close()

// I/O failure computing the hash is usually transient; re-stage once.
_, err := auth.AuthenticatePackage(loc)
if err != nil && strings.Contains(err.Error(), "failed to compute checksum") {
    _ = restageArchive(); _, err = auth.AuthenticatePackage(loc)
}
return err

When it happens

Trigger: PackageHashLegacyZipSHA(archiveLocation) at line 309 returns an error: filepath.EvalSymlinks fails (dangling symlink), os.Open fails (ENOENT/EACCES), or io.Copy fails (read error on the zip).

Common situations: The staged .zip was deleted or moved between download and verification. Permissions on the cache dir prevent reading. The archive is on a network mount that dropped. A broken symlink in the plugin cache path.

Related errors

• failed to verify provider package checksums: %s
• Cannot read directory %s
• failed to verify checksum of %s %s package cached in in %s:
• the cached package for %s %s (in %s) does not match any of t
• failed to copy from %s to %s: %s

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/c1663d8e83e0c36e. Report an issue: GitHub.