What causes "failed to verify checksum of %s %s package cached in in %s: %s" in hashicorp/terraform?

Remove the corrupt provider package from .terraform/providers and re-run `terraform init` to re-download.

failed to verify checksum of %s %s package cached in in %s:

Error message

failed to verify checksum of %s %s package cached in in %s: %s

What it means

Raised when checksum verification of a cached provider package against the lock file's preferred hashes fails with an error (not merely a mismatch). cached.MatchesAnyHash(allowedHashes) returned a non-nil err — e.g. the cached package archive/directory is corrupt, unreadable, or the hashing operation itself failed. Note the message contains a literal typo ('cached in in').

Source

Thrown at internal/command/meta_providers.go:413

			// loops below, for dev overrides etc.
			continue
		}

		version := lock.Version()
		cached := cacheDir.ProviderVersion(provider, version)
		if cached == nil {
			reportError(fmt.Errorf(
				"there is no package for %s %s cached in %s",
				provider, version, cacheDir.BasePath(),
			))
			continue
		}
		// The cached package must match one of the checksums recorded in
		// the lock file, if any.
		if allowedHashes := lock.PreferredHashes(); len(allowedHashes) != 0 {
			matched, err := cached.MatchesAnyHash(allowedHashes)
			if err != nil {
				reportError(fmt.Errorf(
					"failed to verify checksum of %s %s package cached in in %s: %s",
					provider, version, cacheDir.BasePath(), err,
				))
				continue
			}
			if !matched {
				reportError(fmt.Errorf(
					"the cached package for %s %s (in %s) does not match any of the checksums recorded in the dependency lock file",
					provider, version, cacheDir.BasePath(),
				))
				continue
			}
		}
		factories[provider] = providerFactory(cached)
	}
	for provider, localDir := range devOverrideProviders {
		factories[provider] = devOverrideProviderFactory(provider, localDir)
	}

View on GitHub (pinned to c9def3e214)

Solutions

Remove the corrupt provider package from .terraform/providers and re-run `terraform init` to re-download.
If TF_PLUGIN_CACHE_DIR is set, clear the offending provider entry there too.
Run `terraform init -upgrade` to refresh the package and its lock hashes.
Check disk health / antivirus interference if corruption recurs.

Example fix

// before
// terraform plan -> failed to verify checksum of aws 4.0 package cached in in .terraform/providers: ...

// after
rm -rf .terraform/providers/registry.terraform.io/hashicorp/aws
terraform init   # re-downloads and re-verifies

Defensive patterns

Strategy: validation

Validate before calling

// Verify a cached provider package hashes cleanly before use
func providerIntact(pkgPath string, allowedHashes []string) (bool, error) {
    // use the same hashing as getprovider.PackageHash
    h, err := getprovider.PackageHash(pkgPath)
    if err != nil { return false, err }
    for _, ah := range allowedHashes {
        if ah == h { return true, nil }
    }
    return false, nil
}

Prevention

Do not interrupt init mid-download to avoid corrupt provider packages.
Clear and re-download a provider if verification fails: rm -rf the provider dir then terraform init.
Run terraform init -upgrade to refresh both package and lock hashes.
Investigate disk/antivirus issues if corruption recurs.

When it happens

Trigger: providerFactoriesFromLocks: cached.MatchesAnyHash(allowedHashes) returns (false, err) with err!=nil. Triggered by a corrupt or truncated provider package in .terraform/providers, a permissions error reading the package, or a partially downloaded zip that cannot be hashed.

Common situations: A previous init download was interrupted leaving a corrupt package; antivirus/EDR quarantined part of the provider; filesystem corruption; manual tampering with the cache; disk filled mid-download.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/274079e8d7c7e252. Report an issue: GitHub.