hashicorp/terraform · error

failed to verify provider package checksums: %s

Error message

failed to verify provider package checksums: %s

What it means

Wrapper error from packageHashAuthentication.AuthenticatePackage when PackageMatchesAnyHash returns a non-nil error. The inner '%s' is the real cause: it comes from PackageHashV1 or PackageHashLegacyZipSHA failing to read/hash the on-disk package (EvalSymlinks/Open/io.Copy errors). Authentication is aborted before any match decision is made.

Source

Thrown at internal/getproviders/package_authentication.go:252

	requiredHashes := PreferredHashes(validHashes)
	return packageHashAuthentication{
		RequiredHashes: requiredHashes,
		AllHashes:      validHashes,
		Platform:       platform,
	}
}

func (a packageHashAuthentication) AuthenticatePackage(localLocation PackageLocation) (*PackageAuthenticationResult, error) {
	if len(a.RequiredHashes) == 0 {
		// Indicates that none of the hashes given to
		// NewPackageHashAuthentication were considered to be usable by this
		// version of Terraform.
		return nil, fmt.Errorf("this version of Terraform does not support any of the checksum formats given for this provider")
	}

	matches, err := PackageMatchesAnyHash(localLocation, a.RequiredHashes)
	if err != nil {
		return nil, fmt.Errorf("failed to verify provider package checksums: %s", err)
	}

	if matches {
		return &PackageAuthenticationResult{result: verifiedChecksum}, nil
	}
	if len(a.RequiredHashes) == 1 {
		return nil, fmt.Errorf("provider package doesn't match the expected checksum %q", a.RequiredHashes[0].String())
	}
	// It's non-ideal that this doesn't actually list the expected checksums,
	// but in the many-checksum case the message would get pretty unweildy.
	// In practice today we typically use this authenticator only with a
	// single hash returned from a network mirror, so the better message
	// above will prevail in that case. Maybe we'll improve on this somehow
	// if the future introduction of a new hash scheme causes there to more
	// commonly be multiple hashes.
	return nil, fmt.Errorf("provider package doesn't match the any of the expected checksums")
}

View on GitHub (pinned to c9def3e214)

Solutions

1. Re-run 'terraform init' to re-stage the provider (the most common fix; transient I/O errors resolve on retry).
2. Inspect the inner error string for the I/O cause (ENOENT, EACCES, EOF) and fix that specifically: chmod the cache dir, free disk space, or remove a corrupt cache entry.
3. Clear the plugin cache: remove .terraform/providers/<provider> and the user-level plugin cache, then init again.
4. If using a shared plugin cache over a network mount, move the cache to local disk.

Example fix

// before: stale/corrupt staged provider
$ terraform init
Error: failed to verify provider package checksums: open .../.terraform/providers/.../terraform-provider-aws_v5.0.0: no such file
// after
$ rm -rf .terraform/providers && terraform init

// Ensure the staged location is readable before authenticating.
func readable(loc getproviders.PackageLocation) error {
    if p, ok := loc.(getproviders.PackageLocalArchive); ok {
        f, err := os.Open(string(p)); if err != nil { return err }; f.Close()
    }
    return nil
}

// 901 wraps transient I/O; retry re-staging once before surfacing.
var lastErr error
for attempt := 0; attempt < 2; attempt++ {
    _, err := auth.AuthenticatePackage(loc)
    if err == nil { return nil }
    lastErr = err
    if !isTransientIO(err) { break }
    _ = restageProvider()
}
return lastErr

When it happens

Trigger: PackageMatchesAnyHash(localLocation, a.RequiredHashes) is called at line 250; for an 'h1:' hash it runs PackageHashV1 (which walks the unpacked dir) and for a 'zh:' hash it runs PackageHashLegacyZipSHA (which opens the .zip). Any I/O failure - file deleted between download and verify, permission denied, broken symlink, truncated/corrupt zip - surfaces here.

Common situations: Antivirus or a concurrent process deleting the staged provider zip mid-install. A filesystem path with restrictive permissions (downloaded to a cache the user cannot read). A partially-downloaded package where the archive is truncated. Network filesystem flakiness causing read errors on the plugin cache.

Related errors

• failed to compute checksum for %s: %s
• Cannot read directory %s
• failed to verify checksum of %s %s package cached in in %s:
• the cached package for %s %s (in %s) does not match any of t
• failed to copy from %s to %s: %s

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/9bb36b5fd2145d5a. Report an issue: GitHub.