hashicorp/terraform · critical

init (determineIfProviderTrusted): unexpected provider locat

Error message

init (determineIfProviderTrusted): unexpected provider location type for state storage provider %q: %T

What it means

Programmer-error panic in determineIfProviderTrusted: the provider's install location type is not one of the recognized package types (PackageLocalArchive, PackageLocalDir, PackageHTTPURL). The switch falls to default and panics with the provider address and the concrete location type. This guards the trust-decision logic for state-store providers against an unanticipated location kind.

Source

Thrown at internal/command/meta_backend.go:3105

		//
		// In both cases trust is already established; skip requesting approval.
		log.Printf("[TRACE] init (determineIfProviderTrusted): the state storage provider %s (%q) was present in a dependency lock file during provider installation, so we consider it safe", provider.Type, provider)
		return Trusted
	} else {
		// The provider wasn't in the dependency lock file so it's being download for the first time
		// (we block upgrading the state store provider in this method).
		log.Printf("[TRACE] init (determineIfProviderTrusted): the state storage provider %s (%q) will be changed in the dependency lock file during provider installation.", provider.Type, provider)
		switch location.(type) {
		case getproviders.PackageLocalArchive, getproviders.PackageLocalDir:
			// If the provider is downloaded from a local source we assume it's safe.
			// We don't require presence of the -safe-init flag, or require input from the user to approve its usage.
			log.Printf("[TRACE] init (determineIfProviderTrusted): the state storage provider %s (%q) is downloaded from a local source, so we consider it safe.", provider.Type, provider)
			return Trusted
		case getproviders.PackageHTTPURL:
			log.Printf("[DEBUG] init (determineIfProviderTrusted): the state storage provider %s (%q) is downloaded via HTTP, so we consider it potentially unsafe.", provider.Type, provider)
			return RequiresApproval
		default:
			panic(fmt.Sprintf("init (determineIfProviderTrusted): unexpected provider location type for state storage provider %q: %T", provider, location))
		}
	}
}

// confirmProviderIsTrusted takes the action determined by `determineIfProviderTrusted` and either prompts the user for approval, or returns an error if something has gone wrong with pre-supplied locks when Terraform was run in automation.
//
// NOTE: the command parameter is used to determine which command is being run, so that we can provide more specific guidance to the user. Do not use that parameter for any other purpose!
func (m *Meta) confirmProviderIsTrusted(trust ProviderTrust, provider addrs.Provider, stateStoreProviderAuthResult *getproviders.PackageAuthenticationResult, stateStoreProviderLock, locksBeforeInstall *depsfile.Locks, flagLockfilePath string, command cli.Command, view views.StateStoreProviderTrustLogger) tfdiags.Diagnostics {
	var diags tfdiags.Diagnostics

	switch trust {
	case Trusted:
		// do nothing; provider is already trusted and there's no need to notify the user.

		if flagLockfilePath != "" {
			// If the user supplied a lock file path via CLI flag, we should notify them that it was used.
			view.LogAutomaticApproval()
			view.Spacer()

View on GitHub (pinned to d32a084675)

Solutions

1. Upgrade Terraform to a version where the new location type is handled.
2. Avoid the unsupported install source (switch to a registry or local-dir source for the state-store provider).
3. Report the location type (%T value in the message) so maintainers can add a case.

Example fix

// before (library code)
default:
    panic(fmt.Sprintf("...unexpected provider location type...%T", location))

// after (defensive)
default:
    return RequiresApproval // unknown -> ask the user

// Defensive: treat unknown location types as RequiresApproval
switch location.(type) {
case getproviders.PackageLocalArchive, getproviders.PackageLocalDir:
    return Trusted
case getproviders.PackageHTTPURL:
    return RequiresApproval
default:
    return RequiresApproval
}

When it happens

Trigger: The state-store provider install resolved to a location type the trust logic does not handle (e.g. a future PackageLocalMirror, PackageNetworkMirror artifact, or a custom getproviders.PackageMeta type).

Common situations: New provider source / installation method not yet covered by the safe-init trust switch, experimental mirror installs, or a Terraform build that introduced a new location type without updating this switch.

Related errors

• nil config passed to StateStoreProviderFactoryFromConfigStat
• Unexpected command type in confirmProviderIsTrusted; this is
• When installing providers described in the config Terraform
• errStateStoreInitDiag requires a non-nil reason argument
• confirmFunc must not be nil

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/540cac28954ba811. Report an issue: GitHub.