hashicorp/terraform · error

invalid hostname in provider matching pattern %q: %s

Error message

invalid hostname in provider matching pattern %q: %s

What it means

When a pattern has three segments, the first is the hostname. If it is not the wildcard "*" it is normalized with svchost.ForComparison; an IDNA validation failure yields this error, appending the normalization error. The hostname must be a valid service host or the wildcard.

Source

Thrown at internal/getproviders/multi_source.go:162

		return nil, nil
	}

	ret := make(MultiSourceMatchingPatterns, len(strs))
	for i, str := range strs {
		parts := strings.Split(str, "/")
		if len(parts) < 2 || len(parts) > 3 {
			return nil, fmt.Errorf("invalid provider matching pattern %q: must have either two or three slash-separated segments", str)
		}
		host := defaultRegistryHost
		explicitHost := len(parts) == 3
		if explicitHost {
			givenHost := parts[0]
			if givenHost == "*" {
				host = svchost.Hostname(Wildcard)
			} else {
				normalHost, err := svchost.ForComparison(givenHost)
				if err != nil {
					return nil, fmt.Errorf("invalid hostname in provider matching pattern %q: %s", str, err)
				}

				// The remaining code below deals only with the namespace/type portions.
				host = normalHost
			}

			parts = parts[1:]
		}

		pType, err := normalizeProviderNameOrWildcard(parts[1])
		if err != nil {
			return nil, fmt.Errorf("invalid provider type %q in provider matching pattern %q: must either be the wildcard * or a provider type name", parts[1], str)
		}
		namespace, err := normalizeProviderNamespaceOrWildcard(parts[0])
		if err != nil {
			return nil, fmt.Errorf("invalid registry namespace %q in provider matching pattern %q: must either be the wildcard * or a literal namespace", parts[1], str)
		}

View on GitHub (pinned to c9def3e214)

Solutions

1. Use hyphens instead of underscores in hostnames.
2. Drop the hostname segment to use the default registry ("hashicorp/aws").
3. Use "*" only if you also wildcard namespace and type ("*/*/*").

Example fix

# before
include = ["tf_mirror.local/hashicorp/aws"]

# after
include = ["tf-mirror.local/hashicorp/aws"]

// Validate the hostname segment up front.
if len(parts) == 3 && parts[0] != "*" {
    if _, err := svchost.ForComparison(parts[0]); err != nil {
        return fmt.Errorf("hostname %q invalid: %w", parts[0], err)
    }
}

When it happens

Trigger: A three-segment pattern whose first segment is an invalid hostname: contains underscores, invalid punycode, or other characters IDNA rejects. e.g. "tf_mirror.local/hashicorp/aws".

Common situations: Underscore in the hostname (common in internal DNS names but forbidden by IDNA); punycode that doesn't round-trip; stray punctuation.

Related errors

• invalid provider matching pattern %q: must have either two o
• invalid provider type %q in provider matching pattern %q: mu
• invalid registry namespace %q in provider matching pattern %
• invalid provider matching pattern %q: hostname can be a wild
• invalid provider matching pattern %q: namespace can be a wil

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/b9b59f4ac8bbc598. Report an issue: GitHub.