What causes "invalid md5" in hashicorp/terraform?

Inspect the TableStore row and correct or delete the malformed Digest value so it is a 32-char hex MD5.

invalid md5

Error message

invalid md5

What it means

Returned by RemoteClient.getMD5 (internal/backend/remote-state/oss/client.go:247) when the 'Digest' value read from Alibaba TableStore fails to hex-decode or its decoded length is not md5.Size (16 bytes). The Digest column is used for state consistency checks; a malformed digest means the integrity metadata is corrupt and the state cannot be verified. Get() will log this and, if a payload exists, may proceed without comparison, but if comparison is forced it fails.

Source

Thrown at internal/backend/remote-state/oss/client.go:247

	log.Printf("[DEBUG] Retrieving state serial in tablestore: %#v", getParams)

	object, err := c.otsClient.GetRow(&tablestore.GetRowRequest{
		SingleRowQueryCriteria: getParams,
	})

	if err != nil {
		return nil, err
	}

	var val string
	if v, ok := object.GetColumnMap().Columns["Digest"]; ok && len(v) > 0 {
		val = v[0].Value.(string)
	}

	sum, err := hex.DecodeString(val)
	if err != nil || len(sum) != md5.Size {
		return nil, errors.New("invalid md5")
	}

	return sum, nil
}

// store the hash of the state to that clients can check for stale state files.
func (c *RemoteClient) putMD5(sum []byte) error {
	if c.otsTable == "" {
		return nil
	}

	if len(sum) != md5.Size {
		return errors.New("invalid payload md5")
	}

	putParams := &tablestore.PutRowChange{
		TableName: c.otsTable,
		PrimaryKey: &tablestore.PrimaryKey{

View on GitHub (pinned to c9def3e214)

Solutions

Inspect the TableStore row and correct or delete the malformed Digest value so it is a 32-char hex MD5.
Re-push a known-good state with 'terraform state push' to overwrite the corrupt digest.
Verify no external process is writing malformed digests to the OTS table.

Defensive patterns

Strategy: try-catch

Validate before calling

// Verify the digest is well-formed before relying on it.
if d, err := hex.DecodeString(storedDigest); err != nil || len(d) != md5.Size {
    log.Println("[WARN] TableStore Digest is malformed; state integrity check skipped")
}

Try / catch

if _, err := client.getMD5(); err != nil {
    if strings.Contains(err.Error(), "invalid md5") {
        // Malformed integrity metadata; investigate the TableStore row.
        log.Println("[ERROR] OTS Digest corrupt; consider 'terraform state push' to repair")
    }
}

Prevention

Do not manually edit the TableStore Digest column.
After aborted applies, verify the Digest matches the S3 state via 'terraform state pull/push'.
Restrict write access to the OTS table to terraform only.

When it happens

Trigger: The TableStore 'Digest' column for the state's lockPath+stateIDSuffix contains a non-hex string, an empty string, or a truncated/overlength value; external modification of the TableStore row; a partial/corrupt write left a bad digest.

Common situations: Manual edits to the OTS table; a failed/aborted Put that left a malformed Digest; version-mismatch bugs writing the digest in a different format; someone clearing or truncating the Digest field.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/3329deff1de5df34. Report an issue: GitHub.