provider package doesn't match the any of the expected check

Error message

provider package doesn't match the any of the expected checksums

What it means

Multi-hash mismatch from packageHashAuthentication.AuthenticatePackage. Multiple RequiredHashes were acceptable but PackageMatchesAnyHash returned false for all of them. The package was readable and hashed successfully but matched none of the accepted checksums. As the code comment notes, the expected hashes are deliberately not listed to keep the message readable.

Source

Thrown at internal/getproviders/package_authentication.go:268

	matches, err := PackageMatchesAnyHash(localLocation, a.RequiredHashes)
	if err != nil {
		return nil, fmt.Errorf("failed to verify provider package checksums: %s", err)
	}

	if matches {
		return &PackageAuthenticationResult{result: verifiedChecksum}, nil
	}
	if len(a.RequiredHashes) == 1 {
		return nil, fmt.Errorf("provider package doesn't match the expected checksum %q", a.RequiredHashes[0].String())
	}
	// It's non-ideal that this doesn't actually list the expected checksums,
	// but in the many-checksum case the message would get pretty unweildy.
	// In practice today we typically use this authenticator only with a
	// single hash returned from a network mirror, so the better message
	// above will prevail in that case. Maybe we'll improve on this somehow
	// if the future introduction of a new hash scheme causes there to more
	// commonly be multiple hashes.
	return nil, fmt.Errorf("provider package doesn't match the any of the expected checksums")
}

func (a packageHashAuthentication) AcceptableHashes() []Hash {
	// In this case we include even hashes the current version of Terraform
	// doesn't prefer, because this result is used for building a lock file
	// and so it's helpful to include older hash formats that other Terraform
	// versions might need in order to do authentication successfully.
	return a.AllHashes
}

type archiveHashAuthentication struct {
	Platform      Platform
	WantSHA256Sum [sha256.Size]byte
}

// NewArchiveChecksumAuthentication returns a PackageAuthentication
// implementation that checks that the original distribution archive matches
// the given hash.

View on GitHub (pinned to c9def3e214)

Solutions

Regenerate the lock file: 'terraform init -upgrade' (or delete the provider block in .terraform.lock.hcl) so hashes match the currently served artifact.
Verify everyone on the team uses the same registry/mirror so recomputed hashes are consistent.
If a custom mirror repackaged the zip, serve the original upstream .zip so 'zh:' hashes match again.
Confirm the provider version was not yanked and re-released; pin to a version that has not been republished.

Example fix

// before
$ terraform init
Error: provider package doesn't match the any of the expected checksums
// after
$ terraform init -upgrade

Defensive patterns

Strategy: validation

Validate before calling

// Pre-check all candidate hashes against the staged package so you surface
// the actual expected set, not the generic message.
for _, h := range getproviders.PreferredHashes(validHashes) {
    if ok, _ := getproviders.PackageMatchesAnyHash(loc, []providerreqs.Hash{h}); ok { return nil }
}
return fmt.Errorf("matched none of %d candidate hashes", len(validHashes))

Try / catch

_, err := auth.AuthenticatePackage(loc)
if err != nil && strings.Contains(err.Error(), "any of the expected checksums") {
    // multi-hash drift: regenerate lock against the artifact you actually serve.
}
return err

Prevention

Standardize the team on one registry/mirror so recomputed hashes are consistent.
Run terraform init -upgrade after provider republishes, not before.
Do not serve repackaged zips from mirrors (breaks zh: hashes).

When it happens

Trigger: len(a.RequiredHashes) > 1 and PackageMatchesAnyHash returns (false, nil), reaching line 268. Common with the registry path where both 'h1:' and 'zh:' hashes are supplied yet the package matches neither.

Common situations: Lock file generated against one provider build but the registry/mirror now serves a different build of the same version (republished artifact). Mixed lock files shared across teams where one side recomputed hashes from a different source. A mirror that serves a repackaged zip (which breaks 'zh:' hashes) while the contents also differ (breaking 'h1:').

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/9216ec851abfc726. Report an issue: GitHub.