registry response includes invalid download URL: must use ht

Error message

registry response includes invalid download URL: must use http or https scheme

What it means

PackageMeta parsed download_url successfully but its scheme is neither http nor https. Terraform only fetches provider archives over http(s), so the response is rejected outright with a plain fmt.Errorf. This guards against a compromised or misconfigured registry redirecting downloads to file://, ftp://, etc.

Source

Thrown at internal/getproviders/registry_client.go:289

			if err != nil {
				return PackageMeta{}, err
			}
			protoErr.Suggestion = closest
			return PackageMeta{}, protoErr
		}
	}

	if body.OS != target.OS || body.Arch != target.Arch {
		return PackageMeta{}, fmt.Errorf("registry response to request for %s archive has incorrect target %s", target, Platform{body.OS, body.Arch})
	}

	downloadURL, err := url.Parse(body.DownloadURL)
	if err != nil {
		return PackageMeta{}, fmt.Errorf("registry response includes invalid download URL: %s", err)
	}
	downloadURL = resp.Request.URL.ResolveReference(downloadURL)
	if downloadURL.Scheme != "http" && downloadURL.Scheme != "https" {
		return PackageMeta{}, fmt.Errorf("registry response includes invalid download URL: must use http or https scheme")
	}

	ret := PackageMeta{
		Provider:         provider,
		Version:          version,
		ProtocolVersions: protoVersions,
		TargetPlatform: Platform{
			OS:   body.OS,
			Arch: body.Arch,
		},
		Filename: body.Filename,
		Location: PackageHTTPURL(downloadURL.String()),
		// "Authentication" is populated below
	}

	if len(body.SHA256Sum) != sha256.Size*2 { // *2 because it's hex-encoded
		return PackageMeta{}, c.errQueryFailed(
			provider,

View on GitHub (pinned to c9def3e214)

Solutions

Configure the registry to return an https:// URL for the archive (front object storage with an https endpoint if needed).
If relative, ensure the request URL itself is http(s) so resolution yields an http(s) absolute URL.
Audit any URL-rewriting proxy between Terraform and the registry.

Example fix

// before
{"download_url":"file:///srv/providers/foo.zip"}
// after
{"download_url":"https://registry.example/providers/foo.zip"}

Defensive patterns

Strategy: validation

Validate before calling

// If you control the registry, assert the scheme before returning the response.
func validDownloadScheme(u string) error {
    parsed, err := url.Parse(u)
    if err != nil {
        return err
    }
    if parsed.Scheme != "http" && parsed.Scheme != "https" {
        return fmt.Errorf("download_url scheme %q not allowed", parsed.Scheme)
    }
    return nil
}

Try / catch

meta, err := client.PackageMeta(ctx, provider, ver, plat)
if err != nil && strings.Contains(err.Error(), "must use http or https scheme") {
    // registry tried to redirect to a disallowed scheme; flag as config/registry bug
}

Prevention

Serve all artifacts over https only.
Front object storage with an https endpoint rather than emitting s3:// or file:// URLs.
Review any reverse proxy that could rewrite the scheme.

When it happens

Trigger: Registry response's download_url uses a scheme other than http/https — e.g. file://, ftp://, s3://, or a schemeless URL that resolved oddly.

Common situations: Private registry serving artifacts from object storage and emitting an s3:// URL; misconfigured proxy rewriting to ftp; registry dev environment using file:// paths; CDN returning a data: URL.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/f7701ff7e9f01961. Report an issue: GitHub.