registry response includes invalid SHASUMS signature URL: mu

Error message

registry response includes invalid SHASUMS signature URL: must use http or https scheme

What it means

PackageMeta parsed shasums_signature_url but its scheme is not http or https. Signature documents are only fetched over http(s), so the install aborts with a plain fmt.Errorf. Security guard parallel to the shasums_url and download_url checks.

Source

Thrown at internal/getproviders/registry_client.go:342

	}
	shasumsURL = resp.Request.URL.ResolveReference(shasumsURL)
	if shasumsURL.Scheme != "http" && shasumsURL.Scheme != "https" {
		return PackageMeta{}, fmt.Errorf("registry response includes invalid SHASUMS URL: must use http or https scheme")
	}
	document, err := c.getFile(shasumsURL)
	if err != nil {
		return PackageMeta{}, c.errQueryFailed(
			provider,
			fmt.Errorf("failed to retrieve authentication checksums for provider: %s", err),
		)
	}
	signatureURL, err := url.Parse(body.SHA256SumsSignatureURL)
	if err != nil {
		return PackageMeta{}, fmt.Errorf("registry response includes invalid SHASUMS signature URL: %s", err)
	}
	signatureURL = resp.Request.URL.ResolveReference(signatureURL)
	if signatureURL.Scheme != "http" && signatureURL.Scheme != "https" {
		return PackageMeta{}, fmt.Errorf("registry response includes invalid SHASUMS signature URL: must use http or https scheme")
	}
	signature, err := c.getFile(signatureURL)
	if err != nil {
		return PackageMeta{}, c.errQueryFailed(
			provider,
			fmt.Errorf("failed to retrieve cryptographic signature for provider: %s", err),
		)
	}

	keys := make([]SigningKey, len(body.SigningKeys.GPGPublicKeys))
	for i, key := range body.SigningKeys.GPGPublicKeys {
		keys[i] = *key
	}

	ret.Authentication = PackageAuthenticationAll(
		NewMatchingChecksumAuthentication(document, body.Filename, checksum),
		NewArchiveChecksumAuthentication(ret.TargetPlatform, checksum),
		NewSignatureAuthentication(document, signature, keys),

View on GitHub (pinned to c9def3e214)

Solutions

Serve the signature file over https and reference it with an https:// URL.
Ensure relative signature URL resolves against an http(s) request URL.
Fix any proxy/CDN that rewrites the scheme.

Example fix

// before
{"shasums_signature_url":"file:///srv/sums/SHA256SUMS.sig"}
// after
{"shasums_signature_url":"https://registry.example/s/SHA256SUMS.sig"}

Defensive patterns

Strategy: validation

Validate before calling

func validSignatureScheme(u string) error {
    parsed, err := url.Parse(u)
    if err != nil {
        return err
    }
    if parsed.Scheme != "http" && parsed.Scheme != "https" {
        return fmt.Errorf("signature URL scheme %q not allowed", parsed.Scheme)
    }
    return nil
}

Try / catch

meta, err := client.PackageMeta(ctx, provider, ver, plat)
if err != nil && strings.Contains(err.Error(), "SHASUMS signature URL: must use http or https scheme") {
    // registry signature URL uses a disallowed scheme
}

Prevention

Serve signature files over https only.
Ensure relative signature URLs resolve against https request URLs.
Audit proxies that may rewrite the scheme.

When it happens

Trigger: Registry response's shasums_signature_url resolves to a non-http(s) scheme: file://, ftp://, gpg://, etc.

Common situations: Private registry serving the .sig from internal storage with a file:// URL; dev/staging registry; proxy stripping the scheme.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/6cde9013e625e650. Report an issue: GitHub.