registry response includes invalid SHASUMS signature URL: %s

Error message

registry response includes invalid SHASUMS signature URL: %s

What it means

PackageMeta tries to url.Parse the shasums_signature_url (the GPG/PGP detached signature for the SHASUMS document) and parsing fails, so the signature cannot be fetched. Aborted with a plain fmt.Errorf before any network call.

Source

Thrown at internal/getproviders/registry_client.go:338

	shasumsURL, err := url.Parse(body.SHA256SumsURL)
	if err != nil {
		return PackageMeta{}, fmt.Errorf("registry response includes invalid SHASUMS URL: %s", err)
	}
	shasumsURL = resp.Request.URL.ResolveReference(shasumsURL)
	if shasumsURL.Scheme != "http" && shasumsURL.Scheme != "https" {
		return PackageMeta{}, fmt.Errorf("registry response includes invalid SHASUMS URL: must use http or https scheme")
	}
	document, err := c.getFile(shasumsURL)
	if err != nil {
		return PackageMeta{}, c.errQueryFailed(
			provider,
			fmt.Errorf("failed to retrieve authentication checksums for provider: %s", err),
		)
	}
	signatureURL, err := url.Parse(body.SHA256SumsSignatureURL)
	if err != nil {
		return PackageMeta{}, fmt.Errorf("registry response includes invalid SHASUMS signature URL: %s", err)
	}
	signatureURL = resp.Request.URL.ResolveReference(signatureURL)
	if signatureURL.Scheme != "http" && signatureURL.Scheme != "https" {
		return PackageMeta{}, fmt.Errorf("registry response includes invalid SHASUMS signature URL: must use http or https scheme")
	}
	signature, err := c.getFile(signatureURL)
	if err != nil {
		return PackageMeta{}, c.errQueryFailed(
			provider,
			fmt.Errorf("failed to retrieve cryptographic signature for provider: %s", err),
		)
	}

	keys := make([]SigningKey, len(body.SigningKeys.GPGPublicKeys))
	for i, key := range body.SigningKeys.GPGPublicKeys {
		keys[i] = *key
	}

View on GitHub (pinned to c9def3e214)

Solutions

Inspect the raw shasums_signature_url for invalid characters.
Have the registry emit a well-formed absolute or relative http(s) URL (or omit signing if unsigned).
URL-encode dynamic segments.

Example fix

// before
{"shasums_signature_url":"https://reg/s/SHA256SUMS .sig"}
// after
{"shasums_signature_url":"https://reg/s/SHA256SUMS.sig"}

Defensive patterns

Strategy: try-catch

Try / catch

meta, err := client.PackageMeta(ctx, provider, ver, plat)
if err != nil && strings.Contains(err.Error(), "invalid SHASUMS signature URL") && !strings.Contains(err.Error(), "scheme") {
    // registry signature URL failed to parse; report upstream
}

Prevention

Return well-formed http(s) signature URLs from the registry.
URL-encode dynamic path segments.
Lint registry responses against a schema in CI.

When it happens

Trigger: Registry response's shasums_signature_url contains characters/structure that Go url.Parse rejects: invalid percent-encoding, control characters, malformed scheme.

Common situations: Custom registry omits the field then a shim emits a broken placeholder; templating bug injecting an unencoded path; field contains a stray quote or newline from JSON assembly.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/75f3404c418a12ca. Report an issue: GitHub.