registry response includes invalid SHASUMS URL: must use htt

Error message

registry response includes invalid SHASUMS URL: must use http or https scheme

What it means

PackageMeta parsed shasums_url but its scheme is not http or https. Terraform refuses to fetch checksum documents over other schemes, so the install aborts with a plain fmt.Errorf. This is a security guard parallel to the download_url scheme check.

Source

Thrown at internal/getproviders/registry_client.go:327

		)
	}

	var checksum [sha256.Size]byte
	_, err = hex.Decode(checksum[:], []byte(body.SHA256Sum))
	if err != nil {
		return PackageMeta{}, c.errQueryFailed(
			provider,
			fmt.Errorf("registry response includes invalid SHA256 hash %q: %s", body.SHA256Sum, err),
		)
	}

	shasumsURL, err := url.Parse(body.SHA256SumsURL)
	if err != nil {
		return PackageMeta{}, fmt.Errorf("registry response includes invalid SHASUMS URL: %s", err)
	}
	shasumsURL = resp.Request.URL.ResolveReference(shasumsURL)
	if shasumsURL.Scheme != "http" && shasumsURL.Scheme != "https" {
		return PackageMeta{}, fmt.Errorf("registry response includes invalid SHASUMS URL: must use http or https scheme")
	}
	document, err := c.getFile(shasumsURL)
	if err != nil {
		return PackageMeta{}, c.errQueryFailed(
			provider,
			fmt.Errorf("failed to retrieve authentication checksums for provider: %s", err),
		)
	}
	signatureURL, err := url.Parse(body.SHA256SumsSignatureURL)
	if err != nil {
		return PackageMeta{}, fmt.Errorf("registry response includes invalid SHASUMS signature URL: %s", err)
	}
	signatureURL = resp.Request.URL.ResolveReference(signatureURL)
	if signatureURL.Scheme != "http" && signatureURL.Scheme != "https" {
		return PackageMeta{}, fmt.Errorf("registry response includes invalid SHASUMS signature URL: must use http or https scheme")
	}
	signature, err := c.getFile(signatureURL)
	if err != nil {

View on GitHub (pinned to c9def3e214)

Solutions

Serve the SHASUMS document over https and reference it with an https:// URL.
Ensure relative shasums_url resolves against an http(s) request URL.
Fix any proxy/CDN rewriting the scheme.

Example fix

// before
{"shasums_url":"file:///srv/sums/SHA256SUMS"}
// after
{"shasums_url":"https://registry.example/s/SHA256SUMS"}

Defensive patterns

Strategy: validation

Validate before calling

func validShasumsScheme(u string) error {
    parsed, err := url.Parse(u)
    if err != nil {
        return err
    }
    if parsed.Scheme != "http" && parsed.Scheme != "https" {
        return fmt.Errorf("shasums_url scheme %q not allowed", parsed.Scheme)
    }
    return nil
}

Try / catch

meta, err := client.PackageMeta(ctx, provider, ver, plat)
if err != nil && strings.Contains(err.Error(), "SHASUMS URL: must use http or https scheme") {
    // registry emitted a non-http shasums URL; fix registry config
}

Prevention

Serve SHASUMS documents over https only.
Ensure relative shasums_url resolves against an https request URL.
Audit proxies that may rewrite the scheme.

When it happens

Trigger: Registry response's shasums_url resolves to a non-http(s) scheme: file://, ftp://, smb://, etc.

Common situations: Private registry serving SHASUMS from internal storage emitting a file:// or smb:// URL; dev registry; misconfigured reverse proxy stripping the scheme.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/de63ce8e68235eff. Report an issue: GitHub.