hashicorp/terraform · error

registry response includes invalid SHASUMS URL: %s

Error message

registry response includes invalid SHASUMS URL: %s

What it means

PackageMeta tries to url.Parse the shasums_url field (the URL of the SHASUMS checksum document) and parsing fails, so the checksum document cannot be retrieved. Aborted with a plain fmt.Errorf before any fetch.

Source

Thrown at internal/getproviders/registry_client.go:323

	if len(body.SHA256Sum) != sha256.Size*2 { // *2 because it's hex-encoded
		return PackageMeta{}, c.errQueryFailed(
			provider,
			fmt.Errorf("registry response includes invalid SHA256 hash %q: %s", body.SHA256Sum, err),
		)
	}

	var checksum [sha256.Size]byte
	_, err = hex.Decode(checksum[:], []byte(body.SHA256Sum))
	if err != nil {
		return PackageMeta{}, c.errQueryFailed(
			provider,
			fmt.Errorf("registry response includes invalid SHA256 hash %q: %s", body.SHA256Sum, err),
		)
	}

	shasumsURL, err := url.Parse(body.SHA256SumsURL)
	if err != nil {
		return PackageMeta{}, fmt.Errorf("registry response includes invalid SHASUMS URL: %s", err)
	}
	shasumsURL = resp.Request.URL.ResolveReference(shasumsURL)
	if shasumsURL.Scheme != "http" && shasumsURL.Scheme != "https" {
		return PackageMeta{}, fmt.Errorf("registry response includes invalid SHASUMS URL: must use http or https scheme")
	}
	document, err := c.getFile(shasumsURL)
	if err != nil {
		return PackageMeta{}, c.errQueryFailed(
			provider,
			fmt.Errorf("failed to retrieve authentication checksums for provider: %s", err),
		)
	}
	signatureURL, err := url.Parse(body.SHA256SumsSignatureURL)
	if err != nil {
		return PackageMeta{}, fmt.Errorf("registry response includes invalid SHASUMS signature URL: %s", err)
	}
	signatureURL = resp.Request.URL.ResolveReference(signatureURL)
	if signatureURL.Scheme != "http" && signatureURL.Scheme != "https" {

View on GitHub (pinned to c9def3e214)

Solutions

  1. Inspect the raw shasums_url value for invalid characters.
  2. Have the registry emit a well-formed absolute or relative http(s) URL.
  3. URL-encode any dynamic segments in the shasums URL.

Example fix

// before
{"shasums_url":"https://reg/s/terraform-provider v1.0_SHA256SUMS"}
// after
{"shasums_url":"https://reg/s/terraform-provider%20v1.0_SHA256SUMS"}
Defensive patterns

Strategy: try-catch

Try / catch

meta, err := client.PackageMeta(ctx, provider, ver, plat)
if err != nil && strings.Contains(err.Error(), "invalid SHASUMS URL") && !strings.Contains(err.Error(), "scheme") {
    // registry shasums_url failed to parse; report upstream
}

Prevention

When it happens

Trigger: Registry response's shasums_url contains characters/structure that Go url.Parse rejects: bad percent-encoding, stray control characters, malformed scheme.

Common situations: Custom registry builds shasums_url by concatenation and injects an unencoded version or path; field accidentally contains a newline or quote from a templating bug; registry schema drift renamed the field and a shim emits garbage.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/d2271aeb87c82781. Report an issue: GitHub.