hashicorp/terraform · error
%s returned from %s
Error message
%s returned from %s
What it means
getFile (used to fetch SHASUMS documents and signature files) returned an HTTP response whose status was not 200 OK. The status text and host are formatted into the error. It is returned raw (plain fmt.Errorf), then typically wrapped in ErrQueryFailed by the caller PackageMeta.
Source
Thrown at internal/getproviders/registry_client.go:441
}
}
func (c *registryClient) errUnauthorized(hostname svchost.Hostname) error {
return ErrUnauthorized{
Hostname: hostname,
HaveCredentials: c.creds != nil,
}
}
func (c *registryClient) getFile(url *url.URL) ([]byte, error) {
resp, err := c.httpClient.Get(url.String())
if err != nil {
return nil, err
}
defer resp.Body.Close()
if resp.StatusCode != http.StatusOK {
return nil, fmt.Errorf("%s returned from %s", resp.Status, HostFromRequest(resp.Request))
}
data, err := ioutil.ReadAll(resp.Body)
if err != nil {
return data, err
}
return data, nil
}
// configureDiscoveryRetry configures the number of retries the registry client
// will attempt for requests with retryable errors, like 502 status codes
func configureDiscoveryRetry() {
discoveryRetry = defaultRetry
if v := os.Getenv(registryDiscoveryRetryEnvName); v != "" {
retry, err := strconv.Atoi(v)
if err == nil && retry > 0 {View on GitHub (pinned to c9def3e214)
Solutions
- curl -I the cited URL to see the exact status and host.
- For 401/403: supply registry credentials (terraform login / credentials helper).
- For 404: confirm the provider version actually published SHASUMS/signature artifacts; try another version.
- For 429/5xx: raise TF_REGISTRY_DISCOVERY_RETRY and retry later.
- Verify the registry's reverse proxy permits the host/path.
Example fix
# diagnose $ curl -I https://registry.example/s/SHA256SUMS.sig HTTP/2 404 # fix: publish the missing signature artifact on the registry
Defensive patterns
Strategy: try-catch
Try / catch
doc, err := client.getFile(shasumsURL)
if err != nil {
if strings.Contains(err.Error(), "returned from") {
// non-200 status from host; inspect status, possibly auth or 404
}
return err
} Prevention
- Confirm SHASUMS/signature artifacts are published for every provider version.
- Provide registry credentials via terraform login when the registry requires auth.
- Monitor the registry for 4xx/5xx on checksum and signature endpoints.
When it happens
Trigger: The shasums_url or shasums_signature_url responded with any non-200 status: 401/403 (auth), 404 (missing artifact), 410 (gone), 429 (rate limit), 5xx (server error), or a redirect that did not land on 200.
Common situations: Signed registry URL expired (403); artifact not published for that version (404); registry rate-limiting (429); registry 5xx outage; reverse proxy returning a default error page with a non-200 status; private registry requiring auth the client lacks.
Related errors
- failed to retrieve authentication checksums for provider: %s
- registry response includes invalid SHASUMS signature URL: %s
- registry response includes invalid SHASUMS signature URL: mu
- failed to retrieve cryptographic signature for provider: %s
- registry response includes invalid SHASUMS URL: %s
AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07).
Data as JSON: /api/errors/91ffe69483487961.
Report an issue: GitHub.