the cached package for %s %s (in %s) does not match any of t

Error message

the cached package for %s %s (in %s) does not match any of the checksums recorded in the dependency lock file

What it means

This error is raised in Meta.providerFactoriesFromLocks when verifying a cached provider plugin against the dependency lock file (.terraform.lock.hcl). For each provider locked entry, Terraform computes the hashes of the package in the local plugin cache (CachedProvider.MatchesAnyHash) and compares them against lock.PreferredHashes(). If none match, the cached package is considered corrupt, tampered, or stale and is rejected to prevent executing an untrusted provider binary.

Source

Thrown at internal/command/meta_providers.go:420

			reportError(fmt.Errorf(
				"there is no package for %s %s cached in %s",
				provider, version, cacheDir.BasePath(),
			))
			continue
		}
		// The cached package must match one of the checksums recorded in
		// the lock file, if any.
		if allowedHashes := lock.PreferredHashes(); len(allowedHashes) != 0 {
			matched, err := cached.MatchesAnyHash(allowedHashes)
			if err != nil {
				reportError(fmt.Errorf(
					"failed to verify checksum of %s %s package cached in in %s: %s",
					provider, version, cacheDir.BasePath(), err,
				))
				continue
			}
			if !matched {
				reportError(fmt.Errorf(
					"the cached package for %s %s (in %s) does not match any of the checksums recorded in the dependency lock file",
					provider, version, cacheDir.BasePath(),
				))
				continue
			}
		}
		factories[provider] = providerFactory(cached)
	}
	for provider, localDir := range devOverrideProviders {
		factories[provider] = devOverrideProviderFactory(provider, localDir)
	}
	for provider, reattach := range unmanagedProviders {
		factories[provider] = unmanagedProviderFactory(provider, reattach)
	}
	if m.testingOverrides != nil {
		// Allow tests, where testingOverrides is set, to see test providers in locks
		for provider, factory := range m.testingOverrides.Providers {
			factories[provider] = factory

View on GitHub (pinned to c9def3e214)

Solutions

Run 'terraform providers lock -platform=<your_platform>' to regenerate correct hashes for the cached package.
Remove the offending provider from the cache directory and re-run 'terraform init' to re-download a clean package.
Delete .terraform.lock.hcl and .terraform/providers, then run 'terraform init' fresh to rebuild both.
Verify the CI cache key includes the Terraform version so mismatched hash algorithms aren't restored across upgrades.
Ensure all team members use a Terraform version that supports the same hash schemes (>= 0.13 for zh: hashes).

Example fix

// before: lock file pins h1: hashes but cache has zh: only provider
// fix: regenerate the lock entry for your platform
$ terraform providers lock -platform=linux_amd64 -platform=darwin_arm64
// then re-init
$ terraform init

Defensive patterns

Strategy: validation

Validate before calling

// Before running Terraform, verify cached provider hashes match the lock file
package main

import (
	"os"
	"path/filepath"
)

func verifyProviderCacheLockConsistent(cacheDir, lockFile string) error {
	info, err := os.Stat(lockFile)
	if err != nil { return nil /* no lock yet, nothing to validate */ }
	if info.IsDir() { return nil }
	// Ensure the cache dir referenced by the lock entries exists and is non-empty
	entries, err := os.ReadDir(cacheDir)
	if err != nil { return err }
	if len(entries) == 0 {
		return fmt.Errorf("provider cache %s empty; run 'terraform init' first", cacheDir)
	}
	// Best signal: run the real check via CLI before your pipeline step
	return nil
}

Prevention

Run 'terraform init -upgrade' after upgrading Terraform CLI so lock hashes are recomputed with the supported algorithm.
Pin CI cache keys to the Terraform version + lock file hash so stale provider packages are not restored.
Commit .terraform.lock.hcl and require it in CI rather than regenerating per-runner.
Never hand-edit .terraform.lock.hcl; always use 'terraform providers lock'.

When it happens

Trigger: Triggered during any command that initializes providers (init, plan, apply, etc.) when lock.PreferredHashes() is non-empty AND cached.MatchesAnyHash(allowedHashes) returns matched=false. The provider entry in .terraform.lock.hcl has hashes that the package in the cache directory (~/.terraform.d/plugin-cache or .terraform/providers) cannot reproduce.

Common situations: The cache directory was populated by a different Terraform version that recorded different hash algorithms (e.g. zh: vs h1:); the lock file was hand-edited or regenerated by a teammate on another platform; a CI cache restore mixed packages from incompatible runs; the provider zip was partially downloaded/corrupted; manual tampering with cached plugin files.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/da1bce115ca6e0f8. Report an issue: GitHub.