this version of Terraform does not support any of the checks

Error message

this version of Terraform does not support any of the checksum formats given for this provider

What it means

Thrown by packageHashAuthentication.AuthenticatePackage when the RequiredHashes set is empty. RequiredHashes is built by PreferredHashes(validHashes), which only keeps hashes whose scheme is HashScheme1 ('h1:') or HashSchemeZip ('zh:'). So this error means every hash supplied to NewPackageHashAuthentication used a scheme this Terraform build does not recognize, and therefore no checksum verification can be attempted at all.

Source

Thrown at internal/getproviders/package_authentication.go:247

// This uses the hash algorithms implemented by functions PackageHash and
// MatchesHash. The PreferredHashes function will select which of the given
// hashes are considered by Terraform to be the strongest verification, and
// authentication succeeds as long as one of those matches.
func NewPackageHashAuthentication(platform Platform, validHashes []Hash) PackageAuthentication {
	requiredHashes := PreferredHashes(validHashes)
	return packageHashAuthentication{
		RequiredHashes: requiredHashes,
		AllHashes:      validHashes,
		Platform:       platform,
	}
}

func (a packageHashAuthentication) AuthenticatePackage(localLocation PackageLocation) (*PackageAuthenticationResult, error) {
	if len(a.RequiredHashes) == 0 {
		// Indicates that none of the hashes given to
		// NewPackageHashAuthentication were considered to be usable by this
		// version of Terraform.
		return nil, fmt.Errorf("this version of Terraform does not support any of the checksum formats given for this provider")
	}

	matches, err := PackageMatchesAnyHash(localLocation, a.RequiredHashes)
	if err != nil {
		return nil, fmt.Errorf("failed to verify provider package checksums: %s", err)
	}

	if matches {
		return &PackageAuthenticationResult{result: verifiedChecksum}, nil
	}
	if len(a.RequiredHashes) == 1 {
		return nil, fmt.Errorf("provider package doesn't match the expected checksum %q", a.RequiredHashes[0].String())
	}
	// It's non-ideal that this doesn't actually list the expected checksums,
	// but in the many-checksum case the message would get pretty unweildy.
	// In practice today we typically use this authenticator only with a
	// single hash returned from a network mirror, so the better message
	// above will prevail in that case. Maybe we'll improve on this somehow

View on GitHub (pinned to c9def3e214)

Solutions

Upgrade the Terraform/OpenTofu binary to a version that understands the hash scheme present in the lock file (newer binaries accept both 'h1:' and 'zh:').
If upgrading is impossible, delete the offending hash line(s) from .terraform.lock.hcl and run 'terraform init' so the current binary recomputes and records a supported scheme.
Confirm the source (registry or mirror) actually publishes SHA256SUMS / lock hashes; if a custom mirror serves only unknown schemes, fix the mirror to emit 'h1:' hashes.
If you constructed the authenticator in your own code, ensure validHashes contains at least one 'h1:' or 'zh:' hash before calling AuthenticatePackage.

Example fix

// before: lock file has only an unknown scheme
providers = {
  registry.terraform.io/hashicorp/aws = { version = "5.0.0", hashes = ["h9:deadbeef..."] }
}
// after: delete the line and let init regenerate, or upgrade binary
$ rm .terraform.lock.hcl && terraform init

Defensive patterns

Strategy: validation

Validate before calling

// Before authenticating, ensure at least one supplied hash uses a
// scheme this binary understands. PreferredHashes mirrors the same filter
// the authenticator applies internally.
func hasUsableHash(hashes []providerreqs.Hash) bool {
    return len(getproviders.PreferredHashes(hashes)) > 0
}

if !hasUsableHash(validHashes) {
    return fmt.Errorf("no supported hash scheme (want h1: or zh:); upgrade or regenerate lock file")
}

Try / catch

// Distinguish "unsupported scheme" (902/903's precondition) from real I/O/integrity
// errors by checking the precondition before calling AuthenticatePackage.
if len(getproviders.PreferredHashes(validHashes)) == 0 {
    // version/lock-file mismatch path: upgrade or regenerate
}
result, err := auth.AuthenticatePackage(loc)
if err != nil {
    return fmt.Errorf("authenticate provider %s: %w", loc, err)
}

Prevention

Commit .terraform.lock.hcl and regenerate it only with the oldest Terraform version your team uses, so all members understand the schemes it contains.
Never hand-edit hash values; always regenerate with terraform init.
When building a custom mirror, publish both h1: and zh: hashes.

When it happens

Trigger: NewPackageHashAuthentication is called with a validHashes slice containing only hashes with schemes other than 'h1:'/'zh:' (e.g. a future 'h2:' scheme, a bare hex string with no scheme, or an unrecognized prefix). On AuthenticatePackage, len(a.RequiredHashes)==0 at line 243 triggers the error before any package bytes are read.

Common situations: A .terraform.lock.hcl written by a NEWER Terraform/Opentofu version that recorded a hash scheme the running (older) binary cannot parse. A filesystem/network mirror that returns only legacy 'zh:' hashes while the binary only understands 'h1:' (or vice versa in a degenerate build). Manually-edited lock files with mangled hash values that lost their scheme prefix.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/5fe39f44e9b839b7. Report an issue: GitHub.