Failed to publish provider to registry: "SHASUM signature failed verification: Invalid signature"

Terraform
1

I’ve been publishing my provider GitHub - magodo/terraform-provider-restful: Terraform provider to manage RESTful resources frequently, with no change to the GPG setting or github action setting.

This morning I published a new tag as usal, the goreleaser finished successfully, with the github release and assets created succesfully, together with the checksum and checksum signature. When I go to the registry page, it says:

image
image772×121 8.13 KB

I can verify the signature locally:

image
image1438×196 15 KB

Also, the GPG key is correctly set in my account, unchanged for 5 years:

image

Not sure what goes wrong…

1 Like
2

I am also experiencing this.

3

Ours is also 5 years old, but still valid. I wonder if there is some maximum.

4

Did you check if your private key is expired?

5

The key is not expired actually. I recall I’ve met this issue months ago, and I have to delete the Github release and re-run the goreleaser action again, which somehow resolves the issue. But I’d like to understand what’s going wrong this time…

6

@wyardley would you please further check why the release failed? I really want it can be released soon.

7

I tried to build and sign the binaries again and uploaded to the Github release. But when syncing the registry, the same error occur.

8

I have no idea.

But maybe check with Hashicorp.
Publish providers to the Terraform registry | Terraform | HashiCorp Developer has some details on the registry, and an email address to contact. Maybe you could try re-uploading your public key in their portal too? If nothing else, if there’s an error importing it, it might give you some additional information.

9

I’ve made a new release v0.19.1 for my provider days ago, the sync job still failed for the same reason. I don’t think it makes sense to change a GPG key in this case, that makes the users have to identify which public key to use to verify which release of this provider. Doesn’t make sense to me.

10

I learned several things working with the registry team:

  1. What you upload is what they have, they don’t poll key servers
  2. There isn’t a way for the user to edit or remove a key, you need to contact them at terraform-registry@hashicorp.com
  3. They recently started respecting expiry dates, which may be rolled back soon

In my case, the sbind on my subkey had expired, but I updated the key and uploaded the change to several key servers. They didn’t know about this, which makes sense now. Hashicorp’s team was very helpful and got us back up and running. I highly recommend sending an email to terraform-registry@hashicorp.com, it was a very positive experience.

2 Likes
11

My key doesn’t expire, and I can sync after they revert the change.