https://blog.corneschi.ro/tags/security/Recent content in Security on Daniel CorneschiHugoenDaniel CorneschiWed, 07 Oct 2026 23:47:29 +0300https://blog.corneschi.ro/posts/terraform-lock-file-checksums/Wed, 07 Oct 2026 00:00:00 +0000https://blog.corneschi.ro/posts/terraform-lock-file-checksums/<h2 id="overview">Overview</h2> <p>The <code>.terraform.lock.hcl</code> file stores cryptographic hashes that verify the integrity of downloaded providers. Two hash schemes exist: <code>zh:</code> (a legacy scheme tied to zip archives) and <code>h1:</code> (a directory hash of the unpacked provider). Understanding how these are calculated helps when debugging lock file mismatches or verifying providers manually.</p> <h2 id="zh-and-h1-checksums">zh and h1 Checksums</h2> <p>The <code>terraform init</code> command downloads the provider and verifies that it matches one of the checksums in the lock file, then extracts the package into <code>.terraform/providers</code>.</p>