terraform init hashes a cached provider package three times when linking it from the plugin cache #39252

I was annoyed with how slow terraform init is, so I went looking for bugs in the provider installer. This is one I found, AI-assisted.

When a provider is linked from the global plugin cache and the lock file has checksums for it, the installer reads and hashes the whole cached package three times. I have a small fix to internal/providercache/installer.go that hashes it at most once and reuses the result. It leaves the lock file checks themselves (#32129) unchanged. For the configuration below it takes terraform init from 1.28s to 0.50s wall time and from 0.99s to 0.35s CPU time (median of 8 runs, Apple silicon Mac). I'd like to open a PR for it if that's welcome.

Terraform Version

Terraform v1.16.3
on darwin_arm64

Also reproduces on main (78194be).

Terraform Configuration Files

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "6.44.0"
    }
  }
}

Debug Output

Not attached. The trace log has no lines for the hashing itself, only a gap before providercache.Dir.LinkFromOtherCache: linking registry.terraform.io/hashicorp/aws.

Expected Behavior

The cached package is read and hashed once.

Actual Behavior

The same package is hashed three times during EnsureProviderVersions, and each pass reads the whole package (770MB for hashicorp/aws 6.44.0):

1. installer.go:426: cached.MatchesAnyHash(preferredHashes) checks the cache entry against the lock file.
2. dir_modify.go:66: LinkFromOtherCache checks the same hashes again before linking.
3. installer.go:540: cached.Hash() computes the hash again for the lock file update.

Steps to Reproduce

1. Save the configuration above as main.tf, with a plugin cache enabled: export TF_PLUGIN_CACHE_DIR=$HOME/.terraform.d/plugin-cache.
2. terraform providers lock -platform=darwin_arm64 -platform=linux_amd64
3. terraform init once, to fill the plugin cache.
4. Copy main.tf and .terraform.lock.hcl into an empty directory and run time terraform init there.

Additional Context

It only happens with the global plugin cache enabled and a lock file that has checksums for the provider. Without a lock file entry, the cache entry is only used with plugin_cache_may_break_dependency_lock_file set, and is then hashed once.

Generative AI / LLM assisted development?

Claude Code (Claude Opus 5). I used it to find the problem and to write this issue text.