OpenTofu .terraform.lock.hcl provider hash mismatch after migrating from Terraform in CI

Your committed .terraform.lock.hcl records provider hashes from registry.terraform.io. Under OpenTofu, the same provider is pulled from registry.opentofu.org with different recorded hashes, so init rejects the lock. Regenerate it with tofu.

What this error means

tofu init fails with "Error: registry.opentofu.org/hashicorp/aws: the current package for ... does not match any of the checksums recorded in the dependency lock file", right after switching a repo from terraform to tofu.

tofu

Error: Failed to install provider

Error while installing hashicorp/aws v5.60.0: the current package for
registry.opentofu.org/hashicorp/aws 5.60.0 does not match any of the checksums
recorded in the dependency lock file.

Common causes

The lock file was generated by Terraform

Terraform wrote hashes tied to registry.terraform.io. OpenTofu fetches from its own registry, whose package checksums are recorded differently, so the existing lock does not match.

The lock lacks OpenTofu-registry checksums

Even for the same provider version, the lock needs the hashes for the OpenTofu registry entry; without them init refuses to install.

How to fix it

Regenerate the lock with tofu init -upgrade

Run tofu init -upgrade to recompute the lock against registry.opentofu.org.
Commit the updated .terraform.lock.hcl.
Optionally add all platform hashes so CI on Linux and macOS both validate.

Terminal

tofu init -upgrade
tofu providers lock \
  -platform=linux_amd64 -platform=darwin_arm64

Commit the tofu-generated lock, not the Terraform one

Do not carry the Terraform .terraform.lock.hcl forward unchanged. Let tofu rewrite it once during migration and commit that version so every CI run matches.

How to prevent it

Regenerate .terraform.lock.hcl with tofu the moment you migrate.
Run tofu providers lock for every platform your CI uses.
Do not mix Terraform-written and OpenTofu-written lock files.