{"record":{"id":"15a25b0a9406ff93","repo":"hashicorp/packer","slug":"sbom-true-requires-local-artifact-files-or-sbom-sc","errorCode":null,"errorMessage":"sbom=true requires local artifact files or sbom_scan_path","messagePattern":"sbom=true requires local artifact files or sbom_scan_path","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"post-processor/provenance/post-processor.go","lineNumber":495,"sourceCode":"\tif p.config.SBOMScanPath != \"\" {\n\t\treturn p.config.SBOMScanPath, nil\n\t}\n\n\tfiles := source.Files()\n\tif len(files) == 1 {\n\t\treturn files[0], nil\n\t}\n\tif len(files) > 1 {\n\t\tparent := filepath.Dir(files[0])\n\t\tfor _, file := range files[1:] {\n\t\t\tif filepath.Dir(file) != parent {\n\t\t\t\treturn \"\", fmt.Errorf(\"sbom=true requires sbom_scan_path when artifact files span multiple directories\")\n\t\t\t}\n\t\t}\n\t\treturn parent, nil\n\t}\n\n\treturn \"\", fmt.Errorf(\"sbom=true requires local artifact files or sbom_scan_path\")\n}\n\nfunc buildSBOMPredicate(rawSBOM []byte, format internalsbom.Format) (interface{}, string, error) {\n\tdecoder := json.NewDecoder(bytes.NewReader(rawSBOM))\n\tdecoder.UseNumber()\n\n\tvar predicate interface{}\n\tif err := decoder.Decode(&predicate); err != nil {\n\t\treturn nil, \"\", fmt.Errorf(\"decode SBOM payload: %w\", err)\n\t}\n\n\tswitch format {\n\tcase internalsbom.FormatCycloneDX:\n\t\treturn predicate, predicateTypeCycloneDX, nil\n\tcase internalsbom.FormatSPDX:\n\t\treturn predicate, predicateTypeSPDX, nil\n\tdefault:\n\t\treturn nil, \"\", fmt.Errorf(\"unsupported SBOM format %q\", format)","sourceCodeStart":477,"sourceCodeEnd":513,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/post-processor/provenance/post-processor.go#L477-L513","documentation":"Thrown by resolveSBOMScanPath when sbom=true but Packer cannot derive any scan path: the artifact has zero files and sbom_scan_path is empty. Some builders (cloud images, remote registries) produce artifacts with no local files, so there is nothing on disk to scan.","triggerScenarios":"provenance post-processor with sbom=true, sbom_scan_path empty, and source.Files() returning an empty slice (e.g. an amazon-ebs or docker.registry artifact with no local file list).","commonSituations":"Enabling SBOM on builders whose artifacts are remote resources rather than local files; forgetting that only file-producing builders expose Files().","solutions":["Set sbom_scan_path explicitly to a local directory containing the artifact contents","Use a file/manifest post-processor to first export the artifact to disk","Disable sbom for artifacts without local files"],"exampleFix":"// before\npost-processor provenance {\n  sbom = true\n}\n// after\npost-processor provenance {\n  sbom = true\n  sbom_scan_path = \"./packer-output\"\n}","handlingStrategy":"validation","validationCode":"// Before enabling sbom, verify local files exist:\nif p.config.SBOM && p.config.SBOMScanPath == \"\" && len(artifact.Files()) == 0 {\n    fmt.Println(\"sbom=true needs sbom_scan_path for artifacts without local files\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set sbom_scan_path whenever using cloud builders (amazon-ebs, docker registry) that have no local artifact files","Export the artifact to disk (file post-processor) before the provenance post-processor","Only enable sbom on builders that emit local files"],"tags":["packer","provenance","sbom","config"],"backgroundTag":"sbom-scan-path-required","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}