{"record":{"id":"1965152208ddf22f","repo":"hashicorp/packer","slug":"failed-to-download-sbom-s","errorCode":null,"errorMessage":"failed to download SBOM: %s","messagePattern":"failed to download SBOM: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"provisioner/hcp-sbom/provisioner.go","lineNumber":659,"sourceCode":"\tremoteScannerPath, err := p.uploadScanner(ctx, ui, comm, scannerZipPath, osType)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to upload scanner: %s\", err)\n\t}\n\tdefer p.cleanupRemoteFile(ctx, ui, comm, remoteScannerPath)\n\n\t// Step 3: Run scanner on remote\n\tui.Say(fmt.Sprintf(\"Running scanner on remote host (scanning %s)...\", p.config.ScanPath))\n\tremoteSBOMPath, err := p.runScanner(ctx, ui, comm, remoteScannerPath, osType)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to run scanner: %s\", err)\n\t}\n\tdefer p.cleanupRemoteFile(ctx, ui, comm, remoteSBOMPath)\n\n\t// Step 4: Download SBOM from remote\n\tlog.Println(\"Downloading SBOM from remote host...\")\n\tsbomData, err := p.downloadSBOM(ctx, ui, comm, remoteSBOMPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to download SBOM: %s\", err)\n\t}\n\n\t// Step 5: Process SBOM for HCP (validate, compress, store)\n\tlog.Println(\"Processing SBOM for HCP Packer...\")\n\tif err := p.processSBOMForHCP(generatedData, sbomData); err != nil {\n\t\treturn fmt.Errorf(\"failed to process SBOM: %s\", err)\n\t}\n\n\tui.Say(\"Automatic SBOM generation completed successfully\")\n\treturn nil\n}\n\n// runScanner executes `packer sbom-generate` on the remote host.\nfunc (p *Provisioner) runScanner(ctx context.Context, ui packersdk.Ui,\n\tcomm packersdk.Communicator, scannerPath, osType string) (string, error) {\n\n\t// Determine output path based on OS\n\tvar outputPath string","sourceCodeStart":641,"sourceCodeEnd":677,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/provisioner/hcp-sbom/provisioner.go#L641-L677","documentation":"This wrapper error is returned by provisionWithNativeGeneration (provisioner/hcp-sbom/provisioner.go:659) when p.downloadSBOM fails to fetch the generated SBOM file from the remote machine via the communicator. It wraps the underlying communicator Download error, so the root cause (network, path, permissions) is embedded in the message. Packer throws it because the SBOM artifact cannot be retrieved from the guest after successful generation.","triggerScenarios":"Calling `packer build` with the hcp-sbom provisioner in native-generation mode when comm.Download(remoteSBOMPath, &buf) fails — e.g. the remote SBOM file was never created, was deleted by the cleanup defer, the SSH/WinRM connection dropped mid-download, or the guest path (/tmp/packer-sbom.json or C:\\Windows\\Temp\\packer-sbom.json) is unreadable.","commonSituations":"The scanner step appeared to succeed but wrote output to a different path due to a customized execute_command that does not redirect to {{.Output}}; SSH session timeouts on slow downloads; guest disk full or read-only /tmp; security tools (AppArmor/SELinux/AV) blocking the temp file; another cleanup racing the download.","solutions":["Check the full wrapped error message for the root cause (e.g. 'no such file' vs 'connection timed out') and fix that first.","Verify your custom execute_command redirects scanner output to {{.Output}} exactly; the download uses the fixed path /tmp/packer-sbom.json (or C:\\Windows\\Temp\\packer-sbom.json on Windows).","Re-run with PACKER_LOG=1 to see 'Downloading SBOM from ...' and the underlying communicator error details.","Ensure the guest temp directory is writable and not wiped between scanner run and download (e.g. provisioners running tmp cleaners).","If SSH connections drop on large transfers, retry or check guest network stability/host key settings."],"exampleFix":"// before: custom execute_command loses output\nexecute_command = \"chmod +x {{.Path}} && sudo {{.Path}} sbom-generate {{.Args}} {{.ScanPath}}\"\n// after: keep the redirect so the file exists at the expected remote path\nexecute_command = \"chmod +x {{.Path}} && sudo {{.Path}} sbom-generate {{.Args}} {{.ScanPath}} > {{.Output}}\"","handlingStrategy":"try-catch","validationCode":"// Before building: verify the scanner output path matches the fixed remote path\n// Unix: /tmp/packer-sbom.json ; Windows: C:\\Windows\\Temp\\packer-sbom.json\nstrings.Contains(cfg.ExecuteCommand, \"> {{.Output}}\") // must be true","typeGuard":null,"tryCatchPattern":"err := p.downloadSBOM(ctx, ui, comm, remoteSBOMPath)\nif err != nil {\n    return fmt.Errorf(\"failed to download SBOM: %w\", err) // inspect wrapped cause\n}","preventionTips":["Always keep `> {{.Output}}` in execute_command so the file lands at the expected remote path.","Avoid provisioner steps that wipe /tmp between scanner run and download.","Test SSH/SFTP download capability on the guest image before adding the SBOM provisioner.","Run builds with PACKER_LOG=1 in CI to capture transfer errors early."],"tags":["packer","sbom","provisioner","download","communicator"],"backgroundTag":"remote-file-download-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}