{"record":{"id":"2138ea3a70b5c9ac","repo":"hashicorp/packer","slug":"downloaded-sbom-is-empty","errorCode":null,"errorMessage":"downloaded SBOM is empty","messagePattern":"downloaded SBOM is empty","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"provisioner/hcp-sbom/provisioner.go","lineNumber":836,"sourceCode":"\t\treturn true\n\tdefault:\n\t\treturn false\n\t}\n}\n\n// downloadSBOM downloads the SBOM file from the remote host\nfunc (p *Provisioner) downloadSBOM(ctx context.Context, ui packersdk.Ui,\n\tcomm packersdk.Communicator, remotePath string) ([]byte, error) {\n\n\tvar buf bytes.Buffer\n\tlog.Printf(\"Downloading SBOM from %s...\", remotePath)\n\n\tif err := comm.Download(remotePath, &buf); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to download SBOM: %s\", err)\n\t}\n\n\tif buf.Len() == 0 {\n\t\treturn nil, fmt.Errorf(\"downloaded SBOM is empty\")\n\t}\n\n\tlog.Printf(\"Downloaded SBOM (%d bytes)\", buf.Len())\n\treturn buf.Bytes(), nil\n}\n\n// cleanupRemoteFile removes a file from the remote host.\nfunc (p *Provisioner) cleanupRemoteFile(ctx context.Context, ui packersdk.Ui,\n\tcomm packersdk.Communicator, remotePath string) {\n\n\tif remotePath == \"\" {\n\t\treturn\n\t}\n\n\tlog.Printf(\"Cleaning up remote file: %s\", remotePath)\n\n\t// Determine delete command based on path (Windows vs Unix)\n\tvar cmdStr string","sourceCodeStart":818,"sourceCodeEnd":854,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/provisioner/hcp-sbom/provisioner.go#L818-L854","documentation":"Returned by downloadSBOM (provisioner/hcp-sbom/provisioner.go:836) when the communicator reports a successful download but the received buffer is zero bytes. Packer treats an empty SBOM as invalid because validation and HCP upload cannot proceed with no content — usually the remote file was empty or truncated.","triggerScenarios":"The remote SBOM file exists but is 0 bytes: the scanner command redirected output to {{.Output}} but the generation produced nothing (tool failed silently, wrong args like a quiet flag), or the scanner wrote to stderr while stdout (redirected) stayed empty.","commonSituations":"execute_command redirecting stdout but scanner writing the SBOM to a file of its own choosing (double-output confusion); scanner crashing after opening the output file; disk-full on guest leaving a 0-byte file; scanner_args containing a version/help flag that prints to stderr and writes no SBOM.","solutions":["Check scanner stderr lines in the build log — an empty stdout usually means the tool errored after the redirect opened the file.","Verify scanner_args actually generate output (no --help/--version/--quiet flags) and match the bundled scanner version's CLI.","Test the exact execute_command on a similar guest manually and confirm /tmp/packer-sbom.json is non-empty.","Ensure the guest filesystem has free space and the scan path contains content to scan.","Remove custom output-file flags so the only sink is the `> {{.Output}}` redirect."],"exampleFix":"// before: scanner writes to its own file, stdout stays empty\nscanner_args = [\"--output\", \"/tmp/other.json\"]\n// after: let the provisioner's redirect capture the SBOM\nscanner_args = []","handlingStrategy":"validation","validationCode":"// After download, before processing:\nif buf.Len() == 0 {\n    // treat as generation failure: check scanner stderr before proceeding\n}","typeGuard":null,"tryCatchPattern":"data, err := p.downloadSBOM(ctx, ui, comm, remoteSBOMPath)\nif err != nil {\n    if strings.Contains(err.Error(), \"empty\") { /* scanner produced no output: check stderr */ }\n    return err\n}","preventionTips":["Do not pass --quiet/--help-style flags in scanner_args.","Let the `> {{.Output}}` redirect be the only output sink (no --output flags).","Confirm the scan path has content and the guest has free disk space.","Dry-run the exact execute_command manually and check the produced file size."],"tags":["packer","sbom","download","empty-output"],"backgroundTag":"empty-download-content","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}