{"record":{"id":"2654fd9ae8a4b413","repo":"hashicorp/packer","slug":"sbom-validation-failed-s","errorCode":null,"errorMessage":"SBOM validation failed: %s","messagePattern":"SBOM validation failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"provisioner/hcp-sbom/provisioner.go","lineNumber":881,"sourceCode":"\t}\n\n\tif err := comm.Start(ctx, cmd); err != nil {\n\t\tui.Error(fmt.Sprintf(\"Failed to cleanup: %s\", err))\n\t\treturn\n\t}\n\n\tcmd.Wait()\n\tif cmd.ExitStatus() != 0 {\n\t\tui.Error(fmt.Sprintf(\"Cleanup command failed for %s with exit status %d\", remotePath, cmd.ExitStatus()))\n\t}\n}\n\n// processSBOMForHCP validates, compresses, and prepares SBOM for HCP upload\nfunc (p *Provisioner) processSBOMForHCP(generatedData map[string]interface{}, sbomData []byte) error {\n\t// Validate SBOM format\n\tformat, err := validateSBOM(sbomData)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"SBOM validation failed: %s\", err)\n\t}\n\n\t// Get destination path from generatedData\n\tpkrDst, ok := generatedData[\"dst\"].(string)\n\tif !ok || pkrDst == \"\" {\n\t\treturn fmt.Errorf(\"packer destination path missing from configs: this is an internal error\")\n\t}\n\n\t// Write PackerSBOM to destination\n\toutFile, err := os.Create(pkrDst)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create output file %q: %s\", pkrDst, err)\n\t}\n\tdefer func() {\n\t\t_ = outFile.Close() // Cleanup, ignore error\n\t}()\n\n\terr = json.NewEncoder(outFile).Encode(PackerSBOM{","sourceCodeStart":863,"sourceCodeEnd":899,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/provisioner/hcp-sbom/provisioner.go#L863-L899","documentation":"Returned by processSBOMForHCP (provisioner/hcp-sbom/provisioner.go:881) when validateSBOM rejects the downloaded SBOM bytes. Packer requires a recognizable SBOM format (SPDX or CycloneDX JSON) before storing it for HCP upload, so unrecognized, truncated, or non-JSON content aborts processing.","triggerScenarios":"Downloaded bytes fail validateSBOM: scanner produced a text/table report instead of JSON, output was truncated mid-write, an HTML error page or log text got redirected into the output file, or the scanner emitted an unsupported SBOM version.","commonSituations":"scanner_args forcing human-readable format (--format table/text); scanner printing warnings to stdout before the JSON corrupting the document; old scanner version emitting an unsupported format; guest locale/encoding mangling output; mixing this provisioner with an execute_command meant for a different tool.","solutions":["Read the inner validateSBOM error — it names whether the content was unparseable JSON or an unknown format/BOM.","Set scanner_args to request JSON output explicitly (e.g. spdx-json or cyclonedx-json format for syft-style tools).","Inspect the generated SBOM content (scanner stdout in the log, or the remote file) for stray log lines or truncation.","Update the guest scanner binary version so it emits a supported, current SBOM format.","Ensure execute_command does not prepend commands that print to stdout before the redirect (they corrupt the file)."],"exampleFix":"// before: human-readable output fails validation\nscanner_args = [\"--format\", \"table\"]\n// after: valid machine-readable SBOM\nscanner_args = [\"--format\", \"spdx-json\"]","handlingStrategy":"validation","validationCode":"// Validate the SBOM before handing it to the provisioner\nvar probe map[string]interface{}\nif json.Unmarshal(sbomBytes, &probe) != nil { /* not JSON: scanner args are wrong */ }\n// require a known SBOM envelope\nif _, ok := probe[\"bomFormat\"]; !ok {\n    if _, ok := probe[\"spdxVersion\"]; !ok { /* unknown SBOM format */ }\n}","typeGuard":null,"tryCatchPattern":"if err := p.processSBOMForHCP(generatedData, sbomData); err != nil {\n    if strings.Contains(err.Error(), \"validation failed\") { /* fix scanner format args */ }\n    return err\n}","preventionTips":["Always request JSON SBOM formats (spdx-json or cyclonedx-json).","Keep commands before the redirect from printing to stdout.","Pin the guest scanner version to one emitting a supported format.","Spot-check the generated SBOM JSON in a test build."],"tags":["packer","sbom","validation","format"],"backgroundTag":"sbom-validation-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}