{"record":{"id":"2fee9282afc7e5d8","repo":"hashicorp/packer","slug":"sbom-name-q-doesn-t-match-the-expected-format","errorCode":null,"errorMessage":"`sbom_name` %q doesn't match the expected format, it must contain between 3 and 36 characters, all from the following set: [A-Za-z0-9_-]","messagePattern":"`sbom_name` %q doesn't match the expected format, it must contain between 3 and 36 characters, all from the following set: \\[A-Za-z0-9_-\\]","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"provisioner/hcp-sbom/provisioner.go","lineNumber":258,"sourceCode":"\t}\n\n\tif p.config.SbomName != \"\" && !sbomFormatRegexp.MatchString(p.config.SbomName) {\n\t\t// Ugly but a bit of a problem with interpolation since Provisioners\n\t\t// are prepared twice in HCL2.\n\t\t//\n\t\t// If the information used for interpolating is populated in-between the\n\t\t// first call to Prepare (at the start of the build), and when the\n\t\t// Provisioner is actually called, the first call will fail, as\n\t\t// the value won't contain the actual interpolated value, but a\n\t\t// placeholder which doesn't match the regex.\n\t\t//\n\t\t// Since we don't have a way to discriminate between the calls\n\t\t// in the context of the provisioner, we ignore them, and later the\n\t\t// HCP Packer call will fail because of the broken regex.\n\t\tif strings.Contains(p.config.SbomName, \"<no value>\") {\n\t\t\tlog.Printf(\"[WARN] interpolation incomplete for `sbom_name`, will possibly retry later with data populated into context, otherwise will fail when uploading to HCP Packer.\")\n\t\t} else {\n\t\t\terrs = packersdk.MultiErrorAppend(errs, fmt.Errorf(\"`sbom_name` %q doesn't match the expected format, it must \"+\n\t\t\t\t\"contain between 3 and 36 characters, all from the following set: [A-Za-z0-9_-]\", p.config.SbomName))\n\t\t}\n\t}\n\n\treturn errs\n}\n\n// PackerSBOM is the type we write to the temporary JSON dump of the SBOM to\n// be consumed by Packer core\ntype PackerSBOM struct {\n\t// RawSBOM is the raw data from the SBOM downloaded from the guest\n\tRawSBOM []byte `json:\"raw_sbom\"`\n\t// Format is the format detected by the provisioner\n\t//\n\t// Supported values: `SPDX` or `CYCLONEDX`\n\tFormat hcpPackerModels.HashicorpCloudPacker20230101SbomFormat `json:\"format\"`\n\t// Name is the name of the SBOM to be set on HCP Packer\n\t//","sourceCodeStart":240,"sourceCodeEnd":276,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/provisioner/hcp-sbom/provisioner.go#L240-L276","documentation":"Prepare-time validation error from the hcp-sbom provisioner: the optional `sbom_name` set in the template fails sbomFormatRegexp (3-36 chars from [A-Za-z0-9_-]). HCP Packer enforces this format, so invalid names are rejected early. As a special case, names still containing the literal '<no value>' (incomplete HCL2 interpolation — Prepare runs twice) only produce a warning, since a later Prepare/Provision call may see the fully interpolated value.","triggerScenarios":"config.SbomName is non-empty, fails the regex, and does NOT contain '<no value>' — e.g. it is too short (<3), too long (>36), or contains characters like spaces, dots, slashes, or ':' during p.config Prepare in Prepare().","commonSituations":"Using a human-readable name with spaces or dots ('my.sbom v1'); interpolating HCP Packer variables that resolve too long; typos making the name 1-2 chars; accidentally passing a full path instead of a bare name.","solutions":["Rename `sbom_name` to 3-36 characters using only letters, digits, underscore, and hyphen.","If the name comes from interpolation, check the resolved value length and content (e.g. use tr/slugify via a local).","Remember Prepare runs twice in HCL2: if you see '<no value>' warnings, the final interpolated value must still satisfy the regex or the HCP upload will fail later.","Drop `sbom_name` entirely to let HCP Packer generate one."],"exampleFix":"// before\nsbom_name = \"My SBOM (final)\"\n// after\nsbom_name = \"my-sbom-final\"","handlingStrategy":"validation","validationCode":"var sbomNameRe = regexp.MustCompile(`^[A-Za-z0-9_-]{3,36}$`)\nfunc validateSbomName(name string) error {\n\tif name == \"\" || strings.Contains(name, \"<no value>\") {\n\t\treturn nil // unset or still interpolating\n\t}\n\tif !sbomNameRe.MatchString(name) {\n\t\treturn fmt.Errorf(\"sbom_name %q must be 3-36 chars from [A-Za-z0-9_-]\", name)\n\t}\n\treturn nil\n}","typeGuard":"func sbomNameIsValid(s string) bool {\n\treturn len(s) >= 3 && len(s) <= 36 && !strings.ContainsFunc(s, func(r rune) bool {\n\t\treturn !(r >= 'A' && r <= 'Z' || r >= 'a' && r <= 'z' || r >= '0' && r <= '9' || r == '_' || r == '-')\n\t})\n}","tryCatchPattern":"if err := packerBuild(...); err != nil {\n\tif strings.Contains(err.Error(), \"doesn't match the expected format\") {\n\t\treturn fmt.Errorf(\"fix `sbom_name` in your template: 3-36 chars, [A-Za-z0-9_-] only: %w\", err)\n\t}\n}","preventionTips":["Validate sbom_name against ^[A-Za-z0-9_-]{3,36}$ before running packer build","Avoid spaces, dots, slashes and ':' in names; slugify interpolated values","Watch for '<no value>' warnings — the final interpolated name must still pass the regex","Omit sbom_name to let HCP Packer auto-generate one"],"tags":["validation","config","hcl2","hcp-sbom"],"backgroundTag":"invalid-config-value","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}