{"record":{"id":"3a005d9667c0943c","repo":"hashicorp/packer","slug":"http-d-for-s","errorCode":null,"errorMessage":"HTTP %d for %s","messagePattern":"HTTP (.+?) for (.+?)","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"provisioner/hcp-sbom/packer_release_fetch.go","lineNumber":70,"sourceCode":"// fetchLatestPackerVersion queries the HashiCorp releases index, sorts all\n// stable (non-prerelease) versions with semver, and returns the highest one.\nfunc fetchLatestPackerVersion(ctx context.Context, client *http.Client) (string, error) {\n\tindexURL := getReleaseBaseURL() + \"/packer/index.json\"\n\tvar indexData releaseIndex\n\n\treq, err := http.NewRequestWithContext(ctx, http.MethodGet, indexURL, nil)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to build index request: %w\", err)\n\t}\n\n\tresp, err := client.Do(req)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to fetch release index: %w\", err)\n\t}\n\tdefer func() { _ = resp.Body.Close() }()\n\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn \"\", fmt.Errorf(\"HTTP %d for %s\", resp.StatusCode, indexURL)\n\t}\n\n\terr = json.NewDecoder(resp.Body).Decode(&indexData)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to retrieve packer release index from %s: %w\", indexURL, err)\n\t}\n\n\tvar semverList []*semver.Version\n\tfor vStr := range indexData.Versions {\n\t\tv, parseErr := semver.NewVersion(vStr)\n\t\tif parseErr != nil {\n\t\t\tcontinue\n\t\t}\n\t\tif v.Prerelease() != \"\" {\n\t\t\tcontinue // skip alpha/beta/rc\n\t\t}\n\t\tsemverList = append(semverList, v)\n\t}","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/provisioner/hcp-sbom/packer_release_fetch.go#L52-L88","documentation":"The Packer releases index responded with a non-200 HTTP status code. fetchLatestPackerVersion requires 200 OK before decoding the JSON index and returns the status code plus the requested URL verbatim so the caller can see which endpoint misbehaved. This indicates a server-side or routing problem rather than a local network failure.","triggerScenarios":"GET https://releases.hashicorp.com/packer/index.json returned e.g. 403 (blocked by CDN/WAF, geo or rate limiting), 404 (endpoint moved), 5xx (server error), or an unexpected status like 301/403 from a misbehaving proxy.","commonSituations":"Corporate proxy or security appliance rewriting/blocking the request; rate limiting from shared CI egress IPs; HashiCorp releases outage; a redirect-to-error-page proxy returning 302/502.","solutions":["Check the reported status code: 403/429 suggests proxy/WAF/rate limiting; 5xx suggests a server-side outage.","Retry after a delay if 429/5xx — the index is static content and transient errors are common under rate limiting.","Curl the URL manually from the affected environment to reproduce and inspect response headers/body.","Bypass or fix any corporate proxy/SSL-inspection appliance that is rewriting the response.","Check status.hashicorp.com for a releases endpoint incident."],"exampleFix":"// before: proxy returns 403 for releases.hashicorp.com\n// curl -I https://releases.hashicorp.com/packer/index.json -> HTTP/1.1 403\n\n// after: allowlist the host in the proxy policy\n// curl -I -> HTTP/2 200","handlingStrategy":"retry","validationCode":"resp, err := client.Get(\"https://releases.hashicorp.com/packer/index.json\")\nif err == nil {\n\tok := resp.StatusCode == http.StatusOK\n\tresp.Body.Close()\n\tif !ok {\n\t\treturn errors.New(\"releases endpoint currently returning non-200; retry later\")\n\t}\n}","typeGuard":"func isBadStatus(err error) (bool, int) {\n\tre := regexp.MustCompile(`HTTP (\\d+) for`)\n\tif m := re.FindStringSubmatch(err.Error()); m != nil {\n\t\tn, _ := strconv.Atoi(m[1])\n\t\treturn n != http.StatusOK, n\n\t}\n\treturn false, 0\n}","tryCatchPattern":"ver, err := fetchLatestPackerVersion(ctx, client)\nif err != nil {\n\tif bad, code := isBadStatus(err); bad && (code == 429 || code >= 500) {\n\t\t// back off and retry once\n\t\ttime.Sleep(time.Minute)\n\t\tver, err = fetchLatestPackerVersion(ctx, client)\n\t}\n\tif err != nil {\n\t\treturn err\n\t}\n}","preventionTips":["Allowlist releases.hashicorp.com in proxy/WAF/egress policies.","Add exponential backoff for 429/5xx responses.","Monitor status.hashicorp.com during build windows.","Avoid shared rate-limited egress IPs for large CI fleets."],"tags":["http","network","http-status"],"backgroundTag":"http-non-200-response","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}