{"record":{"id":"5e34ff07c79e7227","repo":"hashicorp/packer","slug":"failed-to-render-execute-command-s","errorCode":null,"errorMessage":"failed to render execute_command: %s","messagePattern":"failed to render execute_command: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"provisioner/hcp-sbom/provisioner.go","lineNumber":714,"sourceCode":"\t// Use Windows-specific default if on Windows and user hasn't customized\n\texecuteCommand := p.config.ExecuteCommand\n\tif isWindows && executeCommand == \"chmod +x {{.Path}} && sudo {{.Path}} sbom-generate {{.Args}} {{.ScanPath}} > {{.Output}}\" {\n\t\t// User didn't customize, use Windows default (no sudo, uses sbom-generate subcommand).\n\t\texecuteCommand = \"{{.Path}} sbom-generate {{.Args}} {{.ScanPath}} > {{.Output}}\"\n\t}\n\n\t// Backward compatibility: older execute_command templates omitted the\n\t// sbom-generate subcommand and invoked the scanner binary directly.\n\tnormalizedExecuteCommand := normalizeScannerExecuteCommand(executeCommand)\n\tif normalizedExecuteCommand != executeCommand {\n\t\tlog.Printf(\"[INFO] execute_command compatibility: injected 'sbom-generate' subcommand\")\n\t\texecuteCommand = normalizedExecuteCommand\n\t}\n\n\t// Render the execute command template\n\tcmdStr, err := interpolate.Render(executeCommand, &renderCtx)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to render execute_command: %s\", err)\n\t}\n\n\t// For Windows with elevated user, wrap command with elevated runner\n\tif isWindows && p.config.ElevatedUser != \"\" {\n\t\tlog.Printf(\"Using elevated user '%s' for scanner execution\", p.config.ElevatedUser)\n\t\televatedCmd, err := guestexec.GenerateElevatedRunner(cmdStr, p)\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"failed to generate elevated runner: %s\", err)\n\t\t}\n\t\tcmdStr = elevatedCmd\n\t}\n\n\tlog.Printf(\"Executing: %s\", cmdStr)\n\n\t// Execute scanner\n\tvar stdout, stderr bytes.Buffer\n\tcmd := &packersdk.RemoteCmd{\n\t\tCommand: cmdStr,","sourceCodeStart":696,"sourceCodeEnd":732,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/provisioner/hcp-sbom/provisioner.go#L696-L732","documentation":"Returned by runScanner (provisioner/hcp-sbom/provisioner.go:714) when interpolate.Render fails to render the user-supplied execute_command template against the restricted template data (Path, Args, ScanPath, Output). Packer validates template syntax before executing anything on the guest, so a bad template aborts before any scanner run.","triggerScenarios":"Setting execute_command in the hcp-sbom provisioner block with malformed Go template syntax (unbalanced {{ }}, stray backticks), or referencing an unknown field like {{.Foo}} that the interpolation context cannot resolve.","commonSituations":"Copy-pasting execute_command from other provisioners (shell/file) that allow different variables; hand-editing templates and leaving {{.Path}} half-deleted; HCL quoting issues that mangle the {{ }} delimiters; referencing Packer variables that were not passed into this provisioner's ctx.","solutions":["Fix the template syntax in execute_command: balance all {{ }} delimiters and escape literal braces when needed.","Only use the supported keys: {{.Path}}, {{.Args}}, {{.ScanPath}}, {{.Output}}; remove or replace any other {{.X}} references.","Start from the documented default: \"chmod +x {{.Path}} && sudo {{.Path}} sbom-generate {{.Args}} {{.ScanPath}} > {{.Output}}\" and edit incrementally.","Run `packer validate` (or `packer hcl2_upgrade` for JSON templates) before building to catch template errors early.","Check PACKER_LOG=1 output for the exact render error text pointing at the offending token."],"exampleFix":"// before: unknown key and unbalanced braces\nexecute_command = \"chmod +x {{.Path} && {{.Source}} scan {{.ScanPath}}\"\n// after: balanced syntax, supported keys only\nexecute_command = \"chmod +x {{.Path}} && sudo {{.Path}} sbom-generate {{.Args}} {{.ScanPath}} > {{.Output}}\"","handlingStrategy":"validation","validationCode":"// Validate template before building\nmustContain := []string{\"{{.Path}}\", \"{{.Output}}\"}\nfor _, tok := range mustContain {\n    if !strings.Contains(cfg.ExecuteCommand, tok) { /* fail fast: bad template */ }\n}\n// reject unsupported keys like {{.Foo}} with a regex check","typeGuard":null,"tryCatchPattern":"cmdStr, err := interpolate.Render(executeCommand, &renderCtx)\nif err != nil {\n    return \"\", fmt.Errorf(\"failed to render execute_command: %w\", err)\n}","preventionTips":["Run `packer validate` before every build.","Use only documented keys: {{.Path}}, {{.Args}}, {{.ScanPath}}, {{.Output}}.","Start from the documented default execute_command and edit incrementally.","Watch HCL quoting: braces inside strings can be mangled."],"tags":["packer","template","provisioner","interpolation"],"backgroundTag":"template-render-error","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}