{"record":{"id":"664a11e1fb3c47fb","repo":"hashicorp/packer","slug":"malformed-packer-sbom-output-from-file-q-s","errorCode":null,"errorMessage":"malformed packer SBOM output from file %q: %s","messagePattern":"malformed packer SBOM output from file %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packer/provisioner.go","lineNumber":398,"sourceCode":"\terr = p.Provisioner.Provision(ctx, ui, comm, generatedData)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tpackerSbom, err := os.Open(tmpFileName)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to open Packer SBOM file %q: %s\", tmpFileName, err)\n\t}\n\tdefer func() {\n\t\tif err := packerSbom.Close(); err != nil {\n\t\t\tlog.Printf(\"[WARN] Failed to close Packer SBOM file: %s\", err)\n\t\t}\n\t}()\n\n\tprovisionerOut := &hcpSbomProvisioner.PackerSBOM{}\n\terr = json.NewDecoder(packerSbom).Decode(provisionerOut)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"malformed packer SBOM output from file %q: %s\", tmpFileName, err)\n\t}\n\n\tencoder, err := zstd.NewWriter(nil, zstd.WithEncoderLevel(zstd.SpeedBestCompression))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create zstd encoder: %s\", err)\n\t}\n\tp.CompressedData = encoder.EncodeAll(provisionerOut.RawSBOM, nil)\n\tp.SBOMFormat = provisionerOut.Format\n\tp.SBOMName = provisionerOut.Name\n\n\treturn nil\n}\n","sourceCodeStart":380,"sourceCodeEnd":411,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/packer/provisioner.go#L380-L411","documentation":"Thrown when the JSON decoder cannot parse the contents of the SBOM temporary file into hcpSbomProvisioner.PackerSBOM. This means the SBOM written by the preceding provisioner step is absent, empty, or not valid JSON matching the expected shape (RawSBOM, Format, Name fields).","triggerScenarios":"Provision reads back the SBOM temp file with json.NewDecoder(...).Decode(&PackerSBOM{}) and the decode fails because the file is empty, truncated, or not the expected JSON structure.","commonSituations":"A chained SBOM provisioner (e.g. the syft/cyclonedx datasource step) silently produced no output; disk-full during write left a truncated file; plugin version mismatch produces a different JSON schema.","solutions":["Verify the SBOM-producing step (e.g. the SBOM datasource/provisioner) ran and completed successfully before this point","Inspect the quoted temp file contents if it still exists to see whether it is empty or malformed","Ensure the SBOM-producing plugin and Packer versions are compatible","Free disk space and rerun — truncation from a full disk is a common cause"],"exampleFix":"// before\nerr = json.NewDecoder(packerSbom).Decode(provisionerOut)\nif err != nil {\n  return fmt.Errorf(\"malformed packer SBOM output from file %q: %s\", tmpFileName, err)\n}\n// after\nerr = json.NewDecoder(packerSbom).Decode(provisionerOut)\nif err != nil {\n  return fmt.Errorf(\"malformed packer SBOM output from file %q: %w\", tmpFileName, err)\n}","handlingStrategy":"validation","validationCode":"// Go: validate your SBOM-producing step output is valid JSON before the build chain\nf, err := os.Open(sbomPath)\nif err != nil { log.Fatal(err) }\ndec := json.NewDecoder(f)\nvar probe map[string]json.RawMessage\nif err := dec.Decode(&probe); err != nil {\n    log.Fatalf(\"SBOM step output not valid JSON: %v\", err)\n}\nfor _, k := range []string{\"RawSBOM\", \"Format\", \"Name\"} {\n    if _, ok := probe[k]; !ok {\n        log.Fatalf(\"SBOM JSON missing expected key %q\", k)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := p.Provision(ctx, ui, comm, data); err != nil {\n    if strings.HasPrefix(err.Error(), \"malformed packer SBOM output\") {\n        // inspect the upstream SBOM provisioner/datasource logs\n    }\n    return err\n}","preventionTips":["Confirm the SBOM-producing plugin version matches your Packer version","Ensure the SBOM step succeeds (check its logs) before dependent steps","Keep ample disk space so the temp file isn't truncated","Run packer validate and a small test build when upgrading SBOM tooling"],"tags":["go","json","sbom","decoding"],"backgroundTag":"json-decode-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}