{"record":{"id":"6d68f4b357b861b9","repo":"hashicorp/packer","slug":"unsupported-sbom-format-q","errorCode":null,"errorMessage":"unsupported SBOM format %q","messagePattern":"unsupported SBOM format %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"post-processor/provenance/post-processor.go","lineNumber":513,"sourceCode":"\treturn \"\", fmt.Errorf(\"sbom=true requires local artifact files or sbom_scan_path\")\n}\n\nfunc buildSBOMPredicate(rawSBOM []byte, format internalsbom.Format) (interface{}, string, error) {\n\tdecoder := json.NewDecoder(bytes.NewReader(rawSBOM))\n\tdecoder.UseNumber()\n\n\tvar predicate interface{}\n\tif err := decoder.Decode(&predicate); err != nil {\n\t\treturn nil, \"\", fmt.Errorf(\"decode SBOM payload: %w\", err)\n\t}\n\n\tswitch format {\n\tcase internalsbom.FormatCycloneDX:\n\t\treturn predicate, predicateTypeCycloneDX, nil\n\tcase internalsbom.FormatSPDX:\n\t\treturn predicate, predicateTypeSPDX, nil\n\tdefault:\n\t\treturn nil, \"\", fmt.Errorf(\"unsupported SBOM format %q\", format)\n\t}\n}\n\nfunc (p *PostProcessor) externalParameters(env map[string]string) map[string]interface{} {\n\texternalParameters := map[string]interface{}{}\n\n\tif p.config.TemplatePath != \"\" {\n\t\texternalParameters[\"template\"] = p.config.TemplatePath\n\t}\n\tif len(p.config.OnlyBuilds) > 0 {\n\t\texternalParameters[\"onlyBuilds\"] = append([]string(nil), p.config.OnlyBuilds...)\n\t}\n\n\tuserVariables := collectUserVariables(env)\n\tfor key, value := range p.config.UserVariables {\n\t\tuserVariables[key] = value\n\t}\n\tredactSensitiveVariables(userVariables, p.config.PackerSensitiveVars)","sourceCodeStart":495,"sourceCodeEnd":531,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/post-processor/provenance/post-processor.go#L495-L531","documentation":"The SBOM format value resolved to something other than CycloneDX or SPDX, the two formats the attestation builder supports. ParseFormatFromArgs elsewhere accepts more aliases, so this fires only when an unexpected format reaches buildSBOMPredicate.","triggerScenarios":"buildSBOMPredicate receives a format value not in {FormatCycloneDX, FormatSPDX} — possible only if internalsbom gains a new format or the format was resolved inconsistently (e.g. custom/unknown sbom_format string that parsed successfully but has no attestation predicate type).","commonSituations":"Setting sbom_format to an unsupported string like \"json\" or \"custom\"; upgrading the SDK/internalsbom package so a new format exists without a mapping here.","solutions":["Set sbom_format to \"cyclonedx-json\" or \"spdx-json\"","Check the config value for typos or extra quoting","Upgrade/downgrade the provenance post-processor so format and attestation mappings match"],"exampleFix":"// before\nsbom_format = \"json\"\n// after\nsbom_format = \"cyclonedx-json\"","handlingStrategy":"validation","validationCode":"// Pre-check sbom_format against supported attestation formats:\nsupported := map[string]bool{\"cyclonedx-json\": true, \"spdx-json\": true}\nif !supported[strings.ToLower(cfg.SBOMFormat)] {\n    fmt.Println(\"sbom_format must be cyclonedx-json or spdx-json\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use only documented sbom_format values: cyclonedx-json or spdx-json","Re-check config after upgrading packer/internalsbom versions","Avoid passing free-form strings like \"json\" or \"xml\""],"tags":["packer","provenance","sbom","config"],"backgroundTag":"unsupported-sbom-format","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}