{"record":{"id":"830bf650f3718525","repo":"hashicorp/packer","slug":"invalid-bomformat-q-expected-cyclonedx","errorCode":null,"errorMessage":"invalid bomFormat: %q, expected CycloneDX","messagePattern":"invalid bomFormat: %q, expected CycloneDX","errorType":"validation","errorClass":"ValidationError","httpStatus":null,"severity":"error","filePath":"provisioner/hcp-sbom/validate.go","lineNumber":39,"sourceCode":"func (e *ValidationError) Error() string {\n\treturn e.Err.Error()\n}\n\nfunc (e *ValidationError) Unwrap() error {\n\treturn e.Err\n}\n\n// ValidateCycloneDX is a validation for CycloneDX in JSON format.\nfunc validateCycloneDX(content []byte) error {\n\tdecoder := cyclonedx.NewBOMDecoder(bytes.NewBuffer(content), cyclonedx.BOMFileFormatJSON)\n\tbom := new(cyclonedx.BOM)\n\tif err := decoder.Decode(bom); err != nil {\n\t\treturn fmt.Errorf(\"error parsing CycloneDX SBOM: %w\", err)\n\t}\n\n\tif !strings.EqualFold(bom.BOMFormat, \"CycloneDX\") {\n\t\treturn &ValidationError{\n\t\t\tErr: fmt.Errorf(\"invalid bomFormat: %q, expected CycloneDX\", bom.BOMFormat),\n\t\t}\n\t}\n\tif bom.SpecVersion.String() == \"\" {\n\t\treturn &ValidationError{\n\t\t\tErr: fmt.Errorf(\"specVersion is required\"),\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// validateSPDX is a validation for SPDX in JSON format.\nfunc validateSPDX(content []byte) error {\n\tdoc, err := spdxjson.Read(bytes.NewBuffer(content))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error parsing SPDX JSON file: %w\", err)\n\t}\n","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/provisioner/hcp-sbom/validate.go#L21-L57","documentation":"After successfully decoding as JSON, validateCycloneDX checks that bom.BOMFormat equals 'CycloneDX' (case-insensitive). This ValidationError is thrown when the document parses as JSON but its bomFormat field is absent or some other value, meaning it is not a CycloneDX document (or not identifiable as one).","triggerScenarios":"Content decodes without error but bom.BOMFormat is \"\" or something like \"SPDX\"/\"syft\" — e.g. an SPDX JSON document, a generic JSON file, or CycloneDX output with a missing/wrong bomFormat field, and validateSBOM fell through to the CycloneDX probe after SPDX parsing also failed.","commonSituations":"Pointing the provisioner at an SPDX JSON file whose parser also errored (so the CycloneDX check reports the format problem); hand-edited SBOM where bomFormat was removed or renamed; tools emitting only specVersion without bomFormat.","solutions":["Open the SBOM and check the top-level \"bomFormat\" field; it must be exactly \"CycloneDX\" (case-insensitive).","Re-generate the SBOM with -o cyclonedx-json (syft/trivy) instead of a generic or SPDX output.","If the file is actually SPDX, fix the SPDX document so validateSPDX succeeds (validateSBOM tries SPDX first).","Validate with an official CycloneDX validator (cyclonedx-cli validate) to catch schema issues.","Avoid hand-editing the bomFormat field of generated SBOMs."],"exampleFix":"// before (sbom.json)\n{ \"specVersion\": \"1.5\", \"components\": [] }\n// after\n{ \"bomFormat\": \"CycloneDX\", \"specVersion\": \"1.5\", \"components\": [] }","handlingStrategy":"validation","validationCode":"var probe struct {\n\tBOMFormat string `json:\"bomFormat\"`\n}\nif err := json.Unmarshal(content, &probe); err != nil || !strings.EqualFold(probe.BOMFormat, \"CycloneDX\") {\n\treturn fmt.Errorf(\"not a CycloneDX document: bomFormat=%q\", probe.BOMFormat)\n}","typeGuard":"func hasCycloneDXFormat(b any) bool {\n\tm, ok := b.(map[string]any)\n\tif !ok { return false }\n\tf, _ := m[\"bomFormat\"].(string)\n\treturn strings.EqualFold(f, \"CycloneDX\")\n}","tryCatchPattern":"var vErr *hcp_sbom.ValidationError\nif err := processSBOM(); err != nil {\n\tif errors.As(err, &vErr) && strings.Contains(vErr.Error(), \"invalid bomFormat\") {\n\t\t// inspect the file's bomFormat field, regenerate as cyclonedx-json\n\t}\n}","preventionTips":["Keep \"bomFormat\": \"CycloneDX\" intact in generated SBOMs.","Distinguish SPDX vs CycloneDX files by extension/content before provisioning.","Validate SBOMs with an official validator in CI.","Pin your SBOM generator version so output shape is stable."],"tags":["sbom","cyclonedx","validation","schema"],"backgroundTag":"invalid-sbom-format","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}