{"record":{"id":"9811337733e0cd23","repo":"hashicorp/packer","slug":"error-validating-sbom-file-invalid-sbom-format","errorCode":null,"errorMessage":"error validating SBOM file: invalid SBOM format","messagePattern":"error validating SBOM file: invalid SBOM format","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"provisioner/hcp-sbom/validate.go","lineNumber":88,"sourceCode":"\tspdxErr := validateSPDX(content)\n\tif spdxErr == nil {\n\t\treturn hcpPackerModels.HashicorpCloudPacker20230101SbomFormatSPDX, nil\n\t}\n\n\tif vErr, ok := spdxErr.(*ValidationError); ok {\n\t\treturn \"\", vErr\n\t}\n\n\tcycloneDxErr := validateCycloneDX(content)\n\tif cycloneDxErr == nil {\n\t\treturn hcpPackerModels.HashicorpCloudPacker20230101SbomFormatCYCLONEDX, nil\n\t}\n\n\tif vErr, ok := cycloneDxErr.(*ValidationError); ok {\n\t\treturn \"\", vErr\n\t}\n\n\treturn \"\", fmt.Errorf(\"error validating SBOM file: invalid SBOM format\")\n}\n","sourceCodeStart":70,"sourceCodeEnd":90,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/provisioner/hcp-sbom/validate.go#L70-L90","documentation":"This is the final fallback error of validateSBOM: the content failed SPDX parsing with a non-ValidationError error, and also failed CycloneDX parsing with a non-ValidationError error, so the provisioner cannot identify the SBOM as either supported format. It is returned before any HCP processing, aborting the provision run.","triggerScenarios":"validateSBOM is called from processSBOMForHCP with content that is neither valid SPDX JSON nor valid CycloneDX JSON — e.g. empty bytes, HTML/XML output, YAML SBOM, a raw binary blob, or a heavily corrupted JSON file.","commonSituations":"The SBOM-generation step inside the build failed and produced empty/log output that was then passed to the provisioner; user supplied a CycloneDX XML or SPDX tag-value (.spdx) file instead of JSON; wrong file path grabbed (e.g. a README); encoding issues (UTF-16 output from PowerShell redirection).","solutions":["Inspect the actual SBOM file: file sbom.json && head -c 200 sbom.json — it must start with '{' and be valid JSON.","Re-run the SBOM generator so it emits CycloneDX JSON or SPDX 2.x JSON (syft -o cyclonedx-json or -o spdx-json).","Convert non-JSON formats (XML, tag-value, RDF) to JSON with cyclonedx-cli or pyspdxtools before use.","Check the earlier build step logs for SBOM-generation failures that produced empty/invalid output.","Verify file encoding is UTF-8 without BOM; UTF-16 output (common with PowerShell) will not parse."],"exampleFix":"// before: tag-value SPDX file passed in\n$ syft packages -o spdx-tag-value . > sbom.spdx\n// after: JSON output accepted by the validator\n$ syft packages -o spdx-json . > sbom.json","handlingStrategy":"validation","validationCode":"func isSupportedSBOM(content []byte) bool {\n\tvar probe struct {\n\t\tBOMFormat   string `json:\"bomFormat\"`\n\t\tSpecVersion string `json:\"specVersion\"`\n\t\tSPDXVersion string `json:\"spdxVersion\"`\n\t}\n\tif err := json.Unmarshal(content, &probe); err != nil {\n\t\treturn false\n\t}\n\treturn (strings.EqualFold(probe.BOMFormat, \"CycloneDX\") && probe.SpecVersion != \"\") ||\n\t\tstrings.HasPrefix(probe.SPDXVersion, \"SPDX-2.\")\n}\n// guard before invoking the provisioner","typeGuard":"func isJSONDoc(b any) bool {\n\t_, ok := b.(map[string]any)\n\treturn ok\n}","tryCatchPattern":"if err := packerBuild(); err != nil {\n\tif strings.Contains(err.Error(), \"invalid SBOM format\") {\n\t\t// inspect sbom.json: must be CycloneDX JSON or SPDX 2.x JSON;\n\t\t// regenerate (syft -o cyclonedx-json / -o spdx-json) and retry\n\t}\n}","preventionTips":["Verify the SBOM file is non-empty, valid JSON, and UTF-8 (no BOM/UTF-16) before building.","Only supply CycloneDX JSON or SPDX 2.x JSON — not XML, tag-value, RDF, or YAML.","Check the in-build SBOM-generation step's logs and exit code; a failed step often yields garbage input.","Run a format-validation CI gate on SBOM artifacts before invoking Packer."],"tags":["sbom","validation","format","parsing"],"backgroundTag":"invalid-sbom-format","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}