{"record":{"id":"a1fa3a96b0e6bade","repo":"hashicorp/packer","slug":"error-parsing-spdx-json-file-w","errorCode":null,"errorMessage":"error parsing SPDX JSON file: %w","messagePattern":"error parsing SPDX JSON file: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"provisioner/hcp-sbom/validate.go","lineNumber":55,"sourceCode":"\tif !strings.EqualFold(bom.BOMFormat, \"CycloneDX\") {\n\t\treturn &ValidationError{\n\t\t\tErr: fmt.Errorf(\"invalid bomFormat: %q, expected CycloneDX\", bom.BOMFormat),\n\t\t}\n\t}\n\tif bom.SpecVersion.String() == \"\" {\n\t\treturn &ValidationError{\n\t\t\tErr: fmt.Errorf(\"specVersion is required\"),\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// validateSPDX is a validation for SPDX in JSON format.\nfunc validateSPDX(content []byte) error {\n\tdoc, err := spdxjson.Read(bytes.NewBuffer(content))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error parsing SPDX JSON file: %w\", err)\n\t}\n\n\tif doc.SPDXVersion == \"\" {\n\t\treturn &ValidationError{\n\t\t\tErr: fmt.Errorf(\"missing SPDXVersion\"),\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// validateSBOM validates the SBOM file and returns the format of the SBOM.\nfunc validateSBOM(content []byte) (hcpPackerModels.HashicorpCloudPacker20230101SbomFormat, error) {\n\t// Try validating as SPDX\n\tspdxErr := validateSPDX(content)\n\tif spdxErr == nil {\n\t\treturn hcpPackerModels.HashicorpCloudPacker20230101SbomFormatSPDX, nil\n\t}","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/provisioner/hcp-sbom/validate.go#L37-L73","documentation":"validateSPDX parses the content as SPDX JSON via spdx tools-golang's spdxjson.Read. This error wraps any parsing error — invalid JSON, or JSON that does not conform to the SPDX 2.x document structure the parser expects. In validateSBOM, an SPDX parse error (as opposed to a ValidationError) is a signal to try CycloneDX next, so users may see this text indirectly in the final 'invalid SBOM format' error.","triggerScenarios":"validateSBOM probes the content as SPDX first and spdxjson.Read returns an error because the content is not valid SPDX JSON (malformed JSON, wrong field types, missing required SPDX fields like spdxVersion/documents structure, or the content is CycloneDX/other format entirely).","commonSituations":"A CycloneDX JSON document is supplied (SPDX parser rejects it first); a SPDX 3.0 document that tools-golang json (SPDX 2.x) cannot parse; truncated or corrupted SBOM output; HTML error page saved as .json.","solutions":["Validate the file is valid JSON and matches SPDX 2.x schema (jq . sbom.json; spdx validator).","If the document is CycloneDX, ensure it is complete — the CycloneDX probe will accept it only if SPDX parse failed AND CycloneDX parse succeeds.","Re-generate with an SPDX 2.x JSON output: syft packages -o spdx-json . > sbom.json.","For SPDX 3.0 content, downgrade output to SPDX 2.3 JSON, as the parser targets SPDX 2.x.","Check the file is not truncated or wrapped in non-JSON output (logs, HTML)."],"exampleFix":"// before: SPDX 3.x JSON not readable by tools-golang json reader\n$ syft packages -o spdx-json@3.0 . > sbom.json\n// after: emit SPDX 2.3 JSON\n$ syft packages -o spdx-json . > sbom.json","handlingStrategy":"validation","validationCode":"func looksLikeSPDXJSON(content []byte) bool {\n\tvar probe struct {\n\t\tSPDXVersion string `json:\"spdxVersion\"`\n\t}\n\tif err := json.Unmarshal(content, &probe); err != nil {\n\t\treturn false\n\t}\n\treturn strings.HasPrefix(probe.SPDXVersion, \"SPDX-2.\")\n}","typeGuard":"func isSPDX2(b any) bool {\n\tm, ok := b.(map[string]any)\n\tif !ok { return false }\n\tv, _ := m[\"spdxVersion\"].(string)\n\treturn strings.HasPrefix(v, \"SPDX-2.\")\n}","tryCatchPattern":"if err := processSBOM(); err != nil {\n\tif strings.Contains(err.Error(), \"error parsing SPDX JSON file\") ||\n\t\tstrings.Contains(err.Error(), \"invalid SBOM format\") {\n\t\t// content is not SPDX 2.x JSON; regenerate with -o spdx-json or emit cyclonedx-json\n\t}\n}","preventionTips":["Emit SPDX 2.x JSON (spdx-json), not SPDX 3.0 JSON, which tools-golang json cannot read.","Verify SBOM files start with '{' and parse with jq before provisioning.","Check generator exit codes so partial output is never consumed.","Keep generator tooling versions pinned and current."],"tags":["sbom","spdx","json","parsing"],"backgroundTag":"invalid-sbom-format","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}