{"record":{"id":"b82735aa710bc77e","repo":"hashicorp/packer","slug":"failed-to-build-index-request-w","errorCode":null,"errorMessage":"failed to build index request: %w","messagePattern":"failed to build index request: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"provisioner/hcp-sbom/packer_release_fetch.go","lineNumber":60,"sourceCode":"}\n\n// releaseBuild represents one platform build inside a release version.\ntype releaseBuild struct {\n\tOS       string `json:\"os\"`\n\tArch     string `json:\"arch\"`\n\tFilename string `json:\"filename\"`\n\tURL      string `json:\"url\"`\n}\n\n// fetchLatestPackerVersion queries the HashiCorp releases index, sorts all\n// stable (non-prerelease) versions with semver, and returns the highest one.\nfunc fetchLatestPackerVersion(ctx context.Context, client *http.Client) (string, error) {\n\tindexURL := getReleaseBaseURL() + \"/packer/index.json\"\n\tvar indexData releaseIndex\n\n\treq, err := http.NewRequestWithContext(ctx, http.MethodGet, indexURL, nil)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to build index request: %w\", err)\n\t}\n\n\tresp, err := client.Do(req)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to fetch release index: %w\", err)\n\t}\n\tdefer func() { _ = resp.Body.Close() }()\n\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn \"\", fmt.Errorf(\"HTTP %d for %s\", resp.StatusCode, indexURL)\n\t}\n\n\terr = json.NewDecoder(resp.Body).Decode(&indexData)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to retrieve packer release index from %s: %w\", indexURL, err)\n\t}\n\n\tvar semverList []*semver.Version","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/provisioner/hcp-sbom/packer_release_fetch.go#L42-L78","documentation":"The hcp-sbom provisioner could not construct the http.Request used to query the Packer releases index (`https://releases.hashicorp.com/packer/index.json`). `http.NewRequestWithContext` returns an error only when the URL fails to parse (or the method/body are invalid). This wraps that error with context so callers know the request was never sent.","triggerScenarios":"fetchLatestPackerVersion builds the index URL from getReleaseBaseURL() and calls http.NewRequestWithContext; the error fires when that URL string is unparseable — e.g. an invalid/missing scheme or control characters in the URL. Not reachable with the default hardcoded HTTPS URL under normal operation; effectively only via URL construction failure or context misuse.","commonSituations":"Practically rare in production: a patched/overridden release base URL that is malformed, an empty URL from a bad configuration override, or URL containing illegal characters (spaces, newlines).","solutions":["Confirm the release base URL used to compose the index URL is a well-formed absolute URL with an http/https scheme.","Check for stray whitespace or control characters in any environment/config value feeding the base URL.","Log the wrapped underlying error (`%w`) — it names the exact parse failure (e.g. `parse \"...\": invalid control character in URL`).","Verify no proxy/URL-mangling middleware or wrapper replaced getReleaseBaseURL with a bad value."],"exampleFix":"// before (malformed override)\nbaseURL := \"releases.hashicorp.com\" // missing scheme\n\n// after\nbaseURL := \"https://releases.hashicorp.com\"","handlingStrategy":"try-catch","validationCode":"u, err := url.Parse(baseURL + \"/packer/index.json\")\nif err != nil || u.Scheme == \"\" || u.Host == \"\" {\n\treturn fmt.Errorf(\"invalid release index URL: %q\", baseURL+\"/packer/index.json\")\n}","typeGuard":"func isRequestConstructionError(err error) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"failed to build index request\")\n}","tryCatchPattern":"ver, err := fetchLatestPackerVersion(ctx, client)\nif err != nil {\n\tvar urlErr *url.Error\n\tif errors.As(err, &urlErr) {\n\t\tlog.Fatalf(\"malformed release URL: %v\", urlErr)\n\t}\n\treturn err\n}","preventionTips":["Always construct base URLs with a scheme (https://).","Sanitize config/env-supplied URLs with url.Parse before use.","Trim whitespace/control characters from URL inputs.","Rely on the default hardcoded base URL rather than overriding it unless necessary."],"tags":["http","url","network"],"backgroundTag":"invalid-url-request-construction","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}