{"record":{"id":"c1453e474c909e9e","repo":"hashicorp/packer","slug":"scanner-exited-with-status-d","errorCode":null,"errorMessage":"scanner exited with status %d","messagePattern":"scanner exited with status (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"provisioner/hcp-sbom/provisioner.go","lineNumber":752,"sourceCode":"\t\tStderr:  &stderr,\n\t}\n\n\tif err := comm.Start(ctx, cmd); err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to start scanner: %s\", err)\n\t}\n\n\tcmd.Wait()\n\n\t// Log output\n\tif stdout.Len() > 0 {\n\t\tui.Say(fmt.Sprintf(\"Scanner stdout: %s\", stdout.String()))\n\t}\n\tif stderr.Len() > 0 {\n\t\tui.Say(fmt.Sprintf(\"Scanner stderr: %s\", stderr.String()))\n\t}\n\n\tif cmd.ExitStatus() != 0 {\n\t\treturn \"\", fmt.Errorf(\"scanner exited with status %d\", cmd.ExitStatus())\n\t}\n\n\treturn outputPath, nil\n}\n\nfunc normalizeScannerExecuteCommand(executeCommand string) string {\n\t// Walk each {{.Path}} token and only inject \"sbom-generate\" when that\n\t// token is being used as the scanner executable invocation.\n\t//\n\t// Example rewritten:\n\t//   chmod +x {{.Path}} && {{.Path}} {{.Args}} {{.ScanPath}} > {{.Output}}\n\t// becomes:\n\t//   chmod +x {{.Path}} && {{.Path}} sbom-generate {{.Args}} {{.ScanPath}} > {{.Output}}\n\t//\n\t// Example left unchanged:\n\t//   chmod +x {{.Path}} && {{.Path}} version\n\t// because the token after {{.Path}} is not {{.Args}} or {{.ScanPath}}.\n\tvar out strings.Builder","sourceCodeStart":734,"sourceCodeEnd":770,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/provisioner/hcp-sbom/provisioner.go#L734-L770","documentation":"Returned by runScanner (provisioner/hcp-sbom/provisioner.go:752) when the remote `packer sbom-generate` command ran but exited with a non-zero status. The scanner's stdout/stderr are printed to the UI just above this error, so the guest-side failure reason is in the build log.","triggerScenarios":"The scanner command executes successfully at the transport level but returns a non-zero exit code: sbom-generate cannot read ScanPath, the scanner binary lacks execute permission (missing chmod), scan tool inside fails (no root, missing dependency), or scanner_args are invalid.","commonSituations":"ScanPath pointing to a directory that does not exist in the guest; running without sudo when the scanner needs root; customized execute_command that dropped the `chmod +x {{.Path}}` prefix; scanner_args typo causing CLI usage error; SELinux preventing execution from /tmp.","solutions":["Read 'Scanner stdout/stderr' lines in the build output immediately above the error — they contain the guest-side reason.","Verify scan_path exists on the guest and is readable by the user running execute_command; add sudo if it needs root.","Ensure execute_command keeps `chmod +x {{.Path}}` before invoking {{.Path}}.","Validate scanner_args against the underlying scanner's CLI (try the same args manually on a similar machine).","Check exit code meaning: 126/127 usually means permission denied / command not found in the rendered command."],"exampleFix":"// before: scanner not executable, exits 126\nexecute_command = \"{{.Path}} sbom-generate {{.Args}} {{.ScanPath}} > {{.Output}}\"\n// after: chmod before execution\nexecute_command = \"chmod +x {{.Path}} && sudo {{.Path}} sbom-generate {{.Args}} {{.ScanPath}} > {{.Output}}\"","handlingStrategy":"try-catch","validationCode":"// Pre-validate the guest can run the scanner\n// execute_command must include: chmod +x {{.Path}} && ...\n// scan_path must exist in the guest image (bake it in or verify in an earlier provisioner)","typeGuard":null,"tryCatchPattern":"if cmd.ExitStatus() != 0 {\n    // stdout/stderr were already surfaced via ui.Say; include them for context\n    return \"\", fmt.Errorf(\"scanner exited with status %d: %s\", cmd.ExitStatus(), stderr.String())\n}","preventionTips":["Always keep `chmod +x {{.Path}}` at the start of execute_command.","Verify scan_path exists and is readable in the guest (use sudo if needed).","Test scanner_args manually against the same scanner version on a similar machine.","Read 'Scanner stdout/stderr' lines in build logs — they explain the exit code."],"tags":["packer","sbom","provisioner","exit-status","guest-execution"],"backgroundTag":"remote-command-nonzero-exit","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}