{"record":{"id":"c218e75e842e6ed9","repo":"hashicorp/packer","slug":"failed-to-create-spdx-encoder-w","errorCode":null,"errorMessage":"failed to create SPDX encoder: %w","messagePattern":"failed to create SPDX encoder: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sbom/generator_syft.go","lineNumber":82,"sourceCode":"\tcase FormatCycloneDX:\n\t\tcfg := cyclonedxjson.DefaultEncoderConfig()\n\t\tcfg.Pretty = true\n\t\tencoder, err := cyclonedxjson.NewFormatEncoderWithConfig(\n\t\t\tcfg,\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create CycloneDX encoder: %w\", err)\n\t\t}\n\t\treturn format.Encode(*sbomData, encoder)\n\n\tcase FormatSPDX:\n\t\tcfg := spdxjson.DefaultEncoderConfig()\n\t\tcfg.Pretty = true\n\t\tencoder, err := spdxjson.NewFormatEncoderWithConfig(\n\t\t\tcfg,\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create SPDX encoder: %w\", err)\n\t\t}\n\t\treturn format.Encode(*sbomData, encoder)\n\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported format: %s (supported: cyclonedx, spdx)\", g.config.Format)\n\t}\n}\n","sourceCodeStart":64,"sourceCodeEnd":90,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/sbom/generator_syft.go#L64-L90","documentation":"When generating an SBOM in SPDX JSON format, the syft SPDX encoder is constructed from the default config with pretty-printing enabled. `spdxjson.NewFormatEncoderWithConfig` returns an error only if the supplied encoder configuration is invalid (e.g. a bad SPDX version or invalid output descriptor in the config), and the generator wraps it as \"failed to create SPDX encoder\". This happens before any SBOM data is encoded, so it indicates a configuration problem, not a cataloging failure.","triggerScenarios":"Calling Generator.Generate with config.Format == \"spdx\" while the spdxjson encoder config produced by DefaultEncoderConfig plus the Pretty override is rejected by NewFormatEncoderWithConfig — practically only when the syft library's default config is customized or the syft version changes its accepted config fields.","commonSituations":"Upgrading/downgrading the syft SDK so the default encoder config no longer validates; vendoring a fork with modified SPDX version settings; local modifications to DefaultEncoderConfig in a custom build.","solutions":["Pin the syft SDK version to the one the generator was developed against and run `go mod tidy`","Check any local modifications to spdxjson.DefaultEncoderConfig for invalid fields (SPDX version, license info)","Reproduce with a minimal call to spdxjson.NewFormatEncoderWithConfig(DefaultEncoderConfig()) and read the wrapped %w error for the offending field","If the syft library itself regressed, file/update an issue against the syft version in go.mod"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Verify the SPDX encoder can be built before running a long cataloging job\nif _, err := spdxjson.NewFormatEncoderWithConfig(func() spdxjson.EncoderConfig { c := spdxjson.DefaultEncoderConfig(); c.Pretty = true; return c }()); err != nil {\n    return fmt.Errorf(\"SPDX encoder misconfigured: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"sbomBytes, err := gen.Generate(ctx)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to create SPDX encoder\") {\n        return fmt.Errorf(\"syft/SPDX encoder config invalid (check syft version in go.mod): %w\", err)\n    }\n    return err\n}","preventionTips":["Pin the syft SDK version and update it deliberately, re-running SBOM generation tests after upgrades","Don't modify DefaultEncoderConfig output unless you validate with NewFormatEncoderWithConfig first","Smoke-test encoder creation early in the Generate flow before expensive cataloging"],"tags":["sbom","spdx","syft","encoder-config"],"backgroundTag":"sbom-encoder-creation-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}