{"record":{"id":"c63a1a0493dd8248","repo":"hashicorp/packer","slug":"error-opening-powershell-script-s","errorCode":null,"errorMessage":"Error opening powershell script: %s","messagePattern":"Error opening powershell script: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"provisioner/powershell/provisioner.go","lineNumber":375,"sourceCode":"\t}\n\n\t// every provisioner run will only have one env var script file so lets add it first\n\tuploadedScripts := []string{p.config.RemoteEnvVarPath}\n\tfor _, path := range scripts {\n\t\tui.Say(fmt.Sprintf(\"Provisioning with powershell script: %s\", path))\n\n\t\tlog.Printf(\"Opening %s for reading\", path)\n\t\tfi, err := os.Stat(path)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Error stating powershell script: %s\", err)\n\t\t}\n\t\tif os.IsPathSeparator(p.config.RemotePath[len(p.config.RemotePath)-1]) {\n\t\t\t// path is a directory\n\t\t\tp.config.RemotePath += filepath.Base(fi.Name())\n\t\t}\n\t\tf, err := os.Open(path)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Error opening powershell script: %s\", err)\n\t\t}\n\t\tdefer f.Close()\n\n\t\tcommand, err := p.createCommandText()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Error processing command: %s\", err)\n\t\t}\n\n\t\t// Upload the file and run the command. Do this in the context of a\n\t\t// single retryable function so that we don't end up with the case\n\t\t// that the upload succeeded, a restart is initiated, and then the\n\t\t// command is executed but the file doesn't exist any longer.\n\t\tvar cmd *packersdk.RemoteCmd\n\t\terr = retry.Config{StartTimeout: p.config.StartRetryTimeout}.Run(ctx, func(ctx context.Context) error {\n\t\t\tif _, err := f.Seek(0, 0); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tif err := comm.Upload(p.config.RemotePath, f, &fi); err != nil {","sourceCodeStart":357,"sourceCodeEnd":393,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/provisioner/powershell/provisioner.go#L357-L393","documentation":"After successfully stating the script, Provision opens it locally with os.Open to read its contents for upload. An open failure (permissions, file locked, deleted between Stat and Open) produces \"Error opening powershell script: %s\" and aborts provisioning.","triggerScenarios":"Provision called with a stat-able script path whose os.Open fails — most commonly a permission denied or the file being locked by another process.","commonSituations":"File readable only by another user; running packer as a restricted service account; on Windows the .ps1 is locked by an editor or AV scanner; NFS/network share permission issues.","solutions":["Grant the packer process read permission on the script (chmod/chmod +r or icacls).","Close programs or exclude the script from AV locking, then retry.","Copy the script to a local path with normal permissions instead of reading from a network share.","Run packer as a user with access to the scripts directory."],"exampleFix":"// shell\n// before: -rw-------  bootstrap.ps1 (packer runs as different user)\n// after\nchmod 644 scripts/bootstrap.ps1","handlingStrategy":"validation","validationCode":"// Go, before Provision: verify readability\nfor _, p := range cfg.Scripts {\n    f, err := os.Open(p)\n    if err != nil {\n        return fmt.Errorf(\"cannot read script %q: %w\", p, err)\n    }\n    f.Close()\n}","typeGuard":null,"tryCatchPattern":"// Go\nerr := prov.Provision(ctx, ui, comm, genData)\nif err != nil {\n    if errors.Is(err, os.ErrPermission) || strings.Contains(err.Error(), \"Error opening powershell script\") {\n        // fix permissions or re-run as a user with read access\n    }\n    return err\n}","preventionTips":["chmod scripts to be readable by the packer process user (0644 is typical).","Run CI packer jobs with a service account granted access to the scripts directory.","Copy scripts from network shares to a local writable dir before building.","Beware editors/AV holding write-locks on .ps1 files during builds."],"tags":["powershell","provisioner","file-permissions","runtime"],"backgroundTag":"permission-denied","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}