{"record":{"id":"cb86fce44fcd2264","repo":"hashicorp/packer","slug":"decode-sbom-payload-w","errorCode":null,"errorMessage":"decode SBOM payload: %w","messagePattern":"decode SBOM payload: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"post-processor/provenance/post-processor.go","lineNumber":504,"sourceCode":"\t\tparent := filepath.Dir(files[0])\n\t\tfor _, file := range files[1:] {\n\t\t\tif filepath.Dir(file) != parent {\n\t\t\t\treturn \"\", fmt.Errorf(\"sbom=true requires sbom_scan_path when artifact files span multiple directories\")\n\t\t\t}\n\t\t}\n\t\treturn parent, nil\n\t}\n\n\treturn \"\", fmt.Errorf(\"sbom=true requires local artifact files or sbom_scan_path\")\n}\n\nfunc buildSBOMPredicate(rawSBOM []byte, format internalsbom.Format) (interface{}, string, error) {\n\tdecoder := json.NewDecoder(bytes.NewReader(rawSBOM))\n\tdecoder.UseNumber()\n\n\tvar predicate interface{}\n\tif err := decoder.Decode(&predicate); err != nil {\n\t\treturn nil, \"\", fmt.Errorf(\"decode SBOM payload: %w\", err)\n\t}\n\n\tswitch format {\n\tcase internalsbom.FormatCycloneDX:\n\t\treturn predicate, predicateTypeCycloneDX, nil\n\tcase internalsbom.FormatSPDX:\n\t\treturn predicate, predicateTypeSPDX, nil\n\tdefault:\n\t\treturn nil, \"\", fmt.Errorf(\"unsupported SBOM format %q\", format)\n\t}\n}\n\nfunc (p *PostProcessor) externalParameters(env map[string]string) map[string]interface{} {\n\texternalParameters := map[string]interface{}{}\n\n\tif p.config.TemplatePath != \"\" {\n\t\texternalParameters[\"template\"] = p.config.TemplatePath\n\t}","sourceCodeStart":486,"sourceCodeEnd":522,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/post-processor/provenance/post-processor.go#L486-L522","documentation":"buildSBOMPredicate failed to JSON-decode the generated SBOM payload before embedding it into the in-toto attestation. Since the SBOM was just produced by the generator, this almost always means the generator emitted non-JSON output (empty bytes, a CLI error banner, or truncated output).","triggerScenarios":"writeSBOMAttestation passes rawSBOM bytes to buildSBOMPredicate and json.Decoder.Decode fails — e.g. the SBOM tool wrote an error message or empty file, or bytes were corrupted between generation and decoding.","commonSituations":"Missing or misconfigured syft/trivy binary whose stderr leaked into captured output; SBOM generation produced empty output; plugin version mismatch.","solutions":["Rerun with logs to inspect what the SBOM generator actually produced","Verify the SBOM tool (syft/trivy) is installed and works standalone with the chosen format","Check the earlier 'write SBOM' output file on disk for validity with jq"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Sanity-check generated SBOM bytes before attesting:\nvar probe interface{}\nif err := json.Unmarshal(rawSBOM, &probe); err != nil {\n    return fmt.Errorf(\"SBOM not valid JSON: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := p.Provision(ctx); err != nil {\n    if strings.Contains(err.Error(), \"decode SBOM payload\") {\n        // inspect raw SBOM output, check generator tool install/version\n    }\n}","preventionTips":["Verify the SBOM generator binary (syft/trivy) works standalone before wiring it into packer","Check the written SBOM file with `jq .` after failed runs","Pin the SBOM tool version to avoid output format regressions"],"tags":["packer","provenance","sbom","json"],"backgroundTag":"invalid-json-payload","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}