{"record":{"id":"e02014dafa43b585","repo":"hashicorp/packer","slug":"source-must-be-specified-when-auto-generate-is-not","errorCode":null,"errorMessage":"source must be specified when auto_generate is not enabled","messagePattern":"source must be specified when auto_generate is not enabled","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"provisioner/hcp-sbom/provisioner.go","lineNumber":235,"sourceCode":"\t\t// Set default execute_command if not provided\n\t\t// Note: This will be further customized based on OS at runtime\n\t\tif p.config.ExecuteCommand == \"\" {\n\t\t\tp.config.ExecuteCommand = \"chmod +x {{.Path}} && sudo {{.Path}} sbom-generate {{.Args}} {{.ScanPath}} > {{.Output}}\"\n\t\t}\n\n\t\t// Keep legacy validation for clarity while fields remain accepted.\n\t\tif p.config.ScannerChecksum != \"\" && p.config.ScannerURL == \"\" {\n\t\t\terrs = packersdk.MultiErrorAppend(errs, errors.New(\"scanner_checksum requires scanner_url to be specified (note: both fields are deprecated and ignored)\"))\n\t\t}\n\n\t\t// Validate elevated user configuration (Windows only)\n\t\tif p.config.ElevatedUser == \"\" && p.config.ElevatedPassword != \"\" {\n\t\t\terrs = packersdk.MultiErrorAppend(errs, errors.New(\"elevated_user must be specified if elevated_password is provided\"))\n\t\t}\n\t} else {\n\t\t// Traditional mode: source is required\n\t\tif p.config.Source == \"\" {\n\t\t\terrs = packersdk.MultiErrorAppend(errs, errors.New(\"source must be specified when auto_generate is not enabled\"))\n\t\t}\n\n\t\t// Note: Scanner-related fields are allowed in source mode to support\n\t\t// toggling auto_generate without clearing configuration fields\n\t}\n\n\tif p.config.SbomName != \"\" && !sbomFormatRegexp.MatchString(p.config.SbomName) {\n\t\t// Ugly but a bit of a problem with interpolation since Provisioners\n\t\t// are prepared twice in HCL2.\n\t\t//\n\t\t// If the information used for interpolating is populated in-between the\n\t\t// first call to Prepare (at the start of the build), and when the\n\t\t// Provisioner is actually called, the first call will fail, as\n\t\t// the value won't contain the actual interpolated value, but a\n\t\t// placeholder which doesn't match the regex.\n\t\t//\n\t\t// Since we don't have a way to discriminate between the calls\n\t\t// in the context of the provisioner, we ignore them, and later the","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/provisioner/hcp-sbom/provisioner.go#L217-L253","documentation":"The hcp-sbom provisioner runs in one of two modes: auto-generate mode (which produces the SBOM itself) or traditional source mode (which reads an existing SBOM file). This error is thrown in Prepare when auto_generate is not enabled and p.config.Source is empty, meaning the provisioner would have no SBOM input at all. It is a fail-fast configuration validation so builds stop before a machine is ever provisioned.","triggerScenarios":"Calling packer build with an hcp-sbom provisioner block that omits the source field while auto_generate is false or unset. E.g. provisioner \"hcp-sbom\" { scanner { ... } } with neither source nor auto_generate = true.","commonSituations":"Users copy an auto_generate example and delete source intending auto-generate, but forget to set auto_generate = true; users migrating between modes leave source blank; partial config from templating variables where the source variable is empty at packer time.","solutions":["Set source in the hcp-sbom provisioner block to the path of the SBOM file to upload.","Alternatively set auto_generate = true if you want Packer/HCP to generate the SBOM instead of supplying one.","If using a variable for source, verify the variable has a non-empty default/value at packer build time."],"exampleFix":"// before\nprovisioner \"hcp-sbom\" {\n  scanner {\n    sbom_version = 1\n  }\n}\n\n// after\nprovisioner \"hcp-sbom\" {\n  source = \"sbom.cdx.json\"\n}","handlingStrategy":"validation","validationCode":"// In the provisioner block, ensure one of the two modes is configured before building:\n// valid if: auto_generate == true  OR  source != \"\"\n// HCL check you can run:\n// packer validate template.pkr.hcl\nprecondition {\n  condition     = var.sbom_source != \"\" || var.auto_generate\n  error_message = \"Set hcp-sbom source or enable auto_generate.\"\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pair source with the traditional mode and auto_generate = true with generated mode.","Run packer validate before packer build to catch Prepare errors early.","Give source-providing variables non-empty defaults."],"tags":["packer","provisioner","hcp-sbom","config-validation"],"backgroundTag":"missing-required-argument","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}