What causes "could not parse release: %w" in hashicorp/packer?

Open the releases URL directly and confirm it serves a plain checksums file (" " per line), not HTML or JSON.

could not parse release: %w

Error message

could not parse release: %w

What it means

During InstallLatest, Packer downloads a releases file (SHA256SUM-style listing) for each configured release URL and parses it with ParseReleases(). If the file's content cannot be parsed into release entries, the error is appended to a multierror and installation continues to the next source; if all sources fail, the aggregated error is returned.

Source

Thrown at packer/plugin-getter/plugins.go:660

	var errs *multierror.Error
	for _, getter := range getters {

		releasesFile, err := getter.Get("releases", GetOptions{
			PluginRequirement:         pr,
			BinaryInstallationOptions: opts.BinaryInstallationOptions,
		})
		if err != nil {
			if errors.Is(err, HTTPFailure) {
				continue
			}
			errs = multierror.Append(errs, err)
			log.Printf("[TRACE] %s", err.Error())
			return nil, errs
		}

		releases, err := ParseReleases(releasesFile)
		if err != nil {
			err := fmt.Errorf("could not parse release: %w", err)
			errs = multierror.Append(errs, err)
			log.Printf("[TRACE] %s", err.Error())
			continue
		}
		if len(releases) == 0 {
			err := fmt.Errorf("no release found")
			errs = multierror.Append(errs, err)
			log.Printf("[TRACE] %s", err.Error())
			continue
		}
		for _, release := range releases {
			v, err := goversion.NewVersion(release.Version)
			if err != nil {
				err := fmt.Errorf("could not parse release version %s. %w", release.Version, err)
				errs = multierror.Append(errs, err)
				log.Printf("[TRACE] %s, ignoring it", err.Error())
				continue
			}

View on GitHub (pinned to eb36e3c3e4)

Solutions

Open the releases URL directly and confirm it serves a plain checksums file ("<sha256> <filename>" per line), not HTML or JSON.
Add a proper SHA256SUM-style asset to the plugin's GitHub release, or fix the release URL configured for the plugin.
Check proxy/firewall interference (HTTP_PROXY, corporate MITM) and retry; note the multierror may contain one error per source — read all of them.

Example fix

// release currently ships only binaries — add a checksums file
$ sha256sum packer-plugin-foo_* > SHA256SUM && gh release upload v1.0.0 SHA256SUM

Defensive patterns

Strategy: retry

Validate before calling

resp, err := http.Get(releasesURL)
if err == nil {
	b, _ := io.ReadAll(resp.Body)
	for _, line := range strings.Split(string(b), "\n") {
		f := strings.Fields(line)
		if len(f) != 2 {
			return fmt.Errorf("%s is not a checksums file", releasesURL)
		}
	}
}

Try / catch

releases, err := ParseReleases(releasesFile)
if err != nil {
	log.Printf("[TRACE] source %s unusable (%v); trying next release URL", url, err)
	continue // mirror InstallLatest's own multi-source loop
}

Prevention

Every plugin GitHub release must ship a SHA256SUM-style checksums asset
Verify release URLs return raw text, not an HTML 404/proxy page
Retry transient network failures before treating a source as invalid
Inspect all errors in the returned multierror, not just the first

When it happens

Trigger: Calling InstallLatest when ParseReleases(releasesFile) fails for a fetched releases file — the file is empty, HTML (a 404 page served with 200), or not in the expected "checksum filename" format.

Common situations: A custom/plugin-mirror release URL serves a webpage or JSON instead of a checksums file; the GitHub release has no SHA256SUM asset; a corporate proxy intercepts the download; network issues truncate the file.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/6063ae60f90def29. Report an issue: GitHub.