What causes "decode SBOM payload: %w" in hashicorp/packer?

Rerun with logs to inspect what the SBOM generator actually produced

decode SBOM payload: %w

Error message

decode SBOM payload: %w

What it means

buildSBOMPredicate failed to JSON-decode the generated SBOM payload before embedding it into the in-toto attestation. Since the SBOM was just produced by the generator, this almost always means the generator emitted non-JSON output (empty bytes, a CLI error banner, or truncated output).

Source

Thrown at post-processor/provenance/post-processor.go:504

		parent := filepath.Dir(files[0])
		for _, file := range files[1:] {
			if filepath.Dir(file) != parent {
				return "", fmt.Errorf("sbom=true requires sbom_scan_path when artifact files span multiple directories")
			}
		}
		return parent, nil
	}

	return "", fmt.Errorf("sbom=true requires local artifact files or sbom_scan_path")
}

func buildSBOMPredicate(rawSBOM []byte, format internalsbom.Format) (interface{}, string, error) {
	decoder := json.NewDecoder(bytes.NewReader(rawSBOM))
	decoder.UseNumber()

	var predicate interface{}
	if err := decoder.Decode(&predicate); err != nil {
		return nil, "", fmt.Errorf("decode SBOM payload: %w", err)
	}

	switch format {
	case internalsbom.FormatCycloneDX:
		return predicate, predicateTypeCycloneDX, nil
	case internalsbom.FormatSPDX:
		return predicate, predicateTypeSPDX, nil
	default:
		return nil, "", fmt.Errorf("unsupported SBOM format %q", format)
	}
}

func (p *PostProcessor) externalParameters(env map[string]string) map[string]interface{} {
	externalParameters := map[string]interface{}{}

	if p.config.TemplatePath != "" {
		externalParameters["template"] = p.config.TemplatePath
	}

View on GitHub (pinned to eb36e3c3e4)

Solutions

Rerun with logs to inspect what the SBOM generator actually produced
Verify the SBOM tool (syft/trivy) is installed and works standalone with the chosen format
Check the earlier 'write SBOM' output file on disk for validity with jq

Defensive patterns

Strategy: try-catch

Validate before calling

// Sanity-check generated SBOM bytes before attesting:
var probe interface{}
if err := json.Unmarshal(rawSBOM, &probe); err != nil {
    return fmt.Errorf("SBOM not valid JSON: %w", err)
}

Try / catch

if err := p.Provision(ctx); err != nil {
    if strings.Contains(err.Error(), "decode SBOM payload") {
        // inspect raw SBOM output, check generator tool install/version
    }
}

Prevention

Verify the SBOM generator binary (syft/trivy) works standalone before wiring it into packer
Check the written SBOM file with `jq .` after failed runs
Pin the SBOM tool version to avoid output format regressions

When it happens

Trigger: writeSBOMAttestation passes rawSBOM bytes to buildSBOMPredicate and json.Decoder.Decode fails — e.g. the SBOM tool wrote an error message or empty file, or bytes were corrupted between generation and decoding.

Common situations: Missing or misconfigured syft/trivy binary whose stderr leaked into captured output; SBOM generation produced empty output; plugin version mismatch.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/cb86fce44fcd2264. Report an issue: GitHub.