hashicorp/packer · error

error parsing CycloneDX SBOM: %w

Error message

error parsing CycloneDX SBOM: %w

What it means

validateCycloneDX decodes the SBOM content as CycloneDX JSON using cyclonedx-go's BOMDecoder. This error wraps any decoding error — the input is not valid JSON, or is not shaped like a CycloneDX 1.x document. In validateSBOM it is expected during probing: SPDX is tried first, and a CycloneDX parse failure on non-CycloneDX content leads to the generic 'invalid SBOM format' error.

Source

Thrown at provisioner/hcp-sbom/validate.go:34

// ValidationError represents an error encountered while validating an SBOM.
type ValidationError struct {
	Err error
}

func (e *ValidationError) Error() string {
	return e.Err.Error()
}

func (e *ValidationError) Unwrap() error {
	return e.Err
}

// ValidateCycloneDX is a validation for CycloneDX in JSON format.
func validateCycloneDX(content []byte) error {
	decoder := cyclonedx.NewBOMDecoder(bytes.NewBuffer(content), cyclonedx.BOMFileFormatJSON)
	bom := new(cyclonedx.BOM)
	if err := decoder.Decode(bom); err != nil {
		return fmt.Errorf("error parsing CycloneDX SBOM: %w", err)
	}

	if !strings.EqualFold(bom.BOMFormat, "CycloneDX") {
		return &ValidationError{
			Err: fmt.Errorf("invalid bomFormat: %q, expected CycloneDX", bom.BOMFormat),
		}
	}
	if bom.SpecVersion.String() == "" {
		return &ValidationError{
			Err: fmt.Errorf("specVersion is required"),
		}
	}

	return nil
}

// validateSPDX is a validation for SPDX in JSON format.
func validateSPDX(content []byte) error {

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Validate the SBOM is syntactically valid JSON: jq . sbom.json.
2. Confirm the document is CycloneDX JSON (has "bomFormat": "CycloneDX"), not XML or another format.
3. Re-generate the SBOM with a current tool (syft, cyclonedx-gomod, trivy) in CycloneDX JSON output.
4. If the file is SPDX, fix whatever broke SPDX parsing instead — validateSBOM tries SPDX first.
5. Check the file is not empty or truncated (e.g. incomplete download or failed generation step).

Example fix

// before: XML CycloneDX fed to JSON-only validator
$ syft packages -o cyclonedx-xml . > sbom.xml
// after
$ syft packages -o cyclonedx-json . > sbom.json

func looksLikeCycloneDXJSON(content []byte) bool {
	var probe struct {
		BOMFormat   string `json:"bomFormat"`
		SpecVersion string `json:"specVersion"`
	}
	if json.Unmarshal(content, &probe) != nil {
		return false
	}
	return strings.EqualFold(probe.BOMFormat, "CycloneDX") && probe.SpecVersion != ""
}
// call before handing content to the provisioner

func isCycloneDX(b any) bool {
	m, ok := b.(map[string]any)
	if !ok { return false }
	f, _ := m["bomFormat"].(string)
	return strings.EqualFold(f, "CycloneDX")
}

var vErr *hcp_sbom.ValidationError
if err := run(); err != nil {
	if strings.Contains(err.Error(), "error parsing CycloneDX SBOM") {
		// regenerate SBOM as cyclonedx-json before retrying
	}
	if errors.As(err, &vErr) { /* structured validation failure, show vErr.Err */ }
}

When it happens

Trigger: validateSBOM probes the content as CycloneDX after the SPDX parse failed, and cyclonedx.NewBOMDecoder(...).Decode(bom) errors on malformed JSON or JSON missing required CycloneDX structure (no bomFormat/specVersion fields compatible with the decoder).

Common situations: The SBOM source returned HTML/XML/empty output instead of CycloneDX JSON; user pointed the provisioner at a CycloneDX XML file; an older tool generated a non-conformant CycloneDX JSON; a truncated download.

Related errors

• error parsing SPDX JSON file: %w
• decode attestation envelope %q: %w
• decode attestation statement: %w
• failed to create CycloneDX encoder: %w
• malformed packer SBOM output from file %q: %s

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/a6c700d14c1a44db. Report an issue: GitHub.