hashicorp/packer · error

error parsing SPDX JSON file: %w

Error message

error parsing SPDX JSON file: %w

What it means

validateSPDX parses the content as SPDX JSON via spdx tools-golang's spdxjson.Read. This error wraps any parsing error — invalid JSON, or JSON that does not conform to the SPDX 2.x document structure the parser expects. In validateSBOM, an SPDX parse error (as opposed to a ValidationError) is a signal to try CycloneDX next, so users may see this text indirectly in the final 'invalid SBOM format' error.

Source

Thrown at provisioner/hcp-sbom/validate.go:55

	if !strings.EqualFold(bom.BOMFormat, "CycloneDX") {
		return &ValidationError{
			Err: fmt.Errorf("invalid bomFormat: %q, expected CycloneDX", bom.BOMFormat),
		}
	}
	if bom.SpecVersion.String() == "" {
		return &ValidationError{
			Err: fmt.Errorf("specVersion is required"),
		}
	}

	return nil
}

// validateSPDX is a validation for SPDX in JSON format.
func validateSPDX(content []byte) error {
	doc, err := spdxjson.Read(bytes.NewBuffer(content))
	if err != nil {
		return fmt.Errorf("error parsing SPDX JSON file: %w", err)
	}

	if doc.SPDXVersion == "" {
		return &ValidationError{
			Err: fmt.Errorf("missing SPDXVersion"),
		}
	}

	return nil
}

// validateSBOM validates the SBOM file and returns the format of the SBOM.
func validateSBOM(content []byte) (hcpPackerModels.HashicorpCloudPacker20230101SbomFormat, error) {
	// Try validating as SPDX
	spdxErr := validateSPDX(content)
	if spdxErr == nil {
		return hcpPackerModels.HashicorpCloudPacker20230101SbomFormatSPDX, nil
	}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Validate the file is valid JSON and matches SPDX 2.x schema (jq . sbom.json; spdx validator).
2. If the document is CycloneDX, ensure it is complete — the CycloneDX probe will accept it only if SPDX parse failed AND CycloneDX parse succeeds.
3. Re-generate with an SPDX 2.x JSON output: syft packages -o spdx-json . > sbom.json.
4. For SPDX 3.0 content, downgrade output to SPDX 2.3 JSON, as the parser targets SPDX 2.x.
5. Check the file is not truncated or wrapped in non-JSON output (logs, HTML).

Example fix

// before: SPDX 3.x JSON not readable by tools-golang json reader
$ syft packages -o spdx-json@3.0 . > sbom.json
// after: emit SPDX 2.3 JSON
$ syft packages -o spdx-json . > sbom.json

func looksLikeSPDXJSON(content []byte) bool {
	var probe struct {
		SPDXVersion string `json:"spdxVersion"`
	}
	if err := json.Unmarshal(content, &probe); err != nil {
		return false
	}
	return strings.HasPrefix(probe.SPDXVersion, "SPDX-2.")
}

func isSPDX2(b any) bool {
	m, ok := b.(map[string]any)
	if !ok { return false }
	v, _ := m["spdxVersion"].(string)
	return strings.HasPrefix(v, "SPDX-2.")
}

if err := processSBOM(); err != nil {
	if strings.Contains(err.Error(), "error parsing SPDX JSON file") ||
		strings.Contains(err.Error(), "invalid SBOM format") {
		// content is not SPDX 2.x JSON; regenerate with -o spdx-json or emit cyclonedx-json
	}
}

When it happens

Trigger: validateSBOM probes the content as SPDX first and spdxjson.Read returns an error because the content is not valid SPDX JSON (malformed JSON, wrong field types, missing required SPDX fields like spdxVersion/documents structure, or the content is CycloneDX/other format entirely).

Common situations: A CycloneDX JSON document is supplied (SPDX parser rejects it first); a SPDX 3.0 document that tools-golang json (SPDX 2.x) cannot parse; truncated or corrupted SBOM output; HTML error page saved as .json.

Related errors

• error parsing CycloneDX SBOM: %w
• decode attestation envelope %q: %w
• decode attestation statement: %w
• failed to create SPDX encoder: %w
• malformed packer SBOM output from file %q: %s

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/a1fa3a96b0e6bade. Report an issue: GitHub.