hashicorp/packer · error

error validating SBOM file: invalid SBOM format

Error message

error validating SBOM file: invalid SBOM format

What it means

This is the final fallback error of validateSBOM: the content failed SPDX parsing with a non-ValidationError error, and also failed CycloneDX parsing with a non-ValidationError error, so the provisioner cannot identify the SBOM as either supported format. It is returned before any HCP processing, aborting the provision run.

Solutions

1. Inspect the actual SBOM file: file sbom.json && head -c 200 sbom.json — it must start with '{' and be valid JSON.
2. Re-run the SBOM generator so it emits CycloneDX JSON or SPDX 2.x JSON (syft -o cyclonedx-json or -o spdx-json).
3. Convert non-JSON formats (XML, tag-value, RDF) to JSON with cyclonedx-cli or pyspdxtools before use.
4. Check the earlier build step logs for SBOM-generation failures that produced empty/invalid output.
5. Verify file encoding is UTF-8 without BOM; UTF-16 output (common with PowerShell) will not parse.

Example fix

// before: tag-value SPDX file passed in
$ syft packages -o spdx-tag-value . > sbom.spdx
// after: JSON output accepted by the validator
$ syft packages -o spdx-json . > sbom.json

func isSupportedSBOM(content []byte) bool {
	var probe struct {
		BOMFormat   string `json:"bomFormat"`
		SpecVersion string `json:"specVersion"`
		SPDXVersion string `json:"spdxVersion"`
	}
	if err := json.Unmarshal(content, &probe); err != nil {
		return false
	}
	return (strings.EqualFold(probe.BOMFormat, "CycloneDX") && probe.SpecVersion != "") ||
		strings.HasPrefix(probe.SPDXVersion, "SPDX-2.")
}
// guard before invoking the provisioner

func isJSONDoc(b any) bool {
	_, ok := b.(map[string]any)
	return ok
}

if err := packerBuild(); err != nil {
	if strings.Contains(err.Error(), "invalid SBOM format") {
		// inspect sbom.json: must be CycloneDX JSON or SPDX 2.x JSON;
		// regenerate (syft -o cyclonedx-json / -o spdx-json) and retry
	}
}

When it happens

Trigger: validateSBOM is called from processSBOMForHCP with content that is neither valid SPDX JSON nor valid CycloneDX JSON — e.g. empty bytes, HTML/XML output, YAML SBOM, a raw binary blob, or a heavily corrupted JSON file.

Common situations: The SBOM-generation step inside the build failed and produced empty/log output that was then passed to the provisioner; user supplied a CycloneDX XML or SPDX tag-value (.spdx) file instead of JSON; wrong file path grabbed (e.g. a README); encoding issues (UTF-16 output from PowerShell redirection).

Related errors

• SBOM validation failed
• unsupported format: (supported: cyclonedx, spdx)
• error parsing CycloneDX SBOM
• error parsing SPDX JSON file
• failed to process SBOM

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/9811337733e0cd23. Report an issue: GitHub.

Appendix: source

Thrown at provisioner/hcp-sbom/validate.go:88

	spdxErr := validateSPDX(content)
	if spdxErr == nil {
		return hcpPackerModels.HashicorpCloudPacker20230101SbomFormatSPDX, nil
	}

	if vErr, ok := spdxErr.(*ValidationError); ok {
		return "", vErr
	}

	cycloneDxErr := validateCycloneDX(content)
	if cycloneDxErr == nil {
		return hcpPackerModels.HashicorpCloudPacker20230101SbomFormatCYCLONEDX, nil
	}

	if vErr, ok := cycloneDxErr.(*ValidationError); ok {
		return "", vErr
	}

	return "", fmt.Errorf("error validating SBOM file: invalid SBOM format")
}

View on GitHub (pinned to eb36e3c3e4)