What causes "error validating SBOM file: invalid SBOM format" in hashicorp/packer?

Inspect the actual SBOM file: file sbom.json && head -c 200 sbom.json — it must start with '{' and be valid JSON.

error validating SBOM file: invalid SBOM format

Error message

error validating SBOM file: invalid SBOM format

What it means

This is the final fallback error of validateSBOM: the content failed SPDX parsing with a non-ValidationError error, and also failed CycloneDX parsing with a non-ValidationError error, so the provisioner cannot identify the SBOM as either supported format. It is returned before any HCP processing, aborting the provision run.

Source

Thrown at provisioner/hcp-sbom/validate.go:88

	spdxErr := validateSPDX(content)
	if spdxErr == nil {
		return hcpPackerModels.HashicorpCloudPacker20230101SbomFormatSPDX, nil
	}

	if vErr, ok := spdxErr.(*ValidationError); ok {
		return "", vErr
	}

	cycloneDxErr := validateCycloneDX(content)
	if cycloneDxErr == nil {
		return hcpPackerModels.HashicorpCloudPacker20230101SbomFormatCYCLONEDX, nil
	}

	if vErr, ok := cycloneDxErr.(*ValidationError); ok {
		return "", vErr
	}

	return "", fmt.Errorf("error validating SBOM file: invalid SBOM format")
}

View on GitHub (pinned to eb36e3c3e4)

Solutions

Inspect the actual SBOM file: file sbom.json && head -c 200 sbom.json — it must start with '{' and be valid JSON.
Re-run the SBOM generator so it emits CycloneDX JSON or SPDX 2.x JSON (syft -o cyclonedx-json or -o spdx-json).
Convert non-JSON formats (XML, tag-value, RDF) to JSON with cyclonedx-cli or pyspdxtools before use.
Check the earlier build step logs for SBOM-generation failures that produced empty/invalid output.
Verify file encoding is UTF-8 without BOM; UTF-16 output (common with PowerShell) will not parse.

Example fix

// before: tag-value SPDX file passed in
$ syft packages -o spdx-tag-value . > sbom.spdx
// after: JSON output accepted by the validator
$ syft packages -o spdx-json . > sbom.json

Defensive patterns

Strategy: validation

Validate before calling

func isSupportedSBOM(content []byte) bool {
	var probe struct {
		BOMFormat   string `json:"bomFormat"`
		SpecVersion string `json:"specVersion"`
		SPDXVersion string `json:"spdxVersion"`
	}
	if err := json.Unmarshal(content, &probe); err != nil {
		return false
	}
	return (strings.EqualFold(probe.BOMFormat, "CycloneDX") && probe.SpecVersion != "") ||
		strings.HasPrefix(probe.SPDXVersion, "SPDX-2.")
}
// guard before invoking the provisioner

Type guard

func isJSONDoc(b any) bool {
	_, ok := b.(map[string]any)
	return ok
}

Try / catch

if err := packerBuild(); err != nil {
	if strings.Contains(err.Error(), "invalid SBOM format") {
		// inspect sbom.json: must be CycloneDX JSON or SPDX 2.x JSON;
		// regenerate (syft -o cyclonedx-json / -o spdx-json) and retry
	}
}

Prevention

Verify the SBOM file is non-empty, valid JSON, and UTF-8 (no BOM/UTF-16) before building.
Only supply CycloneDX JSON or SPDX 2.x JSON — not XML, tag-value, RDF, or YAML.
Check the in-build SBOM-generation step's logs and exit code; a failed step often yields garbage input.
Run a format-validation CI gate on SBOM artifacts before invoking Packer.

When it happens

Trigger: validateSBOM is called from processSBOMForHCP with content that is neither valid SPDX JSON nor valid CycloneDX JSON — e.g. empty bytes, HTML/XML output, YAML SBOM, a raw binary blob, or a heavily corrupted JSON file.

Common situations: The SBOM-generation step inside the build failed and produced empty/log output that was then passed to the provisioner; user supplied a CycloneDX XML or SPDX tag-value (.spdx) file instead of JSON; wrong file path grabbed (e.g. a README); encoding issues (UTF-16 output from PowerShell redirection).

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/9811337733e0cd23. Report an issue: GitHub.