hashicorp/packer · error

failed to create CycloneDX encoder: %w

Error message

failed to create CycloneDX encoder: %w

What it means

When encoding the completed SBOM as CycloneDX JSON, cyclonedxjson.NewFormatEncoderWithConfig failed to build the encoder, wrapped as `failed to create CycloneDX encoder: %w`. This indicates a mismatch between the encoder config and the Syft version — with DefaultEncoderConfig it is rare and usually a library/version integration problem rather than user input.

Source

Thrown at internal/sbom/generator_syft.go:71

	sbomResult, err := syft.CreateSBOM(ctx, src, sbomCfg)
	if err != nil {
		return nil, fmt.Errorf("failed to create SBOM: %w", err)
	}

	return g.encodeToFormat(sbomResult)
}

// encodeToFormat encodes the SBOM to the requested format.
func (g *Generator) encodeToFormat(sbomData *sbom.SBOM) ([]byte, error) {
	switch g.config.Format {
	case FormatCycloneDX:
		cfg := cyclonedxjson.DefaultEncoderConfig()
		cfg.Pretty = true
		encoder, err := cyclonedxjson.NewFormatEncoderWithConfig(
			cfg,
		)
		if err != nil {
			return nil, fmt.Errorf("failed to create CycloneDX encoder: %w", err)
		}
		return format.Encode(*sbomData, encoder)

	case FormatSPDX:
		cfg := spdxjson.DefaultEncoderConfig()
		cfg.Pretty = true
		encoder, err := spdxjson.NewFormatEncoderWithConfig(
			cfg,
		)
		if err != nil {
			return nil, fmt.Errorf("failed to create SPDX encoder: %w", err)
		}
		return format.Encode(*sbomData, encoder)

	default:
		return nil, fmt.Errorf("unsupported format: %s (supported: cyclonedx, spdx)", g.config.Format)
	}
}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Read the wrapped cause from %w for the constructor's actual complaint
2. Run go mod tidy / go mod vendor to align syft module versions
3. Upgrade or pin github.com/anchore/syft to a known-good version
4. Fall back to the default encoder path or the SPDX encoder if CycloneDX encoding is broken in that version

Example fix

// before
import "github.com/anchore/syft/syft/format/cyclonedxjson" // version drift vs syft core
// after
// go.mod: pin one consistent version
go get github.com/anchore/syft@v1.x.y && go mod tidy
// then rebuild; if still failing:
encoder, err := cyclonedxjson.NewFormatEncoderWithConfig(cyclonedxjson.DefaultEncoderConfig())

// no pre-call validation possible; constructor depends on library internals

out, err := gen.Generate(ctx)
if err != nil {
    if strings.Contains(err.Error(), "failed to create CycloneDX encoder") {
        log.Warn("CycloneDX encoder unavailable; retrying with SPDX")
        cfg.Format = sbom.FormatSPDX
        return sbom.NewGenerator(cfg).Generate(ctx)
    }
    return err
}

When it happens

Trigger: Syft library upgrade changing NewFormatEncoderWithConfig signature/behavior; config struct fields set to values the encoder constructor rejects; build-tag or vendoring inconsistencies causing an incompatible cyclonedxjson package.

Common situations: Partial dependency upgrades (go.mod pinning different syft module versions); custom fork/vendor drift; a Syft release where the CycloneDX encoder constructor gained validation.

Related errors

• failed to get source: %w
• unsupported scope: %s
• failed to create SBOM: %w
• unsupported format: %s
• unsupported scope: %s (supported: squashed, all-layers)

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/4b28f184d03f1615. Report an issue: GitHub.