What causes "failed to create SBOM: %w" in hashicorp/packer?

Inspect the wrapped cause from %w to identify the failing cataloger or file

failed to create SBOM: %w

Error message

failed to create SBOM: %w

What it means

syft.CreateSBOM catalogs the resolved source and failed — wrapped as `failed to create SBOM: %w`. This covers cataloger errors during package discovery: unreadable files inside the scan scope, database/cataloger initialization issues (note the modernc.org/sqlite import), context cancellation, or internal Syft panics surfaced as errors.

Source

Thrown at internal/sbom/generator_syft.go:55

	var scope source.Scope
	switch g.config.Scope {
	case ScopeAllLayers:
		scope = source.AllLayersScope
	case "", ScopeSquashed:
		scope = source.SquashedScope
	default:
		return nil, fmt.Errorf("unsupported scope: %s", g.config.Scope)
	}

	sbomCfg := syft.DefaultCreateSBOMConfig().
		WithSearchConfig(cataloging.SearchConfig{
			Scope: scope,
		}).
		WithParallelism(g.config.Parallelism)

	sbomResult, err := syft.CreateSBOM(ctx, src, sbomCfg)
	if err != nil {
		return nil, fmt.Errorf("failed to create SBOM: %w", err)
	}

	return g.encodeToFormat(sbomResult)
}

// encodeToFormat encodes the SBOM to the requested format.
func (g *Generator) encodeToFormat(sbomData *sbom.SBOM) ([]byte, error) {
	switch g.config.Format {
	case FormatCycloneDX:
		cfg := cyclonedxjson.DefaultEncoderConfig()
		cfg.Pretty = true
		encoder, err := cyclonedxjson.NewFormatEncoderWithConfig(
			cfg,
		)
		if err != nil {
			return nil, fmt.Errorf("failed to create CycloneDX encoder: %w", err)
		}
		return format.Encode(*sbomData, encoder)

View on GitHub (pinned to eb36e3c3e4)

Solutions

Inspect the wrapped cause from %w to identify the failing cataloger or file
Increase build/step timeouts and check context cancellation
Increase Parallelism or set exclusions (Config.Exclude) to skip problematic paths
Ensure the process has read access to everything under the scan scope
Retry after checking Syft version compatibility if a cataloger bug is implicated

Example fix

// before
gen := sbom.NewGenerator(sbom.Config{ScanPath: "/"})
out, err := gen.Generate(ctx) // cancelled by short step timeout
// after
ctx, cancel := context.WithTimeout(ctx, 30*time.Minute)
defer cancel()
gen := sbom.NewGenerator(sbom.Config{ScanPath: "/", Exclude: []string{"/proc", "/sys"}})
out, err := gen.Generate(ctx)

Defensive patterns

Strategy: try-catch

Validate before calling

ctx, cancel := context.WithTimeout(ctx, 30*time.Minute)
defer cancel()
// ensure scan path readable
_ = filepath.Walk(cfg.ScanPath, func(p string, i os.FileInfo, e error) error { return e })

Try / catch

out, err := gen.Generate(ctx)
if err != nil {
    if errors.Is(err, context.DeadlineExceeded) { return retryWithLongerTimeout() }
    return fmt.Errorf("SBOM cataloging failed: %w", err)
}

Prevention

Allocate generous timeouts for full-filesystem scans
Exclude /proc, /sys and other pseudo-filesystems via Config.Exclude
Ensure read permissions across the scan scope
Monitor memory when using high Parallelism

When it happens

Trigger: Context cancelled/timed out mid-catalog; permission errors reading files under the scan path; corrupted image layers; cataloger config (parallelism, exclusions) triggering failures; sqlite driver initialization problems in constrained environments.

Common situations: Long scans hitting build timeouts; scanning filesystems with unreadable mounted secrets; very low memory environments; unusual filesystems inside the image that trip specific catalogers.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/e3daab9deff4b6c5. Report an issue: GitHub.