hashicorp/packer · error

failed to create SPDX encoder: %w

Error message

failed to create SPDX encoder: %w

What it means

When generating an SBOM in SPDX JSON format, the syft SPDX encoder is constructed from the default config with pretty-printing enabled. `spdxjson.NewFormatEncoderWithConfig` returns an error only if the supplied encoder configuration is invalid (e.g. a bad SPDX version or invalid output descriptor in the config), and the generator wraps it as "failed to create SPDX encoder". This happens before any SBOM data is encoded, so it indicates a configuration problem, not a cataloging failure.

Source

Thrown at internal/sbom/generator_syft.go:82

	case FormatCycloneDX:
		cfg := cyclonedxjson.DefaultEncoderConfig()
		cfg.Pretty = true
		encoder, err := cyclonedxjson.NewFormatEncoderWithConfig(
			cfg,
		)
		if err != nil {
			return nil, fmt.Errorf("failed to create CycloneDX encoder: %w", err)
		}
		return format.Encode(*sbomData, encoder)

	case FormatSPDX:
		cfg := spdxjson.DefaultEncoderConfig()
		cfg.Pretty = true
		encoder, err := spdxjson.NewFormatEncoderWithConfig(
			cfg,
		)
		if err != nil {
			return nil, fmt.Errorf("failed to create SPDX encoder: %w", err)
		}
		return format.Encode(*sbomData, encoder)

	default:
		return nil, fmt.Errorf("unsupported format: %s (supported: cyclonedx, spdx)", g.config.Format)
	}
}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Pin the syft SDK version to the one the generator was developed against and run `go mod tidy`
2. Check any local modifications to spdxjson.DefaultEncoderConfig for invalid fields (SPDX version, license info)
3. Reproduce with a minimal call to spdxjson.NewFormatEncoderWithConfig(DefaultEncoderConfig()) and read the wrapped %w error for the offending field
4. If the syft library itself regressed, file/update an issue against the syft version in go.mod

// Verify the SPDX encoder can be built before running a long cataloging job
if _, err := spdxjson.NewFormatEncoderWithConfig(func() spdxjson.EncoderConfig { c := spdxjson.DefaultEncoderConfig(); c.Pretty = true; return c }()); err != nil {
    return fmt.Errorf("SPDX encoder misconfigured: %w", err)
}

sbomBytes, err := gen.Generate(ctx)
if err != nil {
    if strings.Contains(err.Error(), "failed to create SPDX encoder") {
        return fmt.Errorf("syft/SPDX encoder config invalid (check syft version in go.mod): %w", err)
    }
    return err
}

When it happens

Trigger: Calling Generator.Generate with config.Format == "spdx" while the spdxjson encoder config produced by DefaultEncoderConfig plus the Pretty override is rejected by NewFormatEncoderWithConfig — practically only when the syft library's default config is customized or the syft version changes its accepted config fields.

Common situations: Upgrading/downgrading the syft SDK so the default encoder config no longer validates; vendoring a fork with modified SPDX version settings; local modifications to DefaultEncoderConfig in a custom build.

Related errors

• failed to get source: %w
• unsupported scope: %s
• failed to create SBOM: %w
• failed to create CycloneDX encoder: %w
• sbom generation is not supported on %s builds

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/c218e75e842e6ed9. Report an issue: GitHub.