hashicorp/packer · error

failed to download %s: %w

Error message

failed to download %s: %w

What it means

downloadChecksumFile issued the GET for the SHA256SUMS file but client.Do returned an error, meaning no usable HTTP response was received: DNS failure, TCP connect failure, TLS handshake error, request canceled via context, or a client-side policy/redirect error. The error is wrapped with the URL so the failing endpoint is identified directly.

Source

Thrown at provisioner/hcp-sbom/packer_release_fetch.go:153

	}
	if closeErr != nil {
		_ = os.Remove(tmpPath)
		return "", fmt.Errorf("failed to close temp file: %w", closeErr)
	}

	return tmpPath, nil
}

// downloadChecksumFile fetches the SHA256SUMS text file at url.
func downloadChecksumFile(ctx context.Context, client *http.Client, url string) (string, error) {
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
	if err != nil {
		return "", fmt.Errorf("failed to build request for %s: %w", url, err)
	}

	resp, err := client.Do(req)
	if err != nil {
		return "", fmt.Errorf("failed to download %s: %w", url, err)
	}
	defer func() { _ = resp.Body.Close() }()

	if resp.StatusCode != http.StatusOK {
		return "", fmt.Errorf("download failed: HTTP %d for %s", resp.StatusCode, url)
	}

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		return "", fmt.Errorf("failed reading response body for %s: %w", url, err)
	}
	if len(strings.TrimSpace(string(body))) == 0 {
		return "", fmt.Errorf("empty response body for %s", url)
	}

	return string(body), nil
}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Verify outbound connectivity to the URL shown in the error (curl -v <url>) from the machine running Packer
2. Configure proxy environment variables (HTTPS_PROXY/HTTP_PROXY/NO_PROXY) if the network requires a proxy
3. Check DNS resolution (nslookup releases.hashicorp.com) and firewall/egress rules in CI or cloud security groups
4. Rely on the built-in retry — downloadPackerRelease retries the whole flow 3 times with 5s delay; if failures persist, investigate the network path
5. Ensure the context passed to the build is not being canceled early by an upstream timeout

Example fix

// before: no proxy configured in CI, client.Do fails
// after: export proxy vars before running packer
// $ export HTTPS_PROXY=http://proxy.corp.example:3128
// $ export NO_PROXY=localhost,127.0.0.1
// $ packer build template.pkr.hcl

// preflight reachability check before the real flow
req, err := http.NewRequestWithContext(ctx, http.MethodHead, base+"/packer/index.json", nil)
if err != nil {
    return err
}
resp, err := client.Do(req)
if err != nil {
    return fmt.Errorf("releases host unreachable (check network/proxy/DNS): %w", err)
}
_ = resp.Body.Close()

// detect transport-level failures suitable for retry vs. permanent errors
func isRetryableURLError(err error) bool {
    var ue *url.Error
    if !errors.As(err, &ue) {
        return false
    }
    if errors.Is(ue.Err, context.Canceled) {
        return false
    }
    var ne net.Error
    return errors.As(ue.Err, &ne) || errors.Is(ue.Err, io.EOF) || ue.Timeout()
}

_, err := downloadChecksumFile(ctx, client, shaSumsURL)
if err != nil {
    var ue *url.Error
    if errors.As(err, &ue) {
        return fmt.Errorf("network error reaching %s (op=%s): %w", ue.URL, ue.Op, err)
    }
    return err
}

When it happens

Trigger: client.Do(req) returns a non-nil *url.Error while fetching <base>/packer/<v>/packer_<v>_SHA256SUMS — network unreachable, DNS resolution failure for releases.hashicorp.com, TLS interception/certificate problems, or ctx canceled/timed out mid-request.

Common situations: Build machine has no outbound internet access or a proxy is required but not configured (HTTP_PROXY/HTTPS_PROXY); corporate firewall blocks releases.hashicorp.com; DNS misconfiguration in CI containers; transient network blip during a Packer build; context deadline exceeded on slow links.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

• HTTP request failed: %w
• request GitHub OIDC token: %w
• failed to fetch release index: %w
• failed reading response body for %s: %w
• empty response body for %s

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/9cfd24d274fc9eda. Report an issue: GitHub.