hashicorp/packer · error

failed to download SBOM: %s

Error message

failed to download SBOM: %s

What it means

This wrapper error is returned by provisionWithNativeGeneration (provisioner/hcp-sbom/provisioner.go:659) when p.downloadSBOM fails to fetch the generated SBOM file from the remote machine via the communicator. It wraps the underlying communicator Download error, so the root cause (network, path, permissions) is embedded in the message. Packer throws it because the SBOM artifact cannot be retrieved from the guest after successful generation.

Source

Thrown at provisioner/hcp-sbom/provisioner.go:659

	remoteScannerPath, err := p.uploadScanner(ctx, ui, comm, scannerZipPath, osType)
	if err != nil {
		return fmt.Errorf("failed to upload scanner: %s", err)
	}
	defer p.cleanupRemoteFile(ctx, ui, comm, remoteScannerPath)

	// Step 3: Run scanner on remote
	ui.Say(fmt.Sprintf("Running scanner on remote host (scanning %s)...", p.config.ScanPath))
	remoteSBOMPath, err := p.runScanner(ctx, ui, comm, remoteScannerPath, osType)
	if err != nil {
		return fmt.Errorf("failed to run scanner: %s", err)
	}
	defer p.cleanupRemoteFile(ctx, ui, comm, remoteSBOMPath)

	// Step 4: Download SBOM from remote
	log.Println("Downloading SBOM from remote host...")
	sbomData, err := p.downloadSBOM(ctx, ui, comm, remoteSBOMPath)
	if err != nil {
		return fmt.Errorf("failed to download SBOM: %s", err)
	}

	// Step 5: Process SBOM for HCP (validate, compress, store)
	log.Println("Processing SBOM for HCP Packer...")
	if err := p.processSBOMForHCP(generatedData, sbomData); err != nil {
		return fmt.Errorf("failed to process SBOM: %s", err)
	}

	ui.Say("Automatic SBOM generation completed successfully")
	return nil
}

// runScanner executes `packer sbom-generate` on the remote host.
func (p *Provisioner) runScanner(ctx context.Context, ui packersdk.Ui,
	comm packersdk.Communicator, scannerPath, osType string) (string, error) {

	// Determine output path based on OS
	var outputPath string

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Check the full wrapped error message for the root cause (e.g. 'no such file' vs 'connection timed out') and fix that first.
2. Verify your custom execute_command redirects scanner output to {{.Output}} exactly; the download uses the fixed path /tmp/packer-sbom.json (or C:\Windows\Temp\packer-sbom.json on Windows).
3. Re-run with PACKER_LOG=1 to see 'Downloading SBOM from ...' and the underlying communicator error details.
4. Ensure the guest temp directory is writable and not wiped between scanner run and download (e.g. provisioners running tmp cleaners).
5. If SSH connections drop on large transfers, retry or check guest network stability/host key settings.

Example fix

// before: custom execute_command loses output
execute_command = "chmod +x {{.Path}} && sudo {{.Path}} sbom-generate {{.Args}} {{.ScanPath}}"
// after: keep the redirect so the file exists at the expected remote path
execute_command = "chmod +x {{.Path}} && sudo {{.Path}} sbom-generate {{.Args}} {{.ScanPath}} > {{.Output}}"

// Before building: verify the scanner output path matches the fixed remote path
// Unix: /tmp/packer-sbom.json ; Windows: C:\Windows\Temp\packer-sbom.json
strings.Contains(cfg.ExecuteCommand, "> {{.Output}}") // must be true

err := p.downloadSBOM(ctx, ui, comm, remoteSBOMPath)
if err != nil {
    return fmt.Errorf("failed to download SBOM: %w", err) // inspect wrapped cause
}

When it happens

Trigger: Calling `packer build` with the hcp-sbom provisioner in native-generation mode when comm.Download(remoteSBOMPath, &buf) fails — e.g. the remote SBOM file was never created, was deleted by the cleanup defer, the SSH/WinRM connection dropped mid-download, or the guest path (/tmp/packer-sbom.json or C:\Windows\Temp\packer-sbom.json) is unreadable.

Common situations: The scanner step appeared to succeed but wrote output to a different path due to a customized execute_command that does not redirect to {{.Output}}; SSH session timeouts on slow downloads; guest disk full or read-only /tmp; security tools (AppArmor/SELinux/AV) blocking the temp file; another cleanup racing the download.

Related errors

• failed to process SBOM: %s
• failed to start scanner: %s
• scanner exited with status %d
• downloaded SBOM is empty
• packer destination path missing from configs: this is an int

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/1965152208ddf22f. Report an issue: GitHub.