What causes "failed to get source: %w" in hashicorp/packer?

Read the inner error from %w — it names the actual source failure

failed to get source: %w

Error message

failed to get source: %w

What it means

Generator.Generate calls syft.GetSource to resolve the configured ScanPath into a catalogable source (directory, container image, etc.). Any failure resolving that source — path does not exist, unsupported scheme, registry auth failure, image pull error — is wrapped as `failed to get source: %w`. The wrapped Syft error carries the real cause.

Source

Thrown at internal/sbom/generator_syft.go:33

	"github.com/anchore/syft/syft/cataloging"
	"github.com/anchore/syft/syft/format"
	"github.com/anchore/syft/syft/format/cyclonedxjson"
	"github.com/anchore/syft/syft/format/spdxjson"
	"github.com/anchore/syft/syft/sbom"
	"github.com/anchore/syft/syft/source"
)

// Generate creates an SBOM for the configured scan path and returns the encoded result.
func (g *Generator) Generate(ctx context.Context) ([]byte, error) {
	sourceInput := g.config.ScanPath
	getSourceCfg := syft.DefaultGetSourceConfig()
	if len(g.config.Exclude) > 0 {
		getSourceCfg = getSourceCfg.WithExcludeConfig(source.ExcludeConfig{Paths: g.config.Exclude})
	}

	src, err := syft.GetSource(ctx, sourceInput, getSourceCfg)
	if err != nil {
		return nil, fmt.Errorf("failed to get source: %w", err)
	}
	defer func() { _ = src.Close() }()

	var scope source.Scope
	switch g.config.Scope {
	case ScopeAllLayers:
		scope = source.AllLayersScope
	case "", ScopeSquashed:
		scope = source.SquashedScope
	default:
		return nil, fmt.Errorf("unsupported scope: %s", g.config.Scope)
	}

	sbomCfg := syft.DefaultCreateSBOMConfig().
		WithSearchConfig(cataloging.SearchConfig{
			Scope: scope,
		}).
		WithParallelism(g.config.Parallelism)

View on GitHub (pinned to eb36e3c3e4)

Solutions

Read the inner error from %w — it names the actual source failure
Verify the ScanPath exists and is accessible from the process (ls/stat it)
For image sources, run docker pull / crane auth manually to validate access
Check registry credentials and network/proxy configuration
Ensure the source scheme is supported by the embedded Syft version

Example fix

// before
Cfg.ScanPath = "/opt/app" // not present inside build VM
// after
if _, err := os.Stat(cfg.ScanPath); err != nil {
    return fmt.Errorf("scan path unavailable: %w", err)
}
// or use a scheme Syft supports, e.g. "docker:image:tag" or an absolute dir

Defensive patterns

Strategy: validation

Validate before calling

if info, err := os.Stat(cfg.ScanPath); err != nil || !info.IsDir() {
    return fmt.Errorf("scan path %q is not an accessible directory", cfg.ScanPath)
}

Try / catch

out, err := gen.Generate(ctx)
if err != nil {
    var inner error = errors.Unwrap(err)
    return fmt.Errorf("SBOM source error (check path/registry auth): %w", err)
}

Prevention

Stat the scan path inside the environment where Generate runs
Pre-authenticate registry access before scanning image sources
Keep source schemes simple (local directory) inside build VMs
Check network/proxy settings for remote image scans

When it happens

Trigger: ScanPath points to a nonexistent directory; ScanPath uses a scheme Syft cannot handle; scanning registry/image references without credentials or network; image reference malformed; platform/daemon unavailable for docker:// sources.

Common situations: Wrong scan path in config (typo or path not mounted in build VM); scanning a private image without registry credentials; air-gapped environment trying to pull a remote image; Syft version change altering supported source schemes.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/c909e77ea0783f68. Report an issue: GitHub.