What causes "failed to open Packer release zip: %s" in hashicorp/packer?

Verify the local zip path exists and is readable: run `ls -l ` (or equivalent) as the same user running Packer.

failed to open Packer release zip: %s

Error message

failed to open Packer release zip: %s

What it means

This error wraps an os.Open failure when uploadScanner tries to open the locally cached Packer release zip before uploading it to a Windows guest. It is thrown by the hcp-sbom provisioner's Windows path in provisioner/hcp-sbom/provisioner.go:503; the wrapped OS error is embedded verbatim, so the actual cause (ENOENT, EACCES, etc.) appears in the message text. It means the provisioner could not even read the local zip file, before any network/upload work started.

Source

Thrown at provisioner/hcp-sbom/provisioner.go:503

	isWindows := strings.Contains(strings.ToLower(osType), "windows")

	var remotePath, binaryName string
	if isWindows {
		binaryName = "packer.exe"
		remotePath = "C:\\Windows\\Temp\\packer-sbom-runner.exe"
	} else {
		binaryName = "packer"
		remotePath = "/tmp/packer-sbom-runner"
	}

	if isWindows {
		remoteDir := "C:\\Windows\\Temp"
		remoteZipPath := remoteDir + "\\packer-sbom-runner.zip"

		// Step 1: upload zip to remote.
		zipFile, err := os.Open(localZipPath)
		if err != nil {
			return "", fmt.Errorf("failed to open Packer release zip: %s", err)
		}
		defer func() { _ = zipFile.Close() }()

		log.Printf("[INFO] Uploading Packer release zip to %s...", remoteZipPath)
		if err := comm.Upload(remoteZipPath, zipFile, nil); err != nil {
			return "", fmt.Errorf("failed to upload Packer release zip: %s", err)
		}

		// Single PowerShell command: extract, move binary, remove zip.
		psCmd := fmt.Sprintf(
			`powershell -NoProfile -ExecutionPolicy Bypass -Command `+
				`"$ErrorActionPreference='Stop'; `+
				`Expand-Archive -Path '%s' -DestinationPath '%s' -Force; `+
				`if (!(Test-Path '%s\%s')) { throw 'packer.exe not found after extraction' }; `+
				`Move-Item -Force '%s\%s' '%s'; `+
				`Remove-Item -Force '%s'"`,
			remoteZipPath, remoteDir,
			remoteDir, binaryName,

View on GitHub (pinned to eb36e3c3e4)

Solutions

Verify the local zip path exists and is readable: run `ls -l <localZipPath>` (or equivalent) as the same user running Packer.
Fix the config/variable that produces localZipPath — check the hcp-sbom provisioner config and interpolated path for typos.
Ensure an earlier download step actually produced the zip before the provisioner runs (check build ordering).
Grant the Packer process read permission on the file, or move the zip somewhere the Packer user can read.
Re-run with PACKER_LOG=1 to see the wrapped OS error detail (no such file vs permission denied).

Example fix

// before (path from a misconfigured variable)
os.Open(cfg.ReleaseZipPath) // -> "failed to open Packer release zip: open /opt/packer.zip: no such file or directory"
// after (validate/derive the real path before the build)
if _, err := os.Stat(releaseZipPath); err != nil {
	log.Fatalf("release zip missing at %s: %v", releaseZipPath, err)
}

Defensive patterns

Strategy: validation

Validate before calling

info, err := os.Stat(localZipPath)
if err != nil {
	return fmt.Errorf("release zip unavailable before build: %w", err)
}
if err != nil || info.IsDir() {
	return fmt.Errorf("%s is not a readable file", localZipPath)
}
f, err := os.Open(localZipPath)
if err != nil {
	return fmt.Errorf("cannot read release zip %s: %w", localZipPath, err)
}
_ = f.Close()

Try / catch

_, err := os.Open(localZipPath)
if err != nil {
	if errors.Is(err, os.ErrNotExist) {
		// redownload or fix path
	} else if errors.Is(err, os.ErrPermission) {
		// fix file permissions
	}
	return err
}

Prevention

os.Stat the zip path in a pre-build validation step and fail fast with a clear message.
Pin and log the zip path resolved from config so typos surface early.
Keep download and provision steps in the same build lifecycle so the zip cannot be garbage-collected between them.
Run Packer as a user with read access to the artifact cache directory.
Verify zip checksums after download to catch truncated files.

When it happens

Trigger: os.Open(localZipPath) fails inside uploadScanner (Windows guest path) — i.e. the local zip path does not exist, is a directory, or the Packer process lacks read permission. Called by provisionWithNativeGeneration during a build using the hcp-sbom provisioner with a Windows target OS.

Common situations: The configured release zip path points to a file that was never downloaded or was deleted by a prior build step; a typo or wrong variable interpolation in the zip path config; the Packer process runs as a user without read access to the zip; a race where a cleanup step removed the zip before the provisioner ran.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/3f6b90ad1511a0f3. Report an issue: GitHub.