hashicorp/packer · error

failed to process SBOM: %s

Error message

failed to process SBOM: %s

What it means

This wrapper error is returned by provisionWithNativeGeneration (provisioner/hcp-sbom/provisioner.go:665) when p.processSBOMForHCP fails after a successful download. processSBOMForHCP validates the SBOM format, extracts the Packer destination path from generatedData, and writes the artifact for HCP upload. Any failure inside those steps is wrapped with this message, so inspect the nested text for the real cause.

Source

Thrown at provisioner/hcp-sbom/provisioner.go:665

	// Step 3: Run scanner on remote
	ui.Say(fmt.Sprintf("Running scanner on remote host (scanning %s)...", p.config.ScanPath))
	remoteSBOMPath, err := p.runScanner(ctx, ui, comm, remoteScannerPath, osType)
	if err != nil {
		return fmt.Errorf("failed to run scanner: %s", err)
	}
	defer p.cleanupRemoteFile(ctx, ui, comm, remoteSBOMPath)

	// Step 4: Download SBOM from remote
	log.Println("Downloading SBOM from remote host...")
	sbomData, err := p.downloadSBOM(ctx, ui, comm, remoteSBOMPath)
	if err != nil {
		return fmt.Errorf("failed to download SBOM: %s", err)
	}

	// Step 5: Process SBOM for HCP (validate, compress, store)
	log.Println("Processing SBOM for HCP Packer...")
	if err := p.processSBOMForHCP(generatedData, sbomData); err != nil {
		return fmt.Errorf("failed to process SBOM: %s", err)
	}

	ui.Say("Automatic SBOM generation completed successfully")
	return nil
}

// runScanner executes `packer sbom-generate` on the remote host.
func (p *Provisioner) runScanner(ctx context.Context, ui packersdk.Ui,
	comm packersdk.Communicator, scannerPath, osType string) (string, error) {

	// Determine output path based on OS
	var outputPath string
	isWindows := strings.Contains(strings.ToLower(osType), "windows")
	if isWindows {
		outputPath = "C:\\Windows\\Temp\\packer-sbom.json"
	} else {
		outputPath = "/tmp/packer-sbom.json"
	}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Read the wrapped cause: 'SBOM validation failed' means the scanner output is malformed; 'packer destination path missing' is an internal error worth reporting; 'failed to create output file' means check local fs permissions.
2. Inspect /tmp/packer-sbom.json on the remote (before cleanup) or capture scanner stdout in the log to see what was actually generated.
3. Verify scanner_args produce JSON output (e.g. correct format flag for syft/trivy wrapper) and that the scan path exists on the guest.
4. Ensure the local directory Packer writes PackerSBOM artifacts into is writable and exists.
5. If 'internal error' is shown, upgrade Packer to the latest patch release and file an issue if it persists.

Example fix

// before: scanner args emit text format
scanner_args = ["--format", "table"]
// after: request a machine-readable SBOM format
scanner_args = ["--format", "cyclonedx-json"]

// Pre-validate scanner args request a machine-readable format
allowed := []string{"--format", "cyclonedx-json", "--format", "spdx-json"}
// ensure scanner_args select a JSON SBOM format, not table/text

if err := p.processSBOMForHCP(generatedData, sbomData); err != nil {
    return fmt.Errorf("failed to process SBOM: %w", err) // branch on wrapped cause
}

When it happens

Trigger: Calling `packer build` in native-generation mode when processSBOMForHCP returns an error: validateSBOM rejects the downloaded bytes (not valid SPDX/CycloneDX JSON), generatedData lacks a "dst" key (internal bug), or os.Create on the local destination path fails (permissions, nonexistent directory).

Common situations: The scanner produced an error page or empty/partial file instead of a valid SBOM; the scanner wrote a text/plain log instead of JSON; the local Packer output directory is read-only or was removed mid-build; running Packer with a version that has an internal data-plumbing bug.

Related errors

• failed to download SBOM: %s
• scanner exited with status %d
• SBOM validation failed: %s
• packer destination path missing from configs: this is an int
• source must be specified when auto_generate is not enabled

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/d29dab9948a5007d. Report an issue: GitHub.