What causes "failed to render execute_command: %s" in hashicorp/packer?

Fix the template syntax in execute_command: balance all {{ }} delimiters and escape literal braces when needed.

failed to render execute_command: %s

Error message

failed to render execute_command: %s

What it means

Returned by runScanner (provisioner/hcp-sbom/provisioner.go:714) when interpolate.Render fails to render the user-supplied execute_command template against the restricted template data (Path, Args, ScanPath, Output). Packer validates template syntax before executing anything on the guest, so a bad template aborts before any scanner run.

Source

Thrown at provisioner/hcp-sbom/provisioner.go:714

	// Use Windows-specific default if on Windows and user hasn't customized
	executeCommand := p.config.ExecuteCommand
	if isWindows && executeCommand == "chmod +x {{.Path}} && sudo {{.Path}} sbom-generate {{.Args}} {{.ScanPath}} > {{.Output}}" {
		// User didn't customize, use Windows default (no sudo, uses sbom-generate subcommand).
		executeCommand = "{{.Path}} sbom-generate {{.Args}} {{.ScanPath}} > {{.Output}}"
	}

	// Backward compatibility: older execute_command templates omitted the
	// sbom-generate subcommand and invoked the scanner binary directly.
	normalizedExecuteCommand := normalizeScannerExecuteCommand(executeCommand)
	if normalizedExecuteCommand != executeCommand {
		log.Printf("[INFO] execute_command compatibility: injected 'sbom-generate' subcommand")
		executeCommand = normalizedExecuteCommand
	}

	// Render the execute command template
	cmdStr, err := interpolate.Render(executeCommand, &renderCtx)
	if err != nil {
		return "", fmt.Errorf("failed to render execute_command: %s", err)
	}

	// For Windows with elevated user, wrap command with elevated runner
	if isWindows && p.config.ElevatedUser != "" {
		log.Printf("Using elevated user '%s' for scanner execution", p.config.ElevatedUser)
		elevatedCmd, err := guestexec.GenerateElevatedRunner(cmdStr, p)
		if err != nil {
			return "", fmt.Errorf("failed to generate elevated runner: %s", err)
		}
		cmdStr = elevatedCmd
	}

	log.Printf("Executing: %s", cmdStr)

	// Execute scanner
	var stdout, stderr bytes.Buffer
	cmd := &packersdk.RemoteCmd{
		Command: cmdStr,

View on GitHub (pinned to eb36e3c3e4)

Solutions

Fix the template syntax in execute_command: balance all {{ }} delimiters and escape literal braces when needed.
Only use the supported keys: {{.Path}}, {{.Args}}, {{.ScanPath}}, {{.Output}}; remove or replace any other {{.X}} references.
Start from the documented default: "chmod +x {{.Path}} && sudo {{.Path}} sbom-generate {{.Args}} {{.ScanPath}} > {{.Output}}" and edit incrementally.
Run `packer validate` (or `packer hcl2_upgrade` for JSON templates) before building to catch template errors early.
Check PACKER_LOG=1 output for the exact render error text pointing at the offending token.

Example fix

// before: unknown key and unbalanced braces
execute_command = "chmod +x {{.Path} && {{.Source}} scan {{.ScanPath}}"
// after: balanced syntax, supported keys only
execute_command = "chmod +x {{.Path}} && sudo {{.Path}} sbom-generate {{.Args}} {{.ScanPath}} > {{.Output}}"

Defensive patterns

Strategy: validation

Validate before calling

// Validate template before building
mustContain := []string{"{{.Path}}", "{{.Output}}"}
for _, tok := range mustContain {
    if !strings.Contains(cfg.ExecuteCommand, tok) { /* fail fast: bad template */ }
}
// reject unsupported keys like {{.Foo}} with a regex check

Try / catch

cmdStr, err := interpolate.Render(executeCommand, &renderCtx)
if err != nil {
    return "", fmt.Errorf("failed to render execute_command: %w", err)
}

Prevention

Run `packer validate` before every build.
Use only documented keys: {{.Path}}, {{.Args}}, {{.ScanPath}}, {{.Output}}.
Start from the documented default execute_command and edit incrementally.
Watch HCL quoting: braces inside strings can be mangled.

When it happens

Trigger: Setting execute_command in the hcp-sbom provisioner block with malformed Go template syntax (unbalanced {{ }}, stray backticks), or referencing an unknown field like {{.Foo}} that the interpolation context cannot resolve.

Common situations: Copy-pasting execute_command from other provisioners (shell/file) that allow different variables; hand-editing templates and leaving {{.Path}} half-deleted; HCL quoting issues that mangle the {{ }} delimiters; referencing Packer variables that were not passed into this provisioner's ctx.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/5e34ff07c79e7227. Report an issue: GitHub.