What causes "failed to upload Packer binary: %s" in hashicorp/packer?

Check PACKER_LOG=1 output for the wrapped error and fix the root transport cause (auth, subsystem, disk).

failed to upload Packer binary: %s

Error message

failed to upload Packer binary: %s

What it means

This error wraps a comm.Upload failure when writing the extracted scanner binary bytes to /tmp/packer-sbom-runner on the Unix guest. It is thrown at provisioner/hcp-sbom/provisioner.go:539 in uploadScanner (Unix path), called by provisionWithNativeGeneration. The zip extraction already succeeded; the failure is purely in transferring the binary over the communicator (SSH, typically), with the underlying transport error embedded.

Source

Thrown at provisioner/hcp-sbom/provisioner.go:539

			remoteDir, binaryName,
			remoteDir, binaryName, remotePath,
			remoteZipPath,
		)
		if err := p.runRemoteCmd(ctx, comm, psCmd, "extract scanner (Windows)"); err != nil {
			return "", err
		}
	} else {
		// Step 1: extract the binary locally from the release zip.
		binaryData, err := extractBinaryFromZip(localZipPath, binaryName)
		if err != nil {
			return "", fmt.Errorf("failed to extract %s from Packer release zip: %w", binaryName, err)
		}

		// Step 2: upload binary directly to remote.
		localFile := bytes.NewReader(binaryData)
		log.Printf("[INFO] Uploading Packer binary to %s...", remotePath)
		if err := comm.Upload(remotePath, localFile, nil); err != nil {
			return "", fmt.Errorf("failed to upload Packer binary: %s", err)
		}

		// Step 3: make it executable.
		chmodCmd := fmt.Sprintf(`chmod +x "%s"`, remotePath)
		if err := p.runRemoteCmd(ctx, comm, chmodCmd, "chmod scanner binary"); err != nil {
			return "", err
		}

		// Final verify: confirm binary is executable.
		verifyCmd := fmt.Sprintf(`test -x "%s"`, remotePath)
		if err := p.runRemoteCmd(ctx, comm, verifyCmd, "verify scanner is executable"); err != nil {
			return "", fmt.Errorf("scanner binary is not executable at %s after chmod; "+
				"check that /tmp is not mounted noexec on the remote host", remotePath)
		}
	}

	return remotePath, nil
}

View on GitHub (pinned to eb36e3c3e4)

Solutions

Check PACKER_LOG=1 output for the wrapped error and fix the root transport cause (auth, subsystem, disk).
Verify the guest's /tmp has free space and is writable: `df -h /tmp && touch /tmp/probe` as the SSH user.
Ensure the guest's SSH server has the sftp subsystem enabled (default sshd_config), since the communicator uploads via SFTP.
Check SSH auth in the communicator block (ssh_username, ssh_private_key_file / temporary key from the builder).
Retry the build if a transient network drop interrupted the transfer.

Example fix

// before (guest sshd_config)
#Subsystem sftp /usr/lib/openssh/sftp-server
// after
Subsystem sftp internal-sftp

Defensive patterns

Strategy: retry

Validate before calling

// pre-flight: SSH reachability and SFTP support
conn, err := net.DialTimeout("tcp", fmt.Sprintf("%s:22", guestHost), 10*time.Second)
if err != nil {
	return fmt.Errorf("SSH not reachable: %w", err)
}
conn.Close()
// during provisioning: ensure /tmp writable and has space
out, err := runRemote(`df -h /tmp | tail -1`)
if err != nil {
	return fmt.Errorf("cannot check /tmp space: %w", err)
}
log.Printf("guest /tmp usage: %s", out)

Try / catch

err := comm.Upload(remotePath, localFile, nil)
if err != nil {
	var netErr net.Error
	if errors.As(err, &netErr) && netErr.Timeout() {
		// retry with backoff, or raise ssh handshake/upload timeout
	}
	if strings.Contains(err.Error(), "sftp") || strings.Contains(err.Error(), "subsystem") {
		// enable sftp subsystem on guest sshd
	}
	return fmt.Errorf("failed to upload Packer binary: %w", err)
}

Prevention

Ensure the guest sshd has the sftp subsystem enabled before builds.
Verify /tmp has free space and is writable by the SSH user (add a df/touch pre-check).
Use a stable, pre-authenticated SSH key in the communicator config; avoid key rotation mid-build.
Retry transient network failures with backoff.
For flaky networks, consider uploading a smaller compressed binary and expanding remotely.

When it happens

Trigger: comm.Upload(remotePath, localFile, nil) errors in the Unix branch of uploadScanner — SSH connection dropped, auth failure, guest /tmp full or read-only, scp/sftp unavailable or disabled on the guest, or a transfer timeout.

Common situations: Guest's /tmp filesystem is full or mounted read-only; SSH server restricts SFTP/SCP subsystems (only shell allowed); SSH key/auth problems in the communicator config; connection drops during upload on flaky networks; disk quota exceeded for the SSH user.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/0760f154e3438236. Report an issue: GitHub.