What causes "Failed to upload sboms %s" in hashicorp/packer?

Re-run the build; SBOM upload failures are often transient API issues

Failed to upload sboms %s

Error message

Failed to upload sboms %s

What it means

Wraps a failure from bucket.uploadSbom when publishing compressed SBOM entries for a build to HCP Packer. It indicates one or more SBOM uploads failed during doCompleteBuild, typically due to an API/network problem or an oversized/invalid SBOM payload.

Source

Thrown at internal/hcp/registry/types.bucket.go:811

		}
	}

	build, err := bucket.Version.Build(buildName)
	if err != nil {
		return packerSDKArtifacts, fmt.Errorf(
			"failed to get build %q from version being built. This is a Packer bug.",
			buildName)
	}
	if len(build.Artifacts) == 0 {
		return packerSDKArtifacts, &NotAHCPArtifactError{
			fmt.Errorf("No HCP Packer-compatible artifacts were found for the build"),
		}
	}

	for _, sbom := range build.CompressedSboms {
		err = bucket.uploadSbom(ctx, buildName, sbom)
		if err != nil {
			return packerSDKArtifacts, fmt.Errorf("Failed to upload sboms %s", err)
		}
	}

	parErr := bucket.markBuildComplete(ctx, buildName)
	if parErr != nil {
		return packerSDKArtifacts, fmt.Errorf(
			"failed to update HCP Packer artifacts for %q: %s",
			buildName,
			parErr)
	}

	// Update channels after build is marked complete
	channelErr := bucket.updateChannels(ctx, ui)
	if channelErr != nil {
		log.Printf("[ERROR] Failed to update channels after completing build %s: %s", buildName, channelErr)
	}

	return append(packerSDKArtifacts, &registryArtifact{

View on GitHub (pinned to eb36e3c3e4)

Solutions

Re-run the build; SBOM upload failures are often transient API issues
Check HCP credentials (HCP_CLIENT_ID/HCP_CLIENT_SECRET) and network/proxy connectivity to api.cloud.hashicorp.com
Verify SBOM content is valid and not exceeding size limits; disable the SBOM-generating data source if not needed
Inspect the wrapped error text (it is appended via %s) to identify the underlying HTTP status

Defensive patterns

Strategy: try-catch

Validate before calling

// Pre-flight: verify HCP API reachability and credentials before long builds
resp, err := http.Get("https://api.cloud.hashicorp.com")
if err != nil { log.Warn("HCP API unreachable; SBOM uploads may fail") }

Try / catch

if err := run(); err != nil {
    var na *registry.NotAHCPArtifactError
    if errors.As(err, &na) { /* not SBOM-related */ }
    if strings.Contains(err.Error(), "Failed to upload sboms") {
        // inspect wrapped cause, retry build or skip SBOM publishing
    }
}

Prevention

Keep HCP credentials valid for the whole build duration
Check HCP service status before long-running builds that publish SBOMs
Keep SBOM payloads within service size limits

When it happens

Trigger: doCompleteBuild iterates build.CompressedSboms calling uploadSbom; any non-nil error from that call (HTTP failure, auth expiry, size limit, malformed SBOM) is wrapped as 'Failed to upload sboms %s'.

Common situations: Transient HCP API outages or timeouts during build completion; expired/invalid HCP credentials; very large SBOM payloads exceeding service limits; corrupted SBOM generation by a data source.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/841f67b8e56157de. Report an issue: GitHub.