hashicorp/packer · error

failed to write SBOM to destination %q: %s

Error message

failed to write SBOM to destination %q: %s

What it means

This error is returned when os.WriteFile fails to write the raw SBOM bytes to the computed user destination path (0644 permissions). The path was computed successfully, but creating or writing the file failed on the host filesystem — most commonly a missing parent directory or insufficient permissions.

Source

Thrown at provisioner/hcp-sbom/provisioner.go:915

	}()

	err = json.NewEncoder(outFile).Encode(PackerSBOM{
		RawSBOM: sbomData,
		Format:  format,
		Name:    p.config.SbomName,
	})
	if err != nil {
		return fmt.Errorf("failed to write SBOM to %q: %s", pkrDst, err)
	}

	// Also save to user destination if specified
	if p.config.Destination != "" {
		usrDst, err := p.getUserDestination()
		if err != nil {
			return fmt.Errorf("failed to compute destination path %q: %s", p.config.Destination, err)
		}
		if err := os.WriteFile(usrDst, sbomData, 0644); err != nil {
			return fmt.Errorf("failed to write SBOM to destination %q: %s", usrDst, err)
		}
	}

	return nil
}

// Communicator returns the communicator for elevated execution
func (p *Provisioner) Communicator() packersdk.Communicator {
	return p.communicator
}

// ElevatedUser returns the elevated user for Windows execution
func (p *Provisioner) ElevatedUser() string {
	return p.config.ElevatedUser
}

// ElevatedPassword returns the elevated password for Windows execution
func (p *Provisioner) ElevatedPassword() string {

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Read the wrapped OS error: 'no such file or directory' means create the parent directories first.
2. Pre-create the destination directory: mkdir -p <parent of destination>.
3. Check write permissions for the user running Packer on the destination directory.
4. Ensure destination is a file path, not an existing directory.
5. Free disk space if the error indicates the device is full.

Example fix

// before (shell)
destination = "./out/sboms/report.json"   // ./out/sboms does not exist
// after (pre-create dirs)
$ mkdir -p out/sboms
$ packer build template.pkr.hcl

usrDst, err := getUserDestination()
if err == nil {
	if st, err := os.Stat(filepath.Dir(usrDst)); err != nil || !st.IsDir() {
		os.MkdirAll(filepath.Dir(usrDst), 0o755) // ensure parent exists
	}
}

if err := os.WriteFile(usrDst, sbomData, 0644); err != nil {
	var perr *fs.PathError
	if errors.As(err, &perr) && errors.Is(err, syscall.ENOENT) {
		os.MkdirAll(filepath.Dir(usrDst), 0o755)
		err = os.WriteFile(usrDst, sbomData, 0644)
	}
	if err != nil {
		return fmt.Errorf("failed to write SBOM to destination %q: %w", usrDst, err)
	}
}

When it happens

Trigger: p.config.Destination is set, getUserDestination() succeeds, and os.WriteFile(usrDst, sbomData, 0644) returns an error because the parent directory does not exist, the path is not writable, usrDst is a directory, or the disk is full.

Common situations: Setting destination to a nested path whose directories were never created (e.g. ./artifacts/sbom/report.json with no artifacts/sbom/ dir); writing to a protected location like /usr or C:\Program Files without elevation; read-only mounted output directory.

Understand the failure class

Background: "Permission denied" / "Failed to write" file errors: why a library can't write its files to disk (EACCES, EPERM, ENOSPC) and how to fix them — this error's family across 43 libraries.

Related errors

• failed to create output file %q: %s
• failed to open %s for hashing: %w
• read verifier %q: %w
• read signer %q: %w
• hash %q: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/bea3f3d7dac2b642. Report an issue: GitHub.