hashicorp/packer · error

generate SBOM: %w

Error message

generate SBOM: %w

What it means

Runtime error from resolveSBOM in the provenance post-processor: generating the SBOM for the artifact (via the configured scanner, e.g. Syft) failed. The wrapped error carries the scanner's failure — bad scope, missing scanner binary, or unreadable scan path.

Source

Thrown at post-processor/provenance/post-processor.go:466

	// artifact changed between runs.
	format, err := internalsbom.ParseFormatFromArgs(p.config.SBOMFormat)
	if err != nil {
		return "", nil, err
	}

	scanPath, err := p.resolveSBOMScanPath(source)
	if err != nil {
		return "", nil, err
	}

	rawSBOM, err := p.generateSBOM(ctx, internalsbom.Config{
		ScanPath: scanPath,
		Format:   format,
		Scope:    p.config.SBOMScope,
		Exclude:  append([]string(nil), p.config.SBOMExclude...),
	})
	if err != nil {
		return "", nil, fmt.Errorf("generate SBOM: %w", err)
	}

	if err := atomicWriteFile(paths.SBOMRaw, rawSBOM, 0664); err != nil {
		return "", nil, fmt.Errorf("write SBOM %q: %w", paths.SBOMRaw, err)
	}

	return format, rawSBOM, nil
}

func (p *PostProcessor) resolveSBOMScanPath(source packersdk.Artifact) (string, error) {
	if p.config.SBOMScanPath != "" {
		return p.config.SBOMScanPath, nil
	}

	files := source.Files()
	if len(files) == 1 {
		return files[0], nil
	}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Check sbom_scope/sbom_exclude settings and that the scan path exists
2. Verify the SBOM scanner tool is installed and runnable
3. Inspect the wrapped error for the scanner-specific cause and fix accordingly

Example fix

// before
"sbom": {
  "scan_path": "/nonexistent/dir"
}
// after
"sbom": {
  "scan_path": "./output/image.tar"
}

import os
func checkScanTarget(scanPath, format string) error {
	if _, err := os.Stat(scanPath); err != nil {
		return fmt.Errorf("scan_path %s unavailable: %w", scanPath, err)
	}
	switch format {
	case "spdx-json", "cyclonedx-json":
		return nil
	default:
		return fmt.Errorf("unsupported SBOM format %q", format)
	}
}

if err := p.PostProcess(ctx, a); err != nil {
	if strings.Contains(err.Error(), "generate SBOM") {
		log.Printf("SBOM generation failed; check scanner and scan_path: %v", err)
	}
	return err
}

When it happens

Trigger: writeSBOMAttestation -> resolveSBOM invokes the SBOM generator with ScanPath/Format/Scope/Exclude and it returns an error; the raw SBOM is then never written.

Common situations: scan_path points to a nonexistent artifact/directory; unsupported SBOM format requested; scanner binary missing or its version incompatible; scan scope invalid; exclude patterns malformed.

Related errors

• sbom=true requires sbom_scan_path when artifact files span m
• sbom=true requires local artifact files or sbom_scan_path
• decode SBOM payload: %w
• unsupported SBOM format %q
• attestation subject does not match artifact %q

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/ab3af919a2cc60a1. Report an issue: GitHub.