hashicorp/packer · error · ValidationError

missing SPDXVersion

Error message

missing SPDXVersion

What it means

After a successful SPDX JSON parse, validateSPDX requires doc.SPDXVersion to be non-empty; this ValidationError is thrown when the parsed document lacks an spdxVersion field. An SPDX document without a version cannot be identified as SPDX 2.x, so it is rejected as invalid.

Source

Thrown at provisioner/hcp-sbom/validate.go:60

	if bom.SpecVersion.String() == "" {
		return &ValidationError{
			Err: fmt.Errorf("specVersion is required"),
		}
	}

	return nil
}

// validateSPDX is a validation for SPDX in JSON format.
func validateSPDX(content []byte) error {
	doc, err := spdxjson.Read(bytes.NewBuffer(content))
	if err != nil {
		return fmt.Errorf("error parsing SPDX JSON file: %w", err)
	}

	if doc.SPDXVersion == "" {
		return &ValidationError{
			Err: fmt.Errorf("missing SPDXVersion"),
		}
	}

	return nil
}

// validateSBOM validates the SBOM file and returns the format of the SBOM.
func validateSBOM(content []byte) (hcpPackerModels.HashicorpCloudPacker20230101SbomFormat, error) {
	// Try validating as SPDX
	spdxErr := validateSPDX(content)
	if spdxErr == nil {
		return hcpPackerModels.HashicorpCloudPacker20230101SbomFormatSPDX, nil
	}

	if vErr, ok := spdxErr.(*ValidationError); ok {
		return "", vErr
	}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Ensure the document contains "spdxVersion": "SPDX-2.3" (or another SPDX-2.x value) at the top level.
2. Regenerate the SBOM as SPDX 2.x JSON: syft packages -o spdx-json . > sbom.json.
3. If using SPDX 3.0, convert the document to SPDX 2.3 JSON before use.
4. Run an SPDX validator (e.g. tools-java Validate) to confirm the document is conformant.
5. Stop post-processing steps from removing the spdxVersion field.

Example fix

// before
{ "documents": [ ... ] }   // no spdxVersion
// after
{ "spdxVersion": "SPDX-2.3", "documents": [ ... ] }

var probe struct {
	SPDXVersion string `json:"spdxVersion"`
}
if err := json.Unmarshal(content, &probe); err != nil {
	return err
}
if !strings.HasPrefix(probe.SPDXVersion, "SPDX-") {
	return fmt.Errorf("spdxVersion missing or invalid: %q", probe.SPDXVersion)
}

func hasSPDXVersion(b any) bool {
	m, ok := b.(map[string]any)
	if !ok { return false }
	v, _ := m["spdxVersion"].(string)
	return v != ""
}

var vErr *hcp_sbom.ValidationError
if err := processSBOM(); err != nil {
	if errors.As(err, &vErr) && strings.Contains(vErr.Error(), "missing SPDXVersion") {
		// regenerate the SBOM as SPDX 2.x JSON
	}
}

When it happens

Trigger: Content parses as JSON but the top-level spdxVersion field is missing or empty (e.g. SPDX 3.0 documents or custom JSON with SPDX-like fields), and validateSBOM's SPDX probe returns this ValidationError, which aborts before the CycloneDX probe.

Common situations: SPDX 3.0 output (which uses a different model and no spdxVersion string in the same place) fed to the provisioner; hand-written JSON resembling SPDX but omitting spdxVersion; tooling that strips or renames the field.

Related errors

• invalid bomFormat: %q, expected CycloneDX
• specVersion is required
• unsupported format: %s
• unsupported scope: %s (supported: squashed, all-layers)
• unsupported scope: %s

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/27f2cd612a405b85. Report an issue: GitHub.