`sbom_name` %q doesn't match the expected format, it must co

Error message

`sbom_name` %q doesn't match the expected format, it must contain between 3 and 36 characters, all from the following set: [A-Za-z0-9_-]

What it means

Prepare-time validation error from the hcp-sbom provisioner: the optional `sbom_name` set in the template fails sbomFormatRegexp (3-36 chars from [A-Za-z0-9_-]). HCP Packer enforces this format, so invalid names are rejected early. As a special case, names still containing the literal '<no value>' (incomplete HCL2 interpolation — Prepare runs twice) only produce a warning, since a later Prepare/Provision call may see the fully interpolated value.

Source

Thrown at provisioner/hcp-sbom/provisioner.go:258

	}

	if p.config.SbomName != "" && !sbomFormatRegexp.MatchString(p.config.SbomName) {
		// Ugly but a bit of a problem with interpolation since Provisioners
		// are prepared twice in HCL2.
		//
		// If the information used for interpolating is populated in-between the
		// first call to Prepare (at the start of the build), and when the
		// Provisioner is actually called, the first call will fail, as
		// the value won't contain the actual interpolated value, but a
		// placeholder which doesn't match the regex.
		//
		// Since we don't have a way to discriminate between the calls
		// in the context of the provisioner, we ignore them, and later the
		// HCP Packer call will fail because of the broken regex.
		if strings.Contains(p.config.SbomName, "<no value>") {
			log.Printf("[WARN] interpolation incomplete for `sbom_name`, will possibly retry later with data populated into context, otherwise will fail when uploading to HCP Packer.")
		} else {
			errs = packersdk.MultiErrorAppend(errs, fmt.Errorf("`sbom_name` %q doesn't match the expected format, it must "+
				"contain between 3 and 36 characters, all from the following set: [A-Za-z0-9_-]", p.config.SbomName))
		}
	}

	return errs
}

// PackerSBOM is the type we write to the temporary JSON dump of the SBOM to
// be consumed by Packer core
type PackerSBOM struct {
	// RawSBOM is the raw data from the SBOM downloaded from the guest
	RawSBOM []byte `json:"raw_sbom"`
	// Format is the format detected by the provisioner
	//
	// Supported values: `SPDX` or `CYCLONEDX`
	Format hcpPackerModels.HashicorpCloudPacker20230101SbomFormat `json:"format"`
	// Name is the name of the SBOM to be set on HCP Packer
	//

View on GitHub (pinned to eb36e3c3e4)

Solutions

Rename `sbom_name` to 3-36 characters using only letters, digits, underscore, and hyphen.
If the name comes from interpolation, check the resolved value length and content (e.g. use tr/slugify via a local).
Remember Prepare runs twice in HCL2: if you see '<no value>' warnings, the final interpolated value must still satisfy the regex or the HCP upload will fail later.
Drop `sbom_name` entirely to let HCP Packer generate one.

Example fix

// before
sbom_name = "My SBOM (final)"
// after
sbom_name = "my-sbom-final"

Defensive patterns

Strategy: validation

Validate before calling

var sbomNameRe = regexp.MustCompile(`^[A-Za-z0-9_-]{3,36}$`)
func validateSbomName(name string) error {
	if name == "" || strings.Contains(name, "<no value>") {
		return nil // unset or still interpolating
	}
	if !sbomNameRe.MatchString(name) {
		return fmt.Errorf("sbom_name %q must be 3-36 chars from [A-Za-z0-9_-]", name)
	}
	return nil
}

Type guard

func sbomNameIsValid(s string) bool {
	return len(s) >= 3 && len(s) <= 36 && !strings.ContainsFunc(s, func(r rune) bool {
		return !(r >= 'A' && r <= 'Z' || r >= 'a' && r <= 'z' || r >= '0' && r <= '9' || r == '_' || r == '-')
	})
}

Try / catch

if err := packerBuild(...); err != nil {
	if strings.Contains(err.Error(), "doesn't match the expected format") {
		return fmt.Errorf("fix `sbom_name` in your template: 3-36 chars, [A-Za-z0-9_-] only: %w", err)
	}
}

Prevention

Validate sbom_name against ^[A-Za-z0-9_-]{3,36}$ before running packer build
Avoid spaces, dots, slashes and ':' in names; slugify interpolated values
Watch for '<no value>' warnings — the final interpolated name must still pass the regex
Omit sbom_name to let HCP Packer auto-generate one

When it happens

Trigger: config.SbomName is non-empty, fails the regex, and does NOT contain '<no value>' — e.g. it is too short (<3), too long (>36), or contains characters like spaces, dots, slashes, or ':' during p.config Prepare in Prepare().

Common situations: Using a human-readable name with spaces or dots ('my.sbom v1'); interpolating HCP Packer variables that resolve too long; typos making the name 1-2 chars; accidentally passing a full path instead of a bare name.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/2fee9282afc7e5d8. Report an issue: GitHub.