hashicorp/packer · error

sbom=true requires local artifact files or sbom_scan_path

Error message

sbom=true requires local artifact files or sbom_scan_path

What it means

Thrown by resolveSBOMScanPath when sbom=true but Packer cannot derive any scan path: the artifact has zero files and sbom_scan_path is empty. Some builders (cloud images, remote registries) produce artifacts with no local files, so there is nothing on disk to scan.

Source

Thrown at post-processor/provenance/post-processor.go:495

	if p.config.SBOMScanPath != "" {
		return p.config.SBOMScanPath, nil
	}

	files := source.Files()
	if len(files) == 1 {
		return files[0], nil
	}
	if len(files) > 1 {
		parent := filepath.Dir(files[0])
		for _, file := range files[1:] {
			if filepath.Dir(file) != parent {
				return "", fmt.Errorf("sbom=true requires sbom_scan_path when artifact files span multiple directories")
			}
		}
		return parent, nil
	}

	return "", fmt.Errorf("sbom=true requires local artifact files or sbom_scan_path")
}

func buildSBOMPredicate(rawSBOM []byte, format internalsbom.Format) (interface{}, string, error) {
	decoder := json.NewDecoder(bytes.NewReader(rawSBOM))
	decoder.UseNumber()

	var predicate interface{}
	if err := decoder.Decode(&predicate); err != nil {
		return nil, "", fmt.Errorf("decode SBOM payload: %w", err)
	}

	switch format {
	case internalsbom.FormatCycloneDX:
		return predicate, predicateTypeCycloneDX, nil
	case internalsbom.FormatSPDX:
		return predicate, predicateTypeSPDX, nil
	default:
		return nil, "", fmt.Errorf("unsupported SBOM format %q", format)

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Set sbom_scan_path explicitly to a local directory containing the artifact contents
2. Use a file/manifest post-processor to first export the artifact to disk
3. Disable sbom for artifacts without local files

Example fix

// before
post-processor provenance {
  sbom = true
}
// after
post-processor provenance {
  sbom = true
  sbom_scan_path = "./packer-output"
}

// Before enabling sbom, verify local files exist:
if p.config.SBOM && p.config.SBOMScanPath == "" && len(artifact.Files()) == 0 {
    fmt.Println("sbom=true needs sbom_scan_path for artifacts without local files")
}

When it happens

Trigger: provenance post-processor with sbom=true, sbom_scan_path empty, and source.Files() returning an empty slice (e.g. an amazon-ebs or docker.registry artifact with no local file list).

Common situations: Enabling SBOM on builders whose artifacts are remote resources rather than local files; forgetting that only file-producing builders expose Files().

Related errors

• sbom=true requires sbom_scan_path when artifact files span m
• unsupported SBOM format %q
• decode SBOM payload: %w
• unsupported format: %s
• unsupported scope: %s (supported: squashed, all-layers)

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/15a25b0a9406ff93. Report an issue: GitHub.