sbom=true requires sbom_scan_path when artifact files span m

Error message

sbom=true requires sbom_scan_path when artifact files span multiple directories

What it means

The provenance post-processor throws this when sbom=true but the artifact exposes more than one file and those files do not all live in the same directory. Packer would otherwise guess a scan root from the files, and a multi-directory spread makes that guess ambiguous, so it refuses and asks for an explicit sbom_scan_path.

Source

Thrown at post-processor/provenance/post-processor.go:489

	}

	return format, rawSBOM, nil
}

func (p *PostProcessor) resolveSBOMScanPath(source packersdk.Artifact) (string, error) {
	if p.config.SBOMScanPath != "" {
		return p.config.SBOMScanPath, nil
	}

	files := source.Files()
	if len(files) == 1 {
		return files[0], nil
	}
	if len(files) > 1 {
		parent := filepath.Dir(files[0])
		for _, file := range files[1:] {
			if filepath.Dir(file) != parent {
				return "", fmt.Errorf("sbom=true requires sbom_scan_path when artifact files span multiple directories")
			}
		}
		return parent, nil
	}

	return "", fmt.Errorf("sbom=true requires local artifact files or sbom_scan_path")
}

func buildSBOMPredicate(rawSBOM []byte, format internalsbom.Format) (interface{}, string, error) {
	decoder := json.NewDecoder(bytes.NewReader(rawSBOM))
	decoder.UseNumber()

	var predicate interface{}
	if err := decoder.Decode(&predicate); err != nil {
		return nil, "", fmt.Errorf("decode SBOM payload: %w", err)
	}

	switch format {

View on GitHub (pinned to eb36e3c3e4)

Solutions

Set sbom_scan_path in the provenance post-processor config to the directory (or file) to scan
Restructure the build so all artifact files land in one directory
Set sbom=false if SBOM attestation is not needed

Example fix

// before
post-processors {
  post-processor provenance {
    sbom = true
  }
}
// after
post-processors {
  post-processor provenance {
    sbom = true
    sbom_scan_path = "./output"
  }
}

Defensive patterns

Strategy: validation

Validate before calling

// In your template config, before running packer build
// if sbom = true, make sure artifact files share a dir or set the path:
files := artifact.Files()
if len(files) > 1 {
    parent := filepath.Dir(files[0])
    for _, f := range files[1:] {
        if filepath.Dir(f) != parent {
            fmt.Println("set sbom_scan_path explicitly")
        }
    }
}

Prevention

Always set sbom_scan_path when sbom=true unless the artifact is a single local file
Keep artifact outputs in one flat output directory
Run packer validate / a dry build to exercise resolveSBOMScanPath early

When it happens

Trigger: Configure the provenance post-processor with sbom=true, leave sbom_scan_path unset, and have the artifact's Files() list contain paths whose filepath.Dir values differ (e.g. 'out/a/pkg.tar' plus 'out/b/manifest.json').

Common situations: Artifacts from builders that emit multiple outputs (a file builder writing several files, or a manifest/artifact-export chain) combined with sbom=true and no explicit scan path; also happens after changing output config so files no longer share a directory.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/53db8a97aa6bcb28. Report an issue: GitHub.