source must be specified when auto_generate is not enabled

Error message

source must be specified when auto_generate is not enabled

What it means

The hcp-sbom provisioner runs in one of two modes: auto-generate mode (which produces the SBOM itself) or traditional source mode (which reads an existing SBOM file). This error is thrown in Prepare when auto_generate is not enabled and p.config.Source is empty, meaning the provisioner would have no SBOM input at all. It is a fail-fast configuration validation so builds stop before a machine is ever provisioned.

Source

Thrown at provisioner/hcp-sbom/provisioner.go:235

		// Set default execute_command if not provided
		// Note: This will be further customized based on OS at runtime
		if p.config.ExecuteCommand == "" {
			p.config.ExecuteCommand = "chmod +x {{.Path}} && sudo {{.Path}} sbom-generate {{.Args}} {{.ScanPath}} > {{.Output}}"
		}

		// Keep legacy validation for clarity while fields remain accepted.
		if p.config.ScannerChecksum != "" && p.config.ScannerURL == "" {
			errs = packersdk.MultiErrorAppend(errs, errors.New("scanner_checksum requires scanner_url to be specified (note: both fields are deprecated and ignored)"))
		}

		// Validate elevated user configuration (Windows only)
		if p.config.ElevatedUser == "" && p.config.ElevatedPassword != "" {
			errs = packersdk.MultiErrorAppend(errs, errors.New("elevated_user must be specified if elevated_password is provided"))
		}
	} else {
		// Traditional mode: source is required
		if p.config.Source == "" {
			errs = packersdk.MultiErrorAppend(errs, errors.New("source must be specified when auto_generate is not enabled"))
		}

		// Note: Scanner-related fields are allowed in source mode to support
		// toggling auto_generate without clearing configuration fields
	}

	if p.config.SbomName != "" && !sbomFormatRegexp.MatchString(p.config.SbomName) {
		// Ugly but a bit of a problem with interpolation since Provisioners
		// are prepared twice in HCL2.
		//
		// If the information used for interpolating is populated in-between the
		// first call to Prepare (at the start of the build), and when the
		// Provisioner is actually called, the first call will fail, as
		// the value won't contain the actual interpolated value, but a
		// placeholder which doesn't match the regex.
		//
		// Since we don't have a way to discriminate between the calls
		// in the context of the provisioner, we ignore them, and later the

View on GitHub (pinned to eb36e3c3e4)

Solutions

Set source in the hcp-sbom provisioner block to the path of the SBOM file to upload.
Alternatively set auto_generate = true if you want Packer/HCP to generate the SBOM instead of supplying one.
If using a variable for source, verify the variable has a non-empty default/value at packer build time.

Example fix

// before
provisioner "hcp-sbom" {
  scanner {
    sbom_version = 1
  }
}

// after
provisioner "hcp-sbom" {
  source = "sbom.cdx.json"
}

Defensive patterns

Strategy: validation

Validate before calling

// In the provisioner block, ensure one of the two modes is configured before building:
// valid if: auto_generate == true  OR  source != ""
// HCL check you can run:
// packer validate template.pkr.hcl
precondition {
  condition     = var.sbom_source != "" || var.auto_generate
  error_message = "Set hcp-sbom source or enable auto_generate."
}

Prevention

Always pair source with the traditional mode and auto_generate = true with generated mode.
Run packer validate before packer build to catch Prepare errors early.
Give source-providing variables non-empty defaults.

When it happens

Trigger: Calling packer build with an hcp-sbom provisioner block that omits the source field while auto_generate is false or unset. E.g. provisioner "hcp-sbom" { scanner { ... } } with neither source nor auto_generate = true.

Common situations: Users copy an auto_generate example and delete source intending auto-generate, but forget to set auto_generate = true; users migrating between modes leave source blank; partial config from templating variables where the source variable is empty at packer time.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/e02014dafa43b585. Report an issue: GitHub.