What causes "unsupported format: %s" in hashicorp/packer?

Use a format string containing "cyclonedx" or "spdx", e.g. "cyclonedx-json" or "spdx-json"

unsupported format: %s

Error message

unsupported format: %s

What it means

ParseFormatFromArgs accepts only Syft-style format arguments containing 'cyclonedx' or 'spdx' (case-insensitive substring match). Any other string returns `unsupported format: %s`. The SBOM generator supports exactly two output formats: CycloneDX JSON and SPDX JSON.

Source

Thrown at internal/sbom/generator.go:63

		cfg.Scope = ScopeSquashed
	}

	return &Generator{config: cfg}
}

// ParseFormatFromArgs parses Syft-style format argument
// This is a PACKAGE-LEVEL EXPORTED FUNCTION
func ParseFormatFromArgs(formatArg string) (Format, error) {
	formatArg = strings.ToLower(formatArg)

	if strings.Contains(formatArg, "cyclonedx") {
		return FormatCycloneDX, nil
	}
	if strings.Contains(formatArg, "spdx") {
		return FormatSPDX, nil
	}

	return "", fmt.Errorf("unsupported format: %s", formatArg)
}

func ParseScopeFromArgs(scopeArg string) (string, error) {
	scopeArg = strings.ToLower(strings.TrimSpace(scopeArg))

	switch scopeArg {
	case ScopeSquashed:
		return ScopeSquashed, nil
	case ScopeAllLayers, "all", "alllayers":
		return ScopeAllLayers, nil
	default:
		return "", fmt.Errorf("unsupported scope: %s (supported: squashed, all-layers)", scopeArg)
	}
}

View on GitHub (pinned to eb36e3c3e4)

Solutions

Use a format string containing "cyclonedx" or "spdx", e.g. "cyclonedx-json" or "spdx-json"
Prefer the Format constants (FormatCycloneDX/FormatSPDX) instead of raw strings
Note XML variants are not supported — only the JSON encoders are wired in encodeToFormat
Normalize hyphenation: "cyclonedx" must appear without an internal hyphen

Example fix

// before
format, err := sbom.ParseFormatFromArgs("syft-json")
// after
format, err := sbom.ParseFormatFromArgs("cyclonedx-json")

Defensive patterns

Strategy: validation

Validate before calling

allowed := []string{"cyclonedx", "spdx"}
norm := strings.ToLower(formatArg)
for _, a := range allowed {
    if strings.Contains(norm, a) { /* ok */ }
}

Type guard

func isSupportedFormat(f string) bool {
    n := strings.ToLower(f)
    return strings.Contains(n, "cyclonedx") || strings.Contains(n, "spdx")
}

Try / catch

format, err := sbom.ParseFormatFromArgs(arg)
if err != nil {
    return fmt.Errorf("format %q not supported; use cyclonedx-json or spdx-json: %w", arg, err)
}

Prevention

Use the exported Format constants instead of raw strings
Whitelist formats at the HCL/template config layer
Remember only JSON encoders (CycloneDX/SPDX) are wired in

When it happens

Trigger: Calling ParseFormatFromArgs("json"), (""), ("syft-json"), ("text"), or any format string not containing cyclonedx/spdx; typos like "cyclone-dx" actually work (contains cyclonedx? no — 'cyclone-dx' does not contain 'cyclonedx') so hyphenated spellings fail.

Common situations: Passing Syft CLI formats not enabled here (syft-json, template, cyclonedx-xml); typos or casing/hyphenation variants like "CycloneDX-XML"; users copying flags from syft CLI docs instead of this integration's supported list.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/dbdeba788745d02c. Report an issue: GitHub.