What causes "unsupported SBOM format %q" in hashicorp/packer?

Set sbom_format to "cyclonedx-json" or "spdx-json"

unsupported SBOM format %q

Error message

unsupported SBOM format %q

What it means

The SBOM format value resolved to something other than CycloneDX or SPDX, the two formats the attestation builder supports. ParseFormatFromArgs elsewhere accepts more aliases, so this fires only when an unexpected format reaches buildSBOMPredicate.

Source

Thrown at post-processor/provenance/post-processor.go:513

	return "", fmt.Errorf("sbom=true requires local artifact files or sbom_scan_path")
}

func buildSBOMPredicate(rawSBOM []byte, format internalsbom.Format) (interface{}, string, error) {
	decoder := json.NewDecoder(bytes.NewReader(rawSBOM))
	decoder.UseNumber()

	var predicate interface{}
	if err := decoder.Decode(&predicate); err != nil {
		return nil, "", fmt.Errorf("decode SBOM payload: %w", err)
	}

	switch format {
	case internalsbom.FormatCycloneDX:
		return predicate, predicateTypeCycloneDX, nil
	case internalsbom.FormatSPDX:
		return predicate, predicateTypeSPDX, nil
	default:
		return nil, "", fmt.Errorf("unsupported SBOM format %q", format)
	}
}

func (p *PostProcessor) externalParameters(env map[string]string) map[string]interface{} {
	externalParameters := map[string]interface{}{}

	if p.config.TemplatePath != "" {
		externalParameters["template"] = p.config.TemplatePath
	}
	if len(p.config.OnlyBuilds) > 0 {
		externalParameters["onlyBuilds"] = append([]string(nil), p.config.OnlyBuilds...)
	}

	userVariables := collectUserVariables(env)
	for key, value := range p.config.UserVariables {
		userVariables[key] = value
	}
	redactSensitiveVariables(userVariables, p.config.PackerSensitiveVars)

View on GitHub (pinned to eb36e3c3e4)

Solutions

Set sbom_format to "cyclonedx-json" or "spdx-json"
Check the config value for typos or extra quoting
Upgrade/downgrade the provenance post-processor so format and attestation mappings match

Example fix

// before
sbom_format = "json"
// after
sbom_format = "cyclonedx-json"

Defensive patterns

Strategy: validation

Validate before calling

// Pre-check sbom_format against supported attestation formats:
supported := map[string]bool{"cyclonedx-json": true, "spdx-json": true}
if !supported[strings.ToLower(cfg.SBOMFormat)] {
    fmt.Println("sbom_format must be cyclonedx-json or spdx-json")
}

Prevention

Use only documented sbom_format values: cyclonedx-json or spdx-json
Re-check config after upgrading packer/internalsbom versions
Avoid passing free-form strings like "json" or "xml"

When it happens

Trigger: buildSBOMPredicate receives a format value not in {FormatCycloneDX, FormatSPDX} — possible only if internalsbom gains a new format or the format was resolved inconsistently (e.g. custom/unknown sbom_format string that parsed successfully but has no attestation predicate type).

Common situations: Setting sbom_format to an unsupported string like "json" or "custom"; upgrading the SDK/internalsbom package so a new format exists without a mapping here.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/6d68f4b357b861b9. Report an issue: GitHub.