What causes "write SBOM %q: %w" in hashicorp/packer?

Ensure the provenance output directory exists and is writable

write SBOM %q: %w

Error message

write SBOM %q: %w

What it means

Runtime error from resolveSBOM in the provenance post-processor: the generated raw SBOM bytes could not be written to the attestation working directory (atomicWriteFile failed on paths.SBOMRaw) — usually a missing/unwritable directory or disk-full condition.

Source

Thrown at post-processor/provenance/post-processor.go:470

	}

	scanPath, err := p.resolveSBOMScanPath(source)
	if err != nil {
		return "", nil, err
	}

	rawSBOM, err := p.generateSBOM(ctx, internalsbom.Config{
		ScanPath: scanPath,
		Format:   format,
		Scope:    p.config.SBOMScope,
		Exclude:  append([]string(nil), p.config.SBOMExclude...),
	})
	if err != nil {
		return "", nil, fmt.Errorf("generate SBOM: %w", err)
	}

	if err := atomicWriteFile(paths.SBOMRaw, rawSBOM, 0664); err != nil {
		return "", nil, fmt.Errorf("write SBOM %q: %w", paths.SBOMRaw, err)
	}

	return format, rawSBOM, nil
}

func (p *PostProcessor) resolveSBOMScanPath(source packersdk.Artifact) (string, error) {
	if p.config.SBOMScanPath != "" {
		return p.config.SBOMScanPath, nil
	}

	files := source.Files()
	if len(files) == 1 {
		return files[0], nil
	}
	if len(files) > 1 {
		parent := filepath.Dir(files[0])
		for _, file := range files[1:] {
			if filepath.Dir(file) != parent {

View on GitHub (pinned to eb36e3c3e4)

Solutions

Ensure the provenance output directory exists and is writable
Free disk space on the volume holding the build directory

Example fix

// before
"output_path": "/mnt/ro/attestation.json"  # read-only mount
// after
"output_path": "./dist/attestation.json"

Defensive patterns

Strategy: try-catch

Validate before calling

import os
func ensureWritable(path string) error {
	dir := filepath.Dir(path)
	if err := os.MkdirAll(dir, 0o755); err != nil { return err }
	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY, 0o664)
	if err != nil { return err }
	return f.Close()
}
// ensureWritable(expectedSBOMRawPath) before running PostProcess

Try / catch

if err := p.PostProcess(ctx, a); err != nil {
	var pe *os.PathError
	if errors.As(err, &pe) && strings.Contains(err.Error(), "write SBOM") {
		log.Printf("SBOM write failed at %s: %v", pe.Path, pe.Err)
	}
	return err
}

Prevention

Pre-create and chmod the output directory in CI.
Confirm output volume has free space for SBOM payloads.
Avoid pointing output_path at read-only or ephemeral mounts.
Test the provenance post-processor locally before CI rollout.

When it happens

Trigger: resolveSBOM (via writeSBOMAttestation) succeeds at generating rawSBOM but atomicWriteFile(paths.SBOMRaw, rawSBOM, 0664) returns an error.

Common situations: Output directory for the SBOM artifact doesn't exist; permissions denied for the packer process; disk full; SBOMRaw path collides with a directory or read-only file.

Understand the failure class

Background: "failed to write file", "Could not save figure", "Error saving remote file" — file write failed: causes and fixes across languages and libraries — this error's family across 38 libraries.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/c670f90293c44518. Report an issue: GitHub.