iSharkFly-Docs/Packer-Cn
2
0
Fork 0
mirror of https://github.com/hashicorp/packer.git synced 2026-10-25 23:48:32 -04:00
Code Issues Packages Projects Releases Wiki Activity
19,012 Commits 348 Branches 148 Tags
da0d1a3c440832aeb70b7a78cdc89b60c762b85e
Commit Graph
19012 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Erik BergandClaude Fable 5 da0d1a3c44 hcl2template: pass user variable values to plugins as packer_user_variables (#13686) 
HCL2 builds do not send the packer_user_variables config key to the
builder, provisioner and post-processor plugins. Legacy JSON builds
send this key (through CoreBuild.packerConfig()). Without the key, the
plugin SDK keeps interpolate.Context.UserVariables nil. Then the
template function {{ user "name" }} fails with 'error calling user:
test'. This failure occurs in each string that a plugin interpolates at
run time, for example the contents of the vagrant post-processor's
vagrantfile_template.

Add the function PackerConfig.userVariableValues(). This function
converts the input variable values to strings, equivalent to the legacy
user variables. The core sends the map at each plugin handoff point:
builder, provisioner, post-processor, and enforced provisioner.

The map does not contain the sensitive variables. A sensitive value
goes to a plugin only if the template refers to it explicitly. The map
does not contain values that are not primitive (lists, maps, objects).
Legacy user variables were always strings.

Co-authored-by: Claude Fable 5 <[email protected]>
 2026-08-10 13:32:18 +05:30
Tanmay Jain 856572ec83 version: cut release v1.16.0 (#13682) 
* Go Module grpc update

* version: cut release v1.16.0
v1.16.0 		2026-07-24 11:33:24 +05:30
Tanmay Jain aea5e6bfa3 fix: prevent path traversal in GitHub plugin getter filename (#13680) 2026-07-22 11:03:11 +05:30
Tanmay Jain 014f8d1bbe FEAT(provenance): Add SLSA provenance attestation and verification (#13667) 
* feat(provenance): add SLSA provenance and attestation signing libraries

Add internal/provenance for deriving in-toto subjects from Packer
artifacts, building SLSA Provenance v1 predicates, wrapping in-toto
statements, and best-effort git/CI source detection.

Add internal/attestation for DSSE envelope handling and a pluggable
Signer/Verifier backend supporting key (local PEM), kms (aws/gcp/
azure/hashivault), and keyless (Sigstore Fulcio) modes, plus Sigstore
bundle handling and DSSE/policy verification.

Add the supporting module dependencies in go.mod/go.sum.

* feat(provenance): add provenance post-processor

Add the opt-in "provenance" post-processor that runs after a build,
derives subjects from the artifact, emits DSSE-wrapped SLSA provenance
(and optional SBOM) attestations, signs them via the configured
signing backend, and writes sidecar files (including *.sigstore.json
bundles in keyless mode). Register it in the core post-processor set.

The provenance enable flag is a tri-state so an unset value stays
enabled through HCL2 decoding instead of being silently disabled.

* feat(provenance): add verify-attestation command

Add "packer verify-attestation" to verify signed DSSE attestations
against key, KMS, and keyless policy inputs, including optional
Sigstore bundle checks for Rekor and timestamp evidence. Register the
command in the CLI.

* docs(provenance): add reference CI workflows and changelog

Add reference GitHub Actions workflows under examples/ci for SLSA L2
keyless signing and L3-compatible delegated signing

* fix: lint and tests

* Added docs for Provenance PostProcessor
 2026-07-21 13:40:42 +05:30
Tanmay Jain 65f0fb3ff2 Suppress false positive for GO-2026-5932 (#13677) 2026-07-10 12:04:26 +05:30
Tanmay Jain 76135acec4 Pin Action Refs to Latest (#13675) 2026-07-10 11:57:50 +05:30
Tanmay Jain fbcc619a6b security: drop x/crypto/openpgp by upgrading go-github v33 -> v75 (#13676) 2026-07-10 11:20:44 +05:30
dependabot[bot] e64148cb81 build(deps): bump golang.org/x/net in /packer_test/common/plugin_tester (#13664) 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.54.0 to 0.55.0.
- [Commits](https://github.com/golang/net/compare/v0.54.0...v0.55.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.55.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-09 12:43:52 +05:30
dependabot[bot] 7ee518a021 build(deps): bump golang.org/x/crypto (#13672) 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.47.0 to 0.52.0.
- [Commits](https://github.com/golang/crypto/compare/v0.47.0...v0.52.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.52.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-09 12:38:32 +05:30
Tanmay Jain b233fff1e8 FEAT: Add continue_on_error option to HCL2 provisioner blocks (#13674) 2026-07-09 12:27:18 +05:30
Tanmay Jain 8b304b2b7f FEAT: Add rfc3339_parse and unix_timestamp_parse HCL functions (#13669) 2026-07-08 16:01:46 +05:30
Tanmay Jain b0451d400d Updated Go Modules (#13673) 2026-07-08 15:25:35 +05:30
Tanmay Jain 9dc75dc66c core/hcl2: support optional() attributes in variable object types (#13670) 2026-07-08 15:12:16 +05:30
eshan-tripathi d5e6ccb165 Merge pull request #13671 from hashicorp/remove-old-website 
chore: remove website, fix:references
 2026-07-08 11:56:48 +05:30
eshan-tripathi ba86798d7b fix: CONTRIBUTING.md 2026-07-07 14:26:50 +05:30
eshan-tripathi d2f2baa4b4 chore: remove website, fix:references 2026-07-07 12:21:06 +05:30
Tanmay Jain b95fa4be03 chore: added an AGENTS.md (#13668) 2026-07-06 11:51:43 +05:30
Hari 2f86cc4001 chore(release): update changelog and version to 1.15.4 (#13651) 2026-06-03 18:27:30 +05:30
Hari 5ed27a3490 fix: update build constraints to support arm architecture on FreeBSD (#13650) 2026-06-03 16:52:34 +05:30
Hari 5c431e0e44 Removes Syft binary download/handling from the HCP SBOM provisioner (#13636) 2026-06-03 15:23:57 +05:30
hashicorp-copywrite[bot] abc4bfffce Merge pull request #13632 from hashicorp/compliance/add-headers 
[COMPLIANCE] Add/Update Copyright Headers
 2026-06-03 14:37:46 +05:30
Tanmay Jain 683af0c935 Merge pull request #13649 from hashicorp/dependabot/github_actions/actions-f333ae29b9 
build(deps): bump the actions group across 1 directory with 7 updates
 2026-06-03 12:36:00 +05:30
dependabot[bot] a3f194a8d1 build(deps): bump the actions group across 1 directory with 7 updates 
Bumps the actions group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `4.3.1` |
| [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `4.0.2` | `4.3.1` |
| [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action) | `1.27.0` | `1.27.1` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.0` | `4.6.2` |
| [actions/github-script](https://github.com/actions/github-script) | `7.0.1` | `7.1.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.1.8` | `4.3.0` |
| [ncipollo/release-action](https://github.com/ncipollo/release-action) | `1.15.0` | `1.21.0` |



Updates `actions/checkout` from 4.2.2 to 4.3.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/11bd71901bbe5b1630ceea73d27597364c9af683...34e114876b0b11c390a56381ad16ebd13914f8d5)

Updates `aws-actions/configure-aws-credentials` from 4.0.2 to 4.3.1
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](https://github.com/aws-actions/configure-aws-credentials/compare/e3dd6a429d7300a6a4c196c26e071d42e0343502...7474bc4690e29a8392af63c5b98e7449536d5c3a)

Updates `slackapi/slack-github-action` from 1.27.0 to 1.27.1
- [Release notes](https://github.com/slackapi/slack-github-action/releases)
- [Changelog](https://github.com/slackapi/slack-github-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/slackapi/slack-github-action/compare/37ebaef184d7626c5f204ab8d3baff4262dd30f0...fcfb566f8b0aab22203f066d80ca1d7e4b5d05b3)

Updates `actions/upload-artifact` from 4.6.0 to 4.6.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08...ea165f8d65b6e75b540449e92b4886f43607fa02)

Updates `actions/github-script` from 7.0.1 to 7.1.0
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/60a0d83039c74a4aee543508d2ffcb1c3799cdea...f28e40c7f34bde8b3046d885e986cb6290c5673b)

Updates `actions/download-artifact` from 4.1.8 to 4.3.0
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/fa0a91b85d4f404e444e00e005971372dc801d16...d3f86a106a0bac45b974a628896c90dbdf5c8093)

Updates `ncipollo/release-action` from 1.15.0 to 1.21.0
- [Release notes](https://github.com/ncipollo/release-action/releases)
- [Commits](https://github.com/ncipollo/release-action/compare/cdcc88a9acf3ca41c16c37bb7d21b9ad48560d87...339a81892b84b4eeb0f6e744e4574d79d0d9b8dd)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 4.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: 4.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: slackapi/slack-github-action
  dependency-version: 1.27.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: 4.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/github-script
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/download-artifact
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: ncipollo/release-action
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
 2026-06-03 06:56:15 +00:00
Tanmay Jain 219be22e1a Merge pull request #13647 from hashicorp/module-update 
Update Go version and refresh dependencies
 2026-06-03 12:22:05 +05:30
Tanmay Jain 958d1a8315 Update Go version and refresh dependencies 2026-06-03 12:13:48 +05:30
mukulmohan177 cddfaf5d03 Merge pull request #13645 from hashicorp/authorization-bypass 
upgraded go-git and crypto version
 2026-06-03 08:26:34 +05:30
Taru Garg 9c9ad59981 Update Go version from 1.25.9 to 1.25.10 (#13646) 2026-06-02 18:11:25 +05:30
Tanmay Jain 46392d6e9f Merge pull request #13640 from hashicorp/dependabot/go_modules/github.com/hashicorp/packer-plugin-sdk-0.6.9 
build(deps): bump github.com/hashicorp/packer-plugin-sdk from 0.6.7 to 0.6.9
 2026-06-02 14:59:17 +05:30
sanyaraj2424 277b49a248 upgraded crypto version 2026-06-01 10:38:00 +05:30
sanyaraj2424 14b14d0220 upgraded go-git version 2026-05-29 11:58:45 +05:30