* feat(provenance): add SLSA provenance and attestation signing libraries
Add internal/provenance for deriving in-toto subjects from Packer
artifacts, building SLSA Provenance v1 predicates, wrapping in-toto
statements, and best-effort git/CI source detection.
Add internal/attestation for DSSE envelope handling and a pluggable
Signer/Verifier backend supporting key (local PEM), kms (aws/gcp/
azure/hashivault), and keyless (Sigstore Fulcio) modes, plus Sigstore
bundle handling and DSSE/policy verification.
Add the supporting module dependencies in go.mod/go.sum.
* feat(provenance): add provenance post-processor
Add the opt-in "provenance" post-processor that runs after a build,
derives subjects from the artifact, emits DSSE-wrapped SLSA provenance
(and optional SBOM) attestations, signs them via the configured
signing backend, and writes sidecar files (including *.sigstore.json
bundles in keyless mode). Register it in the core post-processor set.
The provenance enable flag is a tri-state so an unset value stays
enabled through HCL2 decoding instead of being silently disabled.
* feat(provenance): add verify-attestation command
Add "packer verify-attestation" to verify signed DSSE attestations
against key, KMS, and keyless policy inputs, including optional
Sigstore bundle checks for Rekor and timestamp evidence. Register the
command in the CLI.
* docs(provenance): add reference CI workflows and changelog
Add reference GitHub Actions workflows under examples/ci for SLSA L2
keyless signing and L3-compatible delegated signing
* fix: lint and tests
* Added docs for Provenance PostProcessor
* fixes typos in base docs
* fixes typos in example code
* fixes typos in website docs
* fixes link to Terraform provider
* fixes typo in function name
* move alicloud examples from common example directory to alicloud builder
* move amazon examples to amazon builder dir
* move examples into ansible provisioner directory
* move azure examples to builder dir
* move hyperone examples into builder directory
* move jdcloud builder examples into builder directory
* move tencent cloud examples into the builder directory
* move ucloud examples into ucloud builder directory
The Azure example uses an inline PowerShell script to wait for sysprep to complete. While waiting, it prints out the current setup state *if the state is **not** complete*, otherwise it breaks and shuts down.
This logging behavior can be confusing because the last message logged says that sysprep is not completed. To clarify things, move the log statement ahead of the "if" check so the result of each polling operation is logged.
Data disk is an important feature for instances and images, this
patch implements the basic functionality of it. More work needs
to be done to make it friendly to users. Docs has pointed out
current limitation.
Also update dependencies because this feature requires new code in
tencentcloud go sdk.
Instance tags are useful, our customer asks us to support it in packer as
well, to enable them to identify the purpose of the instance, even the
instance runs in a very short time.
Tanmay Jain
Kerim Satirli
Adrien Delorme
Megan Marsh
Adrien Delorme
Ricardo Rosales
Jean-Francois Panisset
Brad Ackerman
satya
satyamuralidhar
Adam Dobrawy
mingsheng.su
Li Kexian
Paul Meyer
Etienne Deneuve
Matt Kotsenas
xiaohan.liang
Jesse Mazzella
ZhiQiang Fan