mirror of
https://github.com/hashicorp/packer.git
synced 2026-11-05 20:05:14 -05:00
v1.16.2
5
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
     
|
b35bf7d952 |
Backport changes for Packer 1.16.2 (#13730)
* fix: run make generate to fix test errors (#13719) * ci: bump lock-threads to v6 so the scheduled lock job can run (#13693) The pinned version validates its github-token input with a 100 character cap, and the Actions token now exceeds that, so every run fails before locking anything: ##[error]"github-token" length must be less than or equal to 100 characters long v6 raised the cap to 1000 (v4 and v5.0.x both still validate max(100)). Every input this workflow passes exists unchanged in the v6 schema, so the pin bump is the whole fix. Pinned to the v6.0.2 release commit. Co-authored-by: Tushar Pagar <[email protected]> * build(deps): bump the actions group across 1 directory with 7 updates (#13720) Bumps the actions group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.2.3` | `6.3.0` | | [hashicorp/actions-generate-metadata](https://github.com/hashicorp/actions-generate-metadata) | `1.1.4` | `1.3.1` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [hashicorp/actions-go-build](https://github.com/hashicorp/actions-go-build) | `1.1.2` | `1.1.3` | | [hashicorp/actions-docker-build](https://github.com/hashicorp/actions-docker-build) | `2.2.1` | `2.3.0` | | [github/issue-labeler](https://github.com/github/issue-labeler) | `3.4` | `3.5` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | Updates `aws-actions/configure-aws-credentials` from 6.2.3 to 6.3.0 - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](https://github.com/aws-actions/configure-aws-credentials/compare/e6de054238d6b7531b4efff3b6587d9aade6a06c...e1253824e5c10ff9df46874f81ed3ec929e19cfd) Updates `hashicorp/actions-generate-metadata` from 1.1.4 to 1.3.1 - [Release notes](https://github.com/hashicorp/actions-generate-metadata/releases) - [Commits](https://github.com/hashicorp/actions-generate-metadata/compare/a43468dfb100445f2c2aa52cdc3d57b2c982a0f3...aff2981e4d616c852cf7652a8019e719e7a1cce0) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `hashicorp/actions-go-build` from 1.1.2 to 1.1.3 - [Release notes](https://github.com/hashicorp/actions-go-build/releases) - [Changelog](https://github.com/hashicorp/actions-go-build/blob/main/CHANGELOG.md) - [Commits](https://github.com/hashicorp/actions-go-build/compare/dd7ca5a30c402c933e1fe61e0ff7165e5c4ee9e4...3f078f63a57c91c3e07285183d22e47869fe0dce) Updates `hashicorp/actions-docker-build` from 2.2.1 to 2.3.0 - [Release notes](https://github.com/hashicorp/actions-docker-build/releases) - [Changelog](https://github.com/hashicorp/actions-docker-build/blob/main/CHANGELOG.md) - [Commits](https://github.com/hashicorp/actions-docker-build/compare/e12557abf02a40557313ab2839d6cd2c6705261e...595f29357108da6d4767b6a48e5f01f25de0c131) Updates `github/issue-labeler` from 3.4 to 3.5 - [Release notes](https://github.com/github/issue-labeler/releases) - [Commits](https://github.com/github/issue-labeler/compare/c1b0f9f52a63158c4adc09425e858e87b32e9685...ccca1e16fcb66762200e616fc29b57b940c1cb67) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) --- updated-dependencies: - dependency-name: aws-actions/configure-aws-credentials dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: hashicorp/actions-generate-metadata dependency-version: 1.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: hashicorp/actions-go-build dependency-version: 1.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: hashicorp/actions-docker-build dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/issue-labeler dependency-version: '3.5' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * [COMPLIANCE] Add/Update Copyright Headers (#13718) * [COMPLIANCE] Add/Update Copyright Headers * fix: add the copyright header to the source file --------- Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com> Co-authored-by: Taru Garg <[email protected]> * build(deps): bump github.com/hashicorp/hcp-sdk-go (#13722) Bumps [github.com/hashicorp/hcp-sdk-go](https://github.com/hashicorp/hcp-sdk-go) from 0.175.0 to 0.176.0. - [Release notes](https://github.com/hashicorp/hcp-sdk-go/releases) - [Changelog](https://github.com/hashicorp/hcp-sdk-go/blob/main/CHANGELOG.md) - [Commits](https://github.com/hashicorp/hcp-sdk-go/compare/v0.175.0...v0.176.0) --- updated-dependencies: - dependency-name: github.com/hashicorp/hcp-sdk-go dependency-version: 0.176.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Update dependencies in plugin_tester module (#13728) - Bump Go version from 1.26.8 to 1.26.10 - Upgrade github.com/hashicorp/hcl/v2 from v2.24.0 to v2.25.0 - Upgrade github.com/hashicorp/packer-plugin-sdk from v0.6.11 to v0.6.13 - Upgrade github.com/zclconf/go-cty from v1.18.1 to v1.19.0 - Add indirect dependencies for aws-sdk-go-v2 and related packages - Upgrade various indirect dependencies including golang.org/x/crypto, golang.org/x/net, and golang.org/x/text - Remove deprecated dependency on github.com/jmespath/go-jmespath * changelog: update to version 1.16.2 with bug fixes, improvements, and dependency updates --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Taru Garg <[email protected]> Co-authored-by: Tushar Pagar <[email protected]> Co-authored-by: Tushar Pagar <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com> |
||
 Tanmay Jain
|
014f8d1bbe |
FEAT(provenance): Add SLSA provenance attestation and verification (#13667)
* feat(provenance): add SLSA provenance and attestation signing libraries Add internal/provenance for deriving in-toto subjects from Packer artifacts, building SLSA Provenance v1 predicates, wrapping in-toto statements, and best-effort git/CI source detection. Add internal/attestation for DSSE envelope handling and a pluggable Signer/Verifier backend supporting key (local PEM), kms (aws/gcp/ azure/hashivault), and keyless (Sigstore Fulcio) modes, plus Sigstore bundle handling and DSSE/policy verification. Add the supporting module dependencies in go.mod/go.sum. * feat(provenance): add provenance post-processor Add the opt-in "provenance" post-processor that runs after a build, derives subjects from the artifact, emits DSSE-wrapped SLSA provenance (and optional SBOM) attestations, signs them via the configured signing backend, and writes sidecar files (including *.sigstore.json bundles in keyless mode). Register it in the core post-processor set. The provenance enable flag is a tri-state so an unset value stays enabled through HCL2 decoding instead of being silently disabled. * feat(provenance): add verify-attestation command Add "packer verify-attestation" to verify signed DSSE attestations against key, KMS, and keyless policy inputs, including optional Sigstore bundle checks for Rekor and timestamp evidence. Register the command in the CLI. * docs(provenance): add reference CI workflows and changelog Add reference GitHub Actions workflows under examples/ci for SLSA L2 keyless signing and L3-compatible delegated signing * fix: lint and tests * Added docs for Provenance PostProcessor |
||
 Devashish
|
a353260f5d |
packer: add hcp-sbom provisioner
The hcp-sbom provisioner is a provisioner that acts essentially like a download-only file provisioner, which also verifies the file downloaded is a SPDX/CycloneDX JSON-encoded SBOM file, and sets up its upload to HCP Packer later on. |
||
 Lucas Bajolet
|
9f6f0ba6a2 |
packer: pick protobuf/gob for serialisation (#13025)
As we're trying to move away from gob for serialising data over the wire, this commit adds the capability for Packer to pick dynamically between gob or protobuf for the serialisation format to communicate with plugins. As it stands, if all the plugins discovered are compatible with protobuf, and we have not forced gob usage, protobuf will be the serialisation format picked. If any plugin is not compatible with protobuf, gob will be used for communicating with all the plugins that will be used over the course of a command. |
||
 Lucas Bajolet
|
7f056211d9 |
commands: rename plugin to execute
The plugin and plugins command had a name that was close, and while plugin is not supposed to be directly called by Packer users, this could happen by accident while trying to execute packer plugins subcommands, and when it does, the error messages are far from explicit, so unless they understand what Packer is doing here, they'll likely be lost. To reduce the risk of confusion, we rename the command to run packer embedded components as execute. |