Tanmay Jain
014f8d1bbe
* feat(provenance): add SLSA provenance and attestation signing libraries Add internal/provenance for deriving in-toto subjects from Packer artifacts, building SLSA Provenance v1 predicates, wrapping in-toto statements, and best-effort git/CI source detection. Add internal/attestation for DSSE envelope handling and a pluggable Signer/Verifier backend supporting key (local PEM), kms (aws/gcp/ azure/hashivault), and keyless (Sigstore Fulcio) modes, plus Sigstore bundle handling and DSSE/policy verification. Add the supporting module dependencies in go.mod/go.sum. * feat(provenance): add provenance post-processor Add the opt-in "provenance" post-processor that runs after a build, derives subjects from the artifact, emits DSSE-wrapped SLSA provenance (and optional SBOM) attestations, signs them via the configured signing backend, and writes sidecar files (including *.sigstore.json bundles in keyless mode). Register it in the core post-processor set. The provenance enable flag is a tri-state so an unset value stays enabled through HCL2 decoding instead of being silently disabled. * feat(provenance): add verify-attestation command Add "packer verify-attestation" to verify signed DSSE attestations against key, KMS, and keyless policy inputs, including optional Sigstore bundle checks for Rekor and timestamp evidence. Register the command in the CLI. * docs(provenance): add reference CI workflows and changelog Add reference GitHub Actions workflows under examples/ci for SLSA L2 keyless signing and L3-compatible delegated signing * fix: lint and tests * Added docs for Provenance PostProcessor
Packer
Packer is a tool for building identical machine images for multiple platforms from a single source configuration.
Packer is lightweight, runs on every major operating system, and is highly performant, creating machine images for multiple platforms in parallel. Packer supports various platforms through external plugin integrations, the full list of which can be found at https://developer.hashicorp.com/packer/integrations.
The images that Packer creates can easily be turned into Vagrant boxes.
Quick Start
Packer
There is a great introduction and getting started guide for building a Docker image on your local machine without using any paid cloud resources.
Alternatively, you can refer to getting started with AWS to learn how to build a machine image for an external cloud provider.
HCP Packer
HCP Packer registry stores Packer image metadata, enabling you to track your image lifecycle.
To get started with building an AWS machine image to HCP Packer for referencing in Terraform refer to the collection of HCP Packer Tutorials.
Documentation
Comprehensive documentation is viewable on the Packer website at https://developer.hashicorp.com/packer/docs.
Contributing to Packer
See CONTRIBUTING.md for best practices and instructions on setting up your development environment to work on Packer.
Contributing to Documentation
Important: Packer documentation has moved to the hashicorp/web-unified-docs repository.
To contribute documentation changes:
- Make contributions directly to the
web-unified-docsrepository - See the Updating Documentation section in CONTRIBUTING.md for detailed instructions
Unmaintained Plugins
As contributors' circumstances change, development on a community maintained plugin can slow. When this happens, HashiCorp may use GitHub's option to archive the plugin’s repository, to clearly signal the plugin's status to users.
What does unmaintained mean?
- The code repository and all commit history will still be available.
- Documentation will remain on the Packer website.
- Issues and pull requests are monitored as a best effort.
- No active development will be performed by HashiCorp.
If you are interested in maintaining an unmaintained or archived plugin, please reach out to us at [email protected].