Wilken Rivera
e3c8d9b929
This change addresses vulnerabilities reported by govulncheck ``` Vulnerability #1: GO-2024-2610 Errors returned from JSON marshaling may break template escaping in html/template More info: https://pkg.go.dev/vuln/GO-2024-2610 Standard library Found in: html/[email protected] Fixed in: html/[email protected].1 Example traces found: #1: datasource/http/data.go:119:24: http.Datasource.Execute calls http.Client.Do, which eventually calls template.Template.Execute #2: datasource/http/data.go:119:24: http.Datasource.Execute calls http.Client.Do, which eventually calls template.Template.ExecuteTemplate Vulnerability #2: GO-2024-2600 Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http More info: https://pkg.go.dev/vuln/GO-2024-2600 Standard library Found in: net/[email protected] Fixed in: net/[email protected].1 Example traces found: #1: datasource/http/data.go:119:24: http.Datasource.Execute calls http.Client.Do #2: hcl2template/function/aws_secretetkey.go:38:37: function.init calls template.GetAWSSecret, which eventually calls http.Client.Post #3: hcl2template/function/aws_secretetkey.go:38:37: function.init calls template.GetAWSSecret, which eventually calls http.Client.PostForm Vulnerability #3: GO-2024-2599 Memory exhaustion in multipart form parsing in net/textproto and net/http More info: https://pkg.go.dev/vuln/GO-2024-2599 Standard library Found in: net/[email protected] Fixed in: net/[email protected].1 Example traces found: #1: internal/hcp/api/service_build.go:81:48: api.Client.UpdateBuild calls packer_service.Client.PackerServiceUpdateBuild, which eventually calls textproto.Reader.ReadLine #2: datasource/http/data.go:140:26: http.Datasource.Execute calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader Vulnerability #4: GO-2024-2598 Verify panics on certificates with an unknown public key algorithm in crypto/x509 More info: https://pkg.go.dev/vuln/GO-2024-2598 Standard library Found in: crypto/[email protected] Fixed in: crypto/[email protected].1 Example traces found: #1: datasource/http/data.go:140:26: http.Datasource.Execute calls io.ReadAll, which eventually calls x509.Certificate.Verify ```
Packer
Packer is a tool for building identical machine images for multiple platforms from a single source configuration.
Packer is lightweight, runs on every major operating system, and is highly performant, creating machine images for multiple platforms in parallel. Packer supports various platforms through external plugin integrations, the full list of which can be found at https://developer.hashicorp.com/packer/integrations.
The images that Packer creates can easily be turned into Vagrant boxes.
Quick Start
Packer
There is a great introduction and getting started guide for building a Docker image on your local machine without using any paid cloud resources.
Alternatively, you can refer to getting started with AWS to learn how to build a machine image for an external cloud provider.
HCP Packer
HCP Packer registry stores Packer image metadata, enabling you to track your image lifecycle.
To get started with building an AWS machine image to HCP Packer for referencing in Terraform refer to the collection of HCP Packer Tutorials.
Documentation
Comprehensive documentation is viewable on the Packer website at https://developer.hashicorp.com/packer/docs.
Contributing to Packer
See CONTRIBUTING.md for best practices and instructions on setting up your development environment to work on Packer.
Unmaintained Plugins
As contributors' circumstances change, development on a community maintained plugin can slow. When this happens, HashiCorp may use GitHub's option to archive the plugin’s repository, to clearly signal the plugin's status to users.
What does unmaintained mean?
- The code repository and all commit history will still be available.
- Documentation will remain on the Packer website.
- Issues and pull requests are monitored as a best effort.
- No active development will be performed by HashiCorp.
If you are interested in maintaining an unmaintained or archived plugin, please reach out to us at [email protected].