Tag

#packer

Tagged “packer”

2 articles

Packer 1.16 ships signed SLSA provenance, and a command to check it

Packer v1.16.0 emits signed SLSA Provenance v1 attestations for every machine image it builds, and adds a verify-attestation command so downstream pipelines can actually check the signature before promoting an AMI or a VM template.

Aug 14, 2026 · Tomás Vega Security & supply chain

HCP Packer's enforced provisioners turn golden-image policy into a contract teams can't quietly skip

HashiCorp has added enforced provisioners to HCP Packer, letting platform and security teams centrally pin mandatory build steps onto every downstream image rather than trusting that the wiki page got read. The mechanism is the easy part; deciding whether your org actually wants policy this loud is the harder one.

Jun 17, 2026 · Tomás Vega