winget install --id Hashicorp.PackerAbout HashiCorp Packer
Packer is a tool for building identical machine images for multiple platforms from a single source configuration. Packer is lightweight, runs on every major operating system, and is highly performant, creating machine images for multiple platforms in parallel. Packer supports various platforms through external plugin integrations, the full list of which can be found at https://developer.hashicorp.com/packer/integrations. The images that Packer creates can easily be turned into Vagrant boxes.
What's new in 1.16.0
FEATURES: - provenance: add new provenance post-processor and packer verify-attestation command for SLSA Build L1/L2 supply-chain attestations. Derives in-toto subjects from Packer artifacts, builds SLSA Provenance v1 predicates with Git/CI metadata, and signs via local PEM key, cloud KMS (awskms://, gcpkms://, azurekms://, hashivault://), or keyless Sigstore (Fulcio + optional Rekor transparency log). Reference CI workflows for L2 keyless and L3-compatible delegated-signing patterns are included under examples/ci/. GH-13667 - core/hcl2: add rfc3339_parse and unix_timestamp_parse template functions. Both accept RFC 3339 timestamps; unix_timestamp_parse additionally accepts Unix epoch integers. GH-13669 - core/hcl2: add continue_on_error meta-argument to provisioner blocks. When set to true, a provisioner failure is logged and the build continues rather than halting. GH-13674 - core/hcl2: variable object types now support optional() attribute modifiers, allowing object variables to declare per-attribute defaults and omit fields that have a default set. GH-13670 BUG FIXES: - plugin/getter: prevent path traversal vulnerability in GitHub plugin getter filename handling. GH-13680 - build: update build constraints to support arm architecture on FreeBSD. GH-13650 SECURITY: - security: drop x/crypto/openpgp by upgrading go-github v33 → v75. GH-13676 - security: suppress false positive for GO-2026-5932. GH-13677 - deps: bump golang.org/x/crypto to v0.54.0. GH-13672 DEPENDENCIES: - deps: bump github.com/hashicorp/packer-plugin-sdk to v0.6.10. GH-13673 - deps: bump github.com/hashicor...
Version history
| Version | Updated | Notes |
|---|---|---|
| 1.16.0 | Unknown | FEATURES: - provenance: add new provenance post-processor and packer verify-attestation command for SLSA Build L1/L2 supply-chain attestations. Derives in-toto subjects from Packer artifacts, builds SLSA Provenance v1 pr... |
| 1.15.4 | Unknown | BUG FIXES: - builder: update build constraints to support arm architecture on FreeBSD GH-13650 IMPROVEMENTS: - hcp: removes Syft binary download/handling from the HCP SBOM provisioner GH-13636 SECURITY: - deps: upgraded... |
| 1.15.3 | Unknown | BUG FIXES: - hcp: skip bucket update requests when description and labels already match, avoiding unnecessary updates for existing buckets. GH-13624 |
| 1.15.2 | Unknown | FEATURES: - provisioner: added support for the enforced provisioner. GH-13591 SECURITY: - deps: bump github.com/go-jose/go-jose/v4 GH-13594 - deps: bump go.opentelemetry.io/otel/sdk GH-13606 - deps: update cloud.google.c... |
| 1.15.1 | Unknown | FEATURES: - hcp: native sbom generation for hcp GH-13566 BUG FIXES: - core: Scrub multiline sensitive values from build output (including OS-specific multiline sensitive-value fixtures) GH-13582 SECURITY: - deps: bump sy... |
| 1.15.0 | Unknown | IMPROVEMENTS: - core/hcp: add support for updating HCP Packer registry channels and bucket log UI metadata. GH-13532 - build: update Go to 1.24.12. GH-13553 - docker: remove vmware and vsphere from the packer full image.... |
| 1.14.3 | Unknown | IMPROVEMENTS: - core/hcp: added cicd metadata support for BitBucket and Jenkins pipelines. GH-13513 GH-13505 - core: bump github.com/hashicorp/packer-plugin-sdk to 0.6.4 GH-13494 - docs: fix typos and linguistic errors i... |
| 1.14.2 | Unknown | ✨ Features - HCP Certificate Authentication Support – by @JenGoldstrich (#13435) Adds support for the HCP_CRED_FILE environment variable and removes restrictions on HCP_CLIENT_ID and HCP_CLIENT_SECRET when connecting bui... |
| 1.14.1 | Unknown | BUG FIXES: - core: Changes on the packer plugin installation process to ensure that the plugin is installed correctly. The releases binary from official site releases.hashicorp.com was not getting installed from a proxy... |
| 1.14.0 | Unknown | IMPROVEMENTS: - core: Changes to pull official packer plugins binaries from official site (releases.hashicorp.com). This change allows Packer to automatically download and install official plugins from the HashiCorp offi... |
| 1.13.1 | Unknown | Release notes |
| 1.13.0 | Unknown | FEATURES: - core: Enhanced the existing inline field in the shell provisioner to support any script with its own shebang (#!). Allows users to provide scripts directly in the inline field, making it possible to use scrip... |
| 1.12.0 | Unknown | FEATURES: - core: add support for a DAG-based evaluation on locals and datasources. A long-standing odditiy of Packer has been the order of evaluation for locals and data sources. In previous versions of Packer, the data... |
| 1.11.2 | Unknown | No notes |
| 1.11.1 | Unknown | No notes |
| 1.11.0 | Unknown | No notes |
| 1.10.3 | Unknown | No notes |
| 1.10.2 | Unknown | Release notes |
| 1.10.1 | Unknown | Release notes |
| 1.10.0 | Unknown | Release notes |