HashiCorp Packer 1.16 Adds Native SLSA Provenance Generation and Verification for Machine Images

InfoQ Homepage News HashiCorp Packer 1.16 Adds Native SLSA Provenance Generation and Verification for Machine Images

The issue with the release targets is clear but important. Machine images support every workload running on them. If an image is tampered with or cannot be verified, it can quietly spread to every instance created from it. Before this release, locating the source of an image required sifting through outdated build logs. Packer didn't have a way to show which commit, pipeline, or identity created a specific artifact.