Packer v1.16.0 brings verifiable provenance to machine images
Curated from HashiCorp Blog
Supply chain security has shifted from a nice-to-have to a regulatory requirement for many enterprises. Traditionally, infrastructure-as-code tools like Packer generated images without a standardized, machine-readable record of their construction. This opacity created blind spots in audit trails and made it difficult to verify that a deployed instance matched its source code exactly. The introduction of native SLSA provenance support in Packer v1.16.0 addresses this gap by embedding verifiable metadata directly into the image lifecycle. For SRE teams managing large-scale cloud environments, this capability is critical for maintaining integrity across CI/CD pipelines. It allows security teams to automatically validate that images were built from trusted sources and have not been tampered with. You should update your build pipelines to leverage this feature immediately to ensure compliance and reduce the risk of deploying unverified artifacts.
Packer v1. 16. 0 adds native SLSA provenance generation and verification for machine images, along with new HCL2 features for provisioners and variables.
— HashiCorp Blog