Packer v1.16.0 Brings SLSA Provenance to Machine Images — Here's What That Means

Machine images have a provenance problem. AMIs, Azure Managed Images, and GCE images are widely used as trusted deployment artifacts, but until now, there was no standard way to cryptographically verify that a given image came from an approved CI pipeline rather than a shadow build. Packer v1.16.0 closes that gap.

What Happened

Packer v1.16.0 adds two new capabilities:

A provenance post-processor that generates a signed attestation at the end of every build. The attestation captures the artifact digest, builder identity, Git commit, CI pipeline metadata, and build timestamp — in in-toto format with a SLSA Provenance v1 predicate. This is the same vendor-neutral standard used for container image provenance in supply chain frameworks like SLSA and SSDF.

A packer verify-attestation command that validates the attestation against a signing identity before deployment. This enables enforcement: a pipeline step can reject any image that doesn’t carry a valid attestation from an approved source.

The post-processor supports four signing modes — none (unsigned), key (local PEM), kms (cloud KMS providers), and keyless (Sigstore with CI/CD platforms). Keyless signing is the recommended mode for automated pipelines; it uses ephemeral certificates tied to the CI job identity rather than long-lived key material.

The HCL2 configuration is minimal:

post-processor "provenance" {
  signing_mode = "keyless"
  upload_tlog  = true
  output_dir   = "attestations/"
}

Why It Matters

Image tampering and shadow builds are the threat scenarios this addresses, but the practical driver for most organizations is compliance. SOC 2 reviews increasingly expect artifact provenance for infrastructure components, not just application code. FedRAMP programs require auditable evidence of approved build pipelines. The JFrog supply chain security framework similarly emphasizes artifact traceability as a foundation of governed AI and infrastructure deployments.

Packer’s provenance attestation provides the machine image equivalent of container signing — the same attestation model that Cosign and Sigstore established for OCI images, now applied to the VM layer. For organizations already using cosigned container images, adding Packer v1.16.0 provenance extends supply chain verification down to the base image layer, closing the gap between “we verify what runs in containers” and “we verify what the containers run on.”

The SLSA build levels matter for compliance mapping: L1 (signed provenance exists) is achievable with any signing mode; L2 (hosted CI service generates and signs via keyless authentication) is achievable with standard CI platforms; L3-compatible configurations require an isolated signing job, which the post-processor supports.

The HCL2 Additions

The v1.16.0 release also adds three HCL2 features worth noting for complex Packer configurations:

• continue_on_error on provisioners: marks failures as non-fatal — the build continues and logs a warning rather than halting. Useful for optional instrumentation steps that shouldn’t block image creation.
• optional() modifier on object-type variables: allows per-attribute defaults, making schema evolution in shared Packer configurations significantly cleaner.
• Timestamp functions (rfc3339_parse(), unix_timestamp_parse()): enable dynamic image naming based on build time without shell interpolation hacks.

Source: HashiCorp

Content created with AI assistance and reviewed for accuracy.