HashiCorp Packer 1.16 Adds Native SLSA Provenance Generation and Verification for Machine Images

HashiCorp has launched Packer version 1.16.0, which introduces built-in support for creating, signing, and verifying SLSA (Software Supply Chain) provenance attestations for machine images. This ensures a secure and tamper-proof history of how machine images are generated without the need for additional supply-chain tools.

Machine images are crucial for every workload they support; thus, if an image is compromised or unverifiable, it can potentially spread to all instances created from it. Previously, identifying the origin of an image involved reviewing outdated build logs, a cumbersome process. Packer's new feature, a provenance post-processor, generates in-toto statements with an SLSA Provenance v1 predicate, a vendor-neutral format compatible with existing supply-chain security tools.

These attestations capture the Git commit, repository, reference, triggering CI pipeline, and build timestamps. Local artifacts are linked to their SHA-256 digest, while cloud artifacts lacking local files are connected to a record containing the builder and artifact IDs. Packer offers four signing modes to cater to different key management needs, from unsigned JSON output for internal use to local PEM keys for isolated setups, and cloud KMS or Vault for centralized key management.

Sigstore Fulcio enables keyless signing in CI pipelines, which can be uploaded to Rekor for transparency.

Packer maps its output directly onto SLSA's build-level ladder. Level 1 requires only the provenance post-processor, with optional signing. Level 2 is achieved by running Packer on a CI platform with keyless signing, where the CI job's OIDC identity serves as the signer. For full L3 compliance, provenance generation is separated from the build job, using a distinct signing job based on slsa-framework/slsa-github-generator.

However, this workflow alone does not guarantee full L3 compliance, as it also depends on platform hardening and build isolation controls.

HashiCorp positions this tool for deployment gating and correlating CVEs with commits and running instances, serving as supporting evidence for SOC 2 or FedRAMP audits. The release includes smaller enhancements to HCL2, such as a continue_on_error meta-argument for non-fatal provisioners, optional() in per-attribute defaults for object-type variables, and new template functions for handling timestamps.

All new features are optional, and existing Packer templates require no modifications to work under version 1.16.0. Teams desiring provenance need only add the provenance post-processor to their build block; for L2 or L3-compatible patterns, they must integrate the provided reference GitHub Actions workflows.

Packer leverages a proven method from the container layer, using in-toto statements, SLSA Provenance predicates, keyless Sigstore signing, and Rekor transparency logs, elements previously absent in the machine-image layer. This enhancement extends to AMIs, QCOW2, and VHD artifacts, making Docker's buildx and GitHub's artifact attestations easily accessible, all while maintaining the same rigorous signing and verification process.