Skip to content

v1.16.0

Latest
Latest

Choose a tag to compare

View all tags
@hc-github-team-es-release-engineering hc-github-team-es-release-engineering released this 24 Jul 09:26
v1.16.0
856572e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

1.16.0 (July 24, 2026)

FEATURES:

  • provenance: add new provenance post-processor and packer verify-attestation command for
    SLSA Build L1/L2 supply-chain attestations. Derives in-toto subjects from Packer artifacts,
    builds SLSA Provenance v1 predicates with Git/CI metadata, and signs via local PEM key, cloud
    KMS (awskms://, gcpkms://, azurekms://, hashivault://), or keyless Sigstore (Fulcio +
    optional Rekor transparency log). Reference CI workflows for L2 keyless and L3-compatible
    delegated-signing patterns are included under examples/ci/.
    GH-13667
  • core/hcl2: add rfc3339_parse and unix_timestamp_parse template functions. Both accept
    RFC 3339 timestamps; unix_timestamp_parse additionally accepts Unix epoch integers.
    GH-13669
  • core/hcl2: add continue_on_error meta-argument to provisioner blocks. When set to true,
    a provisioner failure is logged and the build continues rather than halting.
    GH-13674
  • core/hcl2: variable object types now support optional() attribute modifiers, allowing
    object variables to declare per-attribute defaults and omit fields that have a default set.
    GH-13670

BUG FIXES:

  • plugin/getter: prevent path traversal vulnerability in GitHub plugin getter filename handling.
    GH-13680
  • build: update build constraints to support arm architecture on FreeBSD.
    GH-13650

SECURITY:

  • security: drop x/crypto/openpgp by upgrading go-github v33 → v75.
    GH-13676
  • security: suppress false positive for GO-2026-5932.
    GH-13677
  • deps: bump golang.org/x/crypto to v0.54.0.
    GH-13672

DEPENDENCIES:

  • deps: bump github.com/hashicorp/packer-plugin-sdk to v0.6.10.
    GH-13673
  • deps: bump github.com/hashicorp/hcp-sdk-go to v0.174.0.
    GH-13673
  • deps: bump github.com/zclconf/go-cty to v1.18.1.
    GH-13673
  • deps: bump github.com/google/go-github v33 → v75.
    GH-13676
  • deps: bump golang.org/x/net to v0.56.0.
    GH-13664
  • deps: update various Go module dependencies.
    GH-13673

INTERNAL:

  • ci: pin GitHub Action refs to latest verified SHAs.
    GH-13675
  • chore: remove old website references.
    GH-13668
Assets 2
Loading