hashicorp/packer v1.16.0 on GitHub

1.16.0 (July 24, 2026)

provenance: add new provenance post-processor and packer verify-attestation command for
SLSA Build L1/L2 supply-chain attestations. Derives in-toto subjects from Packer artifacts,
builds SLSA Provenance v1 predicates with Git/CI metadata, and signs via local PEM key, cloud
KMS (awskms://, gcpkms://, azurekms://, hashivault://), or keyless Sigstore (Fulcio +
optional Rekor transparency log). Reference CI workflows for L2 keyless and L3-compatible
delegated-signing patterns are included under examples/ci/.
GH-13667
core/hcl2: add rfc3339_parse and unix_timestamp_parse template functions. Both accept
RFC 3339 timestamps; unix_timestamp_parse additionally accepts Unix epoch integers.
GH-13669
core/hcl2: add continue_on_error meta-argument to provisioner blocks. When set to true,
a provisioner failure is logged and the build continues rather than halting.
GH-13674
core/hcl2: variable object types now support optional() attribute modifiers, allowing
object variables to declare per-attribute defaults and omit fields that have a default set.
GH-13670

plugin/getter: prevent path traversal vulnerability in GitHub plugin getter filename handling.
GH-13680
build: update build constraints to support arm architecture on FreeBSD.
GH-13650