HashiCorp Packer 1.16 Adds Native SLSA Provenance Generation and Verification for Machine Images

Native SLSA Provenance for Machine Images

HashiCorp has released Packer v1.16.0, which includes native support for generating, signing, and verifying SLSA provenance attestations for every machine image built using the tool. This new capability provides a secure and tamper-proof record of an image's creation process, directly within Packer, eliminating the need for external supply-chain security tools.

Addressing Infrastructure Supply Chain Gaps

The update addresses a significant gap in infrastructure security, as machine images underpin all workloads running on them. Previously, verifying the origin of an image often involved sifting through outdated build logs, and Packer lacked a direct method to link an artifact to its specific commit, pipeline, or identity. This new feature prevents the silent spread of tampered or unverified images by providing clear traceability.

Technical Implementation and Attestation Details

The core addition is a new provenance post-processor that generates in-toto statements using an SLSA Provenance v1 predicate. This vendor-neutral format is compatible with existing supply-chain security tools. Attestations record crucial details such as the Git commit, repository, reference, triggering CI pipeline, and build timestamps. Local artifacts are bound by their SHA-256 digest, while cloud artifacts are linked to a canonical identity record containing builder and artifact IDs.

Flexible Signing and SLSA Compliance

Packer offers four signing modes to accommodate different key management strategies: unsigned JSON for internal use, local PEM keys for isolated setups, cloud KMS or Vault for centralized key management, and Sigstore Fulcio for keyless signing in CI pipelines with Rekor upload for transparency. Packer maps its output to SLSA's build-level ladder, with L1 achievable with the provenance post-processor, and L2 with keyless signing on a CI platform. Achieving L3 compatibility involves separating provenance generation from the build job using a different signing job, though full L3 compliance also depends on platform hardening and build isolation controls.