HashiCorp Packer is a Free Windows program in the Other category, developed by HashiCorp. The current version is 1.16.0; you can download it safely from its official source with the download button above.
Packer is a tool for building identical machine images for multiple platforms from a single source configuration.
Packer is lightweight, runs on every major operating system, and is highly performant, creating machine images for multiple platforms in parallel. Packer supports various platforms through external plugin integrations, the full list of which can be found at https://developer.hashicorp.com/packer/integrations.
The images that Packer creates can easily be turned into Vagrant boxes.
📝 Release notes (1.16.0)
FEATURES:
- provenance: add new provenance post-processor and packer verify-attestation command for
SLSA Build L1/L2 supply-chain attestations. Derives in-toto subjects from Packer artifacts,
builds SLSA Provenance v1 predicates with Git/CI metadata, and signs via local PEM key, cloud
KMS (awskms://, gcpkms://, azurekms://, hashivault://), or keyless Sigstore (Fulcio +
optional Rekor transparency log). Reference CI workflows for L2 keyless and L3-compatible
delegated-signing patterns are included under examples/ci/.
GH-13667
- core/hcl2: add rfc3339_parse and unix_timestamp_parse template functions. Both accept
RFC 3339 timestamps; unix_timestamp_parse additionally accepts Unix epoch integers.
GH-13669
- core/hcl2: add continue_on_error meta-argument to provisioner blocks. When set to true,
a provisioner failure is logged and the build continues rather than halting.
GH-13674
- core/hcl2: variable object types now support optional() attribute modifiers, allowing
object variables to declare per-attribute defaults and omit fields that have a default set.
GH-13670
BUG FIXES:
- plugin/getter: prevent path traversal vulnerability in GitHub plugin getter filename handling.
GH-13680
- build: update build constraints to support arm architecture on FreeBSD.
GH-13650
SECURITY:
- security: drop x/crypto/openpgp by upgrading go-github v33 → v75.
GH-13676
- security: suppress false positive for GO-2026-5932.
GH-13677
- deps: bump golang.org/x/crypto to v0.54.0.
GH-13672
DEPENDENCIES:
- deps: bump github.com/hashicorp/packer-plugin-sdk to v0.6.10.
GH-13673
- deps: bump github.com/hashicorp/hcp-sdk-go to v0.174.0.
GH-13673
- deps: bump github.com/zclconf/go-cty to v1.18.1.
GH-13673
- deps: bump github.com/google/go-github v33 → v75.
GH-13676
- deps: bump golang.org/x/net to v0.56.0.
GH-13664
- deps: update various Go module dependencies.
GH-13673
INTERNAL:
- ci: pin GitHub Action refs to latest verified SHAs.
GH-13675
- chore: remove old website references.
GH-13668
SHA-256: 91A378D4E7F9C5363CAA196E23FD78717DA31D12FC6069C8BB892CDACCEB2EB8
