Hari
5c431e0e44
Removes Syft binary download/handling from the HCP SBOM provisioner ( #13636 )
2026-06-03 15:23:57 +05:30
Tanmay Jain
958d1a8315
Update Go version and refresh dependencies
2026-06-03 12:13:48 +05:30
mukulmohan177
cddfaf5d03
Merge pull request #13645 from hashicorp/authorization-bypass
...
upgraded go-git and crypto version
2026-06-03 08:26:34 +05:30
sanyaraj2424
277b49a248
upgraded crypto version
2026-06-01 10:38:00 +05:30
sanyaraj2424
14b14d0220
upgraded go-git version
2026-05-29 11:58:45 +05:30
dependabot[bot]
4a5aa7cfb1
build(deps): bump github.com/hashicorp/packer-plugin-sdk
...
Bumps [github.com/hashicorp/packer-plugin-sdk](https://github.com/hashicorp/packer-plugin-sdk ) from 0.6.7 to 0.6.9.
- [Release notes](https://github.com/hashicorp/packer-plugin-sdk/releases )
- [Changelog](https://github.com/hashicorp/packer-plugin-sdk/blob/main/CHANGELOG.md )
- [Commits](https://github.com/hashicorp/packer-plugin-sdk/compare/v0.6.7...v0.6.9 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/packer-plugin-sdk
dependency-version: 0.6.9
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-05-26 01:24:44 +00:00
Taru Garg
287f5e33fb
Merge pull request #13638 from taru-garg-hashicorp/taru-garg-hashicorp/bom-fix
...
build / Go ${{ needs.get-go-version.outputs.go-version }} freebsd amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} netbsd amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} openbsd amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} solaris amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} windows amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} freebsd arm build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} netbsd arm build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} openbsd arm build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} linux 386 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} linux amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} linux arm build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} linux arm64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} linux ppc64le build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} darwin amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} darwin arm64 build (push) Has been cancelled
build / Docker light 386 build (push) Has been cancelled
build / Docker light amd64 build (push) Has been cancelled
build / Docker light arm build (push) Has been cancelled
build / Docker light arm64 build (push) Has been cancelled
build / Docker full 386 build (push) Has been cancelled
build / Docker full amd64 build (push) Has been cancelled
build / Docker full arm build (push) Has been cancelled
build / Docker full arm64 build (push) Has been cancelled
Go Test / Linux go tests (push) Has been cancelled
Go Test / Darwin go tests (push) Has been cancelled
Go Test / Windows go tests (push) Has been cancelled
Go Validate / Go Mod Tidy (push) Has been cancelled
Go Validate / Lint (push) Has been cancelled
Go Validate / Fmt check (push) Has been cancelled
Go Validate / Generate check (push) Has been cancelled
deps(cyclonedx-go): Bump cyclonedx-go dependency to 0.11.0
2026-05-22 17:34:15 +05:30
Hari
48f5e6becc
fix(deps): update github.com/Azure/go-ntlmssp to v0.1.1 ( #13622 )
build / Go ${{ needs.get-go-version.outputs.go-version }} freebsd amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} netbsd amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} openbsd amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} solaris amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} windows amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} freebsd arm build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} netbsd arm build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} openbsd arm build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} linux 386 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} linux amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} linux arm build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} linux arm64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} linux ppc64le build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} darwin amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} darwin arm64 build (push) Has been cancelled
build / Docker light 386 build (push) Has been cancelled
build / Docker light amd64 build (push) Has been cancelled
build / Docker light arm build (push) Has been cancelled
build / Docker light arm64 build (push) Has been cancelled
build / Docker full 386 build (push) Has been cancelled
build / Docker full amd64 build (push) Has been cancelled
build / Docker full arm build (push) Has been cancelled
build / Docker full arm64 build (push) Has been cancelled
Go Test / Linux go tests (push) Has been cancelled
Go Test / Darwin go tests (push) Has been cancelled
Go Test / Windows go tests (push) Has been cancelled
Go Validate / Go Mod Tidy (push) Has been cancelled
Go Validate / Lint (push) Has been cancelled
Go Validate / Fmt check (push) Has been cancelled
Go Validate / Generate check (push) Has been cancelled
2026-04-24 13:15:53 +05:30
Tanmay Jain
c45722b902
Update Go version and refresh dependencies
...
Aligns project with Go 1.25.9 and updates several dependencies
to incorporate bug fixes, security enhancements, and improved
compatibility across packages.
Ensures continued stability and support for the latest upstream
features by tracking current releases.
2026-04-21 11:30:06 +05:30
Tanmay Jain
206063490f
Bumps Go version to 1.25.9 for compatibility
2026-04-21 11:08:11 +05:30
Hari
eee3805c06
Feature/enforced provisioner ( #13591 )
...
build / Go ${{ needs.get-go-version.outputs.go-version }} openbsd amd64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} solaris amd64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} windows amd64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} freebsd arm build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} netbsd arm build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} openbsd arm build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} linux 386 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} linux amd64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} linux arm build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} linux arm64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} linux ppc64le build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} darwin amd64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} darwin arm64 build (push) Blocked by required conditions
build / Docker light 386 build (push) Blocked by required conditions
build / Docker light amd64 build (push) Blocked by required conditions
build / Docker light arm build (push) Blocked by required conditions
build / Docker light arm64 build (push) Blocked by required conditions
build / Docker full 386 build (push) Blocked by required conditions
build / Docker full amd64 build (push) Blocked by required conditions
build / Docker full arm build (push) Blocked by required conditions
build / Docker full arm64 build (push) Blocked by required conditions
Go Test / get-go-version (push) Waiting to run
Go Test / Linux go tests (push) Blocked by required conditions
Go Test / Darwin go tests (push) Blocked by required conditions
Go Test / Windows go tests (push) Blocked by required conditions
Go Validate / get-go-version (push) Waiting to run
Go Validate / Go Mod Tidy (push) Blocked by required conditions
Go Validate / Lint (push) Blocked by required conditions
Go Validate / Fmt check (push) Blocked by required conditions
Go Validate / Generate check (push) Blocked by required conditions
* added the parser for the enforced block
* Enhance enforced provisioner parsing to support HCL and JSON formats
- Updated ParseProvisionerBlocks to handle both HCL and JSON syntax, including legacy JSON format.
- Added comprehensive test cases for JSON provisioner parsing.
- Improved ExtractBuildProvisionerHCL to merge inline commands from shell provisioners.
- Enhanced logging for enforced block operations in HCP Packer.
* Remove PublishEnforcedBlocks function from Bucket struct
* Remove ExtractBuildProvisionerHCL function and unused imports
* Reverted the version upgrade
* Added the internal-sdk for the enforcedProvsioner api changes
* Enhance enforced provisioner handling and error reporting
- Update error handling in FetchEnforcedBlocks to return detailed errors instead of warnings.
- Modify GetCoreBuildProvisionerFromBlock to accept build name for overrides.
- Add tests for FetchEnforcedBlocks to ensure correct behavior and error handling.
- Implement diagnostics for unsupported legacy JSON templates.
* Implement enforced provisioner parsing and handling
- Introduced a new package `enforcedparser` to handle parsing of enforced provisioner blocks from HCL and JSON formats.
- Refactored existing code to utilize the new `ParseProvisionerBlocks` function from the `enforcedparser` package.
- Updated `GetCoreBuildProvisionerFromEnforcedBlock` method to convert enforced provisioner blocks into core build provisioners.
- Enhanced error handling and logging during the parsing process.
- Added tests for the new parsing functionality and ensured existing tests were updated to reflect changes.
- Modified `InjectEnforcedProvisioners` method in JSON registry to utilize the new parsing logic.
* Add test case for -skip-enforcement flag in BuildArgs
* Refactor sensitive variable handling in provisioners and add related tests
* Refactor enforced provisioner handling: remove internal parser, update tests, and streamline API interactions
* Enhance provisioner block parsing: add error handling for invalid combinations and expand test coverage
* Remove internal SDK replacement for enforced block types in go.mod
* Update dependencies in go.mod and go.sum: bump hcp-sdk-go and packer-plugin-sdk versions, adjust syft version, and update OpenTelemetry packages
* Update hcp-sdk-go dependency to v0.172.0 in go.mod and go.sum
* Fix formatting in TestBuildCommand_ParseArgs and add newline at end of json_enforced_test.go
* Refactor testJSONRegistryWithBuilds: remove environment variable setup and streamline registry initialization
* Rename injected variable for clarity in InjectEnforcedProvisioners function
---------
Co-authored-by: Hari Om <58305594+Madhav008@users.noreply.github.com>
2026-04-17 14:17:28 +05:30
Hari Om
8a4139f5bd
Update dependencies: bump cloud.google.com/go/auth to v0.18.2, cloud.google.com/go/storage to v1.61.3, and aws-sdk-go-v2 packages to latest versions; includes various other dependency updates for improved stability and performance.
2026-04-17 11:44:35 +05:30
Anurag Sharma
c1aac01642
bump syft to v1.42.3 ( #13581 )
...
build / Go ${{ needs.get-go-version.outputs.go-version }} openbsd amd64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} solaris amd64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} windows amd64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} freebsd arm build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} netbsd arm build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} openbsd arm build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} linux 386 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} linux amd64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} linux arm build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} linux arm64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} linux ppc64le build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} darwin amd64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} darwin arm64 build (push) Blocked by required conditions
build / Docker light 386 build (push) Blocked by required conditions
build / Docker light amd64 build (push) Blocked by required conditions
build / Docker light arm build (push) Blocked by required conditions
build / Docker light arm64 build (push) Blocked by required conditions
build / Docker full 386 build (push) Blocked by required conditions
build / Docker full amd64 build (push) Blocked by required conditions
build / Docker full arm build (push) Blocked by required conditions
build / Docker full arm64 build (push) Blocked by required conditions
Go Test / get-go-version (push) Waiting to run
Go Test / Linux go tests (push) Blocked by required conditions
Go Test / Darwin go tests (push) Blocked by required conditions
Go Test / Windows go tests (push) Blocked by required conditions
Go Validate / get-go-version (push) Waiting to run
Go Validate / Go Mod Tidy (push) Blocked by required conditions
Go Validate / Lint (push) Blocked by required conditions
Go Validate / Fmt check (push) Blocked by required conditions
Go Validate / Generate check (push) Blocked by required conditions
* bump syft to v1.42.3
fix GO-2026-4809
* bump sdk to v0.6.7
* update go version
2026-03-26 11:05:04 +05:30
Anurag Sharma
ea25de1315
feat: native sbom generation for hcp ( #13566 )
...
build / Go ${{ needs.get-go-version.outputs.go-version }} openbsd amd64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} solaris amd64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} windows amd64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} freebsd arm build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} netbsd arm build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} openbsd arm build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} linux 386 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} linux amd64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} linux arm build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} linux arm64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} linux ppc64le build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} darwin amd64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} darwin arm64 build (push) Blocked by required conditions
build / Docker light 386 build (push) Blocked by required conditions
build / Docker light amd64 build (push) Blocked by required conditions
build / Docker light arm build (push) Blocked by required conditions
build / Docker light arm64 build (push) Blocked by required conditions
build / Docker full 386 build (push) Blocked by required conditions
build / Docker full amd64 build (push) Blocked by required conditions
build / Docker full arm build (push) Blocked by required conditions
build / Docker full arm64 build (push) Blocked by required conditions
Go Test / get-go-version (push) Waiting to run
Go Test / Linux go tests (push) Blocked by required conditions
Go Test / Darwin go tests (push) Blocked by required conditions
Go Test / Windows go tests (push) Blocked by required conditions
Go Validate / get-go-version (push) Waiting to run
Go Validate / Go Mod Tidy (push) Blocked by required conditions
Go Validate / Lint (push) Blocked by required conditions
Go Validate / Fmt check (push) Blocked by required conditions
Go Validate / Generate check (push) Blocked by required conditions
* add configuration fields to SBOMInternalProvisioner
* add os detection
* move implementation to hcp-sbom
* upload scanner binary and execute
* use latest syft version always
* reduce duplicate code
* rename config fields appropriately
* default to cyclonedx
* add syft dependency
* add support for elevated user for windows
* add retry for download
* add syft dependency
Updates go version
* optimization for windows
* improve docs
* update config usage rules
* add unit tests
* update golang version, fix linter issues
* refactor and improvements
* simplify few lines
* refactor retry for scanner download
* resolved conflicts
* resolve conflicts from main
* stick to syft v1 for compatibility
* fix lint issues
* stricter version check for syft
* fix version eg
* update go version to 1.25.7
* go mod changes
2026-03-25 11:33:00 +05:30
Tanmay Jain
8d9a4cfdfc
Merge pull request #13565 from hashicorp/dependabot/go_modules/github.com/hashicorp/packer-plugin-sdk-0.6.6
...
build(deps): bump github.com/hashicorp/packer-plugin-sdk from 0.6.4 to 0.6.6
2026-03-24 12:19:22 +05:30
Tanmay Jain
2f2704c84d
Updates OpenTelemetry dependencies to v1.41.0
...
Ensures compatibility with the latest OpenTelemetry libraries,
potentially addressing security and stability improvements.
Prepares codebase for new features and bug fixes from upstream.
2026-03-20 12:36:37 +05:30
dependabot[bot]
a13d7cedf9
build(deps): bump github.com/hashicorp/packer-plugin-sdk
...
Bumps [github.com/hashicorp/packer-plugin-sdk](https://github.com/hashicorp/packer-plugin-sdk ) from 0.6.4 to 0.6.6.
- [Release notes](https://github.com/hashicorp/packer-plugin-sdk/releases )
- [Changelog](https://github.com/hashicorp/packer-plugin-sdk/blob/main/CHANGELOG.md )
- [Commits](https://github.com/hashicorp/packer-plugin-sdk/compare/v0.6.4...v0.6.6 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/packer-plugin-sdk
dependency-version: 0.6.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-03-20 07:00:37 +00:00
dependabot[bot]
4a41160643
build(deps): bump github.com/hashicorp/hcp-sdk-go
...
Bumps [github.com/hashicorp/hcp-sdk-go](https://github.com/hashicorp/hcp-sdk-go ) from 0.136.0 to 0.167.0.
- [Release notes](https://github.com/hashicorp/hcp-sdk-go/releases )
- [Changelog](https://github.com/hashicorp/hcp-sdk-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/hashicorp/hcp-sdk-go/compare/v0.136.0...v0.167.0 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/hcp-sdk-go
dependency-version: 0.167.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-03-20 06:53:17 +00:00
Tanmay Jain
a96954deaf
Upgrade go-git to v5.17.0 and grpc to 1.79.3
2026-03-20 11:44:48 +05:30
Tanmay Jain
6210b0a4ce
Updates circl dependency to v1.6.3
...
Brings in latest upstream improvements and bug fixes from circl.
Helps maintain compatibility and security with indirect dependencies.
2026-03-11 12:49:56 +05:30
kp2099
d7abe43ccc
go-git package upgrade
2026-02-17 20:03:11 +05:30
Tanmay Jain
5fc98d9e4e
Updates Go version to 1.24.12
2026-01-28 12:14:53 +05:30
Tanmay Jain
c62a195f36
Bump x/crypto to v0.46.0
2025-12-15 12:50:06 +05:30
Anurag Sharma
543123ac17
bump golang.org/x/crypto to 0.43.0 ( #13518 )
...
build / Go ${{ needs.get-go-version.outputs.go-version }} openbsd amd64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} solaris amd64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} windows amd64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} freebsd arm build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} netbsd arm build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} openbsd arm build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} linux 386 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} linux amd64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} linux arm build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} linux arm64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} linux ppc64le build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} darwin amd64 build (push) Blocked by required conditions
build / Go ${{ needs.get-go-version.outputs.go-version }} darwin arm64 build (push) Blocked by required conditions
build / Docker light 386 build (push) Blocked by required conditions
build / Docker light amd64 build (push) Blocked by required conditions
build / Docker light arm build (push) Blocked by required conditions
build / Docker light arm64 build (push) Blocked by required conditions
build / Docker full 386 build (push) Blocked by required conditions
build / Docker full amd64 build (push) Blocked by required conditions
build / Docker full arm build (push) Blocked by required conditions
build / Docker full arm64 build (push) Blocked by required conditions
Go Test / get-go-version (push) Waiting to run
Go Test / Linux go tests (push) Blocked by required conditions
Go Test / Darwin go tests (push) Blocked by required conditions
Go Test / Windows go tests (push) Blocked by required conditions
Go Validate / get-go-version (push) Waiting to run
Go Validate / Go Mod Tidy (push) Blocked by required conditions
Go Validate / Lint (push) Blocked by required conditions
Go Validate / Fmt check (push) Blocked by required conditions
Go Validate / Generate check (push) Blocked by required conditions
* bump golang.org/x/crypto to 0.43.0
CVE-2025-47913 GO-2025-4116
* fixed go.sum
* fixed multiple warnings that prevented test runs
* make generate
* fix lint errors, update linter version
* fix go vet issues
2025-11-18 15:49:03 +05:30
dependabot[bot]
06043136db
build(deps): bump github.com/hashicorp/packer-plugin-sdk ( #13494 )
...
build / Go ${{ needs.get-go-version.outputs.go-version }} freebsd amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} netbsd amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} openbsd amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} solaris amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} windows amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} freebsd arm build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} netbsd arm build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} openbsd arm build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} linux 386 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} linux amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} linux arm build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} linux arm64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} linux ppc64le build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} darwin amd64 build (push) Has been cancelled
build / Go ${{ needs.get-go-version.outputs.go-version }} darwin arm64 build (push) Has been cancelled
build / Docker light 386 build (push) Has been cancelled
build / Docker light amd64 build (push) Has been cancelled
build / Docker light arm build (push) Has been cancelled
build / Docker light arm64 build (push) Has been cancelled
build / Docker full 386 build (push) Has been cancelled
build / Docker full amd64 build (push) Has been cancelled
build / Docker full arm build (push) Has been cancelled
build / Docker full arm64 build (push) Has been cancelled
Go Test / Linux go tests (push) Has been cancelled
Go Test / Darwin go tests (push) Has been cancelled
Go Test / Windows go tests (push) Has been cancelled
Go Validate / Go Mod Tidy (push) Has been cancelled
Go Validate / Lint (push) Has been cancelled
Go Validate / Fmt check (push) Has been cancelled
Go Validate / Generate check (push) Has been cancelled
Bumps [github.com/hashicorp/packer-plugin-sdk](https://github.com/hashicorp/packer-plugin-sdk ) from 0.6.3 to 0.6.4.
- [Release notes](https://github.com/hashicorp/packer-plugin-sdk/releases )
- [Changelog](https://github.com/hashicorp/packer-plugin-sdk/blob/main/CHANGELOG.md )
- [Commits](https://github.com/hashicorp/packer-plugin-sdk/compare/v0.6.3...v0.6.4 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/packer-plugin-sdk
dependency-version: 0.6.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-09 16:06:35 +05:30
karthik P
9a14670eea
bumping github.com/hashicorp/packer-plugin-sdk from v0.6.2 to v0.6.3
2025-09-08 17:34:01 +05:30
karthik P
34cbd9df3f
bumping github.com/ulikunitz/xz from v0.5.10 to v0.5.15
2025-09-08 16:36:00 +05:30
Jenna Goldstrich
2fd2d7207c
Bump go-git
2025-06-26 16:40:08 -07:00
Tanmay Jain
f70933f6b5
Updating PackerSDK version
2025-06-24 21:36:50 +05:30
Jenna Goldstrich
f16ca7fa03
Bump /x/net and /x/crypto in plugin tester and main go.mod
2025-05-01 15:01:00 -07:00
Lucas Bajolet
fe6eba27f2
go.mod: bump golang.net/x/net to v0.36.0
...
Previous version was v0.33.0, which was detected vulnerable to
GO-2025-3503.
This is unlikely to be a bug that causes significant security concerns,
but we fix that with this commit regardless.
2025-04-22 15:07:45 -04:00
Lucas Bajolet
ec7bc08a62
go.mod: bump dependencies to fix vulnerabilities
...
golang.org/x/crypto: v0.35.0 - GO-2025-3487
github.com/go-jose/go-jose/v4: v4.0.5 - GO-2025-3485
golang.org/x/oauth2: v0.27.0 - GO-2025-3488
2025-03-06 15:07:46 -05:00
dependabot[bot]
c0d13348b8
build(deps): bump github.com/hashicorp/hcp-sdk-go
...
Bumps [github.com/hashicorp/hcp-sdk-go](https://github.com/hashicorp/hcp-sdk-go ) from 0.135.0 to 0.136.0.
- [Release notes](https://github.com/hashicorp/hcp-sdk-go/releases )
- [Changelog](https://github.com/hashicorp/hcp-sdk-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/hashicorp/hcp-sdk-go/compare/v0.135.0...v0.136.0 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/hcp-sdk-go
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2025-02-12 19:28:33 +00:00
dependabot[bot]
9011c1ec5c
build(deps): bump github.com/hashicorp/hcp-sdk-go
...
Bumps [github.com/hashicorp/hcp-sdk-go](https://github.com/hashicorp/hcp-sdk-go ) from 0.131.0 to 0.135.0.
- [Release notes](https://github.com/hashicorp/hcp-sdk-go/releases )
- [Changelog](https://github.com/hashicorp/hcp-sdk-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/hashicorp/hcp-sdk-go/compare/v0.131.0...v0.135.0 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/hcp-sdk-go
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2025-02-05 19:40:08 +00:00
Devashish
a353260f5d
packer: add hcp-sbom provisioner
...
The hcp-sbom provisioner is a provisioner that acts essentially like a
download-only file provisioner, which also verifies the file downloaded
is a SPDX/CycloneDX JSON-encoded SBOM file, and sets up its upload to
HCP Packer later on.
2025-01-21 16:57:50 -05:00
Lucas Bajolet
9f6f0ba6a2
packer: pick protobuf/gob for serialisation ( #13025 )
...
As we're trying to move away from gob for serialising data over the
wire, this commit adds the capability for Packer to pick dynamically
between gob or protobuf for the serialisation format to communicate with
plugins.
As it stands, if all the plugins discovered are compatible with
protobuf, and we have not forced gob usage, protobuf will be the
serialisation format picked.
If any plugin is not compatible with protobuf, gob will be used for
communicating with all the plugins that will be used over the course of
a command.
2025-01-21 16:44:03 -05:00
Lucas Bajolet
dddc1fb356
go.mod: bump Packer plugin SDK to v0.6.0
...
Since the version 0.6.0 of the plugin SDK was released yesterday, we
bump packer to use this version.
This change adds new functions to use within Packer regarding AWS
secretsmanager, along with changes to how plugins can communicate
over-the-wire (e.g. using protobuf/msgpack for serialising
configurations instead of gob).
2025-01-21 11:29:53 -05:00
dependabot[bot]
8b2a3ccdf3
build(deps): bump github.com/hashicorp/hcp-sdk-go
...
Bumps [github.com/hashicorp/hcp-sdk-go](https://github.com/hashicorp/hcp-sdk-go ) from 0.112.0 to 0.131.0.
- [Release notes](https://github.com/hashicorp/hcp-sdk-go/releases )
- [Changelog](https://github.com/hashicorp/hcp-sdk-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/hashicorp/hcp-sdk-go/compare/v0.112.0...v0.131.0 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/hcp-sdk-go
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2025-01-21 09:49:04 -05:00
Lucas Bajolet
f24c978d46
go.mod: bump go-git to v5.13.0
...
Version 5.11.0 of the go-git library is vulnerable to two CVEs as
reported by our scanners.
Both are not impacting Packer since we only use go-git to read values
from a local Git repository, but still we upgrade our version to 5.13.0
so those reports don't apply to us.
2025-01-06 15:48:15 -05:00
Lucas Bajolet
77bf0282a7
go.mod: bump golang.org/x/net to v0.33.0
...
The version of golang.org/x/net that we're using (v0.25.0) is vulnerable
to GO-2024-3333, a DoS vulnerability.
Packer is not particularly vulnerable to this, as we are not a hosted
service, but since security scanners report this, and the fix is rather
simple, we address it today.
2024-12-20 13:47:18 -05:00
Lucas Bajolet
b6141fd532
command: copy AWS plugin structures for upgrade
...
The hcl2_upgrade command transforms a JSON template into an HCL2
template for use with Packer.
The command is quite fragile already, but given that this is the last
remaining fragment that causes Packer to depend on the AWS SDK directly,
we can do away with it.
This commit therefore imports the definitions for AWS access config, so
we can extract this information from the JSON template, and include it
in the definition of the output source for AWS, since we manage this one
differently from other sources.
This allows us to not depend on the AWS plugin directly, which in turn
makes Packer not need to link with the AWS plugin when compiling the
executable.
We are still depending on the AWS SDK for now since the SDK exposes a
aws_secretsmanager function that can be used for interpolation (legacy
JSON interpolation to be clear), so this cannot be removed from now, but
we should consider some form of remediation in the future.
2024-12-17 17:42:58 -05:00
Lucas Bajolet
cd009b0f3b
go.mod: bump x/crypto to v0.31.0
...
The crypto experimental module that the SDK depends on was detected
vulnerable on v0.23.0 to an authentication bypass attack through the
ServerConfig for SSH.
This is only used for locally proxying SSH communications, typically for
use with Ansible to provide an SSH server with which to interact, in
order to provision an instance of an OS that uses a communicator other
than SSH, therefore the vulnerability does not necessarily impact us.
However, in order to resolve the automatic report of that vulnerability,
we bump the crypto module's version to 0.31.0, where that problem was
addressed.
2024-12-17 14:06:59 -05:00
dependabot[bot]
68730cfcf5
build(deps): bump github.com/hashicorp/hcp-sdk-go ( #13162 )
...
Bumps [github.com/hashicorp/hcp-sdk-go](https://github.com/hashicorp/hcp-sdk-go ) from 0.105.0 to 0.112.0.
- [Release notes](https://github.com/hashicorp/hcp-sdk-go/releases )
- [Changelog](https://github.com/hashicorp/hcp-sdk-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/hashicorp/hcp-sdk-go/compare/v0.105.0...v0.112.0 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/hcp-sdk-go
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-12 21:07:15 -04:00
dependabot[bot]
a1caaad47d
build(deps): bump github.com/hashicorp/hcp-sdk-go from 0.99.0 to 0.105.0 ( #13129 )
...
Bumps [github.com/hashicorp/hcp-sdk-go](https://github.com/hashicorp/hcp-sdk-go ) from 0.99.0 to 0.105.0.
- [Release notes](https://github.com/hashicorp/hcp-sdk-go/releases )
- [Changelog](https://github.com/hashicorp/hcp-sdk-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/hashicorp/hcp-sdk-go/compare/v0.99.0...v0.105.0 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/hcp-sdk-go
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-05 14:04:28 -04:00
Wilken Rivera
cceead82aa
Bump github.com/hashicorp/go-retryablehttp to address CVE-2024-6104 ( #13081 )
...
Before change
```
~> govulncheck ./...
=== Symbol Results ===
Vulnerability #1 : GO-2024-2947
Leak of sensitive information to log files in
github.com/hashicorp/go-retryablehttp
More info: https://pkg.go.dev/vuln/GO-2024-2947
Module: github.com/hashicorp/go-retryablehttp
Found in: github.com/hashicorp/go-retryablehttp@v0.7.6
Fixed in: github.com/hashicorp/go-retryablehttp@v0.7.7
Example traces found:
#1 : hcl2template/function/vault.go:30:30: function.init calls template.Vault, which eventually calls retryablehttp.Client.Do
Your code is affected by 1 vulnerability from 1 module.
```
After Change
```
~> govulncheck ./...
No vulnerabilities found.
```
2024-06-28 13:57:52 -04:00
dependabot[bot]
bf5555f0fb
build(deps): bump github.com/hashicorp/hcp-sdk-go from 0.96.0 to 0.99.0
...
Bumps [github.com/hashicorp/hcp-sdk-go](https://github.com/hashicorp/hcp-sdk-go ) from 0.96.0 to 0.99.0.
- [Release notes](https://github.com/hashicorp/hcp-sdk-go/releases )
- [Changelog](https://github.com/hashicorp/hcp-sdk-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/hashicorp/hcp-sdk-go/compare/v0.96.0...v0.99.0 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/hcp-sdk-go
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-06-21 13:12:16 -04:00
dependabot[bot]
dd3b2e51f0
build(deps): bump github.com/hashicorp/packer-plugin-sdk from 0.5.3 to 0.5.4 ( #13061 )
...
* build(deps): bump github.com/hashicorp/packer-plugin-sdk
Bumps [github.com/hashicorp/packer-plugin-sdk](https://github.com/hashicorp/packer-plugin-sdk ) from 0.5.3 to 0.5.4.
- [Release notes](https://github.com/hashicorp/packer-plugin-sdk/releases )
- [Changelog](https://github.com/hashicorp/packer-plugin-sdk/blob/main/CHANGELOG.md )
- [Commits](https://github.com/hashicorp/packer-plugin-sdk/compare/v0.5.3...v0.5.4 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/packer-plugin-sdk
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump Go mod version to 1.21.0
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Wilken Rivera <dev@wilkenrivera.com>
2024-06-20 14:12:49 -04:00
Wilken Rivera
92aabc7c2e
Bump github.com/hashicorp/go-getter/v2 modules to v2.2.2
2024-05-22 09:25:43 -04:00
dependabot[bot]
493ddb1f2b
build(deps): bump github.com/hashicorp/hcp-sdk-go from 0.95.0 to 0.96.0
...
Bumps [github.com/hashicorp/hcp-sdk-go](https://github.com/hashicorp/hcp-sdk-go ) from 0.95.0 to 0.96.0.
- [Release notes](https://github.com/hashicorp/hcp-sdk-go/releases )
- [Changelog](https://github.com/hashicorp/hcp-sdk-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/hashicorp/hcp-sdk-go/compare/v0.95.0...v0.96.0 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/hcp-sdk-go
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-05-20 12:39:47 -04:00
dependabot[bot]
4444623a16
build(deps): bump github.com/hashicorp/hcp-sdk-go from 0.93.0 to 0.95.0
...
Bumps [github.com/hashicorp/hcp-sdk-go](https://github.com/hashicorp/hcp-sdk-go ) from 0.93.0 to 0.95.0.
- [Release notes](https://github.com/hashicorp/hcp-sdk-go/releases )
- [Changelog](https://github.com/hashicorp/hcp-sdk-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/hashicorp/hcp-sdk-go/compare/v0.93.0...v0.95.0 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/hcp-sdk-go
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-05-15 10:16:49 -04:00
