{"id":53464,"date":"2026-09-09T09:00:00","date_gmt":"2026-09-09T07:00:00","guid":{"rendered":"https:\/\/www.cloudmagazin.com\/?p=53464"},"modified":"2026-10-16T09:12:51","modified_gmt":"2026-10-16T07:12:51","slug":"hashicorp-introduces-provenance-tracking-for-machine-images","status":"publish","type":"post","link":"https:\/\/www.cloudmagazin.com\/en\/2026\/09\/09\/hashicorp-introduces-provenance-tracking-for-machine-images\/","title":{"rendered":"HashiCorp gives machine images proof of origin"},"content":{"rendered":"<p><strong>A compromised machine image runs in every instance launched from it. HashiCorp has released Packer 1.16 with provenance based on the SLSA supply chain standard: the build can generate and sign an attestation, then verify it with one command. Proof requires enabling the post-processor and someone verifying it before launch.<\/strong><\/p>\n<h2>Key takeaways<\/h2>\n<div style=\"background:#f8fbfd;border:1px solid rgba(11,183,253,0.28);border-radius:8px;padding:22px 26px;margin:16px 0 34px;box-shadow:0 1px 0 rgba(11,183,253,0.08),0 2px 8px rgba(0,0,0,0.03);\">\n<ul style=\"margin:0;padding-left:20px;line-height:1.75;color:#1a2733;\">\n<li style=\"margin-bottom:10px;\"><strong>Packer 1.16 generates verifiable provenance.<\/strong> Packer can generate and sign SLSA attestations for machine images. HashiCorp announced the version in its blog on 13 August 2026; it appeared on GitHub on 24 July 2026.<\/li>\n<li style=\"margin-bottom:10px;\"><strong>The opt-in feature is disabled by default.<\/strong> Existing templates continue building unchanged. Provenance requires the provenance post-processor in the template. Verification before launch is a separate step.<\/li>\n<li><strong>L3 has no Packer button.<\/strong> The changelog lists SLSA Build L1 and L2 as features. The supplied L3 example uses a separate signing job. It does not establish the build platform&#8217;s security level.<\/li>\n<\/ul>\n<\/div>\n<p style=\"font-size:0.88em;color:#666;margin:20px 0 32px 0;border-top:1px solid #e5e5e5;border-bottom:1px solid #e5e5e5;padding:10px 0;\"><span style=\"font-family:'SF Mono','Monaco','Consolas',monospace;color:#0879aa;font-weight:700;text-transform:uppercase;font-size:0.72em;letter-spacing:0.14em;margin-right:14px;\">Related:<\/span><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/06\/05\/opentofu-vs-terraform-which-iac-tool-really-delivers\/\" style=\"color:#333;text-decoration:underline;\">OpenTofu vs. Terraform: which IaC tool really delivers<\/a>&nbsp;&nbsp;<span style=\"color:#ccc;\">\/<\/span>&nbsp;&nbsp;<a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/07\/21\/hugging-face-hacked-the-breach-started-with-a-dataset-loader\/\" style=\"color:#333;text-decoration:underline;\">Hugging Face hacked: a dataset loader was the entry point<\/a><\/p>\n<p><strong>What is Packer 1.16?<\/strong> The HashiCorp version that natively generates, signs and verifies SLSA provenance for machine images during builds. Without the post-processor and verification before launch, the attestation remains a file alongside the Amazon Machine Image (AMI).<\/p>\n<h2 style=\"margin-top:64px;margin-bottom:20px;padding-top:16px;\">The golden image is considered safe until someone checks its origin<\/h2>\n<p>Golden images are trusted, although few people check their origin. The pipeline has built the image, it sits in the registry, and instances launch from it. If a vulnerability emerges later or a build looks suspicious, the search begins in logs that are often already gone. HashiCorp writes that, until this version, reconstructing a machine image&#8217;s provenance required searching archives.<\/p>\n<p>The gap is structural. The SLSA framework, Supply-chain Levels for Software Artifacts, defines graduated guarantees about how artifacts are created. Its tools were developed for packages and containers. Machine images, including AMIs, VHD, QCOW2 and comparable cloud artifacts, fell outside their scope. Yet every workload starts there. A tampered image silently infects every instance launched from it.<\/p>\n<p>Packer was already where these images were built. What was missing was vendor-neutral, signed provenance readable by other supply chain tools. Version 1.16 adds it to the build. Protection depends on whether teams enable it and verify it before launch.<\/p>\n<h2 style=\"margin-top:64px;margin-bottom:20px;padding-top:16px;\">Packer records provenance as an in-toto statement<\/h2>\n<p>The new provenance post-processor supplements an existing build. After the run, Packer writes a signed JSON attestation to a directory such as attestations. It sits alongside the artifact, in S3, a registry or the team&#8217;s artifact store. The format is an in-toto statement, the attestation format used by supply chain tools, with an SLSA Provenance v1 predicate. Existing verification tools already consume this format for containers.<\/p>\n<p>The statement records the origin: Git commit, repository and ref, CI pipeline and timestamps. For local artifacts, Packer binds the attestation to the file&#8217;s SHA-256 digest. For cloud artifacts without a local file, it creates a canonical identity record: always the builder ID and artifact ID, optionally registry state, such as an HCP Packer URI, if provided by the builder.<\/p>\n<p>HashiCorp offers four attestation output modes, including an unsigned option. Unsigned (none) writes a JSON statement for an internal system already considered trusted. key uses a local PEM key, useful in air-gapped environments. kms accesses AWS KMS, Google Cloud KMS, Azure Key Vault or HashiCorp Vault through the respective URI. keyless uses Sigstore Fulcio and optionally the Rekor transparency log, intended for GitHub Actions without a long-lived key.<\/p>\n<p>Existing templates require no changes. Packer 1.16 continues building what 1.15 built. Provenance is an addition someone writes into the HCL. The code has been on GitHub since 24 July 2026; the <a href=\"https:\/\/www.hashicorp.com\/en\/blog\/packer-v1160-brings-verifiable-provenance-to-machine-images\" rel=\"noopener noreferrer\" target=\"_blank\">HashiCorp blog post of 13 August<\/a> announced it. It also describes the four signing options and attestation format: an in-toto statement with an SLSA Provenance v1 predicate, keyless via Sigstore Fulcio with an optional Rekor entry, and kms for AWS KMS, Google Cloud KMS, Azure Key Vault and HashiCorp Vault.<\/p>\n<h2 style=\"margin-top:64px;margin-bottom:20px;padding-top:16px;\">L3 has no Packer switch<\/h2>\n<p>SLSA distinguishes build levels with increasing requirements. HashiCorp mentions three in connection with Packer. The tool itself reaches two; the third depends on the build platform.<\/p>\n<p>Build L1 means provenance exists that identifies the artifact by digest and describes how it was created. Signing is optional at this level. signing_mode none provides documentation without protection against forgery. The statement must accompany the artifact; otherwise, L1 remains an internal file with no external effect.<\/p>\n<p>Build L2 requires a hosted service that generates and signs the provenance. HashiCorp demonstrates this with a Packer workflow on GitHub Actions: keyless signing, OpenID Connect (OIDC) providing the job&#8217;s short-lived CI identity as signer, and upload to the public Rekor log. A reference workflow is available under examples\/ci. HashiCorp states that this pattern meets L2 only if the hosted build platform and provenance generation controls meet SLSA L2 requirements. Packer alone does not confer that status.<\/p>\n<p>HashiCorp explicitly calls the third example only L3-compatible. Here, the build job publishes only the digest. A separate signing job, sharing no process space with the build steps, issues the attestation. The example uses slsa-framework\/slsa-github-generator. HashiCorp is clear: this does not establish L3 by itself. L3 requires a hardened platform and build isolation. Accordingly, the changelog for version 1.16.0 lists features for SLSA Build L1 and L2. A YAML file in the repository does not make Packer 1.16 SLSA Build L3; the level remains a property of the build platform.<\/p>\n<h2 style=\"margin-top:64px;margin-bottom:20px;padding-top:16px;\">Without verification before launch, the attestation goes unread<\/h2>\n<p>HashiCorp intends the new packer verify-attestation command for the deployment pipeline or preflight checks. If verification fails, the command exits with an error code, stopping deployment. HashiCorp specifies signing identity and artifact digest as minimum checks. L2 additionally requires Rekor and timestamps.<\/p>\n<p>Packer 1.16 makes provenance verifiable once the post-processor runs and the verify command is placed before launch. Without this step, a JSON file remains alongside the AMI. Pipeline operators decide whether the command runs before launch. Packer does not enforce it.<\/p>\n<h2 style=\"padding-top:64px;margin-bottom:20px;\">Frequently asked questions<\/h2>\n<details>\n<summary><strong>What does Packer 1.16 change for machine images?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">This version can generate and sign SLSA provenance for every image built, then verify it later. The new post-processor and packer verify-attestation command are disabled by default. Without these two steps, Packer builds images as before.<\/p>\n<\/details>\n<details>\n<summary><strong>What does a provenance attestation contain?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Signed, machine-readable provenance: Git commit, repository, ref, CI pipeline and timestamps. Local artifacts also include the file&#8217;s SHA-256. Cloud artifacts without a local file use an identity record comprising builder ID and artifact ID, optionally with a registry URI. The format is in-toto with an SLSA Provenance v1 predicate.<\/p>\n<\/details>\n<details>\n<summary><strong>Do I need to rework existing Packer templates?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">No. HashiCorp makes the new capabilities opt-in. Existing templates continue running under 1.16. Provenance is generated only when the post-processor is included in the HCL.<\/p>\n<\/details>\n<details>\n<summary><strong>Is Packer 1.16 enough for SLSA Build L3?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">No. The changelog lists L1 and L2 as features. The L3 example separates building and signing into two jobs and uses slsa-github-generator. HashiCorp states that this alone does not establish L3. L3 remains a property of the build platform.<\/p>\n<\/details>\n<details>\n<summary><strong>What does packer verify-attestation check?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">The command checks the attestation against the artifact, the expected signing identity and optional additional requirements such as Rekor and timestamps. On failure, it exits with an error code. In pipelines without this command, instances launch without verification.<\/p>\n<\/details>\n<h2>Editor&#8217;s Picks<\/h2>\n<ul style=\"list-style:none;margin:0 0 8px;padding:0;\">\n<li style=\"padding:10px 0;border-bottom:1px solid #eee;\"><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/07\/21\/hugging-face-hacked-the-breach-started-with-a-dataset-loader\/\" style=\"color:#1a1a1a;text-decoration:none;\">Hugging Face Breach: How a Dataset Loader Became the Entry Point<\/a><\/li>\n<li style=\"padding:10px 0;border-bottom:1px solid #eee;\"><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/07\/22\/study-increased-cloud-budget-does-not-fill-the-security-gap\/\" style=\"color:#1a1a1a;text-decoration:none;\">Study: More Cloud Budget Won\u2019t Close the Security Gap<\/a><\/li>\n<li style=\"padding:10px 0;border-bottom:1px solid #eee;\"><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/08\/04\/downloadable-doesnt-mean-deployable\/\" style=\"color:#1a1a1a;text-decoration:none;\">Downloadable Doesn\u2019t Mean Deployable<\/a><\/li>\n<\/ul>\n<p style=\"margin:44px 0 12px;font-size:0.72em;font-weight:700;text-transform:uppercase;letter-spacing:0.18em;color:#666;\">More from the MBF Media Network<\/p>\n<div style=\"padding:14px 18px;border-left:3px solid #202528;background:#fafafa;margin-bottom:6px;\">\n<div style=\"font-size:0.7em;font-weight:700;color:#202528;text-transform:uppercase;letter-spacing:0.12em;margin-bottom:4px;\">MyBusinessFuture<\/div>\n<p><a href=\"https:\/\/mybusinessfuture.com\/mckinsey-ki-hebt-tempo-die-guv-bleibt-flach\/\" style=\"font-weight:600;line-height:1.4;color:#1a1a1a;text-decoration:none;\">McKinsey: AI Speeds Up Operations, But EBITDA Growth Remains Flat<\/a><\/p>\n<\/div>\n<div style=\"padding:14px 18px;border-left:3px solid #d65663;background:#fafafa;margin-bottom:6px;\">\n<div style=\"font-size:0.7em;font-weight:700;color:#d65663;text-transform:uppercase;letter-spacing:0.12em;margin-bottom:4px;\">Digital-Chiefs<\/div>\n<p><a href=\"https:\/\/www.digital-chiefs.de\/warum-ki-an-den-stammdaten-scheitert\/\" style=\"font-weight:600;line-height:1.4;color:#1a1a1a;text-decoration:none;\">Why AI Fails at Master Data<\/a><\/p>\n<\/div>\n<div style=\"padding:14px 18px;border-left:3px solid #69d8ed;background:#fafafa;\">\n<div style=\"font-size:0.7em;font-weight:700;color:#69d8ed;text-transform:uppercase;letter-spacing:0.12em;margin-bottom:4px;\">SecurityToday<\/div>\n<p><a href=\"https:\/\/www.securitytoday.de\/2026\/08\/24\/ray-jobs-api-ohne-login-steht-jetzt-in-kev\/\" style=\"font-weight:600;line-height:1.4;color:#1a1a1a;text-decoration:none;\">CISA Adds Ray to KEV: API Lets Users Launch Cluster Jobs Without Authentication<\/a><\/p>\n<\/div>\n<p style=\"text-align:right;color:#868e96;font-size:0.75em;margin-top:40px;\"><em>Image Source: AI-generated (September 2026)<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"Packer 1.16 can sign the provenance of golden images. The feature is disabled by default. Without verification before launch, the attestation goes unread.","protected":false},"author":31,"featured_media":51758,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"pre_headline":"","bildquelle":"","teasertext":"","language":"de","_evm_slot_owner":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[921],"tags":[],"industry":[],"class_list":["post-53464","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"evm_reading_time_minutes":8,"wpml_language":"en","wpml_translation_of":51639,"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.9 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>HashiCorp gives machine images proof of origin<\/title>\n<meta name=\"description\" content=\"Packer 1.16 adds native SLSA provenance for machine images. Four signing modes, one verify command. It stays off until enabled before launch.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/09\/09\/hashicorp-introduces-provenance-tracking-for-machine-images\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"HashiCorp gives machine images proof of origin\" \/>\n<meta property=\"og:description\" content=\"Packer 1.16 adds native SLSA provenance for machine images. Four signing modes, one verify command. It stays off until enabled before launch.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.cloudmagazin.com\/en\/2026\/09\/09\/hashicorp-introduces-provenance-tracking-for-machine-images\/\" \/>\n<meta property=\"og:site_name\" content=\"cloudmagazin\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cloudmagazincom\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-09T07:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-16T07:12:51+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/09\/packer-1-16-herkunftsnachweis-fuer-machine-images-cover-hero.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Alec Chizhik\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cloudmagazin\" \/>\n<meta name=\"twitter:site\" content=\"@cloudmagazin\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Alec Chizhik\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/09\\\/09\\\/hashicorp-introduces-provenance-tracking-for-machine-images\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/09\\\/09\\\/hashicorp-introduces-provenance-tracking-for-machine-images\\\/\"},\"author\":{\"name\":\"Alec Chizhik\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#\\\/schema\\\/person\\\/ce38baaa19a580268aedce096597eb3c\"},\"headline\":\"HashiCorp gives machine images proof of origin\",\"datePublished\":\"2026-09-09T07:00:00+00:00\",\"dateModified\":\"2026-10-16T07:12:51+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/09\\\/09\\\/hashicorp-introduces-provenance-tracking-for-machine-images\\\/\"},\"wordCount\":1288,\"publisher\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/09\\\/09\\\/hashicorp-introduces-provenance-tracking-for-machine-images\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/packer-1-16-herkunftsnachweis-fuer-machine-images-cover-hero.jpg\",\"articleSection\":[\"News\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/09\\\/09\\\/hashicorp-introduces-provenance-tracking-for-machine-images\\\/\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/09\\\/09\\\/hashicorp-introduces-provenance-tracking-for-machine-images\\\/\",\"name\":\"HashiCorp gives machine images proof of origin\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/09\\\/09\\\/hashicorp-introduces-provenance-tracking-for-machine-images\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/09\\\/09\\\/hashicorp-introduces-provenance-tracking-for-machine-images\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/packer-1-16-herkunftsnachweis-fuer-machine-images-cover-hero.jpg\",\"datePublished\":\"2026-09-09T07:00:00+00:00\",\"dateModified\":\"2026-10-16T07:12:51+00:00\",\"description\":\"Packer 1.16 adds native SLSA provenance for machine images. Four signing modes, one verify command. It stays off until enabled before launch.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/09\\\/09\\\/hashicorp-introduces-provenance-tracking-for-machine-images\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/09\\\/09\\\/hashicorp-introduces-provenance-tracking-for-machine-images\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/09\\\/09\\\/hashicorp-introduces-provenance-tracking-for-machine-images\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/packer-1-16-herkunftsnachweis-fuer-machine-images-cover-hero.jpg\",\"contentUrl\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/packer-1-16-herkunftsnachweis-fuer-machine-images-cover-hero.jpg\",\"width\":1280,\"height\":720,\"caption\":\"Bildquelle: KI-generiert (September 2026)\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/09\\\/09\\\/hashicorp-introduces-provenance-tracking-for-machine-images\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/home\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"HashiCorp gives machine images proof of origin\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/\",\"name\":\"cloudmagazin\",\"description\":\"Inspiration f\u00fcr Businessentscheider\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#organization\",\"name\":\"cloudmagazin\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/cloudmagazin-logo-klein_menu.jpg\",\"contentUrl\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/cloudmagazin-logo-klein_menu.jpg\",\"width\":150,\"height\":150,\"caption\":\"cloudmagazin\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/cloudmagazincom\\\/\",\"https:\\\/\\\/x.com\\\/cloudmagazin\",\"https:\\\/\\\/www.linkedin.com\\\/showcase\\\/cloudmagazin\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#\\\/schema\\\/person\\\/ce38baaa19a580268aedce096597eb3c\",\"name\":\"Alec Chizhik\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/alec-chizhik.jpg\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/alec-chizhik.jpg\",\"contentUrl\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/alec-chizhik.jpg\",\"caption\":\"Alec Chizhik\"},\"description\":\"Alec is the Chief Digital Officer at Evernine and writes about cloud architectures, IT security, and digital operations practices.\",\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/alecchizhik\\\/\"],\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/author\\\/alec\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"HashiCorp gives machine images proof of origin","description":"Packer 1.16 adds native SLSA provenance for machine images. Four signing modes, one verify command. It stays off until enabled before launch.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.cloudmagazin.com\/en\/2026\/09\/09\/hashicorp-introduces-provenance-tracking-for-machine-images\/","og_locale":"en_US","og_type":"article","og_title":"HashiCorp gives machine images proof of origin","og_description":"Packer 1.16 adds native SLSA provenance for machine images. Four signing modes, one verify command. It stays off until enabled before launch.","og_url":"https:\/\/www.cloudmagazin.com\/en\/2026\/09\/09\/hashicorp-introduces-provenance-tracking-for-machine-images\/","og_site_name":"cloudmagazin","article_publisher":"https:\/\/www.facebook.com\/cloudmagazincom\/","article_published_time":"2026-09-09T07:00:00+00:00","article_modified_time":"2026-10-16T07:12:51+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/09\/packer-1-16-herkunftsnachweis-fuer-machine-images-cover-hero.jpg","type":"image\/jpeg"}],"author":"Alec Chizhik","twitter_card":"summary_large_image","twitter_creator":"@cloudmagazin","twitter_site":"@cloudmagazin","twitter_misc":{"Written by":"Alec Chizhik","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/09\/09\/hashicorp-introduces-provenance-tracking-for-machine-images\/#article","isPartOf":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/09\/09\/hashicorp-introduces-provenance-tracking-for-machine-images\/"},"author":{"name":"Alec Chizhik","@id":"https:\/\/www.cloudmagazin.com\/en\/#\/schema\/person\/ce38baaa19a580268aedce096597eb3c"},"headline":"HashiCorp gives machine images proof of origin","datePublished":"2026-09-09T07:00:00+00:00","dateModified":"2026-10-16T07:12:51+00:00","mainEntityOfPage":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/09\/09\/hashicorp-introduces-provenance-tracking-for-machine-images\/"},"wordCount":1288,"publisher":{"@id":"https:\/\/www.cloudmagazin.com\/en\/#organization"},"image":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/09\/09\/hashicorp-introduces-provenance-tracking-for-machine-images\/#primaryimage"},"thumbnailUrl":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/09\/packer-1-16-herkunftsnachweis-fuer-machine-images-cover-hero.jpg","articleSection":["News"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/09\/09\/hashicorp-introduces-provenance-tracking-for-machine-images\/","url":"https:\/\/www.cloudmagazin.com\/en\/2026\/09\/09\/hashicorp-introduces-provenance-tracking-for-machine-images\/","name":"HashiCorp gives machine images proof of origin","isPartOf":{"@id":"https:\/\/www.cloudmagazin.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/09\/09\/hashicorp-introduces-provenance-tracking-for-machine-images\/#primaryimage"},"image":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/09\/09\/hashicorp-introduces-provenance-tracking-for-machine-images\/#primaryimage"},"thumbnailUrl":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/09\/packer-1-16-herkunftsnachweis-fuer-machine-images-cover-hero.jpg","datePublished":"2026-09-09T07:00:00+00:00","dateModified":"2026-10-16T07:12:51+00:00","description":"Packer 1.16 adds native SLSA provenance for machine images. Four signing modes, one verify command. It stays off until enabled before launch.","breadcrumb":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/09\/09\/hashicorp-introduces-provenance-tracking-for-machine-images\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.cloudmagazin.com\/en\/2026\/09\/09\/hashicorp-introduces-provenance-tracking-for-machine-images\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/09\/09\/hashicorp-introduces-provenance-tracking-for-machine-images\/#primaryimage","url":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/09\/packer-1-16-herkunftsnachweis-fuer-machine-images-cover-hero.jpg","contentUrl":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/09\/packer-1-16-herkunftsnachweis-fuer-machine-images-cover-hero.jpg","width":1280,"height":720,"caption":"Bildquelle: KI-generiert (September 2026)"},{"@type":"BreadcrumbList","@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/09\/09\/hashicorp-introduces-provenance-tracking-for-machine-images\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.cloudmagazin.com\/en\/home\/"},{"@type":"ListItem","position":2,"name":"HashiCorp gives machine images proof of origin"}]},{"@type":"WebSite","@id":"https:\/\/www.cloudmagazin.com\/en\/#website","url":"https:\/\/www.cloudmagazin.com\/en\/","name":"cloudmagazin","description":"Inspiration f\u00fcr Businessentscheider","publisher":{"@id":"https:\/\/www.cloudmagazin.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.cloudmagazin.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.cloudmagazin.com\/en\/#organization","name":"cloudmagazin","url":"https:\/\/www.cloudmagazin.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cloudmagazin.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2020\/04\/cloudmagazin-logo-klein_menu.jpg","contentUrl":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2020\/04\/cloudmagazin-logo-klein_menu.jpg","width":150,"height":150,"caption":"cloudmagazin"},"image":{"@id":"https:\/\/www.cloudmagazin.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/cloudmagazincom\/","https:\/\/x.com\/cloudmagazin","https:\/\/www.linkedin.com\/showcase\/cloudmagazin\/"]},{"@type":"Person","@id":"https:\/\/www.cloudmagazin.com\/en\/#\/schema\/person\/ce38baaa19a580268aedce096597eb3c","name":"Alec Chizhik","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/03\/alec-chizhik.jpg","url":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/03\/alec-chizhik.jpg","contentUrl":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/03\/alec-chizhik.jpg","caption":"Alec Chizhik"},"description":"Alec is the Chief Digital Officer at Evernine and writes about cloud architectures, IT security, and digital operations practices.","sameAs":["https:\/\/www.linkedin.com\/in\/alecchizhik\/"],"url":"https:\/\/www.cloudmagazin.com\/en\/author\/alec\/"}]}},"_links":{"self":[{"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/posts\/53464","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/users\/31"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/comments?post=53464"}],"version-history":[{"count":19,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/posts\/53464\/revisions"}],"predecessor-version":[{"id":54168,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/posts\/53464\/revisions\/54168"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/media\/51758"}],"wp:attachment":[{"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/media?parent=53464"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/categories?post=53464"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/tags?post=53464"},{"taxonomy":"industry","embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/industry?post=53464"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}