packer

Commit Graph

Author	SHA1	Message	Date
Wilken Rivera	e3c8d9b929	Bump Go toolchain to 1.21.8 This change addresses vulnerabilities reported by govulncheck ``` Vulnerability #1: GO-2024-2610 Errors returned from JSON marshaling may break template escaping in html/template More info: https://pkg.go.dev/vuln/GO-2024-2610 Standard library Found in: html/template@go1.22 Fixed in: html/template@go1.22.1 Example traces found: #1: datasource/http/data.go:119:24: http.Datasource.Execute calls http.Client.Do, which eventually calls template.Template.Execute #2: datasource/http/data.go:119:24: http.Datasource.Execute calls http.Client.Do, which eventually calls template.Template.ExecuteTemplate Vulnerability #2: GO-2024-2600 Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http More info: https://pkg.go.dev/vuln/GO-2024-2600 Standard library Found in: net/http@go1.22 Fixed in: net/http@go1.22.1 Example traces found: #1: datasource/http/data.go:119:24: http.Datasource.Execute calls http.Client.Do #2: hcl2template/function/aws_secretetkey.go:38:37: function.init calls template.GetAWSSecret, which eventually calls http.Client.Post #3: hcl2template/function/aws_secretetkey.go:38:37: function.init calls template.GetAWSSecret, which eventually calls http.Client.PostForm Vulnerability #3: GO-2024-2599 Memory exhaustion in multipart form parsing in net/textproto and net/http More info: https://pkg.go.dev/vuln/GO-2024-2599 Standard library Found in: net/textproto@go1.22 Fixed in: net/textproto@go1.22.1 Example traces found: #1: internal/hcp/api/service_build.go:81:48: api.Client.UpdateBuild calls packer_service.Client.PackerServiceUpdateBuild, which eventually calls textproto.Reader.ReadLine #2: datasource/http/data.go:140:26: http.Datasource.Execute calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader Vulnerability #4: GO-2024-2598 Verify panics on certificates with an unknown public key algorithm in crypto/x509 More info: https://pkg.go.dev/vuln/GO-2024-2598 Standard library Found in: crypto/x509@go1.22 Fixed in: crypto/x509@go1.22.1 Example traces found: #1: datasource/http/data.go:140:26: http.Datasource.Execute calls io.ReadAll, which eventually calls x509.Certificate.Verify ```	2 years ago
Wilken Rivera	910a22f263	Bump google.golang.org/protobuf to address CVE-2024-24786	2 years ago
dependabot[bot]	8a1d1e0c88	build(deps): bump github.com/hashicorp/hcp-sdk-go from 0.83.0 to 0.85.0 (#12850 ) Bumps [github.com/hashicorp/hcp-sdk-go](https://github.com/hashicorp/hcp-sdk-go) from 0.83.0 to 0.85.0. - [Release notes](https://github.com/hashicorp/hcp-sdk-go/releases) - [Changelog](https://github.com/hashicorp/hcp-sdk-go/blob/main/CHANGELOG.md) - [Commits](https://github.com/hashicorp/hcp-sdk-go/compare/v0.83.0...v0.85.0) --- updated-dependencies: - dependency-name: github.com/hashicorp/hcp-sdk-go dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2 years ago
dependabot[bot]	9b01bfa486	build(deps): bump github.com/hashicorp/hcp-sdk-go from 0.82.0 to 0.83.0 (#12827 ) Bumps [github.com/hashicorp/hcp-sdk-go](https://github.com/hashicorp/hcp-sdk-go) from 0.82.0 to 0.83.0. - [Release notes](https://github.com/hashicorp/hcp-sdk-go/releases) - [Changelog](https://github.com/hashicorp/hcp-sdk-go/blob/main/CHANGELOG.md) - [Commits](https://github.com/hashicorp/hcp-sdk-go/compare/v0.82.0...v0.83.0) --- updated-dependencies: - dependency-name: github.com/hashicorp/hcp-sdk-go dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2 years ago
Devashish	3fa637c608	Migrate HCP Packer to API V2 and new nomenclature changes (#12794 ) * add hcp packer new nomenclature updates * Update docs with nomenclature changes * Update navigation bar links * Bump github.com/hashicorp/hcp-sdk-go from 0.81.0 to 0.82.0 * fix acceptance test template --------- Co-authored-by: sylviamoss <moss@hashicorp.com> Co-authored-by: Wilken Rivera <dev@wilkenrivera.com>	2 years ago
dependabot[bot]	91ce018cf1	build(deps): bump github.com/hashicorp/hcp-sdk-go from 0.79.0 to 0.81.0 Bumps [github.com/hashicorp/hcp-sdk-go](https://github.com/hashicorp/hcp-sdk-go) from 0.79.0 to 0.81.0. - [Release notes](https://github.com/hashicorp/hcp-sdk-go/releases) - [Changelog](https://github.com/hashicorp/hcp-sdk-go/blob/main/CHANGELOG.md) - [Commits](https://github.com/hashicorp/hcp-sdk-go/compare/v0.79.0...v0.81.0) --- updated-dependencies: - dependency-name: github.com/hashicorp/hcp-sdk-go dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2 years ago
Wilken Rivera	beb5fcf470	Bump github.com/cloudflare/circl to address GHSA-9763-4f94-gfch (#12781 )	2 years ago
dependabot[bot]	a9000f3a70	build(deps): bump github.com/hashicorp/hcp-sdk-go from 0.74.0 to 0.79.0 Bumps [github.com/hashicorp/hcp-sdk-go](https://github.com/hashicorp/hcp-sdk-go) from 0.74.0 to 0.79.0. - [Release notes](https://github.com/hashicorp/hcp-sdk-go/releases) - [Changelog](https://github.com/hashicorp/hcp-sdk-go/blob/main/CHANGELOG.md) - [Commits](https://github.com/hashicorp/hcp-sdk-go/compare/v0.74.0...v0.79.0) --- updated-dependencies: - dependency-name: github.com/hashicorp/hcp-sdk-go dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2 years ago
Wilken Rivera	bfc3f8b564	Bump github.com/go-git/go-git/v5 to address CVE-2023-49568	2 years ago
Wilken Rivera	2515aa27a7	Bump golang.org/x/crypto to address CVE-2023-48795	2 years ago
Wilken Rivera	083243c119	Bump github.com/go-jose/go-jose/v3 to address GO-2023-2334	2 years ago
Wilken Rivera	2aad170440	Bumps github.com/hashicorp/packer-plugin-sdk from 0.4.0 to 0.5.2	2 years ago
dependabot[bot]	9b2d9f4fb3	build(deps): bump github.com/hashicorp/hcp-sdk-go from 0.73.0 to 0.74.0 Bumps [github.com/hashicorp/hcp-sdk-go](https://github.com/hashicorp/hcp-sdk-go) from 0.73.0 to 0.74.0. - [Release notes](https://github.com/hashicorp/hcp-sdk-go/releases) - [Changelog](https://github.com/hashicorp/hcp-sdk-go/blob/main/CHANGELOG.md) - [Commits](https://github.com/hashicorp/hcp-sdk-go/compare/v0.73.0...v0.74.0) --- updated-dependencies: - dependency-name: github.com/hashicorp/hcp-sdk-go dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2 years ago
Wilken Rivera	c245b1fb7c	deps: Bump github.com/hashicorp/hcp-sdk-go to v0.73.0 * Updates cloud-resource-management API to use sable * Removes duplicate imports of the same SDK packages	2 years ago
Wilken Rivera	ac71611cf5	Remove all HashiCorp vendored plugins	2 years ago
Jamie Finnigan	9a1d4b5219	go get -u google.golang.org/grpc && go mod tidy	2 years ago
Jamie Finnigan	193f5e1f60	go get -u golang.org/x/net && go mod tidy	2 years ago
Shengjing Zhu	d56db70a57	Bump github.com/pierrec/lz4 to v4.1.18	2 years ago
Lucas Bajolet	4d0a51c189	go.mod: bump golang.org/x/net to v0.13.0 The version of the golang.org/x/net we used (v0.8.0), is vulnerable to a rendering issue, potentially escaping text that should not be, which can enable other attacks then. Packer itself is not vulnerable to the CVE as we don't render web pages, but security checks do point it as an issue, so we fix it by updating the dependencies. CVE refrerence: GO-2023-1988	3 years ago
Wilken Rivera	8982d4f168	Migrate external Parallels plugin to Parallels/packer-plugin-parallels (#12476 ) * Update external plugin documentation source The Parallels plugin for Packer is now maintained by the Parallels team, under their respective GitHub org. This changes updates the source address for the external plugin that should be used for pulling new plugin documentation. * Removed packer-plugin-parallels for list of vendored plugins	3 years ago
Wilken Rivera	d67bacc8d3	Remove community plugins from the vendored plugins list (#12436 ) This step removes community plugins from the Packer binary release. These plugins are being maintained and released independently of Packer and have become out of date. To ensure users are using the latest version of the plugins they are being removed in favor of the external plugin installation processes.	3 years ago
Wilken Rivera	6a4c577d6a	Bump github.com/shirou/gopsutil to v3 (#12437 ) This change updates gopsutil to the latest available version. Fixes: https://github.com/hashicorp/packer/issues/12430	3 years ago
Wilken Rivera	06fe087097	Merge pull request #12380 from hashicorp/bump-go-1.20 Bump Go tooling to version 1.20	3 years ago
Wilken Rivera	65f6428fce	Remove external archived provisioner plugins (#12374 ) This change removes a set of plugins that have not been updated in a while. These plugins have been archived for some time now. Users wishing to continue using these plugins should use the `packer plugins install` or `packer init` commands to install the external plugin.	3 years ago
Wilken Rivera	13a24db0de	Remove IONOS plugins from vendored plugins (#12385 ) * Remove profitbricks plugin * Remove oneandone plugin The following plugins have been unmaintained for some time now, and their upstream cloud provider has consolidate the services. These plugins will continue to be available to Packer via direct installation using packer init or the packer plugins install command. But they will no longer be bundled with Packer.	3 years ago
Wilken Rivera	ddd7ee98b6	Bump go.mod to 1.20 * Fix go vet issue * Bump Go tooling to version 1.20 * Update workflows to use go-version file	3 years ago
Wilken Rivera	08d1dfe36c	Remove external plugin for Digital Ocean (#12376 ) The Digital Ocean plugin is now maintained and released by the Digital Ocean team. To ensure users are downloading the latest available version the plugin will nolonger be bundled with Packer.	3 years ago
Wilken Rivera	f678c06396	Migrate external UCloud plugin to ucloud/packer-plugin-ucloud (#12335 ) * Update external plugin documentation source The UCloud plugin for Packer is now maintained by the UCloud team, under their respective GitHub org. This changes updates the source address for the external plugin that should be used for pulling new plugin documentation. * Remove packer-plugin-ucloud from vendored plugins.	3 years ago
Wilken Rivera	20c2d48df7	Migrate external Linode plugin to linode/packer-plugin-linode (#12329 ) * Update external plugin documentation source The Linode plugin for Packer is now maintained by the Linode team, under their respective GitHub org. This changes updates the source address for the external plugin that should be used for pulling new plugin documentation. * Removed packer-plugin-linode for list of vendored plugins The Linode plugin for Packer is now maintained by the Linode team, under their respective GitHub org. This changes removes Linode from the vendored plugins lists.	3 years ago
dependabot[bot]	d7fdc9a9ec	build(deps): bump github.com/hashicorp/packer-plugin-sdk (#12306 ) Bumps [github.com/hashicorp/packer-plugin-sdk](https://github.com/hashicorp/packer-plugin-sdk) from 0.3.4 to 0.4.0. - [Release notes](https://github.com/hashicorp/packer-plugin-sdk/releases) - [Changelog](https://github.com/hashicorp/packer-plugin-sdk/blob/main/CHANGELOG.md) - [Commits](https://github.com/hashicorp/packer-plugin-sdk/compare/v0.3.4...v0.4.0) --- updated-dependencies: - dependency-name: github.com/hashicorp/packer-plugin-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	3 years ago
dependabot[bot]	512ef1ae39	build(deps): bump github.com/hashicorp/hcp-sdk-go from 0.34.0 to 0.36.0 (#12292 ) Bumps [github.com/hashicorp/hcp-sdk-go](https://github.com/hashicorp/hcp-sdk-go) from 0.34.0 to 0.36.0. - [Release notes](https://github.com/hashicorp/hcp-sdk-go/releases) - [Changelog](https://github.com/hashicorp/hcp-sdk-go/blob/main/CHANGELOG.md) - [Commits](https://github.com/hashicorp/hcp-sdk-go/compare/v0.34.0...v0.36.0) --- updated-dependencies: - dependency-name: github.com/hashicorp/hcp-sdk-go dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	3 years ago
Wilken Rivera	245df57ca6	Update golang.org/x/net to address GO-2023-1571 ``` » Go Modules Scanner ⚠︎ found OSV reported vulnerability GHSA-vvpx-j8f3-3w6h in golang.org/x/net@v0.5.0 ⚠︎ found OSV reported vulnerability GO-2023-1571 in golang.org/x/net@v0.5.0 ```	3 years ago
Wilken Rivera	fd3ab4710d	Bump bundled plugins to latest available version (#12271 )	3 years ago
dependabot[bot]	f82d93d9ac	build(deps): bump github.com/hashicorp/hcp-sdk-go from 0.33.0 to 0.34.0 (#12262 ) Bumps [github.com/hashicorp/hcp-sdk-go](https://github.com/hashicorp/hcp-sdk-go) from 0.33.0 to 0.34.0. - [Release notes](https://github.com/hashicorp/hcp-sdk-go/releases) - [Changelog](https://github.com/hashicorp/hcp-sdk-go/blob/main/CHANGELOG.md) - [Commits](https://github.com/hashicorp/hcp-sdk-go/compare/v0.33.0...v0.34.0) --- updated-dependencies: - dependency-name: github.com/hashicorp/hcp-sdk-go dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	3 years ago
Wilken Rivera	b3a1e98889	Update github.com/hashicorp/go-getter/v2 pkgs to address CVE-2023-0475	3 years ago
dependabot[bot]	ab90025dc2	build(deps): bump github.com/hashicorp/hcp-sdk-go from 0.31.0 to 0.33.0 Bumps [github.com/hashicorp/hcp-sdk-go](https://github.com/hashicorp/hcp-sdk-go) from 0.31.0 to 0.33.0. - [Release notes](https://github.com/hashicorp/hcp-sdk-go/releases) - [Changelog](https://github.com/hashicorp/hcp-sdk-go/blob/main/CHANGELOG.md) - [Commits](https://github.com/hashicorp/hcp-sdk-go/compare/v0.31.0...v0.33.0) --- updated-dependencies: - dependency-name: github.com/hashicorp/hcp-sdk-go dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	3 years ago
Ashlee M Boyer	50da6c8dc8	docs: Migrate link formats (#12192 ) * Adding check-legacy-links-format workflow * Adding test-link-rewrites workflow * Migrating links to new format * Updating docs-content-check-legacy-links-format hash * chore: update source * Update generated partials from Packer plugin SDK * Bump packer-plugin-sdk to get latest packer-sdc * Update website/content/docs/templates/hcl_templates/blocks/build/provisioner.mdx * Update Plugin SDK to fix shell-local regression --------- Co-authored-by: Kendall Strautman <kendallstrautman@gmail.com> Co-authored-by: Wilken Rivera <wilken@hashicorp.com> Co-authored-by: Kendall Strautman <36613477+kendallstrautman@users.noreply.github.com>	3 years ago
dependabot[bot]	15a3e4f5fb	build(deps): bump github.com/hashicorp/hcp-sdk-go from 0.29.0 to 0.31.0 Bumps [github.com/hashicorp/hcp-sdk-go](https://github.com/hashicorp/hcp-sdk-go) from 0.29.0 to 0.31.0. - [Release notes](https://github.com/hashicorp/hcp-sdk-go/releases) - [Changelog](https://github.com/hashicorp/hcp-sdk-go/blob/main/CHANGELOG.md) - [Commits](https://github.com/hashicorp/hcp-sdk-go/compare/v0.29.0...v0.31.0) --- updated-dependencies: - dependency-name: github.com/hashicorp/hcp-sdk-go dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	3 years ago
Wilken Rivera	56f784ae95	Bump github.com/hashicorp/go-getter/v2 (#12161 ) The latest version of Go-Getter contains a SMBClient timeout option, along with an updated AWS SDK to improve S3 support. ``` go get github.com/hashicorp/go-getter/v2 go get github.com/hashicorp/go-getter/s3/v2 go get github.com/hashicorp/go-getter/gcs/v2 go mod tidy ```	3 years ago
dependabot[bot]	a6e7635d05	build(deps): bump github.com/hashicorp/hcp-sdk-go from 0.28.0 to 0.29.0 (#12163 ) Bumps [github.com/hashicorp/hcp-sdk-go](https://github.com/hashicorp/hcp-sdk-go) from 0.28.0 to 0.29.0. - [Release notes](https://github.com/hashicorp/hcp-sdk-go/releases) - [Changelog](https://github.com/hashicorp/hcp-sdk-go/blob/main/CHANGELOG.md) - [Commits](https://github.com/hashicorp/hcp-sdk-go/compare/v0.28.0...v0.29.0) --- updated-dependencies: - dependency-name: github.com/hashicorp/hcp-sdk-go dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	3 years ago
Lucas Bajolet	027e920147	go.mod: bump golang.org/net to 0.4.0 As with the go version to 1.18.9, this fix concerns mitigations to the GO-2022-1144 vulnerability. Since we depend on golang.org/net too, we need to update it to a version that is not vulnerable anymore, and this is starting at version 0.4.0	3 years ago
Wilken Rivera	f35270700f	Update external plugins to latest available release	3 years ago
Lucas Bajolet	08f1e85fb1	hcp: fix payloads for new SDK version The grpc_gateway v2 changes had some repercussions in the payloads of the API calls, making the current code non-functional against the latest SDK.	3 years ago
Wilken Rivera	c1cd718e0e	Update github.com/stretchr/testify to address vulnerabilities in dependencies * Resolves CVE-2022-28948 in gopkg.in/yaml.v3 Many thanks to chncaption for bubbling this vulnerability in #12908	3 years ago
dependabot[bot]	113bc5eea4	Bump github.com/hashicorp/hcl/v2 from 2.13.0 to 2.14.1 (#12015 ) Bumps [github.com/hashicorp/hcl/v2](https://github.com/hashicorp/hcl) from 2.13.0 to 2.14.1. - [Release notes](https://github.com/hashicorp/hcl/releases) - [Changelog](https://github.com/hashicorp/hcl/blob/main/CHANGELOG.md) - [Commits](https://github.com/hashicorp/hcl/compare/v2.13.0...v2.14.1) --- updated-dependencies: - dependency-name: github.com/hashicorp/hcl/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	3 years ago
Wilken Rivera	10c7b999ea	Update bundled plugins to latest available version (#12085 )	3 years ago
Wilken Rivera	6eba1f598e	chore: Bump golang.org/x/text to v0.3.8 Address reported vulnerability GO-2022-1059 in golang.org/x/text@v0.3.7	3 years ago
Wilken Rivera	d028844284	Update dependency to resolve GO-2022-0969 (#12009 )	3 years ago
dependabot[bot]	f7ce79362d	Bump github.com/hashicorp/packer-plugin-sdk from 0.3.1 to 0.3.2 (#11981 ) Bumps [github.com/hashicorp/packer-plugin-sdk](https://github.com/hashicorp/packer-plugin-sdk) from 0.3.1 to 0.3.2. - [Release notes](https://github.com/hashicorp/packer-plugin-sdk/releases) - [Changelog](https://github.com/hashicorp/packer-plugin-sdk/blob/main/CHANGELOG.md) - [Commits](https://github.com/hashicorp/packer-plugin-sdk/compare/v0.3.1...v0.3.2) --- updated-dependencies: - dependency-name: github.com/hashicorp/packer-plugin-sdk dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	3 years ago
Wilken Rivera	11e71729f1	Remove Oracle plugin from the list of vendored plugins (#11983 ) The latest release of the Oracle plugin for Packer removed Solaris from its list of supported platforms. Since Packer still releases binaries for Solaris the Oracle plugin will no longer be bundled and distributed within the Packer binary. Practitioners relying on the plugin can continue using the plugin by installing it manually using either the `packer init` or `packer plugins install` commands.	3 years ago

1 2 3 4 5 ...

381 Commits (ea1e798c47a556b1f54581801c8a40a5ab42e2ec)