github.com/hashicorp/packer

NOTES:

• New Docker Image: As part of the bundled plugin removal effort, a new Docker target called release-full has been added to the Packer release artifacts. The release-full image includes Packer and all the official plugins pre-installed in its environment. This image is being offered as an alternative option for those users who may still be relying on the plugin versions bundled into the Packer binary. GH-12532

IMPROVEMENTS:

• core/docs: Clarify the expected usage of the packer init command for HCL2 template builds.GH-12535
• core/hcp: Add support for project-level service principals. A user connecting with a project level service principals must provide a valid HCP_PROJECT_ID in order to connect. GH-12520 GH-12576
• core: A new Docker image packer:release-full has been added for all supported architectures. The release-full image includes Packer and all the official plugins pre-installed in its environment. GH-12532
• core: Add enhanced support to Packer telemetry for bundle plugins usage. GH-12536

BUG FIXES:

• core: Bump golang.org/x/net to v0.13.0 to address CVE GO-2023-1988. Packer itself is not vulnerable to the CVE as we don't render web pages, but security checks do point it as an issue that needs to be addressed. GH-12561
• core: Fix custom plugin loading in current working directory regression. GH-12544

NOTES:

• Vendored plugins within Packer have not been updated. Plugin releases occur on a regular basis to address issues and feature requests. Please note that in an upcoming version of Packer, we will remove the last bundled plugins from Packer. Users are encouraged to use packer init for HCL2 templates or packer plugins install with legacy JSON templates for installing external plugins.

• Packer will now warn when using bundled plugins. This feature will be removed in a future version of the tool, so this warning is meant to bring awareness of the upcoming change, and help users update their templates. GH-12495

BUG FIXES:

• Fixed a bug with how Packer was discovering plugins: in order to load plugins, Packer would recursively scan all the known directories in which we could have installed plugins. This caused unnecessary directory walks and slowdowns upon invocation. Packer will now only check for nested plugins within the directories used by commands such as packer init, or packer plugins install, or as defined in PACKER_PLUGIN_PATH. Refer to Packer's plugin directory documentation for details on how loading works. GH-12414

• The packer init subcommand now bundles all the missing installed plugins into one condensed warning, as opposed to one warning per missing plugin. GH-12506

PLUGINS:

• packer-plugin-parallels: The Parallels plugin has been handed over to the Parallels team. New releases for this plugin are available at https://github.com/parallels/packer-plugin-parallels. This plugin is no longer being bundled in the Packer binary release. Existing references to the plugin will continue to work but users are advised to update the required_plugins block to use the new plugin source address. GH-12476

   required_plugins {
     parallels = {
       source  =  "github.com/parallels/parallels"
       version =  "~> 1"
      }
  }
  

IMPROVEMENTS:

• The hcl2_upgrade sub-command will now add required_plugins to the template generated from JSON for official plugins. GH-12504

BUG FIXES:

• On May 16th 2023, HCP introduced multi-project support to the platform. In order to use multiple projects in your organization, you will need to update Packer to version 1.9.1 or above. Starting with 1.9.1, you may specify a project ID to push builds to with the HCP_PROJECT_ID environment variable. If no project ID is specified, Packer will pick the project with the oldest creation date. Older versions of Packer are incompatible with multi-project support on HCP, and builds will fail for HCP organizations with multiple projects on versions before 1.9.1. GH-12453

NOTES:

• Breaking Change: Iteration fingerprints used to be computed from the Git SHA of the repository where the template is located when running packer build. This changes with this release, and now fingerprints are automatically generated as a ULID. This implies that continuing an existing iteration will require users to define the fingerprint in the environment manually in order to adopt this behaviour, otherwise, by default, a new iteration will be created. This does not impact workflows where the fingerprint was defined through the HCP_PACKER_ITERATION_FINGERPRINT environment variable, and these builds will work exactly as they did before. GH-12172

• Breaking Change: Community-maintained plugins bundled with the Packer binary have been removed. These external plugin components are released independently of Packer core and can be installed directly by the user. Users relying on the external plugin components listed below should refer to the packer plugins sub-command and, if using HCL2, a required_plugins block to define a list of plugins for building a template.

PLUGINS

• Remove provisioner plugins for Chef, Converge, Puppet, Salt, and Inspec as vendored plugins. These plugins have been previously archived and not updated in release since being archived. These plugins can be installed using packer init or with the Packer plugins sub-command packer plugins install github.com/hashicorp/chef. GH-12374

• The following community plugins won't be bundled with Packer anymore:

  • Alicloud
  • CloudStack
  • HCloud
  • HyperOne
  • Hyper-V
  • JDCloud
  • LXC
  • LXD
  • NCloud
  • OpenStack
  • Proxmox
  • TencentCloud
  • Triton
  • Yandex

  GH-12436

Users relying on these external plugin components should refer to the packer plugins sub-command and, if using HCL2, a required_plugins block to define a list of plugins to use for building a template.

IMPROVEMENTS:

• core/hcp: Now, fingerprints used by HCP Packer are randomly generated ULIDs instead of a Git SHA, and a new one is always generated, unless one is specified in the environment. GH-12172

BUG FIXES:

• Fix LDFLAGS for release pipelines: Between Packer 1.8.5 and Packer 1.8.7, changes to the LDFLAGS in use for building the binaries for Packer had mistakenly removed some compilation flags, leading to the final binaries not being stripped. This change raised the size of the built binaries by as much as 45%. In this release, we fixed the LDFLAGS during compilation, yielding leaner binaries.

• Bumped gopsutil to v3. This fixes a macOS intermittent crash reported by the community GH-12430

HCP Packer -- Multi project support advisory

If using HCP Packer to store metadata on your builds, please be aware that Packer does not support this feature yet, and as such, having multiple projects in your organization will make it impossible to use HCP Packer in this release.

We are actively working on supporting this feature, which will be available in a subsequent release.

NOTES:

• Vendored plugins within Packer have not been updated. Plugin releases occur on a regular basis to address issues and feature requests. Users are encouraged to use packer init for HCL2 templates or packer plugins install with legacy JSON templates for installing external plugins.

• packer-plugin-digitalocean: The Digital Ocean Packer plugin has been handed over to the Digital Ocean team. New releases for this plugin are available at https://github.com/digitalocean/packer-plugin-digitalocean.

  required_plugins {
  	digitalocean = {
  	 source =  "github.com/digitalocean/digitalocean"
  	 version = ">=1.1.1"
  	}
  }
  

• packer-plugin-linode: The Linode plugin has been handed over to the Linode team. New releases for this plugin are available at https://github.com/linode/packer-plugin-linode. This plugin is is no longer being bundled in the Packer binary release. Existing references to the plugin will continue to work but users are advised to update the required_plugins block to use the new plugin source address. GH-12329

   required_plugins {
     linode = {
       source  =  "github.com/linode/linode"
       version = ">=1.0.5"
      }
  }
  

• packer-plugin-ucloud: The UCloud plugin has been handed over to the UCloud team. New releases for this plugin are available at https://github.com/ucloud/packer-plugin-ucloud. This plugin is is no longer being bundled in the Packer binary release. Existing references to the plugin will continue to work but users are advised to update the required_plugins block to use the new plugin source address. GH-12335

   required_plugins {
      ucloud = {
       source  =  "github.com/ucloud/ucloud"
       version = ">=1.0.8"
      }
  }
  

• packer-plugin-profitbricks: The Profitbricks plugin has been removed as a bundled plugin in Packer. New releases for this plugin are available at https://github.com/hashicorp/packer-plugin-profitbricks. This plugin is is no longer being bundled in the Packer binary release. Existing references to the plugin will continue to work but users are advised to update the required_plugins block to use the new plugin source address. GH-12385

   required_plugins {
      ucloud = {
       source  =  "github.com/hashicorp/profitbricks"
       version = ">=1.0.2"
      }
  }
  

PLUGINS

• core: Migrate external Linode plugin to linode/packer-plugin-linode. GH-12329
• core: Migrate external UCloud plugin to ucloud/packer-plugin-ucloud. GH-12335
• core: Remove external plugin for Digital Ocean as a vendored plugin. GH-12376
• core: Remove external plugins for Profitbricks and 1&1 as vendored plugins. GH-12385
• docs: Add HCP Ready label to Oracle builder components. GH-12217

IMPROVEMENTS

• cmd/console: Add config-type flag to command help. GH-12360
• core: Add enhanced support to Packer telemetry for HCL2. GH-12319
• Enhance zsh completion for the Packer command. GH-12356, GH-12366

BUG FIXES

• cmd/hcl2_upgrade: Fix a crash when running the hcl2_upgrade command against a legacy JSON template containing user variables with an undefined variables block. GH-12257
• core: Bump github.com/hashicorp/hcp-sdk-go to 0.36.0. GH-12292
• core: Bump github.com/hashicorp/packer-plugin-sdk to 0.4.0 to address CVE-2023-0475, CVE-2022-41723. GH-12306
• core: Bump Go module version to 1.20 GH-12380
• core: Fix regression introduced in 1.8.6, where legacy JSON templates with custom builder names are outputted to STDOUT as uninterpolated user variables. GH-12290

NOTES:

• core: Users will see some changes in how names are displayed during a Packer build for JSON templates. Previously only the builder type or the builder name, if it was set, would be displayed. Now for named builders ("name":"mybuilder") the builder's type and name will be displayed (i.e "<type>.mybuilder". This does not impact the behavior of options such as only or except, they will continue to work as they did before.)

PLUGINS:

The following external plugins have been updated and pinned to address open issues. Please see their respective changelogs for details on plugin specific bug fixes and improvements.

• alicloud@v1.0.7 - CHANGELOG
• amazon@v1.2.1 - CHANGELOG
• azure@v1.4.0 - CHANGELOG
• googlecompute@v1.1.0 - CHANGELOG
• proxmox@v1.1.1 - CHANGELOG
• tencentcloud@v1.0.6 - CHANGELOG
• qemu@v1.0.9 - CHANGELOG

IMPROVEMENTS:

• Bump bundled plugins to latest available version. GH-12274
• bump github.com/hashicorp/hcp-sdk-go from 0.28.0 to 0.29.0 GH-12163
• Bump github.com/hashicorp/hcp-sdk-go from 0.33.0 to 0.34.0 GH-12275
• core/hcl2: Packer will no longer warn on excluded post-processors when using -only/exlude filters for running select builds. GH-12187

BUG FIXES:

• cmd/hcl2_upgrade: Fix crash when variables block is undefined. GH-12250
• core/hcl2: Templates with build blocks referencing an unknown source block would display an empty string for the template filename at line 0, which made it difficult to identify the broken build block. Packer has been updated to display the proper filename and line number where the unknown reference resides. GH-12167
• core: Linux packages now have vendor label and set the default label to HashiCorp. This fix is implemented for any future releases, but will not be updated for historical releases. GH-12252
• core/hcp: The bucket's description was not properly set in the bucket object sent to HCP Packer leaving all newly created buckets with an empty description. [GH-12235] GH-12235