Packer 1.16 signs SLSA provenance into every machine image it builds
Packer v1.16.0 natively generates, signs, and verifies SLSA provenance attestations for every image it builds, recording the Git commit, repo, CI pipeline, and timestamps with no extra tooling. A new packer verify-attestation command checks attestations against image digests, closing a supply-chain blind spot that has mostly focused on containers and packages.