Packer is a tool for creating identical machine images for multiple platforms from a single source configuration.
This report summarizes scanner evidence for hashicorp/packer, a Go project with 15,820 GitHub stars. SynthScan examined 93,565 lines of code across 898 source files, recording 107 pattern matches distributed across 8 syntactic categories. The legacy adjusted pattern signal is 1.4 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 103 finding(s).
Are imports declared and package/API names verified? 4 finding(s).
Are wrappers, guards, and repeated structures necessary? 0 finding(s).
Which changes need focused human review? 107 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 107 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .golangci.yml | 61 | # include test files or not, default is true | COMMENT |
| LOW | .golangci.yml | 81 | # won't be reported. Default value is empty list, but there is | COMMENT |
| LOW | .golangci.yml | 121 | COMMENT | |
| LOW | main.go | 121 | // We're the child, so just close the tempfile we made in order to | COMMENT |
| LOW | datasource/hcp-packer-iteration/data.go | 61 | return nil | COMMENT |
| LOW | datasource/hcp-packer-image/data.go | 41 | // `hcp-packer-image`s use a shared `hcp-packer-iteration` that will | COMMENT |
| LOW | datasource/hcp-packer-image/data.go | 101 | return nil | COMMENT |
| LOW | acctest/testing.go | 41 | // Check is called after this step is executed in order to test that | COMMENT |
| LOW | acctest/testing.go | 81 | type TestBuilderSet struct { | COMMENT |
| LOW | post-processor/provenance/post-processor.go | 41 | // The SLSA `buildType` URI recorded in the provenance predicate. Defaults to | COMMENT |
| LOW | post-processor/provenance/post-processor.go | 61 | SourceURI string `mapstructure:"source_uri"` | COMMENT |
| LOW | post-processor/provenance/post-processor.go | 81 | // `hashivault://...` for `kms` mode. | COMMENT |
| LOW | internal/hcp/registry/types.metadata_store.go | 1 | // Copyright IBM Corp. 2024, 2026 | COMMENT |
| LOW | provisioner/file/provisioner.go | 21 | "github.com/hashicorp/packer-plugin-sdk/template/config" | COMMENT |
| LOW | provisioner/file/provisioner.go | 41 | // A list of sources to upload. This can be used in place of the `source` | COMMENT |
| LOW | provisioner/powershell/provisioner.go | 81 | // Defaults to false. When true any script created by a non-elevated Powershell | COMMENT |
| LOW | provisioner/hcp-sbom/provisioner.go | 41 | // You can specify an absolute or a path relative to the working directory | COMMENT |
| LOW | provisioner/hcp-sbom/provisioner.go | 61 | // `["-o", "cyclonedx-json"]`. | COMMENT |
| LOW | provisioner/hcp-sbom/provisioner.go | 81 | // - `{{.Path}}` - Path to the scanner binary on the remote host | COMMENT |
| LOW | provisioner/hcp-sbom/provisioner.go | 141 | } | COMMENT |
| LOW | provisioner/hcp-sbom/provisioner.go | 161 | // /tmp/packer-sbom-runner | COMMENT |
| LOW | provisioner/hcp-sbom/provisioner.go | 241 | COMMENT | |
| LOW | provisioner/hcp-sbom/provisioner.go | 461 | } | COMMENT |
| LOW | hcl2template/docs.go | 1 | // Copyright IBM Corp. 2024, 2026 | COMMENT |
| LOW | hcl2template/types.packer_config.go | 221 | // unused maybe remove? | COMMENT |
| LOW | hcl2template/types.variables.go | 21 | // A consistent detail message for all "not a valid identifier" diagnostics. | COMMENT |
| LOW | hcl2template/types.variables.go | 61 | // Values contains possible values for the variable; The last value set | COMMENT |
| LOW | hcl2template/types.variables.go | 461 | COMMENT | |
| LOW | hcl2template/parser.go | 81 | hcl2VarJsonFileExt = ".pkrvars.json" | COMMENT |
| LOW | hcl2template/parser.go | 401 | func (cfg *PackerConfig) buildPrereqsDAG() (*dag.AcyclicGraph, error) { | COMMENT |
| LOW | hcl2template/types.refstring.go | 21 | // RefMType is the top-level label, that is used to know which type of | COMMENT |
| LOW | hcl2template/addrs/referenceable.go | 1 | // Copyright IBM Corp. 2024, 2026 | COMMENT |
| LOW | hcl2template/addrs/parse_ref.go | 21 | // given traversal, which must be an absolute traversal or this function | COMMENT |
| LOW | hcl2template/addrs/plugin.go | 41 | return p.Source | COMMENT |
| LOW | hcl2template/addrs/plugin.go | 61 | // subsequent call, in which case the result will be identical. | COMMENT |
| LOW | hcl2template/addrs/plugin.go | 161 | COMMENT | |
| LOW | hcl2template/addrs/doc.go | 1 | // Copyright IBM Corp. 2024, 2026 | COMMENT |
| LOW | hcl2template/repl/repl.go | 1 | // Copyright IBM Corp. 2024, 2026 | COMMENT |
| LOW | hcl2template/function/encoding.go | 41 | }, | COMMENT |
| LOW | hcl2template/function/datetime.go | 81 | } | COMMENT |
| LOW | version/version.go | 21 | COMMENT | |
| LOW | examples/ci/github-actions-l2-keyless.yml | 1 | # Reference workflow — NOT wired into this repository's CI. | COMMENT |
| LOW | examples/ci/github-actions-l2-keyless.yml | 41 | version: latest | COMMENT |
| LOW | examples/ci/github-actions-l3-delegated.yml | 1 | # Reference workflow — NOT wired into this repository's CI. | COMMENT |
| LOW | examples/hcl/linux/source.vsphere-iso.pkr.hcl | 1 | // I use the following config with direnv and set the following values: | COMMENT |
| LOW | fix/fixer.go | 1 | // Copyright IBM Corp. 2024, 2026 | COMMENT |
| LOW | .github/CONTRIBUTING.md | 441 | COMMENT | |
| LOW | .github/CONTRIBUTING.md | 461 | // test running. For example, you can use this to make sure certain | COMMENT |
| LOW | .github/CONTRIBUTING.md | 481 | // | COMMENT |
| LOW | .github/CONTRIBUTING.md | 621 | ```go | COMMENT |
| LOW | .github/CONTRIBUTING.md | 641 | // is a valid entry for "template" here, but the complete Packer template: | COMMENT |
| LOW | packer_test/common/suite.go | 21 | pluginsDirectory string | COMMENT |
| LOW | packer_test/common/plugin.go | 161 | suite *PackerTestSuite | COMMENT |
| LOW | packer_test/common/plugin.go | 181 | // | COMMENT |
| LOW | packer_test/common/commands.go | 121 | // SetAssertFatal allows changing how Assert behaves when reporting an error. | COMMENT |
| LOW | packer_test/common/check/pipe_checker.go | 181 | } | COMMENT |
| LOW | …er_test/provisioner_tests/hcp-sbom/provisioner_test.go | 21 | COMMENT | |
| LOW | command/init_test.go | 61 | tests := []testCaseInit{ | COMMENT |
| LOW | command/init_test.go | 81 | // "github.com/hashicorp/hashicups/packer-plugin-hashicups_v1.0.1_x5.0_linux_amd64_SHA256SUM": "0a4e4e1d6de280 | COMMENT |
| LOW | command/hcl2_upgrade.go | 41 | # Avoid mixing go templating calls ( for example ` + "```{{ upper(`string`) }}```" + ` ) | COMMENT |
| 18 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | provisioner/hcp-sbom/provisioner.go | 529 | // Step 1: extract the binary locally from the release zip. | COMMENT |
| LOW⚡ | provisioner/hcp-sbom/provisioner.go | 535 | // Step 2: upload binary directly to remote. | COMMENT |
| LOW⚡ | provisioner/hcp-sbom/provisioner.go | 542 | // Step 3: make it executable. | COMMENT |
| LOW⚡ | provisioner/hcp-sbom/provisioner.go | 639 | // Step 2: Upload scanner to remote. | COMMENT |
| LOW⚡ | provisioner/hcp-sbom/provisioner.go | 647 | // Step 3: Run scanner on remote | COMMENT |
| LOW⚡ | provisioner/hcp-sbom/provisioner.go | 655 | // Step 4: Download SBOM from remote | COMMENT |
| LOW⚡ | provisioner/hcp-sbom/provisioner.go | 662 | // Step 5: Process SBOM for HCP (validate, compress, store) | COMMENT |
| LOW | provisioner/hcp-sbom/provisioner.go | 500 | // Step 1: upload zip to remote. | COMMENT |
| LOW | provisioner/hcp-sbom/provisioner.go | 619 | // Step 1: Download Packer release binary on the host. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | provisioner/hcp-sbom/provisioner.go | 529 | // Step 1: extract the binary locally from the release zip. | COMMENT |
| LOW⚡ | provisioner/hcp-sbom/provisioner.go | 535 | // Step 2: upload binary directly to remote. | COMMENT |
| LOW⚡ | provisioner/hcp-sbom/provisioner.go | 542 | // Step 3: make it executable. | COMMENT |
| LOW⚡ | provisioner/hcp-sbom/provisioner.go | 639 | // Step 2: Upload scanner to remote. | COMMENT |
| LOW⚡ | provisioner/hcp-sbom/provisioner.go | 647 | // Step 3: Run scanner on remote | COMMENT |
| LOW⚡ | provisioner/hcp-sbom/provisioner.go | 655 | // Step 4: Download SBOM from remote | COMMENT |
| LOW⚡ | provisioner/hcp-sbom/provisioner.go | 662 | // Step 5: Process SBOM for HCP (validate, compress, store) | COMMENT |
| LOW | provisioner/hcp-sbom/provisioner.go | 500 | // Step 1: upload zip to remote. | COMMENT |
| LOW | provisioner/hcp-sbom/provisioner.go | 619 | // Step 1: Download Packer release binary on the host. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | command/hcl2_upgrade.go | 47 | # views them; you can change their type later on. Read the variables type | COMMENT |
| MEDIUM | …d/test-fixtures/hcl2_upgrade/complete/expected.pkr.hcl | 26 | # views them; you can change their type later on. Read the variables type | COMMENT |
| MEDIUM | …est-fixtures/hcl2_upgrade/source-name/expected.pkr.hcl | 26 | # views them; you can change their type later on. Read the variables type | COMMENT |
| MEDIUM | …nd/test-fixtures/hcl2_upgrade/minimal/expected.pkr.hcl | 26 | # views them; you can change their type later on. Read the variables type | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …p-packer-version/test-fixtures/hcp-setup-build.pkr.hcl | 7 | content = "Lorem ipsum dolor sit amet" | CODE |
| LOW | …p-packer-version/test-fixtures/hcp-setup-build.pkr.hcl | 7 | content = "Lorem ipsum dolor sit amet" | CODE |
| LOW | …packer-iteration/test-fixtures/hcp-setup-build.pkr.hcl | 7 | content = "Lorem ipsum dolor sit amet" | CODE |
| LOW | …packer-iteration/test-fixtures/hcp-setup-build.pkr.hcl | 7 | content = "Lorem ipsum dolor sit amet" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | scripts/codesign_example.sh | 50 | # Create the sign/notarize ID "SN_ID" | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/build.sh | 36 | # NOTE: I'm unsure why you don't just use realpath like below | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/workflows/nightly-release.yml | 32 | # Set BUILD_OUTPUT_LIST to out\<project>-<version>.<fileext>\*,out\... | COMMENT |