{"record":{"id":"23ab659dc3769bca","repo":"hashicorp/packer","slug":"the-version-s-is-revoked-and-can-not-be-used-on-p","errorCode":null,"errorMessage":"the version %s is revoked and can not be used on Packer builds","messagePattern":"the version (.+?) is revoked and can not be used on Packer builds","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"datasource/hcp-packer-artifact/data.go","lineNumber":204,"sourceCode":"\t\tvar channel *hcpPackerModels.HashicorpCloudPacker20230101Channel\n\t\tchannel, err = cli.GetChannel(ctx, d.config.BucketName, d.config.ChannelName)\n\t\tif err != nil {\n\t\t\treturn cty.NullVal(cty.EmptyObject), fmt.Errorf(\n\t\t\t\t\"error retrieving channel from HCP Packer Registry: %s\", err.Error(),\n\t\t\t)\n\t\t}\n\n\t\tif channel.Version == nil {\n\t\t\treturn cty.NullVal(cty.EmptyObject), fmt.Errorf(\n\t\t\t\t\"there is no version associated with the channel %s\", d.config.ChannelName,\n\t\t\t)\n\t\t}\n\t\tchannelID = channel.ID\n\t\tversion = channel.Version\n\t}\n\n\tif *version.Status == hcpPackerModels.HashicorpCloudPacker20230101VersionStatusVERSIONREVOKED {\n\t\treturn cty.NullVal(cty.EmptyObject), fmt.Errorf(\n\t\t\t\"the version %s is revoked and can not be used on Packer builds\", version.ID,\n\t\t)\n\t}\n\n\tvar output DatasourceOutput\n\n\tcloudAndRegions := map[string][]string{}\n\tfor _, build := range version.Builds {\n\t\tif build.Platform != d.config.Platform {\n\t\t\tcontinue\n\t\t}\n\t\tfor _, artifact := range build.Artifacts {\n\t\t\tcloudAndRegions[build.Platform] = append(cloudAndRegions[build.Platform], artifact.Region)\n\t\t\tif artifact.Region == d.config.Region && filterBuildByComponentType(build, d.config.ComponentType) {\n\t\t\t\t// This is the desired artifact.\n\t\t\t\toutput = DatasourceOutput{\n\t\t\t\t\tPlatform:           build.Platform,\n\t\t\t\t\tComponentType:      build.ComponentType,","sourceCodeStart":186,"sourceCodeEnd":222,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/datasource/hcp-packer-artifact/data.go#L186-L222","documentation":"Returned when the resolved version's Status is VERSIONREVOKED. HCP Packer versions can be revoked (manually or via revocation policies) to prevent new infrastructure from being built from them. The datasource deliberately hard-fails instead of returning the revoked version's metadata, because building from revoked images is unsafe and typically violates compliance policy.","triggerScenarios":"Either version_fingerprint or a channel resolves to a version whose *version.Status == VERSIONREVOKED — explicit manual revocation, or an automatic revocation policy whose date has passed.","commonSituations":"A pinned version_fingerprint in a long-lived template was revoked after its retention window; a channel left pointing at an old revoked version; incident response revoked a vulnerable image but CI still references it; a time-based revocation schedule matured between runs.","solutions":["Publish a new version and repoint the channel (or update version_fingerprint) to a non-revoked version.","Check the version's revocation schedule in HCP Packer; if revoked early by mistake, un-revoke it in the UI or via the HCP API.","Switch the template to resolve via a channel (e.g. 'production') so revocations roll forward automatically.","If revoked metadata must be read, use the HCP API directly instead of this datasource."],"exampleFix":"// before\ndata \"hcp-packer-artifact\" \"foo\" {\n  bucket_name = \"my-bucket\"\n  version_fingerprint = \"2023-06-01T12:00:00Z\" # revoked by retention policy\n}\n// after\ndata \"hcp-packer-artifact\" \"foo\" {\n  bucket_name = \"my-bucket\"\n  channel_name = \"production\" # tracks the latest valid version\n}","handlingStrategy":"fallback","validationCode":"// Check version status via the HCP API before consuming:\n// GET /packer/2023-01-01/versions/{fingerprint} -> status must not be VERSION_REVOKED\nif version.Status == \"VERSION_REVOKED\" {\n    return fmt.Errorf(\"version %s is revoked; resolve a newer version first\", version.ID)\n}","typeGuard":null,"tryCatchPattern":"if ! packer build template.pkr.hcl; then\n  if packer_logs | grep -q 'is revoked and can not be used'; then\n    echo \"Resolved HCP version is revoked; repoint channel or publish a new version\" >&2\n  fi\nfi","preventionTips":["Never pin long-lived version_fingerprints; use channels with scheduled roll-forward.","Set revocation schedules with lead time and alert before versions become revoked.","Monitor HCP Packer revocation events in CI and re-resolve versions on revocation."],"tags":["hcp-packer","revoked-version","policy","datasource"],"backgroundTag":"image-version-revoked","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}