{"record":{"id":"3b2c46e932aa8d15","repo":"hashicorp/packer","slug":"the-iteration-s-is-revoked-and-can-not-be-used-on","errorCode":null,"errorMessage":"the iteration %s is revoked and can not be used on Packer builds","messagePattern":"the iteration (.+?) is revoked and can not be used on Packer builds","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"datasource/hcp-packer-image/data.go","lineNumber":187,"sourceCode":"\t\tchannel, err := cli.GetChannel(ctx, d.config.Bucket, d.config.Channel)\n\t\tif err != nil {\n\t\t\treturn cty.NullVal(cty.EmptyObject), fmt.Errorf(\"error retrieving \"+\n\t\t\t\t\"channel from HCP Packer registry: %s\", err.Error())\n\t\t}\n\n\t\tif channel.Iteration == nil {\n\t\t\treturn cty.NullVal(cty.EmptyObject), fmt.Errorf(\"there is no iteration associated with the channel %s\",\n\t\t\t\td.config.Channel)\n\t\t}\n\t\tchannelID = channel.ID\n\t\titeration = channel.Iteration\n\t}\n\n\trevokeAt := time.Time(iteration.RevokeAt)\n\tif !revokeAt.IsZero() && revokeAt.Before(time.Now().UTC()) {\n\t\t// If RevokeAt is not a zero date and is before NOW, it means this iteration is revoked and should not be used\n\t\t// to build new images.\n\t\treturn cty.NullVal(cty.EmptyObject), fmt.Errorf(\"the iteration %s is revoked and can not be used on Packer builds\",\n\t\t\titeration.ID)\n\t}\n\n\tvar output DatasourceOutput\n\n\tcloudAndRegions := map[string][]string{}\n\tfor _, build := range iteration.Builds {\n\t\tif build.CloudProvider != d.config.CloudProvider {\n\t\t\tcontinue\n\t\t}\n\t\tfor _, image := range build.Images {\n\t\t\tcloudAndRegions[build.CloudProvider] = append(cloudAndRegions[build.CloudProvider], image.Region)\n\t\t\tif image.Region == d.config.Region && filterBuildByComponentType(build, d.config.ComponentType) {\n\t\t\t\t// This is the desired image.\n\t\t\t\toutput = DatasourceOutput{\n\t\t\t\t\tCloudProvider: build.CloudProvider,\n\t\t\t\t\tComponentType: build.ComponentType,\n\t\t\t\t\tCreatedAt:     image.CreatedAt.String(),","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/datasource/hcp-packer-image/data.go#L169-L205","documentation":"The iteration resolved for the hcp-packer-image datasource has a RevokeAt timestamp that is non-zero and in the past, meaning it was revoked. HCP Packer revocations are hard stops: the datasource refuses to return image metadata from revoked iterations so builds cannot consume deleted/insecure image versions. This is intentional safety behavior, not a bug.","triggerScenarios":"cli.GetChannel or GetIteration returns an iteration whose RevokeAt (converted via time.Time(iteration.RevokeAt)) is before time.Now().UTC(); Execute then returns this error before iterating builds.","commonSituations":"A channel still points at an iteration someone revoked via HCP Packer's revocation feature or a scheduled rollback; soft-deleted iterations past their revocation date are still referenced by templates; CI pipelines pinned to old channels after a security revocation.","solutions":["Repoint the channel to a non-revoked iteration in the HCP Packer registry.","Update the template to use a newer channel or a valid iteration_id.","If the revocation was premature, revert the revocation in HCP Packer (restore the iteration) and re-run the build.","Check scheduled revocation policies in HCP Packer that may have auto-revoked the iteration."],"exampleFix":"// before\nsource \"hcp\" {\n  datasource \"hcp-packer-image\" {\n    channel        = \"stable\" // points at revoked iteration 01HOLD...\n    cloud_provider = \"aws\"\n    region         = \"us-east-1\"\n  }\n}\n// after\n// Repoint channel 'stable' to a valid iteration in HCP, then rebuild.\nsource \"hcp\" {\n  datasource \"hcp-packer-image\" {\n    channel        = \"stable\"\n    cloud_provider = \"aws\"\n    region         = \"us-east-1\"\n  }\n}","handlingStrategy":"validation","validationCode":"// Pre-flight: check the channel's iteration revocation status via HCP CLI/API\n// hcp packer channels show <channel> --bucket=my-app\n// Reject if iteration.revoke_at is set and in the past.","typeGuard":null,"tryCatchPattern":"// Wrap the build and handle the explicit revocation error:\nout=$(packer build template.pkr.hcl 2>&1) || {\n  echo \"$out\" | grep -q 'is revoked and can not be used' && echo \"Repoint channel to a valid iteration\" \n  exit 1\n}","preventionTips":["Track revocation schedules; update channels before revoke_at elapses.","Use a rolling 'latest-good' channel maintained by automation that skips revoked iterations.","Avoid hardcoding iteration IDs that may be revoked; prefer channels with lifecycle automation.","Alert on HCP Packer revocation events in your monitoring."],"tags":["hcp-packer","revocation","datasource","lifecycle"],"backgroundTag":"hcp-iteration-revoked","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}