the version %s is revoked and can not be used on Packer buil

Error message

the version %s is revoked and can not be used on Packer builds

What it means

Returned when the resolved version's Status is VERSIONREVOKED. HCP Packer versions can be revoked (manually or via revocation policies) to prevent new infrastructure from being built from them. The datasource deliberately hard-fails instead of returning the revoked version's metadata, because building from revoked images is unsafe and typically violates compliance policy.

Source

Thrown at datasource/hcp-packer-artifact/data.go:204

		var channel *hcpPackerModels.HashicorpCloudPacker20230101Channel
		channel, err = cli.GetChannel(ctx, d.config.BucketName, d.config.ChannelName)
		if err != nil {
			return cty.NullVal(cty.EmptyObject), fmt.Errorf(
				"error retrieving channel from HCP Packer Registry: %s", err.Error(),
			)
		}

		if channel.Version == nil {
			return cty.NullVal(cty.EmptyObject), fmt.Errorf(
				"there is no version associated with the channel %s", d.config.ChannelName,
			)
		}
		channelID = channel.ID
		version = channel.Version
	}

	if *version.Status == hcpPackerModels.HashicorpCloudPacker20230101VersionStatusVERSIONREVOKED {
		return cty.NullVal(cty.EmptyObject), fmt.Errorf(
			"the version %s is revoked and can not be used on Packer builds", version.ID,
		)
	}

	var output DatasourceOutput

	cloudAndRegions := map[string][]string{}
	for _, build := range version.Builds {
		if build.Platform != d.config.Platform {
			continue
		}
		for _, artifact := range build.Artifacts {
			cloudAndRegions[build.Platform] = append(cloudAndRegions[build.Platform], artifact.Region)
			if artifact.Region == d.config.Region && filterBuildByComponentType(build, d.config.ComponentType) {
				// This is the desired artifact.
				output = DatasourceOutput{
					Platform:           build.Platform,
					ComponentType:      build.ComponentType,

View on GitHub (pinned to eb36e3c3e4)

Solutions

Publish a new version and repoint the channel (or update version_fingerprint) to a non-revoked version.
Check the version's revocation schedule in HCP Packer; if revoked early by mistake, un-revoke it in the UI or via the HCP API.
Switch the template to resolve via a channel (e.g. 'production') so revocations roll forward automatically.
If revoked metadata must be read, use the HCP API directly instead of this datasource.

Example fix

// before
data "hcp-packer-artifact" "foo" {
  bucket_name = "my-bucket"
  version_fingerprint = "2023-06-01T12:00:00Z" # revoked by retention policy
}
// after
data "hcp-packer-artifact" "foo" {
  bucket_name = "my-bucket"
  channel_name = "production" # tracks the latest valid version
}

Defensive patterns

Strategy: fallback

Validate before calling

// Check version status via the HCP API before consuming:
// GET /packer/2023-01-01/versions/{fingerprint} -> status must not be VERSION_REVOKED
if version.Status == "VERSION_REVOKED" {
    return fmt.Errorf("version %s is revoked; resolve a newer version first", version.ID)
}

Try / catch

if ! packer build template.pkr.hcl; then
  if packer_logs | grep -q 'is revoked and can not be used'; then
    echo "Resolved HCP version is revoked; repoint channel or publish a new version" >&2
  fi
fi

Prevention

Never pin long-lived version_fingerprints; use channels with scheduled roll-forward.
Set revocation schedules with lead time and alert before versions become revoked.
Monitor HCP Packer revocation events in CI and re-resolve versions on revocation.

When it happens

Trigger: Either version_fingerprint or a channel resolves to a version whose *version.Status == VERSIONREVOKED — explicit manual revocation, or an automatic revocation policy whose date has passed.

Common situations: A pinned version_fingerprint in a long-lived template was revoked after its retention window; a channel left pointing at an old revoked version; incident response revoked a vulnerable image but CI still references it; a time-based revocation schedule matured between runs.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/23ab659dc3769bca. Report an issue: GitHub.