siderolabs/image-factory v1.4.0 on GitHub

image-factory 1.4.0 (2026-07-20)

Welcome to the v1.4.0 release of image-factory!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.

Audit Logging

Image Factory now supports audit logging via a configurable sink. Two sinks are
available: file and log. By default, no sink is configured. File sink writes
audit log as JSON lines to a file configured via audit.file.path and rotates
the log file based on the size. Log sink writes audit log to the standard log
output.

Core Artifacts Namespace

Image Factory now supports setting namespace for core artifacts - an optional
repository path prefix prepended to every image pulled from the core registry:
the component images as well as the extension and overlay images discovered
via the manifests. Previously only the registry host could be overridden, so
pull-through caches which prefix the upstream repository path (e.g. a Harbor
proxy-cache project) could not be used.

The prefix only affects pull references; extension identities (matched against
schematics, the UI, and the meta API) are unchanged.

Disk Images

Image Factory now supports generating disk images with 4096 byte sector size (custom size), set via schematic customization.

Extra Extensions (enterprise only)

Image factory can now be configured with an extra extensions manifest image allowing to easily add custom extensions in addition to the official Sidero extensions.

Embedded Machine Configuration

Image Factory now supports embedding machine configuration into generated images starting with Talos version 1.2.0 onwards.

Secure Boot Disk Images

Image Factory now generates disk images with Secure Boot supporting automatically enrolling keys (with if-safe setting, enabled for VMs in setup mode).

Contributors

Mateusz Urbanek
Maja Bojarska
Noel Georgi
Andrey Smirnov
Orzelius
Rokoucha
Justin Garrison
Mark Glants
Mickaël Canévet
Rowan Voermans

Changes

21 commits

efab38f release(v1.4.0): prepare release
9c64235 feat: add schematic owner validation
ca87d23 fix: add single-flight around schematic factory
d45b5ac docs: link to Image Factory Enterprise docs page
490a993 chore: bump pkgs revision to match talos v1.14.0-alpha.2
f9ff935 chore: bump go pkgs
12cd647 feat: add llms.txt for better LLM usage
f65960f fix: audit file defaults
f26e5e2 feat: add audit log for authenticated requests
beff6e2 feat: support registry namespace prefix for core artifacts
8c489d0 chore: update dependencies
026f8a8 feat: extra extensions (enterprise only)
915ef76 chore: add insecure flag to dev config
3bccbe1 fix: handle single arch images
6b1c855 refactor: prepare for more than one artifact registry
bee4fe3 feat: narrow sbom cache key to extension list only
e0e4a44 refactor: abstract versioned cache
3359f6c feat: add secureboot enrollKeys schematic option
805c51c feat: add per-request correlation ID to logs
8cee96d feat: assert pxe cache in tests
4ec0789 feat: bump go-conainerregistry

Changes from siderolabs/gen

1 commit

c526410 fix: skip unknown-key check for types with custom YAML unmarshaler

Changes from siderolabs/pkgs

18 commits

ea48e8b fix: patch Linux kernel for tunnel metadata buffer overflow
ff80d88 feat: add support for AMD XGBE driver
9f8ab22 feat: enable NF_TABLES_ARP option
bedfbeb feat: update Linux to 6.18.36
a9f2bb3 chore: bump containerd to 2.3.2
73e76f8 chore: upgrade runc to 1.5.0-rc.3
28db1ca chore: update nvidia driver lts to 580.167.08
5df1a44 chore: update zfs to 2.4.3
cd77c4f chore: update dependencies 2026-06-16
0f27ecc feat: bump runc
d213ff5 feat: bump OpenSSL to 3.6.3
cb713ae feat: bump kernel to 6.18.35
09cb04e fix: avoid page_table_check BUG on time namespace VVAR page
bfb88f6 feat: add nvidia-fs kernel module
f2850d1 feat: enable USB hiddev for apcupsd support
55aa64f feat: bump go to 1.26.4
f27dbe1 feat: bump kernel to 6.18.34
aa9fe00 feat: add DVB USB Modules

Dependency Changes

cloud.google.com/go/auth v0.20.0 -> v0.22.0
github.com/anchore/clio v0.1.0 -> v0.1.1
github.com/anchore/grype v0.112.0 -> v0.115.0
github.com/anchore/syft v1.44.0 -> v1.46.0
github.com/google/go-containerregistry v0.21.6 -> v0.21.7
github.com/google/uuid v1.6.0 new
github.com/jellydator/ttlcache/v3 v3.4.0 -> v3.4.1
github.com/klauspost/compress v1.18.6 -> v1.19.0
github.com/knadh/koanf/v2 v2.3.4 -> v2.3.5
github.com/minio/minio-go/v7 v7.2.0 -> v7.2.1
github.com/siderolabs/gen v0.8.6 -> v0.8.7
github.com/siderolabs/go-blockdevice/v2 v2.0.29 -> v2.0.32
github.com/siderolabs/pkgs v1.14.0-alpha.0-70-g0870a4b -> v1.14.0-alpha.0-88-gea48e8b
github.com/sigstore/cosign/v3 v3.0.6 -> v3.1.1
github.com/sigstore/rekor v1.5.2 -> v1.5.3
github.com/sigstore/sigstore v1.10.7 -> v1.10.8
github.com/sigstore/sigstore-go v1.1.4 -> v1.2.2
github.com/spdx/tools-golang v0.5.7 -> v0.6.0-rc4
golang.org/x/crypto v0.52.0 -> v0.54.0
golang.org/x/sync v0.20.0 -> v0.22.0
golang.org/x/sys v0.45.0 -> v0.47.0
golang.org/x/text v0.37.0 -> v0.40.0
gopkg.in/natefinch/lumberjack.v2 v2.2.1 new

Previous release can be found at v1.3.3