siderolabs/image-factory v1.8.0 on GitHub

image-factory 1.8.0 (2026-11-03)

Welcome to the v1.8.0 release of image-factory!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.

HTTP Status Fixes

Several error paths now return the correct HTTP status instead of 500 or 401:

A stored API token that cannot be checked because the token storage is unavailable is answered with 503, so clients can retry, instead of 401.
A 403 from the token storage registry is treated as a failed read, not as a missing token or an empty token list.
An installer tag that is not a valid version, or an unknown file under /talosctl/<version>/, is answered with 404.
/secureboot/signing-cert.pem is answered with 404 on a factory without Secure Boot.
An invalid Talos version in the extensions and overlays endpoints is answered with 400.

A failed fetch of the Secure Boot signing certificate from a remote signer is no longer cached until restart; the next request retries it.

Other Changes

Legacy signature bundles are validated by checking that the image digest matches the signature's claims.
An SBOM is generated for the Image Factory image.

New UI

The browser UI has been rewritten as a Vue single-page app and replaces the server-rendered UI.
It follows the Sidero design system, and is served with a Content-Security-Policy header.

The Enterprise Auth0 landing, login error and logout pages are part of the new UI as well.

VEX Annotations

Enterprise only: scan results are annotated with VEX comments.
Raw JSON statements carry the annotation, and the UI shows it next to the upstream CVE description.

The talos-vex-data image is proxied through the registry frontend on Enterprise builds.
Other builds answer 402 Payment Required for it, and a factory without a talosVexData repository configured answers 404.

Contributors

Andrey Smirnov
Edward Sammut Alessi
Mateusz Urbanek
immanuwell
Alexander Soelberg Heidarsson
Brian Cappello
Daniel Chaplin
Erwan Leboucher
Jarrad S
Karthik Chowdary
Kyle Tse
Loki San
Michał Małyska
Nicolas Brainez
Noel Georgi
Oguz Kilcan
Orzelius
Spencer Smith
Utku Ozdemir
frauniki
sasha-sup

Changes

39 commits

c9c1f39 release(v1.8.0): prepare release
57ba7d3 feat: generate sbom for factory
b611fd1 fix(frontend): fix some minor design issues
b881b7e chore: bump talos and pks to latest
5e3e789 chore(frontend): bump frontend dependencies
3660cbc chore: rekres
f51705f feat(frontend): add a content-security-policy
c800285 fix(frontend): fix content vertical padding being lost
90d098f feat(frontend): move page intro into step target
c864a64 feat(frontend): add missing translations for a few items
a46875f feat(frontend): add visual feedback to copy buttons
a92bd19 feat(frontend): align inputs and code blocks to the design system
ab6f315 feat(frontend): align checkbox and radio with design system
7365309 feat(frontend): add dim theme to factory
bac4e58 feat(frontend): change language select to match theme style
5614c6c feat(frontend): scale layout to fit the page
48eae73 feat(frontend): add stories for all components
16d65e5 test(frontend): migrate tests to MSW
c6c073e feat(frontend): add storybook to factory
89e1a03 feat(frontend): migrate auth0 pages to vue
d0e80c5 test(frontend): add tests for enterprise auth0 flow
f522066 chore(frontend): add license headers for frontend to conform
2878068 feat(frontend): make spa the default and delete old ui
c6868bd test(frontend): add e2e suite for factory frontend
81515cf feat(frontend): re-implement the wizard frontend in Vue
45d147a feat: add /api routes for vue frontend requirements
10cf83e chore(frontend): add codeowners and vscode settings
4058260 feat: proxy talos-vex-data image for Enterprise
b2bde76 feat(frontend): scaffold a vue spa frontend into factory
b9edbb1 feat: annotate scan results with VEX comments
2216580 feat: support WITH_DEBUG flag
bb9aaf5 feat: add docker-compose override support
d8cc9ec feat: add crane to docker-compose
7cdbae2 refactor: skip image pushing for local docker compose builds
6857d8f fix: return correct HTTP statuses on several error paths
bc9b7ca chore: rework IF UI
7f64858 chore: update dependencies
7402544 feat: provide landing page for link parsing, robots.txt
2dd2e55 fix: perform correct validation of legacy signature bundles

Changes from siderolabs/go-vex

1 commit

5ecd81c feat: add support for annotating scan results with VEX notes

Changes from siderolabs/talos

62 commits

dad8d3edf release(v1.14.5): prepare release
2f97b6a4b test: verify on-demand kernel module loading end-to-end
c35fd8cef feat: load kernel modules on demand via the modprobe usermode helper
bf34a0ebb feat: add EDAC_10NM kernel module
25c16761c fix: race with platform accessing metadata volumes
b88cda936 feat: update etcd to 3.7.3
34d408094 fix: pull images over HTTP/1.1
2dc3686b1 fix: preserve project quotas on temporary growfs mounts
bffcf9b48 fix: correctly pass hostname to the proxy in gRPC dial
6b3ea905b fix: preserve rejected edits in talosctl edit
b6e5fa2e2 feat: implement RAID1 (md-raid) support in BIOS mode
fb2b077b5 fix: ignore netlink recoverable errors in watchers
2f7efe81b fix: skip kexec when the kernel finds no free memory region
d6488456b fix: provide proper concurrency for health checks
03075319b fix: preserve omitted CEL expressions when patching configs
aca5abc16 fix: skip EFI boot entries that cannot be decoded
9c69456c9 fix: read VMware guestinfo with SecureBoot enabled
6c6fec7d5 fix: parse EFI load options with an empty description
e0002327b fix: route pod CIDRs matching the KubeSpan ULA purpose byte
449f82d46 fix: wait for inactive MD arrays before volume discovery
824b0f976 test: reproduce degraded md boot array reboot
ce2fa4132 fix: high cpu usage by the bridge keepalive dummy qemu vm
51eda9a51 chore: add qemu-ip-family integration suite
e700de0c0 feat: update Linux 6.18.58, Go 1.26.10
3fb46c378 release(v1.14.4): prepare release
68da63f11 release(v1.14.3): prepare release
cbe344931 fix: disable GSO offload on QEMU 10.2+
1e3f3ad5f test: adapt minimal settings to new QEMU version
59e1fcd63 fix: restrict raw disk helper to linux
08b213686 fix: make the imager installer reproducible with system extensions
a9b984aab fix: improve KubePrism load balancer recovery
d01538115 fix: clean up mountpoints on unmount
146c2bd92 fix: roll back stacked try configs to the config before the first try
f5182237e fix: correct handling of DHCP changing address
f97d79fc3 fix: image verification test
5fadce79d fix: verify the claim for the legacy bundle image verification
6cade9fed fix: restore source names for pseudo filesystem mounts
692e6796b fix: add validation for the PTP device name
b166b72ca fix: network on azure (and might fix some other platforms)
4c4e57a4b feat: update etcd to 3.7.2
0d3b40c44 feat: update tools and pkgs
51d094f47 fix: tear down stale routes before adding their replacements
f513c7358 release(v1.14.2): prepare release
114c70ae3 feat: update Kubernetes default to 1.37.1
00a53e13d feat: update containerd to 2.3.6
305ced360 test: fix the md-boot pipeline
540a427c3 docs: clarify the KMS endpoint scheme
f53a00050 fix: drop devices from the last observed generation if they are gone
a015f8176 feat: handle the change in kubelet's CPU and memory policies
c792fa485 fix: perform stricter validation of hostnames/search domains
3137edfb0 fix: handle correctly routes without outlinkname set
e966b131d chore: clean up unused settings in LVM reconcile controllers
da3b328db fix: do not disclose pre-shared Wireguard key in LinkStatus
80fd649d1 fix: retry transient LVM reconciliation failures
98b3cb51e feat: add macsec module
949b85fa7 fix: preserve hostname under Docker (in container mode)
ad65799ab fix: handle Akamai/Linode metadata without IPv6
2e87819aa docs: clarify admission control and flannel config docs
a9422412d test: fix the aws-arm64 test
c7e25249d fix: use correct conditions on CRI <> sandboxd dependency
5a78c3fc3 fix: extend the USB settle code for more code paths
a8ac3ca50 feat: sync pkgs/tools

Dependency Changes

cloud.google.com/go/auth v0.23.3 -> v0.24.1
github.com/anchore/go-logger v0.1.1 -> v0.2.0
github.com/anchore/grype v0.119.0 -> v0.121.0
github.com/anchore/syft v1.52.0 -> v1.55.0
github.com/klauspost/compress v1.20.0 -> v1.20.3
github.com/knadh/koanf/parsers/dotenv v1.1.2 -> v1.1.3
github.com/knadh/koanf/providers/env/v2 v2.0.1 -> v2.0.2
github.com/knadh/koanf/v2 v2.3.6 -> v2.3.8
github.com/minio/minio-go/v7 v7.3.0 -> v7.4.1
github.com/moby/moby/api v1.56.0 -> v1.56.1
github.com/prometheus/client_golang v1.24.1 -> v1.25.0
github.com/siderolabs/go-blockdevice/v2 v2.0.32 -> v2.0.36
github.com/siderolabs/go-vex v0.1.4 -> v0.1.5
github.com/siderolabs/talos v1.14.1 -> v1.14.5
github.com/siderolabs/talos/pkg/machinery v1.14.1 -> v1.14.5
github.com/sigstore/sigstore v1.10.10 -> v1.11.0
golang.org/x/crypto v0.57.0 -> v0.58.0
golang.org/x/sync v0.23.0 -> v0.24.0
golang.org/x/sys v0.48.0 -> v0.49.0

Previous release can be found at v1.7.2