v0.4.1

booter 0.4.1 (2026-10-29)

Welcome to the v0.4.1 release of booter!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/booter/issues.

Contributors

• Utku Ozdemir
• Mateusz Urbanek
• Spencer Smith
• Andrey Smirnov
• Edward Sammut Alessi
• Orzelius
• Noel Georgi
• Oguz Kilcan
• Artem Chernyshev
• Justin Garrison
• Andy Longwill
• Maja Bojarska
• Gerard de Leeuw
• Klesev Dimitrij
• Mateusz Urbanek
• Mickaël Canévet
• Mikolaj Pawlikowski
• Rowan Voermans

Changes

5 commits

• c74c686 release(v0.4.1): prepare release
• bf8b1a2 refactor: use the PXE boot packages of the bare-metal provider
• 22fb9cc chore: bump deps, rekres
• ea6228e fix: add dhcp option 54 to the pxe offer
• b70e6ff test: bind the advertised PXE boot files to the served files

Changes from siderolabs/image-factory

105 commits

• f3d984d release(v1.7.2): prepare release
• 79b67d7 chore: add cdn hmac verification
• a54d48a refactor(http): remove shared dependency bag
• 983ec95 refactor(http): isolate registry services
• 015a950 refactor(http): isolate OCI routing
• 58b4086 refactor(http): isolate browser adapters
• df928e0 refactor(http): isolate image services
• 7c5173e refactor(http): unify route authentication
• 55a9fff refactor(http): isolate endpoint owners
• ae77d98 feat(http): declare route ownership
• be369f1 refactor(http): declare route metadata
• 77ecb9e release(v1.7.1): prepare release
• fec432d feat: update dependencies
• c99ce3a feat: improve the token UI
• 73f93b2 test: switch to SeaweedFS instead of minio for testing
• c35986a feat: add 'On Premises' role to the token UI
• 42d9b84 fix(scanner): wait for database replacement
• feaf2f6 fix: download 1.14.0
• 5da8c30 release(v1.7.0): prepare release
• 513036c fix: cache unauthenticated iPXE scripts, dedupe cache signing
• 5fec48b test: characterize HTTP frontend behavior
• 4520b38 fix(enterprise): evaluate VEX against Talos kernel
• a27dfe6 feat: enforce public API with OpenAPI
• 773ba3c fix(ui): gate token create modal on the in-flight POST
• 2e149c8 fix(auth0): drop Bearer challenge from 401 response
• 9f82dde fix: rename registryClientRefreshInterval to refreshInterval
• f4f79db feat(enterprise): repo-per-org token storage, url-safe stored tokens
• f4e4d01 feat(enterprise): expose actor profiles for token creation UI
• 8a77753 feat(enterprise): replace scope enum with route-defined capability scopes
• 4d9710f feat(enterprise): add CLI-only admin token scope
• 4286666 feat(enterprise): unify download and node tokens as scoped API tokens
• 4becd5d release(v1.6.1): prepare release
• e5ff748 fix: pull in Talos for the SBC/GRUB/EFI fix
• b54b945 release(v1.6.0): prepare release
• 9244e82 feat: sign installer profile when unified secureboot supported
• 3b58dfa feat(enterprise): add a node tokens page
• 82bd329 feat: add node token methods to the factory client
• 9312d82 feat(enterprise): add self-issued node tokens
• 4691e01 feat: add WithTokenSource to include bearer tokens
• b115d17 chore(enterprise): drop the Auth0 Management API node-token design
• 6f08ed9 feat(enterprise): extend the download-token issuer to a second audience
• c51ac14 feat: accept download token on /pxe/ and forward it
• 7252d87 chore: allow proxying IF through IF
• f45ec71 fix(enterprise): read the org_id claim from if_org_id
• 43adb19 release(v1.5.1): prepare release
• 5f1f197 feat: update Talos to 1.14.0-rc.2
• b7908c1 feat(enterprise): add Auth0 Management API client for node tokens
• 36fedd7 feat: add WithBearerToken to include m2m token
• e783a3d feat(frontend): preserve whitespace for vuln descriptions
• 18f56f7 chore: make sure check-dirty also checks docs
• 196a447 fix: enforce canonical image references
• 26b95ca feat(enterprise): require auth0 clientID and clientSecret always
• 25561f7 fix: retry put when joining a failed get flight
• aab14ff feat: add spdx and vex reports to factory client
• dc6a9f9 feat(enterprise): theme and translate Auth0 logout/login-error pages
• bd13149 release(v1.5.0): prepare release
• d3c693a feat: update talos to v1.14.0-rc.1
• 5c9839a feat: use the CI cluster registry cache for integration tests
• 70e0590 feat(enterprise): add auth0 browser login
• f5f3128 fix: record the status the client actually received
• 0d2275c feat: make download token TTL configurable
• a5824c7 docs: complete user-facing API reference
• dd485bd docs: document endpoint access control
• 6016631 test: fix two flaky checks in the enterprise integration job
• f984ad8 chore: let the OIDC test server serve extra routes
• f297b62 chore: update Talos to the latest version
• 86b0a22 fix: re-identify cached SBOM bundles per schematic
• 77990dc fix: schedule grype db refresh to avoid replica desync
• ad14c5f feat(enterprise): publish installer build evidence
• dbcc3c6 feat: add auth0 bearer token authentication
• ae757b5 chore: bump cosign to v3.1.2, sign via Rekor v2 + TSA
• 615b279 feat(enterprise): serve detached Sigstore bundles for assets
• 5296d4a chore: update grpc library
• dee1a57 feat: support JWT download tokens
• c2339ee feat: support public routes in enterprise plugins
• a81f6e9 feat: proxy images through backing registry
• 32a3b08 fix: reuse registry puller for bundle verification
• efab38f release(v1.4.0): prepare release
• 9c64235 feat: add schematic owner validation
• ca87d23 fix: add single-flight around schematic factory
• d45b5ac docs: link to Image Factory Enterprise docs page
• 490a993 chore: bump pkgs revision to match talos v1.14.0-alpha.2
• f9ff935 chore: bump go pkgs
• 12cd647 feat: add llms.txt for better LLM usage
• f65960f fix: audit file defaults
• f26e5e2 feat: add audit log for authenticated requests
• beff6e2 feat: support registry namespace prefix for core artifacts
• 8c489d0 chore: update dependencies
• 026f8a8 feat: extra extensions (enterprise only)
• 915ef76 chore: add insecure flag to dev config
• 3bccbe1 fix: handle single arch images
• 6b1c855 refactor: prepare for more than one artifact registry
• bee4fe3 feat: narrow sbom cache key to extension list only
• e0e4a44 refactor: abstract versioned cache
• 3359f6c feat: add secureboot enrollKeys schematic option
• 805c51c feat: add per-request correlation ID to logs
• 8cee96d feat: assert pxe cache in tests
• 4ec0789 feat: bump go-conainerregistry
• 425e59e release(v1.3.3): prepare release
• b5d3d92 fix: vulnerability scans with extensions
• 916bcf6 feat: update go-vex
• 9920386 feat: update Image Factory with Talos 1.14.0-alpha.1
• d49e952 feat: allow excluding Talos releases
• 147a3e8 feat: add scan report to factory client
• 2887e78 feat: add support for embedding machine configuration

Changes from siderolabs/omni-infra-provider-bare-metal

99 commits

• 47026ce refactor: move the PXE boot stack into public packages
• e24f327 release(v0.14.1): prepare release
• b381ac5 fix: select the Redfish system matching the machine UUID
• 77f3c51 chore: bump deps, rekres
• 51b8c60 fix: send the server identifier in DHCP proxy replies
• d8c2440 release(v0.14.0): prepare release
• 2bc4a88 refactor: rename the imagefactory package to installationmedia
• 9c0b0e3 feat: default the agent-mode Talos version to Omni's default
• d6cddce chore: bump talos-metal-agent to v0.1.7
• ce71ada chore: bump deps, rekres
• e52678c release(v0.13.0): prepare release
• a84fbd5 test: bump the Talos version of the integration test cluster
• 98edcab test: run the integration tests against the enterprise image factory
• dc7a460 feat: exercise the real IPMI path against emulated QEMU machines
• ee94d6e feat: get boot assets from the image factory through Omni
• 0e1e7e6 test: bind the advertised PXE boot files to the served files
• 74a2564 release(v0.12.0): prepare release
• a9b4266 feat: support running the provider and emulated machines natively
• 2d243ab release(v0.11.0): prepare release
• 12025df feat: report version to omni client
• 3faf960 chore: bump deps, rekres, fix boot assets, add agent guide
• ba06836 release(v0.10.2): prepare release
• dc42fb6 fix: don't stall boot.ipxe requests when many nodes PXE boot at once
• 37cae94 chore: rekres
• 16fad8a test: download omnictl from the /api/omnictl/ path
• 150bf44 release(v0.10.1): prepare release
• c93c09b fix: write boot filename to BOOTP header for U-Boot ProxyDHCP
• e6da964 chore: bump Go and deps, rekres, fix linters
• 5b57fe3 release(v0.10.0): prepare release
• a3694fb chore: bump image-factory and talos-metal-agent
• 4d13952 chore: rekres
• e27fd88 chore: bump deps, rekres, Talos v1.13.0
• fed52d9 feat: honor power-off requests from omni
• 2730cf3 chore: accept eula in integration tests
• f43cfa1 release(v0.9.0): prepare release
• 84b50bf fix: listen on both DHCP port 67 and 4011 per PXE spec
• c9b458e test: add BMC integration tests and fix hardcoded IPMI username
• 6dc0c43 release(v0.8.1): prepare release
• 9ed9832 chore: bump deps including new redfish changes
• 89de24a fix: correct /tftp/ HTTP path, debug build tags, and comment typos
• 529806a fix: use a private IP range in tests
• 96eabb6 release(v0.8.0): prepare release
• 3cf79cc test: set required Omni SQLite storage path flag to integration test
• d9e43cc release(v0.7.1): prepare release
• 821b331 fix: always include the extra config docs in machine config
• e81d812 release(v0.7.0): prepare release
• 61f2a5d chore: rekres, bump deps
• f303b3f feat: allow providing additional config documents from config endpoint
• 0c53f3a release(v0.6.0): prepare release
• 9c50645 feat: allow specifying a custom DHCP proxy port
• 1a622b6 release(v0.5.0): prepare release
• 4e7f89b chore: bump Talos version to 1.11.3, make integration tests parallel
• e53367e chore: rekres, bump deps
• 5bca2eb refactor: adapt to new QTransform controllers
• 172f6b7 feat: add AMI FutureState fallback for boot settings configuration
• 5eeb667 chore: run integration tests on daily schedule
• 268ad6f feat: allow making ipxe trust a custom CA certificate
• f6a8cdd feat: allow providing own ca cert and self-issued certs
• 8a209de chore: update Omni client module
• 3d91bf6 chore: bump deps and rekres
• 9efacdb chore: bump deps and rekres
• 04ccf6d test: bring back --join-tokens-mode=strict in tests
• c08b791 fix: connect the ipmi client before using it
• 1cc7efc chore: bump deps
• 87001b9 fix: do not reboot machines which do not need to be powered on
• d033824 chore: bump Go, deps and rekres
• e19e669 fix: add support for u-boot arm64 client arch in DHCP proxy
• b57c272 docs: add link to official docs
• a4202aa feat: support node unique token join flow
• f61cb0b fix: do not attempt to reboot if BMC config is not yet set
• 1735d5d fix: fix pxe boot mode change logic
• 9d4dcd2 feat: add secure boot support
• 59aefc3 feat: allow configuring agent calls/wipe timeouts
• f62eb78 feat: use native ipmi client library
• eb7f567 fix: make tftp server bind on api advertise address
• 22fde54 feat: allow user-configured BMC credentials
• a522f9c fix: serve iPXE binaries over http
• 86def06 fix: set the pxe boot flag if required before power on
• c71ff31 feat: add TLS support for agent GRPC connection
• 36d5fbd feat: ignore rejected and cordoned machines in pxe boot handler
• 24f4e21 refactor!: rework resources and controllers
• 4581ace test: update integration tests script
• fb2e410 fix: fix racy access to the provider ID variable
• c4ad6a9 fix: use the correct repo for the Omni client
• b811596 feat: add health checks
• 535696d feat: probe Redfish API and use it when available
• fd0e1c9 feat: implement cordoning infra machines
• 5a36cf1 feat: clear existing machine labels before setting new labels
• 04954bd feat: implement machine reboot
• d5f562a chore: bump agent Talos version and deps
• d2369e4 feat: add initial redfish support
• d2f788d feat: implement powering machines on/off
• b423085 feat: set machine labels directly on InfraMachineStatus
• 4f52230 feat: prevent rebooting too frequently
• e6bfaa9 feat: change the boot order to be first disk, then network
• 2343815 feat: address various points after review
• f2ce7d1 feat: implement bare-metal provider
• 0498eb1 chore: add github actions workflow files
• c3e892b chore: add readme

Dependency Changes

• github.com/cosi-project/runtime v1.16.1 -> v1.16.4
• github.com/siderolabs/image-factory v1.3.2 -> v1.7.2
• github.com/siderolabs/omni-infra-provider-bare-metal 47026ceade31 new
• github.com/siderolabs/omni/client v1.8.0 -> v1.13.0
• github.com/siderolabs/talos/pkg/machinery v1.13.3 -> 3ba3d6a5e784
• github.com/stretchr/testify v1.11.1 -> v1.12.1
• golang.org/x/sync v0.22.0 -> v0.24.0

Previous release can be found at v0.4.0