v1.6.0

[rsmitty]

image-factory 1.6.0 (2026-08-28)

Welcome to the v1.6.0 release of image-factory!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.

Unified Installer Signing

Installer images for Talos 1.14.0 and newer are now always signed when SecureBoot assets are configured.

Unified installers embed a UKI regardless of the SecureBoot flag, so installer and installer-secureboot now resolve to the same profile
and share cached assets instead of being built and stored twice.

Talos versions before 1.14.0 are unaffected: signing an installer there also turns on lockdown=confidentiality, so the two variants stay distinct.

Contributors

• Spencer Smith
• Mateusz Urbanek
• Edward Sammut Alessi
• Orzelius

Changes

11 commits

• b54b945 release(v1.6.0): prepare release
• 9244e82 feat: sign installer profile when unified secureboot supported
• 3b58dfa feat(enterprise): add a node tokens page
• 82bd329 feat: add node token methods to the factory client
• 9312d82 feat(enterprise): add self-issued node tokens
• 4691e01 feat: add WithTokenSource to include bearer tokens
• b115d17 chore(enterprise): drop the Auth0 Management API node-token design
• 6f08ed9 feat(enterprise): extend the download-token issuer to a second audience
• c51ac14 feat: accept download token on /pxe/ and forward it
• 7252d87 chore: allow proxying IF through IF
• f45ec71 fix(enterprise): read the org_id claim from if_org_id

Dependency Changes

• github.com/prometheus/client_golang v1.24.0 -> v1.24.1
• github.com/stretchr/testify v1.12.0 -> v1.11.1

Previous release can be found at v1.5.1

---

This discussion was created from the release v1.6.0.