build(deps): bump github.com/siderolabs/image-factory from 1.6.0 to 1.7.0

[dependabot]

Bumps github.com/siderolabs/image-factory from 1.6.0 to 1.7.0.

Release notes

Sourced from github.com/siderolabs/image-factory's releases.

v1.7.0

image-factory 1.7.0 (2026-09-07)

Welcome to the v1.7.0 release of image-factory!

Please try out the release binaries and report any issues at https://github.com/siderolabs/image-factory/issues.

API Tokens

Download tokens and node tokens are now one self-issued API token with atomic, resource-first capabilities. The catalog is image:read, source:pull, schematic:create, schematic:read, report:read, token:issue, token:read and token:revoke. One code-defined route map validates every scope and authorizes every request; there are no deployment-defined meanings or compatibility aliases for the unreleased intermediate names.

Generated image downloads, PXE assets and generated installer OCI pulls share image:read. Proxied upstream OCI images use the distinct source:pull capability. Schematic creation, schematic reading, report reading, token issuance, token listing and token revocation are independent permissions.

Executable capabilities and delegation are separate. The JWT scope claim controls what the credential may do, while issuable_scopes is an explicit ceiling on what it may grant. Child capabilities and child delegation ceilings must both be subsets of the parent's ceiling. Unknown values fail closed, and no wildcard silently acquires future capabilities.

Each token also carries a stored claim. A stored token is recorded per identity, listed, checked on every use and revocable. An ephemeral token is a signed string and nothing else. Either kind may be used from ?token= on scoped GET and HEAD operations; token-management credentials are refused in query strings because those are copied into access logs.

Lifetime follows storage rather than capability. Stored tokens default to one year and remain revocable. Ephemeral tokens default to five minutes and may live up to eight hours. The CLI bootstrap credential has its own authentication.tokens.ttl.bootstrap policy.

POST /tokens, GET /tokens and POST /tokens/:id/revoke are the only token endpoints. The /node-tokens and /download-token routes are gone; use {"scopes":["image:read"]} and add "stored":false for a short-lived URL credential.

Breaking changes:

• Node and download tokens issued by earlier versions are rejected and must be reissued.
• The intermediate download, pull, schematic, token and admin scope values are rejected.
• POST /tokens accepts stored and issuable_scopes; token records report both executable and issuable scopes.
• Token TTL configuration is grouped under authentication.tokens.ttl.stored, .ephemeral and .bootstrap.
• pkg/client's TokenCreate takes a stored argument; DownloadToken passes false and otherwise keeps its behavior.
• authentication.downloadTokenKeyPath, authentication.downloadTokenTTL and enterprise.nodeTokens move to authentication.tokens; stale keys fail startup.
• authentication.tokens.keyPaths is ordered: the first private key signs new tokens, while every later key or certificate is verification-only. This supports two-phase key rotation without immediately invalidating existing tokens.

See the authentication docs for the complete model and upgrade steps.

Bootstrap Credentials

Cross-subject provisioning uses a CLI-only bootstrap credential rather than an admin scope. It carries token:issue, token:read and token:revoke for its own operations, an explicit snapshot of the current public catalog in issuable_scopes, and the independent any_subject claim.

No HTTP request can create this credential. The Enterprise-only command is:

image-factory admin-token --config /etc/image-factory/config.yaml --subject org_abc123

The command writes the token to stdout and diagnostics to stderr. --ttl uses authentication.tokens.ttl.bootstrap, and authentication.tokens.keyPaths must contain an active private key so the credential is signed by the key running replicas trust.

... (truncated)

Changelog

Sourced from github.com/siderolabs/image-factory's changelog.

image-factory 1.7.0 (2026-09-07)

Welcome to the v1.7.0 release of image-factory!

Please try out the release binaries and report any issues at https://github.com/siderolabs/image-factory/issues.

API Tokens

Download tokens and node tokens are now one self-issued API token with atomic, resource-first capabilities. The catalog is image:read, source:pull, schematic:create, schematic:read, report:read, token:issue, token:read and token:revoke. One code-defined route map validates every scope and authorizes every request; there are no deployment-defined meanings or compatibility aliases for the unreleased intermediate names.

Generated image downloads, PXE assets and generated installer OCI pulls share image:read. Proxied upstream OCI images use the distinct source:pull capability. Schematic creation, schematic reading, report reading, token issuance, token listing and token revocation are independent permissions.

Executable capabilities and delegation are separate. The JWT scope claim controls what the credential may do, while issuable_scopes is an explicit ceiling on what it may grant. Child capabilities and child delegation ceilings must both be subsets of the parent's ceiling. Unknown values fail closed, and no wildcard silently acquires future capabilities.

Each token also carries a stored claim. A stored token is recorded per identity, listed, checked on every use and revocable. An ephemeral token is a signed string and nothing else. Either kind may be used from ?token= on scoped GET and HEAD operations; token-management credentials are refused in query strings because those are copied into access logs.

Lifetime follows storage rather than capability. Stored tokens default to one year and remain revocable. Ephemeral tokens default to five minutes and may live up to eight hours. The CLI bootstrap credential has its own authentication.tokens.ttl.bootstrap policy.

POST /tokens, GET /tokens and POST /tokens/:id/revoke are the only token endpoints. The /node-tokens and /download-token routes are gone; use {"scopes":["image:read"]} and add "stored":false for a short-lived URL credential.

Breaking changes:

• Node and download tokens issued by earlier versions are rejected and must be reissued.
• The intermediate download, pull, schematic, token and admin scope values are rejected.
• POST /tokens accepts stored and issuable_scopes; token records report both executable and issuable scopes.
• Token TTL configuration is grouped under authentication.tokens.ttl.stored, .ephemeral and .bootstrap.
• pkg/client's TokenCreate takes a stored argument; DownloadToken passes false and otherwise keeps its behavior.
• authentication.downloadTokenKeyPath, authentication.downloadTokenTTL and enterprise.nodeTokens move to authentication.tokens; stale keys fail startup.
• authentication.tokens.keyPaths is ordered: the first private key signs new tokens, while every later key or certificate is verification-only. This supports two-phase key rotation without immediately invalidating existing tokens.

See the authentication docs for the complete model and upgrade steps.

Bootstrap Credentials

Cross-subject provisioning uses a CLI-only bootstrap credential rather than an admin scope. It carries token:issue, token:read and token:revoke for its own operations, an explicit snapshot of the current public catalog in issuable_scopes, and the independent any_subject claim.

No HTTP request can create this credential. The Enterprise-only command is:

image-factory admin-token --config /etc/image-factory/config.yaml --subject org_abc123

The command writes the token to stdout and diagnostics to stderr. --ttl uses authentication.tokens.ttl.bootstrap, and authentication.tokens.keyPaths must contain an active private key so the credential is signed by the key running replicas trust.

The bootstrap credential is never recorded, so expiry or removal of its signing key from keyPaths retires it. It cannot propagate any_subject, cannot create a successor bootstrap credential, and cannot be used through ?token=. Keep it offline and give it the shortest practical lifetime.

... (truncated)

Commits

• 5da8c30 release(v1.7.0): prepare release
• 513036c fix: cache unauthenticated iPXE scripts, dedupe cache signing
• 5fec48b test: characterize HTTP frontend behavior
• 4520b38 fix(enterprise): evaluate VEX against Talos kernel
• a27dfe6 feat: enforce public API with OpenAPI
• 773ba3c fix(ui): gate token create modal on the in-flight POST
• 2e149c8 fix(auth0): drop Bearer challenge from 401 response
• 9f82dde fix: rename registryClientRefreshInterval to refreshInterval
• f4f79db feat(enterprise): repo-per-org token storage, url-safe stored tokens
• f4e4d01 feat(enterprise): expose actor profiles for token creation UI
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: go. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.