build(deps): bump github.com/siderolabs/image-factory from 1.3.2 to 1.5.0

[dependabot]

Bumps github.com/siderolabs/image-factory from 1.3.2 to 1.5.0.

Release notes

Sourced from github.com/siderolabs/image-factory's releases.

v1.5.0

image-factory 1.5.0 (2026-08-17)

Welcome to the v1.5.0 release of image-factory!

Please try out the release binaries and report any issues at https://github.com/siderolabs/image-factory/issues.

Artifact Signatures

Image Factory now serves detached Sigstore v0.3 bundles (.sigstore.json) alongside downloaded assets.

Each bundle cryptographically signs the exact bytes returned by the asset endpoint using either a pinned local key or GSA keyless signing. Bundles are persisted in a shared asset cache partitioned by asset, signer, and evidence format, with single-flight deduplication and graceful handling of transient cache failures.

Auth0 Authentication (Enterprise only)

Image Factory now supports Auth0 organization-scoped access tokens as an alternative to htpasswd authentication.

Bearer tokens are validated against the tenant's JWKS and can also be supplied through Basic authentication for OCI and Talos clients. An optional OAuth2 authorization code flow with PKCE provides interactive browser login with encrypted, replica-safe session cookies.

Download Tokens (Enterprise only)

Image Factory can now issue short-lived, identity-scoped JWTs for image downloads through POST /download-token.

Tokens authenticate GET and HEAD requests under /image/ through the token query parameter, and their public signing key is exposed through /.well-known/jwks.json. Callers can request a token lifetime within configurable minimum, maximum, and default bounds.

Source Image Proxy

Allow pulling source images through the Image Factory.

E.g. siderolabs/imager image can be pulled as factory.talos.dev/siderolabs/imager.

Installer Build Evidence (Enterprise only)

Installer images built from stable Talos 1.13.0 and newer now carry signed build evidence.

Each platform manifest has an SPDX 2.3 SBOM attestation, while the multi-platform index has a SLSA Provenance v1 attestation. Evidence is published as Sigstore bundles through OCI referrers, with automatic fallback to the OCI referrers-tag schema for registries without native OCI 1.1 referrers support.

Contributors

... (truncated)

Changelog

Sourced from github.com/siderolabs/image-factory's changelog.

image-factory 1.5.0 (2026-08-17)

Welcome to the v1.5.0 release of image-factory!

Please try out the release binaries and report any issues at https://github.com/siderolabs/image-factory/issues.

Artifact Signatures

Image Factory now serves detached Sigstore v0.3 bundles (.sigstore.json) alongside downloaded assets.

Each bundle cryptographically signs the exact bytes returned by the asset endpoint using either a pinned local key or GSA keyless signing. Bundles are persisted in a shared asset cache partitioned by asset, signer, and evidence format, with single-flight deduplication and graceful handling of transient cache failures.

Auth0 Authentication (Enterprise only)

Image Factory now supports Auth0 organization-scoped access tokens as an alternative to htpasswd authentication.

Bearer tokens are validated against the tenant's JWKS and can also be supplied through Basic authentication for OCI and Talos clients. An optional OAuth2 authorization code flow with PKCE provides interactive browser login with encrypted, replica-safe session cookies.

Download Tokens (Enterprise only)

Image Factory can now issue short-lived, identity-scoped JWTs for image downloads through POST /download-token.

Tokens authenticate GET and HEAD requests under /image/ through the token query parameter, and their public signing key is exposed through /.well-known/jwks.json. Callers can request a token lifetime within configurable minimum, maximum, and default bounds.

Source Image Proxy

Allow pulling source images through the Image Factory.

E.g. siderolabs/imager image can be pulled as factory.talos.dev/siderolabs/imager.

Installer Build Evidence (Enterprise only)

Installer images built from stable Talos 1.13.0 and newer now carry signed build evidence.

Each platform manifest has an SPDX 2.3 SBOM attestation, while the multi-platform index has a SLSA Provenance v1 attestation. Evidence is published as Sigstore bundles through OCI referrers, with automatic fallback to the OCI referrers-tag schema for registries without native OCI 1.1 referrers support.

Contributors

... (truncated)

Commits

• bd13149 release(v1.5.0): prepare release
• d3c693a feat: update talos to v1.14.0-rc.1
• 5c9839a feat: use the CI cluster registry cache for integration tests
• 70e0590 feat(enterprise): add auth0 browser login
• f5f3128 fix: record the status the client actually received
• 0d2275c feat: make download token TTL configurable
• a5824c7 docs: complete user-facing API reference
• dd485bd docs: document endpoint access control
• 6016631 test: fix two flaky checks in the enterprise integration job
• f984ad8 chore: let the OIDC test server serve extra routes
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: go. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.