release(v1.3.2): prepare release

This is the official v1.3.2 release.

Signed-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>

Author: shanduur

.codecov.yml

@@ -1,6 +1,6 @@
-# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+# THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-06-12T16:30:15Z by kres 5128bc1.
+# Generated on 2026-05-25T05:58:11Z by kres 44d3d02.
 
 codecov:
   require_ci_to_pass: false

.kres.yaml

@@ -657,7 +657,7 @@ spec:
         Licensor: Sidero Labs, Inc.
         LicensedWork: Image Factory
         Copyright: (c) 2026 Sidero Labs, Inc.
-        ChangeDate: "2030-05-14"
+        ChangeDate: "2030-05-25"
         ChangeLicense: Mozilla Public License, version 2.0
         EnterpriseLink: https://www.siderolabs.com/contact/
       header: |

CHANGELOG.md

@@ -1,3 +1,40 @@
+## [image-factory 1.3.2](https://github.com/siderolabs/image-factory/releases/tag/v1.3.2) (2026-05-25)
+
+Welcome to the v1.3.2 release of image-factory!
+
+
+
+Please try out the release binaries and report any issues at
+https://github.com/siderolabs/image-factory/issues.
+
+### Contributors
+
+* Mateusz Urbanek
+* Orzelius
+
+### Changes
+<details><summary>8 commits</summary>
+<p>
+
+* [`38183fc`](https://github.com/siderolabs/image-factory/commit/38183fcbd0a0decebc7ea4ee4617f82fa52f637d) fix: update golang.org/x/net
+* [`9f6aee8`](https://github.com/siderolabs/image-factory/commit/9f6aee892c9446e54368f5efb0fcab00aadcf840) fix: make PXE copyable on SecureBoot
+* [`d7377c5`](https://github.com/siderolabs/image-factory/commit/d7377c522e3a3c1e1d702d3ba41e76e3cce53847) refactor: migrate to Tailwind CSS classes
+* [`1e86750`](https://github.com/siderolabs/image-factory/commit/1e86750993dac69f4dc1f0ea4b061ab6ec5c4c32) fix: update golang.org/x/* packages
+* [`33c79e4`](https://github.com/siderolabs/image-factory/commit/33c79e4d5cdcee20c6018c7451f4263baf1f0b60) test: move from kuttl to chainsaw
+* [`ba34dab`](https://github.com/siderolabs/image-factory/commit/ba34dabf151028b77447449e4f255b7daf03e879) feat: move SPDX cache to enterprise options
+* [`cd137ed`](https://github.com/siderolabs/image-factory/commit/cd137edc8d54f3d9e8640552a0ca9a8a3e3dd582) chore: disable authentication for local development
+* [`4ea792f`](https://github.com/siderolabs/image-factory/commit/4ea792f31a1fabc331b6016da2e2138710a41772) fix: build profile with version
+</p>
+</details>
+
+### Dependency Changes
+
+* **golang.org/x/crypto**  v0.50.0 -> v0.52.0
+* **golang.org/x/sys**     v0.43.0 -> v0.45.0
+* **golang.org/x/text**    v0.36.0 -> v0.37.0
+
+Previous release can be found at [v1.3.1](https://github.com/siderolabs/image-factory/releases/tag/v1.3.1)
+
 ## [image-factory 1.3.1](https://github.com/siderolabs/image-factory/releases/tag/v1.3.1) (2026-05-14)
 
 Welcome to the v1.3.1 release of image-factory!

deploy/helm/image-factory/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: image-factory
 description: A Helm chart to deploy Sidero Image Factory on a Kubernetes cluster
 type: application
-version: 1.3.1
-appVersion: "v1.3.1"
+version: 1.3.2
+appVersion: "v1.3.2"
 home: https://github.com/siderolabs/image-factory
 sources:
   - https://github.com/siderolabs/image-factory

deploy/helm/image-factory/README.md

@@ -1,6 +1,6 @@
 # image-factory
 
-![Version: 1.3.1](https://img.shields.io/badge/Version-1.3.1-informational?style=flat) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat) ![AppVersion: v1.3.1](https://img.shields.io/badge/AppVersion-v1.3.1-informational?style=flat)
+![Version: 1.3.2](https://img.shields.io/badge/Version-1.3.2-informational?style=flat) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat) ![AppVersion: v1.3.2](https://img.shields.io/badge/AppVersion-v1.3.2-informational?style=flat)
 
 A Helm chart to deploy Sidero Image Factory on a Kubernetes cluster
 

docs/chart.md

@@ -5,17 +5,17 @@ It is also distributed via the OCI registry.
 
 ## E2E Tests
 
-Image Factory uses KUTTL (Kubernetes Test Tool) integration tests for the Image Factory Helm chart.
+Image Factory uses [Chainsaw](https://kyverno.github.io/chainsaw/) integration tests for the Image Factory Helm chart.
 
 ### Prerequisites
 
-1. **Install KUTTL**:
+1. **Install Chainsaw**:
 
    ```bash
-   make kuttl-plugin-install
+   make chainsaw-install
    ```
 
-   This will install the `kubectl kuttl` plugin using krew.
+   This downloads the `chainsaw` CLI into `_out/`.
 
 2. **Helm**: Helm v4+ installed
 
@@ -39,37 +39,80 @@ make k8s-down
 ```bash
 export KUBECONFIG="$(pwd)/_out/kubeconfig"
 cd deploy/helm/e2e
-kubectl kuttl test
+$(pwd)/../../../_out/chainsaw test
 ```
 
-### Run with custom timeout
+Or via the Makefile target:
 
 ```bash
-kubectl kuttl test --timeout 600
+make chart-e2e-chainsaw
 ```
 
-### Configuration
+#### Run a single test
+
+```bash
+cd deploy/helm/e2e
+$(pwd)/../../../_out/chainsaw test tests/01-image-factory
+```
+
+#### Run with custom timeouts
+
+```bash
+chainsaw test --exec-timeout 600s --assert-timeout 600s
+```
 
-#### Test Suite Settings (kuttl-test.yaml)
+### Configuration
 
-- **startKIND**: `false` - Does not start KIND automatically (we do it manually to test on Talos cluster)
-- **namespace**: `image-factory-e2e` - Fixed namespace for tests
-- **crdDir**: `./_crds` - Prometheus Operator CRDs installed before tests
-- **timeout**: `300` - Each step has 300 second timeout
-- **parallel**: `1` - Tests run sequentially
+#### Test Suite Settings (`deploy/helm/e2e/.chainsaw.yaml`)
+
+- **timeouts.apply**: `60s` - per-apply operation timeout
+- **timeouts.assert**: `600s` - per-assert operation timeout
+- **timeouts.cleanup**: `300s` - cleanup timeout
+- **timeouts.exec**: `600s` - script/command timeout (covers `helm install --wait`)
+- **execution.parallel**: `1` - tests run sequentially
+- **execution.failFast**: `true` - stop on first failure
+- **templating.enabled**: `true` - enables `($namespace)` jmespath expressions in resources
+
+Each test runs in its own ephemeral namespace (`chainsaw-<random>`) which Chainsaw creates and deletes automatically.
+
+### Layout
+
+```text
+deploy/helm/e2e/
+├── .chainsaw.yaml          # root configuration
+├── _crds/                  # cluster-scoped CRDs applied as test setup
+├── _manifests/             # cluster-scoped manifests (local-path-storage, ...)
+├── _lib/                   # shared StepTemplates referenced via `use:` in tests
+├── testdata/               # signing keys, htpasswd, cosign keys
+└── tests/
+    ├── 01-image-factory/   # basic install/upgrade/uninstall
+    ├── 02-upstream/        # internal registry, schematic from upstream
+    ├── 03-airgapped/       # mirror + cosign Talos images, airgapped install
+    └── 04-enterprise/      # enterprise build (auth, grypeDB PVC)
+```
 
 ### Debugging
 
 ```bash
 export KUBECONFIG=./_out/kubeconfig
-kubectl get all -n image-factory-e2e
-kubectl logs -n image-factory-e2e deployment/image-factory
+kubectl get ns | grep chainsaw-       # find ephemeral namespace
+kubectl get all -n chainsaw-<suffix>
+kubectl logs -n chainsaw-<suffix> deployment/image-factory
+```
+
+Failing steps automatically dump describes and pod logs via Chainsaw `catch:` blocks defined in `_lib/*.step.yaml` and per-test `try.catch` sections.
+
+To keep resources around for inspection after a failure, pass `--skip-delete`:
+
+```bash
+chainsaw test --skip-delete --pause-on-failure
 ```
 
 ## Notes
 
-- Prometheus Operator CRDs are pre-installed from `_crds/`
-- Each test step has a 300-second timeout
-- Tests run in fixed namespace `image-factory-e2e`
-- Tests use `--reuse-values` for upgrades to maintain state
-- ECPARAM signing key is provided via a pre-generated key file in `testdata/`
+- Prometheus Operator CRDs are pre-applied from `_crds/` by the `01-image-factory` test (required for ServiceMonitor assertions).
+- `local-path-storage` is pre-applied from `_manifests/` by the `04-enterprise` test (required for the grypeDB PVC).
+- Tests use ephemeral namespaces; service references in tests resolve the namespace via the `($namespace)` jmespath binding.
+- Helm upgrades use `--reuse-values` to maintain state across steps.
+- The ECDSA signing key is provided via a pre-generated key file in `testdata/`.
+- Cosign keys for the airgapped test are in `testdata/cosign.key` and `testdata/cosign.pub`.

enterprise/LICENSE

@@ -7,7 +7,7 @@ Licensed Work:        Image Factory
                       The Licensed Work is (c) 2026 Sidero Labs, Inc.
 Additional Use Grant: None
 
-Change Date:          2030-05-14
+Change Date:          2030-05-25
 
 Change License:       Mozilla Public License, version 2.0
 

hack/release.toml

@@ -5,7 +5,7 @@ project_name = "image-factory"
 github_repo = "siderolabs/image-factory"
 match_deps = "^github.com/(siderolabs/[a-zA-Z0-9-]+)$"
 
-previous = "v1.3.0"
+previous = "v1.3.1"
 pre_release = false
 
 [notes]

internal/version/data/tag

@@ -1 +1 @@
-v1.3.1
+v1.3.2