Skip to main content
Enterprise Image Factory (factory.siderolabs.com) serves Talos Enterprise Linux boot assets along with the artifacts unique to it: per-schematic SBOMs, VEX data, and vulnerability scan reports. This page shows how to download each of them, through the web UI and programmatically. For what these artifacts are and how Enterprise Image Factory differs from the public Image Factory, see Enterprise Image Factory All requests to Enterprise Image Factory are authenticated — the web UI, direct downloads, and registry pulls alike. This page assumes you can already authenticate.

​
Prerequisites

Before you begin, ensure you have the following:
  • Access to Enterprise Image Factory on a qualifying Talos Enterprise Linux tier. Reach out to support to gain access to the Enterprise Image Factory.
  • A schematic ID for programmatic downloads. Create one with the web UI wizard as described in the Download boot assets from the UI section, or programmatically by submitting your schematic YAML to POST /schematics (requires the schematic:create scope) — see the Image Factory API reference.
  • curl (or similar) for programmatic downloads.

​
Download boot assets from the UI

If you have used the public Image Factory or the Create New Media wizard in Omni, this is the same flow, the only difference is that you authenticate first. To download boot assets from the UI:
  1. Log in to Enterprise Image Factory.
  2. On each page of the wizard, select the appropriate options for your setup, then click Next to continue. The wizard is split across multiple pages. Each page presents a different set of configuration options — such as hardware type, architecture, Talos Linux version, and system extensions — that you can use to customize your Talos Enterprise Linux image.
  3. On the Schematic Ready page, select the appropriate boot option for your machine to download the image. The Schematic Ready page also shows your schematic ID. Note it down, you need it for programmatic downloads and for retrieving the SBOM and scan reports for this exact image.
  4. From the same page, download the image’s SBOM, VEX data, and vulnerability scan report alongside the boot assets.
Schematics in Enterprise Image Factory are owned by the account that created them, and the owner is part of the schematic ID. An identical configuration therefore produces a different schematic ID than it does on the public Image Factory, or under another customer’s account.

​
Download boot assets programmatically

Boot assets follow the same URL structure as the public Image Factory, served from factory.siderolabs.com:
However, unlike the public Image Factory, the Enterprise Image Factory requires every request to be authenticated with a token. To learn how to obtain your token, see Manage Enterprise Image Factory Credentials. To authenticate and download boot assets, pass the token in your request, replacing the <token> placeholder with your token:
Common asset paths include: For example, to download the Talos v1.14.0 disk image with the schematic 551f50cf6a99fd16651f975cf5464d2e7c4cc4a9719c0c4c12b47a13fa61898d, run the following command, replacing the <token> placeholder with your token:

​
Download the SBOM, VEX data, and scan reports

These artifacts are served per schematic (SBOM, scan reports) or per Talos Linux release (VEX), from dedicated endpoints:
These endpoints require a token with the report:read scope — an Automation, Operator, or Admin actor.
Scan reports are available in several formats, replace the report suffix as needed:
  • .json: output format of the underlying scanner
  • .table: human-readable table
  • .sarif: SARIF format
  • .cdx: CycloneDX format

​
Verify checksums

Appending .sha256 or .sha512 to any boot asset path returns a checksum file instead of the asset: For example to download the checksum file of the asset path metal-amd64.raw.zst:

​
See also

For more information, see also:
  • Enterprise Image Factory: To learn what these artifacts are and how the enterprise service differs from the public one
  • Image Factory: The public, unauthenticated image factory service