fix: generation of overlay installer images

Pull in fixes from Talos, rekres, add a test for overlay installer
generation.

Due to the nature of the fixes, the first fully working installer should
come with the next release of Talos Linux.

Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>

.github/workflows/ci.yaml

@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-04-04T14:15:53Z by kres latest.
+# Generated on 2024-04-16T17:51:01Z by kres 92eef68.
 
 name: default
 concurrency:
@@ -85,11 +85,11 @@ jobs:
         run: |
           make image-image-factory
       - name: push-image-factory-latest
-        if: github.event_name != 'pull_request'
+        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
         env:
           PUSH: "true"
         run: |
-          make image-image-factory TAG=latest
+          make image-image-factory IMAGE_TAG=latest
       - name: integration
         env:
           REGISTRY: registry.dev.siderolabs.io

.kres.yaml

@@ -51,7 +51,7 @@ spec:
     - stage: ghcr.io/siderolabs/grub@sha256:fd929bae5ad64a3e2a530d6b3cbfab673b60af2e62268a45cf42194df55c116d # arm64
       source: /usr/lib/grub
       destination: /usr/lib/grub
-    - stage: ghcr.io/siderolabs/installer:v1.7.0
+    - stage: ghcr.io/siderolabs/installer:v1.7.0-beta.1
       source: /usr/share/grub/unicode.pf2
       destination: /usr/share/grub/unicode.pf2
 ---

Dockerfile

@@ -2,7 +2,7 @@
 
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-04-04T14:15:53Z by kres latest.
+# Generated on 2024-04-16T17:52:56Z by kres 92eef68.
 
 ARG TOOLCHAIN
 
@@ -178,10 +178,10 @@ FROM base-image-image-factory AS image-image-factory
 RUN apk add --no-cache --update bash binutils-aarch64 binutils-x86_64 cpio dosfstools efibootmgr kmod mtools pigz qemu-img squashfs-tools tar util-linux xfsprogs xorriso xz
 ARG TARGETARCH
 COPY --from=image-factory image-factory-linux-${TARGETARCH} /image-factory
-COPY --from=ghcr.io/siderolabs/grub:v1.6.0-3-g617d342 / /
-COPY --from=ghcr.io/siderolabs/grub@sha256:9c17d29995e569a30ef7e35bfc5aedf9fee4de7f285787322c90dc807af08302 /usr/lib/grub /usr/lib/grub
-COPY --from=ghcr.io/siderolabs/grub@sha256:29014cfe94f68d815e94b990a381bdc464b78fc989e775c748894ce359bcf3a5 /usr/lib/grub /usr/lib/grub
-COPY --from=ghcr.io/siderolabs/installer:v1.6.0 /usr/share/grub/unicode.pf2 /usr/share/grub/unicode.pf2
+COPY --from=ghcr.io/siderolabs/grub:v1.7.0-2-g6101299 / /
+COPY --from=ghcr.io/siderolabs/grub@sha256:46469ae913378d45f69ac10d2dc8ebea54e914542deab2b2f23c95dac5116335 /usr/lib/grub /usr/lib/grub
+COPY --from=ghcr.io/siderolabs/grub@sha256:fd929bae5ad64a3e2a530d6b3cbfab673b60af2e62268a45cf42194df55c116d /usr/lib/grub /usr/lib/grub
+COPY --from=ghcr.io/siderolabs/installer:v1.7.0-beta.1 /usr/share/grub/unicode.pf2 /usr/share/grub/unicode.pf2
 LABEL org.opencontainers.image.source https://github.com/siderolabs/image-factory
 ENTRYPOINT ["/image-factory"]
 

Makefile

@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-04-04T14:15:53Z by kres latest.
+# Generated on 2024-04-16T17:51:01Z by kres 92eef68.
 
 # common variables
 
@@ -9,6 +9,7 @@ TAG := $(shell git describe --tag --always --dirty --match v[0-9]\*)
 ABBREV_TAG := $(shell git describe --tags >/dev/null 2>/dev/null && git describe --tag --always --match v[0-9]\* --abbrev=0 || echo 'undefined')
 BRANCH := $(shell git rev-parse --abbrev-ref HEAD)
 ARTIFACTS := _out
+IMAGE_TAG ?= $(TAG)
 WITH_DEBUG ?= false
 WITH_RACE ?= false
 REGISTRY ?= ghcr.io
@@ -22,7 +23,7 @@ DEEPCOPY_VERSION ?= v0.5.6
 GOLANGCILINT_VERSION ?= v1.57.2
 GOFUMPT_VERSION ?= v0.6.0
 GO_VERSION ?= 1.22.2
-GOIMPORTS_VERSION ?= v0.19.0
+GOIMPORTS_VERSION ?= v0.20.0
 GO_BUILDFLAGS ?=
 GO_LDFLAGS ?=
 CGO_ENABLED ?= 0
@@ -115,7 +116,7 @@ If you already have a compatible builder instance, you may use that instead.
 ## Artifacts
 
 All artifacts will be output to ./$(ARTIFACTS). Images will be tagged with the
-registry "$(REGISTRY)", username "$(USERNAME)", and a dynamic tag (e.g. $(IMAGE):$(TAG)).
+registry "$(REGISTRY)", username "$(USERNAME)", and a dynamic tag (e.g. $(IMAGE):$(IMAGE_TAG)).
 The registry and username can be overridden by exporting REGISTRY, and USERNAME
 respectively.
 
@@ -210,7 +211,7 @@ lint: lint-golangci-lint lint-gofumpt lint-govulncheck lint-goimports lint-markd
 
 .PHONY: image-image-factory
 image-image-factory: tailwind  ## Builds image for image-factory.
-	@$(MAKE) target-$@ TARGET_ARGS="--tag=$(REGISTRY)/$(USERNAME)/image-factory:$(TAG)"
+	@$(MAKE) target-$@ TARGET_ARGS="--tag=$(REGISTRY)/$(USERNAME)/image-factory:$(IMAGE_TAG)"
 
 .PHONY: integration.test
 integration.test:

go.mod

@@ -12,8 +12,8 @@ require (
 	github.com/siderolabs/gen v0.4.8
 	github.com/siderolabs/go-debug v0.3.0
 	github.com/siderolabs/go-pointer v1.0.0
-	github.com/siderolabs/talos v1.7.0-alpha.1.0.20240410135248-145f2406307e
-	github.com/siderolabs/talos/pkg/machinery v1.7.0-alpha.1.0.20240410135248-145f2406307e
+	github.com/siderolabs/talos v1.7.0-alpha.1.0.20240416160744-0a785802ea22
+	github.com/siderolabs/talos/pkg/machinery v1.7.0-alpha.1.0.20240416160744-0a785802ea22
 	github.com/sigstore/cosign/v2 v2.2.3
 	github.com/sigstore/sigstore v1.8.3
 	github.com/slok/go-http-metrics v0.11.0
@@ -295,12 +295,12 @@ require (
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	k8s.io/api v0.30.0-rc.1 // indirect
-	k8s.io/apimachinery v0.30.0-rc.1 // indirect
-	k8s.io/apiserver v0.30.0-rc.1 // indirect
-	k8s.io/client-go v0.30.0-rc.1 // indirect
-	k8s.io/component-base v0.30.0-rc.1 // indirect
-	k8s.io/cri-api v0.30.0-rc.1 // indirect
+	k8s.io/api v0.30.0-rc.2 // indirect
+	k8s.io/apimachinery v0.30.0-rc.2 // indirect
+	k8s.io/apiserver v0.30.0-rc.2 // indirect
+	k8s.io/client-go v0.30.0-rc.2 // indirect
+	k8s.io/component-base v0.30.0-rc.2 // indirect
+	k8s.io/cri-api v0.30.0-rc.2 // indirect
 	k8s.io/klog/v2 v2.120.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
 	k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect

go.sum

@@ -660,10 +660,10 @@ github.com/siderolabs/net v0.4.0 h1:1bOgVay/ijPkJz4qct98nHsiB/ysLQU0KLoBC4qLm7I=
 github.com/siderolabs/net v0.4.0/go.mod h1:/ibG+Hm9HU27agp5r9Q3eZicEfjquzNzQNux5uEk0kM=
 github.com/siderolabs/protoenc v0.2.1 h1:BqxEmeWQeMpNP3R6WrPqDatX8sM/r4t97OP8mFmg6GA=
 github.com/siderolabs/protoenc v0.2.1/go.mod h1:StTHxjet1g11GpNAWiATgc8K0HMKiFSEVVFOa/H0otc=
-github.com/siderolabs/talos v1.7.0-alpha.1.0.20240410135248-145f2406307e h1:spG3RV/LOtDSqLDbYJbE4QV2zGEXJf7QkS5YYhDtj1o=
-github.com/siderolabs/talos v1.7.0-alpha.1.0.20240410135248-145f2406307e/go.mod h1:6066cAVjZh7ce1ygEp28GunvHHIj2Uz3H11ZoE0UwmM=
-github.com/siderolabs/talos/pkg/machinery v1.7.0-alpha.1.0.20240410135248-145f2406307e h1:x9jzt+X3IQtZkkEfyT6SD5A7tdxwrAABbO567rFX/fk=
-github.com/siderolabs/talos/pkg/machinery v1.7.0-alpha.1.0.20240410135248-145f2406307e/go.mod h1:YBl9KDCD45Uc7N0rXBY1JqovUn1n46ekUPSNbEVZzQU=
+github.com/siderolabs/talos v1.7.0-alpha.1.0.20240416160744-0a785802ea22 h1:HzMfKIbPyHMHE2Iw1ChUiuM3YuZXBtUzW6LAMxa6t4U=
+github.com/siderolabs/talos v1.7.0-alpha.1.0.20240416160744-0a785802ea22/go.mod h1:VOzknl+s0jddohvWbixbC9rPS0ss5BtaHL71dys7t+w=
+github.com/siderolabs/talos/pkg/machinery v1.7.0-alpha.1.0.20240416160744-0a785802ea22 h1:9vzfGZFUziMr3nJISbbYOvxqZ7enCJbuq2VhFm/WQ0k=
+github.com/siderolabs/talos/pkg/machinery v1.7.0-alpha.1.0.20240416160744-0a785802ea22/go.mod h1:YBl9KDCD45Uc7N0rXBY1JqovUn1n46ekUPSNbEVZzQU=
 github.com/sigstore/cosign/v2 v2.2.3 h1:WX7yawI+EXu9h7S5bZsfYCbB9XW6Jc43ctKy/NoOSiA=
 github.com/sigstore/cosign/v2 v2.2.3/go.mod h1:WpMn4MBt0cI23GdHsePwO4NxhX1FOz1ITGB3ALUjFaI=
 github.com/sigstore/fulcio v1.4.3 h1:9JcUCZjjVhRF9fmhVuz6i1RyhCc/EGCD7MOl+iqCJLQ=
@@ -1021,18 +1021,18 @@ gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
 gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-k8s.io/api v0.30.0-rc.1 h1:0163kmXvT0JoER+nh9h1nSgX+sDwYYHPBgs+rWqjVIg=
-k8s.io/api v0.30.0-rc.1/go.mod h1:mfiQxBiaioCBgc+jzmDpSXmSEQkqeHTh4FVOAh1iEqU=
-k8s.io/apimachinery v0.30.0-rc.1 h1:Zi5mcxPCvhwJL8S8tNC5AakszlABd3UWr6OOXqPDToM=
-k8s.io/apimachinery v0.30.0-rc.1/go.mod h1:wEJvNDlfxMRaMhyv38SIHIEC9hah/xuzqUUhxIyUv7Y=
-k8s.io/apiserver v0.30.0-rc.1 h1:61klJwjoORznFtXWKdhD1hl2hDtZDAHs+iR4DcFfNkk=
-k8s.io/apiserver v0.30.0-rc.1/go.mod h1:ceP6uSYuNHIx35dD74S5yb/v8HR9sZylInNkyg5uTLI=
-k8s.io/client-go v0.30.0-rc.1 h1:vUhzEA59XUwGtFjea4UPLa9Tal3SskmNYSgR7lmjQNU=
-k8s.io/client-go v0.30.0-rc.1/go.mod h1:LnVJuaom1T1YD5IN2KwCJN9WvWbEfUNTg1lsmErIW3g=
-k8s.io/component-base v0.30.0-rc.1 h1:Rzj2ev1hG3bfvenMBdsm+M5aeARZ7MH+zUW/fYn1DJk=
-k8s.io/component-base v0.30.0-rc.1/go.mod h1:bln4m7L7DC075qpAVDxLSbmQthruJPmDC5OgdywDdVE=
-k8s.io/cri-api v0.30.0-rc.1 h1:74C6n5E7I3zoLlRxZUPhWwFjR5yOIFa42+wajnD9teg=
-k8s.io/cri-api v0.30.0-rc.1/go.mod h1:4MvRsG7Jr/C0uyVjCforyO0BNJJlngqcMRsJvObl4q0=
+k8s.io/api v0.30.0-rc.2 h1:wnrY4jFP4Kx7h/Ppg86D0dyctlKfiMSXHme004ptkCU=
+k8s.io/api v0.30.0-rc.2/go.mod h1:AsZ3vl/SZOLpqzfIKhleVYl5R5ruyzhB3G08xpDEjPQ=
+k8s.io/apimachinery v0.30.0-rc.2 h1:Q1JPqws5zCGjRwKtLW8ZKOY8lvl6aJejqIixJlHoAhc=
+k8s.io/apimachinery v0.30.0-rc.2/go.mod h1:iexa2somDaxdnj7bha06bhb43Zpa6eWH8N8dbqVjTUc=
+k8s.io/apiserver v0.30.0-rc.2 h1:FGIjvgG6HrOjjeVQKSI2qItT6dXbmYKTD1KbBW8TsIo=
+k8s.io/apiserver v0.30.0-rc.2/go.mod h1:Qs+prNQNN52O3tGv5Krq9r1Cm2rqz2+r+LCkM50dJNw=
+k8s.io/client-go v0.30.0-rc.2 h1:AqXSYq6s2BIr4WqK2dXGebxLPIsN48cMYjP71aXKspM=
+k8s.io/client-go v0.30.0-rc.2/go.mod h1:vCtim9VeBumah2j1nZ/95O0V7F4Ad8N0wwCkSkgOE+Y=
+k8s.io/component-base v0.30.0-rc.2 h1:0Qa6faUg01rBp9VxU76B8PmK58rBcAGB+7r4ckpLtgI=
+k8s.io/component-base v0.30.0-rc.2/go.mod h1:rdQm+7+FBi+t74zJKiKBYVgQJEiNRMqvESRh8/f5z5k=
+k8s.io/cri-api v0.30.0-rc.2 h1:7duYOq8BtLqDOE5zqDJvGix2WVUhPp6KbtH/1bITYwQ=
+k8s.io/cri-api v0.30.0-rc.2/go.mod h1://4/umPJSW1ISNSNng4OwjpkvswJOQwU8rnkvO8P+xg=
 k8s.io/klog/v2 v2.120.1 h1:QXU6cPEOIslTGvZaXvFWiP9VKyeet3sawzTOvdXb4Vw=
 k8s.io/klog/v2 v2.120.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 h1:BZqlfIlq5YbRMFko6/PM7FjZpUb45WallggurYhKGag=

internal/artifacts/schematic.go

@@ -13,8 +13,8 @@ import (
 	"os"
 	"path/filepath"
 
-	"github.com/siderolabs/talos/pkg/imager/quirks"
 	"github.com/siderolabs/talos/pkg/machinery/extensions"
+	"github.com/siderolabs/talos/pkg/machinery/imager/quirks"
 	"gopkg.in/yaml.v3"
 
 	"github.com/siderolabs/image-factory/pkg/constants"

internal/asset/asset.go

@@ -19,7 +19,7 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/siderolabs/talos/pkg/imager"
 	"github.com/siderolabs/talos/pkg/imager/profile"
-	"github.com/siderolabs/talos/pkg/imager/quirks"
+	"github.com/siderolabs/talos/pkg/machinery/imager/quirks"
 	"github.com/siderolabs/talos/pkg/reporter"
 	"go.uber.org/zap"
 	"golang.org/x/sync/singleflight"

internal/frontend/http/meta.go

@@ -14,7 +14,7 @@ import (
 	"github.com/blang/semver/v4"
 	"github.com/julienschmidt/httprouter"
 	"github.com/siderolabs/gen/xslices"
-	"github.com/siderolabs/talos/pkg/imager/quirks"
+	"github.com/siderolabs/talos/pkg/machinery/imager/quirks"
 
 	"github.com/siderolabs/image-factory/internal/artifacts"
 	"github.com/siderolabs/image-factory/pkg/client"

internal/frontend/http/ui.go

@@ -16,7 +16,7 @@ import (
 
 	"github.com/blang/semver/v4"
 	"github.com/julienschmidt/httprouter"
-	"github.com/siderolabs/talos/pkg/imager/quirks"
+	"github.com/siderolabs/talos/pkg/machinery/imager/quirks"
 	"gopkg.in/yaml.v3"
 
 	"github.com/siderolabs/image-factory/internal/artifacts"

internal/integration/registry_test.go

@@ -35,7 +35,7 @@ import (
 	"github.com/siderolabs/image-factory/pkg/schematic"
 )
 
-func testInstallerImage(ctx context.Context, t *testing.T, registry name.Registry, talosVersion, schematic string, secureboot bool, platform v1.Platform, baseURL string) {
+func testInstallerImage(ctx context.Context, t *testing.T, registry name.Registry, talosVersion, schematic string, secureboot bool, platform v1.Platform, baseURL string, overlay bool) {
 	imageName := "installer"
 	if secureboot {
 		imageName += "-secureboot"
@@ -70,7 +70,11 @@ func testInstallerImage(ctx context.Context, t *testing.T, registry name.Registr
 	require.NoError(t, err)
 
 	if talosVersion != "v1.3.7" {
-		assert.Len(t, layers, 2, "installer image should have 2 layers: base and artifacts")
+		if overlay {
+			assert.Len(t, layers, 3, "installer image should have 2 layers: base, artifacts and overlay")
+		} else {
+			assert.Len(t, layers, 2, "installer image should have 2 layers: base and artifacts")
+		}
 	}
 
 	expectedFiles := map[string]struct{}{
@@ -85,13 +89,19 @@ func testInstallerImage(ctx context.Context, t *testing.T, registry name.Registr
 		expectedFiles[fmt.Sprintf("usr/install/%s/systemd-boot.efi", platform.Architecture)] = struct{}{}
 	}
 
-	if platform.Architecture == "arm64" {
-		if talosVersion != "v1.3.7" {
-			expectedFiles["usr/install/arm64/dtb/allwinner/sun50i-h616-x96-mate.dtb"] = struct{}{}
-		}
+	if !overlay {
+		if platform.Architecture == "arm64" {
+			if talosVersion != "v1.3.7" {
+				expectedFiles["usr/install/arm64/dtb/allwinner/sun50i-h616-x96-mate.dtb"] = struct{}{}
+			}
 
-		expectedFiles["usr/install/arm64/raspberrypi-firmware/boot/bootcode.bin"] = struct{}{}
-		expectedFiles["usr/install/arm64/u-boot/rockpi_4/rkspi_loader.img"] = struct{}{}
+			expectedFiles["usr/install/arm64/raspberrypi-firmware/boot/bootcode.bin"] = struct{}{}
+			expectedFiles["usr/install/arm64/u-boot/rockpi_4/rkspi_loader.img"] = struct{}{}
+		}
+	} else {
+		expectedFiles["overlay/artifacts/arm64/firmware/boot/fixup.dat"] = struct{}{}
+		expectedFiles["overlay/extra-options"] = struct{}{}
+		expectedFiles["overlay/installers/default"] = struct{}{}
 	}
 
 	assertImageContainsFiles(t, img, expectedFiles)
@@ -235,7 +245,7 @@ func testRegistryFrontend(ctx context.Context, t *testing.T, registryAddr string
 								t.Run(platform.String(), func(t *testing.T) {
 									t.Parallel()
 
-									testInstallerImage(ctx, t, registry, talosVersion, schematicID, secureboot, platform, baseURL)
+									testInstallerImage(ctx, t, registry, talosVersion, schematicID, secureboot, platform, baseURL, false)
 								})
 							}
 						})
@@ -244,4 +254,38 @@ func testRegistryFrontend(ctx context.Context, t *testing.T, registryAddr string
 			}
 		})
 	}
+
+	overlaySchematicID := createSchematicGetID(ctx, t, c,
+		schematic.Schematic{
+			Overlay: schematic.Overlay{
+				Image: "siderolabs/sbc-raspberrypi",
+				Name:  "rpi_generic",
+			},
+		},
+	)
+
+	for _, talosVersion := range []string{"v1.7.0-beta.1"} {
+		t.Run(talosVersion, func(t *testing.T) {
+			t.Parallel()
+
+			schematicID := overlaySchematicID
+
+			t.Run("overlays", func(t *testing.T) {
+				t.Parallel()
+
+				for _, platform := range []v1.Platform{
+					{
+						Architecture: "arm64",
+						OS:           "linux",
+					},
+				} {
+					t.Run(platform.String(), func(t *testing.T) {
+						t.Parallel()
+
+						testInstallerImage(ctx, t, registry, talosVersion, schematicID, false, platform, baseURL, true)
+					})
+				}
+			})
+		})
+	}
 }

internal/profile/hash.go

@@ -41,6 +41,12 @@ func Hash(p profile.Profile) (string, error) {
 	if p.Output.Kind == profile.OutKindInstaller {
 		hasher.Write([]byte("installer fix #8107"))
 	}
+	// 3. overlay installer layout issues
+	// - https://github.com/siderolabs/talos/pull/8606 (missing +x)
+	// - https://github.com/siderolabs/talos/pull/8607 (wrong arch of the overlay)
+	if p.Output.Kind == profile.OutKindInstaller && p.Overlay != nil {
+		hasher.Write([]byte("overlay installer layout fix"))
+	}
 
 	return hex.EncodeToString(hasher.Sum(nil)), nil
 }

internal/profile/profile.go

@@ -19,8 +19,8 @@ import (
 	"github.com/siderolabs/gen/xslices"
 	"github.com/siderolabs/go-pointer"
 	"github.com/siderolabs/talos/pkg/imager/profile"
-	"github.com/siderolabs/talos/pkg/imager/quirks"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
+	"github.com/siderolabs/talos/pkg/machinery/imager/quirks"
 	"github.com/siderolabs/talos/pkg/machinery/meta"
 
 	"github.com/siderolabs/image-factory/internal/artifacts"
@@ -353,7 +353,12 @@ func EnhanceFromSchematic(
 				return prof, xerrors.NewTaggedf[InvalidErrorTag]("official overlay %q is not available for Talos version %s", overlayRef, versionTag)
 			}
 
-			imagePath, err := artifactProducer.GetOverlayImage(ctx, artifacts.Arch(runtime.GOARCH), overlayRef)
+			imageNativePath, err := artifactProducer.GetOverlayImage(ctx, artifacts.Arch(runtime.GOARCH), overlayRef)
+			if err != nil {
+				return prof, fmt.Errorf("error getting extension image %s: %w", overlayRef.TaggedReference, err)
+			}
+
+			imageTargetPath, err := artifactProducer.GetOverlayImage(ctx, artifacts.Arch(prof.Arch), overlayRef)
 			if err != nil {
 				return prof, fmt.Errorf("error getting extension image %s: %w", overlayRef.TaggedReference, err)
 			}
@@ -362,9 +367,11 @@ func EnhanceFromSchematic(
 
 			prof.Overlay = &profile.OverlayOptions{
 				Name:         schematic.Overlay.Name,
-				Image:        profile.ContainerAsset{OCIPath: imagePath},
+				Image:        profile.ContainerAsset{OCIPath: imageNativePath},
 				ExtraOptions: schematic.Overlay.Options,
 			}
+
+			prof.Input.OverlayInstaller = profile.ContainerAsset{OCIPath: imageTargetPath}
 		}
 	}