Downloads pre-built Microsoft-signed iPXE Secure Boot binaries from
the iPXE v2.0.0 release (ipxeboot.tar.gz) and packages them with a
templated autoexec.ipxe that chains into the netboot.xyz menu system.
Boot flow: UEFI firmware validates iPXE shim (Microsoft-signed) which
loads iPXE (signed by iPXE Secure Boot CA) which auto-loads
autoexec.ipxe (text script, no SB validation needed) which chains to
https://boot.netboot.xyz/menu.ipxe.
Changes:
- New generate_disks_secureboot.yml task to download and package
signed iPXE binaries for x86_64 and ARM64
- New autoexec.ipxe.j2 template with DHCP, failsafe menu, and
HTTPS/HTTP fallback chain to boot.netboot.xyz
- Bootloader entries and index.html sections for Secure Boot binaries
served from ipxe/secureboot-x86_64/ and ipxe/secureboot-arm64/
- Checksum generation updated to handle subdirectories
- Debian menu template updated with shim command for Secure Boot
kernel validation (no-op on non-SB systems)
- Production overrides enable Secure Boot generation
Closes#1745
- Update version.txt from 2.0.90 to 3.0.0
- Update boot_version from 2.x to 3.x in defaults/main.yml
- Update hardcoded version references in script/build_release
- Update example in user_overrides.yml
- Add 3.0.0 changelog entry with breaking change notice
- Users with 2.x bootloaders will auto-upgrade to 3.x on boot
IMPORTANT: Updated binaries should be downloaded to pull latest
netboot.xyz with updated code signing certificates embedded for
image signature verification.
Ensures bootloader_disks is set to one type to keep
index generation bound to one falvor type. Shifts generate
disk loop to use bootloader_flavors variable taht can be stacked
with multiple types.
Should fix issue causing the index to have the last name in the list
of bootloader_disks which was setting the incorrect name. This was
probably introduced with the change in:
https://github.com/netbootxyz/netboot.xyz/pull/1096
2.x is designated as a rolling release but usually is aligned
with an actual release. This commit will allow for updates
to endpoints.yml and the Ansible defaults that contains all
of the version updates to be pushed to boot.netboot.xyz
automatically as they are come in.
This will allow version updates like ArchLinux to be rolled out
immediately with out the lag during releases.
Adds the local-vars.ipxe file which can be updated
for changes. Local vars is parsed on bootup if
the next-server and filename are both set on the
local dhcp server.
With the recent changes to Travis CI, it seemed
like a good time to begin porting netboot.xyz CI
over to Github Actions to keep everything in on
place. These are the changes for the main
netboot.xyz repo.
Pins iPXE branch as arm64 build is failing with a
Unrecognised relocation type 311. It appears that
iPXE upstream may have introduced a change causing
build to fail in commit
a61b27b97f572a83ede765a0e779694865950cf2
Cleans up code and removes external OS signature checking code
as it's not very reliable and not currently being used.
Source signature checking will remain in place.
Reduce amount of generated disks
Readme updates, adds version.ipxe for menu version
Generates version.ipxe from version.txt. Used to show the
latest version upstream on the main site. Disabled by default
for regular deployments but enabled as an upstream option.
* Shifting after_deploy messages and aws invalidation to
proper locations
* Add cert checkout to preinstall and setting those on s3
deploys only
* Adding production docker file which runs netboot.xyz overrides
* Only display sig menus if enabled
* Fix var names for signing
* Bumps Arch and Black Arch to latest
* Drops sigs from Arch
* Drops Debian Jessie and Wheezy - EOL
* Changes Fedora Core OS syntax, disabled as not working currently
* Corrects checksum file name
* Changes AlpineLinux kernel names for edge
* Fixes CentOS url
* Fixes Arch url
* Adds netboot.xyz overrides file
* Disables Devuan as mirror cert is expired
* Drops Fedora Workstation and Atomic
Antony Messerli
Dustin Miller
Antony Messerli
thelamer