mirror of
https://github.com/netbootxyz/netboot.xyz.git
synced 2026-08-24 02:34:12 -05:00
Antony Messerli
d059ddb7a8
Downloads pre-built Microsoft-signed iPXE Secure Boot binaries from the iPXE v2.0.0 release (ipxeboot.tar.gz) and packages them with a templated autoexec.ipxe that chains into the netboot.xyz menu system. Boot flow: UEFI firmware validates iPXE shim (Microsoft-signed) which loads iPXE (signed by iPXE Secure Boot CA) which auto-loads autoexec.ipxe (text script, no SB validation needed) which chains to https://boot.netboot.xyz/menu.ipxe. Changes: - New generate_disks_secureboot.yml task to download and package signed iPXE binaries for x86_64 and ARM64 - New autoexec.ipxe.j2 template with DHCP, failsafe menu, and HTTPS/HTTP fallback chain to boot.netboot.xyz - Bootloader entries and index.html sections for Secure Boot binaries served from ipxe/secureboot-x86_64/ and ipxe/secureboot-arm64/ - Checksum generation updated to handle subdirectories - Debian menu template updated with shim command for Secure Boot kernel validation (no-op on non-SB systems) - Production overrides enable Secure Boot generation Closes #1745
71 lines
2.5 KiB
YAML
71 lines
2.5 KiB
YAML
---
|
|
- name: Register a listing of all created iPXE bootloaders
|
|
ansible.builtin.shell: ls -p -I {{ checksums_filename }} {{ netbootxyz_root }}/ipxe/ | grep -v /
|
|
register: netboot_disks
|
|
|
|
- name: Generate date
|
|
ansible.builtin.command: date
|
|
register: current_date
|
|
|
|
- name: Gather stat listing of directory
|
|
ansible.builtin.command: sha256sum -b {{ item }}
|
|
with_items:
|
|
- "{{ netboot_disks.stdout_lines }}"
|
|
args:
|
|
chdir: "{{ netbootxyz_root }}/ipxe/"
|
|
register: netboot_disks_stat
|
|
|
|
- name: Register Secure Boot x86_64 bootloaders
|
|
ansible.builtin.shell: ls {{ netbootxyz_root }}/ipxe/secureboot-x86_64/ 2>/dev/null || true
|
|
register: secureboot_x86_64_disks
|
|
when: generate_disks_secureboot | default(false) | bool
|
|
|
|
- name: Gather Secure Boot x86_64 checksums
|
|
ansible.builtin.command: sha256sum -b {{ item }}
|
|
with_items:
|
|
- "{{ secureboot_x86_64_disks.stdout_lines | default([]) }}"
|
|
args:
|
|
chdir: "{{ netbootxyz_root }}/ipxe/secureboot-x86_64/"
|
|
register: secureboot_x86_64_disks_stat
|
|
when:
|
|
- generate_disks_secureboot | default(false) | bool
|
|
- secureboot_x86_64_disks.stdout_lines | default([]) | length > 0
|
|
|
|
- name: Register Secure Boot ARM64 bootloaders
|
|
ansible.builtin.shell: ls {{ netbootxyz_root }}/ipxe/secureboot-arm64/ 2>/dev/null || true
|
|
register: secureboot_arm64_disks
|
|
when:
|
|
- generate_disks_secureboot | default(false) | bool
|
|
- generate_disks_arm | default(false) | bool
|
|
|
|
- name: Gather Secure Boot ARM64 checksums
|
|
ansible.builtin.command: sha256sum -b {{ item }}
|
|
with_items:
|
|
- "{{ secureboot_arm64_disks.stdout_lines | default([]) }}"
|
|
args:
|
|
chdir: "{{ netbootxyz_root }}/ipxe/secureboot-arm64/"
|
|
register: secureboot_arm64_disks_stat
|
|
when:
|
|
- generate_disks_secureboot | default(false) | bool
|
|
- generate_disks_arm | default(false) | bool
|
|
- secureboot_arm64_disks.stdout_lines | default([]) | length > 0
|
|
|
|
- name: Generate ipxe disk checksums
|
|
ansible.builtin.template:
|
|
src: checksums.txt.j2
|
|
dest: "{{ netbootxyz_root }}/ipxe/{{ checksums_filename }}"
|
|
|
|
- name: Generate site name banner for index
|
|
ansible.builtin.shell: toilet -f standard {{ site_name }} --html | grep span
|
|
register: index_title
|
|
when: ansible_os_family == "Debian"
|
|
|
|
- name: Reset bootloader filename to first in list
|
|
ansible.builtin.set_fact:
|
|
bootloader_filename: "{{ bootloader_disks | first }}"
|
|
|
|
- name: Generate netboot.xyz index template
|
|
ansible.builtin.template:
|
|
src: index.html.j2
|
|
dest: "{{ netbootxyz_root }}/index.html"
|