mirror of
https://github.com/netbootxyz/netboot.xyz.git
synced 2026-08-24 02:34:12 -05:00
Antony Messerli
d059ddb7a8
Downloads pre-built Microsoft-signed iPXE Secure Boot binaries from the iPXE v2.0.0 release (ipxeboot.tar.gz) and packages them with a templated autoexec.ipxe that chains into the netboot.xyz menu system. Boot flow: UEFI firmware validates iPXE shim (Microsoft-signed) which loads iPXE (signed by iPXE Secure Boot CA) which auto-loads autoexec.ipxe (text script, no SB validation needed) which chains to https://boot.netboot.xyz/menu.ipxe. Changes: - New generate_disks_secureboot.yml task to download and package signed iPXE binaries for x86_64 and ARM64 - New autoexec.ipxe.j2 template with DHCP, failsafe menu, and HTTPS/HTTP fallback chain to boot.netboot.xyz - Bootloader entries and index.html sections for Secure Boot binaries served from ipxe/secureboot-x86_64/ and ipxe/secureboot-arm64/ - Checksum generation updated to handle subdirectories - Debian menu template updated with shim command for Secure Boot kernel validation (no-op on non-SB systems) - Production overrides enable Secure Boot generation Closes #1745
65 lines
1.8 KiB
YAML
65 lines
1.8 KiB
YAML
---
|
|
|
|
- name: Create Secure Boot output directories
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
with_items:
|
|
- "{{ netbootxyz_root }}/ipxe/secureboot-x86_64"
|
|
- "{{ netbootxyz_root }}/ipxe/secureboot-arm64"
|
|
|
|
- name: Download iPXE Secure Boot archive
|
|
ansible.builtin.get_url:
|
|
url: "{{ ipxe_secureboot_archive_url }}"
|
|
dest: "/tmp/ipxeboot.tar.gz"
|
|
|
|
- name: Extract iPXE Secure Boot archive
|
|
ansible.builtin.unarchive:
|
|
src: "/tmp/ipxeboot.tar.gz"
|
|
dest: "/tmp"
|
|
remote_src: true
|
|
|
|
- name: Copy x86_64 Secure Boot binaries to output directory
|
|
ansible.builtin.copy:
|
|
src: "/tmp/ipxeboot/x86_64-sb/{{ item }}"
|
|
dest: "{{ netbootxyz_root }}/ipxe/secureboot-x86_64/{{ item }}"
|
|
remote_src: true
|
|
with_items:
|
|
- ipxe.efi
|
|
- ipxe-shim.efi
|
|
- shimx64.efi
|
|
- snponly.efi
|
|
- snponly-shim.efi
|
|
|
|
- name: Copy ARM64 Secure Boot binaries to output directory
|
|
ansible.builtin.copy:
|
|
src: "/tmp/ipxeboot/arm64-sb/{{ item }}"
|
|
dest: "{{ netbootxyz_root }}/ipxe/secureboot-arm64/{{ item }}"
|
|
remote_src: true
|
|
with_items:
|
|
- ipxe.efi
|
|
- ipxe-shim.efi
|
|
- shimaa64.efi
|
|
- snponly.efi
|
|
- snponly-shim.efi
|
|
when: generate_disks_arm | default(false) | bool
|
|
|
|
- name: Template autoexec.ipxe for x86_64 Secure Boot
|
|
ansible.builtin.template:
|
|
src: "disks/autoexec.ipxe.j2"
|
|
dest: "{{ netbootxyz_root }}/ipxe/secureboot-x86_64/autoexec.ipxe"
|
|
|
|
- name: Template autoexec.ipxe for ARM64 Secure Boot
|
|
ansible.builtin.template:
|
|
src: "disks/autoexec.ipxe.j2"
|
|
dest: "{{ netbootxyz_root }}/ipxe/secureboot-arm64/autoexec.ipxe"
|
|
when: generate_disks_arm | default(false) | bool
|
|
|
|
- name: Clean up Secure Boot archive
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
with_items:
|
|
- "/tmp/ipxeboot.tar.gz"
|
|
- "/tmp/ipxeboot"
|