Files
netboot.xyz/roles/netbootxyz/templates/checksums.txt.j2
T
Antony Messerli d059ddb7a8 Add UEFI Secure Boot support using iPXE v2.0.0 signed binaries
Downloads pre-built Microsoft-signed iPXE Secure Boot binaries from
the iPXE v2.0.0 release (ipxeboot.tar.gz) and packages them with a
templated autoexec.ipxe that chains into the netboot.xyz menu system.

Boot flow: UEFI firmware validates iPXE shim (Microsoft-signed) which
loads iPXE (signed by iPXE Secure Boot CA) which auto-loads
autoexec.ipxe (text script, no SB validation needed) which chains to
https://boot.netboot.xyz/menu.ipxe.

Changes:
- New generate_disks_secureboot.yml task to download and package
  signed iPXE binaries for x86_64 and ARM64
- New autoexec.ipxe.j2 template with DHCP, failsafe menu, and
  HTTPS/HTTP fallback chain to boot.netboot.xyz
- Bootloader entries and index.html sections for Secure Boot binaries
  served from ipxe/secureboot-x86_64/ and ipxe/secureboot-arm64/
- Checksum generation updated to handle subdirectories
- Debian menu template updated with shim command for Secure Boot
  kernel validation (no-op on non-SB systems)
- Production overrides enable Secure Boot generation

Closes #1745
2026-03-14 00:20:17 -05:00

24 lines
888 B
Django/Jinja

# {{ site_name }} bootloaders generated at {{ current_date.stdout }}
# iPXE Commit: {{ ipxe_repo }}/commit/{{ ipxe_git_checkout.after }}
{% for item in netboot_disks_stat.results %}
{{ item.stdout }}
{% endfor %}
{% if secureboot_x86_64_disks_stat is defined and secureboot_x86_64_disks_stat.results is defined %}
# Secure Boot x86_64 (iPXE {{ ipxe_secureboot_version }})
{% for item in secureboot_x86_64_disks_stat.results %}
{% if item.stdout is defined %}
{{ item.stdout | replace('*', '*secureboot-x86_64/') }}
{% endif %}
{% endfor %}
{% endif %}
{% if secureboot_arm64_disks_stat is defined and secureboot_arm64_disks_stat.results is defined %}
# Secure Boot ARM64 (iPXE {{ ipxe_secureboot_version }})
{% for item in secureboot_arm64_disks_stat.results %}
{% if item.stdout is defined %}
{{ item.stdout | replace('*', '*secureboot-arm64/') }}
{% endif %}
{% endfor %}
{% endif %}