mirror of
https://github.com/netbootxyz/netboot.xyz.git
synced 2026-08-24 10:14:02 -05:00
Antony Messerli
d059ddb7a8
Downloads pre-built Microsoft-signed iPXE Secure Boot binaries from the iPXE v2.0.0 release (ipxeboot.tar.gz) and packages them with a templated autoexec.ipxe that chains into the netboot.xyz menu system. Boot flow: UEFI firmware validates iPXE shim (Microsoft-signed) which loads iPXE (signed by iPXE Secure Boot CA) which auto-loads autoexec.ipxe (text script, no SB validation needed) which chains to https://boot.netboot.xyz/menu.ipxe. Changes: - New generate_disks_secureboot.yml task to download and package signed iPXE binaries for x86_64 and ARM64 - New autoexec.ipxe.j2 template with DHCP, failsafe menu, and HTTPS/HTTP fallback chain to boot.netboot.xyz - Bootloader entries and index.html sections for Secure Boot binaries served from ipxe/secureboot-x86_64/ and ipxe/secureboot-arm64/ - Checksum generation updated to handle subdirectories - Debian menu template updated with shim command for Secure Boot kernel validation (no-op on non-SB systems) - Production overrides enable Secure Boot generation Closes #1745
99 lines
2.5 KiB
Django/Jinja
99 lines
2.5 KiB
Django/Jinja
#!ipxe
|
|
#
|
|
# {{ site_name }} - Secure Boot autoexec.ipxe
|
|
#
|
|
# This script is loaded automatically by iPXE v2.0.0+ Secure Boot
|
|
# binaries from the same directory. It replaces the embedded script
|
|
# used in self-compiled netboot.xyz bootloaders.
|
|
#
|
|
|
|
set esc:hex 1b
|
|
set bold ${esc:string}[1m
|
|
set boldoff ${esc:string}[22m
|
|
set fg_gre ${esc:string}[32m
|
|
set fg_cya ${esc:string}[36m
|
|
set fg_whi ${esc:string}[37m
|
|
set HTTPS_ERR HTTPS appears to have failed... attempting HTTP
|
|
set HTTP_ERR HTTP has failed, localbooting...
|
|
set site_name {{ site_name }}
|
|
set boot_domain {{ boot_domain }}
|
|
set ipxe_version ${version}
|
|
set version {{ boot_version }}
|
|
set conn_type https
|
|
|
|
:start
|
|
echo ${bold}${fg_gre}${site_name} - ${fg_whi}v${version} (Secure Boot)${boldoff}
|
|
iseq ${site_name} netboot.xyz || echo ${bold}${fg_whi}Powered by ${fg_gre}netboot.xyz${fg_whi}${boldoff}
|
|
prompt --key m --timeout 4000 Hit the ${bold}m${boldoff} key to open failsafe menu... && goto failsafe || goto dhcp
|
|
|
|
:dhcp
|
|
echo
|
|
dhcp || goto netconfig
|
|
goto menu
|
|
|
|
:failsafe
|
|
menu ${boot_domain} Failsafe Menu
|
|
item localboot Boot to local drive
|
|
item netconfig Manual network configuration
|
|
item retry Retry boot
|
|
item debug iPXE Debug Shell
|
|
item reboot Reboot System
|
|
choose failsafe_choice || exit
|
|
goto ${failsafe_choice}
|
|
|
|
:netconfig
|
|
echo Network Configuration:
|
|
echo Available interfaces...
|
|
ifstat
|
|
imgfree
|
|
echo -n Set network interface number [0 for net0, defaults to 0]: ${} && read net
|
|
isset ${net} || set net 0
|
|
echo -n IP: && read net${net}/ip
|
|
echo -n Subnet mask: && read net${net}/netmask
|
|
echo -n Gateway: && read net${net}/gateway
|
|
echo -n DNS: && read dns
|
|
ifopen net${net}
|
|
echo Attempting chainload of ${boot_domain}...
|
|
goto menu || goto failsafe
|
|
|
|
:menu
|
|
{% if bootloader_https_enabled | bool %}
|
|
:menu_https
|
|
set conn_type https
|
|
goto menu_start
|
|
{% endif %}
|
|
|
|
{% if bootloader_http_enabled | bool %}
|
|
:menu_http
|
|
set conn_type http
|
|
goto menu_start
|
|
{% endif %}
|
|
|
|
:menu_start
|
|
isset ${netX/dns6} && goto menu_v6 || goto menu_v4
|
|
:menu_v6
|
|
isset ${netX/dns6_bak} && set netX/dns6 ${netX/dns6_bak} ||
|
|
set netX/dns6_bak ${netX/dns6}
|
|
echo Attempting ${conn_type} boot over IPv6...
|
|
chain --autofree ${conn_type}://${boot_domain}/menu.ipxe || echo ${conn_type} IPv6 failed... attempting IPv4...
|
|
clear netX/dns6
|
|
:menu_v4
|
|
echo Attempting ${conn_type} boot over IPv4...
|
|
chain --autofree ${conn_type}://${boot_domain}/menu.ipxe || echo ${conn_type} IPv4 failed...
|
|
iseq ${conn_type} https && goto menu_http || goto localboot
|
|
|
|
:localboot
|
|
exit
|
|
|
|
:retry
|
|
goto start
|
|
|
|
:reboot
|
|
reboot
|
|
goto start
|
|
|
|
:debug
|
|
echo Type "exit" to return to menu
|
|
shell
|
|
goto failsafe
|