mirror of
https://github.com/netbootxyz/netboot.xyz.git
synced 2026-08-24 02:34:12 -05:00
Antony Messerli
d059ddb7a8
Downloads pre-built Microsoft-signed iPXE Secure Boot binaries from the iPXE v2.0.0 release (ipxeboot.tar.gz) and packages them with a templated autoexec.ipxe that chains into the netboot.xyz menu system. Boot flow: UEFI firmware validates iPXE shim (Microsoft-signed) which loads iPXE (signed by iPXE Secure Boot CA) which auto-loads autoexec.ipxe (text script, no SB validation needed) which chains to https://boot.netboot.xyz/menu.ipxe. Changes: - New generate_disks_secureboot.yml task to download and package signed iPXE binaries for x86_64 and ARM64 - New autoexec.ipxe.j2 template with DHCP, failsafe menu, and HTTPS/HTTP fallback chain to boot.netboot.xyz - Bootloader entries and index.html sections for Secure Boot binaries served from ipxe/secureboot-x86_64/ and ipxe/secureboot-arm64/ - Checksum generation updated to handle subdirectories - Debian menu template updated with shim command for Secure Boot kernel validation (no-op on non-SB systems) - Production overrides enable Secure Boot generation Closes #1745
26 lines
677 B
YAML
26 lines
677 B
YAML
---
|
|
sigs_menu: true
|
|
sigs_enabled: true
|
|
generate_disks_arm: true
|
|
generate_disks_hybrid: true
|
|
generate_disks_linux: true
|
|
generate_disks_rpi: false
|
|
generate_disks_secureboot: true
|
|
generate_version_file: true
|
|
generate_local_vars: false
|
|
make_num_jobs: 4
|
|
bootloader_multiple: true
|
|
bootloader_disks:
|
|
- "netboot.xyz"
|
|
- "netboot.xyz-metal"
|
|
generate_signatures: true
|
|
sigs_dir: "{{ netbootxyz_root }}/sigs"
|
|
sigs_location: "http://${boot_domain}/sigs/"
|
|
cert_dir: "/ansible/certs"
|
|
ipxe_branch: master
|
|
ipxe_ca_url: http://ca.ipxe.org/ca.crt
|
|
ipxe_ca_filename: ca-ipxe-org.crt
|
|
codesign_cert_filename: codesign.crt
|
|
codesign_key_filename: codesign.key
|
|
cert_file_filename: ca-netboot-xyz.crt
|