After ISO/USB images are generated from the secureboot directories,
move autoexec.ipxe to the ipxe root as a standalone file and remove
the secureboot directories. This means:
- Checksums are generated cleanly with no secureboot-* subdirectory entries
- autoexec.ipxe is checksummed automatically as a regular ipxe/ file
- build_release needs no special handling for secureboot directories
- autoexec.ipxe flows naturally into both githubout (release asset)
and s3out (CDN) through the existing copy logic
The Ansible-generated checksums file references files under
secureboot-x86_64/ and secureboot-arm64/ which are removed from
githubout. Strip those entries and add the standalone autoexec.ipxe
so the checksums file matches the actual release assets.
Ensure autoexec.ipxe is available at the root of the S3 bucket
(boot.netboot.xyz/{version}/autoexec.ipxe) alongside other boot
files, not only nested under ipxe/secureboot-x86_64/.
Instead of repackaging the iPXE signed binaries into netboot.xyz
tarballs, publish only the templated autoexec.ipxe boot script as a
release asset. Consumers (e.g. docker-netbootxyz) download the signed
binaries directly from the upstream iPXE release (ipxeboot.tar.gz),
preserving provenance and avoiding checksum mismatches from
repackaging.
The autoexec.ipxe is identical for both x86_64 and ARM64 -- it
contains the netboot.xyz-specific boot_domain, boot_version, and
menu chain logic with DHCP, failsafe menu, and HTTPS/HTTP fallback.
The Secure Boot directories (secureboot-x86_64/, secureboot-arm64/)
produced by generate_disks_secureboot cannot be uploaded directly as
GitHub release assets since releases are flat file lists. Package them
into secureboot-x86_64.tar.gz and secureboot-arm64.tar.gz so they are
included in the release alongside existing boot files.
This enables docker-netbootxyz and other consumers to download the
signed iPXE Secure Boot binaries and autoexec.ipxe directly from
netboot.xyz releases.
Downloads pre-built Microsoft-signed iPXE Secure Boot binaries from
the iPXE v2.0.0 release (ipxeboot.tar.gz) and packages them with a
templated autoexec.ipxe that chains into the netboot.xyz menu system.
Boot flow: UEFI firmware validates iPXE shim (Microsoft-signed) which
loads iPXE (signed by iPXE Secure Boot CA) which auto-loads
autoexec.ipxe (text script, no SB validation needed) which chains to
https://boot.netboot.xyz/menu.ipxe.
Changes:
- New generate_disks_secureboot.yml task to download and package
signed iPXE binaries for x86_64 and ARM64
- New autoexec.ipxe.j2 template with DHCP, failsafe menu, and
HTTPS/HTTP fallback chain to boot.netboot.xyz
- Bootloader entries and index.html sections for Secure Boot binaries
served from ipxe/secureboot-x86_64/ and ipxe/secureboot-arm64/
- Checksum generation updated to handle subdirectories
- Debian menu template updated with shim command for Secure Boot
kernel validation (no-op on non-SB systems)
- Production overrides enable Secure Boot generation
Closes#1745
- Update version.txt from 2.0.90 to 3.0.0
- Update boot_version from 2.x to 3.x in defaults/main.yml
- Update hardcoded version references in script/build_release
- Update example in user_overrides.yml
- Add 3.0.0 changelog entry with breaking change notice
- Users with 2.x bootloaders will auto-upgrade to 3.x on boot
IMPORTANT: Updated binaries should be downloaded to pull latest
netboot.xyz with updated code signing certificates embedded for
image signature verification.
Ensures bootloader_disks is set to one type to keep
index generation bound to one falvor type. Shifts generate
disk loop to use bootloader_flavors variable taht can be stacked
with multiple types.
Should fix issue causing the index to have the last name in the list
of bootloader_disks which was setting the incorrect name. This was
probably introduced with the change in:
https://github.com/netbootxyz/netboot.xyz/pull/1096
2.x is designated as a rolling release but usually is aligned
with an actual release. This commit will allow for updates
to endpoints.yml and the Ansible defaults that contains all
of the version updates to be pushed to boot.netboot.xyz
automatically as they are come in.
This will allow version updates like ArchLinux to be rolled out
immediately with out the lag during releases.
Adds the local-vars.ipxe file which can be updated
for changes. Local vars is parsed on bootup if
the next-server and filename are both set on the
local dhcp server.
With the recent changes to Travis CI, it seemed
like a good time to begin porting netboot.xyz CI
over to Github Actions to keep everything in on
place. These are the changes for the main
netboot.xyz repo.
Pins iPXE branch as arm64 build is failing with a
Unrecognised relocation type 311. It appears that
iPXE upstream may have introduced a change causing
build to fail in commit
a61b27b97f572a83ede765a0e779694865950cf2
Cleans up code and removes external OS signature checking code
as it's not very reliable and not currently being used.
Source signature checking will remain in place.
Reduce amount of generated disks
Readme updates, adds version.ipxe for menu version
Generates version.ipxe from version.txt. Used to show the
latest version upstream on the main site. Disabled by default
for regular deployments but enabled as an upstream option.
* Shifting after_deploy messages and aws invalidation to
proper locations
* Add cert checkout to preinstall and setting those on s3
deploys only
* Adding production docker file which runs netboot.xyz overrides
* Only display sig menus if enabled
* Fix var names for signing
