Secure Boot: document the staged ipxe.efi fallback chain - #90
Merged
Conversation
fog-ipxe v2.0.0-fog.3 stages a second signed chain beside snponly, so a site whose firmware UEFI SNP is broken now has a fallback that needs nothing but a DHCP change. The page already mentioned upstream's all-drivers ipxe.efi, but framed it as something you go and fetch from the upstream tarball yourself. It is staged for you now, so that tip is replaced by a symptom-led subsection under step 3a: an admin hitting this has no way to know the fault is in their firmware's network stack, and "loads but the network never comes up" is the only signal that distinguishes the two chains. Placed after the autoexec.ipxe discussion rather than before it, because that discussion applies to both chains equally. Added a version note: an install pinned to an earlier fog-ipxe release stages only the snponly pair, and MANIFEST is what tells you which you have. Not added to the step-3 troubleshooting table -- that table is scoped to kernel signature violations, and a dead network stack is not one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
fog-ipxe v2.0.0-fog.3 stages a second signed Secure Boot chain beside
snponly, ending the situation where Secure Boot was the one boot path in FOG with no fallback loader. Server-side changes are in FOGProject/fogproject#979 (working-1.6) and #980 (dev-branch).Why
The two signed loaders fail on disjoint hardware:
snponly.efibinds the firmware's own UEFI network protocol. Right default — it's whatever the vendor shipped and tested — but dead where SNP is broken or absent.ipxe.efireplaces the NIC driver with iPXE's own. Recovers exactly those machines, and hangs where the takeover fails.Non-Secure-Boot installs have always had that choice via DHCP option 67.
What changed in the page
The staged-directory listing now shows all four files, with a line on what distinguishes the two loaders.
The existing tip about
ipxe.efiis replaced. The page already mentioned upstream publishes an all-drivers build, but framed it as something you go and fetch from the upstream tarball yourself — it's staged for you now.A new symptom-led subsection under step 3a, "If the chain loads but the network never comes up". An admin hitting this has no way to know the fault is in their firmware's network stack, and that symptom is the only signal distinguishing the two chains — so naming it is what makes the fallback reachable rather than a second filename to guess between.
A version note, since an install pinned to an earlier fog-ipxe release stages only the
snponlypair, andMANIFESTis what tells you which you have.Editorial notes
autoexec.ipxediscussion, not before it — that discussion applies to both chains equally, so scoping it under a fallback heading would have been wrong.#3a-serve-the-signed-chainfollows the existing convention in this file (em dash dropped to a single hyphen, as in#step-1-the-signing-key).🤖 Generated with Claude Code