Make autoexec.ipxe the boot script, not the opt-in

[mastacontrola]

Installer half of fog-ipxe#7, which stops embedding a script in any EFI binary. Publish autoexec.ipxe at the TFTP root, hard-link it beside every EFI binary, retire the autoexec/ tree that no longer ships, and add --boot-delay so the 10-second STP/powersave sleep is a setting rather than a second set of binaries.

Do not merge before fog-ipxe#7 is tagged and the FOG_IPXE_VERSION bump is added here. The installer expects the new tarball layout; against v2.0.0-fog.7 it would delete the autoexec/ tree that release still depends on.

What reversed

configureTFTPandPXE() used to delete any autoexec.ipxe at the TFTP root. That comment is worth keeping in mind, because the reasoning still holds — it is the premise that changed:

efi_probe() calls efi_autoexec_load() unconditionally, so an EMBED-marked binary downloads autoexec.ipxe and then never runs it, because first_image() returns the embedded script ahead of it. Nothing unregisters it, so initrd_load_all() concatenates 2 KB of iPXE script ahead of init.xz and the kernel panics with VFS: Unable to mount root fs on "/dev/ram0" (forums #18213). efi_autoexec_network() falls back to /autoexec.ipxe when the binary's own directory has none, so one embedded EFI binary anywhere was enough to poison every client that fell back to the root.

With no EFI binary embedding anything, the script is executed rather than merely registered, and image_exec() unregisters it for the duration — so it is gone before boot runs. Legacy BIOS is untouched: no efi_autoexec_load() there, so a root autoexec.ipxe is a file it never asks for.

--boot-delay

Seconds of sleep before the first DHCP attempt. Bounded 0–120: this is a wait every client sits through on every boot, and a fat-fingered 600 is indistinguishable from a hung PXE stack to whoever is standing at the machine.

_applyBootDelay() brackets the inserted lines with sentinel comments rather than matching on the sleep line, so an admin's own sleep is never eaten and the option works in both directions — lowering or clearing rewrites the block exactly like raising it. Verified as a unit: insert → change value → clear round-trips to a file byte-identical to the original, and re-applying the same value is stable.

It writes in place with a redirect rather than a temp-and-mv, because by then the file may already be hard-linked and a rename would leave those links on the old inode — the drift the links exist to prevent.

BIOS cannot be served this way and 10secdelay/ is exactly ten seconds, so _biosBootFile() maps any non-zero delay to that build (both the ISC and Kea generators) and the run says so when the two cannot agree.

The manifest trap

_copyIpxeTree() hashes each file as it lays it down, and _applyBootDelay() rewrites autoexec.ipxe afterwards. Without re-stamping, the next run reads the difference as "the admin replaced this file", declines to update it, and the boot script is frozen for good — the same trap _signLocalIpxe() hits, for the same reason. _restampIpxeManifest() is called for autoexec.ipxe and every path it is linked into.

Breaking

A DHCP filename beginning autoexec/ stops resolving; drop the prefix. FOG's own generated dhcpd.conf and Kea config never used those paths, so only hand-written configs are affected. _retireAutoexecDir() deletes the stale tree rather than leaving it — it would otherwise go on serving whichever release last created it, getting quietly older every upgrade while looking maintained — and prints the mapping.

Still to do on this PR

• FOG_IPXE_VERSION → v2.0.0-fog.8 once tagged
• Live boot test on the Secure Boot VM
• fog-docs note for the autoexec/ filename change

🤖 Generated with Claude Code