Secure Boot: publish and document the ipxe.efi fallback chain

[mastacontrola]

Summary

Secure Boot was the one boot path in FOG with no fallback loader. fog-ipxe#2 (released as v2.0.0-fog.3) stages a second signed chain; this points the installer at that release and tells the admin the fallback exists.

Why a fallback was needed

The two signed loaders fail on disjoint hardware:

• snponly.efi drives the NIC through the firmware's own UEFI SNP protocol. Right default — it's whatever the vendor shipped and tested — but dead in the water where SNP is broken or absent.
• ipxe.efi carries iPXE's native drivers and takes the NIC over from the firmware. Recovers exactly those machines, and hangs where the takeover fails.

Non-Secure-Boot installs have always had that choice via DHCP option 67. A Secure Boot site had nothing to move to.

What changed

1. FOG_IPXE_VERSION → v2.0.0-fog.3 — the release that first carries the new chain. Without the bump the paragraph below names a boot file the installer never downloads, which is worse than not documenting it: the admin points DHCP at a path that TFTP 404s and cannot tell that from a broken chain. iPXE itself is unchanged at v2.0.0; only the fog-ipxe packaging moved.

2. One paragraph on the Secure Boot configuration page, framed by symptom rather than by binary:

If that chain loads but the network never comes up, the firmware's own UEFI network stack is at fault. Point the boot filename at secureboot/ipxe-shimx64.efi instead, which uses iPXE's built-in NIC drivers rather than the firmware's. Arm64 clients use the files under secureboot/arm64-efi/.

An admin hitting this has no way to know the fault is in their firmware's network stack, and "loads but no network" is the only signal that distinguishes the two chains. shim resolves its second stage from its own filename, so switching is purely a DHCP change with nothing to rename server-side.

Verification

Against the published fog-ipxe-secureboot-v2.0.0-fog.3.tar.gz:

• Tarball matches its .sha256 asset.
• Contains all four loaders and both shim names, for x86_64 and arm64.
• Every loader is byte-identical to its upstream source in ipxeboot.tar.gz (compared against a separately downloaded copy).

No installer logic change: configureTFTPandPXE copies the staged tree wholesale, and the autoexec.ipxe hard-link loop already covers secureboot/ and secureboot/arm64-efi/.

php -l clean. No FOG_BCACHE_VER bump needed — PHP only, no JS/CSS touched.

dev-branch needs the same two changes and follows as its own PR per the branch convention.

🤖 Generated with Claude Code