From 17e7881059133b182b22502484873188915be6fc Mon Sep 17 00:00:00 2001 From: Tom Elliott Date: Mon, 3 Aug 2026 08:52:23 -0500 Subject: [PATCH 1/2] Secure Boot: document the ipxe.efi fallback chain The page named exactly one DHCP boot filename, secureboot/snponly-shimx64.efi. fog-ipxe now stages a second signed chain beside it, so a site whose firmware UEFI SNP is broken has somewhere to go -- but only if it knows the file is there, which is the whole reason this paragraph exists. Framed by symptom rather than by binary ("loads but the network never comes up") because an admin hitting this has no way to know the fault is in their firmware's network stack, and that is the only signal that distinguishes the two chains. shim resolves its second stage from its own filename, so switching is purely a DHCP change with nothing to rename server-side. Co-Authored-By: Claude Opus 5 --- .../lib/pages/fogconfigurationpage.page.php | 19 +++++++++++++++++++ .../de_DE.UTF-8/LC_MESSAGES/messages.po | 10 ++++++++++ .../en_US.UTF-8/LC_MESSAGES/messages.po | 10 ++++++++++ .../es_ES.UTF-8/LC_MESSAGES/messages.po | 10 ++++++++++ .../eu_ES.UTF-8/LC_MESSAGES/messages.po | 10 ++++++++++ .../fr_FR.UTF-8/LC_MESSAGES/messages.po | 10 ++++++++++ .../it_IT.UTF-8/LC_MESSAGES/messages.po | 10 ++++++++++ .../ja_JP.UTF-8/LC_MESSAGES/messages.po | 10 ++++++++++ .../web/management/languages/messages.pot | 10 ++++++++++ .../pt_BR.UTF-8/LC_MESSAGES/messages.po | 10 ++++++++++ .../zh_CN.UTF-8/LC_MESSAGES/messages.po | 10 ++++++++++ 11 files changed, 119 insertions(+) diff --git a/packages/web/lib/pages/fogconfigurationpage.page.php b/packages/web/lib/pages/fogconfigurationpage.page.php index 5ebb6614d9..9109097888 100644 --- a/packages/web/lib/pages/fogconfigurationpage.page.php +++ b/packages/web/lib/pages/fogconfigurationpage.page.php @@ -438,6 +438,25 @@ public function secureBoot() . 'boot file is unsigned and a Secure Boot client will refuse it' ) ) . '

'; + // Two signed chains are staged, mirroring the snponly/ipxe choice + // every non-Secure-Boot install already has. shim resolves its second + // stage from its OWN filename, so switching chains is purely a DHCP + // change -- there is nothing to rename server-side. Documented here + // because a site whose firmware SNP is broken otherwise has no way to + // know a fallback exists. + $steps .= '

' . sprintf( + '%s secureboot/ipxe-shimx64.efi %s.', + _( + 'If that chain loads but the network never comes up, the ' + . 'firmware\'s own UEFI network stack is at fault. Point the ' + . 'boot filename at' + ), + _( + 'instead, which uses iPXE\'s built-in NIC drivers rather than ' + . 'the firmware\'s. Arm64 clients use the files under ' + . 'secureboot/arm64-efi/' + ) + ) . '

'; // Stated rather than detected: the web request's own scheme says // nothing about the install's $httpproto, so guessing here would be // worse than telling the admin what to check. See diff --git a/packages/web/management/languages/de_DE.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/de_DE.UTF-8/LC_MESSAGES/messages.po index f83086cbb5..ae8e85581d 100644 --- a/packages/web/management/languages/de_DE.UTF-8/LC_MESSAGES/messages.po +++ b/packages/web/management/languages/de_DE.UTF-8/LC_MESSAGES/messages.po @@ -3136,6 +3136,11 @@ msgid "" "If disabled, the client will not make changes until all users are logged off" msgstr "" +msgid "" +"If that chain loads but the network never comes up, the firmware's own UEFI " +"network stack is at fault. Point the boot filename at" +msgstr "" + msgid "If this is an upgrade" msgstr "Falls dies ein Upgrade ist," @@ -8398,6 +8403,11 @@ msgstr "in Sekunden" msgid "initrd (Initial Ramdisk) Update" msgstr "" +msgid "" +"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. " +"Arm64 clients use the files under secureboot/arm64-efi/" +msgstr "" + #, fuzzy msgid "is already being sent by another node" msgstr "Die MAC-Adresse wird bereits von einem andern Host verwendet" diff --git a/packages/web/management/languages/en_US.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/en_US.UTF-8/LC_MESSAGES/messages.po index 93ae7322aa..e517177541 100644 --- a/packages/web/management/languages/en_US.UTF-8/LC_MESSAGES/messages.po +++ b/packages/web/management/languages/en_US.UTF-8/LC_MESSAGES/messages.po @@ -3135,6 +3135,11 @@ msgid "" "If disabled, the client will not make changes until all users are logged off" msgstr "" +msgid "" +"If that chain loads but the network never comes up, the firmware's own UEFI " +"network stack is at fault. Point the boot filename at" +msgstr "" + msgid "If this is an upgrade" msgstr "" @@ -8389,6 +8394,11 @@ msgstr "" msgid "initrd (Initial Ramdisk) Update" msgstr "" +msgid "" +"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. " +"Arm64 clients use the files under secureboot/arm64-efi/" +msgstr "" + #, fuzzy msgid "is already being sent by another node" msgstr "MAC address is already in use by another host" diff --git a/packages/web/management/languages/es_ES.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/es_ES.UTF-8/LC_MESSAGES/messages.po index cef2760364..3228ff23dd 100644 --- a/packages/web/management/languages/es_ES.UTF-8/LC_MESSAGES/messages.po +++ b/packages/web/management/languages/es_ES.UTF-8/LC_MESSAGES/messages.po @@ -3203,6 +3203,11 @@ msgid "" "If disabled, the client will not make changes until all users are logged off" msgstr "" +msgid "" +"If that chain loads but the network never comes up, the firmware's own UEFI " +"network stack is at fault. Point the boot filename at" +msgstr "" + msgid "If this is an upgrade" msgstr "" @@ -8546,6 +8551,11 @@ msgstr "" msgid "initrd (Initial Ramdisk) Update" msgstr "" +msgid "" +"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. " +"Arm64 clients use the files under secureboot/arm64-efi/" +msgstr "" + #, fuzzy msgid "is already being sent by another node" msgstr "La dirección MAC ya está en uso por otro host" diff --git a/packages/web/management/languages/eu_ES.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/eu_ES.UTF-8/LC_MESSAGES/messages.po index 450e92cf7f..bc9ef9856f 100644 --- a/packages/web/management/languages/eu_ES.UTF-8/LC_MESSAGES/messages.po +++ b/packages/web/management/languages/eu_ES.UTF-8/LC_MESSAGES/messages.po @@ -3136,6 +3136,11 @@ msgid "" "If disabled, the client will not make changes until all users are logged off" msgstr "" +msgid "" +"If that chain loads but the network never comes up, the firmware's own UEFI " +"network stack is at fault. Point the boot filename at" +msgstr "" + msgid "If this is an upgrade" msgstr "Falls dies ein Upgrade ist," @@ -8399,6 +8404,11 @@ msgstr "in Sekunden" msgid "initrd (Initial Ramdisk) Update" msgstr "" +msgid "" +"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. " +"Arm64 clients use the files under secureboot/arm64-efi/" +msgstr "" + #, fuzzy msgid "is already being sent by another node" msgstr "Liste der MAC-Adressen" diff --git a/packages/web/management/languages/fr_FR.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/fr_FR.UTF-8/LC_MESSAGES/messages.po index b830718869..245389c546 100644 --- a/packages/web/management/languages/fr_FR.UTF-8/LC_MESSAGES/messages.po +++ b/packages/web/management/languages/fr_FR.UTF-8/LC_MESSAGES/messages.po @@ -3139,6 +3139,11 @@ msgid "" "If disabled, the client will not make changes until all users are logged off" msgstr "" +msgid "" +"If that chain loads but the network never comes up, the firmware's own UEFI " +"network stack is at fault. Point the boot filename at" +msgstr "" + msgid "If this is an upgrade" msgstr "" @@ -8397,6 +8402,11 @@ msgstr "" msgid "initrd (Initial Ramdisk) Update" msgstr "" +msgid "" +"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. " +"Arm64 clients use the files under secureboot/arm64-efi/" +msgstr "" + #, fuzzy msgid "is already being sent by another node" msgstr "L'adresse MAC est déjà utilisée par un autre hôte" diff --git a/packages/web/management/languages/it_IT.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/it_IT.UTF-8/LC_MESSAGES/messages.po index 63ae88e33a..a817ec10be 100644 --- a/packages/web/management/languages/it_IT.UTF-8/LC_MESSAGES/messages.po +++ b/packages/web/management/languages/it_IT.UTF-8/LC_MESSAGES/messages.po @@ -3028,6 +3028,11 @@ msgid "" "If disabled, the client will not make changes until all users are logged off" msgstr "" +msgid "" +"If that chain loads but the network never comes up, the firmware's own UEFI " +"network stack is at fault. Point the boot filename at" +msgstr "" + msgid "If this is an upgrade" msgstr "Se questo è un aggiornamento" @@ -8041,6 +8046,11 @@ msgstr "in secondi" msgid "initrd (Initial Ramdisk) Update" msgstr "" +msgid "" +"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. " +"Arm64 clients use the files under secureboot/arm64-efi/" +msgstr "" + #, fuzzy msgid "is already being sent by another node" msgstr "L'indirizzo MAC è già in uso da un altro host" diff --git a/packages/web/management/languages/ja_JP.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/ja_JP.UTF-8/LC_MESSAGES/messages.po index 6f46d0f4f5..df21648bb3 100644 --- a/packages/web/management/languages/ja_JP.UTF-8/LC_MESSAGES/messages.po +++ b/packages/web/management/languages/ja_JP.UTF-8/LC_MESSAGES/messages.po @@ -2999,6 +2999,11 @@ msgid "" "If disabled, the client will not make changes until all users are logged off" msgstr "" +msgid "" +"If that chain loads but the network never comes up, the firmware's own UEFI " +"network stack is at fault. Point the boot filename at" +msgstr "" + msgid "If this is an upgrade" msgstr "アップグレードの場合" @@ -7966,6 +7971,11 @@ msgstr "秒単位" msgid "initrd (Initial Ramdisk) Update" msgstr "" +msgid "" +"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. " +"Arm64 clients use the files under secureboot/arm64-efi/" +msgstr "" + #, fuzzy msgid "is already being sent by another node" msgstr "MAC アドレスは別のホストで既に使用されています" diff --git a/packages/web/management/languages/messages.pot b/packages/web/management/languages/messages.pot index 6f83c156d5..eed96274eb 100644 --- a/packages/web/management/languages/messages.pot +++ b/packages/web/management/languages/messages.pot @@ -2645,6 +2645,11 @@ msgid "" "If disabled, the client will not make changes until all users are logged off" msgstr "" +msgid "" +"If that chain loads but the network never comes up, the firmware's own UEFI " +"network stack is at fault. Point the boot filename at" +msgstr "" + msgid "If this is an upgrade" msgstr "" @@ -7100,6 +7105,11 @@ msgstr "" msgid "initrd (Initial Ramdisk) Update" msgstr "" +msgid "" +"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. " +"Arm64 clients use the files under secureboot/arm64-efi/" +msgstr "" + msgid "is already being sent by another node" msgstr "" diff --git a/packages/web/management/languages/pt_BR.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/pt_BR.UTF-8/LC_MESSAGES/messages.po index 329a668100..bcbe1d77c2 100644 --- a/packages/web/management/languages/pt_BR.UTF-8/LC_MESSAGES/messages.po +++ b/packages/web/management/languages/pt_BR.UTF-8/LC_MESSAGES/messages.po @@ -3138,6 +3138,11 @@ msgid "" "If disabled, the client will not make changes until all users are logged off" msgstr "" +msgid "" +"If that chain loads but the network never comes up, the firmware's own UEFI " +"network stack is at fault. Point the boot filename at" +msgstr "" + msgid "If this is an upgrade" msgstr "" @@ -8393,6 +8398,11 @@ msgstr "" msgid "initrd (Initial Ramdisk) Update" msgstr "" +msgid "" +"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. " +"Arm64 clients use the files under secureboot/arm64-efi/" +msgstr "" + #, fuzzy msgid "is already being sent by another node" msgstr "O endereço MAC já está sendo usado por outro host" diff --git a/packages/web/management/languages/zh_CN.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/zh_CN.UTF-8/LC_MESSAGES/messages.po index 7b0cf86ed6..f87424fdb3 100644 --- a/packages/web/management/languages/zh_CN.UTF-8/LC_MESSAGES/messages.po +++ b/packages/web/management/languages/zh_CN.UTF-8/LC_MESSAGES/messages.po @@ -3136,6 +3136,11 @@ msgid "" "If disabled, the client will not make changes until all users are logged off" msgstr "" +msgid "" +"If that chain loads but the network never comes up, the firmware's own UEFI " +"network stack is at fault. Point the boot filename at" +msgstr "" + msgid "If this is an upgrade" msgstr "" @@ -8380,6 +8385,11 @@ msgstr "" msgid "initrd (Initial Ramdisk) Update" msgstr "" +msgid "" +"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. " +"Arm64 clients use the files under secureboot/arm64-efi/" +msgstr "" + #, fuzzy msgid "is already being sent by another node" msgstr "MAC地址已被其他主机使用" From 79015d3c904fd4ab81fc8f538567fbdcbcc48b82 Mon Sep 17 00:00:00 2001 From: Tom Elliott Date: Mon, 3 Aug 2026 09:01:32 -0500 Subject: [PATCH 2/2] Point the installer at fog-ipxe v2.0.0-fog.3 The release that first carries the ipxe.efi Secure Boot chain (FOGProject/fog-ipxe#2). Without this bump the paragraph added in the previous commit names a boot file the installer never downloads, which is worse than not documenting it at all -- the admin points DHCP at a path that TFTP 404s and has no way to tell that from a broken chain. iPXE itself is unchanged at v2.0.0; only the fog-ipxe packaging moved. Co-Authored-By: Claude Opus 5 --- packages/web/lib/fog/system.class.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/web/lib/fog/system.class.php b/packages/web/lib/fog/system.class.php index d424f01e4c..206cacadcc 100644 --- a/packages/web/lib/fog/system.class.php +++ b/packages/web/lib/fog/system.class.php @@ -69,7 +69,7 @@ public function __construct() // given FOG release ships a known iPXE -- the installer uses this both // to pick the download and to check out the matching source when an // HTTPS install has to rebuild with its own CA. - define('FOG_IPXE_VERSION', 'v2.0.0-fog.2'); + define('FOG_IPXE_VERSION', 'v2.0.0-fog.3'); // GH-850: FOG_BASE_DIR is now installer-driven. Initiator loads // commons/fogpaths.php (written from the installer's $fogprogramdir) // before the autoloader runs, so in a normal boot these are already