Skip to content

Secure Boot: publish and document the ipxe.efi fallback chain #979

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mastacontrola merged 2 commits into from
Aug 3, 2026
Merged

Secure Boot: publish and document the ipxe.efi fallback chain #979

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
17e7881
Secure Boot: document the ipxe.efi fallback chain
mastacontrola Aug 3, 2026
79015d3
Point the installer at fog-ipxe v2.0.0-fog.3
mastacontrola Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/web/lib/fog/system.class.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ public function __construct()
// given FOG release ships a known iPXE -- the installer uses this both
// to pick the download and to check out the matching source when an
// HTTPS install has to rebuild with its own CA.
define('FOG_IPXE_VERSION', 'v2.0.0-fog.2');
define('FOG_IPXE_VERSION', 'v2.0.0-fog.3');
// GH-850: FOG_BASE_DIR is now installer-driven. Initiator loads
// commons/fogpaths.php (written from the installer's $fogprogramdir)
// before the autoloader runs, so in a normal boot these are already
Expand Down
19 changes: 19 additions & 0 deletions packages/web/lib/pages/fogconfigurationpage.page.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -438,6 +438,25 @@ public function secureBoot()
. 'boot file is unsigned and a Secure Boot client will refuse it'
)
) . '</p>';
// Two signed chains are staged, mirroring the snponly/ipxe choice
// every non-Secure-Boot install already has. shim resolves its second
// stage from its OWN filename, so switching chains is purely a DHCP
// change -- there is nothing to rename server-side. Documented here
// because a site whose firmware SNP is broken otherwise has no way to
// know a fallback exists.
$steps .= '<p>' . sprintf(
'%s <code>secureboot/ipxe-shimx64.efi</code> %s.',
_(
'If that chain loads but the network never comes up, the '
. 'firmware\'s own UEFI network stack is at fault. Point the '
. 'boot filename at'
),
_(
'instead, which uses iPXE\'s built-in NIC drivers rather than '
. 'the firmware\'s. Arm64 clients use the files under '
. 'secureboot/arm64-efi/'
)
) . '</p>';
// Stated rather than detected: the web request's own scheme says
// nothing about the install's $httpproto, so guessing here would be
// worse than telling the admin what to check. See
Expand Down
10 changes: 10 additions & 0 deletions packages/web/management/languages/de_DE.UTF-8/LC_MESSAGES/messages.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3136,6 +3136,11 @@ msgid ""
"If disabled, the client will not make changes until all users are logged off"
msgstr ""

msgid ""
"If that chain loads but the network never comes up, the firmware's own UEFI "
"network stack is at fault. Point the boot filename at"
msgstr ""

msgid "If this is an upgrade"
msgstr "Falls dies ein Upgrade ist,"

Expand Down Expand Up @@ -8398,6 +8403,11 @@ msgstr "in Sekunden"
msgid "initrd (Initial Ramdisk) Update"
msgstr ""

msgid ""
"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. "
"Arm64 clients use the files under secureboot/arm64-efi/"
msgstr ""

#, fuzzy
msgid "is already being sent by another node"
msgstr "Die MAC-Adresse wird bereits von einem andern Host verwendet"
Expand Down
10 changes: 10 additions & 0 deletions packages/web/management/languages/en_US.UTF-8/LC_MESSAGES/messages.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3135,6 +3135,11 @@ msgid ""
"If disabled, the client will not make changes until all users are logged off"
msgstr ""

msgid ""
"If that chain loads but the network never comes up, the firmware's own UEFI "
"network stack is at fault. Point the boot filename at"
msgstr ""

msgid "If this is an upgrade"
msgstr ""

Expand Down Expand Up @@ -8389,6 +8394,11 @@ msgstr ""
msgid "initrd (Initial Ramdisk) Update"
msgstr ""

msgid ""
"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. "
"Arm64 clients use the files under secureboot/arm64-efi/"
msgstr ""

#, fuzzy
msgid "is already being sent by another node"
msgstr "MAC address is already in use by another host"
Expand Down
10 changes: 10 additions & 0 deletions packages/web/management/languages/es_ES.UTF-8/LC_MESSAGES/messages.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3203,6 +3203,11 @@ msgid ""
"If disabled, the client will not make changes until all users are logged off"
msgstr ""

msgid ""
"If that chain loads but the network never comes up, the firmware's own UEFI "
"network stack is at fault. Point the boot filename at"
msgstr ""

msgid "If this is an upgrade"
msgstr ""

Expand Down Expand Up @@ -8546,6 +8551,11 @@ msgstr ""
msgid "initrd (Initial Ramdisk) Update"
msgstr ""

msgid ""
"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. "
"Arm64 clients use the files under secureboot/arm64-efi/"
msgstr ""

#, fuzzy
msgid "is already being sent by another node"
msgstr "La dirección MAC ya está en uso por otro host"
Expand Down
10 changes: 10 additions & 0 deletions packages/web/management/languages/eu_ES.UTF-8/LC_MESSAGES/messages.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3136,6 +3136,11 @@ msgid ""
"If disabled, the client will not make changes until all users are logged off"
msgstr ""

msgid ""
"If that chain loads but the network never comes up, the firmware's own UEFI "
"network stack is at fault. Point the boot filename at"
msgstr ""

msgid "If this is an upgrade"
msgstr "Falls dies ein Upgrade ist,"

Expand Down Expand Up @@ -8399,6 +8404,11 @@ msgstr "in Sekunden"
msgid "initrd (Initial Ramdisk) Update"
msgstr ""

msgid ""
"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. "
"Arm64 clients use the files under secureboot/arm64-efi/"
msgstr ""

#, fuzzy
msgid "is already being sent by another node"
msgstr "Liste der MAC-Adressen"
Expand Down
10 changes: 10 additions & 0 deletions packages/web/management/languages/fr_FR.UTF-8/LC_MESSAGES/messages.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3139,6 +3139,11 @@ msgid ""
"If disabled, the client will not make changes until all users are logged off"
msgstr ""

msgid ""
"If that chain loads but the network never comes up, the firmware's own UEFI "
"network stack is at fault. Point the boot filename at"
msgstr ""

msgid "If this is an upgrade"
msgstr ""

Expand Down Expand Up @@ -8397,6 +8402,11 @@ msgstr ""
msgid "initrd (Initial Ramdisk) Update"
msgstr ""

msgid ""
"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. "
"Arm64 clients use the files under secureboot/arm64-efi/"
msgstr ""

#, fuzzy
msgid "is already being sent by another node"
msgstr "L'adresse MAC est déjà utilisée par un autre hôte"
Expand Down
10 changes: 10 additions & 0 deletions packages/web/management/languages/it_IT.UTF-8/LC_MESSAGES/messages.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3028,6 +3028,11 @@ msgid ""
"If disabled, the client will not make changes until all users are logged off"
msgstr ""

msgid ""
"If that chain loads but the network never comes up, the firmware's own UEFI "
"network stack is at fault. Point the boot filename at"
msgstr ""

msgid "If this is an upgrade"
msgstr "Se questo è un aggiornamento"

Expand Down Expand Up @@ -8041,6 +8046,11 @@ msgstr "in secondi"
msgid "initrd (Initial Ramdisk) Update"
msgstr ""

msgid ""
"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. "
"Arm64 clients use the files under secureboot/arm64-efi/"
msgstr ""

#, fuzzy
msgid "is already being sent by another node"
msgstr "L'indirizzo MAC è già in uso da un altro host"
Expand Down
10 changes: 10 additions & 0 deletions packages/web/management/languages/ja_JP.UTF-8/LC_MESSAGES/messages.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2999,6 +2999,11 @@ msgid ""
"If disabled, the client will not make changes until all users are logged off"
msgstr ""

msgid ""
"If that chain loads but the network never comes up, the firmware's own UEFI "
"network stack is at fault. Point the boot filename at"
msgstr ""

msgid "If this is an upgrade"
msgstr "アップグレードの場合"

Expand Down Expand Up @@ -7966,6 +7971,11 @@ msgstr "秒単位"
msgid "initrd (Initial Ramdisk) Update"
msgstr ""

msgid ""
"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. "
"Arm64 clients use the files under secureboot/arm64-efi/"
msgstr ""

#, fuzzy
msgid "is already being sent by another node"
msgstr "MAC アドレスは別のホストで既に使用されています"
Expand Down
10 changes: 10 additions & 0 deletions packages/web/management/languages/messages.pot
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2645,6 +2645,11 @@ msgid ""
"If disabled, the client will not make changes until all users are logged off"
msgstr ""

msgid ""
"If that chain loads but the network never comes up, the firmware's own UEFI "
"network stack is at fault. Point the boot filename at"
msgstr ""

msgid "If this is an upgrade"
msgstr ""

Expand Down Expand Up @@ -7100,6 +7105,11 @@ msgstr ""
msgid "initrd (Initial Ramdisk) Update"
msgstr ""

msgid ""
"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. "
"Arm64 clients use the files under secureboot/arm64-efi/"
msgstr ""

msgid "is already being sent by another node"
msgstr ""

Expand Down
10 changes: 10 additions & 0 deletions packages/web/management/languages/pt_BR.UTF-8/LC_MESSAGES/messages.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3138,6 +3138,11 @@ msgid ""
"If disabled, the client will not make changes until all users are logged off"
msgstr ""

msgid ""
"If that chain loads but the network never comes up, the firmware's own UEFI "
"network stack is at fault. Point the boot filename at"
msgstr ""

msgid "If this is an upgrade"
msgstr ""

Expand Down Expand Up @@ -8393,6 +8398,11 @@ msgstr ""
msgid "initrd (Initial Ramdisk) Update"
msgstr ""

msgid ""
"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. "
"Arm64 clients use the files under secureboot/arm64-efi/"
msgstr ""

#, fuzzy
msgid "is already being sent by another node"
msgstr "O endereço MAC já está sendo usado por outro host"
Expand Down
10 changes: 10 additions & 0 deletions packages/web/management/languages/zh_CN.UTF-8/LC_MESSAGES/messages.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3136,6 +3136,11 @@ msgid ""
"If disabled, the client will not make changes until all users are logged off"
msgstr ""

msgid ""
"If that chain loads but the network never comes up, the firmware's own UEFI "
"network stack is at fault. Point the boot filename at"
msgstr ""

msgid "If this is an upgrade"
msgstr ""

Expand Down Expand Up @@ -8380,6 +8385,11 @@ msgstr ""
msgid "initrd (Initial Ramdisk) Update"
msgstr ""

msgid ""
"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. "
"Arm64 clients use the files under secureboot/arm64-efi/"
msgstr ""

#, fuzzy
msgid "is already being sent by another node"
msgstr "MAC地址已被其他主机使用"
Expand Down