Secure Boot: document the ipxe.efi fallback chain, bump fog-ipxe pin - #980
Merged
Conversation
Port of the working-1.6 change (GH-979). fog-ipxe v2.0.0-fog.3 stages a second signed chain beside snponly, so a site whose firmware UEFI SNP is broken has somewhere to go -- but only if it knows the file is there. Framed by symptom rather than by binary ("loads but the network never comes up") because an admin hitting this has no way to know the fault is in their firmware's network stack, and that is the only signal that distinguishes the two chains. shim resolves its second stage from its own filename, so switching is purely a DHCP change with nothing to rename server-side. FOG_IPXE_VERSION moves with it: without the bump the paragraph names a boot file the installer never downloads, so the admin points DHCP at a path that TFTP 404s and cannot tell that from a broken chain. Written against this branch's own idiom -- successive echo/printf calls rather than 1.6's accumulated $steps string -- rather than transplanted. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Port of #979 to
dev-branch. fog-ipxe v2.0.0-fog.3 stages a second signed Secure Boot chain, ending the situation where Secure Boot was the one boot path in FOG with no fallback loader.The two signed loaders fail on disjoint hardware:
snponly.efidrives the NIC through the firmware's own UEFI SNP protocol. Right default — whatever the vendor shipped and tested — but dead in the water where SNP is broken or absent.ipxe.eficarries iPXE's native drivers and takes the NIC over from the firmware. Recovers exactly those machines, and hangs where the takeover fails.Non-Secure-Boot installs have always had that choice via DHCP option 67.
What changed
1.
FOG_IPXE_VERSION→v2.0.0-fog.3. Without it the paragraph below names a boot file the installer never downloads — the admin points DHCP at a path that TFTP 404s and cannot tell that from a broken chain. iPXE itself is unchanged at v2.0.0; only the fog-ipxe packaging moved.2. One paragraph on the Secure Boot configuration page, framed by symptom rather than by binary:
Port notes
Verified this branch actually needs it before porting:
downloadipxesecureboot()exists here (lib/common/functions.sh:935) and stages into the samesecureboot/tree, so the paths named are real on this branch too.FOG_IPXE_VERSIONwas on the samev2.0.0-fog.2pin.fogconfigurationpage.class.phphere vs.page.phpon 1.6, and emits with successiveecho/printfcalls rather than 1.6's accumulated$stepsstring. Rewritten in this branch's idiom rather than transplanted.php -lclean. NoFOG_BCACHE_VERbump needed — PHP only.🤖 Generated with Claude Code