From 661b23cded59b4840692918c4cf46b69352d4c8e Mon Sep 17 00:00:00 2001 From: Tom Elliott Date: Mon, 3 Aug 2026 09:07:37 -0500 Subject: [PATCH] Secure Boot: document the ipxe.efi fallback chain, bump fog-ipxe pin Port of the working-1.6 change (GH-979). fog-ipxe v2.0.0-fog.3 stages a second signed chain beside snponly, so a site whose firmware UEFI SNP is broken has somewhere to go -- but only if it knows the file is there. Framed by symptom rather than by binary ("loads but the network never comes up") because an admin hitting this has no way to know the fault is in their firmware's network stack, and that is the only signal that distinguishes the two chains. shim resolves its second stage from its own filename, so switching is purely a DHCP change with nothing to rename server-side. FOG_IPXE_VERSION moves with it: without the bump the paragraph names a boot file the installer never downloads, so the admin points DHCP at a path that TFTP 404s and cannot tell that from a broken chain. Written against this branch's own idiom -- successive echo/printf calls rather than 1.6's accumulated $steps string -- rather than transplanted. Co-Authored-By: Claude Opus 5 --- packages/web/lib/fog/system.class.php | 2 +- .../lib/pages/fogconfigurationpage.class.php | 21 +++++++++++++++++++ .../de_DE.UTF-8/LC_MESSAGES/messages.po | 10 +++++++++ .../en_US.UTF-8/LC_MESSAGES/messages.po | 10 +++++++++ .../es_ES.UTF-8/LC_MESSAGES/messages.po | 10 +++++++++ .../fr_FR.UTF-8/LC_MESSAGES/messages.po | 10 +++++++++ .../it_IT.UTF-8/LC_MESSAGES/messages.po | 10 +++++++++ .../ja_JP.UTF-8/LC_MESSAGES/messages.po | 10 +++++++++ .../web/management/languages/messages.pot | 10 +++++++++ .../pt_BR.UTF-8/LC_MESSAGES/messages.po | 10 +++++++++ .../zh_CN.UTF-8/LC_MESSAGES/messages.po | 10 +++++++++ 11 files changed, 112 insertions(+), 1 deletion(-) diff --git a/packages/web/lib/fog/system.class.php b/packages/web/lib/fog/system.class.php index e0632243bb..2102a53bd1 100644 --- a/packages/web/lib/fog/system.class.php +++ b/packages/web/lib/fog/system.class.php @@ -62,6 +62,6 @@ public function __construct() // given FOG release ships a known iPXE -- the installer uses this both // to pick the download and to check out the matching source when an // HTTPS install has to rebuild with its own CA. - define('FOG_IPXE_VERSION', 'v2.0.0-fog.2'); + define('FOG_IPXE_VERSION', 'v2.0.0-fog.3'); } } diff --git a/packages/web/lib/pages/fogconfigurationpage.class.php b/packages/web/lib/pages/fogconfigurationpage.class.php index 1aa435ecec..f0ee3d0468 100644 --- a/packages/web/lib/pages/fogconfigurationpage.class.php +++ b/packages/web/lib/pages/fogconfigurationpage.class.php @@ -495,6 +495,27 @@ public function secureBoot() ) ); echo '

'; + // Two signed chains are staged, mirroring the snponly/ipxe choice + // every non-Secure-Boot install already has. shim resolves its second + // stage from its OWN filename, so switching chains is purely a DHCP + // change -- there is nothing to rename server-side. Documented here + // because a site whose firmware SNP is broken otherwise has no way to + // know a fallback exists. + echo '

'; + printf( + '%s secureboot/ipxe-shimx64.efi %s.', + _( + 'If that chain loads but the network never comes up, the ' + . 'firmware\'s own UEFI network stack is at fault. Point the ' + . 'boot filename at' + ), + _( + 'instead, which uses iPXE\'s built-in NIC drivers rather than ' + . 'the firmware\'s. Arm64 clients use the files under ' + . 'secureboot/arm64-efi/' + ) + ); + echo '

'; // Stated rather than detected: the web request's own scheme says // nothing about the install's $httpproto, so guessing here would be // worse than telling the admin what to check. An HTTPS install skips diff --git a/packages/web/management/languages/de_DE.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/de_DE.UTF-8/LC_MESSAGES/messages.po index 18aacf9b7d..f2c610029d 100644 --- a/packages/web/management/languages/de_DE.UTF-8/LC_MESSAGES/messages.po +++ b/packages/web/management/languages/de_DE.UTF-8/LC_MESSAGES/messages.po @@ -2849,6 +2849,11 @@ msgstr "falls deaktiviert, " msgid "If on" msgstr "Falls aktiviert," +msgid "" +"If that chain loads but the network never comes up, the firmware's own UEFI " +"network stack is at fault. Point the boot filename at" +msgstr "" + #, fuzzy msgid "If there is not a task set" msgstr "Wenn keine Aufgabe (Task) aktiviert ist, " @@ -7685,6 +7690,11 @@ msgstr "in Sekunden" msgid "install or update the FOG database" msgstr "installieren oder aktualisieren möchten?" +msgid "" +"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. " +"Arm64 clients use the files under secureboot/arm64-efi/" +msgstr "" + #, fuzzy msgid "is already running with pid: " msgstr "läuft bereits mit PID" diff --git a/packages/web/management/languages/en_US.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/en_US.UTF-8/LC_MESSAGES/messages.po index 6cfa8810c9..d4478d61a4 100644 --- a/packages/web/management/languages/en_US.UTF-8/LC_MESSAGES/messages.po +++ b/packages/web/management/languages/en_US.UTF-8/LC_MESSAGES/messages.po @@ -2842,6 +2842,11 @@ msgstr "" msgid "If on" msgstr "Icon" +msgid "" +"If that chain loads but the network never comes up, the firmware's own UEFI " +"network stack is at fault. Point the boot filename at" +msgstr "" + #, fuzzy msgid "If there is not a task set" msgstr "There is a host in a tasking" @@ -7671,6 +7676,11 @@ msgstr "" msgid "install or update the FOG database" msgstr "Are you sure you wish to install or update the FOG database?" +msgid "" +"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. " +"Arm64 clients use the files under secureboot/arm64-efi/" +msgstr "" + #, fuzzy msgid "is already running with pid: " msgstr "Replication Bandwidth" diff --git a/packages/web/management/languages/es_ES.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/es_ES.UTF-8/LC_MESSAGES/messages.po index 0cf3fd8bb0..a938bd898d 100755 --- a/packages/web/management/languages/es_ES.UTF-8/LC_MESSAGES/messages.po +++ b/packages/web/management/languages/es_ES.UTF-8/LC_MESSAGES/messages.po @@ -2855,6 +2855,11 @@ msgstr "" msgid "If on" msgstr "" +msgid "" +"If that chain loads but the network never comes up, the firmware's own UEFI " +"network stack is at fault. Point the boot filename at" +msgstr "" + #, fuzzy msgid "If there is not a task set" msgstr "Gestión de tareas" @@ -7605,6 +7610,11 @@ msgstr "" msgid "install or update the FOG database" msgstr "Fallo al actualziar la base de datos" +msgid "" +"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. " +"Arm64 clients use the files under secureboot/arm64-efi/" +msgstr "" + #, fuzzy msgid "is already running with pid: " msgstr "El grupo de almacenamiento ya existe" diff --git a/packages/web/management/languages/fr_FR.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/fr_FR.UTF-8/LC_MESSAGES/messages.po index 9415f4d9a2..b24de4f4f7 100644 --- a/packages/web/management/languages/fr_FR.UTF-8/LC_MESSAGES/messages.po +++ b/packages/web/management/languages/fr_FR.UTF-8/LC_MESSAGES/messages.po @@ -2522,6 +2522,11 @@ msgstr "Si c'est désactivé" msgid "If on" msgstr "Sinon" +msgid "" +"If that chain loads but the network never comes up, the firmware's own UEFI " +"network stack is at fault. Point the boot filename at" +msgstr "" + msgid "If there is not a task set" msgstr "S'il n'y a pas de tâche définie" @@ -6798,6 +6803,11 @@ msgstr "en secondes" msgid "install or update the FOG database" msgstr "installer ou mettre à jour la base de données du FOG" +msgid "" +"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. " +"Arm64 clients use the files under secureboot/arm64-efi/" +msgstr "" + msgid "is already running with pid: " msgstr "est déjà en cours d'exécution avec le pid : " diff --git a/packages/web/management/languages/it_IT.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/it_IT.UTF-8/LC_MESSAGES/messages.po index 80a9e93491..1fd455411a 100644 --- a/packages/web/management/languages/it_IT.UTF-8/LC_MESSAGES/messages.po +++ b/packages/web/management/languages/it_IT.UTF-8/LC_MESSAGES/messages.po @@ -2576,6 +2576,11 @@ msgstr "Se disabilitato" msgid "If on" msgstr "Se abilitato" +msgid "" +"If that chain loads but the network never comes up, the firmware's own UEFI " +"network stack is at fault. Point the boot filename at" +msgstr "" + msgid "If there is not a task set" msgstr "Non c'è alcuna attività impostata" @@ -6917,6 +6922,11 @@ msgstr "in secondi" msgid "install or update the FOG database" msgstr "Installare o aggiornare il database FOG" +msgid "" +"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. " +"Arm64 clients use the files under secureboot/arm64-efi/" +msgstr "" + #, fuzzy msgid "is already running with pid: " msgstr "è già in esecuzione con pid" diff --git a/packages/web/management/languages/ja_JP.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/ja_JP.UTF-8/LC_MESSAGES/messages.po index d52401bded..f3a1fa24ee 100644 --- a/packages/web/management/languages/ja_JP.UTF-8/LC_MESSAGES/messages.po +++ b/packages/web/management/languages/ja_JP.UTF-8/LC_MESSAGES/messages.po @@ -2484,6 +2484,11 @@ msgstr "オフの場合" msgid "If on" msgstr "オンの場合" +msgid "" +"If that chain loads but the network never comes up, the firmware's own UEFI " +"network stack is at fault. Point the boot filename at" +msgstr "" + msgid "If there is not a task set" msgstr "タスクが設定されていない場合" @@ -6696,6 +6701,11 @@ msgstr "秒単位" msgid "install or update the FOG database" msgstr "FOG データベースをインストールまたは更新" +msgid "" +"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. " +"Arm64 clients use the files under secureboot/arm64-efi/" +msgstr "" + msgid "is already running with pid: " msgstr "は既に次の PID で実行中です: " diff --git a/packages/web/management/languages/messages.pot b/packages/web/management/languages/messages.pot index ec36233bd1..18839df326 100644 --- a/packages/web/management/languages/messages.pot +++ b/packages/web/management/languages/messages.pot @@ -2468,6 +2468,11 @@ msgstr "" msgid "If on" msgstr "" +msgid "" +"If that chain loads but the network never comes up, the firmware's own UEFI " +"network stack is at fault. Point the boot filename at" +msgstr "" + msgid "If there is not a task set" msgstr "" @@ -6653,6 +6658,11 @@ msgstr "" msgid "install or update the FOG database" msgstr "" +msgid "" +"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. " +"Arm64 clients use the files under secureboot/arm64-efi/" +msgstr "" + msgid "is already running with pid: " msgstr "" diff --git a/packages/web/management/languages/pt_BR.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/pt_BR.UTF-8/LC_MESSAGES/messages.po index 8c45a2f452..e5ca09c837 100644 --- a/packages/web/management/languages/pt_BR.UTF-8/LC_MESSAGES/messages.po +++ b/packages/web/management/languages/pt_BR.UTF-8/LC_MESSAGES/messages.po @@ -2503,6 +2503,11 @@ msgstr "Se desligado" msgid "If on" msgstr "Se ligado" +msgid "" +"If that chain loads but the network never comes up, the firmware's own UEFI " +"network stack is at fault. Point the boot filename at" +msgstr "" + msgid "If there is not a task set" msgstr "Se não houver uma tarefa definida" @@ -6730,6 +6735,11 @@ msgstr "em segundos" msgid "install or update the FOG database" msgstr "instalar ou atualizar o banco de dados FOG" +msgid "" +"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. " +"Arm64 clients use the files under secureboot/arm64-efi/" +msgstr "" + msgid "is already running with pid: " msgstr "já está rodando com pid: " diff --git a/packages/web/management/languages/zh_CN.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/zh_CN.UTF-8/LC_MESSAGES/messages.po index 47f4fd1b35..44691abef5 100644 --- a/packages/web/management/languages/zh_CN.UTF-8/LC_MESSAGES/messages.po +++ b/packages/web/management/languages/zh_CN.UTF-8/LC_MESSAGES/messages.po @@ -2498,6 +2498,11 @@ msgstr "如果关机" msgid "If on" msgstr "如果开机" +msgid "" +"If that chain loads but the network never comes up, the firmware's own UEFI " +"network stack is at fault. Point the boot filename at" +msgstr "" + msgid "If there is not a task set" msgstr "如果没有设置任务" @@ -6707,6 +6712,11 @@ msgstr "几秒钟内" msgid "install or update the FOG database" msgstr "安装或更新FOG数据库" +msgid "" +"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. " +"Arm64 clients use the files under secureboot/arm64-efi/" +msgstr "" + msgid "is already running with pid: " msgstr "已在运行，PID："