Publish the ipxe.efi Secure Boot chain alongside snponly.efi

[mastacontrola]

Summary

The Secure Boot asset set staged only the snponly pair, which made Secure Boot the one boot path in FOG with no fallback loader. This adds the ipxe.efi chain beside it, for both x86_64 and arm64.

The two loaders fail on disjoint hardware:

• snponly.efi drives the NIC through the firmware's own UEFI SNP protocol. Right default — it's whatever the vendor shipped and tested — but dead in the water where SNP is broken or absent.
• ipxe.efi carries iPXE's native drivers and takes the NIC over from the firmware. Recovers exactly those machines, and hangs on the ones where takeover fails.

Every non-Secure-Boot install has had both since forever, and admins pick between them with DHCP option 67. A Secure Boot site had nothing to move to.

Why this is cheap

Upstream already signs both. ipxeboot.tar.gz ships x86_64-sb/ipxe.efi and arm64-sb/ipxe.efi under the same CN=iPXE Secure Boot Automatic Code Signing G1A key as snponly.efi, so they stage and signer-assert identically. No new hash pin — IPXEBOOT_SHA256 already covers the whole tarball.

The shim is byte-identical between chains; only its filename differs, because automatic_next_path() picks the second stage by rewriting the -shim<arch>.efi suffix of its own name. So ipxe-shimx64.efi loads ipxe.efi and snponly-shimx64.efi loads snponly.efi, from the same directory. Switching chains is purely a DHCP change with nothing to rename server-side. Upstream ships those two names as symlinks to one binary for exactly this reason; we keep materialising real files because some TFTP daemons refuse to follow symlinks.

Cost

Asset set grows 4.4MB -> 7.2MB, ~2MB of which is the duplicated shim. Weighed against an admin having no signed fallback at all.

Verification

Ran secureboot/stage.sh end to end:

• All four loaders verify against the expected iPXE signer.
• Each staged binary is byte-identical to its upstream source (sha256 compared against a separately downloaded ipxeboot.tar.gz).
• All four shim names resolve to a loader present in the same directory:

snponly-shimx64.efi   -> snponly.efi   PRESENT
ipxe-shimx64.efi      -> ipxe.efi      PRESENT
snponly-shimaa64.efi  -> snponly.efi   PRESENT
ipxe-shimaa64.efi     -> ipxe.efi      PRESENT

No installer change is needed: configureTFTPandPXE copies the staged tree wholesale, and the autoexec.ipxe hard-link loop already covers secureboot/ and secureboot/arm64-efi/.

A companion PR on fogproject documents the fallback on the Secure Boot configuration page.

🤖 Generated with Claude Code