Skip to content

Publish the ipxe.efi Secure Boot chain alongside snponly.efi #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mastacontrola merged 1 commit into from
Aug 3, 2026
Merged

Publish the ipxe.efi Secure Boot chain alongside snponly.efi #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 31 additions & 5 deletions secureboot/stage.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,15 +114,20 @@ fetch "${SHIM_BASE}/mmaa64.efi" "$work/mmaa64.efi" "$MM_AA64_SHA25
fetch "${IPXE_BASE}/ipxeboot.tar.gz" "$work/ipxeboot.tar.gz" "$IPXEBOOT_SHA256"

tar xzf "$work/ipxeboot.tar.gz" -C "$work" \
ipxeboot/x86_64-sb/snponly.efi ipxeboot/arm64-sb/snponly.efi
ipxeboot/x86_64-sb/snponly.efi ipxeboot/x86_64-sb/ipxe.efi \
ipxeboot/arm64-sb/snponly.efi ipxeboot/arm64-sb/ipxe.efi

echo "Verifying signers"
assert_signer "$work/ipxe-shimx64.efi" "$SHIM_SIGNER_2011" "$SHIM_SIGNER_2023"
assert_signer "$work/ipxe-shimaa64.efi" "$SHIM_SIGNER_2011" "$SHIM_SIGNER_2023"
assert_signer "$work/ipxeboot/x86_64-sb/snponly.efi" \
"$IPXE_SIGNER_SUBJECT" "$IPXE_SIGNER_ISSUER"
assert_signer "$work/ipxeboot/x86_64-sb/ipxe.efi" \
"$IPXE_SIGNER_SUBJECT" "$IPXE_SIGNER_ISSUER"
assert_signer "$work/ipxeboot/arm64-sb/snponly.efi" \
"$IPXE_SIGNER_SUBJECT" "$IPXE_SIGNER_ISSUER"
assert_signer "$work/ipxeboot/arm64-sb/ipxe.efi" \
"$IPXE_SIGNER_SUBJECT" "$IPXE_SIGNER_ISSUER"

# The rename IS the mechanism, so it happens here -- once, in a reviewed file
# -- rather than in the installer where a typo would be a silent TFTP 404.
Expand All @@ -137,17 +142,34 @@ assert_signer "$work/ipxeboot/arm64-sb/snponly.efi" \
#
# The suffix match allows "-shim" plus up to four more characters before
# ".efi". "-shimaa64" is exactly nine and therefore exactly at the limit --
# do not lengthen these names.
# do not lengthen these names. Only the suffix is matched, so the "ipxe-"
# prefix below costs nothing.
#
# BOTH pairs are published, because neither loader works everywhere:
# snponly.efi drives the NIC through the firmware's own UEFI SNP protocol.
# Right answer by default -- it is whatever the vendor shipped and tested --
# but it is dead in the water on firmware whose SNP is broken or absent.
# ipxe.efi carries iPXE's native drivers and takes the NIC over from the
# firmware. Recovers exactly those machines, and hangs on the ones where the
# takeover fails.
#
# Only the snponly variant is published. An ipxe-shim*.efi alias would need
# ipxe.efi staged beside it or it chains to a file that is not there.
# Non-Secure-Boot installs have had both since forever and admins switch
# between them by changing DHCP option 67. Publishing only the snponly pair
# made Secure Boot the one path with no fallback, so a site whose firmware SNP
# is broken had nothing to move to. Each pair is self-contained -- shim resolves
# its second stage from its OWN name -- so the two sit side by side in the same
# directory and DHCP alone picks which chain runs.
echo "Staging"
mkdir -p "$out/secureboot/arm64-efi"
install -m 0644 "$work/ipxeboot/x86_64-sb/snponly.efi" "$out/secureboot/snponly.efi"
install -m 0644 "$work/ipxe-shimx64.efi" "$out/secureboot/snponly-shimx64.efi"
install -m 0644 "$work/ipxeboot/x86_64-sb/ipxe.efi" "$out/secureboot/ipxe.efi"
install -m 0644 "$work/ipxe-shimx64.efi" "$out/secureboot/ipxe-shimx64.efi"
install -m 0644 "$work/mmx64.efi" "$out/secureboot/mmx64.efi"
install -m 0644 "$work/ipxeboot/arm64-sb/snponly.efi" "$out/secureboot/arm64-efi/snponly.efi"
install -m 0644 "$work/ipxe-shimaa64.efi" "$out/secureboot/arm64-efi/snponly-shimaa64.efi"
install -m 0644 "$work/ipxeboot/arm64-sb/ipxe.efi" "$out/secureboot/arm64-efi/ipxe.efi"
install -m 0644 "$work/ipxe-shimaa64.efi" "$out/secureboot/arm64-efi/ipxe-shimaa64.efi"
install -m 0644 "$work/mmaa64.efi" "$out/secureboot/arm64-efi/mmaa64.efi"

# autoexec.ipxe has to sit beside the binaries: iPXE resolves the bare name
Expand All @@ -173,15 +195,19 @@ install -m 0644 "$repo/autoexec.ipxe" "$out/secureboot/arm64-efi/autoexec.ipxe"
}
manifest_row "secureboot/snponly.efi" "${IPXE_BASE}/ipxeboot.tar.gz!ipxeboot/x86_64-sb/snponly.efi"
manifest_row "secureboot/snponly-shimx64.efi" "${SHIM_BASE}/ipxe-shimx64.efi"
manifest_row "secureboot/ipxe.efi" "${IPXE_BASE}/ipxeboot.tar.gz!ipxeboot/x86_64-sb/ipxe.efi"
manifest_row "secureboot/ipxe-shimx64.efi" "${SHIM_BASE}/ipxe-shimx64.efi"
manifest_row "secureboot/mmx64.efi" "${SHIM_BASE}/mmx64.efi"
manifest_row "secureboot/arm64-efi/snponly.efi" "${IPXE_BASE}/ipxeboot.tar.gz!ipxeboot/arm64-sb/snponly.efi"
manifest_row "secureboot/arm64-efi/snponly-shimaa64.efi" "${SHIM_BASE}/ipxe-shimaa64.efi"
manifest_row "secureboot/arm64-efi/ipxe.efi" "${IPXE_BASE}/ipxeboot.tar.gz!ipxeboot/arm64-sb/ipxe.efi"
manifest_row "secureboot/arm64-efi/ipxe-shimaa64.efi" "${SHIM_BASE}/ipxe-shimaa64.efi"
manifest_row "secureboot/arm64-efi/mmaa64.efi" "${SHIM_BASE}/mmaa64.efi"
echo
echo "# Signers asserted at release time:"
echo "# shim ${SHIM_SIGNER_2011}"
echo "# shim ${SHIM_SIGNER_2023}"
echo "# snponly ${IPXE_SIGNER_SUBJECT}"
echo "# loaders ${IPXE_SIGNER_SUBJECT}"
echo "#"
echo "# autoexec.ipxe is FOG's own, from this repo, not upstream."
} > "$out/secureboot/MANIFEST"
Expand Down
6 changes: 4 additions & 2 deletions secureboot/upstream.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,9 @@
# Sourced by secureboot/stage.sh.

# --- iPXE ---------------------------------------------------------------
# The signed snponly.efi comes out of upstream's ipxeboot.tar.gz.
# The signed snponly.efi and ipxe.efi both come out of upstream's
# ipxeboot.tar.gz, so IPXEBOOT_SHA256 already covers both and neither needs a
# hash of its own here.
#
# IPXE_RELEASE must match IPXEVER in buildipxe.sh. It is asserted rather than
# derived: if the two drift, Secure Boot clients would run a different iPXE
Expand All @@ -23,7 +25,7 @@
IPXE_RELEASE="v2.0.0"
IPXEBOOT_SHA256="01a526d4cc791fc30362259c609d6c506cc64a7bdff51b9a5eb788354e17eee1"

# Signer of x86_64-sb/snponly.efi and arm64-sb/snponly.efi.
# Signer of the snponly.efi and ipxe.efi under x86_64-sb/ and arm64-sb/.
IPXE_SIGNER_SUBJECT="CN=iPXE Secure Boot Automatic Code Signing G1A"
IPXE_SIGNER_ISSUER="CN=iPXE Secure Boot Intermediate G1A"

Expand Down
Loading