v0.4.61: asset cache fix, PNG-enabled iPXE, composed PXE logo
Two real issues v0.4.6 left on the table: Asset caching: - index.html now interpolates the running OpenPXE version into every asset URL as `?v=<version>` (app.css, app.js, logo.svg). Combined with `Cache-Control: no-cache, must-revalidate` on the asset handlers, browsers and intermediary proxies are forced to fetch fresh on every upgrade. Without this, last release's bundled JS kept serving the old UI even after the operator pulled the new image — invisible to anyone who only checks the version chip in the footer (which is dynamic). - The Cache-Control header is also applied to logo.svg and loader.svg so a logo upload reflects immediately rather than after a hard refresh. Real-image PXE menu logo (matches iVentoy now): - New Dockerfile stage `ipxe-build` clones the iPXE source and compiles all four binaries (undionly.kpxe, snponly.efi for x86_64/i386, snponly.efi for arm64 via gcc-aarch64-linux-gnu) with IMAGE_PNG + CONSOLE_FRAMEBUFFER + CONSOLE_VESAFB enabled. Replaces the boot.ipxe.org fetch — those binaries are built without PNG support, which is why v0.4.6's `console --picture` line silently no-op'd. - `iso-store::pxe_logo::compose_pxe_logo` decodes any operator upload (PNG / JPEG / WebP / GIF), downscales-to-fit if larger than 600×200, and pastes it onto a transparent 1024×768 canvas centered horizontally with a 64-pixel top margin. iPXE paints the result at 1:1 on the typical VESA framebuffer, giving the iVentoy-style centered-logo look regardless of the operator's source dimensions. - GET /branding/pxe-logo now returns the composed PNG. wimboot still fetches from ipxe/wimboot's GitHub release (separately signed). - Dropped the ASCII OpenPXE wordmark from render_menu — once the real image paints, the banner would duplicate it visually. iPXE builds without PNG (none of ours after this release, but a third- party undionly might) simply show the menu without a logo, which is the right graceful-degradation outcome. Quality: - 142 tests passing (was 138 in v0.4.6): +4 pxe_logo unit tests covering canvas dimensions, centered-top placement, oversize downscale, and unsupported-bytes error handling; existing integration tests updated to verify the 1024×768 IHDR header from the composed PNG instead of round-tripping the raw upload. - cargo clippy --workspace --all-targets clean. - Image dependency: `image = "0.25"` with only `png/jpeg/webp/gif` features enabled. No new transitive C deps. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
This commit is contained in:
Miles Ward
co-authored by
Claude Opus 4.7
Claude Opus 4.7
parent
55f4765a20
commit
1419309a2d
@@ -16,13 +16,79 @@
|
||||
|
||||
ARG RUST_VERSION=1.95
|
||||
|
||||
########## fetch iPXE binaries ##########
|
||||
########## fetch wimboot (and a sanity-check fetch of upstream iPXE) ##########
|
||||
# v0.4.61: we no longer ship the boot.ipxe.org iPXE binaries directly;
|
||||
# instead we build iPXE from source with IMAGE_PNG enabled (see the
|
||||
# ipxe-build stage below). The fetch stage still pulls wimboot (a
|
||||
# pre-signed binary from ipxe/wimboot's GitHub release) since that's
|
||||
# unrelated to the PNG concern.
|
||||
FROM debian:12-slim AS fetch
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
WORKDIR /src
|
||||
COPY scripts/fetch-ipxe.sh scripts/fetch-ipxe.sh
|
||||
RUN mkdir -p assets/ipxe && bash scripts/fetch-ipxe.sh
|
||||
RUN mkdir -p assets/ipxe && \
|
||||
curl --fail --silent --show-error --location \
|
||||
-o assets/ipxe/wimboot \
|
||||
https://github.com/ipxe/wimboot/releases/latest/download/wimboot \
|
||||
|| echo "wimboot fetch failed; Windows toggle will stay disabled"
|
||||
|
||||
########## build iPXE from source with IMAGE_PNG enabled ##########
|
||||
# This stage replaces the old "grab pre-built binaries from
|
||||
# boot.ipxe.org" path. The shipped binaries there are built with the
|
||||
# default config which omits `IMAGE_PNG`, so the `console --picture`
|
||||
# call in render_menu silently no-ops — operator logos never paint.
|
||||
# Building from source lets us flip the one flag we need.
|
||||
#
|
||||
# Cross-compilation: x86_64 + i386 use the native toolchain that ships
|
||||
# in the rust:bookworm base; arm64 uses gcc-aarch64-linux-gnu. The four
|
||||
# output binaries match the names openpxe-ipxe-assets expects in
|
||||
# assets/ipxe/.
|
||||
FROM rust:${RUST_VERSION}-bookworm AS ipxe-build
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends \
|
||||
git build-essential liblzma-dev mtools genisoimage syslinux \
|
||||
gcc-aarch64-linux-gnu \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
WORKDIR /build
|
||||
# Pin to a recent iPXE master tip via shallow clone. iPXE doesn't tag
|
||||
# releases; pinning the SHA in source would be a periodic chore. The
|
||||
# tradeoff is that "rebuild the container" silently picks up upstream
|
||||
# patches — for a boot loader this is the right side of the
|
||||
# pin-vs-fresh tradeoff (we want CVE fixes ASAP and the PXE chain is
|
||||
# the trusted base).
|
||||
RUN git clone --depth=1 https://github.com/ipxe/ipxe.git ipxe
|
||||
WORKDIR /build/ipxe/src
|
||||
# Feature flags landed via the `config/local/` override files iPXE's
|
||||
# config system reads after `config/general.h`. We enable just the
|
||||
# image format + framebuffer console plumbing — everything else stays
|
||||
# at the upstream default. `keep-debug` is off; `parserrors` is off; we
|
||||
# pin a small set of useful tweaks.
|
||||
RUN mkdir -p config/local \
|
||||
&& printf '%s\n' \
|
||||
'#define IMAGE_PNG' \
|
||||
'#define CONSOLE_FRAMEBUFFER' \
|
||||
'#define CONSOLE_VESAFB' \
|
||||
'#define DOWNLOAD_PROTO_HTTPS' \
|
||||
'#define NSLOOKUP_CMD' \
|
||||
'#define NTP_CMD' \
|
||||
> config/local/general.h
|
||||
# Each arch builds to its own `bin-*` directory. We copy the four
|
||||
# output binaries into /out/ with the names openpxe-ipxe-assets
|
||||
# expects. Stripping the binaries saves ~30% — they go into the rust
|
||||
# binary via include_bytes! so the savings ripple through the final
|
||||
# image.
|
||||
RUN mkdir -p /out && \
|
||||
make -j"$(nproc)" bin/undionly.kpxe && \
|
||||
cp bin/undionly.kpxe /out/undionly.kpxe && \
|
||||
make -j"$(nproc)" bin-x86_64-efi/snponly.efi && \
|
||||
cp bin-x86_64-efi/snponly.efi /out/snponly.efi && \
|
||||
make -j"$(nproc)" bin-x86_64-efi/ipxe.efi && \
|
||||
cp bin-x86_64-efi/ipxe.efi /out/ipxe.efi && \
|
||||
make -j"$(nproc)" bin-i386-efi/snponly.efi && \
|
||||
cp bin-i386-efi/snponly.efi /out/snponly-i386.efi && \
|
||||
make -j"$(nproc)" CROSS_COMPILE=aarch64-linux-gnu- bin-arm64-efi/snponly.efi && \
|
||||
cp bin-arm64-efi/snponly.efi /out/snponly-arm64.efi && \
|
||||
ls -lh /out/
|
||||
|
||||
########## build openpxe ##########
|
||||
FROM rust:${RUST_VERSION}-bookworm AS build
|
||||
@@ -56,7 +122,11 @@ RUN apt-get update \
|
||||
# `cargo build`, which is slow and can exhaust small Colima/CI disks.
|
||||
COPY Cargo.toml Cargo.lock ./
|
||||
COPY crates/ crates/
|
||||
COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
|
||||
# v0.4.61: iPXE binaries come from our own source-built stage with
|
||||
# IMAGE_PNG enabled. wimboot still comes from the fetch stage (it's
|
||||
# from ipxe/wimboot's GitHub release, separately signed).
|
||||
COPY --from=ipxe-build /out/ /src/assets/ipxe/
|
||||
COPY --from=fetch /src/assets/ipxe/wimboot /src/assets/ipxe/wimboot
|
||||
|
||||
# Cache cargo registry + target across builds. The mtime touch is
|
||||
# belt-and-suspenders: cargo occasionally misses mtime-only changes on
|
||||
|
||||
Reference in New Issue
Block a user