v0.4.69: PNG boot-menu background (iPXE built from source), NFS AUTH_SYS, FleetDM logo
Three things, headlined by the long-blocked graphical PXE menu.
## 1. Graphical PXE boot background — the iVentoy feature, finally
iVentoy paints a PNG background on the PXE screen using stock iPXE
built with CONSOLE_FRAMEBUFFER + IMAGE_PNG + CONSOLE_CMD; the public
iPXE binaries omit those, so `console --picture` is a no-op on them.
We now build our own iPXE from upstream with that thin config delta
(deploy/ipxe/local/{general,console}.h).
The 8-release blocker was cc1 segfaulting when an amd64 gcc ran under
QEMU emulation on the arm64 build host. Fix: a new `ipxe-build`
Dockerfile stage pinned to $BUILDPLATFORM (native arch — no emulation)
that cross-compiles x86_64 iPXE with CROSS_COMPILE=x86_64-linux-gnu-.
The compiler runs native and emits x86_64. Validated end-to-end:
png.o + fbcon.o + pixbuf.o all compile and link (confirmed via the
linked-ELF symbol table, not just strings), ~112s, no segfault. Host
tools needed libc6-dev (dropped by --no-install-recommends; without
it the native host compile falls through to iPXE's freestanding
headers and dies on bits/stdint.h — fixed).
Server side:
- pxe_logo.rs is now a full-screen background compositor: a dark field
(matching the WebUI theme) with the operator's uploaded logo across
the top, or — with no upload — a default OpenPXE rainbow disc drawn
with pure pixel math (no font/SVG deps). Always 1024x768 (iPXE
doesn't scale; this is the universal mode). WebP/JPEG/GIF/PNG in,
PNG out (iPXE only eats PNG).
- /branding/pxe-logo always returns a PNG now (default when no logo,
default when SVG) so the menu always has a background.
- render_menu uses `console --picture … --top 290 || console`: paints
the background and reserves the logo band on PNG-capable binaries
(x86_64 UEFI), cleanly falls back to text on the others. The ASCII
wordmark is GONE.
Only x86_64 UEFI is built from source (host-arch-agnostic cross build);
BIOS/i386/arm64 keep upstream-fetched no-PNG binaries + text fallback.
Modern clients are overwhelmingly x86_64 UEFI.
## 2. NFS AUTH_SYS credential — fixes NFS3ERR_ACCES
v0.4.68's privileged-port fix got past MNT3ERR_ACCES (mount); operators
then hit NFS3ERR_ACCES on READDIR because nfs3_client defaults to
AUTH_NONE and virtually every server exports sec=sys. We now present an
AUTH_UNIX credential (uid 0 / gid 0): no_root_squash servers treat us
as root, root_squash servers map us to anon which reads any
world-readable ISO share. Kept fixed (no UI knob) to stay dead-simple.
Hint updated: a remaining NFS3ERR_ACCES is now a server-side
permission/squash issue, not IP/auth-flavor.
## 3. FleetDM-style full-width logo (top-left)
When a custom logo is uploaded the sidebar header drops the bundled
mark + "OpenPXE" wordmark and lets the logo span the header
(left-aligned, capped 200x50, contain). Rendered server-side via a
brand-class in index_html (has_custom_logo) so there's no flash of the
default. The bundled-default case is unchanged.
Tests: 164 passing. clippy -D warnings clean. iPXE build stage
validated in isolation before the full image build.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
This commit is contained in:
Miles Ward
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
2f12a2ae84
commit
1eb41288c3
@@ -17,14 +17,11 @@
|
||||
ARG RUST_VERSION=1.95
|
||||
|
||||
########## fetch iPXE binaries + wimboot ##########
|
||||
# v0.4.62: kept on the boot.ipxe.org pre-builds for the moment. We
|
||||
# want PNG support (so `console --picture` paints the operator's logo
|
||||
# on the PXE menu) but the obvious path — adding a new `ipxe-build`
|
||||
# stage that compiles iPXE from source with `IMAGE_PNG` enabled —
|
||||
# runs into a QEMU/gcc instability when cross-emulating x86_64 on
|
||||
# arm64 build hosts (intermittent `cc1` segfaults). The compositor
|
||||
# at /branding/pxe-logo is already wired so when the iPXE rebuild
|
||||
# lands (on native x86_64 hardware), no other code change is needed.
|
||||
# Pulls the upstream boot.ipxe.org pre-builds (no PNG support) plus
|
||||
# wimboot. These cover the arches we don't build from source here:
|
||||
# BIOS undionly.kpxe and i386-efi (which need a 32-bit x86 toolchain),
|
||||
# and serve as the baseline that the PNG-enabled x86_64/arm64 UEFI
|
||||
# binaries from the `ipxe-build` stage overlay on top of.
|
||||
FROM debian:12-slim AS fetch
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
@@ -32,6 +29,36 @@ WORKDIR /src
|
||||
COPY scripts/fetch-ipxe.sh scripts/fetch-ipxe.sh
|
||||
RUN mkdir -p assets/ipxe && bash scripts/fetch-ipxe.sh
|
||||
|
||||
########## build PNG-enabled iPXE from source ##########
|
||||
# v0.4.69: THE graphical-boot-menu unlock. iVentoy paints a PNG
|
||||
# background on the PXE screen using stock iPXE built with
|
||||
# CONSOLE_FRAMEBUFFER + IMAGE_PNG + CONSOLE_CMD; the public iPXE
|
||||
# binaries omit those, so `console --picture` is a no-op on them.
|
||||
# We build our own from upstream with that thin config delta.
|
||||
#
|
||||
# The historical blocker was cc1 segfaulting when an amd64 gcc ran
|
||||
# under QEMU emulation on an arm64 host. The fix: pin this stage to
|
||||
# $BUILDPLATFORM (the NATIVE builder arch — arm64 on an Apple-Silicon
|
||||
# Mac, amd64 in x86 CI) and cross-compile with a real cross toolchain
|
||||
# (CROSS_COMPILE=x86_64-linux-gnu-). The compiler runs native and
|
||||
# emits x86_64 — no emulation, no segfault. arm64-efi builds natively.
|
||||
FROM --platform=$BUILDPLATFORM debian:12-slim AS ipxe-build
|
||||
# libc6-dev is REQUIRED and easy to miss under --no-install-recommends:
|
||||
# iPXE's host utilities (elf2efi, zbin) compile with the native gcc and
|
||||
# pull <stdint.h>; without the native libc headers gcc's #include_next
|
||||
# falls through to iPXE's freestanding headers and dies on bits/stdint.h.
|
||||
# The target (iPXE firmware) code is -ffreestanding/-nostdinc, so the
|
||||
# x86_64 cross toolchain needs NO cross libc headers.
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
git make perl gcc binutils libc6-dev \
|
||||
gcc-x86-64-linux-gnu binutils-x86-64-linux-gnu \
|
||||
ca-certificates \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
WORKDIR /src
|
||||
COPY scripts/build-ipxe.sh scripts/build-ipxe.sh
|
||||
COPY deploy/ipxe/local/ deploy/ipxe/local/
|
||||
RUN mkdir -p assets/ipxe && bash scripts/build-ipxe.sh /src/assets/ipxe
|
||||
|
||||
########## build openpxe ##########
|
||||
FROM rust:${RUST_VERSION}-bookworm AS build
|
||||
WORKDIR /src
|
||||
@@ -64,7 +91,14 @@ RUN apt-get update \
|
||||
# `cargo build`, which is slow and can exhaust small Colima/CI disks.
|
||||
COPY Cargo.toml Cargo.lock ./
|
||||
COPY crates/ crates/
|
||||
# Baseline binaries (BIOS / i386 / wimboot), then overlay the
|
||||
# PNG-enabled x86_64 + arm64 UEFI binaries built from source. The
|
||||
# overlay wins for snponly.efi / ipxe.efi / snponly-arm64.efi so the
|
||||
# common modern clients get the graphical background; the rest keep the
|
||||
# upstream no-PNG binaries and the menu's `|| console` text fallback.
|
||||
COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
|
||||
COPY --from=ipxe-build /src/assets/ipxe/snponly.efi /src/assets/ipxe/snponly.efi
|
||||
COPY --from=ipxe-build /src/assets/ipxe/ipxe.efi /src/assets/ipxe/ipxe.efi
|
||||
|
||||
# Cache cargo registry + target across builds. The mtime touch is
|
||||
# belt-and-suspenders: cargo occasionally misses mtime-only changes on
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
/*
|
||||
* OpenPXE iPXE build override — console options.
|
||||
*
|
||||
* Included at the end of config/console.h. CONSOLE_FRAMEBUFFER is the
|
||||
* unified graphical framebuffer console (EFI GOP on UEFI, VESA on
|
||||
* BIOS); it's what `console --picture` paints into. This is the same
|
||||
* single flag iVentoy enables for its graphical PXE screen.
|
||||
*
|
||||
* We *add* the framebuffer console rather than replacing the default
|
||||
* EFI/BIOS text consoles, so text output still works before/after the
|
||||
* picture is set.
|
||||
*/
|
||||
|
||||
#define CONSOLE_FRAMEBUFFER
|
||||
@@ -0,0 +1,23 @@
|
||||
/*
|
||||
* OpenPXE iPXE build override — general options.
|
||||
*
|
||||
* iPXE includes <config/local/general.h> at the end of config/general.h,
|
||||
* so anything defined here is layered on top of the stock defaults
|
||||
* without editing upstream files. We enable exactly the features the
|
||||
* graphical PXE boot menu needs:
|
||||
*
|
||||
* IMAGE_PNG - PNG decoder, so `console --picture <png>` can paint
|
||||
* the operator's logo / OpenPXE background.
|
||||
* IMAGE_PNM - Netpbm decoder (cheap; harmless belt-and-suspenders).
|
||||
* CONSOLE_CMD - the `console` command itself. Without it you get
|
||||
* "console: command not found" even with a framebuffer.
|
||||
*
|
||||
* (CONSOLE_FRAMEBUFFER lives in config/local/console.h.)
|
||||
*
|
||||
* Everything else stays at upstream defaults — we are intentionally a
|
||||
* thin, auditable delta over stock iPXE so the UBDL/GPL story is simple.
|
||||
*/
|
||||
|
||||
#define IMAGE_PNG
|
||||
#define IMAGE_PNM
|
||||
#define CONSOLE_CMD
|
||||
Reference in New Issue
Block a user