v0.7.0: Secure Boot chain, boot rules + decision webhook, tokenized answer files

Three features, all zero-toggle and principle-clean (single static musl
binary, container-first, no test certs, no client trust-store changes).

Secure Boot via signed shim+GRUB (automatic):
- The v0.6.1 escalation ladder gains a third rung: Firmware -> Builtin
  -> Shim. Secure-Boot firmware downloads our unsigned iPXE but refuses
  to execute it — indistinguishable from a failed chainload — so after
  two unconfirmed attempts the MAC is offered Fedora's Microsoft-signed
  shimx64.efi, which loads the signed GRUB, which fetches a
  server-rendered grub.cfg. Fully signed chain, SB stays on.
- scripts/fetch-shim.sh pulls shim-x64/grub2-efi-x64 (+aa64 best-effort)
  from the official Fedora 43 packages and ships the EFI binaries
  byte-for-byte unmodified; Dockerfile fetch stage gained rpm2cpio/cpio.
- New grub_script renderer (Linux kernel entries only — signed GRUB only
  boots signed kernels; sanboot/wimboot have no signed equivalent and
  are omitted with an explanatory menu line).
- TFTP server gains a DynamicAsset hook for server-rendered names
  (grub.cfg); HTTP serves the same config under /ipxe/grub.cfg for
  native UEFI HTTP Boot chains. Arch-aware fallback walks back down the
  ladder where no shim exists (BIOS, IA32).

Boot rules + decision webhook (open 'Matrix Boot'):
- Ordered first-match-wins rules over MAC prefix + client arch (the DHCP
  proxy now bakes arch into the boot.ipxe chain URL), generalizing
  per-MAC pins. Persisted to boot_rules.json; GET/PUT /api/boot-rules;
  rules editor + webhook field on the Hosts tab.
- Optional pixiecore-style webhook: unmatched boots GET
  <url>?mac=&arch= and 200 {"target":"id"} chains to it. Fail-open
  with a 2s budget — a dead endpoint can never block PXE.
- Decision order: exact pin -> rules -> webhook -> menu. Empty config
  is byte-for-byte the previous behavior.

Tokenized answer files (the post-WDS/CVE-2026-0386 hardening):
- Every generated unattended URL (inst.ks / preseed url / autoinstall
  seed) now carries a 4h boot-scoped token; /unattended/{id} and the
  cloud-init seed routes require it (or an operator session) once an
  admin exists. Stops answer-file credential harvesting by anything
  else on the network. No toggle; setup-mode installs stay open.

Validation: clippy clean, fmt clean, 290 workspace tests green
(+18 new across boot_tokens, boot_rules, arch ladder, escalation,
grub renderer, and four new full-flow integration tests).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/core/src/boot_tokens.rs

@@ -0,0 +1,138 @@
+//! One-time(ish) access tokens for unattended answer files (v0.7.0).
+//!
+//! Why: answer files routinely embed credentials (local admin passwords,
+//! domain-join accounts, root hashes). Serving them to anyone who can
+//! GET `/unattended/<id>` is exactly the exposure that got WDS
+//! hands-free deployment disabled upstream (CVE-2026-0386 hardening
+//! guidance). OpenPXE generates every answer-file URL it injects into a
+//! boot chain, so it can scope each URL to the boot that requested it:
+//! when a boot script is rendered, a short-lived token is minted and
+//! appended; the serving endpoint requires it (or a logged-in operator
+//! session, so browser testing keeps working).
+//!
+//! Deliberately multi-use within the TTL rather than strictly one-shot:
+//! real installers fetch the same file more than once (initramfs +
+//! installer stage, cloud-init retries), and the token's job is to stop
+//! *unrelated* hosts from harvesting credentials, not to count fetches.
+//!
+//! In-memory only. A server restart invalidates outstanding tokens —
+//! acceptable because a restart also interrupts the ISO streaming an
+//! in-flight install depends on, and the next boot mints fresh ones.
+
+use parking_lot::Mutex;
+use std::collections::HashMap;
+use std::time::{Duration, Instant};
+use uuid::Uuid;
+
+/// Long enough to cover a slow OS install end-to-end (the answer file is
+/// fetched early, but cloud-init can re-read late), short enough that a
+/// leaked URL goes stale the same afternoon.
+const TOKEN_TTL: Duration = Duration::from_hours(4);
+
+/// Hard cap on outstanding tokens; past it the oldest is evicted. Tokens
+/// are minted once per boot-script render, so this only matters under
+/// abuse, and serving must never become a memory-growth vector.
+const MAX_TOKENS: usize = 4096;
+
+#[derive(Debug, Clone)]
+struct Grant {
+    file_id: String,
+    issued: Instant,
+}
+
+/// In-memory token table. Cheap to clone (`Arc`-shared).
+#[derive(Debug, Clone, Default)]
+pub struct BootTokens {
+    inner: std::sync::Arc<Mutex<HashMap<String, Grant>>>,
+}
+
+impl BootTokens {
+    #[must_use]
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Mint a token granting access to unattended file `file_id` for the
+    /// next [`TOKEN_TTL`]. Returns the opaque token value to embed in the
+    /// generated URL.
+    #[must_use]
+    pub fn mint(&self, file_id: &str) -> String {
+        self.mint_at(file_id, Instant::now())
+    }
+
+    /// Is `token` a live grant for `file_id`?
+    #[must_use]
+    pub fn check(&self, token: &str, file_id: &str) -> bool {
+        self.check_at(token, file_id, Instant::now())
+    }
+
+    fn mint_at(&self, file_id: &str, now: Instant) -> String {
+        let token = Uuid::new_v4().simple().to_string();
+        let mut g = self.inner.lock();
+        g.retain(|_, gr| now.duration_since(gr.issued) < TOKEN_TTL);
+        if g.len() >= MAX_TOKENS {
+            if let Some(oldest) = g
+                .iter()
+                .min_by_key(|(_, gr)| gr.issued)
+                .map(|(k, _)| k.clone())
+            {
+                g.remove(&oldest);
+            }
+        }
+        g.insert(
+            token.clone(),
+            Grant {
+                file_id: file_id.to_string(),
+                issued: now,
+            },
+        );
+        token
+    }
+
+    fn check_at(&self, token: &str, file_id: &str, now: Instant) -> bool {
+        let g = self.inner.lock();
+        g.get(token)
+            .is_some_and(|gr| gr.file_id == file_id && now.duration_since(gr.issued) < TOKEN_TTL)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn mint_then_check_round_trip() {
+        let t = BootTokens::new();
+        let tok = t.mint("ks-1");
+        assert!(t.check(&tok, "ks-1"));
+        // Multi-use within TTL: a second fetch still passes.
+        assert!(t.check(&tok, "ks-1"));
+        // Wrong file id never passes, even with a live token.
+        assert!(!t.check(&tok, "ks-2"));
+        // Unknown token never passes.
+        assert!(!t.check("nope", "ks-1"));
+    }
+
+    #[test]
+    fn token_expires_after_ttl() {
+        let t = BootTokens::new();
+        let now = Instant::now();
+        let tok = t.mint_at("ks-1", now);
+        let just_before = TOKEN_TTL.checked_sub(Duration::from_secs(1)).unwrap();
+        assert!(t.check_at(&tok, "ks-1", now + just_before));
+        assert!(!t.check_at(&tok, "ks-1", now + TOKEN_TTL + Duration::from_secs(1)));
+    }
+
+    #[test]
+    fn table_is_capped() {
+        let t = BootTokens::new();
+        let now = Instant::now();
+        let first = t.mint_at("f", now);
+        for i in 0..MAX_TOKENS {
+            let _ = t.mint_at(&format!("f{i}"), now + Duration::from_secs(1));
+        }
+        // The oldest grant was evicted to stay within the cap.
+        assert!(!t.check_at(&first, "f", now + Duration::from_secs(2)));
+        assert!(t.inner.lock().len() <= MAX_TOKENS);
+    }
+}