40 Releases 41 Tags

RSS Feed

• v0.7.0 3a32d65fb7

  Compare

  v0.7.0 — Secure Boot, boot rules, hardened answer files Pre-Release

  mward4 released this 2026-06-09 20:17:27 -04:00 | 8 commits to main since this release

  Three features. All zero-toggle, all inside the core principles (single static binary, container-first, no test certs, no client trust-store changes).

  Secure Boot — automatic signed shim+GRUB chain

  The v0.6.1 escalation ladder gains a third rung: Firmware → Builtin → Shim. Secure-Boot firmware downloads our unsigned iPXE but refuses to execute it — after two unconfirmed attempts that MAC is automatically offered Fedora's Microsoft-signed shim, which loads the signed GRUB, which fetches a server-rendered menu. Fully signed chain, Secure Boot stays ON, no firmware settings to change on the client.

  • Signed binaries (shimx64.efi/grubx64.efi + arm64 equivalents) are extracted from official Fedora 43 packages at image build and shipped byte-for-byte unmodified.
  • The GRUB menu is rendered live from your boot entries (Linux installers — a signed GRUB only boots signed kernels; sanboot/wimboot entries are iPXE-only and omitted there).
  • Watch for driver=Shim in the DHCP log when an SB client walks the ladder.

  Boot rules + decision webhook (Matrix Boot, but open)

  Ordered, first-match-wins rules — MAC prefix (OUI) and/or client architecture → boot target — generalizing per-MAC pins to whole racks or device families. Plus an optional boot-decision webhook: unmatched boots GET <url>?mac=…&arch=…; a 200 {"target":"<id>"} chains to that target, anything else falls through to the menu (2-second budget, fail-open — a dead endpoint can never block PXE). Editor on the Hosts tab. Decision order: exact pin → rules → webhook → menu.

  Hardened answer-file delivery

  Answer files embed credentials; serving them openly is what got WDS hands-free deployment killed (CVE-2026-0386). Every generated unattended URL now carries a short-lived boot-scoped token, and /unattended/* requires it (or a logged-in operator session) once an admin exists. Automatic — no setting, nothing to migrate; setup-mode installs stay open.

  Validation

  clippy clean · fmt clean · 290 workspace tests green (+18 new) · image build verified the live Fedora fetch (shim-x64 15.8-3 + grub2 2.12-40.fc43, x86_64 and arm64).

  Image

  docker pull gitea.milesward.dev/mward4/openpxe:0.7.0
  

  :0.7.0 / :latest — digest sha256:db8cfde9b27a0602981066bcfea52cd5399e90fa1945bf2449b3b8cfde51857f (linux/amd64).

  Real-world validation notes: the Shim rung needs a Secure-Boot-enabled machine to confirm end-to-end (it adds two quick failed PXE attempts before the signed chain kicks in — expected); rules/webhook and tokens are fully covered by integration tests.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)