mward4/OpenPXE
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 40 Wiki Activity

40 Releases 41 Tags

RSS Feed
  • v0.7.1 29040e8a5a
    Compare

    v0.7.1 — some devices just hate iPXE Pre-Release

    mward4 released this 2026-06-09 21:16:22 -04:00 | 7 commits to main since this release

    Operational refinement of the v0.7.0 escalation ladder, answering "can a machine try all three boot binaries in one go?" The protocol can't carry three boot files in one cycle — but we can make the learning walk a once-per-machine-ever event, and let operators skip it entirely.

    What changed

    • Learned driver modes persist (driver_modes.json in the work dir). A MAC that reaches the Shim rung, or proves Builtin works via the iPXE handoff, is remembered across restarts and idle periods — no more re-walking the ladder every 30 minutes. The file only records exceptions; a healthy fleet never writes it. Corrupt/missing file starts clean.
    • Rules can pin the boot binary. The Boot rules table (Hosts tab) gains a Boot binary column: auto (learn) / Firmware NIC / iPXE drivers / Secure Boot (shim). A pinned rule is consulted before the ladder — a known Secure-Boot rack boots the signed chain on its very first cycle, zero failures. Mode pins and target rules coexist on the same client.
    • Same-boot self-healing in the shim stage. The GRUB config now tries to chainload full iPXE before showing the signed menu: with Secure Boot off the chainload succeeds and the client gets the complete iPXE feature set back in that same boot (and the handoff pins the working mode); with Secure Boot on, shim refuses it inline — no reboot — and the signed menu appears.

    Why not literally one cycle for everyone

    DHCP/PXE hands the firmware exactly one boot file per cycle, the Secure-Boot refusal happens after our part is done (no error report comes back), and the broken-NIC case specifically requires the firmware itself to load builtin-driver iPXE — GRUB's network rides the same broken firmware stack, so routing everything through shim-first would strand exactly the machines the Builtin rung exists for. Worst case remains 2 failed cycles (~15–30 s) — now paid once per machine per lifetime, or never with a rule pin.

    Validation

    clippy clean · fmt clean · 299 workspace tests green (+9 new: persistence round-trip across restart, Shim/Builtin pins surviving the TTL, corrupt-file recovery, default-mode-never-persisted, rule-pin matching with unknown-mode tolerance and pin/target coexistence, GRUB chainload-before-menu ordering, API round-trip of the pin field).

    Image

    docker pull gitea.milesward.dev/mward4/openpxe:0.7.1

    :0.7.1 / :latest — digest sha256:4bc3da30528177c6895e2ec9e8ccdced7e06145a4c4765d95c61821f2888a163 (linux/amd64).

    Downloads