Miles WardandClaude Opus 4.8
3a32d65fb7
Three features, all zero-toggle and principle-clean (single static musl
binary, container-first, no test certs, no client trust-store changes).
Secure Boot via signed shim+GRUB (automatic):
- The v0.6.1 escalation ladder gains a third rung: Firmware -> Builtin
-> Shim. Secure-Boot firmware downloads our unsigned iPXE but refuses
to execute it — indistinguishable from a failed chainload — so after
two unconfirmed attempts the MAC is offered Fedora's Microsoft-signed
shimx64.efi, which loads the signed GRUB, which fetches a
server-rendered grub.cfg. Fully signed chain, SB stays on.
- scripts/fetch-shim.sh pulls shim-x64/grub2-efi-x64 (+aa64 best-effort)
from the official Fedora 43 packages and ships the EFI binaries
byte-for-byte unmodified; Dockerfile fetch stage gained rpm2cpio/cpio.
- New grub_script renderer (Linux kernel entries only — signed GRUB only
boots signed kernels; sanboot/wimboot have no signed equivalent and
are omitted with an explanatory menu line).
- TFTP server gains a DynamicAsset hook for server-rendered names
(grub.cfg); HTTP serves the same config under /ipxe/grub.cfg for
native UEFI HTTP Boot chains. Arch-aware fallback walks back down the
ladder where no shim exists (BIOS, IA32).
Boot rules + decision webhook (open 'Matrix Boot'):
- Ordered first-match-wins rules over MAC prefix + client arch (the DHCP
proxy now bakes arch into the boot.ipxe chain URL), generalizing
per-MAC pins. Persisted to boot_rules.json; GET/PUT /api/boot-rules;
rules editor + webhook field on the Hosts tab.
- Optional pixiecore-style webhook: unmatched boots GET
<url>?mac=&arch= and 200 {"target":"id"} chains to it. Fail-open
with a 2s budget — a dead endpoint can never block PXE.
- Decision order: exact pin -> rules -> webhook -> menu. Empty config
is byte-for-byte the previous behavior.
Tokenized answer files (the post-WDS/CVE-2026-0386 hardening):
- Every generated unattended URL (inst.ks / preseed url / autoinstall
seed) now carries a 4h boot-scoped token; /unattended/{id} and the
cloud-init seed routes require it (or an operator session) once an
admin exists. Stops answer-file credential harvesting by anything
else on the network. No toggle; setup-mode installs stay open.
Validation: clippy clean, fmt clean, 290 workspace tests green
(+18 new across boot_tokens, boot_rules, arch ladder, escalation,
grub renderer, and four new full-flow integration tests).
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
148 lines
5.6 KiB
TOML
148 lines
5.6 KiB
TOML
[workspace]
|
|
resolver = "2"
|
|
members = [
|
|
"crates/core",
|
|
"crates/dhcp-proxy",
|
|
"crates/tftp",
|
|
"crates/http-api",
|
|
"crates/iso-store",
|
|
"crates/ipxe-assets",
|
|
"crates/webui",
|
|
"crates/openpxe",
|
|
]
|
|
|
|
[workspace.package]
|
|
version = "0.7.0"
|
|
edition = "2021"
|
|
rust-version = "1.95"
|
|
license = "MIT OR Apache-2.0"
|
|
repository = "https://gitea.milesward.dev/mward4/OpenPXE"
|
|
authors = ["OpenPXE contributors"]
|
|
|
|
[workspace.dependencies]
|
|
tokio = { version = "1.52", features = ["full"] }
|
|
tokio-util = { version = "0.7", features = ["io"] }
|
|
tokio-stream = { version = "0.1", features = ["sync"] }
|
|
futures = "0.3"
|
|
async-trait = "0.1"
|
|
|
|
# v0.6.2: dhcproto 0.15 drops the deprecated trust-dns-proto dependency
|
|
# (replaced by hickory-proto) and carries three releases of DHCP option
|
|
# coverage accumulated upstream — both directly relevant to the proxy core.
|
|
dhcproto = "0.15"
|
|
socket2 = { version = "0.6", features = ["all"] }
|
|
bytes = "1.7"
|
|
|
|
axum = { version = "0.8", features = ["macros", "multipart", "http2"] }
|
|
tower = "0.5"
|
|
tower-http = { version = "0.6", features = ["fs", "trace", "cors", "limit"] }
|
|
hyper = "1.9"
|
|
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream", "json"] }
|
|
|
|
serde = { version = "1.0", features = ["derive"] }
|
|
serde_json = "1.0"
|
|
toml = "0.8"
|
|
# v0.5.4: layered config (TOML file + env). Pure-Rust, no C deps; keeps the
|
|
# static-musl build OpenSSL-free. Replaces the hand-rolled apply_env mapping.
|
|
figment = { version = "0.10", features = ["toml", "env"] }
|
|
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
|
|
|
|
anyhow = "1.0"
|
|
thiserror = "2.0"
|
|
clap = { version = "4.5", features = ["derive", "env"] }
|
|
uuid = { version = "1.10", features = ["v4", "serde"] }
|
|
time = { version = "0.3", features = ["serde", "serde-human-readable", "formatting", "macros"] }
|
|
# sha2 stays 0.10 deliberately: bergshamra-crypto requires ^0.10, and
|
|
# bumping to 0.11 would split the RustCrypto digest stack in the tree.
|
|
sha2 = "0.10"
|
|
hex = "0.4"
|
|
bcrypt = "0.19"
|
|
parking_lot = "0.12"
|
|
rust-embed = { version = "8.5", features = ["include-exclude"] }
|
|
|
|
# v0.4.67: pure-Rust NFSv3 client. Replaces the (deleted-in-v0.4.65)
|
|
# kernel-mount NFS path with an in-process implementation that works
|
|
# in any container — no kernel modules, no CAP_SYS_ADMIN, no
|
|
# subprocess. Ships alongside the userspace SMB consumer; operators
|
|
# pick whichever protocol their NAS prefers.
|
|
nfs3_client = { version = "0.9", features = ["tokio"] }
|
|
nfs3_types = "0.5"
|
|
|
|
# v0.5.0: SMTP for webhook notifications (Slack/Teams/Discord go over
|
|
# plain HTTP via reqwest; email needs a real SMTP client). rustls TLS
|
|
# to match reqwest and stay musl-static-friendly — no OpenSSL.
|
|
lettre = { version = "0.11", default-features = false, features = ["smtp-transport", "tokio1-rustls-tls", "builder", "hostname"] }
|
|
|
|
# v0.5.1: pure-Rust SAML 2.0 Service Provider. bergshamra does XML-DSig
|
|
# verification + exclusive c14n with RustCrypto (no OpenSSL/xmlsec/libxml2
|
|
# C deps), so the static musl binary stays OpenSSL-free — samael was
|
|
# rejected precisely because it hard-requires OpenSSL. We build the thin
|
|
# SP layer (AuthnRequest, metadata parse, SAMLResponse semantics) on top.
|
|
bergshamra = "0.5"
|
|
roxmltree = "0.21"
|
|
quick-xml = "0.40"
|
|
x509-parser = "0.18"
|
|
# flate2 default backend is miniz_oxide (pure Rust) — do NOT enable the
|
|
# zlib/zlib-ng C backends, which would break the musl-static build.
|
|
flate2 = "1.1"
|
|
base64 = "0.22"
|
|
|
|
# v0.5.5: pure-Rust SSH/SFTP client for reading remote ISO libraries
|
|
# over SFTP without a kernel mount.
|
|
#
|
|
# CRITICAL #1 — crypto backend: `default-features = false` +
|
|
# `features = ["ring"]`. russh's *default* backend is `aws-lc-rs`, which
|
|
# pulls `aws-lc-sys` (C code, fiddly under musl); the `ring` feature
|
|
# instead reuses `ring 0.17` — the exact crate+version already in the
|
|
# binary via rustls + bergshamra — so SFTP adds ZERO new C/crypto deps
|
|
# and the static-musl build stays OpenSSL-free.
|
|
#
|
|
# CRITICAL #2 — history: this was pinned to =0.55.0 from v0.5.5 until
|
|
# v0.6.3 because bergshamra-crypto pinned release-candidate RustCrypto
|
|
# crates that conflicted with the stable generation russh 0.56+ pulls.
|
|
# bergshamra 0.5 (2026-06) moved to the stable generation (pkcs8 0.11),
|
|
# lifting the pin. v0.6.3 bumps to 0.61+, which also closes a batch of
|
|
# RUSTSEC advisories reachable from the SFTP *client* path (unbounded
|
|
# allocations in packet parsing — CVE-2026-48110/-46702/-46673 et al.)
|
|
# and drops mlock on non-secret buffers (~21% SSH throughput upstream).
|
|
#
|
|
# SCP was deliberately rejected: the protocol is sequential-only (no
|
|
# random access → no HTTP Range, unlike SFTP/NFS) and the mature SCP
|
|
# crates wrap libssh2 (C + OpenSSL), which would break this build.
|
|
russh = { version = "0.61", default-features = false, features = ["ring"] }
|
|
russh-sftp = "2.3"
|
|
|
|
openpxe-core = { path = "crates/core" }
|
|
openpxe-dhcp-proxy = { path = "crates/dhcp-proxy" }
|
|
openpxe-tftp = { path = "crates/tftp" }
|
|
openpxe-http-api = { path = "crates/http-api" }
|
|
openpxe-iso-store = { path = "crates/iso-store" }
|
|
openpxe-ipxe-assets = { path = "crates/ipxe-assets" }
|
|
openpxe-webui = { path = "crates/webui" }
|
|
|
|
[workspace.lints.rust]
|
|
unsafe_code = "deny"
|
|
rust_2018_idioms = { level = "warn", priority = -1 }
|
|
|
|
[workspace.lints.clippy]
|
|
pedantic = { level = "warn", priority = -1 }
|
|
module_name_repetitions = "allow"
|
|
missing_errors_doc = "allow"
|
|
missing_panics_doc = "allow"
|
|
must_use_candidate = "allow"
|
|
doc_markdown = "allow"
|
|
items_after_statements = "allow"
|
|
cast_possible_truncation = "allow"
|
|
cast_lossless = "allow"
|
|
cast_sign_loss = "allow"
|
|
similar_names = "allow"
|
|
too_many_lines = "allow"
|
|
|
|
[profile.release]
|
|
lto = "thin"
|
|
codegen-units = 1
|
|
strip = "symbols"
|
|
opt-level = 3
|