Merge branch 'pxe-webapp-redesign' into usb-build

scripts/download-packages.sh

@@ -37,6 +37,7 @@ if [ "${IN_DOCKER:-}" != "1" ] && [ "$HOST_CODENAME" != "noble" ]; then
         -v "$REPO_DIR:/repo" \
         -v "$OUT_DIR_ABS:/out" \
         -e IN_DOCKER=1 \
+        -e BLANCCO_KVER="${BLANCCO_KVER:-}" \
         -w /repo \
         ubuntu:24.04 \
         bash -c "apt-get update -qq && apt-get install -y --no-install-recommends sudo python3-pip python3-setuptools python3-wheel ca-certificates >/dev/null && /repo/scripts/download-packages.sh /out"
@@ -50,6 +51,14 @@ fi
 
 mkdir -p "$OUT_DIR"
 
+# Kernel the Blancco UEFI path boots (playbook var blancco_kver; keep the two
+# in step). The playbook builds vmlinuz-ubuntu-70, kexec-initrd-70.img and
+# kmod-<kver>.tar.gz from this kernel's /boot and /lib/modules, and the
+# Canonical-signed image is what Ubuntu's shim starts with Secure Boot on.
+# The versioned packages pin it; the HWE metapackage keeps the box on the
+# HWE line. Override: BLANCCO_KVER=7.0.0-40-generic ./download-packages.sh
+BLANCCO_KVER="${BLANCCO_KVER:-7.0.0-34-generic}"
+
 # Packages installed by the Ansible playbook (pxe_server_setup.yml)
 PLAYBOOK_PACKAGES=(
     ansible
@@ -71,6 +80,12 @@ PLAYBOOK_PACKAGES=(
     sbsigntool
     zip
     curl
+    # Blancco with Secure Boot on: shimx64.efi.signed + the HWE kernel
+    shim-signed
+    linux-generic-hwe-24.04
+    "linux-image-${BLANCCO_KVER}"
+    "linux-modules-${BLANCCO_KVER}"
+    "linux-modules-extra-${BLANCCO_KVER}"
 )
 
 # Packages installed during autoinstall late-commands (NetworkManager, WiFi, etc.)