ge-aerospace/pxe-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Menu: Clonezilla boots with Secure Boot on (Debian shim); Memtest86+ removed

Browse Source 
Clonezilla Live runs a Debian-signed kernel whose modules (usb-storage,
uas, exfat) are signed by the same build key, so the menu now starts it
through Debian's Microsoft-signed shim with the iPXE shim command, the
same way Blancco uses Ubuntu's. prepare-boot-tools.sh extracts that shim
from the Clonezilla release (EFI/boot/bootx64.efi -> clonezilla/
shimx64.efi) and warns when the shim is not Microsoft-signed or the
kernel not Debian-signed.

Memtest86+ is unsigned and needed Secure Boot off; memory tests now use
the Dell built-in diagnostics (F12 at power-on, Diagnostics), noted in
the menu. The playbook removes the old memtest web dir. Nothing on the
menu needs Secure Boot off any more; the 'disable Secure Boot' screen
remains only as the fallback when a signed path fails.
This commit is contained in:
cproudlock
2026-10-15 14:47:25 -04:00
parent c8e0b4eace
commit 54015566a7
8 changed files with 63 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
README.md
View File

@@ -16,7 +16,7 @@ Client PXE boot (UEFI Secure Boot)
├── Windows PE -> wimboot -> boot.wim -> startnet.cmd -> Samba share -> Image deployment
├── Clonezilla -> vmlinuz/initrd -> Disk cloning/imaging
├── Blancco -> Native kernel + initramfs -> NIST 800-88 drive erasure
└── Memtest86+ -> Memory diagnostics
(memory test: Dell F12 > Diagnostics)
```
### Services
@@ -69,10 +69,10 @@ Downloads all .deb packages and Python wheels for offline installation (~140 MB
### Step 2: Prepare Boot Tools (optional)
```bash
./scripts/prepare-boot-tools.sh /path/to/blancco.iso /path/to/clonezilla.zip /path/to/memtest.bin
./scripts/prepare-boot-tools.sh /path/to/blancco.iso
```
Extracts and configures boot tool files (Blancco, Clonezilla, Memtest86+). Automatically patches Blancco's config.img to auto-save erasure reports to the PXE server's Samba share.
Extracts and configures boot tool files (Blancco, Clonezilla with Debian's signed shim for Secure Boot). Automatically patches Blancco's config.img to auto-save erasure reports to the PXE server's Samba share.
### Step 3: Build the USB
@@ -167,8 +167,7 @@ pxe-server/
│ └── shopfloor-display-imaging-guide.md # End-user imaging guide
├── boot-tools/ # Extracted boot tool files (gitignored)
│ ├── blancco/ # Blancco Drive Eraser
│ ├── clonezilla/ # Clonezilla Live
│ └── memtest/ # Memtest86+
│ └── clonezilla/ # Clonezilla Live
├── boot-files/ # WinPE boot files (boot.wim, wimboot, ipxe.efi, BCD)
├── offline-packages/ # .deb files (gitignored, built by download-packages.sh)
├── pip-wheels/ # Python wheels (gitignored, built by download-packages.sh)

11
SETUP.md
View File

@@ -11,7 +11,7 @@ Client PXE boot
├── Windows PE -> wimboot -> boot.wim -> startnet.cmd -> Samba -> Image deployment
├── Clonezilla -> vmlinuz/initrd -> Disk cloning/imaging
├── Blancco -> Native kernel + initramfs -> NIST 800-88 drive erasure (auto-reports)
└── Memtest86+ -> Memory diagnostics
(memory test: Dell F12 > Diagnostics)
```
### Services on the PXE Server
@@ -81,10 +81,10 @@ to `pip-wheels/`. About 500 debs (~1.6 GB) + 8 wheels.
### Step 2: Prepare Boot Tools (optional)
```bash
./scripts/prepare-boot-tools.sh /path/to/blancco.iso /path/to/clonezilla.zip /path/to/memtest.bin
./scripts/prepare-boot-tools.sh /path/to/blancco.iso
```
Extracts boot files for Blancco, Clonezilla, and Memtest86+ into the `boot-tools/` directory. Automatically patches Blancco's `config.img` to auto-save erasure reports to the PXE server's Samba share.
Extracts boot files for Blancco and Clonezilla (with Debian's signed shim, so it boots with Secure Boot on) into the `boot-tools/` directory. Automatically patches Blancco's `config.img` to auto-save erasure reports to the PXE server's Samba share.
### Step 3: Build the USB
@@ -175,7 +175,7 @@ Access at `http://172.16.9.1:9009` from any machine on the isolated network.
- **Windows PE**: Boots via wimboot + boot.wim, maps Samba shares, begins deployment
- **Clonezilla**: Boots Clonezilla Live for disk imaging
- **Blancco**: Boots Drive Eraser, auto-saves reports to server
- **Memtest86+**: Runs memory diagnostics
- **Memory test**: not on the menu; Dell PCs have one built in (F12 at power-on, Diagnostics)
## Testing with KVM
@@ -221,8 +221,7 @@ pxe-server/
│ └── shopfloor-display-imaging-guide.md # End-user imaging guide
├── boot-tools/ # Extracted boot files (gitignored, built by prepare-boot-tools.sh)
│ ├── blancco/ # Blancco Drive Eraser
│ ├── clonezilla/ # Clonezilla Live
│ └── memtest/ # Memtest86+
│ └── clonezilla/ # Clonezilla Live
├── boot-files/ # WinPE boot files (boot.wim, wimboot, ipxe.efi, BCD)
├── offline-packages/ # .deb files (gitignored, built by download-packages.sh)
├── pip-wheels/ # Python wheels (gitignored, built by download-packages.sh)

9
docs/ARCHITECTURE.md
View File

@@ -29,7 +29,7 @@ systems.
|---------------|-----------|------------------------------------------------------|
| dnsmasq | 67/udp | DHCP. Hands out IPs and the next-server (TFTP) info. |
| dnsmasq | 69/udp | TFTP. Serves `ipxe.efi` to firmware PXE clients. |
| Apache | 80/tcp | HTTP. Serves wimboot, boot.wim, Blancco binaries, Clonezilla, memtest, and proxies the webapp on /. |
| Apache | 80/tcp | HTTP. Serves wimboot, boot.wim, Blancco binaries, Clonezilla, and proxies the webapp on /. |
| Apache | 4433/tcp | HTTP. Serves `Altiris/iPXE/GetPxeScript.aspx` (the iPXE menu script). |
| Samba | 445/tcp | SMB shares. WinPE mounts these to fetch image content during deployment. |
| Flask webapp | 9009/tcp | Browser UI for image import, unattend editing, log/report viewing. |
@@ -112,9 +112,12 @@ WinPE; the Blancco and Clonezilla utilities require Secure Boot disabled.
c. Clonezilla Live:
iPXE loads vmlinuz + initrd over HTTP, fetches filesystem.squashfs.
With Secure Boot on, the Debian-signed kernel starts through Debian's
Microsoft-signed shim (clonezilla/shimx64.efi, iPXE shim command).
d. Memtest86+:
iPXE loads memtest.efi.
Memory testing is not on the menu: Dell PCs have a built-in test
(F12 at power-on, Diagnostics). Memtest86+ was removed because it is
unsigned and needed Secure Boot off.
```
## Windows imaging lifecycle (gea-* images)

23
playbook/ipxe/GetPxeScript.aspx
View File

@@ -9,9 +9,9 @@ item winpe Windows PE (Image Deployment)
item --gap -- ---- Drive Erase ----
item blancco Blancco Drive Eraser
item blancco_debug Blancco Drive Eraser (debug / SSH)
item --gap -- ---- Utilities (Secure Boot must be DISABLED) ----
item --gap -- ---- Utilities ----
item clonezilla Clonezilla Live (Disk Imaging)
item memtest Memtest86+ (Memory Diagnostics)
item --gap -- Memory test: Dell PCs press F12 at power-on, Diagnostics
item --gap -- ----
item reboot Reboot
item exit Exit to BIOS
@@ -26,7 +26,7 @@ echo
echo Secure Boot is OFF on this PC (or this iPXE cannot tell).
echo (iPXE read SecureBoot as: [${efi/SecureBoot:hex}] [${efi/SecureBoot:uint8}])
echo Windows deployment requires Secure Boot to be ENABLED.
echo If you disabled it for Clonezilla/Memtest, re-enable it now.
echo If you disabled it earlier, re-enable it in BIOS Setup now.
echo
prompt --timeout 5000 Press any key to continue (auto-boot in 5s)... && goto winpe_boot || goto winpe_boot
@@ -51,8 +51,13 @@ prompt Press any key to return to menu... && goto menu || goto menu
set base http://${server}/clonezilla
kernel ${base}/vmlinuz boot=live username=user union=overlay config components noswap edd=on nomodeset nodmraid locales= keyboard-layouts= ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no net.ifnames=0 nosplash noprompt fetch=${base}/filesystem.squashfs || goto secureboot_warn
initrd ${base}/initrd.img || goto boot_failed
# iPXE 2.0 accepts an unsigned EFI kernel (PE fallback) and fails only
# here under Secure Boot.
# Secure Boot ON: Clonezilla runs a Debian-signed kernel, started through
# Debian's Microsoft-signed shim (from the Clonezilla release, staged as
# clonezilla/shimx64.efi by prepare-boot-tools.sh), the same way Blancco
# uses Ubuntu's. Its modules (usb-storage, uas, exfat) are signed by the
# same build key, so USB drives work. Without the shim command (old iPXE)
# the line fails harmlessly and the kernel boots directly (Secure Boot off).
shim ${base}/shimx64.efi ||
boot || goto secureboot_warn
:blancco
@@ -99,12 +104,6 @@ boot || goto blancco_efi_grub
echo Direct kernel boot failed - trying GRUB chain fallback...
chain http://${server}/blancco/grubx64.efi || goto secureboot_warn
:memtest
kernel http://${server}/memtest/memtest.efi || goto secureboot_warn
# iPXE 2.0 accepts an unsigned EFI image (PE fallback) and fails only
# here under Secure Boot.
boot || goto secureboot_warn
:boot_failed
echo
echo Download FAILED (see the error above). Check the PXE server and retry.
@@ -113,7 +112,7 @@ prompt Press any key to return to menu... && goto menu || goto menu
:secureboot_warn
echo
echo ======================================================
echo This option requires Secure Boot to be DISABLED.
echo This option could not start with Secure Boot enabled.
echo
echo 1. Reboot this machine
echo 2. Press F2 / Del to enter BIOS Setup

11
playbook/pxe_server_setup.yml
View File

@@ -699,7 +699,11 @@
loop:
- clonezilla
- blancco
- memtest
- name: "Remove the retired Memtest86+ web dir (memory tests: Dell F12 Diagnostics)"
file:
path: "{{ web_root }}/memtest"
state: absent
- name: "Menu: the Blancco file names in the menu must match blancco_kver"
# GetPxeScript.aspx names the UEFI Blancco files by suffix
@@ -1378,13 +1382,14 @@
debug:
msg: "{{ ipxe_chain.stdout }}"
- name: "Copy boot tool files from USB (Clonezilla, Blancco, Memtest)"
- name: "Copy boot tool files from USB (Clonezilla, Blancco)"
# Clonezilla includes shimx64.efi (Debian's Microsoft-signed shim), which
# the menu uses to boot its Debian-signed kernel with Secure Boot on.
shell: >
cp -r "{{ usb_root }}/boot-tools/{{ item }}/"* "{{ web_root }}/{{ item }}/" 2>/dev/null || true
loop:
- clonezilla
- blancco
- memtest
# --- Blancco PXE boot via Ubuntu kernel + switch_root ---
# Blancco's own kernel freezes on Dell Precision towers. Workaround:

2
scripts/build-usb.sh
View File

@@ -677,7 +677,7 @@ else
echo " WARNING: No boot-files/ found (copy WinPE boot files from Media Creator)"
fi
# Copy boot tools (Clonezilla, Blancco, Memtest) if prepared
# Copy boot tools (Clonezilla, Blancco) if prepared
if [ -n "$BOOT_TOOLS_DIR" ] && [ -d "$BOOT_TOOLS_DIR" ]; then
t_cp "" "$BOOT_TOOLS_DIR"
TOOLS_SIZE=$(du -shL "$BOOT_TOOLS_DIR" | cut -f1)

74
scripts/prepare-boot-tools.sh
View File

@@ -2,8 +2,10 @@
#
# prepare-boot-tools.sh — Download/extract boot files for PXE boot tools
#
# Downloads Clonezilla Live and Memtest86+ for PXE booting,
# and extracts Blancco Drive Eraser from its ISO.
# Downloads Clonezilla Live for PXE booting (with Debian's Microsoft-signed
# shim, so it boots with Secure Boot on), and extracts Blancco Drive Eraser
# from its ISO. No memory tester: Dell PCs have one built in (F12 at
# power-on, Diagnostics).
#
# Usage:
# ./prepare-boot-tools.sh [/path/to/blancco.iso]
@@ -11,7 +13,6 @@
# Output directories:
# boot-tools/clonezilla/ — vmlinuz, initrd.img, filesystem.squashfs
# boot-tools/blancco/ — extracted boot files or ISO for memdisk
# boot-tools/memtest/ — memtest.efi
set -euo pipefail
@@ -24,7 +25,7 @@ if [ -z "$BLANCCO_ISO" ]; then
BLANCCO_ISO=$(find "$REPO_ROOT" -maxdepth 1 -name '*DriveEraser*.iso' -o -name '*blancco*.iso' 2>/dev/null | head -1)
fi
mkdir -p "$OUT_DIR"/{clonezilla,blancco,memtest}
mkdir -p "$OUT_DIR"/{clonezilla,blancco}
echo "============================================"
echo "PXE Boot Tools Preparation"
@@ -32,13 +33,14 @@ echo "============================================"
# --- Clonezilla Live ---
echo ""
echo "[1/3] Clonezilla Live"
echo "[1/2] Clonezilla Live"
CLONEZILLA_VERSION="3.3.3-37"
CLONEZILLA_FILE="clonezilla-live-${CLONEZILLA_VERSION}-amd64.zip"
CLONEZILLA_URL="https://sourceforge.net/projects/clonezilla/files/clonezilla_live_stable/${CLONEZILLA_VERSION}/${CLONEZILLA_FILE}/download"
if [ -f "$OUT_DIR/clonezilla/vmlinuz" ] && [ -f "$OUT_DIR/clonezilla/filesystem.squashfs" ]; then
if [ -f "$OUT_DIR/clonezilla/vmlinuz" ] && [ -f "$OUT_DIR/clonezilla/filesystem.squashfs" ] \
&& [ -f "$OUT_DIR/clonezilla/shimx64.efi" ]; then
echo " Already prepared, skipping. Delete boot-tools/clonezilla/ to re-download."
else
echo " Downloading Clonezilla Live ${CLONEZILLA_VERSION}..."
@@ -59,16 +61,32 @@ else
unzip -o -j "$TMPDIR/$CLONEZILLA_FILE" "live/vmlinuz" -d "$OUT_DIR/clonezilla/"
unzip -o -j "$TMPDIR/$CLONEZILLA_FILE" "live/initrd.img" -d "$OUT_DIR/clonezilla/"
unzip -o -j "$TMPDIR/$CLONEZILLA_FILE" "live/filesystem.squashfs" -d "$OUT_DIR/clonezilla/"
# Debian's Microsoft-signed shim (the release's EFI/boot/bootx64.efi):
# the iPXE menu starts the Debian-signed kernel through it, so
# Clonezilla runs with Secure Boot on (like Blancco via Ubuntu's).
unzip -o -p "$TMPDIR/$CLONEZILLA_FILE" "EFI/boot/bootx64.efi" > "$OUT_DIR/clonezilla/shimx64.efi"
rm -rf "$TMPDIR"
echo " Done."
fi
fi
ls -lh "$OUT_DIR/clonezilla/" 2>/dev/null | grep -E 'vmlinuz|initrd|squashfs' | sed 's/^/ /'
ls -lh "$OUT_DIR/clonezilla/" 2>/dev/null | grep -E 'vmlinuz|initrd|squashfs|shimx64' | sed 's/^/ /'
# The shim must be Microsoft-signed (firmware trusts it) and the kernel
# Debian-signed (the shim trusts that); otherwise Secure Boot refuses them.
if command -v sbverify >/dev/null && [ -s "$OUT_DIR/clonezilla/shimx64.efi" ]; then
if sbverify --list "$OUT_DIR/clonezilla/shimx64.efi" 2>/dev/null | grep -q "Microsoft"; then
echo " shimx64.efi: Microsoft-signed"
else
echo " WARNING: clonezilla/shimx64.efi is not Microsoft-signed; Clonezilla will need Secure Boot off."
fi
if ! sbverify --list "$OUT_DIR/clonezilla/vmlinuz" 2>/dev/null | grep -q "Debian Secure Boot"; then
echo " WARNING: clonezilla/vmlinuz is not Debian-signed; Clonezilla will need Secure Boot off."
fi
fi
# --- Blancco Drive Eraser ---
echo ""
echo "[2/3] Blancco Drive Eraser"
echo "[2/2] Blancco Drive Eraser"
if [ -n "$BLANCCO_ISO" ] && [ -f "$BLANCCO_ISO" ]; then
echo " Extracting from: $BLANCCO_ISO"
@@ -265,43 +283,6 @@ fi
ls -lh "$OUT_DIR/blancco/" 2>/dev/null | grep -v '^total' | sed 's/^/ /'
# --- Memtest86+ ---
echo ""
echo "[3/3] Memtest86+"
MEMTEST_VERSION="8.10"
MEMTEST_URL="https://memtest.org/download/v${MEMTEST_VERSION}/mt86plus_${MEMTEST_VERSION}.binaries.zip"
if [ -f "$OUT_DIR/memtest/memtest.efi" ]; then
echo " Already prepared, skipping."
else
echo " Downloading Memtest86+ v${MEMTEST_VERSION}..."
TMPDIR=$(mktemp -d)
wget -q --show-progress -O "$TMPDIR/memtest.zip" "$MEMTEST_URL" || {
echo " ERROR: Download failed. Download manually from https://memtest.org"
TMPDIR=""
}
if [ -n "$TMPDIR" ] && [ -f "$TMPDIR/memtest.zip" ]; then
echo " Extracting EFI binary..."
unzip -o -j "$TMPDIR/memtest.zip" "memtest64.efi" -d "$OUT_DIR/memtest/" 2>/dev/null || \
unzip -o -j "$TMPDIR/memtest.zip" "mt86plus_${MEMTEST_VERSION}.x64.efi" -d "$OUT_DIR/memtest/" 2>/dev/null || \
unzip -o "$TMPDIR/memtest.zip" -d "$TMPDIR/extract/"
# Find the EFI file regardless of exact name
# 8.x ships the x86_64 UEFI binary as mt86p_<ver>_x86_64 (no .efi).
EFI_FILE=$(find "$TMPDIR" "$OUT_DIR/memtest" \( -name '*.efi' -name '*64*' \) -o -name 'mt86p_*_x86_64' 2>/dev/null | head -1)
if [ -n "$EFI_FILE" ] && [ ! -f "$OUT_DIR/memtest/memtest.efi" ]; then
cp "$EFI_FILE" "$OUT_DIR/memtest/memtest.efi"
fi
rm -rf "$TMPDIR"
echo " Done."
fi
fi
ls -lh "$OUT_DIR/memtest/" 2>/dev/null | grep -v '^total' | sed 's/^/ /'
# --- Summary ---
echo ""
echo "============================================"
@@ -309,7 +290,7 @@ echo "Boot tools prepared in: $OUT_DIR/"
echo "============================================"
echo ""
for tool in clonezilla blancco memtest; do
for tool in clonezilla blancco; do
COUNT=$(find "$OUT_DIR/$tool" -type f 2>/dev/null | wc -l)
SIZE=$(du -sh "$OUT_DIR/$tool" 2>/dev/null | cut -f1)
printf " %-15s %s (%d files)\n" "$tool" "$SIZE" "$COUNT"
@@ -319,7 +300,6 @@ echo ""
echo "These files need to be copied to the PXE server's web root:"
echo " /var/www/html/clonezilla/"
echo " /var/www/html/blancco/"
echo " /var/www/html/memtest/"
echo ""
echo "The build-usb.sh script will include them automatically,"
echo "or copy them manually to the server."

2
tests/vm/README.md
View File

@@ -89,4 +89,4 @@ grow the client while both are off, and put them back afterwards:
Menu keys from the host: `virsh -c qemu:///system send-key <vm> KEY_DOWN`
(separator lines are skipped: Down x1 = Blancco, x3 = Clonezilla,
x4 = Memtest), then KEY_ENTER; startnet answers are KEY_<digit> + KEY_ENTER.
x4 = Reboot), then KEY_ENTER; startnet answers are KEY_<digit> + KEY_ENTER.