From 54015566a721c2a6434cb4bc67234e21d5ecc231 Mon Sep 17 00:00:00 2001 From: cproudlock Date: Thu, 15 Oct 2026 14:47:25 -0400 Subject: [PATCH] Menu: Clonezilla boots with Secure Boot on (Debian shim); Memtest86+ removed Clonezilla Live runs a Debian-signed kernel whose modules (usb-storage, uas, exfat) are signed by the same build key, so the menu now starts it through Debian's Microsoft-signed shim with the iPXE shim command, the same way Blancco uses Ubuntu's. prepare-boot-tools.sh extracts that shim from the Clonezilla release (EFI/boot/bootx64.efi -> clonezilla/ shimx64.efi) and warns when the shim is not Microsoft-signed or the kernel not Debian-signed. Memtest86+ is unsigned and needed Secure Boot off; memory tests now use the Dell built-in diagnostics (F12 at power-on, Diagnostics), noted in the menu. The playbook removes the old memtest web dir. Nothing on the menu needs Secure Boot off any more; the 'disable Secure Boot' screen remains only as the fallback when a signed path fails. --- README.md | 9 ++-- SETUP.md | 11 +++-- docs/ARCHITECTURE.md | 9 ++-- playbook/ipxe/GetPxeScript.aspx | 23 +++++----- playbook/pxe_server_setup.yml | 11 +++-- scripts/build-usb.sh | 2 +- scripts/prepare-boot-tools.sh | 74 ++++++++++++--------------------- tests/vm/README.md | 2 +- 8 files changed, 63 insertions(+), 78 deletions(-) diff --git a/README.md b/README.md index 8cf72dd..03d458c 100644 --- a/README.md +++ b/README.md @@ -16,7 +16,7 @@ Client PXE boot (UEFI Secure Boot) ├── Windows PE -> wimboot -> boot.wim -> startnet.cmd -> Samba share -> Image deployment ├── Clonezilla -> vmlinuz/initrd -> Disk cloning/imaging ├── Blancco -> Native kernel + initramfs -> NIST 800-88 drive erasure - └── Memtest86+ -> Memory diagnostics + (memory test: Dell F12 > Diagnostics) ``` ### Services @@ -69,10 +69,10 @@ Downloads all .deb packages and Python wheels for offline installation (~140 MB ### Step 2: Prepare Boot Tools (optional) ```bash -./scripts/prepare-boot-tools.sh /path/to/blancco.iso /path/to/clonezilla.zip /path/to/memtest.bin +./scripts/prepare-boot-tools.sh /path/to/blancco.iso ``` -Extracts and configures boot tool files (Blancco, Clonezilla, Memtest86+). Automatically patches Blancco's config.img to auto-save erasure reports to the PXE server's Samba share. +Extracts and configures boot tool files (Blancco, Clonezilla with Debian's signed shim for Secure Boot). Automatically patches Blancco's config.img to auto-save erasure reports to the PXE server's Samba share. ### Step 3: Build the USB @@ -167,8 +167,7 @@ pxe-server/ │ └── shopfloor-display-imaging-guide.md # End-user imaging guide ├── boot-tools/ # Extracted boot tool files (gitignored) │ ├── blancco/ # Blancco Drive Eraser -│ ├── clonezilla/ # Clonezilla Live -│ └── memtest/ # Memtest86+ +│ └── clonezilla/ # Clonezilla Live ├── boot-files/ # WinPE boot files (boot.wim, wimboot, ipxe.efi, BCD) ├── offline-packages/ # .deb files (gitignored, built by download-packages.sh) ├── pip-wheels/ # Python wheels (gitignored, built by download-packages.sh) diff --git a/SETUP.md b/SETUP.md index fb1172a..d0fb22c 100644 --- a/SETUP.md +++ b/SETUP.md @@ -11,7 +11,7 @@ Client PXE boot ├── Windows PE -> wimboot -> boot.wim -> startnet.cmd -> Samba -> Image deployment ├── Clonezilla -> vmlinuz/initrd -> Disk cloning/imaging ├── Blancco -> Native kernel + initramfs -> NIST 800-88 drive erasure (auto-reports) - └── Memtest86+ -> Memory diagnostics + (memory test: Dell F12 > Diagnostics) ``` ### Services on the PXE Server @@ -81,10 +81,10 @@ to `pip-wheels/`. About 500 debs (~1.6 GB) + 8 wheels. ### Step 2: Prepare Boot Tools (optional) ```bash -./scripts/prepare-boot-tools.sh /path/to/blancco.iso /path/to/clonezilla.zip /path/to/memtest.bin +./scripts/prepare-boot-tools.sh /path/to/blancco.iso ``` -Extracts boot files for Blancco, Clonezilla, and Memtest86+ into the `boot-tools/` directory. Automatically patches Blancco's `config.img` to auto-save erasure reports to the PXE server's Samba share. +Extracts boot files for Blancco and Clonezilla (with Debian's signed shim, so it boots with Secure Boot on) into the `boot-tools/` directory. Automatically patches Blancco's `config.img` to auto-save erasure reports to the PXE server's Samba share. ### Step 3: Build the USB @@ -175,7 +175,7 @@ Access at `http://172.16.9.1:9009` from any machine on the isolated network. - **Windows PE**: Boots via wimboot + boot.wim, maps Samba shares, begins deployment - **Clonezilla**: Boots Clonezilla Live for disk imaging - **Blancco**: Boots Drive Eraser, auto-saves reports to server - - **Memtest86+**: Runs memory diagnostics + - **Memory test**: not on the menu; Dell PCs have one built in (F12 at power-on, Diagnostics) ## Testing with KVM @@ -221,8 +221,7 @@ pxe-server/ │ └── shopfloor-display-imaging-guide.md # End-user imaging guide ├── boot-tools/ # Extracted boot files (gitignored, built by prepare-boot-tools.sh) │ ├── blancco/ # Blancco Drive Eraser -│ ├── clonezilla/ # Clonezilla Live -│ └── memtest/ # Memtest86+ +│ └── clonezilla/ # Clonezilla Live ├── boot-files/ # WinPE boot files (boot.wim, wimboot, ipxe.efi, BCD) ├── offline-packages/ # .deb files (gitignored, built by download-packages.sh) ├── pip-wheels/ # Python wheels (gitignored, built by download-packages.sh) diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md index acb1ff1..3270960 100644 --- a/docs/ARCHITECTURE.md +++ b/docs/ARCHITECTURE.md @@ -29,7 +29,7 @@ systems. |---------------|-----------|------------------------------------------------------| | dnsmasq | 67/udp | DHCP. Hands out IPs and the next-server (TFTP) info. | | dnsmasq | 69/udp | TFTP. Serves `ipxe.efi` to firmware PXE clients. | -| Apache | 80/tcp | HTTP. Serves wimboot, boot.wim, Blancco binaries, Clonezilla, memtest, and proxies the webapp on /. | +| Apache | 80/tcp | HTTP. Serves wimboot, boot.wim, Blancco binaries, Clonezilla, and proxies the webapp on /. | | Apache | 4433/tcp | HTTP. Serves `Altiris/iPXE/GetPxeScript.aspx` (the iPXE menu script). | | Samba | 445/tcp | SMB shares. WinPE mounts these to fetch image content during deployment. | | Flask webapp | 9009/tcp | Browser UI for image import, unattend editing, log/report viewing. | @@ -112,9 +112,12 @@ WinPE; the Blancco and Clonezilla utilities require Secure Boot disabled. c. Clonezilla Live: iPXE loads vmlinuz + initrd over HTTP, fetches filesystem.squashfs. + With Secure Boot on, the Debian-signed kernel starts through Debian's + Microsoft-signed shim (clonezilla/shimx64.efi, iPXE shim command). - d. Memtest86+: - iPXE loads memtest.efi. + Memory testing is not on the menu: Dell PCs have a built-in test + (F12 at power-on, Diagnostics). Memtest86+ was removed because it is + unsigned and needed Secure Boot off. ``` ## Windows imaging lifecycle (gea-* images) diff --git a/playbook/ipxe/GetPxeScript.aspx b/playbook/ipxe/GetPxeScript.aspx index a3d380c..7cc3178 100644 --- a/playbook/ipxe/GetPxeScript.aspx +++ b/playbook/ipxe/GetPxeScript.aspx @@ -9,9 +9,9 @@ item winpe Windows PE (Image Deployment) item --gap -- ---- Drive Erase ---- item blancco Blancco Drive Eraser item blancco_debug Blancco Drive Eraser (debug / SSH) -item --gap -- ---- Utilities (Secure Boot must be DISABLED) ---- +item --gap -- ---- Utilities ---- item clonezilla Clonezilla Live (Disk Imaging) -item memtest Memtest86+ (Memory Diagnostics) +item --gap -- Memory test: Dell PCs press F12 at power-on, Diagnostics item --gap -- ---- item reboot Reboot item exit Exit to BIOS @@ -26,7 +26,7 @@ echo echo Secure Boot is OFF on this PC (or this iPXE cannot tell). echo (iPXE read SecureBoot as: [${efi/SecureBoot:hex}] [${efi/SecureBoot:uint8}]) echo Windows deployment requires Secure Boot to be ENABLED. -echo If you disabled it for Clonezilla/Memtest, re-enable it now. +echo If you disabled it earlier, re-enable it in BIOS Setup now. echo prompt --timeout 5000 Press any key to continue (auto-boot in 5s)... && goto winpe_boot || goto winpe_boot @@ -51,8 +51,13 @@ prompt Press any key to return to menu... && goto menu || goto menu set base http://${server}/clonezilla kernel ${base}/vmlinuz boot=live username=user union=overlay config components noswap edd=on nomodeset nodmraid locales= keyboard-layouts= ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no net.ifnames=0 nosplash noprompt fetch=${base}/filesystem.squashfs || goto secureboot_warn initrd ${base}/initrd.img || goto boot_failed -# iPXE 2.0 accepts an unsigned EFI kernel (PE fallback) and fails only -# here under Secure Boot. +# Secure Boot ON: Clonezilla runs a Debian-signed kernel, started through +# Debian's Microsoft-signed shim (from the Clonezilla release, staged as +# clonezilla/shimx64.efi by prepare-boot-tools.sh), the same way Blancco +# uses Ubuntu's. Its modules (usb-storage, uas, exfat) are signed by the +# same build key, so USB drives work. Without the shim command (old iPXE) +# the line fails harmlessly and the kernel boots directly (Secure Boot off). +shim ${base}/shimx64.efi || boot || goto secureboot_warn :blancco @@ -99,12 +104,6 @@ boot || goto blancco_efi_grub echo Direct kernel boot failed - trying GRUB chain fallback... chain http://${server}/blancco/grubx64.efi || goto secureboot_warn -:memtest -kernel http://${server}/memtest/memtest.efi || goto secureboot_warn -# iPXE 2.0 accepts an unsigned EFI image (PE fallback) and fails only -# here under Secure Boot. -boot || goto secureboot_warn - :boot_failed echo echo Download FAILED (see the error above). Check the PXE server and retry. @@ -113,7 +112,7 @@ prompt Press any key to return to menu... && goto menu || goto menu :secureboot_warn echo echo ====================================================== -echo This option requires Secure Boot to be DISABLED. +echo This option could not start with Secure Boot enabled. echo echo 1. Reboot this machine echo 2. Press F2 / Del to enter BIOS Setup diff --git a/playbook/pxe_server_setup.yml b/playbook/pxe_server_setup.yml index 0a9de42..6a69ea0 100644 --- a/playbook/pxe_server_setup.yml +++ b/playbook/pxe_server_setup.yml @@ -699,7 +699,11 @@ loop: - clonezilla - blancco - - memtest + + - name: "Remove the retired Memtest86+ web dir (memory tests: Dell F12 Diagnostics)" + file: + path: "{{ web_root }}/memtest" + state: absent - name: "Menu: the Blancco file names in the menu must match blancco_kver" # GetPxeScript.aspx names the UEFI Blancco files by suffix @@ -1378,13 +1382,14 @@ debug: msg: "{{ ipxe_chain.stdout }}" - - name: "Copy boot tool files from USB (Clonezilla, Blancco, Memtest)" + - name: "Copy boot tool files from USB (Clonezilla, Blancco)" + # Clonezilla includes shimx64.efi (Debian's Microsoft-signed shim), which + # the menu uses to boot its Debian-signed kernel with Secure Boot on. shell: > cp -r "{{ usb_root }}/boot-tools/{{ item }}/"* "{{ web_root }}/{{ item }}/" 2>/dev/null || true loop: - clonezilla - blancco - - memtest # --- Blancco PXE boot via Ubuntu kernel + switch_root --- # Blancco's own kernel freezes on Dell Precision towers. Workaround: diff --git a/scripts/build-usb.sh b/scripts/build-usb.sh index 96fbf30..2bd413e 100755 --- a/scripts/build-usb.sh +++ b/scripts/build-usb.sh @@ -677,7 +677,7 @@ else echo " WARNING: No boot-files/ found (copy WinPE boot files from Media Creator)" fi -# Copy boot tools (Clonezilla, Blancco, Memtest) if prepared +# Copy boot tools (Clonezilla, Blancco) if prepared if [ -n "$BOOT_TOOLS_DIR" ] && [ -d "$BOOT_TOOLS_DIR" ]; then t_cp "" "$BOOT_TOOLS_DIR" TOOLS_SIZE=$(du -shL "$BOOT_TOOLS_DIR" | cut -f1) diff --git a/scripts/prepare-boot-tools.sh b/scripts/prepare-boot-tools.sh index eb6e522..a722475 100755 --- a/scripts/prepare-boot-tools.sh +++ b/scripts/prepare-boot-tools.sh @@ -2,8 +2,10 @@ # # prepare-boot-tools.sh — Download/extract boot files for PXE boot tools # -# Downloads Clonezilla Live and Memtest86+ for PXE booting, -# and extracts Blancco Drive Eraser from its ISO. +# Downloads Clonezilla Live for PXE booting (with Debian's Microsoft-signed +# shim, so it boots with Secure Boot on), and extracts Blancco Drive Eraser +# from its ISO. No memory tester: Dell PCs have one built in (F12 at +# power-on, Diagnostics). # # Usage: # ./prepare-boot-tools.sh [/path/to/blancco.iso] @@ -11,7 +13,6 @@ # Output directories: # boot-tools/clonezilla/ — vmlinuz, initrd.img, filesystem.squashfs # boot-tools/blancco/ — extracted boot files or ISO for memdisk -# boot-tools/memtest/ — memtest.efi set -euo pipefail @@ -24,7 +25,7 @@ if [ -z "$BLANCCO_ISO" ]; then BLANCCO_ISO=$(find "$REPO_ROOT" -maxdepth 1 -name '*DriveEraser*.iso' -o -name '*blancco*.iso' 2>/dev/null | head -1) fi -mkdir -p "$OUT_DIR"/{clonezilla,blancco,memtest} +mkdir -p "$OUT_DIR"/{clonezilla,blancco} echo "============================================" echo "PXE Boot Tools Preparation" @@ -32,13 +33,14 @@ echo "============================================" # --- Clonezilla Live --- echo "" -echo "[1/3] Clonezilla Live" +echo "[1/2] Clonezilla Live" CLONEZILLA_VERSION="3.3.3-37" CLONEZILLA_FILE="clonezilla-live-${CLONEZILLA_VERSION}-amd64.zip" CLONEZILLA_URL="https://sourceforge.net/projects/clonezilla/files/clonezilla_live_stable/${CLONEZILLA_VERSION}/${CLONEZILLA_FILE}/download" -if [ -f "$OUT_DIR/clonezilla/vmlinuz" ] && [ -f "$OUT_DIR/clonezilla/filesystem.squashfs" ]; then +if [ -f "$OUT_DIR/clonezilla/vmlinuz" ] && [ -f "$OUT_DIR/clonezilla/filesystem.squashfs" ] \ + && [ -f "$OUT_DIR/clonezilla/shimx64.efi" ]; then echo " Already prepared, skipping. Delete boot-tools/clonezilla/ to re-download." else echo " Downloading Clonezilla Live ${CLONEZILLA_VERSION}..." @@ -59,16 +61,32 @@ else unzip -o -j "$TMPDIR/$CLONEZILLA_FILE" "live/vmlinuz" -d "$OUT_DIR/clonezilla/" unzip -o -j "$TMPDIR/$CLONEZILLA_FILE" "live/initrd.img" -d "$OUT_DIR/clonezilla/" unzip -o -j "$TMPDIR/$CLONEZILLA_FILE" "live/filesystem.squashfs" -d "$OUT_DIR/clonezilla/" + # Debian's Microsoft-signed shim (the release's EFI/boot/bootx64.efi): + # the iPXE menu starts the Debian-signed kernel through it, so + # Clonezilla runs with Secure Boot on (like Blancco via Ubuntu's). + unzip -o -p "$TMPDIR/$CLONEZILLA_FILE" "EFI/boot/bootx64.efi" > "$OUT_DIR/clonezilla/shimx64.efi" rm -rf "$TMPDIR" echo " Done." fi fi -ls -lh "$OUT_DIR/clonezilla/" 2>/dev/null | grep -E 'vmlinuz|initrd|squashfs' | sed 's/^/ /' +ls -lh "$OUT_DIR/clonezilla/" 2>/dev/null | grep -E 'vmlinuz|initrd|squashfs|shimx64' | sed 's/^/ /' +# The shim must be Microsoft-signed (firmware trusts it) and the kernel +# Debian-signed (the shim trusts that); otherwise Secure Boot refuses them. +if command -v sbverify >/dev/null && [ -s "$OUT_DIR/clonezilla/shimx64.efi" ]; then + if sbverify --list "$OUT_DIR/clonezilla/shimx64.efi" 2>/dev/null | grep -q "Microsoft"; then + echo " shimx64.efi: Microsoft-signed" + else + echo " WARNING: clonezilla/shimx64.efi is not Microsoft-signed; Clonezilla will need Secure Boot off." + fi + if ! sbverify --list "$OUT_DIR/clonezilla/vmlinuz" 2>/dev/null | grep -q "Debian Secure Boot"; then + echo " WARNING: clonezilla/vmlinuz is not Debian-signed; Clonezilla will need Secure Boot off." + fi +fi # --- Blancco Drive Eraser --- echo "" -echo "[2/3] Blancco Drive Eraser" +echo "[2/2] Blancco Drive Eraser" if [ -n "$BLANCCO_ISO" ] && [ -f "$BLANCCO_ISO" ]; then echo " Extracting from: $BLANCCO_ISO" @@ -265,43 +283,6 @@ fi ls -lh "$OUT_DIR/blancco/" 2>/dev/null | grep -v '^total' | sed 's/^/ /' -# --- Memtest86+ --- -echo "" -echo "[3/3] Memtest86+" - -MEMTEST_VERSION="8.10" -MEMTEST_URL="https://memtest.org/download/v${MEMTEST_VERSION}/mt86plus_${MEMTEST_VERSION}.binaries.zip" - -if [ -f "$OUT_DIR/memtest/memtest.efi" ]; then - echo " Already prepared, skipping." -else - echo " Downloading Memtest86+ v${MEMTEST_VERSION}..." - TMPDIR=$(mktemp -d) - - wget -q --show-progress -O "$TMPDIR/memtest.zip" "$MEMTEST_URL" || { - echo " ERROR: Download failed. Download manually from https://memtest.org" - TMPDIR="" - } - - if [ -n "$TMPDIR" ] && [ -f "$TMPDIR/memtest.zip" ]; then - echo " Extracting EFI binary..." - unzip -o -j "$TMPDIR/memtest.zip" "memtest64.efi" -d "$OUT_DIR/memtest/" 2>/dev/null || \ - unzip -o -j "$TMPDIR/memtest.zip" "mt86plus_${MEMTEST_VERSION}.x64.efi" -d "$OUT_DIR/memtest/" 2>/dev/null || \ - unzip -o "$TMPDIR/memtest.zip" -d "$TMPDIR/extract/" - - # Find the EFI file regardless of exact name - # 8.x ships the x86_64 UEFI binary as mt86p__x86_64 (no .efi). - EFI_FILE=$(find "$TMPDIR" "$OUT_DIR/memtest" \( -name '*.efi' -name '*64*' \) -o -name 'mt86p_*_x86_64' 2>/dev/null | head -1) - if [ -n "$EFI_FILE" ] && [ ! -f "$OUT_DIR/memtest/memtest.efi" ]; then - cp "$EFI_FILE" "$OUT_DIR/memtest/memtest.efi" - fi - rm -rf "$TMPDIR" - echo " Done." - fi -fi - -ls -lh "$OUT_DIR/memtest/" 2>/dev/null | grep -v '^total' | sed 's/^/ /' - # --- Summary --- echo "" echo "============================================" @@ -309,7 +290,7 @@ echo "Boot tools prepared in: $OUT_DIR/" echo "============================================" echo "" -for tool in clonezilla blancco memtest; do +for tool in clonezilla blancco; do COUNT=$(find "$OUT_DIR/$tool" -type f 2>/dev/null | wc -l) SIZE=$(du -sh "$OUT_DIR/$tool" 2>/dev/null | cut -f1) printf " %-15s %s (%d files)\n" "$tool" "$SIZE" "$COUNT" @@ -319,7 +300,6 @@ echo "" echo "These files need to be copied to the PXE server's web root:" echo " /var/www/html/clonezilla/" echo " /var/www/html/blancco/" -echo " /var/www/html/memtest/" echo "" echo "The build-usb.sh script will include them automatically," echo "or copy them manually to the server." diff --git a/tests/vm/README.md b/tests/vm/README.md index 628c2dc..bb709f4 100644 --- a/tests/vm/README.md +++ b/tests/vm/README.md @@ -89,4 +89,4 @@ grow the client while both are off, and put them back afterwards: Menu keys from the host: `virsh -c qemu:///system send-key KEY_DOWN` (separator lines are skipped: Down x1 = Blancco, x3 = Clonezilla, -x4 = Memtest), then KEY_ENTER; startnet answers are KEY_ + KEY_ENTER. +x4 = Reboot), then KEY_ENTER; startnet answers are KEY_ + KEY_ENTER.