ge-aerospace/pxe-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Menu: Clonezilla boots with Secure Boot on (Debian shim); Memtest86+ removed

Browse Source 
Clonezilla Live runs a Debian-signed kernel whose modules (usb-storage,
uas, exfat) are signed by the same build key, so the menu now starts it
through Debian's Microsoft-signed shim with the iPXE shim command, the
same way Blancco uses Ubuntu's. prepare-boot-tools.sh extracts that shim
from the Clonezilla release (EFI/boot/bootx64.efi -> clonezilla/
shimx64.efi) and warns when the shim is not Microsoft-signed or the
kernel not Debian-signed.

Memtest86+ is unsigned and needed Secure Boot off; memory tests now use
the Dell built-in diagnostics (F12 at power-on, Diagnostics), noted in
the menu. The playbook removes the old memtest web dir. Nothing on the
menu needs Secure Boot off any more; the 'disable Secure Boot' screen
remains only as the fallback when a signed path fails.
This commit is contained in:
cproudlock
2026-10-15 14:47:25 -04:00
parent c8e0b4eace
commit 54015566a7
8 changed files with 63 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
playbook/ipxe/GetPxeScript.aspx
View File

@@ -9,9 +9,9 @@ item winpe Windows PE (Image Deployment)
item --gap -- ---- Drive Erase ----
item blancco Blancco Drive Eraser
item blancco_debug Blancco Drive Eraser (debug / SSH)
item --gap -- ---- Utilities (Secure Boot must be DISABLED) ----
item --gap -- ---- Utilities ----
item clonezilla Clonezilla Live (Disk Imaging)
item memtest Memtest86+ (Memory Diagnostics)
item --gap -- Memory test: Dell PCs press F12 at power-on, Diagnostics
item --gap -- ----
item reboot Reboot
item exit Exit to BIOS
@@ -26,7 +26,7 @@ echo
echo Secure Boot is OFF on this PC (or this iPXE cannot tell).
echo (iPXE read SecureBoot as: [${efi/SecureBoot:hex}] [${efi/SecureBoot:uint8}])
echo Windows deployment requires Secure Boot to be ENABLED.
echo If you disabled it for Clonezilla/Memtest, re-enable it now.
echo If you disabled it earlier, re-enable it in BIOS Setup now.
echo
prompt --timeout 5000 Press any key to continue (auto-boot in 5s)... && goto winpe_boot || goto winpe_boot
@@ -51,8 +51,13 @@ prompt Press any key to return to menu... && goto menu || goto menu
set base http://${server}/clonezilla
kernel ${base}/vmlinuz boot=live username=user union=overlay config components noswap edd=on nomodeset nodmraid locales= keyboard-layouts= ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no net.ifnames=0 nosplash noprompt fetch=${base}/filesystem.squashfs || goto secureboot_warn
initrd ${base}/initrd.img || goto boot_failed
# iPXE 2.0 accepts an unsigned EFI kernel (PE fallback) and fails only
# here under Secure Boot.
# Secure Boot ON: Clonezilla runs a Debian-signed kernel, started through
# Debian's Microsoft-signed shim (from the Clonezilla release, staged as
# clonezilla/shimx64.efi by prepare-boot-tools.sh), the same way Blancco
# uses Ubuntu's. Its modules (usb-storage, uas, exfat) are signed by the
# same build key, so USB drives work. Without the shim command (old iPXE)
# the line fails harmlessly and the kernel boots directly (Secure Boot off).
shim ${base}/shimx64.efi ||
boot || goto secureboot_warn
:blancco
@@ -99,12 +104,6 @@ boot || goto blancco_efi_grub
echo Direct kernel boot failed - trying GRUB chain fallback...
chain http://${server}/blancco/grubx64.efi || goto secureboot_warn
:memtest
kernel http://${server}/memtest/memtest.efi || goto secureboot_warn
# iPXE 2.0 accepts an unsigned EFI image (PE fallback) and fails only
# here under Secure Boot.
boot || goto secureboot_warn
:boot_failed
echo
echo Download FAILED (see the error above). Check the PXE server and retry.
@@ -113,7 +112,7 @@ prompt Press any key to return to menu... && goto menu || goto menu
:secureboot_warn
echo
echo ======================================================
echo This option requires Secure Boot to be DISABLED.
echo This option could not start with Secure Boot enabled.
echo
echo 1. Reboot this machine
echo 2. Press F2 / Del to enter BIOS Setup