Menu: Clonezilla boots with Secure Boot on (Debian shim); Memtest86+ removed
Clonezilla Live runs a Debian-signed kernel whose modules (usb-storage, uas, exfat) are signed by the same build key, so the menu now starts it through Debian's Microsoft-signed shim with the iPXE shim command, the same way Blancco uses Ubuntu's. prepare-boot-tools.sh extracts that shim from the Clonezilla release (EFI/boot/bootx64.efi -> clonezilla/ shimx64.efi) and warns when the shim is not Microsoft-signed or the kernel not Debian-signed. Memtest86+ is unsigned and needed Secure Boot off; memory tests now use the Dell built-in diagnostics (F12 at power-on, Diagnostics), noted in the menu. The playbook removes the old memtest web dir. Nothing on the menu needs Secure Boot off any more; the 'disable Secure Boot' screen remains only as the fallback when a signed path fails.
This commit is contained in:
cproudlock
@@ -2,8 +2,10 @@
|
||||
#
|
||||
# prepare-boot-tools.sh — Download/extract boot files for PXE boot tools
|
||||
#
|
||||
# Downloads Clonezilla Live and Memtest86+ for PXE booting,
|
||||
# and extracts Blancco Drive Eraser from its ISO.
|
||||
# Downloads Clonezilla Live for PXE booting (with Debian's Microsoft-signed
|
||||
# shim, so it boots with Secure Boot on), and extracts Blancco Drive Eraser
|
||||
# from its ISO. No memory tester: Dell PCs have one built in (F12 at
|
||||
# power-on, Diagnostics).
|
||||
#
|
||||
# Usage:
|
||||
# ./prepare-boot-tools.sh [/path/to/blancco.iso]
|
||||
@@ -11,7 +13,6 @@
|
||||
# Output directories:
|
||||
# boot-tools/clonezilla/ — vmlinuz, initrd.img, filesystem.squashfs
|
||||
# boot-tools/blancco/ — extracted boot files or ISO for memdisk
|
||||
# boot-tools/memtest/ — memtest.efi
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
@@ -24,7 +25,7 @@ if [ -z "$BLANCCO_ISO" ]; then
|
||||
BLANCCO_ISO=$(find "$REPO_ROOT" -maxdepth 1 -name '*DriveEraser*.iso' -o -name '*blancco*.iso' 2>/dev/null | head -1)
|
||||
fi
|
||||
|
||||
mkdir -p "$OUT_DIR"/{clonezilla,blancco,memtest}
|
||||
mkdir -p "$OUT_DIR"/{clonezilla,blancco}
|
||||
|
||||
echo "============================================"
|
||||
echo "PXE Boot Tools Preparation"
|
||||
@@ -32,13 +33,14 @@ echo "============================================"
|
||||
|
||||
# --- Clonezilla Live ---
|
||||
echo ""
|
||||
echo "[1/3] Clonezilla Live"
|
||||
echo "[1/2] Clonezilla Live"
|
||||
|
||||
CLONEZILLA_VERSION="3.3.3-37"
|
||||
CLONEZILLA_FILE="clonezilla-live-${CLONEZILLA_VERSION}-amd64.zip"
|
||||
CLONEZILLA_URL="https://sourceforge.net/projects/clonezilla/files/clonezilla_live_stable/${CLONEZILLA_VERSION}/${CLONEZILLA_FILE}/download"
|
||||
|
||||
if [ -f "$OUT_DIR/clonezilla/vmlinuz" ] && [ -f "$OUT_DIR/clonezilla/filesystem.squashfs" ]; then
|
||||
if [ -f "$OUT_DIR/clonezilla/vmlinuz" ] && [ -f "$OUT_DIR/clonezilla/filesystem.squashfs" ] \
|
||||
&& [ -f "$OUT_DIR/clonezilla/shimx64.efi" ]; then
|
||||
echo " Already prepared, skipping. Delete boot-tools/clonezilla/ to re-download."
|
||||
else
|
||||
echo " Downloading Clonezilla Live ${CLONEZILLA_VERSION}..."
|
||||
@@ -59,16 +61,32 @@ else
|
||||
unzip -o -j "$TMPDIR/$CLONEZILLA_FILE" "live/vmlinuz" -d "$OUT_DIR/clonezilla/"
|
||||
unzip -o -j "$TMPDIR/$CLONEZILLA_FILE" "live/initrd.img" -d "$OUT_DIR/clonezilla/"
|
||||
unzip -o -j "$TMPDIR/$CLONEZILLA_FILE" "live/filesystem.squashfs" -d "$OUT_DIR/clonezilla/"
|
||||
# Debian's Microsoft-signed shim (the release's EFI/boot/bootx64.efi):
|
||||
# the iPXE menu starts the Debian-signed kernel through it, so
|
||||
# Clonezilla runs with Secure Boot on (like Blancco via Ubuntu's).
|
||||
unzip -o -p "$TMPDIR/$CLONEZILLA_FILE" "EFI/boot/bootx64.efi" > "$OUT_DIR/clonezilla/shimx64.efi"
|
||||
rm -rf "$TMPDIR"
|
||||
echo " Done."
|
||||
fi
|
||||
fi
|
||||
|
||||
ls -lh "$OUT_DIR/clonezilla/" 2>/dev/null | grep -E 'vmlinuz|initrd|squashfs' | sed 's/^/ /'
|
||||
ls -lh "$OUT_DIR/clonezilla/" 2>/dev/null | grep -E 'vmlinuz|initrd|squashfs|shimx64' | sed 's/^/ /'
|
||||
# The shim must be Microsoft-signed (firmware trusts it) and the kernel
|
||||
# Debian-signed (the shim trusts that); otherwise Secure Boot refuses them.
|
||||
if command -v sbverify >/dev/null && [ -s "$OUT_DIR/clonezilla/shimx64.efi" ]; then
|
||||
if sbverify --list "$OUT_DIR/clonezilla/shimx64.efi" 2>/dev/null | grep -q "Microsoft"; then
|
||||
echo " shimx64.efi: Microsoft-signed"
|
||||
else
|
||||
echo " WARNING: clonezilla/shimx64.efi is not Microsoft-signed; Clonezilla will need Secure Boot off."
|
||||
fi
|
||||
if ! sbverify --list "$OUT_DIR/clonezilla/vmlinuz" 2>/dev/null | grep -q "Debian Secure Boot"; then
|
||||
echo " WARNING: clonezilla/vmlinuz is not Debian-signed; Clonezilla will need Secure Boot off."
|
||||
fi
|
||||
fi
|
||||
|
||||
# --- Blancco Drive Eraser ---
|
||||
echo ""
|
||||
echo "[2/3] Blancco Drive Eraser"
|
||||
echo "[2/2] Blancco Drive Eraser"
|
||||
|
||||
if [ -n "$BLANCCO_ISO" ] && [ -f "$BLANCCO_ISO" ]; then
|
||||
echo " Extracting from: $BLANCCO_ISO"
|
||||
@@ -265,43 +283,6 @@ fi
|
||||
|
||||
ls -lh "$OUT_DIR/blancco/" 2>/dev/null | grep -v '^total' | sed 's/^/ /'
|
||||
|
||||
# --- Memtest86+ ---
|
||||
echo ""
|
||||
echo "[3/3] Memtest86+"
|
||||
|
||||
MEMTEST_VERSION="8.10"
|
||||
MEMTEST_URL="https://memtest.org/download/v${MEMTEST_VERSION}/mt86plus_${MEMTEST_VERSION}.binaries.zip"
|
||||
|
||||
if [ -f "$OUT_DIR/memtest/memtest.efi" ]; then
|
||||
echo " Already prepared, skipping."
|
||||
else
|
||||
echo " Downloading Memtest86+ v${MEMTEST_VERSION}..."
|
||||
TMPDIR=$(mktemp -d)
|
||||
|
||||
wget -q --show-progress -O "$TMPDIR/memtest.zip" "$MEMTEST_URL" || {
|
||||
echo " ERROR: Download failed. Download manually from https://memtest.org"
|
||||
TMPDIR=""
|
||||
}
|
||||
|
||||
if [ -n "$TMPDIR" ] && [ -f "$TMPDIR/memtest.zip" ]; then
|
||||
echo " Extracting EFI binary..."
|
||||
unzip -o -j "$TMPDIR/memtest.zip" "memtest64.efi" -d "$OUT_DIR/memtest/" 2>/dev/null || \
|
||||
unzip -o -j "$TMPDIR/memtest.zip" "mt86plus_${MEMTEST_VERSION}.x64.efi" -d "$OUT_DIR/memtest/" 2>/dev/null || \
|
||||
unzip -o "$TMPDIR/memtest.zip" -d "$TMPDIR/extract/"
|
||||
|
||||
# Find the EFI file regardless of exact name
|
||||
# 8.x ships the x86_64 UEFI binary as mt86p_<ver>_x86_64 (no .efi).
|
||||
EFI_FILE=$(find "$TMPDIR" "$OUT_DIR/memtest" \( -name '*.efi' -name '*64*' \) -o -name 'mt86p_*_x86_64' 2>/dev/null | head -1)
|
||||
if [ -n "$EFI_FILE" ] && [ ! -f "$OUT_DIR/memtest/memtest.efi" ]; then
|
||||
cp "$EFI_FILE" "$OUT_DIR/memtest/memtest.efi"
|
||||
fi
|
||||
rm -rf "$TMPDIR"
|
||||
echo " Done."
|
||||
fi
|
||||
fi
|
||||
|
||||
ls -lh "$OUT_DIR/memtest/" 2>/dev/null | grep -v '^total' | sed 's/^/ /'
|
||||
|
||||
# --- Summary ---
|
||||
echo ""
|
||||
echo "============================================"
|
||||
@@ -309,7 +290,7 @@ echo "Boot tools prepared in: $OUT_DIR/"
|
||||
echo "============================================"
|
||||
echo ""
|
||||
|
||||
for tool in clonezilla blancco memtest; do
|
||||
for tool in clonezilla blancco; do
|
||||
COUNT=$(find "$OUT_DIR/$tool" -type f 2>/dev/null | wc -l)
|
||||
SIZE=$(du -sh "$OUT_DIR/$tool" 2>/dev/null | cut -f1)
|
||||
printf " %-15s %s (%d files)\n" "$tool" "$SIZE" "$COUNT"
|
||||
@@ -319,7 +300,6 @@ echo ""
|
||||
echo "These files need to be copied to the PXE server's web root:"
|
||||
echo " /var/www/html/clonezilla/"
|
||||
echo " /var/www/html/blancco/"
|
||||
echo " /var/www/html/memtest/"
|
||||
echo ""
|
||||
echo "The build-usb.sh script will include them automatically,"
|
||||
echo "or copy them manually to the server."
|
||||
|
||||
Reference in New Issue
Block a user