Menu: Clonezilla boots with Secure Boot on (Debian shim); Memtest86+ removed

Clonezilla Live runs a Debian-signed kernel whose modules (usb-storage,
uas, exfat) are signed by the same build key, so the menu now starts it
through Debian's Microsoft-signed shim with the iPXE shim command, the
same way Blancco uses Ubuntu's. prepare-boot-tools.sh extracts that shim
from the Clonezilla release (EFI/boot/bootx64.efi -> clonezilla/
shimx64.efi) and warns when the shim is not Microsoft-signed or the
kernel not Debian-signed.

Memtest86+ is unsigned and needed Secure Boot off; memory tests now use
the Dell built-in diagnostics (F12 at power-on, Diagnostics), noted in
the menu. The playbook removes the old memtest web dir. Nothing on the
menu needs Secure Boot off any more; the 'disable Secure Boot' screen
remains only as the fallback when a signed path fails.

README.md

@@ -16,7 +16,7 @@ Client PXE boot (UEFI Secure Boot)
      ├── Windows PE  -> wimboot -> boot.wim -> startnet.cmd -> Samba share -> Image deployment
      ├── Clonezilla  -> vmlinuz/initrd -> Disk cloning/imaging
      ├── Blancco     -> Native kernel + initramfs -> NIST 800-88 drive erasure
-     └── Memtest86+  -> Memory diagnostics
+     (memory test: Dell F12 > Diagnostics)
 ```
 
 ### Services
@@ -69,10 +69,10 @@ Downloads all .deb packages and Python wheels for offline installation (~140 MB
 ### Step 2: Prepare Boot Tools (optional)
 
 ```bash
-./scripts/prepare-boot-tools.sh /path/to/blancco.iso /path/to/clonezilla.zip /path/to/memtest.bin
+./scripts/prepare-boot-tools.sh /path/to/blancco.iso
 ```
 
-Extracts and configures boot tool files (Blancco, Clonezilla, Memtest86+). Automatically patches Blancco's config.img to auto-save erasure reports to the PXE server's Samba share.
+Extracts and configures boot tool files (Blancco, Clonezilla with Debian's signed shim for Secure Boot). Automatically patches Blancco's config.img to auto-save erasure reports to the PXE server's Samba share.
 
 ### Step 3: Build the USB
 
@@ -167,8 +167,7 @@ pxe-server/
 │   └── shopfloor-display-imaging-guide.md  # End-user imaging guide
 ├── boot-tools/                   # Extracted boot tool files (gitignored)
 │   ├── blancco/                  # Blancco Drive Eraser
-│   ├── clonezilla/               # Clonezilla Live
+│   └── clonezilla/               # Clonezilla Live
-│   └── memtest/                  # Memtest86+
 ├── boot-files/                   # WinPE boot files (boot.wim, wimboot, ipxe.efi, BCD)
 ├── offline-packages/             # .deb files (gitignored, built by download-packages.sh)
 ├── pip-wheels/                   # Python wheels (gitignored, built by download-packages.sh)

SETUP.md

@@ -11,7 +11,7 @@ Client PXE boot
      ├── Windows PE -> wimboot -> boot.wim -> startnet.cmd -> Samba -> Image deployment
      ├── Clonezilla -> vmlinuz/initrd -> Disk cloning/imaging
      ├── Blancco    -> Native kernel + initramfs -> NIST 800-88 drive erasure (auto-reports)
-     └── Memtest86+ -> Memory diagnostics
+     (memory test: Dell F12 > Diagnostics)
 ```
 
 ### Services on the PXE Server
@@ -81,10 +81,10 @@ to `pip-wheels/`. About 500 debs (~1.6 GB) + 8 wheels.
 ### Step 2: Prepare Boot Tools (optional)
 
 ```bash
-./scripts/prepare-boot-tools.sh /path/to/blancco.iso /path/to/clonezilla.zip /path/to/memtest.bin
+./scripts/prepare-boot-tools.sh /path/to/blancco.iso
 ```
 
-Extracts boot files for Blancco, Clonezilla, and Memtest86+ into the `boot-tools/` directory. Automatically patches Blancco's `config.img` to auto-save erasure reports to the PXE server's Samba share.
+Extracts boot files for Blancco and Clonezilla (with Debian's signed shim, so it boots with Secure Boot on) into the `boot-tools/` directory. Automatically patches Blancco's `config.img` to auto-save erasure reports to the PXE server's Samba share.
 
 ### Step 3: Build the USB
 
@@ -175,7 +175,7 @@ Access at `http://172.16.9.1:9009` from any machine on the isolated network.
    - **Windows PE**: Boots via wimboot + boot.wim, maps Samba shares, begins deployment
    - **Clonezilla**: Boots Clonezilla Live for disk imaging
    - **Blancco**: Boots Drive Eraser, auto-saves reports to server
-   - **Memtest86+**: Runs memory diagnostics
+   - **Memory test**: not on the menu; Dell PCs have one built in (F12 at power-on, Diagnostics)
 
 ## Testing with KVM
 
@@ -221,8 +221,7 @@ pxe-server/
 │   └── shopfloor-display-imaging-guide.md  # End-user imaging guide
 ├── boot-tools/                   # Extracted boot files (gitignored, built by prepare-boot-tools.sh)
 │   ├── blancco/                  # Blancco Drive Eraser
-│   ├── clonezilla/               # Clonezilla Live
+│   └── clonezilla/               # Clonezilla Live
-│   └── memtest/                  # Memtest86+
 ├── boot-files/                   # WinPE boot files (boot.wim, wimboot, ipxe.efi, BCD)
 ├── offline-packages/             # .deb files (gitignored, built by download-packages.sh)
 ├── pip-wheels/                   # Python wheels (gitignored, built by download-packages.sh)

docs/ARCHITECTURE.md

@@ -29,7 +29,7 @@ systems.
 |---------------|-----------|------------------------------------------------------|
 | dnsmasq       | 67/udp    | DHCP. Hands out IPs and the next-server (TFTP) info. |
 | dnsmasq       | 69/udp    | TFTP. Serves `ipxe.efi` to firmware PXE clients.     |
-| Apache        | 80/tcp    | HTTP. Serves wimboot, boot.wim, Blancco binaries, Clonezilla, memtest, and proxies the webapp on /. |
+| Apache        | 80/tcp    | HTTP. Serves wimboot, boot.wim, Blancco binaries, Clonezilla, and proxies the webapp on /. |
 | Apache        | 4433/tcp  | HTTP. Serves `Altiris/iPXE/GetPxeScript.aspx` (the iPXE menu script). |
 | Samba         | 445/tcp   | SMB shares. WinPE mounts these to fetch image content during deployment. |
 | Flask webapp  | 9009/tcp  | Browser UI for image import, unattend editing, log/report viewing. |
@@ -112,9 +112,12 @@ WinPE; the Blancco and Clonezilla utilities require Secure Boot disabled.
 
    c. Clonezilla Live:
       iPXE loads vmlinuz + initrd over HTTP, fetches filesystem.squashfs.
+      With Secure Boot on, the Debian-signed kernel starts through Debian's
+      Microsoft-signed shim (clonezilla/shimx64.efi, iPXE shim command).
 
-   d. Memtest86+:
+   Memory testing is not on the menu: Dell PCs have a built-in test
-      iPXE loads memtest.efi.
+   (F12 at power-on, Diagnostics). Memtest86+ was removed because it is
+   unsigned and needed Secure Boot off.
 ```
 
 ## Windows imaging lifecycle (gea-* images)

playbook/ipxe/GetPxeScript.aspx

@@ -9,9 +9,9 @@ item winpe                Windows PE (Image Deployment)
 item --gap --             ---- Drive Erase ----
 item blancco              Blancco Drive Eraser
 item blancco_debug        Blancco Drive Eraser (debug / SSH)
-item --gap --             ---- Utilities (Secure Boot must be DISABLED) ----
+item --gap --             ---- Utilities ----
 item clonezilla           Clonezilla Live (Disk Imaging)
-item memtest              Memtest86+ (Memory Diagnostics)
+item --gap --             Memory test: Dell PCs press F12 at power-on, Diagnostics
 item --gap --             ----
 item reboot               Reboot
 item exit                 Exit to BIOS
@@ -26,7 +26,7 @@ echo
 echo   Secure Boot is OFF on this PC (or this iPXE cannot tell).
 echo   (iPXE read SecureBoot as: [${efi/SecureBoot:hex}] [${efi/SecureBoot:uint8}])
 echo   Windows deployment requires Secure Boot to be ENABLED.
-echo   If you disabled it for Clonezilla/Memtest, re-enable it now.
+echo   If you disabled it earlier, re-enable it in BIOS Setup now.
 echo
 prompt --timeout 5000 Press any key to continue (auto-boot in 5s)... && goto winpe_boot || goto winpe_boot
 
@@ -51,8 +51,13 @@ prompt Press any key to return to menu... && goto menu || goto menu
 set base http://${server}/clonezilla
 kernel ${base}/vmlinuz boot=live username=user union=overlay config components noswap edd=on nomodeset nodmraid locales= keyboard-layouts= ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no net.ifnames=0 nosplash noprompt fetch=${base}/filesystem.squashfs || goto secureboot_warn
 initrd ${base}/initrd.img || goto boot_failed
-# iPXE 2.0 accepts an unsigned EFI kernel (PE fallback) and fails only
+# Secure Boot ON: Clonezilla runs a Debian-signed kernel, started through
-# here under Secure Boot.
+# Debian's Microsoft-signed shim (from the Clonezilla release, staged as
+# clonezilla/shimx64.efi by prepare-boot-tools.sh), the same way Blancco
+# uses Ubuntu's. Its modules (usb-storage, uas, exfat) are signed by the
+# same build key, so USB drives work. Without the shim command (old iPXE)
+# the line fails harmlessly and the kernel boots directly (Secure Boot off).
+shim ${base}/shimx64.efi ||
 boot || goto secureboot_warn
 
 :blancco
@@ -99,12 +104,6 @@ boot || goto blancco_efi_grub
 echo Direct kernel boot failed - trying GRUB chain fallback...
 chain http://${server}/blancco/grubx64.efi || goto secureboot_warn
 
-:memtest
-kernel http://${server}/memtest/memtest.efi || goto secureboot_warn
-# iPXE 2.0 accepts an unsigned EFI image (PE fallback) and fails only
-# here under Secure Boot.
-boot || goto secureboot_warn
-
 :boot_failed
 echo
 echo Download FAILED (see the error above). Check the PXE server and retry.
@@ -113,7 +112,7 @@ prompt Press any key to return to menu... && goto menu || goto menu
 :secureboot_warn
 echo
 echo ======================================================
-echo   This option requires Secure Boot to be DISABLED.
+echo   This option could not start with Secure Boot enabled.
 echo
 echo   1. Reboot this machine
 echo   2. Press F2 / Del to enter BIOS Setup

playbook/pxe_server_setup.yml

@@ -699,7 +699,11 @@
       loop:
         - clonezilla
         - blancco
-        - memtest
+
+    - name: "Remove the retired Memtest86+ web dir (memory tests: Dell F12 Diagnostics)"
+      file:
+        path: "{{ web_root }}/memtest"
+        state: absent
 
     - name: "Menu: the Blancco file names in the menu must match blancco_kver"
       # GetPxeScript.aspx names the UEFI Blancco files by suffix
@@ -1378,13 +1382,14 @@
       debug:
         msg: "{{ ipxe_chain.stdout }}"
 
-    - name: "Copy boot tool files from USB (Clonezilla, Blancco, Memtest)"
+    - name: "Copy boot tool files from USB (Clonezilla, Blancco)"
+      # Clonezilla includes shimx64.efi (Debian's Microsoft-signed shim), which
+      # the menu uses to boot its Debian-signed kernel with Secure Boot on.
       shell: >
         cp -r "{{ usb_root }}/boot-tools/{{ item }}/"* "{{ web_root }}/{{ item }}/" 2>/dev/null || true
       loop:
         - clonezilla
         - blancco
-        - memtest
 
     # --- Blancco PXE boot via Ubuntu kernel + switch_root ---
     # Blancco's own kernel freezes on Dell Precision towers. Workaround:

scripts/build-usb.sh

@@ -677,7 +677,7 @@ else
     echo "    WARNING: No boot-files/ found (copy WinPE boot files from Media Creator)"
 fi
 
-# Copy boot tools (Clonezilla, Blancco, Memtest) if prepared
+# Copy boot tools (Clonezilla, Blancco) if prepared
 if [ -n "$BOOT_TOOLS_DIR" ] && [ -d "$BOOT_TOOLS_DIR" ]; then
     t_cp "" "$BOOT_TOOLS_DIR"
     TOOLS_SIZE=$(du -shL "$BOOT_TOOLS_DIR" | cut -f1)

scripts/prepare-boot-tools.sh

@@ -2,8 +2,10 @@
 #
 # prepare-boot-tools.sh — Download/extract boot files for PXE boot tools
 #
-# Downloads Clonezilla Live and Memtest86+ for PXE booting,
+# Downloads Clonezilla Live for PXE booting (with Debian's Microsoft-signed
-# and extracts Blancco Drive Eraser from its ISO.
+# shim, so it boots with Secure Boot on), and extracts Blancco Drive Eraser
+# from its ISO. No memory tester: Dell PCs have one built in (F12 at
+# power-on, Diagnostics).
 #
 # Usage:
 #   ./prepare-boot-tools.sh [/path/to/blancco.iso]
@@ -11,7 +13,6 @@
 # Output directories:
 #   boot-tools/clonezilla/   — vmlinuz, initrd.img, filesystem.squashfs
 #   boot-tools/blancco/      — extracted boot files or ISO for memdisk
-#   boot-tools/memtest/      — memtest.efi
 
 set -euo pipefail
 
@@ -24,7 +25,7 @@ if [ -z "$BLANCCO_ISO" ]; then
     BLANCCO_ISO=$(find "$REPO_ROOT" -maxdepth 1 -name '*DriveEraser*.iso' -o -name '*blancco*.iso' 2>/dev/null | head -1)
 fi
 
-mkdir -p "$OUT_DIR"/{clonezilla,blancco,memtest}
+mkdir -p "$OUT_DIR"/{clonezilla,blancco}
 
 echo "============================================"
 echo "PXE Boot Tools Preparation"
@@ -32,13 +33,14 @@ echo "============================================"
 
 # --- Clonezilla Live ---
 echo ""
-echo "[1/3] Clonezilla Live"
+echo "[1/2] Clonezilla Live"
 
 CLONEZILLA_VERSION="3.3.3-37"
 CLONEZILLA_FILE="clonezilla-live-${CLONEZILLA_VERSION}-amd64.zip"
 CLONEZILLA_URL="https://sourceforge.net/projects/clonezilla/files/clonezilla_live_stable/${CLONEZILLA_VERSION}/${CLONEZILLA_FILE}/download"
 
-if [ -f "$OUT_DIR/clonezilla/vmlinuz" ] && [ -f "$OUT_DIR/clonezilla/filesystem.squashfs" ]; then
+if [ -f "$OUT_DIR/clonezilla/vmlinuz" ] && [ -f "$OUT_DIR/clonezilla/filesystem.squashfs" ] \
+   && [ -f "$OUT_DIR/clonezilla/shimx64.efi" ]; then
     echo "    Already prepared, skipping. Delete boot-tools/clonezilla/ to re-download."
 else
     echo "    Downloading Clonezilla Live ${CLONEZILLA_VERSION}..."
@@ -59,16 +61,32 @@ else
         unzip -o -j "$TMPDIR/$CLONEZILLA_FILE" "live/vmlinuz" -d "$OUT_DIR/clonezilla/"
         unzip -o -j "$TMPDIR/$CLONEZILLA_FILE" "live/initrd.img" -d "$OUT_DIR/clonezilla/"
         unzip -o -j "$TMPDIR/$CLONEZILLA_FILE" "live/filesystem.squashfs" -d "$OUT_DIR/clonezilla/"
+        # Debian's Microsoft-signed shim (the release's EFI/boot/bootx64.efi):
+        # the iPXE menu starts the Debian-signed kernel through it, so
+        # Clonezilla runs with Secure Boot on (like Blancco via Ubuntu's).
+        unzip -o -p "$TMPDIR/$CLONEZILLA_FILE" "EFI/boot/bootx64.efi" > "$OUT_DIR/clonezilla/shimx64.efi"
         rm -rf "$TMPDIR"
         echo "    Done."
     fi
 fi
 
-ls -lh "$OUT_DIR/clonezilla/" 2>/dev/null | grep -E 'vmlinuz|initrd|squashfs' | sed 's/^/    /'
+ls -lh "$OUT_DIR/clonezilla/" 2>/dev/null | grep -E 'vmlinuz|initrd|squashfs|shimx64' | sed 's/^/    /'
+# The shim must be Microsoft-signed (firmware trusts it) and the kernel
+# Debian-signed (the shim trusts that); otherwise Secure Boot refuses them.
+if command -v sbverify >/dev/null && [ -s "$OUT_DIR/clonezilla/shimx64.efi" ]; then
+    if sbverify --list "$OUT_DIR/clonezilla/shimx64.efi" 2>/dev/null | grep -q "Microsoft"; then
+        echo "    shimx64.efi: Microsoft-signed"
+    else
+        echo "    WARNING: clonezilla/shimx64.efi is not Microsoft-signed; Clonezilla will need Secure Boot off."
+    fi
+    if ! sbverify --list "$OUT_DIR/clonezilla/vmlinuz" 2>/dev/null | grep -q "Debian Secure Boot"; then
+        echo "    WARNING: clonezilla/vmlinuz is not Debian-signed; Clonezilla will need Secure Boot off."
+    fi
+fi
 
 # --- Blancco Drive Eraser ---
 echo ""
-echo "[2/3] Blancco Drive Eraser"
+echo "[2/2] Blancco Drive Eraser"
 
 if [ -n "$BLANCCO_ISO" ] && [ -f "$BLANCCO_ISO" ]; then
     echo "    Extracting from: $BLANCCO_ISO"
@@ -265,43 +283,6 @@ fi
 
 ls -lh "$OUT_DIR/blancco/" 2>/dev/null | grep -v '^total' | sed 's/^/    /'
 
-# --- Memtest86+ ---
-echo ""
-echo "[3/3] Memtest86+"
-
-MEMTEST_VERSION="8.10"
-MEMTEST_URL="https://memtest.org/download/v${MEMTEST_VERSION}/mt86plus_${MEMTEST_VERSION}.binaries.zip"
-
-if [ -f "$OUT_DIR/memtest/memtest.efi" ]; then
-    echo "    Already prepared, skipping."
-else
-    echo "    Downloading Memtest86+ v${MEMTEST_VERSION}..."
-    TMPDIR=$(mktemp -d)
-
-    wget -q --show-progress -O "$TMPDIR/memtest.zip" "$MEMTEST_URL" || {
-        echo "    ERROR: Download failed. Download manually from https://memtest.org"
-        TMPDIR=""
-    }
-
-    if [ -n "$TMPDIR" ] && [ -f "$TMPDIR/memtest.zip" ]; then
-        echo "    Extracting EFI binary..."
-        unzip -o -j "$TMPDIR/memtest.zip" "memtest64.efi" -d "$OUT_DIR/memtest/" 2>/dev/null || \
-        unzip -o -j "$TMPDIR/memtest.zip" "mt86plus_${MEMTEST_VERSION}.x64.efi" -d "$OUT_DIR/memtest/" 2>/dev/null || \
-        unzip -o "$TMPDIR/memtest.zip" -d "$TMPDIR/extract/"
-
-        # Find the EFI file regardless of exact name
-        # 8.x ships the x86_64 UEFI binary as mt86p_<ver>_x86_64 (no .efi).
-        EFI_FILE=$(find "$TMPDIR" "$OUT_DIR/memtest" \( -name '*.efi' -name '*64*' \) -o -name 'mt86p_*_x86_64' 2>/dev/null | head -1)
-        if [ -n "$EFI_FILE" ] && [ ! -f "$OUT_DIR/memtest/memtest.efi" ]; then
-            cp "$EFI_FILE" "$OUT_DIR/memtest/memtest.efi"
-        fi
-        rm -rf "$TMPDIR"
-        echo "    Done."
-    fi
-fi
-
-ls -lh "$OUT_DIR/memtest/" 2>/dev/null | grep -v '^total' | sed 's/^/    /'
-
 # --- Summary ---
 echo ""
 echo "============================================"
@@ -309,7 +290,7 @@ echo "Boot tools prepared in: $OUT_DIR/"
 echo "============================================"
 echo ""
 
-for tool in clonezilla blancco memtest; do
+for tool in clonezilla blancco; do
     COUNT=$(find "$OUT_DIR/$tool" -type f 2>/dev/null | wc -l)
     SIZE=$(du -sh "$OUT_DIR/$tool" 2>/dev/null | cut -f1)
     printf "  %-15s %s (%d files)\n" "$tool" "$SIZE" "$COUNT"
@@ -319,7 +300,6 @@ echo ""
 echo "These files need to be copied to the PXE server's web root:"
 echo "  /var/www/html/clonezilla/"
 echo "  /var/www/html/blancco/"
-echo "  /var/www/html/memtest/"
 echo ""
 echo "The build-usb.sh script will include them automatically,"
 echo "or copy them manually to the server."

tests/vm/README.md

@@ -89,4 +89,4 @@ grow the client while both are off, and put them back afterwards:
 
 Menu keys from the host: `virsh -c qemu:///system send-key <vm> KEY_DOWN`
 (separator lines are skipped: Down x1 = Blancco, x3 = Clonezilla,
-x4 = Memtest), then KEY_ENTER; startnet answers are KEY_<digit> + KEY_ENTER.
+x4 = Reboot), then KEY_ENTER; startnet answers are KEY_<digit> + KEY_ENTER.