ge-aerospace/pxe-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

blancco: upgrade to Drive Eraser 7.20.0

Browse Source 
playbook/blancco-preferences.xml is now the vendor 7.20 preferences
(schema 4.20, "Non_GEAE_Wired" profile) with only our site overrides:
SMB report share on 172.16.9.1 with auto_backup, WiFi INTERNETACCESS for
cloud licensing (wired stays up for SMB), manual as the fallback process,
bootable report, screensaver 86400. workflow default=true is kept: the
cloud workflow erases unattended, as live 7.15 already did. No custom
fields, matching both the vendor image and live 7.15.

prepare-boot-tools.sh:
- 7.20 initramfs is an uncompressed early cpio (NIC firmware, itself
  .xz files) followed by the XZ archive. The old patch decompressed from
  byte 0, failed, warned and carried on, so PXE boots would drop network
  after copytoram. Walk the cpio to its trailer and patch the XZ part.
- Patch exactly one copytoram match or fail. The looser fallback pattern
  matches five hooks in 7.20.
- config.img now carries playbook/blancco-preferences.xml, so the BIOS
  (native kernel) and UEFI (HTTP) paths read the same settings. Refuses
  to build if the playbook preferences are for another Blancco version.
- The old global replace() also set the 802.1x, WiFi and repeater
  passwords to "blancco". Gone with the above.
- Keep preferences.xml size by refilling the NUL gap before the trailing
  filler comment (7.20), or trimming the comment (7.15).
- OUT_DIR can be overridden to stage a build outside boot-tools/.
This commit is contained in:
cproudlock
2026-10-05 09:32:32 -04:00
parent 737a729548
commit 678d10d5c2
2 changed files with 196 additions and 256 deletions
Download Patch File Download Diff File Expand all files Collapse all files

267
playbook/blancco-preferences.xml
View File

@@ -1,49 +1,42 @@
<?xml version="1.0" encoding="UTF-8"?>
<!-- FASDHFOSGHSVASLGHASDLASDFUILEFHLKJDKLFJGKLXCJGHFKLJDGHKLFJ -->
<root>
<blancco type="albus-preferences" version="4.15"/>
<blancco type="albus-preferences" version="4.20"/>
<version>
<generation>7</generation>
<major>15</major>
<minor>1</minor>
<major>20</major>
<minor>0</minor>
</version>
<configuration>
<device_enrollment_detection>
<persistent_software>false</persistent_software>
</device_enrollment_detection>
<integrity>qJ4hjOqd1NaMbEPsbmaz+8gZlG1duEXinTXI+Wrsc00=</integrity>
<configuration dect="3.15.0" imported="false">
<processes type="array" key="process">
<process>workflow</process>
<process>auto</process>
<process>semi</process>
<process selected="true">manual</process>
</processes>
<hardware_tests type="array" key="test" enabled="false">
<test enabled="true" mandatory="false" auto="true" threshold="60">battery</test>
<hardware_tests type="array" key="test" enabled="true">
<test enabled="false" mandatory="false" auto="true" threshold="60">battery</test>
<test enabled="true" mandatory="false" auto="true">cpu</test>
<test enabled="false" mandatory="false" auto="true" passes="0">memory</test>
<test enabled="true" mandatory="false" auto="true">motherboard</test>
<test enabled="true" mandatory="false" auto="false" threshold="50" duration="600">battery_discharge</test>
<test enabled="true" mandatory="false" auto="false">bios_logo</test>
<test enabled="true" mandatory="false" auto="false" threshold="80" duration="180">cpu_stress</test>
<test enabled="true" mandatory="false" auto="false">display</test>
<test enabled="true" mandatory="false" auto="false" formfactor="compact" language="us">keyboard</test>
<test enabled="true" mandatory="false" auto="false">microphone</test>
<test enabled="true" mandatory="false" auto="false" targets="">network</test>
<test enabled="true" mandatory="false" auto="false" tests="R">optical_devices</test>
<test enabled="true" mandatory="false" auto="false">sound</test>
<test enabled="true" mandatory="false" auto="false">pointing_devices</test>
<test enabled="true" mandatory="false" auto="false">sim_presence</test>
<test enabled="true" mandatory="false" auto="false">speaker</test>
<test enabled="true" mandatory="false" auto="false">touchscreen</test>
<test enabled="true" mandatory="false" auto="false" tests="R">usb_ports</test>
<test enabled="true" mandatory="false" auto="false">webcam</test>
<test enabled="true" mandatory="false" auto="false">wifi</test>
<test enabled="false" mandatory="false" auto="false" threshold="50" duration="600">battery_discharge</test>
<test enabled="false" mandatory="false" auto="false">bios_logo</test>
<test enabled="false" mandatory="false" auto="false" threshold="80" duration="180">cpu_stress</test>
<test enabled="false" mandatory="false" auto="false">display</test>
<test enabled="false" mandatory="false" auto="false" formfactor="compact" language="us">keyboard</test>
<test enabled="false" mandatory="false" auto="false">microphone</test>
<test enabled="false" mandatory="false" auto="false" targets="">network</test>
<test enabled="false" mandatory="false" auto="false" tests="R">optical_devices</test>
<test enabled="false" mandatory="false" auto="false">sound</test>
<test enabled="false" mandatory="false" auto="false">pointing_devices</test>
<test enabled="false" mandatory="false" auto="false">sim_presence</test>
<test enabled="false" mandatory="false" auto="false">speaker</test>
<test enabled="false" mandatory="false" auto="false">touchscreen</test>
<test enabled="false" mandatory="false" auto="false" tests="R">usb_ports</test>
<test enabled="false" mandatory="false" auto="false">webcam</test>
<test enabled="false" mandatory="false" auto="false">wifi</test>
</hardware_tests>
<layouts type="array" key="layout">
<layout selected="true">us</layout>
<layout>be</layout>
@@ -71,7 +64,6 @@
<layout>se</layout>
<layout>sk</layout>
</layouts>
<locales type="array" key="locale">
<locale selected="true">en_US</locale>
<locale>de_DE</locale>
@@ -88,119 +80,110 @@
<locale>zh_CN</locale>
<locale>zh_TW</locale>
</locales>
<erasure_standards key="standard" type="array">
<erasure_standards type="array" key="standard">
<standard enabled="true" id="afssi_5020" name="Air Force System Security Instruction 5020"/>
<standard enabled="true" id="aperiodic_random" name="Aperiodic random overwrite"/>
<standard enabled="true" id="bl_ssd" name="Blancco SSD Erasure"/>
<standard enabled="true" id="bruce_schneier" name="Bruce Schneier's Algorithm"/>
<standard enabled="true" id="bsi_vs" name="BSI-2011-VS"/>
<standard enabled="true" id="bsi_gs" name="BSI-GS"/>
<standard enabled="true" id="bsi_gse" name="BSI-GSE"/>
<standard enabled="true" id="bsi_gsk" name="BSI-GSK"/>
<standard enabled="true" id="bl_ssd" name="Blancco SSD Erasure"/>
<standard enabled="true" id="bruce_schneier" name="Bruce Schneier's Algorithm"/>
<standard enabled="true" id="cesg_higher" name="CESG CPA - Higher Level"/>
<standard enabled="true" id="crypto_erase" name="Sanitize Cryptographic Erasure"/>
<standard enabled="true" id="dod" name="DoD 5220.22-M"/>
<standard enabled="true" id="dod_ece" name="DoD 5220.22-M ECE"/>
<standard enabled="true" id="nist_clear" name="NIST 800-88 Clear" pattern="0x00" pattern_type="static"/>
<standard selected="true" enabled="true" id="nist_purge" name="NIST 800-88 Purge"/>
<standard enabled="true" id="firmware" name="Firmware Based Erasure"/>
<standard enabled="true" id="extended_firmware" name="Extended Firmware Based Erasure"/>
<standard enabled="true" id="hmg_lower" name="HMG Infosec Standard 5, Lower Standard"/>
<standard enabled="true" id="firmware" name="Firmware Based Erasure"/>
<standard enabled="true" id="hmg_higher" name="HMG Infosec Standard 5, Higher Standard"/>
<standard enabled="true" id="nsa" name="NSA 130-1"/>
<standard enabled="true" id="ncsc" name="National Computer Security Center (NCSC-TG-025)"/>
<standard enabled="true" id="navso" name="Navy Staff Office Publication (NAVSO P-5239-26)"/>
<standard enabled="true" id="tcg_crypto_erase" name="TCG Cryptographic Erasure"/>
<standard enabled="true" id="opnavinst" name="OPNAVINST 5239.1A"/>
<standard enabled="true" id="peter_gutmann" name="Peter Gutmann's Algorithm"/>
<standard enabled="true" id="random_byte_3x" name="Random Byte Overwrite (3x)"/>
<standard enabled="true" id="rcmp_tssit" name="RCMP TSSIT OPS-II"/>
<standard enabled="true" id="us_army" name="U.S. Army AR380-19"/>
<standard enabled="true" id="hmg_lower" name="HMG Infosec Standard 5, Lower Standard"/>
<standard enabled="true" id="ieee_clear" name="IEEE 2883-2022 Clear"/>
<standard enabled="true" id="ieee_purge" name="IEEE 2883-2022 Purge"/>
<standard enabled="false" id="nist_pc" name="NIST 800-88" pattern="0x00" pattern_type="static"/>
<standard enabled="true" id="nist_clear" name="NIST 800-88 Clear" pattern="0x00" pattern_type="static"/>
<standard selected="true" enabled="true" id="nist_purge" name="NIST 800-88 Purge"/>
<standard enabled="true" id="nist_clear_rev2" name="NIST 800-88r2 Clear" pattern="0x00" pattern_type="static"/>
<standard enabled="true" id="nist_purge_rev2" name="NIST 800-88r2 Purge"/>
<standard enabled="true" id="nsa" name="NSA 130-1"/>
<standard enabled="true" id="ncsc" name="National Computer Security Center (NCSC-TG-025)"/>
<standard enabled="true" id="navso" name="Navy Staff Office Publication (NAVSO P-5239-26)"/>
<standard enabled="true" id="opnavinst" name="OPNAVINST 5239.1A"/>
<standard enabled="true" id="peter_gutmann" name="Peter Gutmann's Algorithm"/>
<standard enabled="true" id="rcmp_tssit" name="RCMP TSSIT OPS-II"/>
<standard enabled="true" id="random_byte_3x" name="Random Byte Overwrite (3x)"/>
<standard enabled="true" id="crypto_erase" name="Sanitize Cryptographic Erasure"/>
<standard enabled="true" id="tcg_crypto_erase" name="TCG Cryptographic Erasure"/>
<standard enabled="true" id="us_army" name="U.S. Army AR380-19"/>
</erasure_standards>
<verification_standards key="standard" type="array">
<standard enabled="true" id="all_bytes_same" pattern="0x00" name="All bytes the same"/>
<verification_standards type="array" key="standard">
<standard enabled="true" id="all_bytes_same" name="All bytes the same" pattern="0x00"/>
<standard enabled="true" id="all_ones" name="All ones"/>
<standard enabled="true" id="all_sectors_same" selected="true" name="All sectors the same"/>
<standard selected="true" enabled="true" id="all_sectors_same" name="All sectors the same"/>
<standard enabled="true" id="all_zeros" name="All zeros"/>
</verification_standards>
<adapters key="adapter" type="array"/>
<network>
<enabled>false</enabled>
<enabled>true</enabled>
<dhcp>true</dhcp>
<sshd>false</sshd>
<looping>false</looping>
<address/>
<mask/>
<gateway/>
<dns1/>
<dns2/>
<vlan/>
<address></address>
<mask></mask>
<gateway></gateway>
<dns1></dns1>
<dns2></dns2>
<vlan></vlan>
</network>
<network_security>
<enabled>false</enabled>
<fallback>false</fallback>
<protocols key="protocol" type="array">
<certificate>false</certificate>
<protocols type="array" key="protocol">
<protocol selected="true">peap</protocol>
<protocol>tls</protocol>
</protocols>
<certificate>false</certificate>
<identity encrypted="false"/>
<password encrypted="false"/>
<identity encrypted="false"></identity>
<password encrypted="false"></password>
</network_security>
<proxy>
<proxy_address encrypted="false"/>
<proxy_port encrypted="false"/>
<proxy_username encrypted="false"/>
<proxy_password encrypted="false"/>
</proxy>
<mc>
<username encrypted="false"/>
<password encrypted="false"/>
<hostname/>
<port/>
<timeout>20</timeout>
<validate_remote_certificate>true</validate_remote_certificate>
</mc>
<network_share>
<username encrypted="false">blancco</username>
<password encrypted="false">blancco</password>
<domain/>
<domain></domain>
<hostname>172.16.9.1</hostname>
<path>blancco-reports</path>
<protocols key="protocol" type="array">
<protocols type="array" key="protocol">
<protocol selected="true">smb</protocol>
</protocols>
</network_share>
<workflow default="false" offline="false"/>
<proxy>
<proxy_address encrypted="false"></proxy_address>
<proxy_port encrypted="false"></proxy_port>
<proxy_username encrypted="false"></proxy_username>
<proxy_password encrypted="false"></proxy_password>
</proxy>
<mc>
<username encrypted="true">k7vMT3SelitU7wIfPSTGZiZa/mNcMlwpPsxGNaBDc2Y1s7VsOBHXEsopfRupMP+shwmLq/sKDIgGR3v9hGrN5A1gmDvvMw/Z+ClZmGIeqhzomR34yUncQA/6GXFq6jc4CNtwXQwKRAvw+stQpE9RYqNvtgFyfmQufOrz75xQyejLXUDmA7KpS6ycdXQxzFKUoqRJOEGlM6I2efjEKkjgKQrvkj8nuRDHw5g5hYXyapKXJhJn7fbwK+AWN+vKx4cceSWVM0wqvofq5BnYj+7hyD5RHphoUI1NqDYnhj2qj8dt3nGKi6EpaXtGJTnXmXplOxbT/PLtZ2afYkxZWRH96negSweOJ4fYkRcJQONe8wGukufSLh/pQcY3NNwkJv7UNh2tC4ogyEKo+E8+n3beImrUWybl6FlUk2lnyQYJFihnnolepze4w5JmPZ2yTEbRi94OUj+bdNEt4ZqRBK2HuDfCI/jzz7h+ytyA2H2+SZWQGjr/oy/RN15a6sgzS5T7Nys+yAbXAH8HSMQm5KUEtLWSSICUpNbRsBOcC+oQhoJnCzWNafj0w5gY/uTNjBm9F0Yd+kjdcO2kqnBF6aeFaLWX6HkTh1DCsMyIJtOr5wZYUmLLtRwgsruhauSbkkQxJA5iy9QsC2Kv+SSACeTLU4WP99Q5MEQIWb+Tjx/S4z6qISgMhxhu4ioteopClaBSizn2oBd/y6gdp7Fz0FK8JSOmPx+pwT3QrDULoK07O5w=</username>
<password encrypted="true">eHTwqUlvjRsTYm5ljXTb8uN4hiG6ceE5OIBO0PA+TSMCwmI9qD6co8tmDHCwRdiDdZH2bssDAW40ZPQNfxTdKbDHZ0hunEcQob0xnrr8668L4OkZlWx5V17k8KXB5QgBUd0v1ALnvp9m2SQbsnP6IljTtIL+cZNnfrpmSrvPoGFe8fuoxwMrRE9PZett0DHuYnsnaaP7lD/hAWy8hONsp6MbegS0YA7vZi56cFSrpFnPwjWbNxYREfO3FY6kxxOZoslGARLKLS9//EA0DmOzN4HcXhKhVsiIIbNS1rUEpZi8PsAjS9EKPBMaD2riKlmQYkcw4gIis8Cdj649TsqG5+VESRtXtGCelaGPKSZJaeh7x3Obh6Me+TYQBN5gx4YBUB8Ao11MJR1i5cZj0vdYLPknIsZ9EaFOtRozIo5S37sd7uhgsLPX9pUKJBiDMy+a/CP07rqlKS7pI4+onhInRapU1hwTaBQuO1DxvjhtPXwoPrz0aadmq3jXREhs1YRiJ0bIpZcTA6c9zWYWBSQQ/kfbBB18BSEBZmKfUq42K/8ZDmGuhS/rVIXKLU14/VL9vMqngMfxZ9rBLzTQobXmkt9dKTO9VKxd90P3j3epTQXQsPZ2hwW1rF7NlRA3il2iL94aRAgOGWGe0P9O18VmKEd9uGKWVjXid6vNKBK5m5JHBMoN5n7eXxo9uKQEn8Ex6CKN7vMVvbms25RcUiHUOg==</password>
<hostname>classic.eu-west-1.blancco.cloud</hostname>
<port>443</port>
<timeout>20</timeout>
<validate_remote_certificate>false</validate_remote_certificate>
</mc>
<workflow offline="false" default="true"></workflow>
<erasure>
<drive_self_test type="short">false</drive_self_test>
<max_simultaneous_erasures>50</max_simultaneous_erasures>
<remove_hidden_areas>false</remove_hidden_areas>
<remove_hidden_areas>true</remove_hidden_areas>
<preserve_recovery_partition>false</preserve_recovery_partition>
<store_erasure_progress>false</store_erasure_progress>
<remapped mandatory="false" threshold="0">false</remapped>
<remapped mandatory="false" threshold="0">true</remapped>
<action_if_not_possible>interrupt</action_if_not_possible>
<fail_on_remapped_sectors>false</fail_on_remapped_sectors>
<fail_on_erasure_errors threshold="5">true</fail_on_erasure_errors>
<fail_on_read_errors threshold="5">true</fail_on_read_errors>
<verification>10</verification>
<enforced_rules key="rule" type="array">
<enforced_rules type="array" key="rule">
<rule enabled="false" name="enforced_standard" standard_id="bl_ssd" target="ssd"/>
<rule enabled="true" name="fallback_nist_standard" standard_id="nist_purge" fallback_id="nist_clear"/>
</enforced_rules>
<drive_self_test type="short">false</drive_self_test>
<fail_on_failed_self_test>false</fail_on_failed_self_test>
<fail_on_low_erasure_speed threshold="1">false</fail_on_low_erasure_speed>
<fail_on_timeout threshold="1">false</fail_on_timeout>
@@ -219,36 +202,29 @@
<allow_tcg_reset_write_pointers>true</allow_tcg_reset_write_pointers>
<allow_tcg_unmap>true</allow_tcg_unmap>
</erasure>
<fingerprint>
<enabled>false</enabled>
<location>67000</location>
</fingerprint>
<bootable_report>
<enabled>true</enabled>
</bootable_report>
<format_disk>
<enabled>false</enabled>
<type>ntfs</type>
</format_disk>
<spin_down_idle_disk>
<enabled>false</enabled>
</spin_down_idle_disk>
<raid>
<show_logical_disks>false</show_logical_disks>
<show_logical_disks>true</show_logical_disks>
<enable_passthrough>true</enable_passthrough>
<kill_logical_disks>true</kill_logical_disks>
<kill_logical_disks>false</kill_logical_disks>
</raid>
<hotplug>
<enabled>false</enabled>
<timeout>30</timeout>
<timeout>60</timeout>
</hotplug>
<external_device_service>
<enabled>false</enabled>
<port>80</port>
@@ -264,28 +240,24 @@
<test enabled="true">webcam</test>
</hardware_tests>
</external_device_service>
<license>
<provider>bios</provider>
<provider_report>bios</provider_report>
<provider>clurichaun</provider>
<provider_report>clurichaun</provider_report>
<edition>Enterprise Volume Edition</edition>
<offline></offline>
<mode>Drive Eraser</mode>
<offline/>
</license>
<image>
<description/>
<creation_date>2025-03-10</creation_date>
<description>BMP Internet - June 2026</description>
<creation_date>2026-06-22</creation_date>
</image>
<customer_data>
<business_location/>
<customer_license>General Electric Company</customer_license>
<erasure_person/>
<erasure_provider/>
<business_name/>
<business_location></business_location>
<customer_license>GE Aerospace</customer_license>
<erasure_person></erasure_person>
<erasure_provider></erasure_provider>
<business_name>Non_GEAE_Wired</business_name>
</customer_data>
<settings>
<gui>
<erasure_console>local</erasure_console>
@@ -295,11 +267,11 @@
<ssd_erasure_exception>true</ssd_erasure_exception>
<report_view locked="true">standard</report_view>
<erasure_settings locked="false"/>
<show_customer>false</show_customer>
<show_customer>true</show_customer>
<show_operator>false</show_operator>
<show_partitions>false</show_partitions>
<screensaver locked="false">
<timeout>30</timeout>
<timeout>86400</timeout>
<show_exceptions>false</show_exceptions>
</screensaver>
<hexviewer>
@@ -309,7 +281,7 @@
<drive_selection_percentage>5</drive_selection_percentage>
<reconfigure_controller_mode>
<timeout enabled="false">30</timeout>
<default_focus_on_proceed>true</default_focus_on_proceed>
<default_focus_on_proceed>false</default_focus_on_proceed>
</reconfigure_controller_mode>
<disable_sid_block_authentication>
<timeout enabled="true">0</timeout>
@@ -323,8 +295,8 @@
<accessibility>
<available>false</available>
<enabled>true</enabled>
<speaking_rate>80</speaking_rate>
<key_echo>true</key_echo>
<speaking_rate>80</speaking_rate>
</accessibility>
<sound_level>70</sound_level>
<input_method>
@@ -334,47 +306,23 @@
</input_method>
</gui>
</settings>
<custom_fields type="array" key="custom_field"/>
<exclude_verification_ranges type="array" key="exclude_verification_range"/>
<report>
<per_drive>false</per_drive>
<auto_backup>true</auto_backup>
<extensions type="array" key="extension">
<extension selected="true">xml</extension>
<extension>pdf+xml</extension>
</extensions>
<utc_offset>0</utc_offset>
<network_info>true</network_info>
<custom_signature>
<enabled>false</enabled>
<label/>
<label></label>
</custom_signature>
<drive_life_estimation>false</drive_life_estimation>
</report>
<custom_fields type="array" key="custom_field">
<custom_field type="input" mandatory="true" locked="false" per_drive="false" show_in_editor="false" pattern="" hint="">
<name>custom_field_1</name>
<title>GERITM Number</title>
<value/>
</custom_field>
<custom_field type="input" mandatory="true" locked="false" per_drive="false" show_in_editor="false" pattern="" hint="">
<name>custom_field_2</name>
<title>Device Name</title>
<value/>
</custom_field>
<custom_field type="input" mandatory="true" locked="false" per_drive="false" show_in_editor="false" pattern="" hint="">
<name>custom_field_3</name>
<title>Device Serial Number</title>
<value/>
</custom_field>
<custom_field type="input" mandatory="false" locked="true" per_drive="false" show_in_editor="false" pattern="" hint="">
<name>custom_field_4</name>
<title>Version</title>
<value>EVE_20250310</value>
</custom_field>
</custom_fields>
<exclude_verification_ranges type="array" key="exclude_verification_range"/>
<wireless>
<enabled>true</enabled>
<ssid encrypted="false">INTERNETACCESS</ssid>
@@ -382,34 +330,31 @@
<key_mgmt>WPA-PSK</key_mgmt>
<scan_ssid>0</scan_ssid>
</wireless>
<cd_eject>
<after_boot>true</after_boot>
<after_boot>false</after_boot>
<after_erasure>false</after_erasure>
<after_report>false</after_report>
<at_shutdown>false</at_shutdown>
</cd_eject>
<system_shutdown>
<after_erasure>false</after_erasure>
<after_successful_erasure>false</after_successful_erasure>
</system_shutdown>
<system_restart>
<after_erasure>false</after_erasure>
<after_successful_erasure>false</after_successful_erasure>
</system_restart>
<device_enrollment_detection>
<persistent_software>false</persistent_software>
</device_enrollment_detection>
<vnc_remote>
<enabled>false</enabled>
<mode>viewer</mode>
<repeater_hostname/>
<repeater_hostname></repeater_hostname>
<port>5900</port>
<password encrypted="false"/>
<password encrypted="false"></password>
</vnc_remote>
<nvme_over_fabrics type="array" key="connection" enabled="false"/>
<nvme_over_fabrics enabled="false" type="array" key="connection"/>
<update>
<enabled>false</enabled>
<intervals type="array" key="interval">
@@ -420,6 +365,6 @@
</intervals>
<url>https://cdn.blancco.com/products/drive_eraser/download/ota/drive_eraser.json</url>
</update>
<adapters type="array" key="adapter"/>
</configuration>
</root>
<!-- JFLKHGDJLKFHGJCXLKGJFLKDJKLHFELIUFDSALDSAHGLSAVSHGSOFHDSAF -->

185
scripts/prepare-boot-tools.sh
View File

@@ -16,7 +16,7 @@
set -euo pipefail
REPO_ROOT="$(cd "$(dirname "$0")"/.. && pwd)"
OUT_DIR="$REPO_ROOT/boot-tools"
OUT_DIR="${OUT_DIR:-$REPO_ROOT/boot-tools}"
BLANCCO_ISO="${1:-}"
# Auto-detect Blancco ISO in project directory
@@ -106,91 +106,76 @@ if [ -n "$BLANCCO_ISO" ] && [ -f "$BLANCCO_ISO" ]; then
echo " Extracted Blancco boot files."
# --- Patch config.img (size-preserving) ---
# config.img is a CPIO archive containing preferences.xml (padded to 32768 bytes).
# The CPIO itself must remain exactly 194560 bytes (380 x 512-byte blocks).
# We use Python for byte-level replacement to preserve exact sizes.
# config.img is a CPIO archive. Its preferences.xml is what the native
# kernel (BIOS) boot path reads; the UEFI path gets the same file over
# HTTP. Both now carry playbook/blancco-preferences.xml, so the two
# paths cannot drift. The vendor file is laid out as
# <xml> [NUL padding] <!-- filler comment --> and its size is kept:
# 7.20 pads to 32768 with ~15KB of NULs; 7.15 had none, so growth
# there comes out of the filler comment.
if [ -f "$OUT_DIR/blancco/config.img" ]; then
echo " Patching config.img for network report storage..."
echo " Writing playbook preferences into config.img..."
CFGTMP=$(mktemp -d)
cd "$CFGTMP"
cpio -id < "$OUT_DIR/blancco/config.img" 2>/dev/null
if [ -f "$CFGTMP/preferences.xml" ]; then
ORIG_SIZE=$(stat -c%s "$CFGTMP/preferences.xml")
python3 << 'PYEOF'
import sys
PREFS_SRC="$REPO_ROOT/playbook/blancco-preferences.xml" python3 << 'PYEOF'
import os, re, sys
with open("preferences.xml", "rb") as f:
data = f.read()
with open(os.environ["PREFS_SRC"], "rb") as f:
ours = f.read().strip() + b"\n"
orig_size = len(data)
# Set SMB share credentials and path
data = data.replace(
b'<username encrypted="false"></username>',
b'<username encrypted="false">blancco</username>'
)
data = data.replace(
b'<password encrypted="false"></password>',
b'<password encrypted="false">blancco</password>'
)
data = data.replace(
b'<hostname></hostname>',
b'<hostname>172.16.9.1</hostname>'
)
data = data.replace(
b'<path></path>',
b'<path>blancco-reports</path>'
)
def version(x):
m = re.search(rb"<version>\s*<generation>(\d+)</generation>\s*"
rb"<major>(\d+)</major>", x)
return m.groups() if m else None
# Enable auto-backup
data = data.replace(
b'<auto_backup>false</auto_backup>',
b'<auto_backup>true</auto_backup>'
)
# Our file must be a merge onto THIS release's preferences, or settings the
# new schema added or renamed are silently lost.
if version(ours) != version(data):
sys.exit(f" ERROR: playbook preferences are for {version(ours)}, ISO is "
f"{version(data)}. Merge onto the new vendor preferences first.")
for need in (b"<hostname>172.16.9.1</hostname>", b"<path>blancco-reports</path>",
b"<auto_backup>true</auto_backup>"):
if need not in ours:
sys.exit(f" ERROR: playbook preferences missing {need.decode()}")
# Enable bootable report
data = data.replace(
b'<bootable_report>\n <enabled>false</enabled>\n </bootable_report>',
b'<bootable_report>\n <enabled>true</enabled>\n </bootable_report>'
)
# Maintain exact file size by trimming trailing padding/whitespace
diff = len(data) - orig_size
if diff > 0:
# The file has trailing whitespace/padding before the final XML closing tags
# Trim from the padding area (spaces before closing comment or end of file)
end_pos = data.rfind(b'<!-- ')
if end_pos > 0:
comment_end = data.find(b' -->', end_pos)
if comment_end > 0:
data = data[:comment_end - diff] + data[comment_end:]
if len(data) > orig_size:
# Fallback: trim trailing whitespace
data = data.rstrip()
data = data + b'\n' * (orig_size - len(data))
elif diff < 0:
# Pad with spaces to maintain size
data = data[:-1] + b' ' * (-diff) + data[-1:]
if len(data) != orig_size:
print(f" WARNING: Size mismatch ({len(data)} vs {orig_size}), padding to match")
if len(data) > orig_size:
data = data[:orig_size]
else:
data = data + b'\x00' * (orig_size - len(data))
# Split off the trailing filler comment and any NUL padding before it.
end = data.find(b"</root>")
cstart = data.rfind(b"<!--")
if end < 0 or cstart < end:
sys.exit(" ERROR: vendor preferences.xml layout not recognised")
gap, tail = data[end + 7:cstart], data[cstart:]
xml = ours
room = orig_size - len(xml) - len(tail)
if room >= 0:
# Refill the gap with what it held: NULs if it was padding, else newlines.
gap = (b"\x00" if b"\x00" in gap else b"\n") * room
else:
# No room left: take it out of the filler comment body (keep "<!-- " + " -->").
cut = -room
if len(tail) - cut < len(b"<!-- -->\n"):
sys.exit(f" ERROR: preferences need {cut} more bytes than the "
"padding and filler comment can give")
tail = tail[:5] + tail[5 + cut:]
gap = b""
out = xml + gap + tail
if len(out) != orig_size:
sys.exit(f" ERROR: preferences.xml size changed {orig_size} -> {len(out)}")
with open("preferences.xml", "wb") as f:
f.write(data)
print(f" preferences.xml: {orig_size} bytes (preserved)")
f.write(out)
print(f" preferences.xml: {len(xml)} bytes of XML, {orig_size} total (preserved)")
PYEOF
# Repack CPIO with exact 512-byte block alignment (194560 bytes)
# Repack CPIO padded to a 512-byte boundary
ls -1 "$CFGTMP" | (cd "$CFGTMP" && cpio -o -H newc 2>/dev/null) | \
dd bs=512 conv=sync 2>/dev/null > "$OUT_DIR/blancco/config.img"
echo " Reports: SMB blancco@172.16.9.1/blancco-reports, bootable report enabled"
echo " Reports: SMB blancco@172.16.9.1/blancco-reports (from playbook preferences)"
fi
cd "$REPO_ROOT"
rm -rf "$CFGTMP"
@@ -201,41 +186,51 @@ PYEOF
# flush all network interfaces. Binary-patch the check from "y" to "N" so
# the condition never matches. IMPORTANT: full extract/repack BREAKS booting.
echo " Patching initramfs to preserve network after copytoram..."
python3 << PYEOF
import lzma, sys, os
initramfs = "$OUT_DIR/blancco/initramfs-bde-linux.img"
INITRAMFS="$OUT_DIR/blancco/initramfs-bde-linux.img" python3 << 'PYEOF'
import lzma, os, sys
initramfs = os.environ["INITRAMFS"]
with open(initramfs, "rb") as f:
compressed = f.read()
data = f.read()
# Decompress XZ stream
try:
raw = lzma.decompress(compressed)
except lzma.LZMAError:
print(" WARNING: Could not decompress initramfs (not XZ?), skipping patch")
sys.exit(0)
# 7.20 prepends an uncompressed early cpio (NIC firmware) before the XZ
# archive; 7.15 was XZ from byte 0. Patch only the XZ part, keep the prefix.
# Walk the cpio headers to its trailer: the firmware files are themselves
# .xz, so searching for the XZ magic would land inside the prefix.
off = 0
while data.startswith(b"070701", off):
namesize = int(data[off + 94:off + 102], 16)
filesize = int(data[off + 54:off + 62], 16)
name = data[off + 110:off + 110 + namesize - 1]
off = (((off + 110 + namesize + 3) & ~3) + filesize + 3) & ~3
if name == b"TRAILER!!!":
while off < len(data) and data[off] == 0:
off += 1
if not data.startswith(b"\xfd7zXZ\x00", off):
sys.exit(f" ERROR: initramfs layout not recognised (no XZ archive at {off})")
prefix, compressed = data[:off], data[off:]
# Binary patch: change the copytoram check from "y" to "N"
raw = lzma.decompress(compressed)
# Binary patch: change the copytoram check from "y" to "N" in
# archiso_pxe_common's run_latehook. Exact match only: the looser
# '"${copytoram}" = "y"' appears in several hooks and patching the first
# one found is not safe.
old = b'"y" ]; then\n for curif in /sys/class/net'
new = b'"N" ]; then\n for curif in /sys/class/net'
count = raw.count(old)
if count != 1:
sys.exit(f" ERROR: copytoram network-flush pattern found {count} times, "
"expected 1. PXE boot would lose network after copytoram.")
raw = raw.replace(old, new, 1)
if old not in raw:
# Try alternate pattern with different whitespace
old = b'"\${copytoram}" = "y"'
new = b'"\${copytoram}" = "N"'
if old in raw:
raw = raw.replace(old, new, 1)
# Recompress with same XZ settings as archiso
recompressed = lzma.compress(raw, format=lzma.FORMAT_XZ,
check=lzma.CHECK_CRC32,
preset=6)
with open(initramfs, "wb") as f:
f.write(recompressed)
print(" initramfs patched: copytoram network flush disabled")
else:
print(" WARNING: copytoram pattern not found in initramfs, skipping patch")
# Recompress with same XZ settings as archiso
recompressed = lzma.compress(raw, format=lzma.FORMAT_XZ,
check=lzma.CHECK_CRC32, preset=6)
with open(initramfs, "wb") as f:
f.write(prefix + recompressed)
print(f" initramfs patched: copytoram network flush disabled "
f"(early cpio {len(prefix)} bytes kept)")
PYEOF
# --- Build GRUB EFI binary for Blancco chainload ---