diff --git a/SETUP.md b/SETUP.md index d0fb22c..6c9b4ce 100644 --- a/SETUP.md +++ b/SETUP.md @@ -84,7 +84,7 @@ to `pip-wheels/`. About 500 debs (~1.6 GB) + 8 wheels. ./scripts/prepare-boot-tools.sh /path/to/blancco.iso ``` -Extracts boot files for Blancco and Clonezilla (with Debian's signed shim, so it boots with Secure Boot on) into the `boot-tools/` directory. Automatically patches Blancco's `config.img` to auto-save erasure reports to the PXE server's Samba share. +Extracts boot files for Blancco and Clonezilla (64-bit with Debian's signed shim, so it boots with Secure Boot on, plus the last 32-bit release for XP-era PCs) into the `boot-tools/` directory. Automatically patches Blancco's `config.img` to auto-save erasure reports to the PXE server's Samba share. ### Step 3: Build the USB diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md index 3270960..822f841 100644 --- a/docs/ARCHITECTURE.md +++ b/docs/ARCHITECTURE.md @@ -114,6 +114,9 @@ WinPE; the Blancco and Clonezilla utilities require Secure Boot disabled. iPXE loads vmlinuz + initrd over HTTP, fetches filesystem.squashfs. With Secure Boot on, the Debian-signed kernel starts through Debian's Microsoft-signed shim (clonezilla/shimx64.efi, iPXE shim command). + The menu checks the CPU (iPXE cpuid --ext 29): 64-bit CPUs get the + current release, 32-bit-only CPUs (XP-era Pentium 4/M, early Atom) get + clonezilla-i686/ (3.2.0-5, the last 32-bit Clonezilla) over legacy BIOS. Memory testing is not on the menu: Dell PCs have a built-in test (F12 at power-on, Diagnostics). Memtest86+ was removed because it is diff --git a/playbook/ipxe/GetPxeScript.aspx b/playbook/ipxe/GetPxeScript.aspx index 7cc3178..d3d731e 100644 --- a/playbook/ipxe/GetPxeScript.aspx +++ b/playbook/ipxe/GetPxeScript.aspx @@ -11,6 +11,7 @@ item blancco Blancco Drive Eraser item blancco_debug Blancco Drive Eraser (debug / SSH) item --gap -- ---- Utilities ---- item clonezilla Clonezilla Live (Disk Imaging) +item clonezilla32 Clonezilla Live 32-bit (XP-era PCs, forced) item --gap -- Memory test: Dell PCs press F12 at power-on, Diagnostics item --gap -- ---- item reboot Reboot @@ -48,6 +49,14 @@ echo Check that the PXE server is up and the win11 boot files are staged. prompt Press any key to return to menu... && goto menu || goto menu :clonezilla +# 64-bit CPUs (cpuid extended bit 29 = long mode) get the current Clonezilla; +# older 32-bit-only CPUs (Pentium 4 without EM64T, Pentium M, early Atom: +# many XP-era PCs) get the last 32-bit release. If this iPXE has no cpuid +# command the check fails and the 32-bit build is used, which also runs +# on 64-bit CPUs. +cpuid --ext 29 && goto clonezilla64 || goto clonezilla32 + +:clonezilla64 set base http://${server}/clonezilla kernel ${base}/vmlinuz boot=live username=user union=overlay config components noswap edd=on nomodeset nodmraid locales= keyboard-layouts= ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no net.ifnames=0 nosplash noprompt fetch=${base}/filesystem.squashfs || goto secureboot_warn initrd ${base}/initrd.img || goto boot_failed @@ -55,11 +64,21 @@ initrd ${base}/initrd.img || goto boot_failed # Debian's Microsoft-signed shim (from the Clonezilla release, staged as # clonezilla/shimx64.efi by prepare-boot-tools.sh), the same way Blancco # uses Ubuntu's. Its modules (usb-storage, uas, exfat) are signed by the -# same build key, so USB drives work. Without the shim command (old iPXE) -# the line fails harmlessly and the kernel boots directly (Secure Boot off). +# same build key, so USB drives work. Without the shim command (legacy +# BIOS, old iPXE) the line fails harmlessly and the kernel boots directly. shim ${base}/shimx64.efi || boot || goto secureboot_warn +:clonezilla32 +# Clonezilla 3.2.0-5 i686 (the last 32-bit release; later ones are amd64 +# only), for legacy-BIOS XP-era PCs. A UEFI PC is always 64-bit and its +# firmware cannot start a 32-bit kernel, so UEFI goes to the 64-bit build. +iseq ${platform} efi && goto clonezilla64 || +set base http://${server}/clonezilla-i686 +kernel ${base}/vmlinuz boot=live username=user union=overlay config components noswap edd=on nomodeset nodmraid locales= keyboard-layouts= ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no net.ifnames=0 nosplash noprompt fetch=${base}/filesystem.squashfs || goto boot_failed +initrd ${base}/initrd.img || goto boot_failed +boot || goto boot_failed + :blancco iseq ${platform} pcbios && goto blancco_bios || goto blancco_efi diff --git a/playbook/pxe_server_setup.yml b/playbook/pxe_server_setup.yml index 6a69ea0..d46ddc6 100644 --- a/playbook/pxe_server_setup.yml +++ b/playbook/pxe_server_setup.yml @@ -698,6 +698,7 @@ mode: '0755' loop: - clonezilla + - clonezilla-i686 - blancco - name: "Remove the retired Memtest86+ web dir (memory tests: Dell F12 Diagnostics)" @@ -1382,13 +1383,14 @@ debug: msg: "{{ ipxe_chain.stdout }}" - - name: "Copy boot tool files from USB (Clonezilla, Blancco)" + - name: "Copy boot tool files from USB (Clonezilla 64/32-bit, Blancco)" # Clonezilla includes shimx64.efi (Debian's Microsoft-signed shim), which # the menu uses to boot its Debian-signed kernel with Secure Boot on. shell: > cp -r "{{ usb_root }}/boot-tools/{{ item }}/"* "{{ web_root }}/{{ item }}/" 2>/dev/null || true loop: - clonezilla + - clonezilla-i686 - blancco # --- Blancco PXE boot via Ubuntu kernel + switch_root --- diff --git a/scripts/prepare-boot-tools.sh b/scripts/prepare-boot-tools.sh index a722475..3c7d5e3 100755 --- a/scripts/prepare-boot-tools.sh +++ b/scripts/prepare-boot-tools.sh @@ -25,7 +25,7 @@ if [ -z "$BLANCCO_ISO" ]; then BLANCCO_ISO=$(find "$REPO_ROOT" -maxdepth 1 -name '*DriveEraser*.iso' -o -name '*blancco*.iso' 2>/dev/null | head -1) fi -mkdir -p "$OUT_DIR"/{clonezilla,blancco} +mkdir -p "$OUT_DIR"/{clonezilla,clonezilla-i686,blancco} echo "============================================" echo "PXE Boot Tools Preparation" @@ -84,6 +84,32 @@ if command -v sbverify >/dev/null && [ -s "$OUT_DIR/clonezilla/shimx64.efi" ]; t fi fi +# --- Clonezilla Live 32-bit (XP-era PCs) --- +# Clonezilla 3.2.0-5 is the last release with a 32-bit (i686) build; the +# menu picks it for CPUs without 64-bit support (cpuid --ext 29). Legacy +# BIOS only, so no shim. Plain i686 (not -pae) for the oldest CPUs. +echo "" +echo "[1b/2] Clonezilla Live 32-bit" +CZ32_VERSION="3.2.0-5" +CZ32_FILE="clonezilla-live-${CZ32_VERSION}-i686.zip" +if [ -f "$OUT_DIR/clonezilla-i686/vmlinuz" ] && [ -f "$OUT_DIR/clonezilla-i686/filesystem.squashfs" ]; then + echo " Already prepared, skipping. Delete boot-tools/clonezilla-i686/ to re-download." +else + TMPDIR=$(mktemp -d) + if wget -q --show-progress -O "$TMPDIR/$CZ32_FILE" \ + "https://sourceforge.net/projects/clonezilla/files/clonezilla_live_stable/${CZ32_VERSION}/${CZ32_FILE}/download" \ + || wget -q --show-progress -O "$TMPDIR/$CZ32_FILE" \ + "https://free.nchc.org.tw/clonezilla-live/oldstable/${CZ32_FILE}"; then + unzip -o -j "$TMPDIR/$CZ32_FILE" "live/vmlinuz" "live/initrd.img" "live/filesystem.squashfs" \ + -d "$OUT_DIR/clonezilla-i686/" + echo " Done." + else + echo " ERROR: could not download $CZ32_FILE; 32-bit PCs cannot run Clonezilla until it is staged." + fi + rm -rf "$TMPDIR" +fi +ls -lh "$OUT_DIR/clonezilla-i686/" 2>/dev/null | grep -E 'vmlinuz|initrd|squashfs' | sed 's/^/ /' + # --- Blancco Drive Eraser --- echo "" echo "[2/2] Blancco Drive Eraser" @@ -290,7 +316,7 @@ echo "Boot tools prepared in: $OUT_DIR/" echo "============================================" echo "" -for tool in clonezilla blancco; do +for tool in clonezilla clonezilla-i686 blancco; do COUNT=$(find "$OUT_DIR/$tool" -type f 2>/dev/null | wc -l) SIZE=$(du -sh "$OUT_DIR/$tool" 2>/dev/null | cut -f1) printf " %-15s %s (%d files)\n" "$tool" "$SIZE" "$COUNT" @@ -299,6 +325,7 @@ done echo "" echo "These files need to be copied to the PXE server's web root:" echo " /var/www/html/clonezilla/" +echo " /var/www/html/clonezilla-i686/" echo " /var/www/html/blancco/" echo "" echo "The build-usb.sh script will include them automatically,"