The Secure Boot chain that dnsmasq hands out over TFTP: the Microsoft-signed shim (ipxe-shim.efi) starts ipxe.efi, which is signed by the iPXE Secure Boot CA. Updates come from the upstream iPXE release tarball on GitHub; its sha256 is checked against GitHub's published digest and each file's signer chain is read with sbverify before it can be installed. ipxe-bcm.efi, dnsmasq.conf and the Blancco files are never changed here.
{# ---- Upstream ------------------------------------------------------------ #}Not checked yet. Check for updates asks the GitHub API for the latest release (a few seconds).
{% endif %}| File | Version | Size | Modified | sha256 | Signature | |||||
|---|---|---|---|---|---|---|---|---|---|---|
|
{{ r.name }}
{% if not r.managed %} read-only here {% endif %}
|
{% if i %}
{{ i.version or '-' }}{% if i.release %} from {{ i.release }} {% endif %} |
{{ "{:,}".format(i.size) }} B | {{ i.modified | timestamp_fmt }} | {{ i.sha256[:12] }} | {{ sig_badge(i, i.chain_ok if i.chain_ok is defined else none) }}{{ chain(i) }} | {% else %}Not present | {% endif %}||||
| Boot file | Requires tag | Unless tagged | Clients |
|---|---|---|---|
| {{ b.file }} {% if b.managed %}updated here{% elif b.read_only %}never touched {% elif b.other_copy %}other copy, not updated here{% endif %} | {{ b.need | join(', ') or '-' }} | {{ b.exclude | join(', ') or '-' }} | {% if b.macs %}{{ b.macs | join(', ') }} {% elif b.need %}clients matching {{ b.need | join(' and ') }} {% else %}every client not excluded{% endif %} |
{% for l in routing.lines %}{{ l }}
{% endfor %}
No dhcp-boot lines found in the dnsmasq configuration.
{% endif %}| Backup | Reason | Files | |
|---|---|---|---|
| {{ b.id }} | {{ b.reason or '-' }} |
{% for f in b.files %} {{ f }} {{ b.versions[f] or '' }} {% endfor %}
{% if not b.files %}empty{% endif %}
|
{% if b.files %} {# The id is a folder name (hand-made backups too): keep it out of the JS source. #} {% endif %} |
No backups yet. One is made automatically before every install and rollback.
{% endif %}Use this when the buttons above cannot reach GitHub, or to check what they do. All commands run on the PXE server as root.
cd /tmp
curl -fLO {{ tarball_url }}
sha256sum ipxeboot.tar.gz
GitHub goes through Zscaler. A certificate error from curl means the Zscaler root CA is missing from
/usr/local/share/ca-certificates/ (the playbook installs it).tar xzf ipxeboot.tar.gz ls -l ipxeboot/x86_64-sb/
sbverify --list ipxeboot/x86_64-sb/shimx64.efi sbverify --list ipxeboot/x86_64-sb/ipxe.efiThe shim must be issued by CN=Microsoft Corporation UEFI CA 2011 or, on a newer build, CN=Microsoft UEFI CA 2023 (prefer a 2023-signed shim when upstream ships one). ipxe.efi must show CN=iPXE Secure Boot Intermediate ... issued by CN=iPXE Secure Boot CA. The shim's warning: data remaining ... gaps between PE/COFF sections? is normal. Do not rely on sbverify --cert: it reports OK even for the wrong certificate.
B=/var/lib/pxe-webapp/updates/ipxe/backups/$(date +%Y%m%d-%H%M%S) mkdir -p "$B" && cp -p /srv/tftp/ipxe-shim.efi /srv/tftp/ipxe.efi "$B"/
install -m 0644 ipxeboot/x86_64-sb/ipxe.efi /srv/tftp/.ipxe.efi.new && mv -f /srv/tftp/.ipxe.efi.new /srv/tftp/ipxe.efi install -m 0644 ipxeboot/x86_64-sb/shimx64.efi /srv/tftp/.ipxe-shim.efi.new && mv -f /srv/tftp/.ipxe-shim.efi.new /srv/tftp/ipxe-shim.efiNo dnsmasq restart is needed. Never replace ipxe-bcm.efi; it serves every other UEFI client.