63fafbfc73
Live since 2026-10-14 for every client (all UEFI clients now run iPXE 2.0):
- WinPE skips the 'Secure Boot must be ENABLED' warning and its 5 s wait
when iPXE reads Secure Boot as on (${efi/SecureBoot:uint8}); otherwise,
or on an iPXE that cannot read it, it warns as before.
- Blancco and Blancco debug start through Ubuntu's shim (iPXE shim
command), so they run with Secure Boot on; an iPXE without the command
boots the kernel directly as before. The separate Secure Boot TEST entry
is gone.
- Blancco has its own menu section; only Clonezilla and Memtest stay under
'Secure Boot must be DISABLED'.
The playbook now installs playbook/ipxe/GetPxeScript.aspx instead of an
inline copy that had drifted from the live menu. Checked that the Blancco
Releases page still parses it (one item blancco, :blancco_efi block).
116 lines
6.2 KiB
Plaintext
116 lines
6.2 KiB
Plaintext
#!ipxe
|
|
|
|
set server 172.16.9.1
|
|
|
|
:menu
|
|
menu GE Aerospace PXE Boot Menu
|
|
item --gap -- ---- Windows Deployment ----
|
|
item winpe Windows PE (Image Deployment)
|
|
item --gap -- ---- Drive Erase ----
|
|
item blancco Blancco Drive Eraser
|
|
item blancco_debug Blancco Drive Eraser (debug / SSH)
|
|
item --gap -- ---- Utilities (Secure Boot must be DISABLED) ----
|
|
item clonezilla Clonezilla Live (Disk Imaging)
|
|
item memtest Memtest86+ (Memory Diagnostics)
|
|
item --gap -- ----
|
|
item reboot Reboot
|
|
item exit Exit to BIOS
|
|
choose --default winpe --timeout 30000 target && goto ${target}
|
|
|
|
:winpe
|
|
# iPXE 2.0 reads the firmware variable; older iPXE cannot (empty), so it
|
|
# warns as before. Secure Boot confirmed on: no warning, no wait.
|
|
iseq ${efi/SecureBoot:uint8} 1 && goto winpe_boot ||
|
|
echo
|
|
echo Secure Boot is OFF on this PC (or this iPXE cannot tell).
|
|
echo Windows deployment requires Secure Boot to be ENABLED.
|
|
echo If you disabled it for Clonezilla/Memtest, re-enable it now.
|
|
echo
|
|
prompt --timeout 5000 Press any key to continue (auto-boot in 5s)... && goto winpe_boot || goto winpe_boot
|
|
|
|
:winpe_boot
|
|
kernel http://${server}/win11/wimboot gui
|
|
initrd http://${server}/win11/EFI/Microsoft/Boot/boot.stl EFI/Microsoft/Boot/Boot.stl
|
|
initrd http://${server}/win11/EFI/Microsoft/Boot/BCD EFI/Microsoft/Boot/BCD
|
|
initrd http://${server}/win11/EFI/Boot/bootx64.efi EFI/Boot/bootx64.efi
|
|
initrd http://${server}/win11/Boot/boot.sdi Boot/boot.sdi
|
|
initrd http://${server}/win11/sources/boot.wim sources/boot.wim
|
|
boot
|
|
|
|
:clonezilla
|
|
set base http://${server}/clonezilla
|
|
kernel ${base}/vmlinuz boot=live username=user union=overlay config components noswap edd=on nomodeset nodmraid locales= keyboard-layouts= ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no net.ifnames=0 nosplash noprompt fetch=${base}/filesystem.squashfs || goto secureboot_warn
|
|
initrd ${base}/initrd.img
|
|
boot
|
|
|
|
:blancco
|
|
iseq ${platform} pcbios && goto blancco_bios || goto blancco_efi
|
|
|
|
:blancco_bios
|
|
echo Loading Blancco for legacy BIOS (canonical)...
|
|
kernel http://${server}/blancco/vmlinuz-bde-linux initrd=initramfs-bde-linux.img,config.img,intel-ucode.img,amd-ucode.img quiet loglevel=3 archisobasedir=arch archiso_http_srv=http://${server}/blancco/ copytoram=y cow_spacesize=50% memtest=00 vmalloc=400M ip=dhcp libata.allow_tpm=1 modprobe.blacklist=btusb rd.udev.timeout=10 systemd.battery-check=0 || goto blancco_bios_failed
|
|
initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_bios_failed
|
|
initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_bios_failed
|
|
initrd --name config.img http://${server}/blancco/config.img || goto blancco_bios_failed
|
|
initrd --name initramfs-bde-linux.img http://${server}/blancco/initramfs-bde-linux.img || goto blancco_bios_failed
|
|
boot
|
|
:blancco_bios_failed
|
|
echo
|
|
echo Blancco BIOS boot FAILED.
|
|
prompt Press any key to return to menu... && goto menu
|
|
|
|
:blancco_debug
|
|
iseq ${platform} pcbios && goto blancco_bios ||
|
|
echo Loading Blancco UEFI (debug: verbose, SSH for root)...
|
|
kernel http://${server}/blancco/vmlinuz-ubuntu-70 initrd=kexec-initrd-70.img ip=dhcp nomodeset vga=normal console=tty0 i915.modeset=0 nouveau.modeset=0 modprobe.blacklist=nouveau,nvidiafb,nvidia,nvidia_drm,mei_me,btusb,dcdbas libata.allow_tpm=1 rd.udev.timeout=10 efi=noruntime usbcore.autosuspend=-1 pcie_aspm=off e1000e.IntMode=0 e1000e.eee_enable=0 consoleblank=0 systemd.battery-check=0 systemd.mask=suspend.target,sleep.target,hibernate.target,hybrid-sleep.target no_console_suspend mem_sleep_default=s2idle blancco.debug=1 || goto blancco_efi_grub
|
|
initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_efi_grub
|
|
initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_efi_grub
|
|
initrd --name kexec-initrd-70.img http://${server}/blancco/kexec-initrd-70.img || goto blancco_efi_grub
|
|
# Secure Boot ON: iPXE 2.0 starts the Canonical-signed kernel through
|
|
# Ubuntu's Microsoft-signed shim. Older iPXE has no shim command: the
|
|
# line fails harmlessly and the kernel boots directly (Secure Boot off).
|
|
shim http://${server}/blancco/shimx64.efi ||
|
|
boot || goto blancco_efi_grub
|
|
|
|
:blancco_efi
|
|
echo Loading Blancco UEFI (direct kernel)...
|
|
kernel http://${server}/blancco/vmlinuz-ubuntu-70 initrd=kexec-initrd-70.img ip=dhcp quiet loglevel=3 nomodeset vga=normal console=tty0 i915.modeset=0 nouveau.modeset=0 modprobe.blacklist=nouveau,nvidiafb,nvidia,nvidia_drm,mei_me,btusb,dcdbas libata.allow_tpm=1 rd.udev.timeout=10 efi=noruntime usbcore.autosuspend=-1 pcie_aspm=off e1000e.IntMode=0 e1000e.eee_enable=0 consoleblank=0 systemd.battery-check=0 systemd.mask=suspend.target,sleep.target,hibernate.target,hybrid-sleep.target no_console_suspend mem_sleep_default=s2idle || goto blancco_efi_grub
|
|
initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_efi_grub
|
|
initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_efi_grub
|
|
initrd --name kexec-initrd-70.img http://${server}/blancco/kexec-initrd-70.img || goto blancco_efi_grub
|
|
# Secure Boot ON: iPXE 2.0 starts the Canonical-signed kernel through
|
|
# Ubuntu's Microsoft-signed shim. Older iPXE has no shim command: the
|
|
# line fails harmlessly and the kernel boots directly (Secure Boot off).
|
|
shim http://${server}/blancco/shimx64.efi ||
|
|
boot || goto blancco_efi_grub
|
|
:blancco_efi_grub
|
|
echo Direct kernel boot failed - trying GRUB chain fallback...
|
|
chain http://${server}/blancco/grubx64.efi || goto secureboot_warn
|
|
|
|
:memtest
|
|
kernel http://${server}/memtest/memtest.efi || goto secureboot_warn
|
|
boot
|
|
|
|
:secureboot_warn
|
|
echo
|
|
echo ======================================================
|
|
echo This option requires Secure Boot to be DISABLED.
|
|
echo
|
|
echo 1. Reboot this machine
|
|
echo 2. Press F2 / Del to enter BIOS Setup
|
|
echo 3. Disable Secure Boot
|
|
echo 4. Save and exit BIOS
|
|
echo 5. PXE boot again and select this option
|
|
echo
|
|
echo Re-enable Secure Boot after completing the task.
|
|
echo ======================================================
|
|
echo
|
|
prompt Press any key to return to menu...
|
|
goto menu
|
|
|
|
:reboot
|
|
reboot
|
|
|
|
:exit
|
|
exit
|