mirror of
https://github.com/xcat2/xcat-core.git
synced 2026-10-21 15:18:19 +00:00
Daniel Hilst
022a80f351
This PR adds a shim to the UEFI boot scripts of netboot=ipxe nodes, so a node with Secure Boot on reaches its kernel. The firmware signature database does not hold the keys of a Linux distribution. A UEFI node with netboot=ipxe loads snponly-shim.efi and snponly.efi, both signed, and then stops at the kernel with "Verification failed: Security Policy Violation". xCAT::SecureBoot::shim_url_path names a shim for one node. The shim of the install source comes first, because its vendor certificate signs the kernel of its own distribution. copycds keeps the names of the DVD, so the module tries EFI/BOOT/BOOTX64.EFI, EFI/BOOT/bootx64.efi and EFI/boot/bootx64.efi: EL and openEuler ship the first, openSUSE the second and Ubuntu the third. When no install source carries a shim, the module names the shim of ipxe-xcat, which verifies a kernel that a MOK key signs. xnba.pm writes the shim line after imgload in the UEFI script of an ipxe node, and mknb.pm writes it in the UEFI discovery scripts. iPXE fetches the shim only when it cannot load the kernel itself, so a node with Secure Boot off reads no shim. netboot=xnba is unchanged: no key signs xnba.efi. The elilo and ESXi paths and the Genesis kernel stay unsigned, and the iPXE documentation now says so. The validation matrix gets a row for a UEFI install, a netboot image and discovery with Secure Boot on. secureboot_ipxe_node_shim.t and secureboot_genesis_shim.t drive nodeset and mknb into a scratch TFTP root. Four assertions of ten and two of seven fail without this change. Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>