Implement preference for iPXE shim

This implements a secureboot compatible flow, even for PXE.

Non secureboot environments suffer one useless transfer, but otherwise should be unaffected.

confluent_server/bin/osdeploy

@@ -278,8 +278,10 @@ async def install_tftp_content():
             raise
     shutil.copy('/opt/confluent/lib/ipxe/ipxe.efi', tftplocation)
     shutil.copy('/opt/confluent/lib/ipxe/ipxe.kkpxe', tftplocation)
+    shutil.copy('/opt/confluent/lib/ipxe/ipxe-shim.efi', tftplocation)
     if os.path.exists('/opt/confluent/lib/ipxe/ipxe-aarch64.efi'):
         shutil.copy('/opt/confluent/lib/ipxe/ipxe-aarch64.efi', os.path.join(armtftplocation, 'ipxe.efi'))
+        shutil.copy('/opt/confluent/lib/ipxe/ipxe-aarch64-shim.efi', os.path.join(armtftplocation, 'ipxe-shim.efi'))
 
 
 

confluent_server/confluent/discovery/protocols/pxe.py

@@ -353,11 +353,11 @@ async def proxydhcp(handler, nodeguess):
                 myip = socket.inet_ntoa(myipn)
                 bootfile = 'http://{0}/confluent-public/os/{1}/boot.ipxe'.format(myip, profile).encode('utf8')
             elif disco['arch'] == 'uefi-x64':
-                bootfile = b'confluent/x86_64/ipxe.efi'
+                bootfile = b'confluent/x86_64/ipxe-shim.efi'
             elif disco['arch'] == 'bios-x86':
                 bootfile = b'confluent/x86_64/ipxe.kkpxe'
             elif disco['arch'] == 'uefi-aarch64':
-                bootfile = b'confluent/aarch64/ipxe.efi'
+                bootfile = b'confluent/aarch64/ipxe-shim.efi'
             if len(bootfile) > 127:
                 if bootfile.startswith(b'http'):
                     bootfile = register_shorturl(bootfile.decode('utf8')).encode('utf8')
@@ -821,7 +821,7 @@ async def reply_dhcp4(node, info, packet, cfg, reqview, httpboot, cfd, profile,
                 return
             bootfile = 'http://{0}/confluent-public/os/{1}/boot.ipxe'.format(myipn, profile).encode('utf8')
         else:
-            bootfile = b'confluent/aarch64/ipxe.efi'
+            bootfile = b'confluent/aarch64/ipxe-shim.efi'
         repview[108:108 + len(bootfile)] = bootfile
     myip = myipn
     myipn = socket.inet_aton(myipn)

confluent_server/confluent/osimage.py

@@ -248,6 +248,10 @@ async def update_boot_linux(profiledir, profile, label):
         ipxeout.write('imgfetch boot/kernel ' + ipxeargs + '\n')
         for initramfs in initrds:
             ipxeout.write('imgfetch boot/initramfs/{0}\n'.format(initramfs))
+        for shimpossible in glob.glob(profiledir + '/boot/efi/boot/*'):
+            shimbasename = os.path.basename(shimpossible)
+            if shimbasename.lower() in ('bootaa64.efi', 'bootx64.efi'):
+                ipxeout.write('shim boot/efi/boot/{0}\n'.format(shimbasename))
         ipxeout.write('imgload kernel\nimgexec kernel\n')
     finally:
         ipxeout.close()