Update to the latest ipxe version, remove trust from the startcom root certificate, add a test script based on qemu and ovmf

4 files changed, 45 insertions, 52 deletions

diff --git a/.SRCINFO b/.SRCINFO
index aa85ceb7158a..5c333b87bb91 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,6 +1,6 @@
 pkgbase = ipxe-netboot
 	pkgdesc = iPXE build for Arch Linux netboot
-	pkgver = r5564.2afd66e
+	pkgver = r5620.30f96c9f
 	pkgrel = 1
 	url = http://ipxe.org
 	arch = i686
@@ -19,13 +19,13 @@ pkgbase = ipxe-netboot
 	source = codesigning_thomas_archlinux.pem
 	source = codesigning_pierre_archlinux.pem
 	source = dst_x1.pem
-	source = startcom.pem
+	source = test-netboot
 	sha256sums = SKIP
 	sha256sums = f789c81cade88537b4dc0acd1ce1beb26d1c1e63b837423a14a7c096b31b0230
 	sha256sums = 3ba0cf390975bb07bf1d3c7ff802d6977bdf901c94883ea2de44c16d444252e5
 	sha256sums = 64d021f345a0b4633de17ba43d816295076adc8a378eaa54e6796e8c0e95d6d0
 	sha256sums = 139a5e4a4e0fa505378c72c5f700934ce8333f4e6b1b508886c4b0eb14f4be99
-	sha256sums = 916a8f9232328192968c81c8edb672fa539f726861dfe379ca722050e19962cd
+	sha256sums = 46dff93f06527c5a0f8a0ca6d641e818f61bf5e2143c0521a59751da89adfbd3
 
 pkgname = ipxe-netboot
 
diff --git a/PKGBUILD b/PKGBUILD
index 10f586de471f..fab6ec76a75a 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -1,6 +1,6 @@
 # Maintainer: Thomas Bächler <thomas@archlinux.org>
 pkgname=ipxe-netboot
-pkgver=r5564.2afd66e
+pkgver=r5620.30f96c9f
 pkgrel=1
 pkgdesc="iPXE build for Arch Linux netboot"
 arch=('i686' 'x86_64')
@@ -19,13 +19,13 @@ source=('ipxe::git+https://git.ipxe.org/ipxe.git#branch=master'
         codesigning_thomas_archlinux.pem
         codesigning_pierre_archlinux.pem
         dst_x1.pem
-        startcom.pem)
+        test-netboot)
 sha256sums=('SKIP'
             'f789c81cade88537b4dc0acd1ce1beb26d1c1e63b837423a14a7c096b31b0230'
             '3ba0cf390975bb07bf1d3c7ff802d6977bdf901c94883ea2de44c16d444252e5'
             '64d021f345a0b4633de17ba43d816295076adc8a378eaa54e6796e8c0e95d6d0'
             '139a5e4a4e0fa505378c72c5f700934ce8333f4e6b1b508886c4b0eb14f4be99'
-            '916a8f9232328192968c81c8edb672fa539f726861dfe379ca722050e19962cd')
+            '46dff93f06527c5a0f8a0ca6d641e818f61bf5e2143c0521a59751da89adfbd3')
 
 pkgver() {
   cd "$srcdir/ipxe"
@@ -46,8 +46,8 @@ build() {
 
   make \
     EMBED="$srcdir/arch.ipxe" \
-    CERT="$srcdir/codesigning_pierre_archlinux.pem","$srcdir/codesigning_thomas_archlinux.pem","$srcdir/dst_x1.pem","$srcdir/startcom.pem" \
-    TRUST="$srcdir/codesigning_pierre_archlinux.pem","$srcdir/codesigning_thomas_archlinux.pem","$srcdir/dst_x1.pem","$srcdir/startcom.pem" \
+    CERT="$srcdir/codesigning_pierre_archlinux.pem","$srcdir/codesigning_thomas_archlinux.pem","$srcdir/dst_x1.pem" \
+    TRUST="$srcdir/codesigning_pierre_archlinux.pem","$srcdir/codesigning_thomas_archlinux.pem","$srcdir/dst_x1.pem" \
     bin/ipxe.lkrn \
     bin/ipxe.pxe \
     bin-x86_64-efi/ipxe.efi
@@ -59,4 +59,5 @@ package() {
   install -m644 bin/ipxe.lkrn "$pkgdir"/usr/share/ipxe-netboot/
   install -m644 bin/ipxe.pxe "$pkgdir"/usr/share/ipxe-netboot/
   install -m644 bin-x86_64-efi/ipxe.efi "$pkgdir"/usr/share/ipxe-netboot/
+  install -D -m755 "$srcdir"/test-netboot "$pkgdir"/usr/bin/test-netboot
 }
diff --git a/startcom.pem b/startcom.pem
deleted file mode 100644
index 960f2657be21..000000000000
--- a/startcom.pem
+++ /dev/null
@@ -1,44 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIHyTCCBbGgAwIBAgIBATANBgkqhkiG9w0BAQUFADB9MQswCQYDVQQGEwJJTDEW
-MBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwg
-Q2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh
-dGlvbiBBdXRob3JpdHkwHhcNMDYwOTE3MTk0NjM2WhcNMzYwOTE3MTk0NjM2WjB9
-MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMi
-U2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3Rh
-cnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUA
-A4ICDwAwggIKAoICAQDBiNsJvGxGfHiflXu1M5DycmLWwTYgIiRezul38kMKogZk
-pMyONvg45iPwbm2xPN1yo4UcodM9tDMr0y+v/uqwQVlntsQGfQqedIXWeUyAN3rf
-OQVSWff0G0ZDpNKFhdLDcfN1YjS6LIp/Ho/u7TTQEceWzVI9ujPW3U3eCztKS5/C
-Ji/6tRYccjV3yjxd5srhJosaNnZcAdt0FCX+7bWgiA/deMotHweXMAEtcnn6RtYT
-Kqi5pquDSR3l8u/d5AGOGAqPY1MWhWKpDhk6zLVmpsJrdAfkK+F2PrRt2PZE4XNi
-HzvEvqBTViVsUQn3qqvKv3b9bZvzndu/PWa8DFaqr5hIlTpL36dYUNk4dalb6kMM
-Av+Z6+hsTXBbKWWc3apdzK8BMewM69KN6Oqce+Zu9ydmDBpI125C4z/eIT574Q1w
-+2OqqGwaVLRcJXrJosmLFqa7LH4XXgVNWG4SHQHuEhANxjJ/GP/89PrNbpHoNkm+
-Gkhpi8KWTRoSsmkXwQqQ1vp5Iki/untp+HDH+no32NgN0nZPV/+Qt+OR0t3vwmC3
-Zzrd/qqc8NSLf3Iizsafl7b4r4qgEKjZ+xjGtrVcUjyJthkqcwEKDwOzEmDyei+B
-26Nu/yYwl/WL3YlXtq09s68rxbd2AvCl1iuahhQqcvbjM4xdCUsT37uMdBNSSwID
-AQABo4ICUjCCAk4wDAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMCAa4wHQYDVR0OBBYE
-FE4L7xqkQFulF2mHMMo0aEPQQa7yMGQGA1UdHwRdMFswLKAqoCiGJmh0dHA6Ly9j
-ZXJ0LnN0YXJ0Y29tLm9yZy9zZnNjYS1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3Js
-LnN0YXJ0Y29tLm9yZy9zZnNjYS1jcmwuY3JsMIIBXQYDVR0gBIIBVDCCAVAwggFM
-BgsrBgEEAYG1NwEBATCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9jZXJ0LnN0YXJ0
-Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5zdGFy
-dGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3Rh
-cnQgQ29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlh
-YmlsaXR5LCByZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2Yg
-dGhlIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFp
-bGFibGUgYXQgaHR0cDovL2NlcnQuc3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJ
-YIZIAYb4QgEBBAQDAgAHMDgGCWCGSAGG+EIBDQQrFilTdGFydENvbSBGcmVlIFNT
-TCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTANBgkqhkiG9w0BAQUFAAOCAgEAFmyZ
-9GYMNPXQhV59CuzaEE44HF7fpiUFS5Eyweg78T3dRAlbB0mKKctmArexmvclmAk8
-jhvh3TaHK0u7aNM5Zj2gJsfyOZEdUauCe37Vzlrk4gNXcGmXCPleWKYK34wGmkUW
-FjgKXlf2Ysd6AgXmvB618p70qSmD+LIU424oh0TDkBreOKk8rENNZEXO3SipXPJz
-ewT4F+irsfMuXGRuczE6Eri8sxHkfY+BUZo7jYn0TZNmezwD7dOaHZrzZVD1oNB1
-ny+v8OqCQ5j4aZyJecRDjkZy42Q2Eq/3JR44iZB3fsNrarnDy0RLrHiQi+fHLB5L
-EUTINFInzQpdn4XBidUaePKVEFMy3YCEZnXZtWgo+2EuvoSoOMCZEoalHmdkrQYu
-L6lwhceWD3yJZfWOQ1QOq92lgDmUYMA0yZZwLKMS9R9Ie70cfmu3nZD0Ijuu+Pwq
-yvqCUqDvr0tVk+vBtfAii6w0TiYiBKGHLHVKt+V9E9e4DGTANtLJL4YSjCMJwRuC
-O3NJo2pXh5Tl1njFmUNj403gdy3hZZlyaQQaRwnmDwFWJPsfvw55qVguucQJAX6V
-um0ABj6y6koQOdjQK/W/7HW/lwLFCRsI3FU34oH7N4RDYiDK51ZLZer+bMEkkySh
-NOsF/5oirpt9P/FlUQqmMGqz9IgcgA38corog14=
------END CERTIFICATE-----
diff --git a/test-netboot b/test-netboot
new file mode 100755
index 000000000000..95784be935cf
--- /dev/null
+++ b/test-netboot
@@ -0,0 +1,36 @@
+#!/bin/bash
+set -euo pipefail
+
+OVMFDIR=/usr/share/ovmf
+OVMF_CODE=${OVMFDIR}/ovmf_code_x64.bin
+OVMF_VARS=${OVMFDIR}/ovmf_vars_x64.bin
+IPXE_IMAGE=/usr/share/ipxe-netboot/ipxe.efi
+
+if [[ ! -f ${OVMF_CODE} ]]; then
+  echo "ERROR: ${OVMF_CODE} is missing, install the ovmf package." >&2
+  exit 1
+fi
+if [[ ! -f ${OVMF_VARS} ]]; then
+  echo "ERROR: ${OVMF_VARS} is missing, install the ovmf package." >&2
+  exit 1
+fi
+if [[ ! -f ${IPXE_IMAGE} ]]; then
+  echo "ERROR: ${IPXE_IMAGE} is missing." >&2
+  exit 1
+fi
+
+WORKDIR=$(mktemp -d --tmpdir netboot.XXXXXX)
+cd "${WORKDIR}"
+
+cp "${OVMF_VARS}" efivars
+mkdir -p ./fat/EFI/Boot/
+cp "${IPXE_IMAGE}" ./fat/EFI/Boot/bootx64.efi
+
+exec qemu-system-x86_64 \
+  -enable-kvm \
+  -device virtio-net-pci,netdev=n -netdev user,ipv4,id=n \
+  -m 2G \
+  -drive if=pflash,format=raw,readonly,file="${OVMF_CODE}" \
+  -drive if=pflash,format=raw,file=efivars \
+  -usb -usbdevice disk:format=raw:fat:./fat \
+  "$@"