lovely stuff, job done -

kernel http://fog/listing/centos7_1804/images/pxeboot/vmlinuz ks=http://fog/listing/centos7_1804/ks.cfg
initrd http://fog/listing/centos7_1804/images/pxeboot/initrd.img
boot || goto MENU

@george1421 made it into all one script, even the mkkeys.sh

#!/bin/bash

apt-get update
apt-get upgrade -y

apt-get install -y openssl efitools gnu-efi git build-essential help2man libssl-dev
perl -e'use CPAN; install "File::Slurp"'

mkdir -p /opt/fog/secureboot/efikeys

cat << EOF > /opt/fog/secureboot/mkkeys.sh
#!/bin/bash
# Copyright (c) 2015 by Roderick W. Smith
# Updated 26-Nov-2021 by George1421 for the FOG Project
# Licensed under the terms of the GPL v3

NAME=FOGProjectSB

openssl req -new -x509 -newkey rsa:2048 -subj "/CN=$NAME PK/" -keyout efikeys/PK.key \
        -out efikeys/PK.crt -days 3650 -nodes -sha256
openssl req -new -x509 -newkey rsa:2048 -subj "/CN=$NAME KEK/" -keyout efikeys/KEK.key \
        -out efikeys/KEK.crt -days 3650 -nodes -sha256
openssl req -new -x509 -newkey rsa:2048 -subj "/CN=$NAME DB/" -keyout efikeys/DB.key \
        -out efikeys/DB.crt -days 3650 -nodes -sha256
openssl x509 -in efikeys/PK.crt -out efikeys/PK.cer -outform DER
openssl x509 -in efikeys/KEK.crt -out efikeys/KEK.cer -outform DER
openssl x509 -in efikeys/DB.crt -out efikeys/DB.cer -outform DER

GUID=`python3 -c 'import uuid; print(str(uuid.uuid1()))'`
echo $GUID > efikeys/myGUID.txt

cert-to-efi-sig-list -g $GUID efikeys/PK.crt efikeys/PK.esl
cert-to-efi-sig-list -g $GUID efikeys/KEK.crt efikeys/KEK.esl
cert-to-efi-sig-list -g $GUID efikeys/DB.crt efikeys/DB.esl
rm -f efikeys/noPK.esl
touch efikeys/noPK.esl

sign-efi-sig-list -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')" \
                  -k efikeys/PK.key -c efikeys/PK.crt PK efikeys/PK.esl efikeys/PK.auth
sign-efi-sig-list -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')" \
                  -k efikeys/PK.key -c efikeys/PK.crt PK efikeys/noPK.esl efikeys/noPK.auth
sign-efi-sig-list -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')" \
                  -k efikeys/PK.key -c efikeys/PK.crt KEK efikeys/KEK.esl efikeys/KEK.auth
sign-efi-sig-list -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')" \
                  -k efikeys/KEK.key -c efikeys/KEK.crt db efikeys/DB.esl efikeys/DB.auth

chmod 0600 efikeys/*.key

echo ""
echo ""
echo "For use with KeyTool, copy the *.auth and *.esl files to a FAT USB"
echo "flash drive or to your EFI System Partition (ESP)."
echo "For use with most UEFIs' built-in key managers, copy the *.cer files;"
echo "but some UEFIs require the *.auth files."
echo ""
EOF

chmod a+x /opt/fog/secureboot/mkkeys.sh
cd /opt/fog/secureboot/
./mkkeys.sh

git clone git://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git

cd /opt/fog/secureboot/efitools
make

mkdir -p /opt/fog/secureboot/hwkeys
cd /opt/fog/secureboot/

efi-readvar -v PK -o /opt/fog/secureboot/hwkeys/hw_PK.esl
efi-readvar -v KEK -o /opt/fog/secureboot/hwkeys/hw_KEK.esl
efi-readvar -v db -o /opt/fog/secureboot/hwkeys/hw_db.esl
efi-readvar -v dbx -o /opt/fog/secureboot/hwkeys/hw_dbx.esl
chmod 666 /opt/fog/secureboot/hwkeys/*

cp /opt/fog/secureboot/efikeys/* /opt/fog/secureboot/efitools/
cp /opt/fog/secureboot/hwkeys/* /opt/fog/secureboot/efitools/
cd /opt/fog/secureboot/efitools

cat hw_db.esl > DB.esl
cat hw_KEK.esl > KEK.esl
cat hw_dbx.esl > dbx.esl

rm LockDown*efi LockDown.so LockDown.o
make

cp LockDown-signed.efi EnrollKeys.efi

mkdir -p /tftpboot

cp /opt/fog/secureboot/efitools/EnrollKeys.efi /tftpboot

mv /var/www/html/fog/service/ipxe/bzImage /var/www/html/fog/service/ipxe/bzImage-unsigned
sbsign --key /opt/fog/secureboot/efikeys/DB.key --cert /opt/fog/secureboot/efikeys/DB.crt --output /var/www/html/fog/service/ipxe/bzImage /var/www/html/fog/service/ipxe/bzImage-unsigned

mv /var/www/html/fog/service/ipxe/bzImage32 /var/www/html/fog/service/ipxe/bzImage32-unsigned
sbsign --key /opt/fog/secureboot/efikeys/DB.key --cert /opt/fog/secureboot/efikeys/DB.crt --output /var/www/html/fog/service/ipxe/bzImage32 /var/www/html/fog/service/ipxe/bzImage32-unsigned

mv /var/www/html/fog/service/ipxe/refind.efi /var/www/html/fog/service/ipxe/refind-unsigned.efi
sbsign --key /opt/fog/secureboot/efikeys/DB.key --cert /opt/fog/secureboot/efikeys/DB.crt --output /var/www/html/fog/service/ipxe/refind.efi /var/www/html/fog/service/ipxe/refind-unsigned.efi


mv /tftpboot/ipxe.efi /tftpboot/ipxe-unsigned.efi
sbsign --key /opt/fog/secureboot/efikeys/DB.key --cert /opt/fog/secureboot/efikeys/DB.crt --output /tftpboot/ipxe.efi /tftpboot/ipxe-unsigned.efi

mv /tftpboot/snponly.efi /tftpboot/snponly-unsigned.efi
sbsign --key /opt/fog/secureboot/efikeys/DB.key --cert /opt/fog/secureboot/efikeys/DB.crt --output /tftpboot/snponly.efi /tftpboot/snponly-unsigned.efi

mv /tftpboot/snp.efi /tftpboot/snp-unsigned.efi
sbsign --key /opt/fog/secureboot/efikeys/DB.key --cert /opt/fog/secureboot/efikeys/DB.crt --output /tftpboot/snp.efi /tftpboot/snp-unsigned.efi

@robertkwild good news, its worked!

before i did “quick inventroy” it listed the vm in “hosts” and then i clicked on “capture” to the image i just created, i used the “windows 10” as the os drop down

i syspreped windows 11, it failed first time, due to some program stopping it, all i had to do was remove it in powershell

Get-AppxPackage Microsoft.BingNews* | Remove-AppxPackage

then try again

sysprep /oobe /generalize /shutdown

it captured it fine, then i deleted that vm, created a new vm, disabled “secure boot”, network booted to my fog clicked on “deploy image” chose the windows 11 image

and the end result i get a nice windows 11 vm desktop

@AlexPDX @Sebastian-Roth it was something simple in the end

BIOS > advanced > system options

i turned off/unticked - configure storage controller for VMD

basically its there version of RAID, untick it and its AHCI

hi all,

got a good way installing windows 11 on esxi, bypassing tpm check, as thats where i got the error saying “your pc doesnt meet all the requirements”

ive also on the vm disabled/unticked “secure boot” so i can still network boot my fog server

heres the how to

https://www.virten.net/2021/10/windows-11-on-vmware-esxi-this-pc-cant-run-windows-11/

basically, when you come to the “enter your key screen” press shift+f10

REG ADD HKLM\SYSTEM\Setup\LabConfig /v BypassTPMCheck /t REG_DWORD /d 1

my end goal is to sysprep it and capture it to fog and then see if i can deploy it to new vm!

thanks,
rob

@george1421 result!!!

i bought a HP NIC as i have a HP laptop and it works

this one if anyone is inteerested

https://www.amazon.co.uk/HP-N7P47AA-Network-DesignJet-Adapters-Black/dp/B01618WGMY?th=1

as literally star tech, ugreen, tp link, realtek or asix chipsets didnt work

@george1421 the good thing is, you only need to do the reg hack and app removal on the GI, once you sysprep the GI and capture it, when you deploy it, you have to do nothing and you can deploy to multiple laptops, vms etc

the pic i shows you shows a laptop with TPM enabled, using the deployed image

@Tom-Elliott sorry took my time in replying back tom my bad

in the end i updated my stable to the latest 1.5.10.1650 and now when i capture the image it saves it as a folder not a file

tbh i am running fog on centos 7 so maybe its time to re install the OS to rocky 9.5 or ubuntu 24

what OS do you recommend?

hi all,

so trying to update my fog from stable 1.5.10.1650 to working 1.6 branch but get a schema error

any help is much appreciated

thanks,
rob

@Tom-Elliott looks like i have to update my fog to 1.6 instead of 1.5 as i thought i resolved it by updating fog to the latest 1.5 but the error is still there on 1.5, i thought it went at first as when i made my first image it saved as a folder but on my second capture its saving as a file again

@tcthorne i thought i resolved it by updating fog to 1.5.10.1650 ie the latest at the time but guess what the error has come back and i have no idea why its come back, the last resort is to update to working branch ie 1.6

hi all,

got a weird one as i get this error below in bios when i try to network boot

usb network boot: ipv4 network (disabled)

its funny as we bulk buy laptops (hp elitebook 840 G8) and trying to image another one i dont get this error, only this laptop

the only difference is i dont get the option “network boot tftp windopw size” menu on the other laptop so maybe its a bios firmware version?

thanks,
rob

@Tom-Elliott sorry took my time in replying back tom my bad

in the end i updated my stable to the latest 1.5.10.1650 and now when i capture the image it saves it as a folder not a file

@tcthorne I had the exact same issue with the stable branch, i was on 1.5.10.1634 or 39 i forgot and i upgraded to 1.5.10.1650 and now instead of a file in the images dir i get a folder!!!

@Tom-Elliott Hi Tom, Im on stable

Latest Version:
1.5.10.1634

Latest Development Version:
1.5.10.1639

i get above on the login screen and below on the fog configuration page

You’re running the latest stable version: 1.5.10.1634

so your saying go to alpha/beta?

@Tom-Elliott thanks Tom,I will try this, so how many versions are there of fog and where do I see the list of different versions please

@Tom-Elliott

when you say move to a working-1.6 branch what do you mean?