wrouesnel / netboot / 36373570632

push

github

Fork as github.com/wrouesnel/netboot, move to mage, secure API mode

Rename the module to github.com/wrouesnel/netboot and note in the
README that this is a fork of danderson/netboot.

Build and CI:
- Replace the Makefiles, scripts/ and dockerfiles/ with a mage build
  (magefile.go, run with `go run mage.go`) and GitHub workflows for
  integration, releases, multi-arch container images and CodeQL,
  based on wrouesnel/golang-template.
- Add a version package stamped at build time.
- `mage binary` names its symlink with a -bin suffix when a non-symlink
  (such as the pixiecore/ source directory) already has the name, and
  `mage clean` only removes symlinks.
- Replace `make update-ipxe` with `mage updateIpxe`, and bump iPXE to
  v2.0.0 (the old pin no longer builds with current toolchains).
- Fix the vet, errcheck and staticcheck findings from golangci-lint.

API mode:
- Support HTTPS API servers with a custom CA (--api-ca-cert), HTTP
  basic auth (--api-username, --api-password-file or
  PIXIECORE_API_PASSWORD), and mTLS with a client certificate from files
  (--api-client-cert/--api-client-key) or with a TPM-resident key
  (--api-client-tpm). Basic auth is only sent to the API server's
  origin. The same flags work for ipv6api.
- Kernel/initrd fetches and boot file writes now use the configured
  client instead of http.DefaultClient, without the API request
  timeout.
- Add `pixiecore tpm-cert`, which creates the TPM key (a TSS2 keyfile)
  and a self-signed client certificate if needed, and prints the
  certificate so the API server can trust it. --csr prints a CSR for
  CA signing instead, and --renew issues a new certificate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

201 of 417 new or added lines in 28 files covered. (48.2%)

1215 of 3512 relevant lines covered (34.6%)

2.78 hits per line