https://netboot.xyz/assets/js/289e67d5.6d675aee.js

1"use strict";(self.webpackChunknetboot_xyz=self.webpackChunknetboot_xyz||[]).push([[3119],{28453:(e,i,t)=>{t.d(i,{R:()=>r,x:()=>d});var s=t(96540);const n={},o=s.createContext(n);function r(e){const i=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(i):{...i,...e}}),[i,e])}function d(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:r(e.components),s.createElement(o.Provider,{value:i},e.children)}},48098:(e,i,t)=>{t.r(i),t.d(i,{assets:()=>a,contentTitle:()=>d,default:()=>l,frontMatter:()=>r,metadata:()=>s,toc:()=>h});const s=JSON.parse('{"id":"kb/hardware/secureboot","title":"UEFI Secure Boot","description":"Overview of UEFI Secure Boot support in netboot.xyz and how to use the pre-built Secure Boot images","source":"@site/docs/kb/hardware/secureboot.md","sourceDirName":"kb/hardware","slug":"/kb/hardware/secureboot","permalink":"/docs/kb/hardware/secureboot","draft":false,"unlisted":false,"editUrl":"https://github.com/netbootxyz/netboot.xyz-docs/edit/master/docs/kb/hardware/secureboot.md","tags":[],"version":"current","frontMatter":{"id":"secureboot","title":"UEFI Secure Boot","sidebar_label":"Secure Boot","description":"Overview of UEFI Secure Boot support in netboot.xyz and how to use the pre-built Secure Boot images","hide_table_of_contents":false},"sidebar":"myAutogeneratedSidebar","previous":{"title":"JetKVM","permalink":"/docs/kb/hardware/jetkvm"},"next":{"title":"Steam Deck","permalink":"/docs/kb/hardware/steamdeck"}}');var n=t(74848),o=t(28453);const r={id:"secureboot",title:"UEFI Secure Boot",sidebar_label:"Secure Boot",description:"Overview of UEFI Secure Boot support in netboot.xyz and how to use the pre-built Secure Boot images",hide_table_of_contents:!1},d=void 0,a={},h=[{value:"Overview",id:"overview",level:2},{value:"How It Works",id:"how-it-works",level:2},{value:"Available Secure Boot Images",id:"available-secure-boot-images",level:2},{value:"Bootable ISO and USB Images",id:"bootable-iso-and-usb-images",level:3},{value:"Network Boot (TFTP/HTTP)",id:"network-boot-tftphttp",level:3},{value:"autoexec.ipxe",id:"autoexecipxe",level:4},{value:"Booting Linux Distributions with Secure Boot",id:"booting-linux-distributions-with-secure-boot",level:2},{value:"Supported Distributions",id:"supported-distributions",level:2},{value:"Known Limitations",id:"known-limitations",level:2},{value:"Further Reading",id:"further-reading",level:2}];function c(e){const i={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",h4:"h4",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,o.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(i.h2,{id:"overview",children:"Overview"}),"\n",(0,n.jsx)(i.p,{children:"UEFI Secure Boot is a firmware security feature that restricts the boot process to code signed by trusted keys. Most modern UEFI systems ship with Secure Boot enabled by default. netboot.xyz provides pre-built Secure Boot compatible images so you can network-boot without disabling Secure Boot in your firmware settings."}),"\n",(0,n.jsx)(i.admonition,{type:"note",children:(0,n.jsxs)(i.p,{children:["Secure Boot support in netboot.xyz is still limited. Not all distributions and boot methods work when Secure Boot is active. Only Debian-family distributions (Debian, Devuan, Kali) that publish a ",(0,n.jsx)(i.code,{children:"debian-installer"})," netboot tree with a signed shim currently support end-to-end Secure Boot network booting."]})}),"\n",(0,n.jsx)(i.h2,{id:"how-it-works",children:"How It Works"}),"\n",(0,n.jsx)(i.p,{children:"Standard iPXE binaries are not signed with a key trusted by the Microsoft UEFI Secure Boot Certificate Authority and will therefore be rejected by firmware with Secure Boot enabled. The iPXE project addresses this through a chain of trust:"}),"\n",(0,n.jsxs)(i.ol,{children:["\n",(0,n.jsxs)(i.li,{children:[(0,n.jsx)(i.strong,{children:"Shim"})," \u2014 A small, Microsoft-signed bootloader (",(0,n.jsx)(i.a,{href:"https://github.com/i

1pxe/shim",children:"ipxe/shim"}),") that acts as the first stage. The shim is signed with the Microsoft third-party UEFI CA and is trusted by default on most systems. This fork of the general-purpose ",(0,n.jsx)(i.a,{href:"https://github.com/rhboot/shim",children:"rhboot/shim"})," is customized to trust the ",(0,n.jsx)(i.a,{href:"https://ipxe.org/secure-boot-ca",children:"iPXE Secure Boot CA"}),"."]}),"\n",(0,n.jsxs)(i.li,{children:[(0,n.jsx)(i.strong,{children:"Signed iPXE"})," \u2014 The shim verifies and launches the iPXE binary (",(0,n.jsx)(i.code,{children:"ipxe.efi"}),"), which is signed with the iPXE Secure Boot CA certificate embedded in the shim."]}),"\n",(0,n.jsxs)(i.li,{children:[(0,n.jsx)(i.strong,{children:"autoexec.ipxe"})," \u2014 Once iPXE is running, it loads the ",(0,n.jsx)(i.code,{children:"autoexec.ipxe"})," boot script that chainloads the netboot.xyz menus."]}),"\n"]}),"\n",(0,n.jsxs)(i.p,{children:["The shim uses a naming convention to locate the iPXE binary: it strips ",(0,n.jsx)(i.code,{children:"shim"})," from its own filename to derive the iPXE filename. For example:"]}),"\n",(0,n.jsxs)(i.table,{children:[(0,n.jsx)(i.thead,{children:(0,n.jsxs)(i.tr,{children:[(0,n.jsx)(i.th,{children:"Shim filename"}),(0,n.jsx)(i.th,{children:"iPXE filename"})]})}),(0,n.jsxs)(i.tbody,{children:[(0,n.jsxs)(i.tr,{children:[(0,n.jsx)(i.td,{children:(0,n.jsx)(i.code,{children:"ipxe-shimx64.efi"})}),(0,n.jsx)(i.td,{children:(0,n.jsx)(i.code,{children:"ipxe.efi"})})]}),(0,n.jsxs)(i.tr,{children:[(0,n.jsx)(i.td,{children:(0,n.jsx)(i.code,{children:"snponly-shimx64.efi"})}),(0,n.jsx)(i.td,{children:(0,n.jsx)(i.code,{children:"snponly.efi"})})]}),(0,n.jsxs)(i.tr,{children:[(0,n.jsx)(i.td,{children:(0,n.jsx)(i.code,{children:"ipxe-shimaa64.efi"})}),(0,n.jsx)(i.td,{children:(0,n.jsx)(i.code,{children:"ipxe.efi"})})]})]})]}),"\n",(0,n.jsx)(i.h2,{id:"available-secure-boot-images",children:"Available Secure Boot Images"}),"\n",(0,n.jsxs)(i.p,{children:["netboot.xyz builds and publishes Secure Boot images for x86_64 and ARM64. These are available as release assets at ",(0,n.jsx)(i.a,{href:"https://github.com/netbootxyz/netboot.xyz/releases",children:"https://github.com/netbootxyz/netboot.xyz/releases"}),"."]}),"\n",(0,n.jsx)(i.h3,{id:"bootable-iso-and-usb-images",children:"Bootable ISO and USB Images"}),"\n",(0,n.jsxs)(i.p,{children:["The easiest way to use Secure Boot with netboot.xyz is via the pre-built ISO or USB images. Each image has the signed shim, the signed iPXE binary, and an embedded ",(0,n.jsx)(i.code,{children:"autoexec.ipxe"})," baked in. The ",(0,n.jsx)(i.code,{children:"autoexec.ipxe"})," contains the initial netboot.xyz boot logic that chainloads the full netboot.xyz menu, so the images work out of the box with no additional configuration."]}),"\n",(0,n.jsxs)(i.p,{children:["These images are published as release assets at ",(0,n.jsx)(i.a,{href:"https://github.com/netbootxyz/netboot.xyz/releases",children:"https://github.com/netbootxyz/netboot.xyz/releases"}),":"]}),"\n",(0,n.jsxs)(i.table,{children:[(0,n.jsx)(i.thead,{children:(0,n.jsxs)(i.tr,{children:[(0,n.jsx)(i.th,{children:"File"}),(0,n.jsx)(i.th,{children:"Architecture"}),(0,n.jsx)(i.th,{children:"Use case"})]})}),(0,n.jsxs)(i.tbody,{children:[(0,n.jsxs)(i.tr,{children:[(0,n.jsx)(i.td,{children:(0,n.jsx)(i.code,{children:"netboot.xyz-sb.iso"})}),(0,n.jsx)(i.td,{children:"x86_64"}),(0,n.jsx)(i.td,{children:"CD/DVD/Virtual Media"})]}),(0,n.jsxs)(i.tr,{children:[(0,n.jsx)(i.td,{children:(0,n.jsx)(i.code,{children:"netboot.xyz-sb.img"})}),(0,n.jsx)(i.td,{children:"x86_64"}),(0,n.jsx)(i.td,{children:"USB flash drive"})]}),(0,n.jsxs)(i.tr,{children:[(0,n.jsx)(i.td,{children:(0,n.jsx)(i.code,{children:"netboot.xyz-sb-arm64.iso"})}),(0,n.jsx)(i.td,{children:"ARM64"}),(0,n.jsx)(i.td,{children:"CD/DVD/Virtual Media"})]}),(0,n.jsxs)(i.tr,{children:[(0,n.jsx)(i.td,{children:(0,n.jsx)(i.code,{children:"netboot.xyz-sb-arm64.img"})}),(0,n.jsx)(i.td,{children:"ARM64"}),(0,n.jsx)(i.td,{children:"USB flash drive"})]})]})]}

1),"\n",(0,n.jsxs)(i.p,{children:["Write the ",(0,n.jsx)(i.code,{children:".img"})," file to a USB drive using a tool like ",(0,n.jsx)(i.code,{children:"dd"})," or ",(0,n.jsx)(i.a,{href:"https://etcher.balena.io/",children:"Balena Etcher"}),"."]}),"\n",(0,n.jsxs)(i.p,{children:["The ",(0,n.jsx)(i.code,{children:"autoexec.ipxe"})," embedded in these images is also published as a standalone file in the release assets (",(0,n.jsx)(i.code,{children:"autoexec.ipxe"}),"), so it can be consumed directly \u2014 for example, when using the upstream iPXE Secure Boot binaries for network boot and you want to use the same boot script the ISO/USB images use."]}),"\n",(0,n.jsx)(i.h3,{id:"network-boot-tftphttp",children:"Network Boot (TFTP/HTTP)"}),"\n",(0,n.jsxs)(i.p,{children:["Because the signed iPXE binaries cannot be recompiled, you must use the pre-built binaries directly from ",(0,n.jsx)(i.a,{href:"https://github.com/ipxe/ipxe/releases",children:"https://github.com/ipxe/ipxe/releases"})," or from the netboot.xyz release tarballs:"]}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"secureboot-x86_64.tar.gz"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.code,{children:"secureboot-arm64.tar.gz"})}),"\n"]}),"\n",(0,n.jsx)(i.p,{children:"Each archive contains the directory structure expected by iPXE's shim loader:"}),"\n",(0,n.jsx)(i.pre,{children:(0,n.jsx)(i.code,{children:"secureboot-x86_64/\n\u251c\u2500\u2500 autoexec.ipxe\n\u251c\u2500\u2500 ipxe-shim.efi      \u2190 configure DHCP to serve this\n\u251c\u2500\u2500 ipxe.efi\n\u251c\u2500\u2500 shimx64.efi\n\u251c\u2500\u2500 snponly-shim.efi\n\u2514\u2500\u2500 snponly.efi\n"})}),"\n",(0,n.jsx)(i.p,{children:"Configure your DHCP server to hand out the path to the shim binary rather than the iPXE binary directly. For example, with ISC dhcpd:"}),"\n",(0,n.jsx)(i.pre,{children:(0,n.jsx)(i.code,{children:'next-server 192.168.0.1;\nfilename "/netboot.xyz/ipxe-shim.efi";\n'})}),"\n",(0,n.jsx)(i.p,{children:"All files from the archive must be present in the same directory on the TFTP/HTTP server, as the shim uses relative paths to locate the corresponding iPXE binary."}),"\n",(0,n.jsx)(i.h4,{id:"autoexecipxe",children:"autoexec.ipxe"}),"\n",(0,n.jsxs)(i.p,{children:["After iPXE loads, it automatically looks for a file named ",(0,n.jsx)(i.code,{children:"autoexec.ipxe"})," in the same directory it was loaded from. If found, it executes it. This is the mechanism netboot.xyz uses to load its menus when booting via the Secure Boot image \u2014 an ",(0,n.jsx)(i.code,{children:"autoexec.ipxe"})," is embedded in the netboot.xyz release tarballs that chainloads the netboot.xyz menu."]}),"\n",(0,n.jsxs)(i.p,{children:["If you are using the upstream iPXE binaries directly from ",(0,n.jsx)(i.a,{href:"https://github.com/ipxe/ipxe/releases",children:"https://github.com/ipxe/ipxe/releases"}),", you can place your own ",(0,n.jsx)(i.code,{children:"autoexec.ipxe"})," alongside the shim and iPXE binaries to control what happens after boot. For example, to load the netboot.xyz menu:"]}),"\n",(0,n.jsx)(i.pre,{children:(0,n.jsx)(i.code,{className:"language-ipxe",children:"#!ipxe\nchain --autofree https://boot.netboot.xyz\n"})}),"\n",(0,n.jsx)(i.h2,{id:"booting-linux-distributions-with-secure-boot",children:"Booting Linux Distributions with Secure Boot"}),"\n",(0,n.jsxs)(i.p,{children:["When Secure Boot is active, loading a Linux kernel directly from iPXE will fail signature verification. Distributions that ship a signed UEFI shim (e.g. Debian) can be booted by using the iPXE ",(0,n.jsx)(i.code,{children:"shim"})," command, which invokes the distribution's own shim to satisfy Secure Boot policy."]}),"\n",(0,n.jsx)(i.p,{children:"Example iPXE script for Debian:"}),"\n",(0,n.jsx)(i.pre,{children:(0,n.jsx)(i.code,{className:"language-ipxe",children:"#!ipxe\n\nset mirror https://mirrors.edge.kernel.org/debian\nset installer ${mirror}/dists/bookworm/main/installer-amd64/current/images/netboot/debian-installer/amd64\n\nkernel ${installer}/linux\ninitrd ${installer}/initrd.gz\nshim ${installer}/bootnetx64.efi\nboot\n"})}

1),"\n",(0,n.jsxs)(i.p,{children:["The ",(0,n.jsx)(i.code,{children:"shim"})," command is a no-op when Secure Boot is not active, so it is safe to leave in scripts regardless of the boot environment."]}),"\n",(0,n.jsx)(i.admonition,{type:"info",children:(0,n.jsxs)(i.p,{children:["The ",(0,n.jsx)(i.code,{children:"imgverify"})," command is not available in the upstream iPXE Secure Boot images, as it requires features that cannot be included in a Secure Boot-signed build. netboot.xyz detects when it is running via a Secure Boot image by checking ",(0,n.jsx)(i.code,{children:"${efi/SecureBoot}"})," and automatically disables signature checking (",(0,n.jsx)(i.code,{children:"sigs_enabled"}),") at runtime to prevent errors when chaining menus."]})}),"\n",(0,n.jsx)(i.h2,{id:"supported-distributions",children:"Supported Distributions"}),"\n",(0,n.jsxs)(i.p,{children:["End-to-end Secure Boot network booting support within netboot.xyz menus is limited to distributions that publish a ",(0,n.jsx)(i.code,{children:"bootnetx64.efi"})," / ",(0,n.jsx)(i.code,{children:"bootnetaa64.efi"})," shim binary as part of their netboot installer tree. Currently, only the three Debian-family distributions that ship a ",(0,n.jsx)(i.code,{children:"debian-installer"})," netboot tree meet this requirement:"]}),"\n",(0,n.jsxs)(i.table,{children:[(0,n.jsx)(i.thead,{children:(0,n.jsxs)(i.tr,{children:[(0,n.jsx)(i.th,{children:"Distribution"}),(0,n.jsx)(i.th,{children:"x86_64 shim"}),(0,n.jsx)(i.th,{children:"ARM64 shim"}),(0,n.jsx)(i.th,{children:"Notes"})]})}),(0,n.jsxs)(i.tbody,{children:[(0,n.jsxs)(i.tr,{children:[(0,n.jsx)(i.td,{children:"Debian"}),(0,n.jsx)(i.td,{children:(0,n.jsx)(i.code,{children:"bootnetx64.efi"})}),(0,n.jsx)(i.td,{children:(0,n.jsx)(i.code,{children:"bootnetaa64.efi"})}),(0,n.jsx)(i.td,{children:"Supported"})]}),(0,n.jsxs)(i.tr,{children:[(0,n.jsx)(i.td,{children:"Devuan"}),(0,n.jsx)(i.td,{children:(0,n.jsx)(i.code,{children:"bootnetx64.efi"})}),(0,n.jsx)(i.td,{children:(0,n.jsx)(i.code,{children:"bootnetaa64.efi"})}),(0,n.jsx)(i.td,{children:"Supported (Debian-identical path structure)"})]}),(0,n.jsxs)(i.tr,{children:[(0,n.jsx)(i.td,{children:"Kali Linux"}),(0,n.jsx)(i.td,{children:(0,n.jsx)(i.code,{children:"bootnetx64.efi"})}),(0,n.jsx)(i.td,{children:(0,n.jsx)(i.code,{children:"bootnetaa64.efi"})}),(0,n.jsx)(i.td,{children:"Supported (Debian-derived path structure)"})]})]})]}),"\n",(0,n.jsxs)(i.p,{children:["Distributions that do ",(0,n.jsx)(i.strong,{children:"not"})," currently support Secure Boot network boot from netboot.xyz:"]}),"\n",(0,n.jsxs)(i.table,{children:[(0,n.jsx)(i.thead,{children:(0,n.jsxs)(i.tr,{children:[(0,n.jsx)(i.th,{children:"Distribution"}),(0,n.jsx)(i.th,{children:"Reason"})]})}),(0,n.jsxs)(i.tbody,{children:[(0,n.jsxs)(i.tr,{children:[(0,n.jsx)(i.td,{children:"Fedora"}),(0,n.jsxs)(i.td,{children:[(0,n.jsx)(i.code,{children:"images/pxeboot/"})," only provides ",(0,n.jsx)(i.code,{children:"vmlinuz"})," + ",(0,n.jsx)(i.code,{children:"initrd.img"}),"; ",(0,n.jsx)(i.code,{children:"EFI/BOOT/BOOTX64.EFI"})," is the ISO bootloader, not a PXE-capable shim"]})]}),(0,n.jsxs)(i.tr,{children:[(0,n.jsx)(i.td,{children:"AlmaLinux / Rocky / CentOS / RHEL / openEuler"}),(0,n.jsx)(i.td,{children:"Same as Fedora \u2014 RHEL family pxeboot path has no shim EFI binary"})]}),(0,n.jsxs)(i.tr,{children:[(0,n.jsx)(i.td,{children:"openSUSE"}),(0,n.jsxs)(i.td,{children:[(0,n.jsx)(i.code,{children:"boot/x86_64/loader/"})," provides ",(0,n.jsx)(i.code,{children:"linux"})," + ",(0,n.jsx)(i.code,{children:"initrd"})," only; no shim binary in the netboot tree"]})]}),(0,n.jsxs)(i.tr,{children:[(0,n.jsx)(i.td,{children:"Ubuntu"}),(0,n.jsxs)(i.td,{children:["Legacy d-i path has no ",(0,n.jsx)(i.code,{children:"bootnetx64.efi"}),"; Subiquity path uses netboot.xyz's own live endpoint"]})]}),(0,n.jsxs)(i.tr,{children:[(0,n.jsx)(i.td,{children:"Mageia, Alpine, Arch, Slackware, others"}),(0,n.jsx)(i.td,{children:"No shim EFI netboot binaries available"})]})]})]}),"\n",(0,n.jsx)(i.p,{children:"Support for additional distributions depends on whether they provide a signed shim binary alongside their netboot kernel and initrd."}),"\n",(0,n.jsxs)(i.p,{children:["If you know of a distribution that publishes a signed shim EFI binary as part of its netboot installer tree, please ",(0,n.jsx)(i.a,{href:"https://github.com/netbootxyz/netboot.xyz/issues",children:"open an issue"})," with the mirror path and we will look at adding support."]}

1),"\n",(0,n.jsx)(i.h2,{id:"known-limitations",children:"Known Limitations"}),"\n",(0,n.jsx)(i.p,{children:"The Secure Boot images distributed by netboot.xyz are pre-built and signed by the iPXE project. Because any modification to the binary \u2014 including recompiling with different options \u2014 would invalidate the signature and break the chain of trust, these images are locked and cannot be customized. This has several practical consequences:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsxs)(i.li,{children:[(0,n.jsxs)(i.strong,{children:[(0,n.jsx)(i.code,{children:"imgverify"})," is unavailable"]})," \u2014 The upstream signed iPXE build omits the ",(0,n.jsx)(i.code,{children:"imgverify"})," command. This means netboot.xyz's built-in menu signature verification is disabled automatically when booting via a Secure Boot image (netboot.xyz detects this via ",(0,n.jsx)(i.code,{children:"${efi/SecureBoot}"})," and sets ",(0,n.jsx)(i.code,{children:"sigs_enabled"})," to false at runtime)."]}),"\n",(0,n.jsxs)(i.li,{children:[(0,n.jsx)(i.strong,{children:"Theming is unavailable"})," \u2014 netboot.xyz's custom theme and branding rely on iPXE features that are not present in the signed build. The Secure Boot image will display a plain iPXE interface rather than the styled netboot.xyz menus."]}),"\n",(0,n.jsxs)(i.li,{children:[(0,n.jsx)(i.strong,{children:"Other netboot.xyz features may not work"})," \u2014 Any feature that depends on a custom-compiled iPXE binary (additional protocol support, specific drivers, etc.) will not be available when booting via the Secure Boot image."]}),"\n",(0,n.jsxs)(i.li,{children:[(0,n.jsx)(i.strong,{children:"No custom iPXE builds"})," \u2014 You cannot compile your own iPXE binary with additional features and have it trusted by the Secure Boot shim. The shim is built to trust only binaries signed by the iPXE Secure Boot CA, and only the iPXE project can produce those signatures. Use the pre-built binaries as-is and control boot behaviour via ",(0,n.jsx)(i.code,{children:"autoexec.ipxe"})," instead."]}),"\n",(0,n.jsxs)(i.li,{children:[(0,n.jsxs)(i.strong,{children:["Spurious ",(0,n.jsx)(i.code,{children:"Security Policy Violation"})," on kernel load"]})," \u2014 There is a known upstream iPXE behavior where loading the kernel via the ",(0,n.jsx)(i.code,{children:"kernel"})," command will briefly display a ",(0,n.jsx)(i.code,{children:"Verification failed: Security Policy Violation"})," error on screen, even when the ",(0,n.jsx)(i.code,{children:"shim"})," command is used and the boot ultimately succeeds. This is cosmetic \u2014 iPXE attempts to verify the kernel directly first, which fails under Secure Boot, and then the ",(0,n.jsx)(i.code,{children:"shim"})," command hands off to the distribution's own shim which succeeds. The boot proceeds normally. This is ",(0,n.jsx)(i.a,{href:"https://github.com/ipxe/ipxe/issues/1653",children:"being tracked upstream"}),"."]}),"\n"]}),"\n",(0,n.jsx)(i.h2,{id:"further-reading",children:"Further Reading"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.a,{href:"https://ipxe.org/secboot",children:"iPXE Secure Boot documentation"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.a,{href:"https://github.com/ipxe/shim",children:"ipxe/shim on GitHub"})}),"\n",(0,n.jsx)(i.li,{children:(0,n.jsx)(i.a,{href:"https://github.com/ipxe/ipxe/releases",children:"iPXE releases"})}),"\n"]})]})}function l(e={}){const{wrapper:i}={...(0,o.R)(),...e.components};return i?(0,n.jsx)(i,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}}}]);