mirror of
https://github.com/Grace-Solutions/Invoke-HTTPBootBiosConfiguration.git
synced 2026-09-21 10:03:26 +00:00
gsadmin
c3e75ceb5a
- Rename OSD-ScriptTemplate to Invoke-HTTPBootBiosConfiguration (script and bootstrapper) - Configure Dell HTTPS boot via CCTK: enable HttpsBoot, set ManualMode, delete existing HttpBootProfile (avoids stale URL not applying), apply generated profile, and verify the applied URL via --Get - Build the HttpBootProfile XML with XmlDocument/XmlWriter; embed the dynamically downloaded Let's Encrypt ISRG Root X1 root certificate; IntegrityInfo emitted with an intentionally empty digest (no hashing - values only) - Default boot image file name snponly_x64.efi is appended when the boot URL does not end with a file name (trailing slash tolerant) - Add Invoke-ToolStaging toolkit function: downloads and extracts tools into Toolkit\Tools (All/X86/X64/ARM64) regardless of manufacturer, so staged bits travel with the script folder and repeat executions use cached bits; supports RawFile, Archive (.zip/.7z), MSI (administrative extraction), and DellUpdatePackage (7z payload carved by binary signature, extracted with portable 7zr.exe) - Add ARM64 support to the toolkit OS architecture calculation - Automatic proxy resolution for downloads: user WinINET proxy, then machine WinHTTP proxy (binary WinHttpSettings parsing incl. per-protocol lists and bypass list), then direct - Windows PE support; WinPE-MSI only needed for the direct DUP path (stage once from a full OS instead) - --ValSetupPwd appended only on modification commands when a setup password is supplied; verified CCTK ignores it when no BIOS password is installed, so one command line works fleet-wide - Git ignore staged tool binaries (cannot be redistributed); add README, Docs (CCTK acquisition, HttpBootProfile reference, WinPE guide), and PowerShell authoring rules under .claude/rules Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
79 lines
4.7 KiB
Markdown
79 lines
4.7 KiB
Markdown
# HTTP Boot Profile Reference (Dell)
|
|
|
|
This document describes the HTTP boot profile document the script generates, the CCTK commands used to apply it, and the troubleshooting knowledge gathered while building this automation.
|
|
|
|
## Generated profile document
|
|
|
|
The script writes `<StagingDirectory>\HttpBootProfile.xml` (UTF-8, no BOM):
|
|
|
|
```xml
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<HttpBootProfile>
|
|
<UrlInfo Type="https">
|
|
<Url>https://prod.ipxe.example.com/2PXE/boot/x64/snponly_x64.efi</Url>
|
|
<CertInfo Type="pem">
|
|
<cert>-----BEGIN CERTIFICATE-----
|
|
... PEM content of the CA root certificate (ISRG Root X1 by default) ...
|
|
-----END CERTIFICATE-----
|
|
</cert>
|
|
</CertInfo>
|
|
</UrlInfo>
|
|
<IntegrityInfo>
|
|
<Algorithm>sha256</Algorithm>
|
|
<Digest />
|
|
<SignValue />
|
|
</IntegrityInfo>
|
|
</HttpBootProfile>
|
|
```
|
|
|
|
The document is built with an `XmlDocument` and written through an `XmlWriter` (two-space indentation, UTF-8 without BOM).
|
|
|
|
Element notes (informed by the `BiosConnectProfile.xsd` schema that ships inside Dell Command | Configure):
|
|
|
|
| Element | Notes |
|
|
| --- | --- |
|
|
| `UrlInfo@Type` | `https` or `http`, derived from the boot URL scheme |
|
|
| `Url` | The full boot image URL |
|
|
| `CertInfo` | Optional per the schema. Only emitted for `https` URLs. `Type="pem"` is the only supported certificate encoding |
|
|
| `cert` | The PEM encoded CA **root** certificate of the chain that signs the boot server's TLS certificate. For Let's Encrypt this is **ISRG Root X1** - not the leaf and not the R10/R11 intermediates |
|
|
| `IntegrityInfo` | **Required** by the schema (it cannot be omitted). `Algorithm` supports `sha1` and `sha256` |
|
|
| `Digest` | Intentionally left empty (the schema allows an empty value). This script places configuration values only - it does not download or hash the boot image, so the boot image on the web server can change freely without invalidating the profile |
|
|
| `SignValue` | Left empty (unsigned profile) |
|
|
|
|
## CCTK command sequence
|
|
|
|
```
|
|
cctk --Version
|
|
cctk --HttpsBoot=Enabled [--ValSetupPwd=<password>]
|
|
cctk --HttpsBootMode=ManualMode [--ValSetupPwd=<password>]
|
|
cctk HttpBootProfile --Delete [--ValSetupPwd=<password>] (skippable)
|
|
cctk HttpBootProfile --Set=<path>\HttpBootProfile.xml [--ValSetupPwd=<password>]
|
|
cctk HttpBootProfile --Get
|
|
```
|
|
|
|
### Why delete before set
|
|
|
|
Updating only the URL inside an existing profile via `HttpBootProfile --Set` has been observed to **not always apply** - the BIOS keeps the old URL even though CCTK returns success. Deleting the profile first and applying the new one fresh avoids this. The script does this by default; `-SkipProfileDeletion` disables it if you want to test the in-place update behavior on a given BIOS release.
|
|
|
|
### Verification
|
|
|
|
After applying, the script runs `HttpBootProfile --Get` and asserts that the output contains the exact boot URL that was requested. If it does not, the script fails (unless `-ContinueOnError`), so a silently ignored profile surfaces as a task sequence error instead of a device that will not boot later.
|
|
|
|
## Relevant exit codes
|
|
|
|
CCTK exit codes are documented by Dell at <https://www.dell.com/support/kbdoc/en-us/000147084/dell-command-configure-error-codes>. The ones that matter here:
|
|
|
|
| Exit code | Meaning | Script handling |
|
|
| --- | --- | --- |
|
|
| 0 | Success | Accepted everywhere |
|
|
| 150 | Profile Not Present | Accepted for `HttpBootProfile --Delete` and returned by `--Get` when nothing is configured (verified empirically on 5.2.2) |
|
|
| 240-246 | Password related errors (wrong/required setup password) | Fails the script - check `-SetupPassword`. Note the asymmetry: a device WITH a setup password fails without the correct `-SetupPassword`, but supplying `-SetupPassword` on a device WITHOUT one is harmless - CCTK ignores `--ValSetupPwd` when no setup password is installed (verified on 5.2.2), so one fleet-wide command line works both ways |
|
|
| 119 | Setting not supported on this platform | Fails the script - the model may not support HTTPS boot |
|
|
|
|
## Troubleshooting
|
|
|
|
- **Profile applies but device does not boot**: confirm the boot URL actually serves the boot image (e.g. `snponly_x64.efi`), and confirm the certificate in the profile is the root of the server's actual chain (`openssl s_client -connect server:443 -showcerts`).
|
|
- **URL change did not take effect**: this is the delete-before-set issue above - re-run without `-SkipProfileDeletion`, or as a last resort clear it in the BIOS setup UI.
|
|
- **`--Set` returns a schema/parse error**: inspect the generated `HttpBootProfile.xml` in the staging directory; the full document is also written into the script log.
|
|
- **Certificate expiry**: the script logs the downloaded root certificate's subject, thumbprint, and expiration, and warns when it is expired. ISRG Root X1 is valid until 2035-06-04.
|