feat: Enable HTTPS in iPXE

.gitmodules

@@ -1,3 +0,0 @@
-[submodule "ipxe/ipxe"]
-	path = ipxe/ipxe
-	url = git@github.com:rkubes/ipxe

ipxe/Cargo.toml

@@ -4,7 +4,13 @@ version = "0.1.0"
 edition = "2024"
 
 [build-dependencies]
-build-print = "1.0.1"
+diffy = "0.5.2"
+gix = { version = "0.89.0", default-features = false, features = [
+  "blocking-network-client",
+  "worktree-mutation",
+  "sha1",
+  "blocking-http-transport-reqwest-rust-tls",
+] }
 
 [dependencies]
 include_dir = "0.7.4"

ipxe/build.rs

@@ -1,57 +1,180 @@
-use std::env;
+use std::collections::HashMap;
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
-use std::process::{Command, Stdio};
+use std::process::Command;
+use std::sync::atomic::AtomicBool;
 
-use build_print::error;
+use diffy::apply;
+use diffy::patch_set::{FileOperation, ParseOptions, PatchSet};
+use gix::Repository;
+use gix::progress::Discard;
+
+const URL: &str = "https://github.com/ipxe/ipxe";
+const REVISION: &str = "2fa08affe9a1a1422766f54b2fb045234b571f06";
+const FILES: &[&str] = &["bin/ipxe.pxe", "bin-x86_64-efi/ipxe.efi"];
+
+const SRC_DIR: &str = "src";
 
 fn main() {
-    let manifest_dir = PathBuf::from(env::var("CARGO_MANIFEST_DIR").unwrap())
+    let manifest_dir = PathBuf::from(std::env::var("CARGO_MANIFEST_DIR").unwrap())
         .canonicalize()
         .unwrap();
-    let src_dir = manifest_dir.join("ipxe").join("src");
+    let out_dir = PathBuf::from(std::env::var("OUT_DIR").unwrap())
+        .canonicalize()
+        .unwrap();
+    let repo_dir = out_dir.join("repo");
+
+    let repo = checkout(&out_dir, &repo_dir);
+
+    apply_patches(&repo, &manifest_dir, &repo_dir);
+    println!("cargo::rerun-if-changed=patches");
+
+    build(&manifest_dir, &repo_dir);
+    println!("cargo::rerun-if-changed=src/embed.ipxe");
+
+    copy_files(&repo_dir, &out_dir);
+}
+
+fn checkout(out_dir: &Path, repo_dir: &Path) -> Repository {
+    // Stamp file is used instead of comparing against HEAD to guard against incomplete clones
+    let stamp = out_dir.join("checkout.stamp");
+    if std::fs::read_to_string(&stamp).is_ok_and(|stamp| stamp == REVISION)
+        && let Ok(repo) = gix::open(repo_dir)
+    {
+        return repo;
+    }
+
+    // Cleanup any left-overs
+    std::fs::remove_file(&stamp).ok();
+    std::fs::remove_dir_all(repo_dir).ok();
+
+    std::fs::create_dir_all(repo_dir).unwrap();
+
+    let mut prepare = gix::prepare_clone(URL, repo_dir)
+        .unwrap()
+        .with_revision(Some(REVISION))
+        .unwrap();
+
+    let interrupt = AtomicBool::new(false);
+    let (mut checkout, _) = prepare.fetch_then_checkout(Discard, &interrupt).unwrap();
+    let (repo, _) = checkout.main_worktree(Discard, &interrupt).unwrap();
+
+    std::fs::write(&stamp, REVISION).unwrap();
+
+    repo
+}
+
+fn apply_patches(repo: &Repository, manifest_dir: &Path, repo_dir: &Path) {
+    let commit_id = gix::ObjectId::from_hex(REVISION.as_bytes()).unwrap();
+    let tree = repo.find_commit(commit_id).unwrap().tree().unwrap();
+
+    // Get all the patches and sort them based on name
+    let mut patch_files: Vec<PathBuf> = std::fs::read_dir(manifest_dir.join("patches"))
+        .unwrap()
+        .map(|e| e.unwrap().path())
+        .filter(|e| e.extension().is_some_and(|e| e == "patch"))
+        .collect();
+    patch_files.sort();
+
+    let mut patched = HashMap::new();
+    for path in patch_files {
+        let text = std::fs::read_to_string(&path).unwrap();
+        let patch_set = PatchSet::parse(&text, ParseOptions::gitdiff());
+
+        for patch in patch_set {
+            let patch = patch.unwrap();
+
+            match patch.operation().strip_prefix(1) {
+                FileOperation::Modify { original, modified } => {
+                    assert_eq!(original, modified);
+                    let path = original.to_string();
+
+                    // Either get the current in-memory patched file, otherwise get the prisine file
+                    let current = patched
+                        .remove(&path)
+                        .unwrap_or_else(|| pristine(&tree, &path));
+
+                    let new = apply(&current, patch.patch().as_text().unwrap()).unwrap();
+                    patched.insert(path, new);
+                }
+                _ => todo!(),
+            }
+        }
+    }
+
+    // If the file was previously patched, but now isn't restore the pristine file
+    for path in modified_files(repo) {
+        if !patched.contains_key(&path) {
+            std::fs::write(repo_dir.join(&path), pristine(&tree, &path)).unwrap();
+        }
+    }
+
+    // Write all the patched files
+    for (path, content) in &patched {
+        let path = repo_dir.join(path);
+        let content = content.as_bytes();
+
+        // But only if the file is actually different from the one on disk
+        // This prevents changing the mtime unnecessarily
+        if std::fs::read(&path).ok().as_deref() != Some(content) {
+            std::fs::write(path, content).unwrap();
+        }
+    }
+}
+
+fn pristine(tree: &gix::Tree<'_>, path: &str) -> String {
+    let entry = tree.lookup_entry_by_path(path).unwrap().unwrap();
+
+    String::from_utf8(entry.object().unwrap().data.clone()).unwrap()
+}
+
+fn modified_files(repo: &gix::Repository) -> Vec<String> {
+    repo.status(Discard)
+        .unwrap()
+        .untracked_files(gix::status::UntrackedFiles::None)
+        .into_index_worktree_iter(Vec::<gix::bstr::BString>::new())
+        .unwrap()
+        .map(|item| item.unwrap().rela_path().to_string())
+        .collect()
+}
+
+fn build(manifest_dir: &Path, repo_dir: &Path) {
+    let src_dir = repo_dir.join(SRC_DIR);
 
     let mut command = Command::new("make");
     command
-        .stdout(Stdio::piped())
         .current_dir(&src_dir)
         .env_remove("DEBUG")
         .env_remove("PROFILE")
-        .args([
-            "-j",
-            &std::thread::available_parallelism()
-                .unwrap()
-                .get()
-                .to_string(),
-        ])
         .arg(format!(
             "EMBED={}",
             manifest_dir
                 .join("src")
                 .join("embed.ipxe")
-                .to_string_lossy(),
+                .to_string_lossy()
-        ));
+        ))
+        .args(FILES);
 
-    let files = ["bin/ipxe.pxe", "bin-x86_64-efi/ipxe.efi"].map(PathBuf::from);
+    if let Ok(flags) = std::env::var("CARGO_MAKEFLAGS") {
-    for file in &files {
+        command.env("MAKEFLAGS", flags);
-        command.arg(file);
     }
 
     let output = command.output().unwrap();
+
     if !output.status.success() {
-        error!("{}", String::from_utf8_lossy(&output.stderr));
+        panic!("make failed:\n{}", String::from_utf8_lossy(&output.stderr));
+    }
 }
 
-    let out_dir = PathBuf::from(env::var("OUT_DIR").unwrap())
+fn copy_files(repo_dir: &Path, out_dir: &Path) {
-        .canonicalize()
+    let src_dir = repo_dir.join(SRC_DIR);
-        .unwrap()
+    let bin_dir = out_dir.join("bin");
-        .join("ipxe");
 
-    std::fs::remove_dir_all(&out_dir).ok();
+    std::fs::create_dir_all(&bin_dir).unwrap();
-    for file in &files {
+    for file in FILES {
+        let file = Path::new(file);
         let input = src_dir.join(file);
-        let output = out_dir.join(file.file_name().unwrap());
+        let output = bin_dir.join(file.file_name().unwrap());
 
-        std::fs::create_dir_all(output.parent().unwrap()).unwrap();
         std::fs::copy(input, output).unwrap();
     }
 }

ipxe/patches/0001_enable_protocols.patch

@@ -0,0 +1,19 @@
+diff --git a/src/config/general.h b/src/config/general.h
+index 43858dceb..54cb1b657 100644
+--- a/src/config/general.h
++++ b/src/config/general.h
+@@ -60,10 +60,10 @@ FILE_SECBOOT ( PERMITTED );
+ //#define HTTP_ENC_PEERDIST	/* PeerDist content encoding */
+
+ /* Disable protocols not historically included in BIOS builds */
+-#if defined ( PLATFORM_pcbios )
+-  #undef DOWNLOAD_PROTO_HTTPS
+-  #undef HTTP_AUTH_NTLM
+-#endif
++// #if defined ( PLATFORM_pcbios )
++//   #undef DOWNLOAD_PROTO_HTTPS
++//   #undef HTTP_AUTH_NTLM
++// #endif
+
+ /*****************************************************************************
+  *

ipxe/src/lib.rs

@@ -1,3 +1,3 @@
 use include_dir::{Dir, include_dir};
 
-pub static IPXE_DIR: Dir<'_> = include_dir!("$OUT_DIR/ipxe");
+pub static IPXE_DIR: Dir<'_> = include_dir!("$OUT_DIR/bin");

typos.toml

@@ -0,0 +1,2 @@
+[default.extend-words]
+rela = "rela"