feat: Enable secure boot on multi-socket systems (#535)

Dockerfile

@@ -1,5 +1,5 @@
 FROM scratch
-COPY --from=qemux/qemu-docker:5.05 / /
+COPY --from=qemux/qemu-docker:5.07 / /
 
 ARG VERSION_ARG="0.0"
 ARG DEBCONF_NOWARNINGS="yes"

readme.md

@@ -49,7 +49,7 @@ services:
 Via Docker CLI:
 
 ```bash
-docker run -it --name windows -p 8006:8006 --device=/dev/kvm --cap-add NET_ADMIN --stop-timeout 120 dockurr/windows
+docker run -it --rm -p 8006:8006 --device=/dev/kvm --cap-add NET_ADMIN --stop-timeout 120 dockurr/windows
 ```
 
 Via Kubernetes:

src/define.sh

@@ -17,8 +17,6 @@ PLATFORM="x64"
 
 parseVersion() {
 
-  VERSION="${VERSION/\//}"
-
   if [[ "${VERSION}" == \"*\" || "${VERSION}" == \'*\' ]]; then
     VERSION="${VERSION:1:-1}"
   fi
@@ -295,9 +293,9 @@ getLanguage() {
 
 parseLanguage() {
 
-  REGION="${REGION/_/-/}"
-  KEYBOARD="${KEYBOARD/_/-/}"
-  LANGUAGE="${LANGUAGE/_/-/}"
+  REGION="${REGION//_/-/}"
+  KEYBOARD="${KEYBOARD//_/-/}"
+  LANGUAGE="${LANGUAGE//_/-/}"
 
   [ -z "$LANGUAGE" ] && LANGUAGE="en"
 
@@ -443,7 +441,7 @@ fromFile() {
   local file="${1,,}"
   local arch="${PLATFORM,,}"
 
-  case "${file/ /_}" in
+  case "${file// /_}" in
     *"_x64_"* | *"_x64."*)
       arch="x64"
       ;;
@@ -455,7 +453,7 @@ fromFile() {
       ;;
   esac
 
-  case "${file/ /_}" in
+  case "${file// /_}" in
     "win7"* | "win_7"* | *"windows7"* | *"windows_7"* )
       id="win7${arch}"
       ;;
@@ -2062,7 +2060,7 @@ prepareXP() {
           echo ""
           echo "[TerminalServices]"
           echo "    AllowConnections=1"
-          echo "" 
+          echo ""
   } | unix2dos > "$target/WINNT.SIF"
 
   {       echo "Windows Registry Editor Version 5.00"

src/entry.sh

@@ -24,7 +24,6 @@ cd /run
 trap - ERR
 
 info "Booting ${APP}${BOOT_DESC}..."
-[[ "$DEBUG" == [Yy1]* ]] && echo "Arguments: $ARGS" && echo
 
 { qemu-system-x86_64 ${ARGS:+ $ARGS} >"$QEMU_OUT" 2>"$QEMU_LOG"; rc=$?; } || :
 (( rc != 0 )) && error "$(<"$QEMU_LOG")" && exit 15

src/install.sh

@@ -7,17 +7,6 @@ FB="falling back to manual installation!"
 ETFS="boot/etfsboot.com"
 EFISYS="efi/microsoft/boot/efisys_noprompt.bin"
 
-hasDisk() {
-
-  [ -b "/disk1" ] && return 0
-  [ -b "/dev/disk1" ] && return 0
-  [ -b "${DEVICE:-}" ] && return 0
-  [ -s "$STORAGE/data.img" ]  && return 0
-  [ -s "$STORAGE/data.qcow2" ] && return 0
-
-  return 1
-}
-
 skipInstall() {
 
   local iso="$1"
@@ -65,7 +54,7 @@ startInstall() {
 
   if [ -z "$CUSTOM" ]; then
 
-    local file="${VERSION/\//}.iso"
+    local file="${VERSION//\//}.iso"
 
     if [[ "${VERSION,,}" == "http"* ]]; then
 
@@ -80,7 +69,7 @@ startInstall() {
       language="${language%%-*}"
 
       if [ -n "$language" ] && [[ "${language,,}" != "en" ]]; then
-        file="${VERSION/\//}_${language,,}.iso"
+        file="${VERSION//\//}_${language,,}.iso"
       fi
 
     fi
@@ -157,6 +146,11 @@ finishInstall() {
           echo "$BOOT_MODE" > "$STORAGE/windows.mode"
         fi
       fi
+      # Enable secure boot on multi-socket systems to workaround freeze
+      if [ -n "$SOCKETS" ] && [[ "$SOCKETS" != "1" ]]; then
+        BOOT_MODE="windows_secure"
+        echo "$BOOT_MODE" > "$STORAGE/windows.mode"    
+      fi
     fi
   fi
 
@@ -187,28 +181,22 @@ abortInstall() {
 
 detectCustom() {
 
-  local file=""
-  local size base
-
+  local file base
   CUSTOM=""
 
-  if [[ "${VERSION,,}" != "http"* ]]; then
-    base="${VERSION/\/storage\//}"
-    [[ "$base" == "."* ]] && base="${file:1}"
-    [[ "$base" == *"/"* ]] && base=""
-    [ -n "$base" ] && file=$(find "$STORAGE" -maxdepth 1 -type f -iname "$base" | head -n 1)
+  file=$(find / -maxdepth 1 -type f -iname custom.iso | head -n 1)
+  [ ! -s "$file" ] && file=$(find "$STORAGE" -maxdepth 1 -type f -iname custom.iso | head -n 1)
+
+  if [ ! -s "$file" ] && [[ "${VERSION,,}" != "http"* ]]; then
+    base=$(basename "$VERSION")
+    file="$STORAGE/$base"
   fi
 
-  [ -z "$file" ] && file=$(find "$STORAGE" -maxdepth 1 -type f -iname custom.iso | head -n 1)
-  [ -z "$file" ] && file=$(find "$STORAGE" -maxdepth 1 -type f -iname custom.img | head -n 1)
-
-  base="/custom.iso"
-  [ -f "$base" ] && [ -s "$base" ] && file="$base"
-
   if [ ! -f "$file" ] || [ ! -s "$file" ]; then
     return 0
   fi
 
+  local size
   size="$(stat -c%s "$file")"
   [ -z "$size" ] || [[ "$size" == "0" ]] && return 0
 
@@ -624,7 +612,7 @@ updateXML() {
 
   local asset="$1"
   local language="$2"
-  local culture region admin pass keyboard
+  local culture region user admin pass keyboard
 
   culture=$(getLanguage "$language" "culture")
 
@@ -648,16 +636,18 @@ updateXML() {
     sed -i "s/<InputLocale>0409:00000409<\/InputLocale>/<InputLocale>$keyboard<\/InputLocale>/g" "$asset"
   fi
 
-  if [ -n "$USERNAME" ]; then
-    sed -i "s/<Name>Docker<\/Name>/<Name>$USERNAME<\/Name>/g" "$asset"
-    sed -i "s/where name=\"Docker\"/where name=\"$USERNAME\"/g" "$asset"    
-    sed -i "s/<FullName>Docker<\/FullName>/<FullName>$USERNAME<\/FullName>/g" "$asset"
-    sed -i "s/<Username>Docker<\/Username>/<Username>$USERNAME<\/Username>/g" "$asset"
+  user=$(echo "$USERNAME" | sed 's/[^[:alnum:]@!._-]//g')
+
+  if [ -n "$user" ]; then
+    sed -i "s/<Name>Docker<\/Name>/<Name>$user<\/Name>/g" "$asset"
+    sed -i "s/where name=\"Docker\"/where name=\"$user\"/g" "$asset"
+    sed -i "s/<FullName>Docker<\/FullName>/<FullName>$user<\/FullName>/g" "$asset"
+    sed -i "s/<Username>Docker<\/Username>/<Username>$user<\/Username>/g" "$asset"
   fi
 
   if [ -n "$PASSWORD" ]; then
-    pass=$(printf '%s' "${PASSWORD}Password" | iconv -f utf-8 -t utf-16le | base64)
-    admin=$(printf '%s' "${PASSWORD}AdministratorPassword" | iconv -f utf-8 -t utf-16le | base64)
+    pass=$(printf '%s' "${PASSWORD}Password" | iconv -f utf-8 -t utf-16le | base64 -w 0)
+    admin=$(printf '%s' "${PASSWORD}AdministratorPassword" | iconv -f utf-8 -t utf-16le | base64 -w 0)
     sed -i "s/<Value>password<\/Value>/<Value>$admin<\/Value>/g" "$asset"
     sed -i "s/<PlainText>true<\/PlainText>/<PlainText>false<\/PlainText>/g" "$asset"
     sed -z "s/<Password>...........<Value \/>/<Password>\n          <Value>$pass<\/Value>/g" -i "$asset"
@@ -675,8 +665,8 @@ updateImage() {
   local asset="$2"
   local language="$3"
   local file="autounattend.xml"
-  local org="${file/.xml/.org}"
-  local dat="${file/.xml/.dat}"
+  local org="${file//.xml/.org}"
+  local dat="${file//.xml/.dat}"
   local desc path src loc xml index result
 
   [[ "${DETECTED,,}" == "winxp"* ]] && return 0
@@ -894,11 +884,6 @@ bootWindows() {
 
   rm -rf "$TMP"
 
-  if [ ! -f "$BOOT" ] || [ ! -s "$BOOT" ]; then
-    BOOT="/custom.iso"
-    [ ! -f "$BOOT" ] && BOOT="${STORAGE}$BOOT"
-  fi
-
   [[ "${PLATFORM,,}" == "arm64" ]] && VGA="virtio-gpu"
 
   if [ -s "$STORAGE/windows.mode" ] && [ -f "$STORAGE/windows.mode" ]; then