mirror of
https://github.com/ipxe/ipxe
synced 2026-10-07 15:05:42 +03:00
Michael Brown
d00df0822b
With suitable guidance, AI agents such as Claude Code are capable of scanning effectively for potential vulnerabilities, and reporting them in a concise and actionable format. These tools are now widely available to malicious actors, and so any vulnerabilities that they are capable of finding must be fixed now before they are inevitably found and potentially exploited. The recent batch of commits over the past week closes all potential vulnerabilities that were detectable by either Opus 4.8 or Fable in multiple passes over the code. No serious security impact was found, and there is nothing that would merit a UEFI Secure Boot revocation. A concrete threat model is now documented, along with the explicit bounds contracts for several internal APIs (such as ASN.1 parsing and I/O buffer pointer manipulation). Some entire classes of nominal defect (e.g. technically undefined behaviour arising from constant left shifts into the sign bit) have been eliminated. False positives that were raised several times and that could not be silenced through reporting guidelines were fixed in the code, even when the code change had no real-world impact. It is now possible to ask an appropriately instructed AI agent to search for vulnerabilities in the iPXE codebase and to be reasonably confident that anything that it reports is worth investigating further. Add a security policy to formally document the expectations upon both humans and AI agents in terms of reporting potential vulnerabilities, and update the contribution guidelines to grant a limited exception to the blanket ban on AI-generated text. Signed-off-by: Michael Brown <mcb30@ipxe.org>
iPXE network bootloader
iPXE is the leading open source network boot firmware. It provides a full PXE implementation enhanced with additional features such as:
-
boot from a web server via HTTP or HTTPS,
-
boot from an iSCSI, FCoE, or AoE SAN,
-
control the boot process with a script,
You can use iPXE to replace the existing PXE ROM on your network card, or you can chainload into iPXE to obtain the features of iPXE without the hassle of reflashing.
iPXE is free, open-source software licensed under the GNU GPL (with some portions under GPL-compatible licences).
You can download the rolling release binaries (built from the latest commit), or use the most recent stable release.
For full documentation, visit the iPXE website.