[GH-ISSUE #785] Unable to load Custom Menus from GitHub

kerem commented

2026-03-01 18:36:05 +03:00

Owner

Originally created by @BasicWombat on GitHub (Dec 3, 2020).
Original GitHub issue: https://github.com/netbootxyz/netboot.xyz/issues/785

Describe the bug
When loading custom menu from GitHub, I get the error "Operation not permitted (http://ipxe.org/410de185f)"

Additional context
It appears to be an issue with TLS and accessing the HTTPS of GitHub.
Tested on different computers and same result.

Originally created by @BasicWombat on GitHub (Dec 3, 2020). Original GitHub issue: https://github.com/netbootxyz/netboot.xyz/issues/785 **Describe the bug** When loading custom menu from GitHub, I get the error "Operation not permitted (http://ipxe.org/410de185f)" **Additional context** It appears to be an issue with TLS and accessing the HTTPS of GitHub. Tested on different computers and same result.

kerem closed this issue

2026-03-01 18:36:05 +03:00

kerem commented

2026-03-01 18:36:06 +03:00

Author

Owner

@BasicWombat commented on GitHub (Dec 3, 2020):

Could be related to the same issue:
#782 https://github.com/netbootxyz/netboot.xyz/issues/782

@BasicWombat commented on GitHub (Dec 3, 2020): Could be related to the same issue: #782 https://github.com/netbootxyz/netboot.xyz/issues/782

kerem commented

2026-03-01 18:36:06 +03:00

Author

Owner

@BasicWombat commented on GitHub (Dec 3, 2020):

@antonym has been helping on this issue via the Discord chat

@BasicWombat commented on GitHub (Dec 3, 2020): @antonym has been helping on this issue via the Discord chat

kerem commented

2026-03-01 18:36:06 +03:00

Author

Owner

@LordChunk commented on GitHub (Dec 24, 2020):

@BasicWombat did you find a fix/workaround?

@LordChunk commented on GitHub (Dec 24, 2020): @BasicWombat did you find a fix/workaround?

kerem commented

2026-03-01 18:36:06 +03:00

Author

Owner

@BasicWombat commented on GitHub (Dec 29, 2020):

@BasicWombat did you find a fix/workaround?

Unfortunately no. While I did work on it further that day, I wasn't able to find anything.
I also haven't had a opportunity since.

For reference, this a link to the discord conversation with @antonym.
https://discord.com/channels/425186187368595466/425186187368595468/784165591236739082

@BasicWombat commented on GitHub (Dec 29, 2020): > @BasicWombat did you find a fix/workaround? Unfortunately no. While I did work on it further that day, I wasn't able to find anything. I also haven't had a opportunity since. For reference, this a link to the discord conversation with @antonym. https://discord.com/channels/425186187368595466/425186187368595468/784165591236739082

kerem commented

2026-03-01 18:36:06 +03:00

Author

Owner

@Firminator commented on GitHub (Dec 30, 2020):

I can't load my custom menu either anymore. Though the error code is 410de13c (aka 410de1 @ https://ipxe.org/err/410de1 )

@Firminator commented on GitHub (Dec 30, 2020): I can't load my custom menu either anymore. Though the error code is 410de13c (aka 410de1 @ https://ipxe.org/err/410de1 )

kerem commented

2026-03-01 18:36:06 +03:00

Author

Owner

@Firminator commented on GitHub (Dec 30, 2020):

Wild speculation here.
boot.netboot.xyz uses an Amazon cert.
raw.githubusercontent uses DigiCert[1].
Could it be that the DigiCert RootCA is not added to the netboot image hence TLS requests to raw.githubusercontent/username/netboot.xyz-custom/master/custom.ipxe will fail?
Anthony suggested to generate certificates and manually them add before building custom netboot images @ https://github.com/netbootxyz/netboot.xyz/issues/237 although we are not building custom images here. We are just using our own repo on Github/raw.githubusercontent.com instead of boot.netboot.xyz

[1] https://www.ssllabs.com/ssltest/analyze.html?d=raw.githubusercontent.com

@Firminator commented on GitHub (Dec 30, 2020): Wild speculation here. boot.netboot.xyz uses an Amazon cert. raw.githubusercontent uses DigiCert[1]. Could it be that the DigiCert RootCA is not added to the netboot image hence TLS requests to raw.githubusercontent/username/netboot.xyz-custom/master/custom.ipxe will fail? Anthony suggested to generate certificates and manually them add before building custom netboot images @ https://github.com/netbootxyz/netboot.xyz/issues/237 although we are not building custom images here. We are just using our own repo on Github/raw.githubusercontent.com instead of boot.netboot.xyz [1] https://www.ssllabs.com/ssltest/analyze.html?d=raw.githubusercontent.com

kerem commented

2026-03-01 18:36:06 +03:00

Author

Owner

@antonym commented on GitHub (Dec 30, 2020):

I did some debug the other day and was getting back the 02 28 error that it mentions on iPXE:

If server replies with “02 28”, then TLS was unable to negotiate compatible
cipher suites between iPXE and your server.  Enable something on the server
side to show what is supported by iPXE.

It was working up until a few weeks ago, so I suspect Github changed something service side on raw.githubusercontent.com that isn't jiving with what iPXE is compatible with. I haven't had much time to dig into this, but we do leverage the ipxe ca with a netboot.xyz code signing cert for signature checking.

I have thought about adding an additional option for loading up menu configs from a URL so that portion of it isn't so dependent on GitHub usernames or their endpoint. Then you can just load the custom menu from anywhere and have more control over compatibility.

@antonym commented on GitHub (Dec 30, 2020): I did some debug the other day and was getting back the 02 28 error that it mentions on iPXE: ``` If server replies with “02 28”, then TLS was unable to negotiate compatible cipher suites between iPXE and your server. Enable something on the server side to show what is supported by iPXE. ``` It was working up until a few weeks ago, so I suspect Github changed something service side on raw.githubusercontent.com that isn't jiving with what iPXE is compatible with. I haven't had much time to dig into this, but we do leverage the ipxe ca with a netboot.xyz code signing cert for signature checking. I have thought about adding an additional option for loading up menu configs from a URL so that portion of it isn't so dependent on GitHub usernames or their endpoint. Then you can just load the custom menu from anywhere and have more control over compatibility.

kerem commented

2026-03-01 18:36:07 +03:00

Author

Owner

@barnabyc commented on GitHub (Dec 31, 2020):

I just moments ago was trying to set github_user via local-vars.ipxe for the first time and thought I had broken something when getting "Operation not permitted", glad it wasn't just me!

A way to override the custom menu base url via local-vars.ipxe could be really useful. In fact, using local-vars.ipxe to override any particular url would be awesome (eg. in the case of locally-hosted Debian mirrors, etc)

@barnabyc commented on GitHub (Dec 31, 2020): I just moments ago was trying to set github_user via local-vars.ipxe for the first time and thought I had broken something when getting "Operation not permitted", glad it wasn't just me! A way to override the custom menu base url via local-vars.ipxe could be really useful. In fact, using local-vars.ipxe to override any particular url would be awesome (eg. in the case of locally-hosted Debian mirrors, etc)

kerem commented

2026-03-01 18:36:07 +03:00

Author

Owner

@LordChunk commented on GitHub (Jan 1, 2021):

Disabling IPv6 on my network seems to resolve the issue.

@LordChunk commented on GitHub (Jan 1, 2021): Disabling IPv6 on my network seems to resolve the issue.

kerem commented

2026-03-01 18:36:07 +03:00

Author

Owner

@hipposen commented on GitHub (Jan 2, 2021):

a bit off-topic but without ipv6 the image download from github is successful

@hipposen commented on GitHub (Jan 2, 2021): a bit off-topic but without ipv6 the image download from github is successful

kerem commented

2026-03-01 18:36:07 +03:00

Author

Owner

@Firminator commented on GitHub (Jan 14, 2021):

Disabling IPv6 on my network seems to resolve the issue.

Disable IPv6 where? Switch, Firewall, DHCP-server?

a bit off-topic but without ipv6 the image download from github is successful

Which image?

@Firminator commented on GitHub (Jan 14, 2021): > Disabling IPv6 on my network seems to resolve the issue. Disable IPv6 where? Switch, Firewall, DHCP-server? > a bit off-topic but without ipv6 the image download from github is successful Which image?

kerem commented

2026-03-01 18:36:07 +03:00

Author

Owner

@bjo81 commented on GitHub (Jan 14, 2021):

I didn't try it without IPv6 yet, but I'm wondering why IPv6 is an issue as it worked already on an IPv6-enabled network. And raw.githubusercontent.com does not have IPv6.


raw.githubusercontent.com is an alias for github.map.fastly.net.
github.map.fastly.net has address 151.101.112.133

@bjo81 commented on GitHub (Jan 14, 2021): I didn't try it without IPv6 yet, but I'm wondering why IPv6 is an issue as it worked already on an IPv6-enabled network. And `raw.githubusercontent.com` does not have IPv6. ``` raw.githubusercontent.com is an alias for github.map.fastly.net. github.map.fastly.net has address 151.101.112.133 ```

kerem commented

2026-03-01 18:36:07 +03:00

Author

Owner

@barnabyc commented on GitHub (Jan 14, 2021):

This seems to be working once again. Was testing a few hours ago. I had not changed any IPv6 settings. Maybe GitHub adjusted their access rules?

@barnabyc commented on GitHub (Jan 14, 2021): This seems to be working once again. Was testing a few hours ago. I had not changed any IPv6 settings. Maybe GitHub adjusted their access rules?

kerem commented

2026-03-01 18:36:07 +03:00

Author

Owner

@antonym commented on GitHub (Jan 14, 2021):

Yeah, it's working for me now again too.

@antonym commented on GitHub (Jan 14, 2021): Yeah, it's working for me now again too.

kerem commented

2026-03-01 18:36:07 +03:00

Author

Owner

@antonym commented on GitHub (Jan 22, 2021):

This appears to still be working so closing this out. I've also added the ability to set a custom url in case functionality with github breaks again.

@antonym commented on GitHub (Jan 22, 2021): This appears to still be working so closing this out. I've also added the ability to set a custom url in case functionality with github breaks again.

Rows
Columns

[GH-ISSUE #785] Unable to load Custom Menus from GitHub #1755