security: verify netboot.xyz checksums, pin CI deps, harden manifest rendering

[devin-ai-integration]

Summary

Fixes the critical/high findings from a security scan of this repo:

1. Unverified bootloader downloads (critical) — scripts/create-netbootxyz-alpine-lxc.sh
The PXE rescue builder downloaded netboot.xyz boot binaries (.efi/.kpxe/.iso/…) that machines will actually boot, with no integrity check — even though upstream publishes netboot.xyz-sha256-checksums.txt. The installer now fetches the checksums file first and verifies each boot file after download:

verify_checksum() {
  entry="$(grep -E "^[0-9a-f]{64} \*$1\$" netboot.xyz-sha256-checksums.txt || true)"
  [ -z "$entry" ] && { echo "WARN: no published checksum for $1"; return 0; }
  printf '%s\n' "$entry" | sha256sum -c - || { rm -f "$1"; return 1; }  # fatal under set -eu
}

A mismatch deletes the file and aborts the install. Files without a published checksum (e.g. menus.tar.gz) warn and continue. Verified against the live release with busybox sha256sum (what Alpine uses): pass, mismatch-abort, and no-checksum paths all behave as intended.

2. Supply-chain hardening of the asset-build workflow (high) — .github/workflows/build-brand-assets.yml
The workflow has contents: write and auto-pushes commits to main, so a compromised action tag or PyPI release could push arbitrary commits. Actions are now pinned to full commit SHAs (checkout v4.2.2, setup-python v5.6.0) and pillow/cairosvg are pinned to exact versions.

3. Manifest-rendering hardening — brand.js
esc() prevented attribute breakout but still allowed a tampered manifest.json to inject javascript: URLs via canonicalRawBase (used in href/src) or extra CSS declarations via accent (style="--brand-accent:..."). Added safeUrl() (https-only, else #) around rawAsset() and safeColor() (strict #hex match) for the accent.

Findings not fixed (reported only)

• No hardcoded secrets found in the working tree or full git history (all branches).
• SQL injection / missing auth / debug endpoints: N/A — this is a static asset repo with no server-side code.
• Wildcard CORS (Access-Control-Allow-Origin: *) in the netboot LXC's nginx config: left as-is; it serves public, read-only boot files on a LAN rescue server, which is the intended netboot.xyz setup.
• curl | bash install pattern documented in proxmox/README.md, and the branding script's apt Post-Invoke hook re-runs itself as root after every apt operation: both fetch only from this repo over HTTPS, but consider pinning to a tag/commit instead of main if you want stronger guarantees.

Link to Devin session: https://app.devin.ai/sessions/b45355e80b6a437886f52f01f6d92e94
Requested by: @puchadave

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring