feat(secure-boot): add support for SBAT section

src/main.rs

@@ -59,6 +59,9 @@ pub mod integrations;
 /// phases: Hooks into specific parts of the boot process.
 pub mod phases;
 
+/// sbat: Secure Boot Attestation section.
+pub mod sbat;
+
 /// secure: Secure Boot support.
 pub mod secure;
 

src/sbat.rs

@@ -0,0 +1,8 @@
+/// SBAT must be aligned by 512 bytes.
+const SBAT_SIZE: usize = 512;
+
+/// Define the SBAT attestation by including the sbat.csv file.
+/// See this document for more details: https://github.com/rhboot/shim/blob/main/SBAT.md
+#[used]
+#[unsafe(link_section = ".sbat")]
+static SBAT: [u8; SBAT_SIZE] = *include_bytes!(concat!(env!("OUT_DIR"), "/sbat.csv"));

src/sbat.template.csv

@@ -0,0 +1,2 @@
+sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
+sprout,1,Edera,sprout,{version},https://sprout.edera.dev