mirrors/sprout
1
0 Fork 0
mirror of https://github.com/edera-dev/sprout.git synced 2026-11-04 22:02:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
390 Commits 5 Branches 30 Tags
dd35c2153bbff5d68c773b744be894a298d67746
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
alex dd35c2153b fix(bls): skip unreadable or invalid BLS entries 
A single BLS entry that could not be read, was not valid UTF-8, or
failed to parse aborted entry generation and therefore the whole boot,
contrary to the generator's documented best-effort behavior. Log a
warning and skip the entry instead.
 2026-09-26 18:58:54 -07:00
alex dbc292e369 fix(bls): allow BLS directories without an entries directory 
Autoconfigure detects BLS when either \loader\loader.conf or
\loader\entries exists, but the BLS generator required the entries
directory and failed the boot without it. This broke ESPs that only
have a loader.conf, such as UKI-only systemd-boot setups. Generate no
entries when the directory is missing.
 2026-09-26 18:58:54 -07:00
alex 6f84a1014a fix(chainload): skip initrd paths without a file component 
Autoconfigured BLS actions use "$root\\$initrd" as the initrd path.
For BLS entries without an initrd line this stamps to the root of the
filesystem, and Sprout tried to read that directory as the initrd,
failing the boot. Treat a path that resolves to no file as no initrd.
 2026-09-26 18:58:54 -07:00
alex 9967a7ab80 fix(chainload): release LoadedImage before starting the image 
The chainload action held the child image's LoadedImage protocol open
exclusively while calling start_image. Any image that opens its own
LoadedImage protocol exclusively, such as another uefi-rs application
or Sprout itself, then failed with ACCESS_DENIED. Scope the protocol to
setting the load options.
 2026-09-26 18:58:54 -07:00
alex bcfb7dc680 fix(shim): take security arch2 boot_policy as a UEFI Boolean 
The firmware passes BootPolicy as a UEFI BOOLEAN (a u8). Declaring it
as a Rust bool in the extern signature is undefined behavior for any
value other than 0 or 1. Use uefi_raw::Boolean instead.
 2026-09-26 18:58:54 -07:00
alex bcc78fd4a3 fix(shim): don't overwrite original handlers when already hooked 
If the security hook was installed while already installed, the
protocols contained Sprout's own handlers, which were then saved as the
"original" handlers. A verification failure would then call back into
the hook forever. Keep the existing saved state in that case.
 2026-09-26 18:58:54 -07:00
alex ad37a2bcf3 fix(variables): accept UTF-16 values without a NUL terminator 
EFI string variables written without a trailing NUL, or with extra NUL
padding, failed to decode and were silently treated as unset. Decode up
to the first NUL and terminate the string ourselves, as systemd-boot
does.

Because empty values now decode to an empty string rather than failing,
treat empty LoaderEntryDefault and LoaderEntryOneShot values as unset so
an empty one-shot entry doesn't fail to match any entry.
 2026-09-26 18:58:54 -07:00
alex df5d8f5c39 fix(bootloader-interface): ignore invalid timeout values 
A LoaderConfigTimeout or LoaderConfigTimeoutOneShot value that is not a
number or a known keyword made Sprout abort boot. Log a warning and
treat the variable as unset instead, matching systemd-boot.
 2026-09-26 18:58:54 -07:00
alex 48e3bc48a9 fix(loader): install the security hook right before LoadImage 
The hook was installed before retaining the shim protocol and reading
the image, so an error in either step returned without uninstalling
it. Install it immediately before LoadImage instead.
 2026-09-26 18:58:54 -07:00
alex 5c2724fd22 fix(env): filter all ASCII control characters from leading args 
The check for unprintable leading arguments added by firmware used
c < 0x1f, which missed 0x1f itself. Use is_ascii_control() instead.
 2026-09-26 18:58:54 -07:00
alex f7e7a9122b fix(menu): ignore key events without an available key 
Some firmware signals the key event without a key being available.
This previously aborted boot with "no key was pressed"; treat it as a
no-op and keep waiting instead.
 2026-09-26 18:58:54 -07:00
alex 1f5bc07c22 fix(autoconfigure): match arm64 Image kernels 
File names are lowercased before matching kernel prefixes, but the
arm64 prefix was "Image", so it could never match and arm64 kernels
were not autoconfigured. Use a lowercase "image" prefix.
 2026-09-26 18:58:54 -07:00
alex 29cdc75776 chore(deps): bump rust to 1.98.1, bump all images, and dependencies (#97) 2026-09-25 11:28:32 -07:00
alex 0e4452b625 chore(upgrade): upgrade to rust v1.97.1, bump deps and migrate, bump images (#95) 2026-08-02 19:02:09 -07:00
alex aafda6e3da chore(deps): upgrade spin and shlex (#86) 2026-05-19 11:51:37 -05:00
alex 6f9c4a2852 chore(deps): upgrade rust and dependencies (#82) 2026-04-16 21:43:36 +00:00
alex c70d1e4d80 sprout: version 0.0.28 (#64) 2026-02-09 12:34:08 -08:00
alex c86215f196 chore(upgrade): bump all dependencies, rust, and images 2026-02-09 09:38:57 -08:00
alex c295de4951 chore(sprout): implement iterator stamping to cleanup code 2026-01-26 20:13:52 -08:00
alex b60c345958 sprout: version 0.0.27 (#57) 2025-12-23 22:51:26 -08:00
alex 6a57c72869 feat(boot): introduce sort keys, which are sorted in reverse order, to make boot order more configurable (#55) 2025-12-21 14:11:26 -08:00
alex d50f22a386 chore(docs): fix all rustdoc warnings (#54) 2025-12-21 14:11:10 -08:00
alex a8a3774c35 chore(upgrade): upgrade dependencies, rust => 1.92.0, dev kernel => 6.18.2, alpine => v3.23 (#53) 2025-12-20 23:00:51 -08:00
alex 81c8217ee0 fix(boot): on boot handoff, clear the screen using clear rather than reset (#52) 
On some Dell firmware, the reset operation doesn't actually clear the screen.
This change uses clear instead of reset to ensure the screen is properly cleared.
 2025-12-20 22:29:44 -08:00
alex 17e729d068 fix(eficore): unregister media loader on drop to prevent more opportunities for leaks (#50) 2025-12-20 22:01:04 -08:00
alex 2da457ee7c feat(boot): clear screen before boot handoff, if --retain-boot-console is not specified on the command-line (#51) 2025-12-20 21:45:35 -08:00
alex 5605056c82 chore(dev): make alpine boot fully clean with kernel module infra 2025-11-26 23:05:01 -08:00
alex d4fcba18c0 Merge pull request #39 from edera-dev/dependabot/github_actions/actions-updates-c5043b94ad 
chore(deps): bump step-security/harden-runner from 2.13.1 to 2.13.2 in the actions-updates group
 2025-11-25 21:35:22 -08:00
alex 4f8abadb3a Merge pull request #42 from edera-dev/fix/pr-workflow-attest 
fix(workflows): disable artifact publish attestation for pull requests
 2025-11-25 20:43:24 -08:00
alex 57e90a4623 fix(workflows): disable artifact publish attestation for pull requests 2025-11-25 20:38:49 -08:00
alex 0dbd011648 Merge pull request #40 from edera-dev/chore/release-v0.0.26 
chore(release): sprout: version 0.0.26
 2025-11-17 10:18:11 -08:00
alex 65c392944b chore(release): sprout: version 0.0.26 2025-11-17 10:14:58 -08:00
alex a7a9554875 Merge pull request #38 from edera-dev/feat/partial-match-default 
feat(entries): support '*' suffix as a partial match to an entry
 2025-11-15 21:25:59 -08:00
alex 5ad617c54f feat(entries): support '*' suffix as a partial match to an entry 2025-11-15 20:36:31 -08:00
alex 0aa7a46808 Merge pull request #27 from edera-dev/feat/jaarg 
feat(options): replace options parser with jaarg
 2025-11-15 18:02:46 -08:00
alex 8711c54074 feat(boot): utilize jaarg for options parsing 2025-11-15 17:31:46 -08:00
alex c053f62b88 fix(autoconfigure/linux): detect Image as a kernel, which openSUSE uses 2025-11-15 13:41:07 -08:00
alex e0bd703511 chore(dev): autologin to alpine and writable rootfs 2025-11-15 13:37:50 -08:00
alex 2a9c9f6907 Merge pull request #34 from edera-dev/chore/release-0.0.25 
chore(release): sprout: version 0.0.25
 2025-11-14 10:49:09 -05:00
alex 16755acdfe chore(release): sprout: version 0.0.25 2025-11-14 10:45:16 -05:00
alex ebb1f0bb44 Merge pull request #33 from edera-dev/chore/upgrade-deps 
chore(deps): upgrade rust to 1.91.1 and bump cargo and docker deps
 2025-11-14 00:30:48 -05:00
alex ecba8a5e02 chore(deps): upgrade rust to 1.91.1 and bump cargo and docker deps 2025-11-14 00:24:09 -05:00
alex 0028e3eefc Merge pull request #32 from rkratky/typo 2025-11-12 10:15:49 -05:00
alex 4fae4080a2 Merge pull request #29 from edera-dev/dependabot/github_actions/actions-updates-1be5372544 
chore(deps): bump the actions-updates group with 2 updates
 2025-11-10 10:09:58 -05:00
alex 0fb54a948b chore(doc): add fedora setup guide and tweak existing guides 2025-11-06 23:51:57 -05:00
alex c4475ad42d fix(boot): ensure top-level error is printed 2025-11-06 13:04:05 -05:00
alex 5e4e86857c sprout: version 0.0.24 2025-11-06 12:03:46 -05:00
alex d3cad25749 chore(deps): upgrade uefi dependencies 2025-11-06 12:03:19 -05:00
alex 22780e6102 chore(eficore): decouple the shim support from the image load callsites 2025-11-06 11:52:00 -05:00
alex c52d61b07f fix(eficore): handle possible leak when the first install protocol interface fails 2025-11-04 14:32:32 -05:00
alex 0ce6ffa3da sprout: version 0.0.23 2025-11-04 12:16:53 -05:00
alex a1028c629d fix(eficore/env): improve quirk handling for dell systems 2025-11-03 23:58:48 -05:00
alex 503a9cba0a chore(code): move load options parsing to crates/eficore 2025-11-03 23:45:35 -05:00
alex 532fb38d5a chore(code): move crates/sprout to crates/boot and name it edera-sprout-boot 2025-11-03 22:52:54 -05:00
alex 9a803ad355 chore(code): sbat section generator build tool 2025-11-03 22:37:06 -05:00
alex 632781abbf chore(code): split much of the efi support code to crates/eficore 2025-11-03 20:47:21 -05:00
alex 48497700d8 fix(sprout): make secure boot warning more specific 2025-11-03 15:31:44 -05:00
alex 34ac57d291 sprout: version 0.0.22 2025-11-03 14:47:59 -05:00
alex 37abe49347 feat(sprout): implement custom logger which shortens output 2025-11-03 14:45:48 -05:00
alex 79615f7436 chore(docs): add openSUSE Secure Boot guide 2025-11-03 04:49:55 -05:00
alex 7a7d92ef70 chore(hack): add keyboard and mouse to dev qemu 2025-11-03 03:41:03 -05:00
alex b34c171ccb fix(hack): remove xen images during clean 2025-11-03 03:18:23 -05:00
alex 384c1e7eaf chore(docker): swap rust for docker builds to 1.91.0 2025-11-03 03:08:09 -05:00
alex 0b7b5066e4 chore(workflows): align on push/pull_request events across workflows 2025-11-03 03:01:57 -05:00
alex ba634ed68a fix(platform/timer): on x86_64, elide usage of asm!() and use _rdtsc() intrinsic 2025-11-03 02:57:22 -05:00
alex be63c5171b chore(doc): add clarifying comments in vercmp 2025-11-03 02:46:41 -05:00
alex f740c35568 fix(tpm): add clarifying parentheses to version check 2025-11-03 02:37:52 -05:00
alex 8a0b70a99b chore(doc): add documentation to VariableController::remove 2025-11-03 02:35:57 -05:00
alex 223a00563e chore(menu): add note as to why we match on the timer event 2025-11-03 02:35:01 -05:00
alex 029e59b209 sprout: version 0.0.21 2025-11-03 02:15:23 -05:00
alex bde1cd01c8 Merge pull request #28 from edera-dev/experiment/no-std 
feat(sprout): introduce no_std sprout which uses stable rust
 2025-11-02 23:11:52 -08:00
alex 0017d7874d feat(sprout): introduce no_std sprout which uses stable rust 2025-11-03 02:04:21 -05:00
alex 1c2acdc568 chore(build): pin rust-toolchain to nightly-2025-11-03 2025-11-03 00:37:04 -05:00
alex 1f322ff4bf chore(workflows): publish should upload and attest all artifacts in a single zip 2025-11-03 00:32:54 -05:00
alex 0bb7d7ccb1 sprout: version 0.0.20 2025-11-03 00:10:20 -05:00
alex 74b6a8deb3 chore(workflows): release workflow should attest all artifacts together 2025-11-03 00:06:53 -05:00
alex 3e5d54913c sprout: version 0.0.19 2025-11-02 23:59:36 -05:00
alex b616e75e96 chore(workflows): release workflow should attest the efi artifacts 2025-11-02 23:57:58 -05:00
alex 069f858e95 chore(workflows): publish workload should provide build provenance 2025-11-02 23:52:15 -05:00
alex ada13b7dd5 sprout: version 0.0.18 2025-11-02 23:40:57 -05:00
alex 8179fdb565 fix(hack): remove splash copy options 2025-11-02 23:37:46 -05:00
alex ed3bfb77c4 chore(crates): introduce new config crate for sprout configuration 2025-11-02 23:28:31 -05:00
alex ccc75a2e14 chore(workspace): move most things into the workspace 2025-11-02 22:35:07 -05:00
alex 9c12e5f12f chore(code): move sprout code to crates/sprout and remove splash support for minimalism 2025-11-02 22:23:00 -05:00
alex b103fdacf2 chore(docs): add debian setup guide 2025-11-02 19:52:25 -05:00
alex 7be42ba074 chore(docs): reorganize setup guides 2025-11-02 19:26:02 -05:00
alex 8a6f4dc19d chore(docs): add ubuntu secure boot setup guide 2025-11-02 18:08:57 -05:00
alex 830eaca19a fix(autoconfigure/linux): workaround canonical stubble bug relating to empty load options 2025-11-02 17:58:06 -05:00
alex 3febca5797 fix(chainload): ensure that load options are always set, even if it is to an empty string 2025-11-02 17:47:36 -05:00
alex 524d0871f3 sprout: version 0.0.17 2025-11-02 16:28:07 -05:00
alex f0628f77e2 fix(shim): repair x86_64 shim verification by using the SYSV calling convention 2025-11-02 05:57:24 -05:00
alex cc37c2b26a fix(shim): use pinned boxed slices to represent data that needs to be passed to uefi stack 2025-11-02 05:08:03 -05:00
alex 8d403d74c9 fix(shim/hook): clarify const-ness of some parameters 2025-11-02 04:16:05 -05:00
alex cc4bc6efcc fix(shim/hook): when using older hook protocol, read the data into an owned buffer 2025-11-02 02:48:41 -05:00
alex d4bcfcd9b1 fix(shim): reflect the const pointer-ness of the verifiable data 2025-11-02 02:45:25 -05:00
alex c34462b812 fix(options): accidental infinite loop due when not running on Dell firmware 2025-11-02 02:21:29 -05:00
alex 79471f6862 fix(quirk): skip initial options that start with a tilde to work around dell firmware 2025-11-02 02:13:39 -05:00
alex 9c31dba6fa fix(shim): only call into shim if it is available AND secure boot is enabled 2025-11-02 01:52:21 -05:00
alex 84d60e09be fix(bootloader-interface): when there are no entries, don't attempt to set LoaderEntries 2025-11-02 01:38:07 -05:00
alex eabb612330 fix(shim/hook): call original hook function if the shim verify fails 2025-11-02 01:07:16 -05:00