sprout: version 0.0.19

feat(boot): basic support for secure boot via shim

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -0,0 +1,42 @@
+name: Report a bug
+description: File a bug report.
+title: "bug: "
+labels: ["bug", "triage"]
+type: bug
+assignees:
+- edera-dev/engineering
+body:
+- type: markdown
+  attributes:
+    value: |
+      Thanks for taking the time to fill out this bug report!
+- type: input
+  id: version
+  attributes:
+    label: Version / Commit
+    description: What version of Sprout are you running?
+  validations:
+    required: true
+- type: textarea
+  id: what-happened
+  attributes:
+    label: What happened?
+    description: Tell us what you expected to happen.
+    placeholder: Tell us what you see!
+    value: "A bug happened!"
+  validations:
+    required: true
+- type: textarea
+  id: logs
+  attributes:
+    label: Log output
+    description: Please provide any relevant log output.
+    render: log
+- type: checkboxes
+  id: terms
+  attributes:
+    label: Code of Conduct
+    description: By submitting this report, you agree to follow our [Code of Conduct](https://github.com/edera-dev/sprout/blob/main/CODE_OF_CONDUCT.md).
+    options:
+    - label: I agree to follow the Sprout Code of Conduct.
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,6 @@
+blank_issues_enabled: false
+contact_links:
+- name: Ask a question
+  url: https://github.com/edera-dev/sprout/discussions
+  about: Please ask and answer questions here.
+# Note that GitHub will automatically display our security policy in the new issue form.

.github/ISSUE_TEMPLATE/feature-request.yml

@@ -0,0 +1,29 @@
+name: Request a feature
+description: Request a feature.
+title: "want: "
+labels: ["enhancement", "triage"]
+type: feature
+assignees:
+- edera-dev/engineering
+body:
+- type: markdown
+  attributes:
+    value: |
+      Thanks for taking the time to fill out a feature request!
+- type: textarea
+  id: description
+  attributes:
+    label: Description
+    description:
+    placeholder: Tell us what you want to see!
+    value: "Your hopes and dreams here!"
+  validations:
+    required: true
+- type: checkboxes
+  id: terms
+  attributes:
+    label: Code of Conduct
+    description: By submitting this report, you agree to follow our [Code of Conduct](https://github.com/edera-dev/sprout/blob/main/CODE_OF_CONDUCT.md).
+    options:
+    - label: I agree to follow the Sprout Code of Conduct.
+      required: true

.github/workflows/ci-actions.yml

@@ -10,7 +10,7 @@ permissions:
   contents: read # Needed to checkout the repository.
 
 concurrency:
-  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}"
+  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ github.sha }}"
   cancel-in-progress: true
 
 jobs:

.github/workflows/ci-code.yml

@@ -12,7 +12,7 @@ permissions:
   contents: read # Needed to checkout the repository.
 
 concurrency:
-  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}"
+  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ github.sha }}"
   cancel-in-progress: true
 
 jobs:

.github/workflows/codeql.yml

@@ -12,7 +12,7 @@ permissions:
   contents: read # Needed to checkout the repository.
 
 concurrency:
-  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}"
+  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ github.sha }}"
   cancel-in-progress: true
 
 jobs:

.github/workflows/publish.yml

@@ -19,7 +19,7 @@ permissions:
   contents: read # Needed to checkout the repository.
 
 concurrency:
-  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}"
+  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ github.sha }}"
   cancel-in-progress: true
 
 jobs:
@@ -27,6 +27,8 @@ jobs:
     name: artifacts
     permissions:
       contents: write # Needed to upload artifacts.
+      id-token: write # Needed for attestation.
+      attestations: write # Needed for attestations.
     runs-on: ubuntu-latest
     steps:
     - name: harden runner
@@ -46,14 +48,28 @@ jobs:
     - name: 'assemble artifacts'
       run: ./hack/assemble.sh
 
-    - name: 'upload sprout-x86_64.efi artifact'
+    - name: 'upload sprout-x86_64.efi.zip artifact'
+      id: upload-sprout-x86_64-efi
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
       with:
-        name: sprout-x86_64.efi
+        name: sprout-x86_64.efi.zip
         path: target/assemble/sprout-x86_64.efi
 
-    - name: 'upload sprout-aarch64.efi artifact'
+    - name: 'upload sprout-aarch64.efi.zip artifact'
+      id: upload-sprout-aarch64-efi
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
       with:
-        name: sprout-aarch64.efi
+        name: sprout-aarch64.efi.zip
         path: target/assemble/sprout-aarch64.efi
+
+    - name: 'attest sprout-x86_64.efi.zip artifact'
+      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+      with:
+        subject-name: sprout-x86_64.efi.zip
+        subject-digest: "sha256:${{ steps.upload-sprout-x86_64-efi.outputs.artifact-digest }}"
+
+    - name: 'attest sprout-aarch64.efi.zip artifact'
+      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+      with:
+        subject-name: sprout-aarch64.efi.zip
+        subject-digest: "sha256:${{ steps.upload-sprout-aarch64-efi.outputs.artifact-digest }}"

.github/workflows/release.yml

@@ -20,6 +20,8 @@ jobs:
     name: release
     permissions:
       contents: write # Needed to upload release assets.
+      id-token: write # Needed for attestation.
+      attestations: write # Needed for attestations.
     runs-on: ubuntu-latest
     steps:
     - name: harden runner
@@ -39,6 +41,16 @@ jobs:
     - name: 'assemble artifacts'
       run: ./hack/assemble.sh
 
+    - name: 'attest sprout-x86_64.efi artifact'
+      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+      with:
+        subject-path: target/assemble/sprout-x86_64.efi
+
+    - name: 'attest sprout-aarch64.efi artifact'
+      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+      with:
+        subject-path: target/assemble/sprout-aarch64.efi
+
     - name: 'generate cultivator token'
       uses: actions/create-github-app-token@bf559f85448f9380bcfa2899dbdc01eb5b37be3a # v3.0.0-beta.2
       id: generate-token

Cargo.lock

@@ -2,35 +2,12 @@
 # It is not intended for manual editing.
 version = 4
 
-[[package]]
-name = "adler2"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
-
 [[package]]
 name = "anyhow"
 version = "1.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
 
-[[package]]
-name = "async-trait"
-version = "0.1.89"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "autocfg"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
-
 [[package]]
 name = "bit_field"
 version = "0.10.3"
@@ -52,24 +29,6 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "bytemuck"
-version = "1.24.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fbdf580320f38b612e485521afda1ee26d10cc9884efaaa750d383e13e3c5f4"
-
-[[package]]
-name = "byteorder-lite"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
-
-[[package]]
-name = "bytes"
-version = "1.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
-
 [[package]]
 name = "cfg-if"
 version = "1.0.4"
@@ -85,15 +44,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "crc32fast"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
-dependencies = [
- "cfg-if",
-]
-
 [[package]]
 name = "crypto-common"
 version = "0.1.6"
@@ -116,43 +66,32 @@ dependencies = [
 
 [[package]]
 name = "edera-sprout"
-version = "0.0.14"
+version = "0.0.19"
 dependencies = [
  "anyhow",
- "image",
+ "bitflags",
+ "edera-sprout-config",
+ "hex",
  "log",
- "serde",
- "sha256",
+ "sha2",
  "toml",
  "uefi",
  "uefi-raw",
 ]
 
+[[package]]
+name = "edera-sprout-config"
+version = "0.0.19"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "equivalent"
 version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
-[[package]]
-name = "fdeflate"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
-dependencies = [
- "simd-adler32",
-]
-
-[[package]]
-name = "flate2"
-version = "1.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfe33edd8e85a12a67454e37f8c75e730830d83e313556ab9ebf9ee7fbeb3bfb"
-dependencies = [
- "crc32fast",
- "miniz_oxide",
-]
-
 [[package]]
 name = "generic-array"
 version = "0.14.9"
@@ -175,19 +114,6 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
-[[package]]
-name = "image"
-version = "0.25.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "529feb3e6769d234375c4cf1ee2ce713682b8e76538cb13f9fc23e1400a591e7"
-dependencies = [
- "bytemuck",
- "byteorder-lite",
- "moxcms",
- "num-traits",
- "png",
-]
-
 [[package]]
 name = "indexmap"
 version = "2.12.0"
@@ -210,47 +136,6 @@ version = "0.4.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
 
-[[package]]
-name = "miniz_oxide"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
-dependencies = [
- "adler2",
- "simd-adler32",
-]
-
-[[package]]
-name = "moxcms"
-version = "0.7.6"
-source = "git+https://github.com/edera-dev/sprout-patched-deps.git?rev=2c4fcc84b50d40c28f540d4271109ea0ca7e1268#2c4fcc84b50d40c28f540d4271109ea0ca7e1268"
-dependencies = [
- "num-traits",
- "pxfm",
-]
-
-[[package]]
-name = "num-traits"
-version = "0.2.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "png"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97baced388464909d42d89643fe4361939af9b7ce7a31ee32a168f832a70f2a0"
-dependencies = [
- "bitflags",
- "crc32fast",
- "fdeflate",
- "flate2",
- "miniz_oxide",
-]
-
 [[package]]
 name = "proc-macro2"
 version = "1.0.103"
@@ -280,15 +165,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "pxfm"
-version = "0.1.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3cbdf373972bf78df4d3b518d07003938e2c7d1fb5891e55f9cb6df57009d84"
-dependencies = [
- "num-traits",
-]
-
 [[package]]
 name = "quote"
 version = "1.0.41"
@@ -348,23 +224,6 @@ dependencies = [
  "digest",
 ]
 
-[[package]]
-name = "sha256"
-version = "1.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f880fc8562bdeb709793f00eb42a2ad0e672c4f883bbe59122b926eca935c8f6"
-dependencies = [
- "async-trait",
- "bytes",
- "hex",
- "sha2",
-]
-
-[[package]]
-name = "simd-adler32"
-version = "0.3.7"
-source = "git+https://github.com/edera-dev/sprout-patched-deps.git?rev=2c4fcc84b50d40c28f540d4271109ea0ca7e1268#2c4fcc84b50d40c28f540d4271109ea0ca7e1268"
-
 [[package]]
 name = "syn"
 version = "2.0.108"
@@ -475,9 +334,9 @@ checksum = "0c8352f8c05e47892e7eaf13b34abd76a7f4aeaf817b716e88789381927f199c"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.20"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "462eeb75aeb73aea900253ce739c8e18a67423fadf006037cd3ff27e82748a06"
+checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
 
 [[package]]
 name = "version_check"

Cargo.toml

@@ -1,45 +1,32 @@
-[package]
-name = "edera-sprout"
-description = "Modern UEFI bootloader"
+[workspace]
+members = [
+  "crates/config",
+  "crates/sprout",
+]
+resolver = "3"
+
+[workspace.package]
 license = "Apache-2.0"
-version = "0.0.14"
+version = "0.0.19"
 homepage = "https://sprout.edera.dev"
 repository = "https://github.com/edera-dev/sprout"
 edition = "2024"
 
-[dependencies]
+[workspace.dependencies]
 anyhow = "1.0.100"
-toml = "0.9.8"
+bitflags = "2.10.0"
+hex = "0.4.3"
 log = "0.4.28"
+serde = "1.0.228"
+sha2 = "0.10.9"
+toml = "0.9.8"
+uefi = "0.36.0"
+uefi-raw = "0.12.0"
 
-[dependencies.image]
-version = "0.25.8"
-default-features = false
-features = ["png"]
-optional = true
-
-[dependencies.serde]
-version = "1.0.228"
-features = ["derive"]
-
-[dependencies.sha256]
-version = "1.6.0"
-default-features = false
-
-[dependencies.uefi]
-version = "0.36.0"
-features = ["alloc", "logger"]
-
-[dependencies.uefi-raw]
-version = "0.12.0"
-
-[features]
-default = ["splash"]
-splash = ["dep:image"]
-
-[profile.dev]
-# We have to compile for opt-level = 2 due to optimization passes
+# Common build profiles
+# NOTE: We have to compile everything for opt-level = 2 due to optimization passes
 # which don't handle the UEFI target properly.
+[profile.dev]
 opt-level = 2
 
 [profile.release]
@@ -56,15 +43,3 @@ inherits = "dev"
 strip = "debuginfo"
 debug = 0
 opt-level = 2
-
-[patch.crates-io.simd-adler32]
-git = "https://github.com/edera-dev/sprout-patched-deps.git"
-rev = "2c4fcc84b50d40c28f540d4271109ea0ca7e1268"
-
-[patch.crates-io.moxcms]
-git = "https://github.com/edera-dev/sprout-patched-deps.git"
-rev = "2c4fcc84b50d40c28f540d4271109ea0ca7e1268"
-
-[[bin]]
-name = "sprout"
-path = "src/main.rs"

Dockerfile

@@ -2,7 +2,7 @@
 ARG RUST_PROFILE=release
 ARG RUST_TARGET_SUBDIR=release
 
-FROM --platform=$BUILDPLATFORM rustlang/rust:nightly-alpine@sha256:7cba2edabb6ba0e92cd806cd1e0acae99d50f63e5b9c9ad842766d13c896d68c AS build
+FROM --platform=$BUILDPLATFORM rustlang/rust:nightly-alpine@sha256:34532121803db17008af0cdc4e2e1210466cb257cc9d3840dac42d706640fee5 AS build
 RUN apk --no-cache add musl-dev busybox-static
 ARG RUST_PROFILE
 RUN adduser -S -s /bin/sh build

README.md

@@ -6,11 +6,11 @@
 
 </div>
 
-Sprout is an **EXPERIMENTAL** programmable UEFI bootloader written in Rust.
+Sprout is a programmable UEFI bootloader written in Rust.
 
-Sprout is in use at Edera today in development environments and is intended to ship to production soon.
+It is in use at Edera today in development environments and is intended to ship to production soon.
 
-The name "sprout" is derived from our company name "Edera" which means "ivy."
+The name "Sprout" is derived from our company name "Edera" which means "ivy."
 Given that Sprout is the first thing intended to start on an Edera system, the name was apt.
 
 It supports `x86_64` and `ARM64` EFI-capable systems. It is designed to require UEFI and can be chainloaded from an
@@ -18,16 +18,16 @@ existing UEFI bootloader or booted by the hardware directly.
 
 Sprout is licensed under Apache 2.0 and is open to modifications and contributions.
 
-**IMPORTANT WARNING**: Sprout does not support UEFI Secure Boot yet.
-See [this issue](https://github.com/edera-dev/sprout/issues/20) for updates.
+**NOTE**: Sprout is still in beta. Some features may not work as expected.
+Please [report any bugs you find](https://github.com/edera-dev/sprout/issues/new/choose).
 
 ## Background
 
 At [Edera] we make compute isolation technology for a wide variety of environments, often ones we do not fully control.
-Our technology utilizes a hypervisor to boot the host system to provide a new isolation mechanism that works
-with or without hardware virtualization support. To do this we need to inject our hypervisor at boot time.
+Our technology uses a hypervisor to boot the host system to provide a new isolation mechanism that works
+with or without hardware virtualization support. To do this, we need to inject our hypervisor at boot time.
 
-Unfortunately, GRUB, the most common bootloader on Linux systems today, utilizes a shell-script like
+Unfortunately, GRUB, the most common bootloader on Linux systems today, uses a shell-script like
 configuration system. Both the code that runs to generate a GRUB config and the GRUB config
 itself is fully turing complete. This makes modifying boot configuration difficult and error-prone.
 
@@ -40,10 +40,22 @@ simplify installation and usage.
 
 ## Documentation
 
-- [Fedora Setup Guide]
-- [Generic Linux Setup Guide]
-- [Alpine Edge Setup Guide]
-- [Windows Setup Guide]
+### Setup Guides
+
+Some guides support Secure Boot and some do not.
+We recommend running Sprout without Secure Boot for development, and with Secure Boot for production.
+
+| Operating System | Secure Boot Enabled | Link                                                  |
+|------------------|---------------------|-------------------------------------------------------|
+| Ubuntu           | ✅                   | [Setup Guide](./docs/setup/signed/ubuntu.md)          |
+| Debian           | ✅                   | [Setup Guide](./docs/setup/signed/debian.md)          |
+| Fedora           | ❌                   | [Setup Guide](./docs/setup/unsigned/fedora.md)        |
+| Alpine Edge      | ❌                   | [Setup Guide](./docs/setup/unsigned/alpine-edge.md)   |
+| Generic Linux    | ❌                   | [Setup Guide](./docs/setup/unsigned/generic-linux.md) |
+| Windows          | ❌                   | [Setup Guide](./docs/setup/unsigned/windows.md)       |
+
+### Project Documentation
+
 - [Development Guide]
 - [Contributing Guide]
 - [Sprout License]
@@ -52,9 +64,6 @@ simplify installation and usage.
 
 ## Features
 
-NOTE: Currently, Sprout is experimental and is not intended for production use.
-The boot menu mechanism is very rudimentary.
-
 ### Current
 
 - [x] Loadable driver support
@@ -65,13 +74,13 @@ The boot menu mechanism is very rudimentary.
 - [x] Load Linux initrd from disk
 - [x] Basic boot menu
 - [x] BLS autoconfiguration support
+- [x] [Secure Boot support](https://github.com/edera-dev/sprout/issues/20): beta
+- [x] [Bootloader interface support](https://github.com/edera-dev/sprout/issues/21): beta
+- [x] [BLS specification conformance](https://github.com/edera-dev/sprout/issues/2): beta
 
 ### Roadmap
 
-- [ ] [Bootloader interface support](https://github.com/edera-dev/sprout/issues/21)
-- [ ] [BLS specification conformance](https://github.com/edera-dev/sprout/issues/2)
 - [ ] [Full-featured boot menu](https://github.com/edera-dev/sprout/issues/1)
-- [ ] [Secure Boot support](https://github.com/edera-dev/sprout/issues/20): work in progress
 - [ ] [UKI support](https://github.com/edera-dev/sprout/issues/6): partial
 - [ ] [multiboot2 support](https://github.com/edera-dev/sprout/issues/7)
 - [ ] [Linux boot protocol (boot without EFI stub)](https://github.com/edera-dev/sprout/issues/7)
@@ -151,10 +160,6 @@ autoconfigure = true
 ```
 
 [Edera]: https://edera.dev
-[Fedora Setup Guide]: ./docs/fedora-setup.md
-[Generic Linux Setup Guide]: ./docs/generic-linux-setup.md
-[Alpine Edge Setup Guide]: ./docs/alpine-edge-setup.md
-[Windows Setup Guide]: ./docs/windows-setup.md
 [Development Guide]: ./DEVELOPMENT.md
 [Contributing Guide]: ./CONTRIBUTING.md
 [Sprout License]: ./LICENSE

crates/config/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "edera-sprout-config"
+description = "Sprout Configuration"
+license.workspace = true
+version.workspace = true
+homepage.workspace = true
+repository.workspace = true
+edition.workspace = true
+
+[dependencies.serde]
+workspace = true
+features = ["derive"]
+
+[lib]
+name = "edera_sprout_config"

crates/config/src/actions.rs

@@ -0,0 +1,32 @@
+use serde::{Deserialize, Serialize};
+
+/// Configuration for the chainload action.
+pub mod chainload;
+
+/// Configuration for the edera action.
+pub mod edera;
+
+/// Configuration for the print action.
+pub mod print;
+
+/// Declares an action that sprout can execute.
+/// Actions allow configuring sprout's internal runtime mechanisms with values
+/// that you can specify via other concepts.
+///
+/// Actions are the main work that Sprout gets done, like booting Linux.
+#[derive(Serialize, Deserialize, Debug, Default, Clone)]
+pub struct ActionDeclaration {
+    /// Chainload to another EFI application.
+    /// This allows you to load any EFI application, either to boot an operating system
+    /// or to perform more EFI actions and return to sprout.
+    #[serde(default)]
+    pub chainload: Option<chainload::ChainloadConfiguration>,
+    /// Print a string to the EFI console.
+    #[serde(default)]
+    pub print: Option<print::PrintConfiguration>,
+    /// Boot the Edera hypervisor and the root operating system.
+    /// This action is an extension on top of the Xen EFI stub that
+    /// is specific to Edera.
+    #[serde(default, rename = "edera")]
+    pub edera: Option<edera::EderaConfiguration>,
+}

crates/config/src/actions/chainload.rs

@@ -0,0 +1,19 @@
+use serde::{Deserialize, Serialize};
+
+/// The configuration of the chainload action.
+#[derive(Serialize, Deserialize, Debug, Default, Clone)]
+pub struct ChainloadConfiguration {
+    /// The path to the image to chainload.
+    /// This can be a Linux EFI stub (vmlinuz usually) or a standard EFI executable.
+    pub path: String,
+    /// The options to pass to the image.
+    /// The options are concatenated by a space and then passed to the EFI application.
+    #[serde(default)]
+    pub options: Vec<String>,
+    /// An optional path to a Linux initrd.
+    /// This uses the [LINUX_EFI_INITRD_MEDIA_GUID] mechanism to load the initrd into the EFI stack.
+    /// For Linux, you can also use initrd=\path\to\initrd as an option, but this option is
+    /// generally better and safer as it can support additional load options in the future.
+    #[serde(default, rename = "linux-initrd")]
+    pub linux_initrd: Option<String>,
+}

crates/config/src/actions/edera.rs

@@ -0,0 +1,21 @@
+use serde::{Deserialize, Serialize};
+
+/// The configuration of the edera action which boots the Edera hypervisor.
+/// Edera is based on Xen but modified significantly with a Rust stack.
+/// Sprout is a component of the Edera stack and provides the boot functionality of Xen.
+#[derive(Serialize, Deserialize, Debug, Default, Clone)]
+pub struct EderaConfiguration {
+    /// The path to the Xen hypervisor EFI image.
+    pub xen: String,
+    /// The path to the kernel to boot for dom0.
+    pub kernel: String,
+    /// The path to the initrd to load for dom0.
+    #[serde(default)]
+    pub initrd: Option<String>,
+    /// The options to pass to the kernel.
+    #[serde(default, rename = "kernel-options")]
+    pub kernel_options: Vec<String>,
+    /// The options to pass to the Xen hypervisor.
+    #[serde(default, rename = "xen-options")]
+    pub xen_options: Vec<String>,
+}

crates/config/src/actions/print.rs

@@ -0,0 +1,9 @@
+use serde::{Deserialize, Serialize};
+
+/// The configuration of the print action.
+#[derive(Serialize, Deserialize, Debug, Default, Clone)]
+pub struct PrintConfiguration {
+    /// The text to print to the console.
+    #[serde(default)]
+    pub text: String,
+}

crates/config/src/drivers.rs

@@ -0,0 +1,12 @@
+use serde::{Deserialize, Serialize};
+
+/// Declares a driver configuration.
+/// Drivers allow extending the functionality of Sprout.
+/// Drivers are loaded at runtime and can provide extra functionality like filesystem support.
+/// Drivers are loaded by their name, which is used to reference them in other concepts.
+#[derive(Serialize, Deserialize, Debug, Default, Clone)]
+pub struct DriverDeclaration {
+    /// The filesystem path to the driver.
+    /// This file should be an EFI executable that can be located and executed.
+    pub path: String,
+}

crates/config/src/entries.rs

@@ -0,0 +1,19 @@
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+
+/// Declares a boot entry to display in the boot menu.
+///
+/// Entries are the user-facing concept of Sprout, making it possible
+/// to run a set of actions with a specific context.
+#[derive(Serialize, Deserialize, Debug, Default, Clone)]
+pub struct EntryDeclaration {
+    /// The title of the entry which will be display in the boot menu.
+    /// This is the pre-stamped value.
+    pub title: String,
+    /// The actions to run when the entry is selected.
+    #[serde(default)]
+    pub actions: Vec<String>,
+    /// The values to insert into the context when the entry is selected.
+    #[serde(default)]
+    pub values: BTreeMap<String, String>,
+}

crates/config/src/extractors.rs

@@ -1,10 +1,7 @@
-use crate::context::SproutContext;
 use crate::extractors::filesystem_device_match::FilesystemDeviceMatchExtractor;
-use anyhow::{Result, bail};
 use serde::{Deserialize, Serialize};
-use std::rc::Rc;
 
-/// The filesystem device match extractor.
+/// Configuration for the filesystem-device-match extractor.
 pub mod filesystem_device_match;
 
 /// Declares an extractor configuration.
@@ -19,14 +16,3 @@ pub struct ExtractorDeclaration {
     #[serde(default, rename = "filesystem-device-match")]
     pub filesystem_device_match: Option<FilesystemDeviceMatchExtractor>,
 }
-
-/// Extracts the value using the specified `extractor` under the provided `context`.
-/// The extractor must return a value, and if a value cannot be determined, an error
-/// should be returned.
-pub fn extract(context: Rc<SproutContext>, extractor: &ExtractorDeclaration) -> Result<String> {
-    if let Some(filesystem) = &extractor.filesystem_device_match {
-        filesystem_device_match::extract(context, filesystem)
-    } else {
-        bail!("unknown extractor configuration");
-    }
-}

crates/config/src/extractors/filesystem_device_match.rs

@@ -0,0 +1,29 @@
+use serde::{Deserialize, Serialize};
+
+/// The filesystem device match extractor.
+/// This extractor finds a filesystem using some search criteria and returns
+/// the device root path that can concatenated with subpaths to access files
+/// on a particular filesystem.
+/// The fallback value can be used to provide a value if no match is found.
+///
+/// This extractor requires all the criteria to match. If no criteria is provided,
+/// an error is returned.
+#[derive(Serialize, Deserialize, Debug, Default, Clone)]
+pub struct FilesystemDeviceMatchExtractor {
+    /// Matches a filesystem that has the specified label.
+    #[serde(default, rename = "has-label")]
+    pub has_label: Option<String>,
+    /// Matches a filesystem that has the specified item.
+    /// An item is either a directory or file.
+    #[serde(default, rename = "has-item")]
+    pub has_item: Option<String>,
+    /// Matches a filesystem that has the specified partition UUID.
+    #[serde(default, rename = "has-partition-uuid")]
+    pub has_partition_uuid: Option<String>,
+    /// Matches a filesystem that has the specified partition type UUID.
+    #[serde(default, rename = "has-partition-type-uuid")]
+    pub has_partition_type_uuid: Option<String>,
+    /// The fallback value to use if no filesystem matches the criteria.
+    #[serde(default)]
+    pub fallback: Option<String>,
+}

crates/config/src/generators.rs

@@ -1,15 +1,15 @@
-use crate::context::SproutContext;
-use crate::entries::BootableEntry;
 use crate::generators::bls::BlsConfiguration;
 use crate::generators::list::ListConfiguration;
 use crate::generators::matrix::MatrixConfiguration;
-use anyhow::Result;
-use anyhow::bail;
 use serde::{Deserialize, Serialize};
-use std::rc::Rc;
 
+/// Configuration for the BLS generator.
 pub mod bls;
+
+/// Configuration for the list generator.
 pub mod list;
+
+/// Configuration for the matrix generator.
 pub mod matrix;
 
 /// Declares a generator configuration.
@@ -38,21 +38,3 @@ pub struct GeneratorDeclaration {
     /// Allows you to specify a list of values to generate an entry from.
     pub list: Option<ListConfiguration>,
 }
-
-/// Runs the generator specified by the `generator` option.
-/// It uses the specified `context` as the parent context for
-/// the generated entries, injecting more values if needed.
-pub fn generate(
-    context: Rc<SproutContext>,
-    generator: &GeneratorDeclaration,
-) -> Result<Vec<BootableEntry>> {
-    if let Some(matrix) = &generator.matrix {
-        matrix::generate(context, matrix)
-    } else if let Some(bls) = &generator.bls {
-        bls::generate(context, bls)
-    } else if let Some(list) = &generator.list {
-        list::generate(context, list)
-    } else {
-        bail!("unknown generator configuration");
-    }
-}

crates/config/src/generators/bls.rs

@@ -0,0 +1,21 @@
+use crate::entries::EntryDeclaration;
+use serde::{Deserialize, Serialize};
+
+/// The default path to the BLS directory.
+const BLS_TEMPLATE_PATH: &str = "\\loader";
+
+/// The configuration of the BLS generator.
+/// The BLS uses the Bootloader Specification to produce
+/// entries from an input template.
+#[derive(Serialize, Deserialize, Debug, Default, Clone)]
+pub struct BlsConfiguration {
+    /// The entry to use for as a template.
+    pub entry: EntryDeclaration,
+    /// The path to the BLS directory.
+    #[serde(default = "default_bls_path")]
+    pub path: String,
+}
+
+fn default_bls_path() -> String {
+    BLS_TEMPLATE_PATH.to_string()
+}

crates/config/src/generators/list.rs

@@ -0,0 +1,16 @@
+use crate::entries::EntryDeclaration;
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+
+/// List generator configuration.
+/// The list generator produces multiple entries based
+/// on a set of input maps.
+#[derive(Serialize, Deserialize, Debug, Default, Clone)]
+pub struct ListConfiguration {
+    /// The template entry to use for each generated entry.
+    #[serde(default)]
+    pub entry: EntryDeclaration,
+    /// The values to use as the input for the matrix.
+    #[serde(default)]
+    pub values: Vec<BTreeMap<String, String>>,
+}

crates/config/src/generators/matrix.rs

@@ -0,0 +1,16 @@
+use crate::entries::EntryDeclaration;
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+
+/// Matrix generator configuration.
+/// The matrix generator produces multiple entries based
+/// on input values multiplicatively.
+#[derive(Serialize, Deserialize, Debug, Default, Clone)]
+pub struct MatrixConfiguration {
+    /// The template entry to use for each generated entry.
+    #[serde(default)]
+    pub entry: EntryDeclaration,
+    /// The values to use as the input for the matrix.
+    #[serde(default)]
+    pub values: BTreeMap<String, Vec<String>>,
+}

crates/config/src/lib.rs

@@ -1,3 +1,6 @@
+//! Sprout configuration descriptions.
+//! This crate provides all the configuration structures for Sprout.
+
 use crate::actions::ActionDeclaration;
 use crate::drivers::DriverDeclaration;
 use crate::entries::EntryDeclaration;
@@ -7,8 +10,12 @@ use crate::phases::PhasesConfiguration;
 use serde::{Deserialize, Serialize};
 use std::collections::BTreeMap;
 
-/// The configuration loader mechanisms.
-pub mod loader;
+pub mod actions;
+pub mod drivers;
+pub mod entries;
+pub mod extractors;
+pub mod generators;
+pub mod phases;
 
 /// This is the latest version of the sprout configuration format.
 /// This must be incremented when the configuration breaks compatibility.
@@ -80,7 +87,8 @@ pub struct OptionsConfiguration {
     pub autoconfigure: bool,
 }
 
-fn latest_version() -> u32 {
+/// Get the latest version of the Sprout configuration format.
+pub fn latest_version() -> u32 {
     LATEST_VERSION
 }
 

crates/config/src/phases.rs

@@ -1,9 +1,5 @@
-use crate::actions;
-use crate::context::SproutContext;
-use anyhow::{Context, Result};
 use serde::{Deserialize, Serialize};
 use std::collections::BTreeMap;
-use std::rc::Rc;
 
 /// Configures the various phases of the boot process.
 /// This allows hooking various phases to run actions.
@@ -32,23 +28,3 @@ pub struct PhaseConfiguration {
     #[serde(default)]
     pub values: BTreeMap<String, String>,
 }
-
-/// Executes the specified [phase] of the boot process.
-/// The value [phase] should be a reference of a specific phase in the [PhasesConfiguration].
-/// Any error from the actions is propagated into the [Result] and will interrupt further
-/// execution of phase actions.
-pub fn phase(context: Rc<SproutContext>, phase: &[PhaseConfiguration]) -> Result<()> {
-    for item in phase {
-        let mut context = context.fork();
-        // Insert the values into the context.
-        context.insert(&item.values);
-        let context = context.freeze();
-
-        // Execute all the actions in this phase configuration.
-        for action in item.actions.iter() {
-            actions::execute(context.clone(), action)
-                .context(format!("unable to execute action '{}'", action))?;
-        }
-    }
-    Ok(())
-}

crates/sprout/Cargo.toml

@@ -0,0 +1,28 @@
+[package]
+name = "edera-sprout"
+description = "Modern UEFI bootloader"
+license.workspace = true
+version.workspace = true
+homepage.workspace = true
+repository.workspace = true
+edition.workspace = true
+
+[dependencies]
+anyhow.workspace = true
+bitflags.workspace = true
+edera-sprout-config.path = "../config"
+hex.workspace = true
+sha2.workspace = true
+toml.workspace = true
+log.workspace = true
+
+[dependencies.uefi]
+workspace = true
+features = ["alloc", "logger"]
+
+[dependencies.uefi-raw]
+workspace = true
+
+[[bin]]
+name = "sprout"
+path = "src/main.rs"

crates/sprout/README.md

@@ -0,0 +1,3 @@
+# Sprout Bootloader
+
+The main bootable crate of the Sprout bootloader.

crates/sprout/build.rs

@@ -0,0 +1,57 @@
+use std::path::PathBuf;
+use std::{env, fs};
+
+/// The size of the sbat.csv file.
+const SBAT_SIZE: usize = 512;
+
+/// Generate the sbat.csv for the .sbat link section.
+///
+/// We intake a sbat.template.tsv and output a sbat.csv which is included by src/sbat.rs
+fn generate_sbat_csv() {
+    // Notify Cargo that if the Sprout version changes, we need to regenerate the sbat.csv.
+    println!("cargo:rerun-if-env-changed=CARGO_PKG_VERSION");
+
+    // The version of the sprout crate.
+    let sprout_version = env::var("CARGO_PKG_VERSION").expect("CARGO_PKG_VERSION not set");
+
+    // The output directory to place the sbat.csv into.
+    let output_dir = PathBuf::from(env::var("OUT_DIR").expect("OUT_DIR not set"));
+
+    // The output path to the sbat.csv.
+    let output_file = output_dir.join("sbat.csv");
+
+    // The path to the root of the sprout crate.
+    let sprout_root =
+        PathBuf::from(env::var("CARGO_MANIFEST_DIR").expect("CARGO_MANIFEST_DIR not set"));
+
+    // The path to the sbat.template.tsv file is in the source directory of the sprout crate.
+    let template_path = sprout_root.join("src/sbat.template.csv");
+
+    // Read the sbat.csv template file.
+    let template = fs::read_to_string(&template_path).expect("unable to read template file");
+
+    // Replace the version placeholder in the template with the actual version.
+    let sbat = template.replace("{version}", &sprout_version);
+
+    // Encode the sbat.csv as bytes.
+    let mut encoded = sbat.as_bytes().to_vec();
+
+    if encoded.len() > SBAT_SIZE {
+        panic!("sbat.csv is too large");
+    }
+
+    // Pad the sbat.csv to the required size.
+    while encoded.len() < SBAT_SIZE {
+        encoded.push(0);
+    }
+
+    // Write the sbat.csv to the output directory.
+    fs::write(&output_file, encoded).expect("unable to write sbat.csv");
+}
+
+/// Build script entry point.
+/// Right now, all we need to do is generate the sbat.csv file.
+fn main() {
+    // Generate the sbat.csv file.
+    generate_sbat_csv();
+}

crates/sprout/src/actions.rs

@@ -1,6 +1,5 @@
 use crate::context::SproutContext;
 use anyhow::{Context, Result, bail};
-use serde::{Deserialize, Serialize};
 use std::rc::Rc;
 
 /// EFI chainloader action.
@@ -10,36 +9,6 @@ pub mod edera;
 /// EFI console print action.
 pub mod print;
 
-/// Splash screen action.
-#[cfg(feature = "splash")]
-pub mod splash;
-
-/// Declares an action that sprout can execute.
-/// Actions allow configuring sprout's internal runtime mechanisms with values
-/// that you can specify via other concepts.
-///
-/// Actions are the main work that Sprout gets done, like booting Linux.
-#[derive(Serialize, Deserialize, Debug, Default, Clone)]
-pub struct ActionDeclaration {
-    /// Chainload to another EFI application.
-    /// This allows you to load any EFI application, either to boot an operating system
-    /// or to perform more EFI actions and return to sprout.
-    #[serde(default)]
-    pub chainload: Option<chainload::ChainloadConfiguration>,
-    /// Print a string to the EFI console.
-    #[serde(default)]
-    pub print: Option<print::PrintConfiguration>,
-    /// Show an image as a fullscreen splash screen.
-    #[serde(default)]
-    #[cfg(feature = "splash")]
-    pub splash: Option<splash::SplashConfiguration>,
-    /// Boot the Edera hypervisor and the root operating system.
-    /// This action is an extension on top of the Xen EFI stub that
-    /// is specific to Edera.
-    #[serde(default, rename = "edera")]
-    pub edera: Option<edera::EderaConfiguration>,
-}
-
 /// Execute the action specified by `name` which should be stored in the
 /// root context of the provided `context`. This function may not return
 /// if the provided action executes an operating system or an EFI application
@@ -67,12 +36,6 @@ pub fn execute(context: Rc<SproutContext>, name: impl AsRef<str>) -> Result<()>
         return Ok(());
     }
 
-    #[cfg(feature = "splash")]
-    if let Some(splash) = &action.splash {
-        splash::splash(context.clone(), splash)?;
-        return Ok(());
-    }
-
     // If we reach here, we don't know how to execute the action that was configured.
     // This is likely unreachable, but we should still return an error just in case.
     bail!("unknown action configuration");

crates/sprout/src/actions/chainload.rs

@@ -0,0 +1,104 @@
+use crate::context::SproutContext;
+use crate::integrations::bootloader_interface::BootloaderInterface;
+use crate::integrations::shim::{ShimInput, ShimSupport};
+use crate::utils;
+use crate::utils::media_loader::MediaLoaderHandle;
+use crate::utils::media_loader::constants::linux::LINUX_EFI_INITRD_MEDIA_GUID;
+use anyhow::{Context, Result, bail};
+use edera_sprout_config::actions::chainload::ChainloadConfiguration;
+use log::error;
+use std::rc::Rc;
+use uefi::CString16;
+use uefi::proto::loaded_image::LoadedImage;
+
+/// Executes the chainload action using the specified `configuration` inside the provided `context`.
+pub fn chainload(context: Rc<SproutContext>, configuration: &ChainloadConfiguration) -> Result<()> {
+    // Retrieve the current image handle of sprout.
+    let sprout_image = uefi::boot::image_handle();
+
+    // Resolve the path to the image to chainload.
+    let resolved = utils::resolve_path(
+        Some(context.root().loaded_image_path()?),
+        &context.stamp(&configuration.path),
+    )
+    .context("unable to resolve chainload path")?;
+
+    // Load the image to chainload using the shim support integration.
+    // It will determine if the image needs to be loaded via the shim or can be loaded directly.
+    let image = ShimSupport::load(sprout_image, ShimInput::ResolvedPath(&resolved))?;
+
+    // Open the LoadedImage protocol of the image to chainload.
+    let mut loaded_image_protocol = uefi::boot::open_protocol_exclusive::<LoadedImage>(image)
+        .context("unable to open loaded image protocol")?;
+
+    // Stamp and combine the options to pass to the image.
+    let options =
+        utils::combine_options(configuration.options.iter().map(|item| context.stamp(item)));
+
+    // Pass the load options to the image.
+    // If no options are provided, the resulting string will be empty.
+    // The options are pinned and boxed to ensure that they are valid for the lifetime of this
+    // function, which ensures the lifetime of the options for the image runtime.
+    let options = Box::pin(
+        CString16::try_from(&options[..])
+            .context("unable to convert chainloader options to CString16")?,
+    );
+
+    if options.num_bytes() > u32::MAX as usize {
+        bail!("chainloader options too large");
+    }
+
+    // SAFETY: option size is checked to validate it is safe to pass.
+    // Additionally, the pointer is allocated and retained on heap, which makes
+    // passing the `options` pointer safe to the next image.
+    unsafe {
+        loaded_image_protocol
+            .set_load_options(options.as_ptr() as *const u8, options.num_bytes() as u32);
+    }
+
+    // Stamp the initrd path, if provided.
+    let initrd = configuration
+        .linux_initrd
+        .as_ref()
+        .map(|item| context.stamp(item));
+    // The initrd can be None or empty, so we need to collapse that into a single Option.
+    let initrd = utils::empty_is_none(initrd);
+
+    // If an initrd is provided, register it with the EFI stack.
+    let mut initrd_handle = None;
+    if let Some(linux_initrd) = initrd {
+        let content =
+            utils::read_file_contents(Some(context.root().loaded_image_path()?), &linux_initrd)
+                .context("unable to read linux initrd")?;
+        let handle =
+            MediaLoaderHandle::register(LINUX_EFI_INITRD_MEDIA_GUID, content.into_boxed_slice())
+                .context("unable to register linux initrd")?;
+        initrd_handle = Some(handle);
+    }
+
+    // Mark execution of an entry in the bootloader interface.
+    BootloaderInterface::mark_exec(context.root().timer())
+        .context("unable to mark execution of boot entry in bootloader interface")?;
+
+    // Start the loaded image.
+    // This call might return, or it may pass full control to another image that will never return.
+    // Capture the result to ensure we can return an error if the image fails to start, but only
+    // after the optional initrd has been unregistered.
+    let result = uefi::boot::start_image(image);
+
+    // Unregister the initrd if it was registered.
+    if let Some(initrd_handle) = initrd_handle
+        && let Err(error) = initrd_handle.unregister()
+    {
+        error!("unable to unregister linux initrd: {}", error);
+    }
+
+    // Assert there was no error starting the image.
+    result.context("unable to start image")?;
+
+    // Explicitly drop the options to clarify the lifetime.
+    drop(options);
+
+    // Return control to sprout.
+    Ok(())
+}

crates/sprout/src/actions/edera.rs

@@ -1,12 +1,7 @@
 use std::rc::Rc;
 
-use anyhow::{Context, Result};
-use log::error;
-use serde::{Deserialize, Serialize};
-use uefi::Guid;
-
 use crate::{
-    actions::{self, chainload::ChainloadConfiguration},
+    actions,
     context::SproutContext,
     utils::{
         self,
@@ -18,26 +13,11 @@ use crate::{
         },
     },
 };
-
-/// The configuration of the edera action which boots the Edera hypervisor.
-/// Edera is based on Xen but modified significantly with a Rust stack.
-/// Sprout is a component of the Edera stack and provides the boot functionality of Xen.
-#[derive(Serialize, Deserialize, Debug, Default, Clone)]
-pub struct EderaConfiguration {
-    /// The path to the Xen hypervisor EFI image.
-    pub xen: String,
-    /// The path to the kernel to boot for dom0.
-    pub kernel: String,
-    /// The path to the initrd to load for dom0.
-    #[serde(default)]
-    pub initrd: Option<String>,
-    /// The options to pass to the kernel.
-    #[serde(default, rename = "kernel-options")]
-    pub kernel_options: Vec<String>,
-    /// The options to pass to the Xen hypervisor.
-    #[serde(default, rename = "xen-options")]
-    pub xen_options: Vec<String>,
-}
+use anyhow::{Context, Result};
+use edera_sprout_config::actions::chainload::ChainloadConfiguration;
+use edera_sprout_config::actions::edera::EderaConfiguration;
+use log::error;
+use uefi::Guid;
 
 /// Builds a configuration string for the Xen EFI stub using the specified `configuration`.
 fn build_xen_config(context: Rc<SproutContext>, configuration: &EderaConfiguration) -> String {
@@ -98,7 +78,7 @@ fn register_media_loader_file(
     // Stamp the path to the file.
     let path = context.stamp(path);
     // Read the file contents.
-    let content = utils::read_file_contents(context.root().loaded_image_path()?, &path)
+    let content = utils::read_file_contents(Some(context.root().loaded_image_path()?), &path)
         .context(format!("unable to read {} file", what))?;
     // Register the media loader.
     let handle = MediaLoaderHandle::register(guid, content.into_boxed_slice())

crates/sprout/src/actions/print.rs

@@ -1,17 +1,9 @@
 use crate::context::SproutContext;
 use anyhow::Result;
+use edera_sprout_config::actions::print::PrintConfiguration;
 use log::info;
-use serde::{Deserialize, Serialize};
 use std::rc::Rc;
 
-/// The configuration of the print action.
-#[derive(Serialize, Deserialize, Debug, Default, Clone)]
-pub struct PrintConfiguration {
-    /// The text to print to the console.
-    #[serde(default)]
-    pub text: String,
-}
-
 /// Executes the print action with the specified `configuration` inside the provided `context`.
 pub fn print(context: Rc<SproutContext>, configuration: &PrintConfiguration) -> Result<()> {
     info!("{}", context.stamp(&configuration.text));

crates/sprout/src/autoconfigure.rs

@@ -1,5 +1,5 @@
-use crate::config::RootConfiguration;
 use anyhow::{Context, Result};
+use edera_sprout_config::RootConfiguration;
 use uefi::fs::FileSystem;
 use uefi::proto::device_path::DevicePath;
 use uefi::proto::media::fs::SimpleFileSystem;

crates/sprout/src/autoconfigure/bls.rs

@@ -1,11 +1,11 @@
-use crate::actions::ActionDeclaration;
-use crate::actions::chainload::ChainloadConfiguration;
-use crate::config::RootConfiguration;
-use crate::entries::EntryDeclaration;
-use crate::generators::GeneratorDeclaration;
-use crate::generators::bls::BlsConfiguration;
 use crate::utils;
 use anyhow::{Context, Result};
+use edera_sprout_config::RootConfiguration;
+use edera_sprout_config::actions::ActionDeclaration;
+use edera_sprout_config::actions::chainload::ChainloadConfiguration;
+use edera_sprout_config::entries::EntryDeclaration;
+use edera_sprout_config::generators::GeneratorDeclaration;
+use edera_sprout_config::generators::bls::BlsConfiguration;
 use uefi::cstr16;
 use uefi::fs::{FileSystem, Path};
 use uefi::proto::device_path::DevicePath;
@@ -72,7 +72,7 @@ pub fn scan(
 
     // Generate a unique name for the BLS generator and insert the generator into the configuration.
     config.generators.insert(
-        format!("autoconfigure-bls-{}", root_unique_hash),
+        format!("auto-bls-{}", root_unique_hash),
         GeneratorDeclaration {
             bls: Some(generator),
             ..Default::default()

crates/sprout/src/autoconfigure/linux.rs

@@ -1,14 +1,15 @@
-use crate::actions::ActionDeclaration;
-use crate::actions::chainload::ChainloadConfiguration;
-use crate::config::RootConfiguration;
-use crate::entries::EntryDeclaration;
-use crate::generators::GeneratorDeclaration;
-use crate::generators::list::ListConfiguration;
 use crate::utils;
+use crate::utils::vercmp;
 use anyhow::{Context, Result};
+use edera_sprout_config::RootConfiguration;
+use edera_sprout_config::actions::ActionDeclaration;
+use edera_sprout_config::actions::chainload::ChainloadConfiguration;
+use edera_sprout_config::entries::EntryDeclaration;
+use edera_sprout_config::generators::GeneratorDeclaration;
+use edera_sprout_config::generators::list::ListConfiguration;
 use std::collections::BTreeMap;
 use uefi::CString16;
-use uefi::fs::{FileSystem, Path};
+use uefi::fs::{FileSystem, Path, PathBuf};
 use uefi::proto::device_path::DevicePath;
 use uefi::proto::device_path::text::{AllowShortcuts, DisplayOnly};
 
@@ -17,7 +18,8 @@ const LINUX_CHAINLOAD_ACTION_PREFIX: &str = "linux-chainload-";
 
 /// The locations to scan for kernel pairs.
 /// We will check for symlinks and if this directory is a symlink, we will skip it.
-const SCAN_LOCATIONS: &[&str] = &["/boot", "/"];
+/// The empty string represents the root of the filesystem.
+const SCAN_LOCATIONS: &[&str] = &["\\boot", "\\"];
 
 /// Prefixes of kernel files to scan for.
 const KERNEL_PREFIXES: &[&str] = &["vmlinuz"];
@@ -25,6 +27,18 @@ const KERNEL_PREFIXES: &[&str] = &["vmlinuz"];
 /// Prefixes of initramfs files to match to.
 const INITRAMFS_PREFIXES: &[&str] = &["initramfs", "initrd", "initrd.img"];
 
+/// This is really silly, but if what we are booting is the Canonical stubble stub,
+/// there is a chance it will assert that the load options are non-empty.
+/// Technically speaking, load options can be empty. However, it assumes load options
+/// have something in it. Canonical's stubble copied code from systemd that does this
+/// and then uses that code improperly by asserting that the pointer is non-null.
+/// To give a good user experience, we place a placeholder value here to ensure it's non-empty.
+/// For stubble, this code ensures the command line pointer becomes null:
+/// https://github.com/ubuntu/stubble/blob/e56643979addfb98982266018e08921c07424a0c/stub.c#L61-L64
+/// Then this code asserts on it, stopping the boot process:
+/// https://github.com/ubuntu/stubble/blob/e56643979addfb98982266018e08921c07424a0c/stub.c#L27
+const DEFAULT_LINUX_OPTIONS: &str = "placeholder";
+
 /// Pair of kernel and initramfs.
 /// This is what scanning a directory is meant to find.
 struct KernelPair {
@@ -39,6 +53,9 @@ fn scan_directory(filesystem: &mut FileSystem, path: &str) -> Result<Vec<KernelP
     // All the discovered kernel pairs.
     let mut pairs = Vec::new();
 
+    // We have to special-case the root directory due to path logic in the uefi crate.
+    let is_root = path.is_empty() || path == "\\";
+
     // Construct a filesystem path from the path string.
     let path = CString16::try_from(path).context("unable to convert path to CString16")?;
     let path = Path::new(&path);
@@ -62,6 +79,16 @@ fn scan_directory(filesystem: &mut FileSystem, path: &str) -> Result<Vec<KernelP
         return Ok(pairs);
     };
 
+    // Create a new path used for joining file names below.
+    // All attempts to derive paths for the files in the directory should use this instead.
+    // The uefi crate does not handle push correctly for the root directory.
+    // It will add a second slash, which will cause our path logic to fail.
+    let path_for_join = if is_root {
+        PathBuf::new()
+    } else {
+        path.clone()
+    };
+
     // For each item in the directory, find a kernel.
     for item in directory {
         let item = item.context("unable to read directory item")?;
@@ -74,11 +101,14 @@ fn scan_directory(filesystem: &mut FileSystem, path: &str) -> Result<Vec<KernelP
         // Convert the name from a CString16 to a String.
         let name = item.file_name().to_string();
 
+        // Convert the name to lowercase to make all of this case-insensitive.
+        let name_for_match = name.to_lowercase();
+
         // Find a kernel prefix that matches, if any.
-        let Some(prefix) = KERNEL_PREFIXES
-            .iter()
-            .find(|prefix| name == **prefix || name.starts_with(&format!("{}-", prefix)))
-        else {
+        // This is case-insensitive to ensure we pick up all possibilities.
+        let Some(prefix) = KERNEL_PREFIXES.iter().find(|prefix| {
+            name_for_match == **prefix || name_for_match.starts_with(&format!("{}-", prefix))
+        }) else {
             // Skip over anything that doesn't match a kernel prefix.
             continue;
         };
@@ -96,8 +126,9 @@ fn scan_directory(filesystem: &mut FileSystem, path: &str) -> Result<Vec<KernelP
             let initramfs = format!("{}{}", prefix, suffix);
             let initramfs = CString16::try_from(initramfs.as_str())
                 .context("unable to convert initramfs name to CString16")?;
-            let mut initramfs_path = path.clone();
+            let mut initramfs_path = path_for_join.clone();
             initramfs_path.push(Path::new(&initramfs));
+
             // Check if the initramfs path exists, if it does, break out of the loop.
             if filesystem
                 .try_exists(&initramfs_path)
@@ -108,7 +139,7 @@ fn scan_directory(filesystem: &mut FileSystem, path: &str) -> Result<Vec<KernelP
         };
 
         // Construct a kernel path from the kernel name.
-        let mut kernel = path.clone();
+        let mut kernel = path_for_join.clone();
         kernel.push(Path::new(&item.file_name()));
         let kernel = kernel.to_string();
         let initramfs = matched_initramfs_path.map(|initramfs_path| initramfs_path.to_string());
@@ -152,6 +183,9 @@ pub fn scan(
         return Ok(false);
     }
 
+    // Sort the kernel pairs by kernel version, if it has one, newer kernels first.
+    pairs.sort_by(|a, b| vercmp::compare_versions(&a.kernel, &b.kernel).reverse());
+
     // Generate a unique name for the linux chainload action.
     let chainload_action_name = format!("{}{}", LINUX_CHAINLOAD_ACTION_PREFIX, root_unique_hash,);
 
@@ -181,7 +215,7 @@ pub fn scan(
 
     // Generate a unique name for the Linux generator and insert the generator into the configuration.
     config.generators.insert(
-        format!("autoconfigure-linux-{}", root_unique_hash),
+        format!("auto-linux-{}", root_unique_hash),
         GeneratorDeclaration {
             list: Some(generator),
             ..Default::default()
@@ -190,9 +224,10 @@ pub fn scan(
 
     // Insert a default value for the linux-options if it doesn't exist.
     if !config.values.contains_key("linux-options") {
-        config
-            .values
-            .insert("linux-options".to_string(), "".to_string());
+        config.values.insert(
+            "linux-options".to_string(),
+            DEFAULT_LINUX_OPTIONS.to_string(),
+        );
     }
 
     // Generate a chainload configuration for the list generator.

crates/sprout/src/autoconfigure/windows.rs

@@ -1,9 +1,9 @@
-use crate::actions::ActionDeclaration;
-use crate::actions::chainload::ChainloadConfiguration;
-use crate::config::RootConfiguration;
-use crate::entries::EntryDeclaration;
 use crate::utils;
 use anyhow::{Context, Result};
+use edera_sprout_config::RootConfiguration;
+use edera_sprout_config::actions::ActionDeclaration;
+use edera_sprout_config::actions::chainload::ChainloadConfiguration;
+use edera_sprout_config::entries::EntryDeclaration;
 use uefi::CString16;
 use uefi::fs::{FileSystem, Path};
 use uefi::proto::device_path::DevicePath;
@@ -49,7 +49,7 @@ pub fn scan(
     let chainload_action_name = format!("{}{}", WINDOWS_CHAINLOAD_ACTION_PREFIX, root_unique_hash,);
 
     // Generate an entry name for Windows.
-    let entry_name = format!("autoconfigure-windows-{}", root_unique_hash,);
+    let entry_name = format!("auto-windows-{}", root_unique_hash,);
 
     // Create an entry for Windows and insert it into the configuration.
     let entry = EntryDeclaration {

crates/sprout/src/config.rs

@@ -0,0 +1,2 @@
+/// The configuration loader mechanisms.
+pub mod loader;

crates/sprout/src/config/loader.rs

@@ -1,7 +1,8 @@
-use crate::config::{RootConfiguration, latest_version};
 use crate::options::SproutOptions;
+use crate::platform::tpm::PlatformTpm;
 use crate::utils;
 use anyhow::{Context, Result, bail};
+use edera_sprout_config::{RootConfiguration, latest_version};
 use log::info;
 use std::ops::Deref;
 use toml::Value;
@@ -19,8 +20,17 @@ fn load_raw_config(options: &SproutOptions) -> Result<Vec<u8>> {
     info!("configuration file: {}", options.config);
 
     // Read the contents of the sprout config file.
-    let content = utils::read_file_contents(&path, &options.config)
+    let content = utils::read_file_contents(Some(&path), &options.config)
         .context("unable to read sprout config file")?;
+
+    // Measure the sprout.toml into the TPM, if needed and possible.
+    PlatformTpm::log_event(
+        PlatformTpm::PCR_BOOT_LOADER_CONFIG,
+        &content,
+        "sprout: configuration file",
+    )
+    .context("unable to measure the sprout.toml file into the TPM")?;
+
     // Return the contents of the sprout config file.
     Ok(content)
 }

crates/sprout/src/context.rs

@@ -1,7 +1,8 @@
-use crate::actions::ActionDeclaration;
 use crate::options::SproutOptions;
+use crate::platform::timer::PlatformTimer;
 use anyhow::anyhow;
 use anyhow::{Result, bail};
+use edera_sprout_config::actions::ActionDeclaration;
 use std::cmp::Reverse;
 use std::collections::{BTreeMap, BTreeSet};
 use std::rc::Rc;
@@ -12,22 +13,29 @@ const CONTEXT_FINALIZE_ITERATION_LIMIT: usize = 100;
 
 /// Declares a root context for Sprout.
 /// This contains data that needs to be shared across Sprout.
-#[derive(Default)]
 pub struct RootContext {
     /// The actions that are available in Sprout.
     actions: BTreeMap<String, ActionDeclaration>,
     /// The device path of the loaded Sprout image.
     loaded_image_path: Option<Box<DevicePath>>,
+    /// Platform timer started at the beginning of the boot process.
+    timer: PlatformTimer,
     /// The global options of Sprout.
     options: SproutOptions,
 }
 
 impl RootContext {
     /// Creates a new root context with the `loaded_image_device_path` which will be stored
-    /// in the context for easy access.
-    pub fn new(loaded_image_device_path: Box<DevicePath>, options: SproutOptions) -> Self {
+    /// in the context for easy access. We also provide a `timer` which is used to measure elapsed
+    /// time for the bootloader.
+    pub fn new(
+        loaded_image_device_path: Box<DevicePath>,
+        timer: PlatformTimer,
+        options: SproutOptions,
+    ) -> Self {
         Self {
             actions: BTreeMap::new(),
+            timer,
             loaded_image_path: Some(loaded_image_device_path),
             options,
         }
@@ -43,6 +51,11 @@ impl RootContext {
         &mut self.actions
     }
 
+    /// Access the platform timer that is started at the beginning of the boot process.
+    pub fn timer(&self) -> &PlatformTimer {
+        &self.timer
+    }
+
     /// Access the device path of the loaded Sprout image.
     pub fn loaded_image_path(&self) -> Result<&DevicePath> {
         self.loaded_image_path
@@ -206,6 +219,14 @@ impl SproutContext {
 
     /// Stamps the `text` value with the specified `values` map. The returned value indicates
     /// whether the `text` has been changed and the value that was stamped and changed.
+    ///
+    /// Stamping works like this:
+    /// - Start with the input text.
+    /// - Sort all the keys in reverse length order (longest keys first)
+    /// - For each key, if the key is not empty, replace $KEY in the text.
+    /// - Each follow-up iteration acts upon the last iterations result.
+    /// - We keep track if the text changes during the replacement.
+    /// - We return both whether the text changed during any iteration and the final result.
     fn stamp_values(values: &BTreeMap<String, String>, text: impl AsRef<str>) -> (bool, String) {
         let mut result = text.as_ref().to_string();
         let mut did_change = false;

crates/sprout/src/drivers.rs

@@ -1,50 +1,28 @@
 use crate::context::SproutContext;
+use crate::integrations::shim::{ShimInput, ShimSupport};
 use crate::utils;
 use anyhow::{Context, Result};
+pub(crate) use edera_sprout_config::drivers::DriverDeclaration;
 use log::info;
-use serde::{Deserialize, Serialize};
 use std::collections::BTreeMap;
 use std::rc::Rc;
 use uefi::boot::SearchType;
-use uefi::proto::device_path::LoadedImageDevicePath;
-
-/// Declares a driver configuration.
-/// Drivers allow extending the functionality of Sprout.
-/// Drivers are loaded at runtime and can provide extra functionality like filesystem support.
-/// Drivers are loaded by their name, which is used to reference them in other concepts.
-#[derive(Serialize, Deserialize, Debug, Default, Clone)]
-pub struct DriverDeclaration {
-    /// The filesystem path to the driver.
-    /// This file should be an EFI executable that can be located and executed.
-    pub path: String,
-}
 
 /// Loads the driver specified by the `driver` declaration.
 fn load_driver(context: Rc<SproutContext>, driver: &DriverDeclaration) -> Result<()> {
     // Acquire the handle and device path of the loaded image.
     let sprout_image = uefi::boot::image_handle();
-    let image_device_path_protocol =
-        uefi::boot::open_protocol_exclusive::<LoadedImageDevicePath>(sprout_image)
-            .context("unable to open loaded image device path protocol")?;
 
-    // Get the device path root of the sprout image.
-    let mut full_path = utils::device_path_root(&image_device_path_protocol)?;
-
-    // Push the path of the driver from the root.
-    full_path.push_str(&context.stamp(&driver.path));
-
-    // Convert the path to a device path.
-    let device_path = utils::text_to_device_path(&full_path)?;
-
-    // Load the driver image.
-    let image = uefi::boot::load_image(
-        sprout_image,
-        uefi::boot::LoadImageSource::FromDevicePath {
-            device_path: &device_path,
-            boot_policy: uefi::proto::BootPolicy::ExactMatch,
-        },
+    // Resolve the path to the driver image.
+    let resolved = utils::resolve_path(
+        Some(context.root().loaded_image_path()?),
+        &context.stamp(&driver.path),
     )
-    .context("unable to load image")?;
+    .context("unable to resolve path to driver")?;
+
+    // Load the driver image using the shim support integration.
+    // It will determine if the image needs to be loaded via the shim or can be loaded directly.
+    let image = ShimSupport::load(sprout_image, ShimInput::ResolvedPath(&resolved))?;
 
     // Start the driver image, this is expected to return control to sprout.
     // There is no guarantee that the driver will actually return control as it is

crates/sprout/src/entries.rs

@@ -1,25 +1,7 @@
 use crate::context::SproutContext;
-use serde::{Deserialize, Serialize};
-use std::collections::BTreeMap;
+use edera_sprout_config::entries::EntryDeclaration;
 use std::rc::Rc;
 
-/// Declares a boot entry to display in the boot menu.
-///
-/// Entries are the user-facing concept of Sprout, making it possible
-/// to run a set of actions with a specific context.
-#[derive(Serialize, Deserialize, Debug, Default, Clone)]
-pub struct EntryDeclaration {
-    /// The title of the entry which will be display in the boot menu.
-    /// This is the pre-stamped value.
-    pub title: String,
-    /// The actions to run when the entry is selected.
-    #[serde(default)]
-    pub actions: Vec<String>,
-    /// The values to insert into the context when the entry is selected.
-    #[serde(default)]
-    pub values: BTreeMap<String, String>,
-}
-
 /// Represents an entry that is stamped and ready to be booted.
 #[derive(Clone)]
 pub struct BootableEntry {
@@ -28,6 +10,7 @@ pub struct BootableEntry {
     context: Rc<SproutContext>,
     declaration: EntryDeclaration,
     default: bool,
+    pin_name: bool,
 }
 
 impl BootableEntry {
@@ -44,6 +27,7 @@ impl BootableEntry {
             context,
             declaration,
             default: false,
+            pin_name: false,
         }
     }
 
@@ -72,6 +56,11 @@ impl BootableEntry {
         self.default
     }
 
+    /// Fetch whether the entry is pinned, which prevents prefixing.
+    pub fn is_pin_name(&self) -> bool {
+        self.pin_name
+    }
+
     /// Swap out the context of the entry.
     pub fn swap_context(&mut self, context: Rc<SproutContext>) {
         self.context = context;
@@ -87,6 +76,16 @@ impl BootableEntry {
         self.default = true;
     }
 
+    // Unmark this entry as the default entry.
+    pub fn unmark_default(&mut self) {
+        self.default = false;
+    }
+
+    /// Mark this entry as being pinned, which prevents prefixing.
+    pub fn mark_pin_name(&mut self) {
+        self.pin_name = true;
+    }
+
     /// Prepend the name of the entry with `prefix`.
     pub fn prepend_name_prefix(&mut self, prefix: &str) {
         self.name.insert_str(0, prefix);

crates/sprout/src/extractors.rs

@@ -0,0 +1,18 @@
+use crate::context::SproutContext;
+use anyhow::{Result, bail};
+use edera_sprout_config::extractors::ExtractorDeclaration;
+use std::rc::Rc;
+
+/// The filesystem device match extractor.
+pub mod filesystem_device_match;
+
+/// Extracts the value using the specified `extractor` under the provided `context`.
+/// The extractor must return a value, and if a value cannot be determined, an error
+/// should be returned.
+pub fn extract(context: Rc<SproutContext>, extractor: &ExtractorDeclaration) -> Result<String> {
+    if let Some(filesystem) = &extractor.filesystem_device_match {
+        filesystem_device_match::extract(context, filesystem)
+    } else {
+        bail!("unknown extractor configuration");
+    }
+}

crates/sprout/src/extractors/filesystem_device_match.rs

@@ -1,7 +1,7 @@
 use crate::context::SproutContext;
 use crate::utils;
 use anyhow::{Context, Result, anyhow, bail};
-use serde::{Deserialize, Serialize};
+use edera_sprout_config::extractors::filesystem_device_match::FilesystemDeviceMatchExtractor;
 use std::ops::Deref;
 use std::rc::Rc;
 use std::str::FromStr;
@@ -9,85 +9,22 @@ use uefi::fs::{FileSystem, Path};
 use uefi::proto::device_path::DevicePath;
 use uefi::proto::media::file::{File, FileSystemVolumeLabel};
 use uefi::proto::media::fs::SimpleFileSystem;
-use uefi::proto::media::partition::PartitionInfo;
-use uefi::{CString16, Guid, Handle};
-use uefi_raw::Status;
-
-/// The filesystem device match extractor.
-/// This extractor finds a filesystem using some search criteria and returns
-/// the device root path that can concatenated with subpaths to access files
-/// on a particular filesystem.
-/// The fallback value can be used to provide a value if no match is found.
-///
-/// This extractor requires all the criteria to match. If no criteria is provided,
-/// an error is returned.
-#[derive(Serialize, Deserialize, Debug, Default, Clone)]
-pub struct FilesystemDeviceMatchExtractor {
-    /// Matches a filesystem that has the specified label.
-    #[serde(default, rename = "has-label")]
-    pub has_label: Option<String>,
-    /// Matches a filesystem that has the specified item.
-    /// An item is either a directory or file.
-    #[serde(default, rename = "has-item")]
-    pub has_item: Option<String>,
-    /// Matches a filesystem that has the specified partition UUID.
-    #[serde(default, rename = "has-partition-uuid")]
-    pub has_partition_uuid: Option<String>,
-    /// Matches a filesystem that has the specified partition type UUID.
-    #[serde(default, rename = "has-partition-type-uuid")]
-    pub has_partition_type_uuid: Option<String>,
-    /// The fallback value to use if no filesystem matches the criteria.
-    #[serde(default)]
-    pub fallback: Option<String>,
-}
-
-/// Represents the partition UUIDs for a filesystem.
-struct PartitionIds {
-    /// The UUID of the partition.
-    partition_uuid: Guid,
-    /// The type UUID of the partition.
-    type_uuid: Guid,
-}
-
-/// Fetches the partition UUIDs for the specified filesystem handle.
-fn fetch_partition_uuids(handle: Handle) -> Result<Option<PartitionIds>> {
-    // Open the partition info protocol for this handle.
-    let partition_info = uefi::boot::open_protocol_exclusive::<PartitionInfo>(handle);
-
-    match partition_info {
-        Ok(partition_info) => {
-            // GPT partitions have a unique partition GUID.
-            // MBR does not.
-            if let Some(gpt) = partition_info.gpt_partition_entry() {
-                let uuid = gpt.unique_partition_guid;
-                let type_uuid = gpt.partition_type_guid;
-                Ok(Some(PartitionIds {
-                    partition_uuid: uuid,
-                    type_uuid: type_uuid.0,
-                }))
-            } else {
-                Ok(None)
-            }
-        }
-
-        Err(error) => {
-            // If the filesystem does not have a partition, that is okay.
-            if error.status() == Status::NOT_FOUND || error.status() == Status::UNSUPPORTED {
-                Ok(None)
-            } else {
-                // We should still handle other errors gracefully.
-                Err(error).context("unable to open filesystem partition info")?;
-                unreachable!()
-            }
-        }
-    }
-}
+use uefi::{CString16, Guid};
 
 /// Extract a filesystem device path using the specified `context` and `extractor` configuration.
 pub fn extract(
     context: Rc<SproutContext>,
     extractor: &FilesystemDeviceMatchExtractor,
 ) -> Result<String> {
+    // If no criteria are provided, bail with an error.
+    if extractor.has_label.is_none()
+        && extractor.has_item.is_none()
+        && extractor.has_partition_uuid.is_none()
+        && extractor.has_partition_type_uuid.is_none()
+    {
+        bail!("at least one criteria is required for filesystem-device-match");
+    }
+
     // Find all the filesystems inside the UEFI stack.
     let handles = uefi::boot::find_handles::<SimpleFileSystem>()
         .context("unable to find filesystem handles")?;
@@ -97,30 +34,49 @@ pub fn extract(
         // This defines whether a match has been found.
         let mut has_match = false;
 
-        // Extract the partition info for this filesystem.
-        // There is no guarantee that the filesystem has a partition.
-        let partition_info =
-            fetch_partition_uuids(handle).context("unable to fetch partition info")?;
-
         // Check if the partition info matches partition uuid criteria.
-        if let Some(ref partition_info) = partition_info
-            && let Some(ref has_partition_uuid) = extractor.has_partition_uuid
-        {
+        if let Some(ref has_partition_uuid) = extractor.has_partition_uuid {
+            // Parse the partition uuid from the extractor.
             let parsed_uuid = Guid::from_str(has_partition_uuid)
                 .map_err(|e| anyhow!("unable to parse has-partition-uuid: {}", e))?;
-            if partition_info.partition_uuid != parsed_uuid {
+
+            // Fetch the root of the device.
+            let root = uefi::boot::open_protocol_exclusive::<DevicePath>(handle)
+                .context("unable to fetch the device path of the filesystem")?
+                .deref()
+                .to_boxed();
+
+            // Fetch the partition uuid for this filesystem.
+            let partition_uuid = utils::partition_guid(&root, utils::PartitionGuidForm::Partition)
+                .context("unable to fetch the partition uuid of the filesystem")?;
+
+            // Compare the partition uuid to the parsed uuid.
+            // If it does not match, continue to the next filesystem.
+            if partition_uuid != Some(parsed_uuid) {
                 continue;
             }
             has_match = true;
         }
 
         // Check if the partition info matches partition type uuid criteria.
-        if let Some(ref partition_info) = partition_info
-            && let Some(ref has_partition_type_uuid) = extractor.has_partition_type_uuid
-        {
+        if let Some(ref has_partition_type_uuid) = extractor.has_partition_type_uuid {
+            // Parse the partition type uuid from the extractor.
             let parsed_uuid = Guid::from_str(has_partition_type_uuid)
                 .map_err(|e| anyhow!("unable to parse has-partition-type-uuid: {}", e))?;
-            if partition_info.type_uuid != parsed_uuid {
+
+            // Fetch the root of the device.
+            let root = uefi::boot::open_protocol_exclusive::<DevicePath>(handle)
+                .context("unable to fetch the device path of the filesystem")?
+                .deref()
+                .to_boxed();
+
+            // Fetch the partition type uuid for this filesystem.
+            let partition_type_uuid =
+                utils::partition_guid(&root, utils::PartitionGuidForm::PartitionType)
+                    .context("unable to fetch the partition uuid of the filesystem")?;
+            // Compare the partition type uuid to the parsed uuid.
+            // If it does not match, continue to the next filesystem.
+            if partition_type_uuid != Some(parsed_uuid) {
                 continue;
             }
             has_match = true;
@@ -154,14 +110,11 @@ pub fn extract(
             let mut filesystem = FileSystem::new(filesystem);
 
             // Check the metadata of the item.
-            let metadata = filesystem.metadata(Path::new(&want_item));
-
             // Ignore filesystem errors as we can't do anything useful with the error.
-            if metadata.is_err() {
+            let Some(metadata) = filesystem.metadata(Path::new(&want_item)).ok() else {
                 continue;
-            }
+            };
 
-            let metadata = metadata?;
             // Only check directories and files.
             if !(metadata.is_directory() || metadata.is_regular_file()) {
                 continue;

crates/sprout/src/generators.rs

@@ -0,0 +1,33 @@
+use crate::context::SproutContext;
+use crate::entries::BootableEntry;
+use anyhow::Result;
+use anyhow::bail;
+use edera_sprout_config::generators::GeneratorDeclaration;
+use std::rc::Rc;
+
+/// The BLS generator.
+pub mod bls;
+
+/// The list generator.
+pub mod list;
+
+/// The matrix generator.
+pub mod matrix;
+
+/// Runs the generator specified by the `generator` option.
+/// It uses the specified `context` as the parent context for
+/// the generated entries, injecting more values if needed.
+pub fn generate(
+    context: Rc<SproutContext>,
+    generator: &GeneratorDeclaration,
+) -> Result<Vec<BootableEntry>> {
+    if let Some(matrix) = &generator.matrix {
+        matrix::generate(context, matrix)
+    } else if let Some(bls) = &generator.bls {
+        bls::generate(context, bls)
+    } else if let Some(list) = &generator.list {
+        list::generate(context, list)
+    } else {
+        bail!("unknown generator configuration");
+    }
+}

crates/sprout/src/generators/bls.rs

@@ -0,0 +1,208 @@
+use crate::context::SproutContext;
+use crate::entries::BootableEntry;
+use crate::generators::bls::entry::BlsEntry;
+use crate::utils;
+use crate::utils::vercmp;
+use anyhow::{Context, Result};
+use edera_sprout_config::generators::bls::BlsConfiguration;
+use std::cmp::Ordering;
+use std::rc::Rc;
+use std::str::FromStr;
+use uefi::cstr16;
+use uefi::fs::{FileSystem, PathBuf};
+use uefi::proto::device_path::text::{AllowShortcuts, DisplayOnly};
+use uefi::proto::media::fs::SimpleFileSystem;
+
+/// BLS entry parser.
+mod entry;
+
+// TODO(azenla): remove this once variable substitution is implemented.
+/// This function is used to remove the `tuned_initrd` variable from entry values.
+/// Fedora uses tuned which adds an initrd that shouldn't be used.
+fn quirk_initrd_remove_tuned(input: String) -> String {
+    input.replace("$tuned_initrd", "").trim().to_string()
+}
+
+/// Sorts two entries according to the BLS sort system.
+/// Reference: https://uapi-group.org/specifications/specs/boot_loader_specification/#sorting
+fn sort_entries(a: &(BlsEntry, BootableEntry), b: &(BlsEntry, BootableEntry)) -> Ordering {
+    // Grab the components of both entries.
+    let (a_bls, a_boot) = a;
+    let (b_bls, b_boot) = b;
+
+    // Grab the sort keys from both entries.
+    let a_sort_key = a_bls.sort_key();
+    let b_sort_key = b_bls.sort_key();
+
+    // Compare the sort keys of both entries.
+    match a_sort_key.cmp(&b_sort_key) {
+        // If A and B sort keys are equal, sort by machine-id.
+        Ordering::Equal => {
+            // Grab the machine-id from both entries.
+            let a_machine_id = a_bls.machine_id();
+            let b_machine_id = b_bls.machine_id();
+
+            // Compare the machine-id of both entries.
+            match a_machine_id.cmp(&b_machine_id) {
+                // If both machine-id values are equal, sort by version.
+                Ordering::Equal => {
+                    // Grab the version from both entries.
+                    let a_version = a_bls.version();
+                    let b_version = b_bls.version();
+
+                    // Compare the version of both entries, sorting newer versions first.
+                    match vercmp::compare_versions_optional(
+                        a_version.as_deref(),
+                        b_version.as_deref(),
+                    )
+                    .reverse()
+                    {
+                        // If both versions are equal, sort by file name in reverse order.
+                        Ordering::Equal => {
+                            // Grab the file name from both entries.
+                            let a_name = a_boot.name();
+                            let b_name = b_boot.name();
+
+                            // Compare the file names of both entries, sorting newer entries first.
+                            vercmp::compare_versions(a_name, b_name).reverse()
+                        }
+                        other => other,
+                    }
+                }
+                other => other,
+            }
+        }
+
+        other => other,
+    }
+}
+
+/// Generates entries from the BLS entries directory using the specified `bls` configuration and
+/// `context`. The BLS conversion is best-effort and will ignore any unsupported entries.
+pub fn generate(context: Rc<SproutContext>, bls: &BlsConfiguration) -> Result<Vec<BootableEntry>> {
+    let mut entries = Vec::new();
+
+    // Stamp the path to the BLS directory.
+    let path = context.stamp(&bls.path);
+
+    // Resolve the path to the BLS directory.
+    let bls_resolved = utils::resolve_path(Some(context.root().loaded_image_path()?), &path)
+        .context("unable to resolve bls path")?;
+
+    // Construct a filesystem path to the BLS entries directory.
+    let mut entries_path = PathBuf::from(
+        bls_resolved
+            .sub_path
+            .to_string(DisplayOnly(false), AllowShortcuts(false))
+            .context("unable to convert bls path to string")?,
+    );
+    entries_path.push(cstr16!("entries"));
+
+    // Open exclusive access to the BLS filesystem.
+    let fs =
+        uefi::boot::open_protocol_exclusive::<SimpleFileSystem>(bls_resolved.filesystem_handle)
+            .context("unable to open bls filesystem")?;
+    let mut fs = FileSystem::new(fs);
+
+    // Read the BLS entries directory.
+    let entries_iter = fs
+        .read_dir(&entries_path)
+        .context("unable to read bls entries")?;
+
+    // For each entry in the BLS entries directory, parse the entry and add it to the list.
+    for entry in entries_iter {
+        // Unwrap the entry file info.
+        let entry = entry.context("unable to read bls item entry")?;
+
+        // Skip items that are not regular files.
+        if !entry.is_regular_file() {
+            continue;
+        }
+
+        // Get the file name of the filesystem item.
+        let mut name = entry.file_name().to_string();
+
+        // Ignore files that are not .conf files.
+        if !name.to_lowercase().ends_with(".conf") {
+            continue;
+        }
+
+        // Remove the .conf extension.
+        name.truncate(name.len() - 5);
+
+        // Skip over files that are named just ".conf" as they are not valid entry files.
+        if name.is_empty() {
+            continue;
+        }
+
+        // Create a mutable path so we can append the file name to produce the full path.
+        let mut full_entry_path = entries_path.to_path_buf();
+        full_entry_path.push(entry.file_name());
+
+        // Read the entry file.
+        let content = fs
+            .read(full_entry_path)
+            .context("unable to read bls file")?;
+
+        // Parse the entry file as a UTF-8 string.
+        let content = String::from_utf8(content).context("unable to read bls entry as utf8")?;
+
+        // Parse the entry file as a BLS entry.
+        let entry = BlsEntry::from_str(&content).context("unable to parse bls entry")?;
+
+        // Ignore entries that are not valid for Sprout.
+        if !entry.is_valid() {
+            continue;
+        }
+
+        // Produce a new sprout context for the entry with the extracted values.
+        let mut context = context.fork();
+
+        let title_base = entry.title().unwrap_or_else(|| name.clone());
+        let chainload = entry.chainload_path().unwrap_or_default();
+        let options = entry.options().unwrap_or_default();
+        let version = entry.version().unwrap_or_default();
+        let machine_id = entry.machine_id().unwrap_or_default();
+
+        // Put the initrd through a quirk modifier to support Fedora.
+        let initrd = quirk_initrd_remove_tuned(entry.initrd_path().unwrap_or_default());
+
+        // Combine the title with the version if a version is present, except if it already contains it.
+        // Sometimes BLS will have a version in the title already, and this makes it unique.
+        let title_full = if !version.is_empty() && !title_base.contains(&version) {
+            format!("{} {}", title_base, version)
+        } else {
+            title_base.clone()
+        };
+
+        context.set("title-base", title_base);
+        context.set("title", title_full);
+        context.set("chainload", chainload);
+        context.set("options", options);
+        context.set("initrd", initrd);
+        context.set("version", version);
+        context.set("machine-id", machine_id);
+
+        // Produce a new bootable entry.
+        let mut boot = BootableEntry::new(
+            name,
+            bls.entry.title.clone(),
+            context.freeze(),
+            bls.entry.clone(),
+        );
+
+        // Pin the entry name to prevent prefixing.
+        // This is needed as the bootloader interface requires the name to be
+        // the same as the entry file name, minus the .conf extension.
+        boot.mark_pin_name();
+
+        // Add the BLS entry to the list, along with the bootable entry.
+        entries.push((entry, boot));
+    }
+
+    // Sort all the entries according to the BLS sort system.
+    entries.sort_by(sort_entries);
+
+    // Collect all the bootable entries and return them.
+    Ok(entries.into_iter().map(|(_, boot)| boot).collect())
+}

crates/sprout/src/generators/bls/entry.rs

@@ -15,6 +15,12 @@ pub struct BlsEntry {
     pub initrd: Option<String>,
     /// The path to an EFI image.
     pub efi: Option<String>,
+    /// The sort key for the entry.
+    pub sort_key: Option<String>,
+    /// The version of the entry.
+    pub version: Option<String>,
+    /// The machine id of the entry.
+    pub machine_id: Option<String>,
 }
 
 /// Parser for a BLS entry.
@@ -30,6 +36,9 @@ impl FromStr for BlsEntry {
         let mut linux: Option<String> = None;
         let mut initrd: Option<String> = None;
         let mut efi: Option<String> = None;
+        let mut sort_key: Option<String> = None;
+        let mut version: Option<String> = None;
+        let mut machine_id: Option<String> = None;
 
         // Iterate over each line in the input and parse it.
         for line in input.lines() {
@@ -74,6 +83,18 @@ impl FromStr for BlsEntry {
                     efi = Some(value.trim().to_string());
                 }
 
+                "sort-key" => {
+                    sort_key = Some(value.trim().to_string());
+                }
+
+                "version" => {
+                    version = Some(value.trim().to_string());
+                }
+
+                "machine-id" => {
+                    machine_id = Some(value.trim().to_string());
+                }
+
                 // Ignore any other key.
                 _ => {
                     continue;
@@ -88,6 +109,9 @@ impl FromStr for BlsEntry {
             linux,
             initrd,
             efi,
+            sort_key,
+            version,
+            machine_id,
         })
     }
 }
@@ -125,4 +149,19 @@ impl BlsEntry {
     pub fn title(&self) -> Option<String> {
         self.title.clone()
     }
+
+    /// Fetches the sort key of the entry, if any.
+    pub fn sort_key(&self) -> Option<String> {
+        self.sort_key.clone()
+    }
+
+    /// Fetches the version of the entry, if any.
+    pub fn version(&self) -> Option<String> {
+        self.version.clone()
+    }
+
+    /// Fetches the machine id of the entry, if any.
+    pub fn machine_id(&self) -> Option<String> {
+        self.machine_id.clone()
+    }
 }

crates/sprout/src/generators/list.rs

@@ -1,24 +1,10 @@
 use crate::context::SproutContext;
-use crate::entries::{BootableEntry, EntryDeclaration};
+use crate::entries::BootableEntry;
 use anyhow::Result;
-use serde::{Deserialize, Serialize};
-use std::collections::BTreeMap;
+use edera_sprout_config::generators::list::ListConfiguration;
 use std::rc::Rc;
 
-/// List generator configuration.
-/// The list generator produces multiple entries based
-/// on a set of input maps.
-#[derive(Serialize, Deserialize, Debug, Default, Clone)]
-pub struct ListConfiguration {
-    /// The template entry to use for each generated entry.
-    #[serde(default)]
-    pub entry: EntryDeclaration,
-    /// The values to use as the input for the matrix.
-    #[serde(default)]
-    pub values: Vec<BTreeMap<String, String>>,
-}
-
-/// Generates a set of entries using the specified `matrix` configuration in the `context`.
+/// Generates a set of entries using the specified `list` configuration in the `context`.
 pub fn generate(
     context: Rc<SproutContext>,
     list: &ListConfiguration,

crates/sprout/src/generators/matrix.rs

@@ -1,24 +1,12 @@
 use crate::context::SproutContext;
-use crate::entries::{BootableEntry, EntryDeclaration};
+use crate::entries::BootableEntry;
 use crate::generators::list;
 use anyhow::Result;
-use serde::{Deserialize, Serialize};
+use edera_sprout_config::generators::list::ListConfiguration;
+use edera_sprout_config::generators::matrix::MatrixConfiguration;
 use std::collections::BTreeMap;
 use std::rc::Rc;
 
-/// Matrix generator configuration.
-/// The matrix generator produces multiple entries based
-/// on input values multiplicatively.
-#[derive(Serialize, Deserialize, Debug, Default, Clone)]
-pub struct MatrixConfiguration {
-    /// The template entry to use for each generated entry.
-    #[serde(default)]
-    pub entry: EntryDeclaration,
-    /// The values to use as the input for the matrix.
-    #[serde(default)]
-    pub values: BTreeMap<String, Vec<String>>,
-}
-
 /// Builds out multiple generations of `input` based on a matrix style.
 /// For example, if input is: {"x": ["a", "b"], "y": ["c", "d"]}
 /// It will produce:
@@ -61,7 +49,7 @@ pub fn generate(
     // Use the list generator to generate entries for each combination.
     list::generate(
         context,
-        &list::ListConfiguration {
+        &ListConfiguration {
             entry: matrix.entry.clone(),
             values: combinations,
         },

crates/sprout/src/integrations.rs

@@ -0,0 +1,4 @@
+/// Implements support for the bootloader interface specification.
+pub mod bootloader_interface;
+/// Implements support for the shim loader application for Secure Boot.
+pub mod shim;

crates/sprout/src/integrations/bootloader_interface.rs

@@ -0,0 +1,314 @@
+use crate::integrations::bootloader_interface::bitflags::LoaderFeatures;
+use crate::platform::timer::PlatformTimer;
+use crate::utils::device_path_subpath;
+use crate::utils::variables::{VariableClass, VariableController};
+use anyhow::{Context, Result};
+use uefi::proto::device_path::DevicePath;
+use uefi::{Guid, guid};
+use uefi_raw::table::runtime::VariableVendor;
+
+/// bitflags: LoaderFeatures bitflags.
+mod bitflags;
+
+/// The name of the bootloader to tell the system.
+const LOADER_NAME: &str = "Sprout";
+
+/// Represents the configured timeout for the bootloader interface.
+pub enum BootloaderInterfaceTimeout {
+    /// Force the menu to be shown.
+    MenuForce,
+    /// Hide the menu.
+    MenuHidden,
+    /// Disable the menu.
+    MenuDisabled,
+    /// Set a timeout for the menu.
+    Timeout(u64),
+    /// Timeout is unspecified.
+    Unspecified,
+}
+
+/// Bootloader Interface support.
+pub struct BootloaderInterface;
+
+impl BootloaderInterface {
+    /// Bootloader Interface GUID from https://systemd.io/BOOT_LOADER_INTERFACE
+    const VENDOR: VariableController = VariableController::new(VariableVendor(guid!(
+        "4a67b082-0a4c-41cf-b6c7-440b29bb8c4f"
+    )));
+
+    /// The feature we support in Sprout.
+    fn features() -> LoaderFeatures {
+        LoaderFeatures::Xbootldr
+            | LoaderFeatures::LoadDriver
+            | LoaderFeatures::Tpm2ActivePcrBanks
+            | LoaderFeatures::RetainShim
+            | LoaderFeatures::ConfigTimeout
+            | LoaderFeatures::ConfigTimeoutOneShot
+            | LoaderFeatures::MenuDisable
+            | LoaderFeatures::EntryDefault
+            | LoaderFeatures::EntryOneShot
+    }
+
+    /// Tell the system that Sprout was initialized at the current time.
+    pub fn mark_init(timer: &PlatformTimer) -> Result<()> {
+        Self::mark_time("LoaderTimeInitUSec", timer)
+    }
+
+    /// Tell the system that Sprout is about to execute the boot entry.
+    pub fn mark_exec(timer: &PlatformTimer) -> Result<()> {
+        Self::mark_time("LoaderTimeExecUSec", timer)
+    }
+
+    /// Tell the system that Sprout is about to display the menu.
+    pub fn mark_menu(timer: &PlatformTimer) -> Result<()> {
+        Self::mark_time("LoaderTimeMenuUSec", timer)
+    }
+
+    /// Tell the system about the current time as measured by the platform timer.
+    /// Sets the variable specified by `key` to the number of microseconds.
+    fn mark_time(key: &str, timer: &PlatformTimer) -> Result<()> {
+        // Measure the elapsed time since the hardware timer was started.
+        let elapsed = timer.elapsed_since_lifetime();
+        Self::VENDOR.set_cstr16(
+            key,
+            &elapsed.as_micros().to_string(),
+            VariableClass::BootAndRuntimeTemporary,
+        )
+    }
+
+    /// Tell the system what loader is being used and our features.
+    pub fn set_loader_info() -> Result<()> {
+        // Set the LoaderInfo variable with the name of the loader.
+        Self::VENDOR
+            .set_cstr16(
+                "LoaderInfo",
+                LOADER_NAME,
+                VariableClass::BootAndRuntimeTemporary,
+            )
+            .context("unable to set loader info variable")?;
+
+        // Set the LoaderFeatures variable with the features we support.
+        Self::VENDOR
+            .set_u64le(
+                "LoaderFeatures",
+                Self::features().bits(),
+                VariableClass::BootAndRuntimeTemporary,
+            )
+            .context("unable to set loader features variable")?;
+        Ok(())
+    }
+
+    /// Tell the system the relative path to the partition root of the current bootloader.
+    pub fn set_loader_path(path: &DevicePath) -> Result<()> {
+        let subpath = device_path_subpath(path).context("unable to get loader path subpath")?;
+        Self::VENDOR.set_cstr16(
+            "LoaderImageIdentifier",
+            &subpath,
+            VariableClass::BootAndRuntimeTemporary,
+        )
+    }
+
+    /// Tell the system what the partition GUID of the ESP Sprout was booted from is.
+    pub fn set_partition_guid(guid: &Guid) -> Result<()> {
+        Self::VENDOR.set_cstr16(
+            "LoaderDevicePartUUID",
+            &guid.to_string(),
+            VariableClass::BootAndRuntimeTemporary,
+        )
+    }
+
+    /// Tell the system what boot entries are available.
+    pub fn set_entries<N: AsRef<str>>(entries: impl Iterator<Item = N>) -> Result<()> {
+        // Entries are stored as a null-terminated list of CString16 strings back to back.
+        // Iterate over the entries and convert them to CString16 placing them into data.
+        let mut data = Vec::new();
+        for entry in entries {
+            // Convert the entry to CString16 little endian.
+            let encoded = entry
+                .as_ref()
+                .encode_utf16()
+                .flat_map(|c| c.to_le_bytes())
+                .collect::<Vec<u8>>();
+            // Write the bytes into the data buffer.
+            data.extend_from_slice(&encoded);
+            // Add a null terminator to the end of the entry.
+            data.extend_from_slice(&[0, 0]);
+        }
+
+        // If no data was generated, we will do nothing.
+        if data.is_empty() {
+            return Ok(());
+        }
+
+        Self::VENDOR.set(
+            "LoaderEntries",
+            &data,
+            VariableClass::BootAndRuntimeTemporary,
+        )
+    }
+
+    /// Tell the system what the selected boot entry is.
+    pub fn set_selected_entry(entry: String) -> Result<()> {
+        Self::VENDOR.set_cstr16(
+            "LoaderEntrySelected",
+            &entry,
+            VariableClass::BootAndRuntimeTemporary,
+        )
+    }
+
+    /// Tell the system about the UEFI firmware we are running on.
+    pub fn set_firmware_info() -> Result<()> {
+        // Access the firmware revision.
+        let firmware_revision = uefi::system::firmware_revision();
+
+        // Access the UEFI revision.
+        let uefi_revision = uefi::system::uefi_revision();
+
+        // Format the firmware information string into something human-readable.
+        let firmware_info = format!(
+            "{} {}.{:02}",
+            uefi::system::firmware_vendor(),
+            firmware_revision >> 16,
+            firmware_revision & 0xffff,
+        );
+        Self::VENDOR.set_cstr16(
+            "LoaderFirmwareInfo",
+            &firmware_info,
+            VariableClass::BootAndRuntimeTemporary,
+        )?;
+
+        // Format the firmware revision into something human-readable.
+        let firmware_type = format!(
+            "UEFI {}.{:02}",
+            uefi_revision.major(),
+            uefi_revision.minor()
+        );
+        Self::VENDOR.set_cstr16(
+            "LoaderFirmwareType",
+            &firmware_type,
+            VariableClass::BootAndRuntimeTemporary,
+        )
+    }
+
+    /// Tell the system what the number of active PCR banks is.
+    /// If this is zero, that is okay.
+    pub fn set_tpm2_active_pcr_banks(value: u32) -> Result<()> {
+        // Format the value into the specification format.
+        let value = format!("0x{:08x}", value);
+        Self::VENDOR.set_cstr16(
+            "LoaderTpm2ActivePcrBanks",
+            &value,
+            VariableClass::BootAndRuntimeTemporary,
+        )
+    }
+
+    /// Retrieve the timeout value from the bootloader interface, using the specified `key`.
+    /// `remove` indicates whether, when found, we remove the variable.
+    fn get_timeout_value(key: &str, remove: bool) -> Result<Option<BootloaderInterfaceTimeout>> {
+        // Retrieve the timeout value from the bootloader interface.
+        let Some(value) = Self::VENDOR
+            .get_cstr16(key)
+            .context("unable to get timeout value")?
+        else {
+            return Ok(None);
+        };
+
+        // If we reach here, we know the value was specified.
+        // If `remove` is true, remove the variable.
+        if remove {
+            Self::VENDOR
+                .remove(key)
+                .context("unable to remove timeout variable")?;
+        }
+
+        // If the value is empty, return Unspecified.
+        if value.is_empty() {
+            return Ok(Some(BootloaderInterfaceTimeout::Unspecified));
+        }
+
+        // If the value is "menu-force", return MenuForce.
+        if value == "menu-force" {
+            return Ok(Some(BootloaderInterfaceTimeout::MenuForce));
+        }
+
+        // If the value is "menu-hidden", return MenuHidden.
+        if value == "menu-hidden" {
+            return Ok(Some(BootloaderInterfaceTimeout::MenuHidden));
+        }
+
+        // If the value is "menu-disabled", return MenuDisabled.
+        if value == "menu-disabled" {
+            return Ok(Some(BootloaderInterfaceTimeout::MenuDisabled));
+        }
+
+        // Parse the value as a u64 to decode an numeric value.
+        let value = value
+            .parse::<u64>()
+            .context("unable to parse timeout value")?;
+
+        // The specification says that a value of 0 means that the menu should be hidden.
+        if value == 0 {
+            return Ok(Some(BootloaderInterfaceTimeout::MenuHidden));
+        }
+
+        // If we reach here, we know it must be a real timeout value.
+        Ok(Some(BootloaderInterfaceTimeout::Timeout(value)))
+    }
+
+    /// Get the timeout from the bootloader interface.
+    /// This indicates how the menu should behave.
+    /// If no values are set, Unspecified is returned.
+    pub fn get_timeout() -> Result<BootloaderInterfaceTimeout> {
+        // Attempt to acquire the value of the LoaderConfigTimeoutOneShot variable.
+        // This should take precedence over the LoaderConfigTimeout variable.
+        let oneshot = Self::get_timeout_value("LoaderConfigTimeoutOneShot", true)
+            .context("unable to check for LoaderConfigTimeoutOneShot variable")?;
+
+        // If oneshot was found, return it.
+        if let Some(oneshot) = oneshot {
+            return Ok(oneshot);
+        }
+
+        // Attempt to acquire the value of the LoaderConfigTimeout variable.
+        // This will be used if the LoaderConfigTimeoutOneShot variable is not set.
+        let direct = Self::get_timeout_value("LoaderConfigTimeout", false)
+            .context("unable to check for LoaderConfigTimeout variable")?;
+
+        // If direct was found, return it.
+        if let Some(direct) = direct {
+            return Ok(direct);
+        }
+
+        // If we reach here, we know that neither variable was set.
+        // We provide the unspecified value instead.
+        Ok(BootloaderInterfaceTimeout::Unspecified)
+    }
+
+    /// Get the default entry set by the bootloader interface.
+    pub fn get_default_entry() -> Result<Option<String>> {
+        Self::VENDOR
+            .get_cstr16("LoaderEntryDefault")
+            .context("unable to get default entry from bootloader interface")
+    }
+
+    /// Get the oneshot entry set by the bootloader interface.
+    /// This should be the entry we boot.
+    pub fn get_oneshot_entry() -> Result<Option<String>> {
+        // Acquire the value of the LoaderEntryOneShot variable.
+        // If it is not set, return None.
+        let Some(value) = Self::VENDOR
+            .get_cstr16("LoaderEntryOneShot")
+            .context("unable to get oneshot entry from bootloader interface")?
+        else {
+            return Ok(None);
+        };
+
+        // Remove the oneshot entry from the bootloader interface.
+        Self::VENDOR
+            .remove("LoaderEntryOneShot")
+            .context("unable to remove oneshot entry")?;
+
+        // Return the oneshot value.
+        Ok(Some(value))
+    }
+}

crates/sprout/src/integrations/bootloader_interface/bitflags.rs

@@ -0,0 +1,46 @@
+use bitflags::bitflags;
+
+bitflags! {
+    /// Feature bitflags for the bootloader interface.
+    #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+    pub struct LoaderFeatures: u64 {
+        /// Bootloader supports LoaderConfigTimeout.
+        const ConfigTimeout = 1 << 0;
+        /// Bootloader supports LoaderConfigTimeoutOneShot.
+        const ConfigTimeoutOneShot = 1 << 1;
+        /// Bootloader supports LoaderEntryDefault.
+        const EntryDefault = 1 << 2;
+        /// Bootloader supports LoaderEntryOneShot.
+        const EntryOneShot = 1 << 3;
+        /// Bootloader supports boot counting.
+        const BootCounting = 1 << 4;
+        /// Bootloader supports detection from XBOOTLDR partitions.
+        const Xbootldr = 1 << 5;
+        /// Bootloader supports the handling of random seeds.
+        const RandomSeed = 1 << 6;
+        /// Bootloader supports loading drivers.
+        const LoadDriver = 1 << 7;
+        /// Bootloader supports sort keys.
+        const SortKey = 1 << 8;
+        /// Bootloader supports saved entries.
+        const SavedEntry = 1 << 9;
+        /// Bootloader supports device trees.
+        const DeviceTree = 1 << 10;
+        /// Bootloader supports secure boot enroll.
+        const SecureBootEnroll = 1 << 11;
+        /// Bootloader retains the shim.
+        const RetainShim = 1 << 12;
+        /// Bootloader supports disabling the menu via the menu timeout variable.
+        const MenuDisable = 1 << 13;
+        /// Bootloader supports multi-profile UKI.
+        const MultiProfileUki = 1 << 14;
+        /// Bootloader reports URLs.
+        const ReportUrl = 1 << 15;
+        /// Bootloader supports type-1 UKIs.
+        const Type1Uki = 1 << 16;
+        /// Bootloader supports type-1 UKI urls.
+        const Type1UkiUrl = 1 << 17;
+        /// Bootloader indicates TPM2 active PCR banks.
+        const Tpm2ActivePcrBanks = 1 << 18;
+    }
+}

crates/sprout/src/integrations/shim.rs

@@ -0,0 +1,316 @@
+use crate::integrations::shim::hook::SecurityHook;
+use crate::secure::SecureBoot;
+use crate::utils;
+use crate::utils::ResolvedPath;
+use crate::utils::variables::{VariableClass, VariableController};
+use anyhow::{Context, Result, anyhow, bail};
+use log::warn;
+use std::ffi::c_void;
+use std::pin::Pin;
+use uefi::Handle;
+use uefi::boot::LoadImageSource;
+use uefi::proto::device_path::text::{AllowShortcuts, DisplayOnly};
+use uefi::proto::device_path::{DevicePath, FfiDevicePath};
+use uefi::proto::unsafe_protocol;
+use uefi_raw::table::runtime::VariableVendor;
+use uefi_raw::{Guid, Status, guid};
+
+/// Security hook support.
+mod hook;
+
+/// Support for the shim loader application for Secure Boot.
+pub struct ShimSupport;
+
+/// Input to the shim mechanisms.
+pub enum ShimInput<'a> {
+    /// Data loaded into a buffer and ready to be verified, owned.
+    OwnedDataBuffer(Option<&'a ResolvedPath>, Pin<Box<[u8]>>),
+    /// Data loaded into a buffer and ready to be verified.
+    DataBuffer(Option<&'a ResolvedPath>, &'a [u8]),
+    /// Low-level data buffer provided by the security hook.
+    SecurityHookBuffer(Option<*const FfiDevicePath>, &'a [u8]),
+    /// Low-level owned data buffer provided by the security hook.
+    SecurityHookOwnedBuffer(Option<*const FfiDevicePath>, Pin<Box<[u8]>>),
+    /// Low-level path provided by the security hook.
+    SecurityHookPath(*const FfiDevicePath),
+    /// Data is provided as a resolved path. We will need to load the data to verify it.
+    /// The output will them return the loaded data.
+    ResolvedPath(&'a ResolvedPath),
+}
+
+impl<'a> ShimInput<'a> {
+    /// Accesses the buffer behind the shim input, if available.
+    pub fn buffer(&self) -> Option<&[u8]> {
+        match self {
+            ShimInput::OwnedDataBuffer(_, data) => Some(data),
+            ShimInput::SecurityHookOwnedBuffer(_, data) => Some(data),
+            ShimInput::SecurityHookBuffer(_, data) => Some(data),
+            ShimInput::SecurityHookPath(_) => None,
+            ShimInput::DataBuffer(_, data) => Some(data),
+            ShimInput::ResolvedPath(_) => None,
+        }
+    }
+
+    /// Accesses the full device path to the input.
+    pub fn file_path(&self) -> Option<&DevicePath> {
+        match self {
+            ShimInput::OwnedDataBuffer(path, _) => path.as_ref().map(|it| it.full_path.as_ref()),
+            ShimInput::DataBuffer(path, _) => path.as_ref().map(|it| it.full_path.as_ref()),
+            ShimInput::SecurityHookBuffer(path, _) => {
+                path.map(|it| unsafe { DevicePath::from_ffi_ptr(it) })
+            }
+            ShimInput::SecurityHookPath(path) => unsafe { Some(DevicePath::from_ffi_ptr(*path)) },
+            ShimInput::ResolvedPath(path) => Some(path.full_path.as_ref()),
+            ShimInput::SecurityHookOwnedBuffer(path, _) => {
+                path.map(|it| unsafe { DevicePath::from_ffi_ptr(it) })
+            }
+        }
+    }
+
+    /// Converts this input into an owned data buffer, where the data is loaded.
+    /// For ResolvedPath, this will read the file.
+    pub fn into_owned_data_buffer(self) -> Result<ShimInput<'a>> {
+        match self {
+            ShimInput::OwnedDataBuffer(root, data) => Ok(ShimInput::OwnedDataBuffer(root, data)),
+
+            ShimInput::DataBuffer(root, data) => Ok(ShimInput::OwnedDataBuffer(
+                root,
+                Box::into_pin(data.to_vec().into_boxed_slice()),
+            )),
+
+            ShimInput::SecurityHookPath(ffi_path) => {
+                // Acquire the file path.
+                let Some(path) = self.file_path() else {
+                    bail!("unable to convert security hook path to device path");
+                };
+                // Convert the underlying path to a string.
+                let path = path
+                    .to_string(DisplayOnly(false), AllowShortcuts(false))
+                    .context("unable to convert device path to string")?;
+                let path = utils::resolve_path(None, &path.to_string())
+                    .context("unable to resolve path")?;
+                // Read the file path.
+                let data = path.read_file()?;
+                Ok(ShimInput::SecurityHookOwnedBuffer(
+                    Some(ffi_path),
+                    Box::into_pin(data.to_vec().into_boxed_slice()),
+                ))
+            }
+
+            ShimInput::SecurityHookBuffer(_, _) => {
+                bail!("unable to convert security hook buffer to owned data buffer")
+            }
+
+            ShimInput::ResolvedPath(path) => {
+                // Read the file path.
+                let data = path.read_file()?;
+                Ok(ShimInput::OwnedDataBuffer(
+                    Some(path),
+                    Box::into_pin(data.to_vec().into_boxed_slice()),
+                ))
+            }
+
+            ShimInput::SecurityHookOwnedBuffer(path, data) => {
+                Ok(ShimInput::SecurityHookOwnedBuffer(path, data))
+            }
+        }
+    }
+}
+
+/// Output of the shim verification function.
+/// Since the shim needs to load the data from disk, we will optimize by using that as the data
+/// to actually boot.
+pub enum ShimVerificationOutput {
+    /// The verification failed.
+    VerificationFailed(Status),
+    /// The data provided to the verifier was already a buffer.
+    VerifiedDataNotLoaded,
+    /// Verifying the data resulted in loading the data from the source.
+    /// This contains the data that was loaded, so it won't need to be loaded again.
+    VerifiedDataBuffer(Vec<u8>),
+}
+
+/// The shim lock protocol as defined by the shim loader application.
+#[unsafe_protocol(ShimSupport::SHIM_LOCK_GUID)]
+struct ShimLockProtocol {
+    /// Verify the data in `buffer` with the size `buffer_size` to determine if it is valid.
+    /// NOTE: On x86_64, this function uses SYSV calling conventions. On aarch64 it uses the
+    /// efiapi calling convention. This is truly wild, but you can verify it yourself by
+    /// looking at: https://github.com/rhboot/shim/blob/15.8/shim.h#L207-L212
+    /// There is no calling convention declared like there should be.
+    #[cfg(target_arch = "x86_64")]
+    pub shim_verify: unsafe extern "sysv64" fn(buffer: *const c_void, buffer_size: u32) -> Status,
+    #[cfg(target_arch = "aarch64")]
+    pub shim_verify: unsafe extern "efiapi" fn(buffer: *const c_void, buffer_size: u32) -> Status,
+    /// Unused function that is defined by the shim.
+    _generate_header: *mut c_void,
+    /// Unused function that is defined by the shim.
+    _read_header: *mut c_void,
+}
+
+impl ShimSupport {
+    /// Variable controller for the shim lock.
+    const SHIM_LOCK_VARIABLES: VariableController =
+        VariableController::new(VariableVendor(Self::SHIM_LOCK_GUID));
+
+    /// GUID for the shim lock protocol.
+    const SHIM_LOCK_GUID: Guid = guid!("605dab50-e046-4300-abb6-3dd810dd8b23");
+    /// GUID for the shim image loader protocol.
+    const SHIM_IMAGE_LOADER_GUID: Guid = guid!("1f492041-fadb-4e59-9e57-7cafe73a55ab");
+
+    /// Determines whether the shim is loaded.
+    pub fn loaded() -> Result<bool> {
+        Ok(utils::find_handle(&Self::SHIM_LOCK_GUID)
+            .context("unable to find shim lock protocol")?
+            .is_some())
+    }
+
+    /// Determines whether the shim loader is available.
+    pub fn loader_available() -> Result<bool> {
+        Ok(utils::find_handle(&Self::SHIM_IMAGE_LOADER_GUID)
+            .context("unable to find shim image loader protocol")?
+            .is_some())
+    }
+
+    /// Use the shim to validate the `input`, returning [ShimVerificationOutput] when complete.
+    pub fn verify(input: ShimInput) -> Result<ShimVerificationOutput> {
+        // Acquire the handle to the shim lock protocol.
+        let handle = utils::find_handle(&Self::SHIM_LOCK_GUID)
+            .context("unable to find shim lock protocol")?
+            .ok_or_else(|| anyhow!("unable to find shim lock protocol"))?;
+        // Acquire the protocol exclusively to the shim lock.
+        let protocol = uefi::boot::open_protocol_exclusive::<ShimLockProtocol>(handle)
+            .context("unable to open shim lock protocol")?;
+
+        // If the input type is a device path, we need to load the data.
+        let maybe_loaded_data = match input {
+            ShimInput::OwnedDataBuffer(_, _data) => {
+                bail!("owned data buffer is not supported in the verification function");
+            }
+            ShimInput::SecurityHookBuffer(_, _) => None,
+            ShimInput::SecurityHookOwnedBuffer(_, _) => None,
+            ShimInput::DataBuffer(_, _) => None,
+            ShimInput::ResolvedPath(path) => Some(path.read_file()?),
+            ShimInput::SecurityHookPath(_) => None,
+        };
+
+        // Convert the input to a buffer.
+        // If the input provides the data buffer, we will use that.
+        // Otherwise, we will use the data loaded by this function.
+        let buffer = match &input {
+            ShimInput::OwnedDataBuffer(_root, data) => data,
+            ShimInput::DataBuffer(_root, data) => *data,
+            ShimInput::ResolvedPath(_path) => maybe_loaded_data
+                .as_deref()
+                .context("expected data buffer to be loaded already")?,
+            ShimInput::SecurityHookBuffer(_, data) => data,
+            ShimInput::SecurityHookOwnedBuffer(_, data) => data,
+            ShimInput::SecurityHookPath(_) => {
+                bail!("security hook path input not supported in the verification function")
+            }
+        };
+
+        // Check if the buffer is too large to verify.
+        if buffer.len() > u32::MAX as usize {
+            bail!("buffer is too large to verify with shim lock protocol");
+        }
+
+        // Call the shim verify function.
+        // SAFETY: The shim verify function is specified by the shim lock protocol.
+        // Calling this function is considered safe because the shim verify function is
+        // guaranteed to be defined by the environment if we are able to acquire the protocol.
+        let status = unsafe {
+            (protocol.shim_verify)(buffer.as_ptr() as *const c_void, buffer.len() as u32)
+        };
+
+        // If the verification failed, return the verification failure output.
+        if !status.is_success() {
+            return Ok(ShimVerificationOutput::VerificationFailed(status));
+        }
+
+        // If verification succeeded, return the validation output,
+        // which might include the loaded data.
+        Ok(maybe_loaded_data
+            .map(ShimVerificationOutput::VerifiedDataBuffer)
+            .unwrap_or(ShimVerificationOutput::VerifiedDataNotLoaded))
+    }
+
+    /// Load the image specified by the `input` and returns an image handle.
+    pub fn load(current_image: Handle, input: ShimInput) -> Result<Handle> {
+        // Determine whether Secure Boot is enabled.
+        let secure_boot =
+            SecureBoot::enabled().context("unable to determine if secure boot is enabled")?;
+
+        // Determine whether the shim is loaded.
+        let shim_loaded = Self::loaded().context("unable to determine if shim is loaded")?;
+
+        // Determine whether the shim loader is available.
+        let shim_loader_available =
+            Self::loader_available().context("unable to determine if shim loader is available")?;
+
+        // Determines whether LoadImage in Boot Services must be patched.
+        // Version 16 of the shim doesn't require extra effort to load Secure Boot binaries.
+        // If the image loader is installed, we can skip over the security hook.
+        let requires_security_hook = secure_boot && shim_loaded && !shim_loader_available;
+
+        // If the security hook is required, we will bail for now.
+        if requires_security_hook {
+            // Install the security hook, if possible. If it's not, this is necessary to continue,
+            // so we should bail.
+            let installed = SecurityHook::install().context("unable to install security hook")?;
+            if !installed {
+                bail!("unable to install security hook required for this platform");
+            }
+        }
+
+        // If the shim is loaded, we will need to retain the shim protocol to allow
+        // loading multiple images.
+        if shim_loaded {
+            // Retain the shim protocol after loading the image.
+            Self::retain()?;
+        }
+
+        // Converts the shim input to an owned data buffer.
+        let input = input
+            .into_owned_data_buffer()
+            .context("unable to convert input to loaded data buffer")?;
+
+        // Constructs a LoadImageSource from the input.
+        let source = LoadImageSource::FromBuffer {
+            buffer: input.buffer().context("unable to get buffer from input")?,
+            file_path: input.file_path(),
+        };
+
+        // Loads the image using Boot Services LoadImage function.
+        let result = uefi::boot::load_image(current_image, source).context("unable to load image");
+
+        // If the security override is required, we will uninstall the security hook.
+        if requires_security_hook {
+            let uninstall_result = SecurityHook::uninstall();
+            // Ensure we don't mask load image errors if uninstalling fails.
+            if result.is_err()
+                && let Err(uninstall_error) = &uninstall_result
+            {
+                // Warn on the error since the load image error is more important.
+                warn!("unable to uninstall security hook: {}", uninstall_error);
+            } else {
+                // Otherwise, ensure we handle the original uninstallation result.
+                uninstall_result?;
+            }
+        }
+        result
+    }
+
+    /// Set the ShimRetainProtocol variable to indicate that shim should retain the protocols
+    /// for the full lifetime of boot services.
+    pub fn retain() -> Result<()> {
+        Self::SHIM_LOCK_VARIABLES
+            .set_bool(
+                "ShimRetainProtocol",
+                true,
+                VariableClass::BootAndRuntimeTemporary,
+            )
+            .context("unable to retain shim protocol")?;
+        Ok(())
+    }
+}

crates/sprout/src/integrations/shim/hook.rs

@@ -0,0 +1,293 @@
+use crate::integrations::shim::{ShimInput, ShimSupport, ShimVerificationOutput};
+use crate::utils;
+use anyhow::{Context, Result, bail};
+use log::warn;
+use std::sync::{LazyLock, Mutex};
+use uefi::proto::device_path::FfiDevicePath;
+use uefi::proto::unsafe_protocol;
+use uefi::{Guid, guid};
+use uefi_raw::Status;
+
+/// GUID for the EFI_SECURITY_ARCH protocol.
+const SECURITY_ARCH_GUID: Guid = guid!("a46423e3-4617-49f1-b9ff-d1bfa9115839");
+/// GUID for the EFI_SECURITY_ARCH2 protocol.
+const SECURITY_ARCH2_GUID: Guid = guid!("94ab2f58-1438-4ef1-9152-18941a3a0e68");
+
+/// EFI_SECURITY_ARCH protocol definition.
+#[unsafe_protocol(SECURITY_ARCH_GUID)]
+pub struct SecurityArchProtocol {
+    /// Determines the file authentication state.
+    pub file_authentication_state: unsafe extern "efiapi" fn(
+        this: *const SecurityArchProtocol,
+        status: u32,
+        path: *const FfiDevicePath,
+    ) -> Status,
+}
+
+/// EFI_SECURITY_ARCH2 protocol definition.
+#[unsafe_protocol(SECURITY_ARCH2_GUID)]
+pub struct SecurityArch2Protocol {
+    /// Determines the file authentication.
+    pub file_authentication: unsafe extern "efiapi" fn(
+        this: *const SecurityArch2Protocol,
+        path: *const FfiDevicePath,
+        file_buffer: *const u8,
+        file_size: usize,
+        boot_policy: bool,
+    ) -> Status,
+}
+
+/// Global state for the security hook.
+struct SecurityHookState {
+    original_hook: SecurityArchProtocol,
+    original_hook2: SecurityArch2Protocol,
+}
+
+/// Global state for the security hook.
+/// This is messy, but it is safe given the mutex.
+static GLOBAL_HOOK_STATE: LazyLock<Mutex<Option<SecurityHookState>>> =
+    LazyLock::new(|| Mutex::new(None));
+
+/// Security hook helper.
+pub struct SecurityHook;
+
+impl SecurityHook {
+    /// Shared verifier logic for both hook types.
+    #[must_use]
+    fn verify(input: ShimInput) -> bool {
+        // Verify the input and convert the result to a status.
+        let status = match ShimSupport::verify(input) {
+            Ok(output) => match output {
+                // If the verification failed, return the access-denied status.
+                ShimVerificationOutput::VerificationFailed(status) => status,
+                // If the verification succeeded, return the success status.
+                ShimVerificationOutput::VerifiedDataNotLoaded => Status::SUCCESS,
+                ShimVerificationOutput::VerifiedDataBuffer(_) => Status::SUCCESS,
+            },
+
+            // If an error occurs, log the error since we can't return a better error.
+            // Then return the access-denied status.
+            Err(error) => {
+                warn!("unable to verify image: {}", error);
+                Status::ACCESS_DENIED
+            }
+        };
+
+        // If the status is not a success, log the status.
+        if !status.is_success() {
+            warn!("shim verification failed: {}", status);
+        }
+        // Return whether the status is a success.
+        // If it's not a success, the original hook should be called.
+        status.is_success()
+    }
+
+    /// File authentication state verifier for the EFI_SECURITY_ARCH protocol.
+    /// Takes the `path` and determines the verification.
+    unsafe extern "efiapi" fn arch_file_authentication_state(
+        this: *const SecurityArchProtocol,
+        status: u32,
+        path: *const FfiDevicePath,
+    ) -> Status {
+        // Verify the path is not null.
+        if path.is_null() {
+            return Status::INVALID_PARAMETER;
+        }
+
+        // Construct a shim input from the path.
+        let input = ShimInput::SecurityHookPath(path);
+
+        // Convert the input to an owned data buffer.
+        let input = match input.into_owned_data_buffer() {
+            Ok(input) => input,
+            // If an error occurs, log the error and return the not found status.
+            Err(error) => {
+                warn!("unable to read data to be authenticated: {}", error);
+                return Status::NOT_FOUND;
+            }
+        };
+
+        // Verify the input, if it fails, call the original hook.
+        if !Self::verify(input) {
+            // Acquire the global hook state to grab the original hook.
+            let function = match GLOBAL_HOOK_STATE.lock() {
+                // We have acquired the lock, so we can find the original hook.
+                Ok(state) => match state.as_ref() {
+                    // The hook state is available, so we can acquire the original hook.
+                    Some(state) => state.original_hook.file_authentication_state,
+
+                    // The hook state is not available, so we can't call the original hook.
+                    None => {
+                        warn!("global hook state is not available, unable to call original hook");
+                        return Status::LOAD_ERROR;
+                    }
+                },
+
+                Err(error) => {
+                    warn!(
+                        "unable to acquire global hook state lock to call original hook: {}",
+                        error,
+                    );
+                    return Status::LOAD_ERROR;
+                }
+            };
+
+            // Call the original hook function to see what it reports.
+            // SAFETY: This function is safe to call as it is stored by us and is required
+            // in the UEFI specification.
+            unsafe { function(this, status, path) }
+        } else {
+            Status::SUCCESS
+        }
+    }
+
+    /// File authentication verifier for the EFI_SECURITY_ARCH2 protocol.
+    /// Takes the `path` and a file buffer to determine the verification.
+    unsafe extern "efiapi" fn arch2_file_authentication(
+        this: *const SecurityArch2Protocol,
+        path: *const FfiDevicePath,
+        file_buffer: *const u8,
+        file_size: usize,
+        boot_policy: bool,
+    ) -> Status {
+        // Verify the path and file buffer are not null.
+        if path.is_null() || file_buffer.is_null() {
+            return Status::INVALID_PARAMETER;
+        }
+
+        // If the boot policy is true, we can't continue as we don't support that.
+        if boot_policy {
+            return Status::INVALID_PARAMETER;
+        }
+
+        // Construct a slice out of the file buffer and size.
+        let buffer = unsafe { std::slice::from_raw_parts(file_buffer, file_size) };
+
+        // Construct a shim input from the path.
+        let input = ShimInput::SecurityHookBuffer(Some(path), buffer);
+
+        // Verify the input, if it fails, call the original hook.
+        if !Self::verify(input) {
+            // Acquire the global hook state to grab the original hook.
+            let function = match GLOBAL_HOOK_STATE.lock() {
+                // We have acquired the lock, so we can find the original hook.
+                Ok(state) => match state.as_ref() {
+                    // The hook state is available, so we can acquire the original hook.
+                    Some(state) => state.original_hook2.file_authentication,
+
+                    // The hook state is not available, so we can't call the original hook.
+                    None => {
+                        warn!("global hook state is not available, unable to call original hook");
+                        return Status::LOAD_ERROR;
+                    }
+                },
+
+                Err(error) => {
+                    warn!(
+                        "unable to acquire global hook state lock to call original hook: {}",
+                        error
+                    );
+                    return Status::LOAD_ERROR;
+                }
+            };
+
+            // Call the original hook function to see what it reports.
+            // SAFETY: This function is safe to call as it is stored by us and is required
+            // in the UEFI specification.
+            unsafe { function(this, path, file_buffer, file_size, boot_policy) }
+        } else {
+            Status::SUCCESS
+        }
+    }
+
+    /// Install the security hook if needed.
+    pub fn install() -> Result<bool> {
+        // Find the security arch protocol. If we can't find it, we will return false.
+        let Some(hook_arch) = utils::find_handle(&SECURITY_ARCH_GUID)
+            .context("unable to check security arch existence")?
+        else {
+            return Ok(false);
+        };
+
+        // Find the security arch2 protocol. If we can't find it, we will return false.
+        let Some(hook_arch2) = utils::find_handle(&SECURITY_ARCH2_GUID)
+            .context("unable to check security arch2 existence")?
+        else {
+            return Ok(false);
+        };
+
+        // Open the security arch protocol.
+        let mut arch_protocol =
+            uefi::boot::open_protocol_exclusive::<SecurityArchProtocol>(hook_arch)
+                .context("unable to open security arch protocol")?;
+
+        // Open the security arch2 protocol.
+        let mut arch_protocol2 =
+            uefi::boot::open_protocol_exclusive::<SecurityArch2Protocol>(hook_arch2)
+                .context("unable to open security arch2 protocol")?;
+
+        // Construct the global state to store.
+        let state = SecurityHookState {
+            original_hook: SecurityArchProtocol {
+                file_authentication_state: arch_protocol.file_authentication_state,
+            },
+            original_hook2: SecurityArch2Protocol {
+                file_authentication: arch_protocol2.file_authentication,
+            },
+        };
+
+        // Acquire the lock to the global state and replace it.
+        let Ok(mut global_state) = GLOBAL_HOOK_STATE.lock() else {
+            bail!("unable to acquire global hook state lock");
+        };
+        global_state.replace(state);
+
+        // Install the hooks into the UEFI stack.
+        arch_protocol.file_authentication_state = Self::arch_file_authentication_state;
+        arch_protocol2.file_authentication = Self::arch2_file_authentication;
+
+        Ok(true)
+    }
+
+    /// Uninstalls the global security hook, if installed.
+    pub fn uninstall() -> Result<()> {
+        // Find the security arch protocol. If we can't find it, we will do nothing.
+        let Some(hook_arch) = utils::find_handle(&SECURITY_ARCH_GUID)
+            .context("unable to check security arch existence")?
+        else {
+            return Ok(());
+        };
+
+        // Find the security arch2 protocol. If we can't find it, we will do nothing.
+        let Some(hook_arch2) = utils::find_handle(&SECURITY_ARCH2_GUID)
+            .context("unable to check security arch2 existence")?
+        else {
+            return Ok(());
+        };
+
+        // Open the security arch protocol.
+        let mut arch_protocol =
+            uefi::boot::open_protocol_exclusive::<SecurityArchProtocol>(hook_arch)
+                .context("unable to open security arch protocol")?;
+
+        // Open the security arch2 protocol.
+        let mut arch_protocol2 =
+            uefi::boot::open_protocol_exclusive::<SecurityArch2Protocol>(hook_arch2)
+                .context("unable to open security arch2 protocol")?;
+
+        // Acquire the lock to the global state.
+        let Ok(mut global_state) = GLOBAL_HOOK_STATE.lock() else {
+            bail!("unable to acquire global hook state lock");
+        };
+
+        // Take the state and replace the original functions.
+        let Some(state) = global_state.take() else {
+            return Ok(());
+        };
+
+        // Reinstall the original functions.
+        arch_protocol.file_authentication_state = state.original_hook.file_authentication_state;
+        arch_protocol2.file_authentication = state.original_hook2.file_authentication;
+        Ok(())
+    }
+}

crates/sprout/src/main.rs

@@ -1,14 +1,22 @@
 #![doc = include_str!("../README.md")]
 #![feature(uefi_std)]
 
-use crate::config::RootConfiguration;
+/// The delay to wait for when an error occurs in Sprout.
+const DELAY_ON_ERROR: Duration = Duration::from_secs(10);
+
 use crate::context::{RootContext, SproutContext};
 use crate::entries::BootableEntry;
+use crate::integrations::bootloader_interface::{BootloaderInterface, BootloaderInterfaceTimeout};
 use crate::options::SproutOptions;
 use crate::options::parser::OptionsRepresentable;
 use crate::phases::phase;
+use crate::platform::timer::PlatformTimer;
+use crate::platform::tpm::PlatformTpm;
+use crate::secure::SecureBoot;
+use crate::utils::PartitionGuidForm;
 use anyhow::{Context, Result, bail};
-use log::{error, info};
+use edera_sprout_config::RootConfiguration;
+use log::{error, info, warn};
 use std::collections::BTreeMap;
 use std::ops::Deref;
 use std::time::Duration;
@@ -38,12 +46,24 @@ pub mod extractors;
 /// generators: Runtime code that can generate entries with specific values.
 pub mod generators;
 
+/// platform: Integration or support code for specific hardware platforms.
+pub mod platform;
+
 /// menu: Display a boot menu to select an entry to boot.
 pub mod menu;
 
+/// integrations: Code that interacts with other systems.
+pub mod integrations;
+
 /// phases: Hooks into specific parts of the boot process.
 pub mod phases;
 
+/// sbat: Secure Boot Attestation section.
+pub mod sbat;
+
+/// secure: Secure Boot support.
+pub mod secure;
+
 /// setup: Code that initializes the UEFI environment for Sprout.
 pub mod setup;
 
@@ -55,6 +75,33 @@ pub mod utils;
 
 /// Run Sprout, returning an error if one occurs.
 fn run() -> Result<()> {
+    // For safety reasons, we will note that Secure Boot is in beta on Sprout.
+    if SecureBoot::enabled().context("unable to determine Secure Boot status")? {
+        warn!("Secure Boot is enabled. Sprout Secure Boot is in beta.");
+    }
+
+    // Start the platform timer.
+    let timer = PlatformTimer::start();
+
+    // Mark the initialization of Sprout in the bootloader interface.
+    BootloaderInterface::mark_init(&timer)
+        .context("unable to mark initialization in bootloader interface")?;
+
+    // Tell the bootloader interface what firmware we are running on.
+    BootloaderInterface::set_firmware_info()
+        .context("unable to set firmware info in bootloader interface")?;
+
+    // Tell the bootloader interface what loader is being used.
+    BootloaderInterface::set_loader_info()
+        .context("unable to set loader info in bootloader interface")?;
+
+    // Acquire the number of active PCR banks on the TPM.
+    // If no TPM is available, this will return zero.
+    let active_pcr_banks = PlatformTpm::active_pcr_banks()?;
+    // Tell the bootloader interface what the number of active PCR banks is.
+    BootloaderInterface::set_tpm2_active_pcr_banks(active_pcr_banks)
+        .context("unable to set tpm2 active PCR banks in bootloader interface")?;
+
     // Parse the options to the sprout executable.
     let options = SproutOptions::parse().context("unable to parse options")?;
 
@@ -69,17 +116,35 @@ fn run() -> Result<()> {
         config::loader::load(&options)?
     };
 
-    // Load the root context.
+    // Grab the sprout.efi loaded image path.
     // This is done in a block to ensure the release of the LoadedImageDevicePath protocol.
-    let mut root = {
+    let loaded_image_path = {
         let current_image_device_path_protocol = uefi::boot::open_protocol_exclusive::<
             LoadedImageDevicePath,
         >(uefi::boot::image_handle())
         .context("unable to get loaded image device path")?;
-        let loaded_image_path = current_image_device_path_protocol.deref().to_boxed();
-        RootContext::new(loaded_image_path, options)
+        current_image_device_path_protocol.deref().to_boxed()
     };
 
+    // Grab the partition GUID of the ESP that sprout was loaded from.
+    let loaded_image_partition_guid =
+        utils::partition_guid(&loaded_image_path, PartitionGuidForm::Partition)
+            .context("unable to retrieve loaded image partition guid")?;
+
+    // Set the partition GUID of the ESP that sprout was loaded from in the bootloader interface.
+    if let Some(loaded_image_partition_guid) = loaded_image_partition_guid {
+        // Tell the system about the partition GUID.
+        BootloaderInterface::set_partition_guid(&loaded_image_partition_guid)
+            .context("unable to set partition guid in bootloader interface")?;
+    }
+
+    // Tell the bootloader interface what the loaded image path is.
+    BootloaderInterface::set_loader_path(&loaded_image_path)
+        .context("unable to set loader path in bootloader interface")?;
+
+    // Create the root context.
+    let mut root = RootContext::new(loaded_image_path, timer, options);
+
     // Insert the configuration actions into the root context.
     root.actions_mut().extend(config.actions.clone());
 
@@ -159,13 +224,17 @@ fn run() -> Result<()> {
     for (name, generator) in config.generators {
         let context = context.fork().freeze();
 
-        // We will prefix all entries with [name]-.
+        // We will prefix all entries with [name]-, provided the name is not pinned.
         let prefix = format!("{}-", name);
 
         // Add all the entries generated by the generator to the entry list.
         // The generator specifies the context associated with the entry.
         for mut entry in generators::generate(context.clone(), &generator)? {
-            entry.prepend_name_prefix(&prefix);
+            // If the entry name is not pinned, prepend the name prefix.
+            if !entry.is_pin_name() {
+                entry.prepend_name_prefix(&prefix);
+            }
+
             entries.push(entry);
         }
     }
@@ -193,6 +262,80 @@ fn run() -> Result<()> {
         }
     }
 
+    // Tell the bootloader interface what entries are available.
+    BootloaderInterface::set_entries(entries.iter().map(|entry| entry.name()))
+        .context("unable to set entries in bootloader interface")?;
+
+    // Execute the late phase.
+    phase(context.clone(), &config.phases.late).context("unable to execute late phase")?;
+
+    // Acquire the timeout setting from the bootloader interface.
+    let bootloader_interface_timeout =
+        BootloaderInterface::get_timeout().context("unable to get bootloader interface timeout")?;
+
+    // Acquire the default entry from the bootloader interface.
+    let bootloader_interface_default_entry = BootloaderInterface::get_default_entry()
+        .context("unable to get bootloader interface default entry")?;
+
+    // Acquire the oneshot entry from the bootloader interface.
+    let bootloader_interface_oneshot_entry = BootloaderInterface::get_oneshot_entry()
+        .context("unable to get bootloader interface oneshot entry")?;
+
+    // If --boot is specified, boot that entry immediately.
+    let mut force_boot_entry = context.root().options().boot.clone();
+    // If --force-menu is specified, show the boot menu regardless of the value of --boot.
+    let mut force_boot_menu = context.root().options().force_menu;
+
+    // Determine the menu timeout in seconds based on the options or configuration.
+    // We prefer the options over the configuration to allow for overriding.
+    let mut menu_timeout = context
+        .root()
+        .options()
+        .menu_timeout
+        .unwrap_or(config.options.menu_timeout);
+
+    // Apply bootloader interface timeout settings.
+    match bootloader_interface_timeout {
+        BootloaderInterfaceTimeout::MenuForce => {
+            // Force the boot menu.
+            force_boot_menu = true;
+        }
+
+        BootloaderInterfaceTimeout::MenuHidden | BootloaderInterfaceTimeout::MenuDisabled => {
+            // Hide the boot menu by setting the timeout to zero.
+            menu_timeout = 0;
+        }
+
+        BootloaderInterfaceTimeout::Timeout(timeout) => {
+            // Configure the timeout to the specified value.
+            menu_timeout = timeout;
+        }
+
+        BootloaderInterfaceTimeout::Unspecified => {
+            // Do nothing.
+        }
+    }
+
+    // Apply bootloader interface default entry settings.
+    if let Some(ref bootloader_interface_default_entry) = bootloader_interface_default_entry {
+        // Iterate over all the entries and mark the default entry as the one specified.
+        for entry in &mut entries {
+            // Mark the entry as the default entry if it matches the specified entry.
+            // If the entry does not match the specified entry, unmark it as the default entry.
+            if entry.is_match(bootloader_interface_default_entry) {
+                entry.mark_default();
+            } else {
+                entry.unmark_default();
+            }
+        }
+    }
+
+    // Apply bootloader interface oneshot entry settings.
+    // If set, we will force booting the oneshot entry.
+    if let Some(ref bootloader_interface_oneshot_entry) = bootloader_interface_oneshot_entry {
+        force_boot_entry = Some(bootloader_interface_oneshot_entry.clone());
+    }
+
     // If no entries were the default, pick the first entry as the default entry.
     if entries.iter().all(|entry| !entry.is_default())
         && let Some(entry) = entries.first_mut()
@@ -200,21 +343,7 @@ fn run() -> Result<()> {
         entry.mark_default();
     }
 
-    // Execute the late phase.
-    phase(context.clone(), &config.phases.late).context("unable to execute late phase")?;
-
-    // If --boot is specified, boot that entry immediately.
-    let force_boot_entry = context.root().options().boot.as_ref();
-    // If --force-menu is specified, show the boot menu regardless of the value of --boot.
-    let force_boot_menu = context.root().options().force_menu;
-
-    // Determine the menu timeout in seconds based on the options or configuration.
-    // We prefer the options over the configuration to allow for overriding.
-    let menu_timeout = context
-        .root()
-        .options()
-        .menu_timeout
-        .unwrap_or(config.options.menu_timeout);
+    // Convert the menu timeout to a duration.
     let menu_timeout = Duration::from_secs(menu_timeout);
 
     // Use the forced boot entry if possible, otherwise pick the first entry using a boot menu.
@@ -223,9 +352,14 @@ fn run() -> Result<()> {
             .context(format!("unable to find entry: {force_boot_entry}"))?
     } else {
         // Delegate to the menu to select an entry to boot.
-        menu::select(menu_timeout, &entries).context("unable to select entry via boot menu")?
+        menu::select(&timer, menu_timeout, &entries)
+            .context("unable to select entry via boot menu")?
     };
 
+    // Tell the bootloader interface what the selected entry is.
+    BootloaderInterface::set_selected_entry(entry.name().to_string())
+        .context("unable to set selected entry in bootloader interface")?;
+
     // Execute all the actions for the selected entry.
     for action in &entry.declaration().actions {
         let action = entry.context().stamp(action);
@@ -251,8 +385,8 @@ fn main() -> Result<()> {
         for (index, stack) in error.chain().enumerate() {
             error!("[{}]: {}", index, stack);
         }
-        // Sleep for 10 seconds to allow the user to read the error.
-        uefi::boot::stall(Duration::from_secs(10));
+        // Sleep to allow the user to read the error.
+        uefi::boot::stall(DELAY_ON_ERROR);
     }
 
     // Sprout doesn't necessarily guarantee anything was booted.

crates/sprout/src/menu.rs

@@ -1,6 +1,8 @@
 use crate::entries::BootableEntry;
+use crate::integrations::bootloader_interface::BootloaderInterface;
+use crate::platform::timer::PlatformTimer;
 use anyhow::{Context, Result, bail};
-use log::info;
+use log::{info, warn};
 use std::time::Duration;
 use uefi::ResultExt;
 use uefi::boot::TimerTrigger;
@@ -54,16 +56,35 @@ fn read(input: &mut Input, timeout: &Duration) -> Result<MenuOperation> {
     uefi::boot::set_timer(&timer_event, trigger).context("unable to set timeout timer")?;
 
     let mut events = vec![timer_event, key_event];
-    let event = uefi::boot::wait_for_event(&mut events)
+
+    // Wait for either the timer event or the key event to trigger.
+    // Store the result so that we can free the timer event.
+    let event_result = uefi::boot::wait_for_event(&mut events)
         .discard_errdata()
-        .context("unable to wait for event")?;
+        .context("unable to wait for event");
 
     // Close the timer event that we acquired.
     // We don't need to close the key event because it is owned globally.
     if let Some(timer_event) = events.into_iter().next() {
-        uefi::boot::close_event(timer_event).context("unable to close timer event")?;
+        // Store the result of the close event so we can determine if we can safely assert it.
+        let close_event_result =
+            uefi::boot::close_event(timer_event).context("unable to close timer event");
+        if event_result.is_err()
+            && let Err(ref close_event_error) = close_event_result
+        {
+            // Log a warning if we failed to close the timer event.
+            // This is done to ensure we don't mask the wait_for_event error.
+            warn!("unable to close timer event: {}", close_event_error);
+        } else {
+            // If we reach here, we can safely assert that the close event succeeded without
+            // masking the wait_for_event error.
+            close_event_result?;
+        }
     }
 
+    // Acquire the event that triggered.
+    let event = event_result?;
+
     // The first event is the timer event.
     // If it has triggered, the user did not select a numbered entry.
     if event == 0 {
@@ -112,7 +133,7 @@ fn select_with_input<'a>(
             info!("Boot Menu:");
             for (index, entry) in entries.iter().enumerate() {
                 let title = entry.context().stamp(&entry.declaration().title);
-                info!("  [{}] {} ({})", index, title, entry.name());
+                info!("  [{}] {}", index, title);
             }
         }
 
@@ -162,7 +183,15 @@ fn select_with_input<'a>(
 /// Shows a boot menu to select a bootable entry to boot.
 /// The actual work is done internally in [select_with_input] which is called
 /// within the context of the standard input device.
-pub fn select(timeout: Duration, entries: &[BootableEntry]) -> Result<&BootableEntry> {
+pub fn select<'live>(
+    timer: &'live PlatformTimer,
+    timeout: Duration,
+    entries: &'live [BootableEntry],
+) -> Result<&'live BootableEntry> {
+    // Notify the bootloader interface that we are about to display the menu.
+    BootloaderInterface::mark_menu(timer)
+        .context("unable to mark menu display in bootloader interface")?;
+
     // Acquire the standard input device and run the boot menu.
     uefi::system::with_stdin(move |input| select_with_input(input, timeout, entries))
 }

crates/sprout/src/options.rs

@@ -44,6 +44,13 @@ impl OptionsRepresentable for SproutOptions {
     /// All the Sprout options that are defined.
     fn options() -> &'static [(&'static str, OptionDescription<'static>)] {
         &[
+            (
+                "autoconfigure",
+                OptionDescription {
+                    description: "Enable Sprout Autoconfiguration",
+                    form: OptionForm::Flag,
+                },
+            ),
             (
                 "config",
                 OptionDescription {

crates/sprout/src/options/parser.rs

@@ -46,8 +46,24 @@ pub trait OptionsRepresentable {
         let configured: BTreeMap<_, _> = BTreeMap::from_iter(Self::options().to_vec());
 
         // Collect all the arguments to Sprout.
-        // Skip the first argument which is the path to our executable.
-        let args = std::env::args().skip(1).collect::<Vec<_>>();
+        // Skip the first argument, which is the path to our executable.
+        let mut args = std::env::args().skip(1).collect::<Vec<_>>();
+
+        // Correct firmware that may add invalid arguments at the start.
+        // Witnessed this on a Dell Precision 5690 when direct booting.
+        loop {
+            // Grab the first argument or break.
+            let Some(arg) = args.first() else {
+                break;
+            };
+
+            // If the argument starts with a tilde, remove it.
+            if arg.starts_with("`") {
+                args.remove(0);
+                continue;
+            }
+            break;
+        }
 
         // Represent options as key-value pairs.
         let mut options = BTreeMap::new();
@@ -96,7 +112,7 @@ pub trait OptionsRepresentable {
                 let maybe_next = iterator.peek();
 
                 // If the next value isn't another option, set the value to the next value.
-                // Otherwise, it is an empty string.
+                // Otherwise, it is None.
                 value = if let Some(next) = maybe_next
                     && !next.starts_with("--")
                 {

crates/sprout/src/phases.rs

@@ -0,0 +1,25 @@
+use crate::actions;
+use crate::context::SproutContext;
+use anyhow::{Context, Result};
+use edera_sprout_config::phases::PhaseConfiguration;
+use std::rc::Rc;
+
+/// Executes the specified [phase] of the boot process.
+/// The value [phase] should be a reference of a specific phase in the [PhasesConfiguration].
+/// Any error from the actions is propagated into the [Result] and will interrupt further
+/// execution of phase actions.
+pub fn phase(context: Rc<SproutContext>, phase: &[PhaseConfiguration]) -> Result<()> {
+    for item in phase {
+        let mut context = context.fork();
+        // Insert the values into the context.
+        context.insert(&item.values);
+        let context = context.freeze();
+
+        // Execute all the actions in this phase configuration.
+        for action in item.actions.iter() {
+            actions::execute(context.clone(), action)
+                .context(format!("unable to execute action '{}'", action))?;
+        }
+    }
+    Ok(())
+}

crates/sprout/src/platform.rs

@@ -0,0 +1,4 @@
+/// timer: Platform timer support.
+pub mod timer;
+/// tpm: Platform TPM support.
+pub mod tpm;

crates/sprout/src/platform/timer.rs

@@ -0,0 +1,94 @@
+// Referenced https://github.com/sheroz/tick_counter (MIT license) as a baseline.
+// Architecturally modified to support UEFI and remove x86 (32-bit) support.
+
+use std::time::Duration;
+
+/// Support for aarch64 timers.
+#[cfg(target_arch = "aarch64")]
+pub mod aarch64;
+
+/// Support for x86_64 timers.
+#[cfg(target_arch = "x86_64")]
+pub mod x86_64;
+
+/// The tick frequency of the platform.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum TickFrequency {
+    /// The platform provides the tick frequency.
+    Hardware(u64),
+    /// The tick frequency is measured internally.
+    Measured(u64, Duration),
+}
+
+impl TickFrequency {
+    /// Acquire the tick frequency reported by the platform.
+    fn ticks(&self) -> u64 {
+        match self {
+            TickFrequency::Hardware(frequency) => *frequency,
+            TickFrequency::Measured(frequency, _) => *frequency,
+        }
+    }
+
+    /// Calculate the nanoseconds represented by a tick.
+    fn nanos(&self) -> f64 {
+        1.0e9_f64 / (self.ticks() as f64)
+    }
+
+    /// Produce a duration from the provided elapsed `ticks` value.
+    fn duration(&self, ticks: u64) -> Duration {
+        let accuracy = self.nanos();
+        let nanos = ticks as f64 * accuracy;
+        Duration::from_nanos(nanos as u64)
+    }
+}
+
+/// Acquire the tick value reported by the platform.
+fn arch_ticks() -> u64 {
+    #[cfg(target_arch = "aarch64")]
+    return aarch64::ticks();
+    #[cfg(target_arch = "x86_64")]
+    return x86_64::ticks();
+}
+
+/// Acquire the tick frequency reported by the platform.
+fn arch_frequency() -> TickFrequency {
+    #[cfg(target_arch = "aarch64")]
+    let frequency = aarch64::frequency();
+    #[cfg(target_arch = "x86_64")]
+    let frequency = x86_64::frequency();
+    // If the frequency is 0, then something went very wrong and we should panic.
+    if frequency.ticks() == 0 {
+        panic!("timer frequency is zero");
+    }
+    frequency
+}
+
+/// Platform timer that allows measurement of the elapsed time.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct PlatformTimer {
+    /// The start tick value.
+    start: u64,
+    /// The tick frequency of the platform.
+    frequency: TickFrequency,
+}
+
+impl PlatformTimer {
+    /// Start a platform timer at the current instant.
+    pub fn start() -> Self {
+        Self {
+            start: arch_ticks(),
+            frequency: arch_frequency(),
+        }
+    }
+
+    /// Measure the elapsed duration since the hardware started ticking upwards.
+    pub fn elapsed_since_lifetime(&self) -> Duration {
+        self.frequency.duration(arch_ticks())
+    }
+
+    /// Measure the elapsed duration since the timer was started.
+    pub fn elapsed_since_start(&self) -> Duration {
+        let duration = arch_ticks().wrapping_sub(self.start);
+        self.frequency.duration(duration)
+    }
+}

crates/sprout/src/platform/timer/aarch64.rs

@@ -0,0 +1,33 @@
+use crate::platform::timer::TickFrequency;
+use std::arch::asm;
+
+/// Reads the cntvct_el0 counter and returns the value.
+pub fn ticks() -> u64 {
+    let counter: u64;
+    unsafe {
+        asm!("mrs x0, cntvct_el0", out("x0") counter);
+    }
+    counter
+}
+
+/// We can use the actual ticks value as our start value.
+pub fn start() -> u64 {
+    ticks()
+}
+
+/// We can use the actual ticks value as our stop value.
+pub fn stop() -> u64 {
+    ticks()
+}
+
+/// Our frequency is provided by cntfrq_el0 on the platform.
+pub fn frequency() -> TickFrequency {
+    let frequency: u64;
+    unsafe {
+        asm!(
+            "mrs x0, cntfrq_el0",
+            out("x0") frequency
+        );
+    }
+    TickFrequency::Hardware(frequency)
+}

crates/sprout/src/platform/timer/x86_64.rs

@@ -0,0 +1,66 @@
+use crate::platform::timer::TickFrequency;
+use core::arch::asm;
+use std::time::Duration;
+
+/// We will measure the frequency of the timer based on 1000 microseconds.
+/// This will result in a call to BS->Stall(1000) in the end.
+const MEASURE_FREQUENCY_DURATION: Duration = Duration::from_micros(1000);
+
+/// Read the number of ticks from the platform timer.
+pub fn ticks() -> u64 {
+    let mut eax: u32;
+    let mut edx: u32;
+
+    unsafe {
+        asm!("rdtsc", out("eax") eax, out("edx") edx);
+    }
+
+    (edx as u64) << 32 | eax as u64
+}
+
+/// Read the starting number of ticks from the platform timer.
+pub fn start() -> u64 {
+    let rax: u64;
+    unsafe {
+        asm!(
+            "mfence",
+            "lfence",
+            "rdtsc",
+            "shl rdx, 32",
+            "or rax, rdx",
+            out("rax") rax
+        );
+    }
+    rax
+}
+
+/// Read the ending number of ticks from the platform timer.
+pub fn stop() -> u64 {
+    let rax: u64;
+    unsafe {
+        asm!(
+        "rdtsc",
+        "lfence",
+        "shl rdx, 32",
+        "or rax, rdx",
+        out("rax") rax
+        );
+    }
+    rax
+}
+
+/// Measure the frequency of the platform timer.
+fn measure_frequency() -> u64 {
+    let start = start();
+    uefi::boot::stall(MEASURE_FREQUENCY_DURATION);
+    let stop = stop();
+    let elapsed = stop.wrapping_sub(start) as f64;
+    (elapsed / MEASURE_FREQUENCY_DURATION.as_secs_f64()) as u64
+}
+
+/// Acquire the platform timer frequency.
+/// On x86_64, this is slightly expensive, so it should be done once.
+pub fn frequency() -> TickFrequency {
+    let frequency = measure_frequency();
+    TickFrequency::Measured(frequency, MEASURE_FREQUENCY_DURATION)
+}

crates/sprout/src/platform/tpm.rs

@@ -0,0 +1,128 @@
+use crate::utils;
+use anyhow::{Context, Result};
+use uefi::ResultExt;
+use uefi::boot::ScopedProtocol;
+use uefi::proto::tcg::PcrIndex;
+use uefi::proto::tcg::v2::{PcrEventInputs, Tcg};
+use uefi_raw::protocol::tcg::EventType;
+use uefi_raw::protocol::tcg::v2::{Tcg2HashLogExtendEventFlags, Tcg2Protocol, Tcg2Version};
+
+/// Represents the platform TPM.
+pub struct PlatformTpm;
+
+/// Represents an open TPM handle.
+pub struct TpmProtocolHandle {
+    /// The version of the TPM protocol.
+    version: Tcg2Version,
+    /// The protocol itself.
+    protocol: ScopedProtocol<Tcg>,
+}
+
+impl TpmProtocolHandle {
+    /// Construct a new [TpmProtocolHandle] from the `version` and `protocol`.
+    pub fn new(version: Tcg2Version, protocol: ScopedProtocol<Tcg>) -> Self {
+        Self { version, protocol }
+    }
+
+    /// Access the version provided by the tcg2 protocol.
+    pub fn version(&self) -> Tcg2Version {
+        self.version
+    }
+
+    /// Access the protocol interface for tcg2.
+    pub fn protocol(&mut self) -> &mut ScopedProtocol<Tcg> {
+        &mut self.protocol
+    }
+}
+
+impl PlatformTpm {
+    /// The PCR for measuring the bootloader configuration into.
+    pub const PCR_BOOT_LOADER_CONFIG: PcrIndex = PcrIndex(5);
+
+    /// Acquire access to the TPM protocol handle, if possible.
+    /// Returns None if TPM is not available.
+    fn protocol() -> Result<Option<TpmProtocolHandle>> {
+        // Attempt to acquire the TCG2 protocol handle. If it's not available, return None.
+        let Some(handle) =
+            utils::find_handle(&Tcg2Protocol::GUID).context("unable to determine tpm presence")?
+        else {
+            return Ok(None);
+        };
+
+        // If we reach here, we've already validated that the handle
+        // implements the TCG2 protocol.
+        let mut protocol = uefi::boot::open_protocol_exclusive::<Tcg>(handle)
+            .context("unable to open tcg2 protocol")?;
+
+        // Acquire the capabilities of the TPM.
+        let capability = protocol
+            .get_capability()
+            .context("unable to get tcg2 boot service capability")?;
+
+        // If the TPM is not present, return None.
+        if !capability.tpm_present() {
+            return Ok(None);
+        }
+
+        // If the TPM is present, we need to determine the version of the TPM.
+        let version = capability.protocol_version;
+
+        // We have a TPM, so return the protocol version and the protocol handle.
+        Ok(Some(TpmProtocolHandle::new(version, protocol)))
+    }
+
+    /// Determines whether the platform TPM is present.
+    pub fn present() -> Result<bool> {
+        Ok(PlatformTpm::protocol()?.is_some())
+    }
+
+    /// Determine the number of active PCR banks on the TPM.
+    /// If no TPM is available, this will return zero.
+    pub fn active_pcr_banks() -> Result<u32> {
+        // Acquire access to the TPM protocol handle.
+        let Some(mut handle) = PlatformTpm::protocol()? else {
+            return Ok(0);
+        };
+
+        // Check if the TPM supports `GetActivePcrBanks`, and if it doesn't return zero.
+        if handle.version().major < 1 || handle.version().major == 1 && handle.version().minor < 1 {
+            return Ok(0);
+        }
+
+        // The safe wrapper for this function will decode the bitmap.
+        // Strictly speaking, it's not future-proof to re-encode that, but in practice it will work.
+        let banks = handle
+            .protocol()
+            .get_active_pcr_banks()
+            .context("unable to get active pcr banks")?;
+
+        // Return the number of active PCR banks.
+        Ok(banks.bits())
+    }
+
+    /// Log an event into the TPM pcr `pcr_index` with `buffer` as data. The `description`
+    /// is used to describe what the event is.
+    ///
+    /// If a TPM is not available, this will do nothing.
+    pub fn log_event(pcr_index: PcrIndex, buffer: &[u8], description: &str) -> Result<()> {
+        // Acquire access to the TPM protocol handle.
+        let Some(mut handle) = PlatformTpm::protocol()? else {
+            return Ok(());
+        };
+
+        // Encode the description as UTF-8.
+        let description = description.as_bytes().to_vec();
+
+        // Construct an event input for the TPM.
+        let event = PcrEventInputs::new_in_box(pcr_index, EventType::IPL, &description)
+            .discard_errdata()
+            .context("unable to construct pcr event inputs")?;
+
+        // Log the event into the TPM.
+        handle
+            .protocol()
+            .hash_log_extend_event(Tcg2HashLogExtendEventFlags::empty(), buffer, &event)
+            .context("unable to log event to tpm")?;
+        Ok(())
+    }
+}

crates/sprout/src/sbat.rs

@@ -0,0 +1,11 @@
+/// SBAT must be aligned by 512 bytes.
+const SBAT_SIZE: usize = 512;
+
+/// Define the SBAT attestation by including the sbat.csv file.
+/// See this document for more details: https://github.com/rhboot/shim/blob/main/SBAT.md
+/// NOTE: Alignment can't be enforced by an attribute, so instead the alignment is currently
+/// enforced by the SBAT_SIZE being 512. The build.rs will ensure that the sbat.csv is padded.
+/// This code will not compile if the sbat.csv is a different size than SBAT_SIZE.
+#[used]
+#[unsafe(link_section = ".sbat")]
+static SBAT: [u8; SBAT_SIZE] = *include_bytes!(concat!(env!("OUT_DIR"), "/sbat.csv"));

crates/sprout/src/sbat.template.csv

@@ -0,0 +1,2 @@
+sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
+sprout,1,Edera,sprout,{version},https://sprout.edera.dev

crates/sprout/src/secure.rs

@@ -0,0 +1,14 @@
+use crate::utils::variables::VariableController;
+use anyhow::Result;
+
+/// Secure boot services.
+pub struct SecureBoot;
+
+impl SecureBoot {
+    /// Checks if Secure Boot is enabled on the system.
+    /// This might fail if retrieving the variable fails in an irrecoverable way.
+    pub fn enabled() -> Result<bool> {
+        // The SecureBoot variable will tell us whether Secure Boot is enabled at all.
+        VariableController::GLOBAL.get_bool("SecureBoot")
+    }
+}

crates/sprout/src/utils.rs

@@ -1,10 +1,14 @@
-use anyhow::{Context, Result};
+use anyhow::{Context, Result, bail};
+use sha2::{Digest, Sha256};
 use std::ops::Deref;
+use uefi::boot::SearchType;
 use uefi::fs::{FileSystem, Path};
 use uefi::proto::device_path::text::{AllowShortcuts, DevicePathFromText, DisplayOnly};
 use uefi::proto::device_path::{DevicePath, PoolDevicePath};
 use uefi::proto::media::fs::SimpleFileSystem;
-use uefi::{CString16, Handle};
+use uefi::proto::media::partition::PartitionInfo;
+use uefi::{CString16, Guid, Handle};
+use uefi_raw::Status;
 
 /// Support code for the EFI framebuffer.
 pub mod framebuffer;
@@ -12,6 +16,12 @@ pub mod framebuffer;
 /// Support code for the media loader protocol.
 pub mod media_loader;
 
+/// Support code for EFI variables.
+pub mod variables;
+
+/// Implements a version comparison algorithm according to the BLS specification.
+pub mod vercmp;
+
 /// Parses the input `path` as a [DevicePath].
 /// Uses the [DevicePathFromText] protocol exclusively, and will fail if it cannot acquire the protocol.
 pub fn text_to_device_path(path: &str) -> Result<PoolDevicePath> {
@@ -98,10 +108,24 @@ pub struct ResolvedPath {
     pub filesystem_handle: Handle,
 }
 
+impl ResolvedPath {
+    /// Read the file specified by this path into a buffer and return it.
+    pub fn read_file(&self) -> Result<Vec<u8>> {
+        let fs = uefi::boot::open_protocol_exclusive::<SimpleFileSystem>(self.filesystem_handle)
+            .context("unable to open filesystem protocol")?;
+        let mut fs = FileSystem::new(fs);
+        let path = self
+            .sub_path
+            .to_string(DisplayOnly(false), AllowShortcuts(false))?;
+        let content = fs.read(Path::new(&path));
+        content.context("unable to read file contents")
+    }
+}
+
 /// Resolve a path specified by `input` to its various components.
 /// Uses `default_root_path` as the base root if one is not specified in the path.
 /// Returns [ResolvedPath] which contains the resolved components.
-pub fn resolve_path(default_root_path: &DevicePath, input: &str) -> Result<ResolvedPath> {
+pub fn resolve_path(default_root_path: Option<&DevicePath>, input: &str) -> Result<ResolvedPath> {
     let mut path = text_to_device_path(input).context("unable to convert text to path")?;
     let path_has_device = path
         .node_iter()
@@ -117,6 +141,9 @@ pub fn resolve_path(default_root_path: &DevicePath, input: &str) -> Result<Resol
         if !input.starts_with('\\') {
             input.insert(0, '\\');
         }
+
+        let default_root_path = default_root_path.context("unable to get default root path")?;
+
         input.insert_str(
             0,
             device_path_root(default_root_path)
@@ -131,8 +158,11 @@ pub fn resolve_path(default_root_path: &DevicePath, input: &str) -> Result<Resol
     let root_path = text_to_device_path(root.as_str())
         .context("unable to convert root to path")?
         .to_boxed();
-    let mut root_path = root_path.as_ref();
-    let handle = uefi::boot::locate_device_path::<SimpleFileSystem>(&mut root_path)
+    let root_path = root_path.as_ref();
+
+    // locate_device_path modifies the path, so we need to clone it.
+    let root_path_modifiable = root_path.to_owned();
+    let handle = uefi::boot::locate_device_path::<SimpleFileSystem>(&mut &*root_path_modifiable)
         .context("unable to locate filesystem device path")?;
     let subpath = device_path_subpath(path.deref()).context("unable to get device subpath")?;
     Ok(ResolvedPath {
@@ -150,16 +180,9 @@ pub fn resolve_path(default_root_path: &DevicePath, input: &str) -> Result<Resol
 /// This acquires exclusive protocol access to the [SimpleFileSystem] protocol of the resolved
 /// filesystem handle, so care must be taken to call this function outside a scope with
 /// the filesystem handle protocol acquired.
-pub fn read_file_contents(default_root_path: &DevicePath, input: &str) -> Result<Vec<u8>> {
+pub fn read_file_contents(default_root_path: Option<&DevicePath>, input: &str) -> Result<Vec<u8>> {
     let resolved = resolve_path(default_root_path, input)?;
-    let fs = uefi::boot::open_protocol_exclusive::<SimpleFileSystem>(resolved.filesystem_handle)
-        .context("unable to open filesystem protocol")?;
-    let mut fs = FileSystem::new(fs);
-    let path = resolved
-        .sub_path
-        .to_string(DisplayOnly(false), AllowShortcuts(false))?;
-    let content = fs.read(Path::new(&path));
-    content.context("unable to read file contents")
+    resolved.read_file()
 }
 
 /// Filter a string-like Option `input` such that an empty string is [None].
@@ -179,5 +202,96 @@ pub fn combine_options<T: AsRef<str>>(options: impl Iterator<Item = T>) -> Strin
 /// Produce a unique hash for the input.
 /// This uses SHA-256, which is unique enough but relatively short.
 pub fn unique_hash(input: &str) -> String {
-    sha256::digest(input.as_bytes())
+    hex::encode(Sha256::digest(input.as_bytes()))
+}
+
+/// Represents the type of partition GUID that can be retrieved.
+#[derive(PartialEq, Eq)]
+pub enum PartitionGuidForm {
+    /// The partition GUID is the unique partition GUID.
+    Partition,
+    /// The partition GUID is the partition type GUID.
+    PartitionType,
+}
+
+/// Retrieve the partition / partition type GUID of the device root `path`.
+/// This only works on GPT partitions. If the root is not a GPT partition, None is returned.
+/// If the GUID is all zeros, this will return None.
+pub fn partition_guid(path: &DevicePath, form: PartitionGuidForm) -> Result<Option<Guid>> {
+    // Clone the path so we can pass it to the UEFI stack.
+    let path = path.to_boxed();
+    let result = uefi::boot::locate_device_path::<PartitionInfo>(&mut &*path);
+    let handle = match result {
+        Ok(handle) => Ok(Some(handle)),
+        Err(error) => {
+            // If the error is NOT_FOUND or UNSUPPORTED, we can return None.
+            // These are non-fatal errors.
+            if error.status() == Status::NOT_FOUND || error.status() == Status::UNSUPPORTED {
+                Ok(None)
+            } else {
+                Err(error)
+            }
+        }
+    }
+    .context("unable to locate device path")?;
+
+    // If we have the handle, we can try to open the partition info protocol.
+    if let Some(handle) = handle {
+        // Open the partition info protocol.
+        let partition_info = uefi::boot::open_protocol_exclusive::<PartitionInfo>(handle)
+            .context("unable to open partition info protocol")?;
+        // Find the unique partition GUID.
+        // If this is not a GPT partition, this will produce None.
+        Ok(partition_info
+            .gpt_partition_entry()
+            .map(|entry| match form {
+                // Match the form of the partition GUID.
+                PartitionGuidForm::Partition => entry.unique_partition_guid,
+                PartitionGuidForm::PartitionType => entry.partition_type_guid.0,
+            })
+            .filter(|guid| !guid.is_zero()))
+    } else {
+        Ok(None)
+    }
+}
+
+/// Find a handle that provides the specified `protocol`.
+pub fn find_handle(protocol: &Guid) -> Result<Option<Handle>> {
+    // Locate the requested protocol handle.
+    match uefi::boot::locate_handle_buffer(SearchType::ByProtocol(protocol)) {
+        // If a handle is found, the protocol is available.
+        Ok(handles) => Ok(if handles.is_empty() {
+            None
+        } else {
+            Some(handles[0])
+        }),
+        // If an error occurs, check if it is because the protocol is not available.
+        // If so, return false. Otherwise, return the error.
+        Err(error) => {
+            if error.status() == Status::NOT_FOUND {
+                Ok(None)
+            } else {
+                Err(error).context("unable to determine if the protocol is available")
+            }
+        }
+    }
+}
+
+/// Convert a byte slice into a CString16.
+pub fn utf16_bytes_to_cstring16(bytes: &[u8]) -> Result<CString16> {
+    // Validate the input bytes are the right length.
+    if !bytes.len().is_multiple_of(2) {
+        bail!("utf16 bytes must be a multiple of 2");
+    }
+
+    // Convert the bytes to UTF-16 data.
+    let data = bytes
+        // Chunk everything into two bytes.
+        .chunks_exact(2)
+        // Reinterpret the bytes as u16 little-endian.
+        .map(|chunk| u16::from_le_bytes([chunk[0], chunk[1]]))
+        // Collect the result into a vector.
+        .collect::<Vec<_>>();
+
+    CString16::try_from(data).context("unable to convert utf16 bytes to CString16")
 }

crates/sprout/src/utils/media_loader.rs

@@ -33,8 +33,6 @@ struct MediaLoaderProtocol {
 /// You MUST call [MediaLoaderHandle::unregister] when ready to unregister.
 /// [Drop] is not implemented for this type.
 pub struct MediaLoaderHandle {
-    /// The vendor GUID of the media loader.
-    guid: Guid,
     /// The handle of the media loader in the UEFI stack.
     handle: Handle,
     /// The protocol interface pointer.
@@ -229,7 +227,6 @@ impl MediaLoaderHandle {
 
         // Return a handle to the media loader.
         Ok(Self {
-            guid,
             handle: primary_handle,
             protocol,
             path,
@@ -239,13 +236,8 @@ impl MediaLoaderHandle {
     /// Unregisters a media loader from the UEFI stack.
     /// This will free the memory allocated by the passed data.
     pub fn unregister(self) -> Result<()> {
-        // Check if the media loader is registered.
-        // If it is not, we don't need to do anything.
-        if !Self::already_registered(self.guid)? {
-            return Ok(());
-        }
-
-        // SAFETY: We know that the media loader is registered, so we can safely uninstall it.
+        // SAFETY: We know that the media loader is registered if the handle is valid,
+        // so we can safely uninstall it.
         // We should have allocated the pointers involved, so we can safely free them.
         unsafe {
             // Uninstall the protocol interface for the device path protocol.

crates/sprout/src/utils/variables.rs

@@ -0,0 +1,152 @@
+use crate::utils;
+use anyhow::{Context, Result};
+use log::warn;
+use uefi::{CString16, guid};
+use uefi_raw::Status;
+use uefi_raw::table::runtime::{VariableAttributes, VariableVendor};
+
+/// The classification of a variable.
+/// This is an abstraction over various variable attributes.
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+pub enum VariableClass {
+    /// The variable is available in Boot Services and Runtime Services and is not persistent.
+    BootAndRuntimeTemporary,
+}
+
+impl VariableClass {
+    /// The [VariableAttributes] for this classification.
+    fn attributes(&self) -> VariableAttributes {
+        match self {
+            VariableClass::BootAndRuntimeTemporary => {
+                VariableAttributes::BOOTSERVICE_ACCESS | VariableAttributes::RUNTIME_ACCESS
+            }
+        }
+    }
+}
+
+/// Provides access to a particular set of vendor variables.
+pub struct VariableController {
+    /// The GUID of the vendor.
+    vendor: VariableVendor,
+}
+
+impl VariableController {
+    /// Global variables.
+    pub const GLOBAL: VariableController = VariableController::new(VariableVendor(guid!(
+        "8be4df61-93ca-11d2-aa0d-00e098032b8c"
+    )));
+
+    /// Create a new [VariableController] for the `vendor`.
+    pub const fn new(vendor: VariableVendor) -> Self {
+        Self { vendor }
+    }
+
+    /// Convert `key` to a variable name as a CString16.
+    fn name(key: &str) -> Result<CString16> {
+        CString16::try_from(key).context("unable to convert variable name to CString16")
+    }
+
+    /// Retrieve the cstr16 value specified by the `key`.
+    /// Returns None if the value isn't set.
+    /// If the value is not decodable, we will return None and log a warning.
+    pub fn get_cstr16(&self, key: &str) -> Result<Option<String>> {
+        let name = Self::name(key)?;
+
+        // Retrieve the variable data, handling variable not existing as None.
+        match uefi::runtime::get_variable_boxed(&name, &self.vendor) {
+            Ok((data, _)) => {
+                // Try to decode UTF-16 bytes to a CString16.
+                match utils::utf16_bytes_to_cstring16(&data) {
+                    Ok(value) => {
+                        // We have a value, so return the UTF-8 value.
+                        Ok(Some(value.to_string()))
+                    }
+
+                    Err(error) => {
+                        // We encountered an error, so warn and return None.
+                        warn!("efi variable '{}' is not valid UTF-16: {}", key, error);
+                        Ok(None)
+                    }
+                }
+            }
+
+            Err(error) => {
+                // If the variable does not exist, we will return None.
+                if error.status() == Status::NOT_FOUND {
+                    Ok(None)
+                } else {
+                    Err(error).with_context(|| format!("unable to get efi variable {}", key))
+                }
+            }
+        }
+    }
+
+    /// Retrieve a boolean value specified by the `key`.
+    pub fn get_bool(&self, key: &str) -> Result<bool> {
+        let name = Self::name(key)?;
+
+        // Retrieve the variable data, handling variable not existing as false.
+        match uefi::runtime::get_variable_boxed(&name, &self.vendor) {
+            Ok((data, _)) => {
+                // If the variable is zero-length, we treat it as false.
+                if data.is_empty() {
+                    Ok(false)
+                } else {
+                    // We treat the variable as true if the first byte is non-zero.
+                    Ok(data[0] > 0)
+                }
+            }
+
+            Err(error) => {
+                // If the variable does not exist, we treat it as false.
+                if error.status() == Status::NOT_FOUND {
+                    Ok(false)
+                } else {
+                    Err(error).with_context(|| format!("unable to get efi variable {}", key))
+                }
+            }
+        }
+    }
+
+    /// Set a variable specified by `key` to `value`.
+    /// The variable `class` controls the attributes for the variable.
+    pub fn set(&self, key: &str, value: &[u8], class: VariableClass) -> Result<()> {
+        let name = Self::name(key)?;
+        uefi::runtime::set_variable(&name, &self.vendor, class.attributes(), value)
+            .with_context(|| format!("unable to set efi variable {}", key))?;
+        Ok(())
+    }
+
+    /// Set a variable specified by `key` to `value`, converting the value to
+    /// a [CString16]. The variable `class` controls the attributes for the variable.
+    pub fn set_cstr16(&self, key: &str, value: &str, class: VariableClass) -> Result<()> {
+        // Encode the value as a CString16 little endian.
+        let mut encoded = value
+            .encode_utf16()
+            .flat_map(|c| c.to_le_bytes())
+            .collect::<Vec<u8>>();
+        // Add a null terminator to the end of the value.
+        encoded.extend_from_slice(&[0, 0]);
+        self.set(key, &encoded, class)
+    }
+
+    /// Set a boolean variable specified by `key` to `value`, converting the value.
+    /// The variable `class` controls the attributes for the variable.
+    pub fn set_bool(&self, key: &str, value: bool, class: VariableClass) -> Result<()> {
+        self.set(key, &[value as u8], class)
+    }
+
+    /// Set the u64 little-endian variable specified by `key` to `value`.
+    /// The variable `class` controls the attributes for the variable.
+    pub fn set_u64le(&self, key: &str, value: u64, class: VariableClass) -> Result<()> {
+        self.set(key, &value.to_le_bytes(), class)
+    }
+
+    pub fn remove(&self, key: &str) -> Result<()> {
+        let name = Self::name(key)?;
+
+        // Delete the variable from UEFI.
+        uefi::runtime::delete_variable(&name, &self.vendor)
+            .with_context(|| format!("unable to remove efi variable {}", key))
+    }
+}

crates/sprout/src/utils/vercmp.rs

@@ -0,0 +1,184 @@
+use std::cmp::Ordering;
+use std::iter::Peekable;
+
+/// Handles single character advancement and comparison.
+macro_rules! handle_single_char {
+    ($ca: expr, $cb:expr, $a_chars:expr, $b_chars:expr, $c:expr) => {
+        match ($ca == $c, $cb == $c) {
+            (true, false) => return Ordering::Less,
+            (false, true) => return Ordering::Greater,
+            (true, true) => {
+                $a_chars.next();
+                $b_chars.next();
+                continue;
+            }
+            _ => {}
+        }
+    };
+}
+
+/// Compares two strings using the BLS version comparison specification.
+/// Handles optional values as well by comparing only if both are specified.
+pub fn compare_versions_optional(a: Option<&str>, b: Option<&str>) -> Ordering {
+    match (a, b) {
+        // If both have values, compare them.
+        (Some(a), Some(b)) => compare_versions(a, b),
+        // If the second value is None, return that it is less than the first.
+        (Some(_a), None) => Ordering::Less,
+        // If the first value is None, return that it is greater than the second.
+        (None, Some(_b)) => Ordering::Greater,
+        // If both values are None, return that they are equal.
+        (None, None) => Ordering::Equal,
+    }
+}
+
+/// Compares two strings using the BLS version comparison specification.
+/// See: https://uapi-group.org/specifications/specs/version_format_specification/
+pub fn compare_versions(a: &str, b: &str) -> Ordering {
+    // Acquire a peekable iterator for each string.
+    let mut a_chars = a.chars().peekable();
+    let mut b_chars = b.chars().peekable();
+
+    // Loop until we have reached the end of one of the strings.
+    loop {
+        // Skip invalid characters in both strings.
+        skip_invalid(&mut a_chars);
+        skip_invalid(&mut b_chars);
+
+        // Check if either string has ended.
+        match (a_chars.peek(), b_chars.peek()) {
+            // No more characters in either string.
+            (None, None) => return Ordering::Equal,
+            // One string has ended, the other hasn't.
+            (None, Some(_)) => return Ordering::Less,
+            (Some(_), None) => return Ordering::Greater,
+            // Both strings have characters left.
+            (Some(&ca), Some(&cb)) => {
+                // Handle the ~ character.
+                handle_single_char!(ca, cb, a_chars, b_chars, '~');
+
+                // Handle '-' character.
+                handle_single_char!(ca, cb, a_chars, b_chars, '-');
+
+                // Handle the '^' character.
+                handle_single_char!(ca, cb, a_chars, b_chars, '^');
+
+                // Handle the '.' character.
+                handle_single_char!(ca, cb, a_chars, b_chars, '.');
+
+                // Handle digits with numerical comparison.
+                // We key off of the A character being a digit intentionally as we presume
+                // this indicates it will be the same at this position.
+                if ca.is_ascii_digit() || cb.is_ascii_digit() {
+                    let result = compare_numeric(&mut a_chars, &mut b_chars);
+                    if result != Ordering::Equal {
+                        return result;
+                    }
+                    continue;
+                }
+
+                // Handle letters with alphabetical comparison.
+                // We key off of the A character being alphabetical intentionally as we presume
+                // this indicates it will be the same at this position.
+                if ca.is_ascii_alphabetic() || cb.is_ascii_alphabetic() {
+                    let result = compare_alphabetic(&mut a_chars, &mut b_chars);
+                    if result != Ordering::Equal {
+                        return result;
+                    }
+                    continue;
+                }
+            }
+        }
+    }
+}
+
+/// Skips characters that are not in the valid character set.
+fn skip_invalid<I: Iterator<Item = char>>(iter: &mut Peekable<I>) {
+    while let Some(&c) = iter.peek() {
+        if is_valid_char(c) {
+            break;
+        }
+        iter.next();
+    }
+}
+
+/// Checks if a character is in the valid character set for comparison.
+fn is_valid_char(c: char) -> bool {
+    matches!(c, 'a'..='z' | 'A'..='Z' | '0'..='9' | '-' | '.' | '~' | '^')
+}
+
+/// Compares numerical prefixes by extracting numbers.
+fn compare_numeric<I: Iterator<Item = char>>(
+    iter_a: &mut Peekable<I>,
+    iter_b: &mut Peekable<I>,
+) -> Ordering {
+    let num_a = extract_number(iter_a);
+    let num_b = extract_number(iter_b);
+
+    num_a.cmp(&num_b)
+}
+
+/// Extracts a number from the iterator, skipping leading zeros.
+fn extract_number<I: Iterator<Item = char>>(iter: &mut Peekable<I>) -> u64 {
+    // Skip leading zeros
+    while let Some(&'0') = iter.peek() {
+        iter.next();
+    }
+
+    let mut num = 0u64;
+    while let Some(&c) = iter.peek() {
+        if c.is_ascii_digit() {
+            iter.next();
+            num = num.saturating_mul(10).saturating_add(c as u64 - '0' as u64);
+        } else {
+            break;
+        }
+    }
+
+    num
+}
+
+/// Compares alphabetical prefixes
+/// Capital letters compare lower than lowercase letters (B < a)
+fn compare_alphabetic<I: Iterator<Item = char>>(
+    iter_a: &mut Peekable<I>,
+    iter_b: &mut Peekable<I>,
+) -> Ordering {
+    loop {
+        return match (iter_a.peek(), iter_b.peek()) {
+            (Some(&ca), Some(&cb)) if ca.is_ascii_alphabetic() && cb.is_ascii_alphabetic() => {
+                if ca == cb {
+                    // Same character, we should continue.
+                    iter_a.next();
+                    iter_b.next();
+                    continue;
+                }
+
+                // Different characters found.
+                // All capital letters compare lower than lowercase letters.
+                match (ca.is_ascii_uppercase(), cb.is_ascii_uppercase()) {
+                    (true, false) => Ordering::Less,    // uppercase < lowercase
+                    (false, true) => Ordering::Greater, // lowercase > uppercase
+                    (true, true) => ca.cmp(&cb),        // both are uppercase
+                    (false, false) => ca.cmp(&cb),      // both are lowercase
+                }
+            }
+
+            (Some(&ca), Some(_)) if ca.is_ascii_alphabetic() => {
+                // a has letters, b doesn't
+                Ordering::Greater
+            }
+
+            (Some(_), Some(&cb)) if cb.is_ascii_alphabetic() => {
+                // b has letters, a doesn't
+                Ordering::Less
+            }
+
+            (Some(&ca), None) if ca.is_ascii_alphabetic() => Ordering::Greater,
+
+            (None, Some(&cb)) if cb.is_ascii_alphabetic() => Ordering::Less,
+
+            _ => Ordering::Equal,
+        };
+    }
+}

docs/setup/signed/debian.md

@@ -0,0 +1,145 @@
+# Setup Sprout for Debian with Secure Boot
+
+## Prerequisites
+
+- Modern Debian release: tested on Debian 13 ARM64
+- EFI System Partition mounted on `/boot/efi` (the default)
+- ext4 or FAT32/exFAT formatted `/boot` partition
+- You will need the following packages installed: `openssl`, `shim-signed`, `mokutil`, `sbsigntool`
+
+## Step 1: Generate and Install Secure Boot Key
+
+```bash
+# Create a directory to store the Secure Boot MOK key and certificates.
+$ mkdir -p /etc/sprout/secure-boot
+# Change to the created directory.
+$ cd /etc/sprout/secure-boot
+# Generate a MOK key and certificate.
+$ openssl req \
+  -newkey rsa:4096 -nodes -keyout mok.key \
+  -new -x509 -sha256 -days 3650 -subj '/CN=Sprout Secure Boot/' \
+  -out mok.crt
+# Generate a DER encoded certificate for enrollment.
+$ openssl x509 -outform DER -in mok.crt -out mok.cer
+# Import the certificate into the Secure Boot environment.
+# This will ask you to make a password that will be used during enrollment.
+$ mokutil --import mok.cer
+# Reboot your machine.
+# During boot, MOK enrollment should appear. If it doesn't, ensure you are booting into the shim.
+# Press any key to begin MOK management. Select "Enroll MOK".
+# Select "View key 0", and ensure the subject says "CN=Sprout Secure Boot".
+# If the subject does not match, something has gone wrong with MOK enrollment.
+# Press Enter to continue, then select the "Continue" option.
+# When it asks to enroll the key, select the "Yes" option.
+# Enter the password that you created during the mokutil --import step.
+# Select "Reboot" to boot back into your Operating System.
+```
+
+## Step 2: Prepare the Secure Boot Environment
+
+```bash
+# Create a directory for Sprout EFI artifacts.
+$ mkdir -p /boot/efi/EFI/sprout
+
+# For x86_64, copy the following artifacts to the Sprout EFI directory.
+$ cp /usr/lib/shim/shimx64.efi.signed /boot/efi/EFI/sprout/shimx64.efi
+$ cp /usr/lib/shim/mmx64.efi.signed /boot/efi/EFI/sprout/mmx64.efi
+$ cp /usr/lib/shim/fbx64.efi.signed /boot/efi/EFI/sprout/fbx64.efi
+
+# For aarch64, copy the following artifacts to the Sprout EFI directory.
+$ cp /usr/lib/shim/shimaa64.efi.signed /boot/efi/EFI/sprout/shimaa64.efi
+$ cp /usr/lib/shim/mmaa64.efi.signed /boot/efi/EFI/sprout/mmaa64.efi
+$ cp /usr/lib/shim/fbaa64.efi.signed /boot/efi/EFI/sprout/fbaa64.efi
+```
+
+## Step 3: Install Unsigned Sprout
+
+Download the latest sprout.efi release from the [GitHub releases page](https://github.com/edera-dev/sprout/releases).
+For x86_64 systems, download the `sprout-x86_64.efi` file, and for ARM64 systems, download the `sprout-aarch64.efi` file.
+Copy the downloaded `sprout.efi` file to `/boot/efi/EFI/sprout/sprout.unsigned.efi` on your EFI System Partition.
+
+## Step 4: Sign Sprout for Secure Boot
+
+```bash
+# For x86_64, sign the unsigned Sprout artifact and name it grubaa64.efi which is what the shim will call.
+$ sbsign \
+    --key /etc/sprout/secure-boot/mok.key \
+    --cert /etc/sprout/secure-boot/mok.crt \
+    --output /boot/efi/EFI/sprout/grubx64.efi \
+    /boot/efi/EFI/sprout/sprout.unsigned.efi
+
+# For aarch64, sign the unsigned Sprout artifact and name it grubaa64.efi which is what the shim will call.
+$ sbsign \
+    --key /etc/sprout/secure-boot/mok.key \
+    --cert /etc/sprout/secure-boot/mok.crt \
+    --output /boot/efi/EFI/sprout/grubaa64.efi \
+    /boot/efi/EFI/sprout/sprout.unsigned.efi
+```
+
+## Step 5: Install and Sign EFI Drivers
+
+You will need a filesystem EFI driver if `/boot` is not FAT32 or ExFAT.
+If `/boot` is FAT32 or ExFAT, you can skip this step.
+
+Most Debian systems use an ext4 filesystem for `/boot`.
+You can download an EFI filesystem driver from [EfiFs releases](https://github.com/pbatard/EfiFs/releases).
+For ext4, download the `ext2` file for your platform. It should work for ext4 filesystems too.
+
+If you have an EFI driver, copy the driver to `/boot/efi/EFI/sprout/DRIVER_NAME.unsigned.efi` for signing.
+
+For example, the `ext4` driver, copy the `ext4.efi` file to `/boot/efi/EFI/sprout/ext4.unsigned.efi`.
+
+Then sign the driver with the Sprout Secure Boot key:
+
+```bash
+# Sign the ext4 driver at ext4.unsigned.efi, placing it at ext4.efi, which will be used in the configuration.
+$ sbsign \
+    --key /etc/sprout/secure-boot/mok.key \
+    --cert /etc/sprout/secure-boot/mok.crt \
+    --output /boot/efi/EFI/sprout/ext4.efi \
+    /boot/efi/EFI/sprout/ext4.unsigned.efi
+```
+
+## Step 6: Create Sprout Configuration
+
+Write the following to the file `/boot/efi/sprout.toml`:
+
+```toml
+# sprout configuration: version 1
+version = 1
+
+# global values.
+[values]
+# your linux kernel command line.
+linux-options = "root=UUID=MY_ROOT_UUID"
+
+# load an ext4 EFI driver.
+# skip this if you do not have a filesystem driver.
+# if your filesystem driver is not named ext4, change accordingly.
+[drivers.ext4]
+path = "\\EFI\\sprout\\ext4.efi"
+
+# global options.
+[options]
+# enable autoconfiguration by detecting bls enabled
+# filesystems and generating boot entries for them.
+autoconfigure = true
+```
+
+Ensure you add the signed driver paths to the configuration, not the unsigned ones.
+If you do not have any drivers, exclude the drivers section entirely.
+
+## Step 7: Configure Sprout Boot Entry
+
+In the following commands, replace /dev/ESP_PARTITION with the actual path to the ESP partition block device.
+
+```bash
+# For x86_64, run this command to add Sprout as the default boot entry.
+$ efibootmgr -d /dev/ESP_PARTITION -c -L 'Sprout' -l '\EFI\sprout\shimx64.efi'
+
+# For aarch64, run this command to add Sprout as the default boot entry.
+$ efibootmgr -d /dev/ESP_PARTITION -c -L 'Sprout' -l '\EFI\sprout\shimaa64.efi'
+```
+
+Reboot your machine and it should boot into Sprout.
+If Sprout fails to boot, it should boot into the original bootloader.

docs/setup/signed/ubuntu.md

@@ -0,0 +1,144 @@
+# Setup Sprout for Ubuntu with Secure Boot
+
+## Prerequisites
+
+- Modern Ubuntu release: tested on Ubuntu 25.10 ARM64
+- EFI System Partition mounted on `/boot/efi` (the default)
+- ext4 or FAT32/exFAT formatted `/boot` partition
+
+## Step 1: Generate and Install Secure Boot Key
+
+```bash
+# Create a directory to store the Secure Boot MOK key and certificates.
+$ mkdir -p /etc/sprout/secure-boot
+# Change to the created directory.
+$ cd /etc/sprout/secure-boot
+# Generate a MOK key and certificate.
+$ openssl req \
+  -newkey rsa:4096 -nodes -keyout mok.key \
+  -new -x509 -sha256 -days 3650 -subj '/CN=Sprout Secure Boot/' \
+  -out mok.crt
+# Generate a DER encoded certificate for enrollment.
+$ openssl x509 -outform DER -in mok.crt -out mok.cer
+# Import the certificate into the Secure Boot environment.
+# This will ask you to make a password that will be used during enrollment.
+$ mokutil --import mok.cer
+# Reboot your machine.
+# During boot, MOK enrollment should appear. If it doesn't, ensure you are booting into the shim.
+# Press any key to begin MOK management. Select "Enroll MOK".
+# Select "View key 0", and ensure the subject says "CN=Sprout Secure Boot".
+# If the subject does not match, something has gone wrong with MOK enrollment.
+# Press Enter to continue, then select the "Continue" option.
+# When it asks to enroll the key, select the "Yes" option.
+# Enter the password that you created during the mokutil --import step.
+# Select "Reboot" to boot back into your Operating System.
+```
+
+## Step 2: Prepare the Secure Boot Environment
+
+```bash
+# Create a directory for Sprout EFI artifacts.
+$ mkdir -p /boot/efi/EFI/sprout
+
+# For x86_64, copy the following artifacts to the Sprout EFI directory.
+$ cp /usr/lib/shim/shimx64.efi.signed /boot/efi/EFI/sprout/shimx64.efi
+$ cp /usr/lib/shim/mmx64.efi /boot/efi/EFI/sprout/mmx64.efi
+$ cp /usr/lib/shim/fbx64.efi /boot/efi/EFI/sprout/fbx64.efi
+
+# For aarch64, copy the following artifacts to the Sprout EFI directory.
+$ cp /usr/lib/shim/shimaa64.efi.signed /boot/efi/EFI/sprout/shimaa64.efi
+$ cp /usr/lib/shim/mmaa64.efi /boot/efi/EFI/sprout/mmaa64.efi
+$ cp /usr/lib/shim/fbaa64.efi /boot/efi/EFI/sprout/fbaa64.efi
+```
+
+## Step 3: Install Unsigned Sprout
+
+Download the latest sprout.efi release from the [GitHub releases page](https://github.com/edera-dev/sprout/releases).
+For x86_64 systems, download the `sprout-x86_64.efi` file, and for ARM64 systems, download the `sprout-aarch64.efi` file.
+Copy the downloaded `sprout.efi` file to `/boot/efi/EFI/sprout/sprout.unsigned.efi` on your EFI System Partition.
+
+## Step 4: Sign Sprout for Secure Boot
+
+```bash
+# For x86_64, sign the unsigned Sprout artifact and name it grubaa64.efi which is what the shim will call.
+$ sbsign \
+    --key /etc/sprout/secure-boot/mok.key \
+    --cert /etc/sprout/secure-boot/mok.crt \
+    --output /boot/efi/EFI/sprout/grubx64.efi \
+    /boot/efi/EFI/sprout/sprout.unsigned.efi
+
+# For aarch64, sign the unsigned Sprout artifact and name it grubaa64.efi which is what the shim will call.
+$ sbsign \
+    --key /etc/sprout/secure-boot/mok.key \
+    --cert /etc/sprout/secure-boot/mok.crt \
+    --output /boot/efi/EFI/sprout/grubaa64.efi \
+    /boot/efi/EFI/sprout/sprout.unsigned.efi
+```
+
+## Step 5: Install and Sign EFI Drivers
+
+You will need a filesystem EFI driver if `/boot` is not FAT32 or ExFAT.
+If `/boot` is FAT32 or ExFAT, you can skip this step.
+
+Most Ubuntu systems use an ext4 filesystem for `/boot`.
+You can download an EFI filesystem driver from [EfiFs releases](https://github.com/pbatard/EfiFs/releases).
+For ext4, download the `ext2` file for your platform. It will work for ext4 filesystems too.
+
+If you have an EFI driver, copy the driver to `/boot/efi/EFI/sprout/DRIVER_NAME.unsigned.efi` for signing.
+
+For example, the `ext4` driver, copy the `ext4.efi` file to `/boot/efi/EFI/sprout/ext4.unsigned.efi`.
+
+Then sign the driver with the Sprout Secure Boot key:
+
+```bash
+# Sign the ext4 driver at ext4.unsigned.efi, placing it at ext4.efi, which will be used in the configuration.
+$ sbsign \
+    --key /etc/sprout/secure-boot/mok.key \
+    --cert /etc/sprout/secure-boot/mok.crt \
+    --output /boot/efi/EFI/sprout/ext4.efi \
+    /boot/efi/EFI/sprout/ext4.unsigned.efi
+```
+
+## Step 6: Create Sprout Configuration
+
+Write the following to the file `/boot/efi/sprout.toml`:
+
+```toml
+# sprout configuration: version 1
+version = 1
+
+# global values.
+[values]
+# your linux kernel command line.
+linux-options = "root=UUID=MY_ROOT_UUID"
+
+# load an ext4 EFI driver.
+# skip this if you do not have a filesystem driver.
+# if your filesystem driver is not named ext4, change accordingly.
+[drivers.ext4]
+path = "\\EFI\\sprout\\ext4.efi"
+
+# global options.
+[options]
+# enable autoconfiguration by detecting bls enabled
+# filesystems and generating boot entries for them.
+autoconfigure = true
+```
+
+Ensure you add the signed driver paths to the configuration, not the unsigned ones.
+If you do not have any drivers, exclude the drivers section entirely.
+
+## Step 7: Configure Sprout Boot Entry
+
+In the following commands, replace /dev/ESP_PARTITION with the actual path to the ESP partition block device.
+
+```bash
+# For x86_64, run this command to add Sprout as the default boot entry.
+$ efibootmgr -d /dev/ESP_PARTITION -c -L 'Sprout' -l '\EFI\sprout\shimx64.efi'
+
+# For aarch64, run this command to add Sprout as the default boot entry.
+$ efibootmgr -d /dev/ESP_PARTITION -c -L 'Sprout' -l '\EFI\sprout\shimaa64.efi'
+```
+
+Reboot your machine and it should boot into Sprout.
+If Sprout fails to boot, it should boot into the original bootloader.

docs/setup/unsigned/alpine-edge.md

@@ -1,4 +1,4 @@
-# Setup Sprout on Alpine Edge
+# Setup Sprout for Alpine Edge without Secure Boot
 
 ## Prerequisites
 

docs/setup/unsigned/fedora.md

@@ -1,4 +1,4 @@
-# Setup Sprout on Fedora
+# Setup Sprout for Fedora without Secure Boot
 
 ## Prerequisites
 

docs/setup/unsigned/generic-linux.md

@@ -1,4 +1,4 @@
-# Setup Sprout to boot Linux
+# Setup Sprout for Linux without Secure Boot
 
 ## Prerequisites
 

docs/setup/unsigned/windows.md

@@ -1,8 +1,8 @@
-# Setup Sprout to boot Windows
+# Setup Sprout for Windows without Secure Boot
 
 ## Prerequisites
 
-- Secure Boot disabled
+- Secure Boot is disabled or configured to allow Sprout
 - UEFI Windows installation
 
 ## Step 1: Base Installation

hack/dev/boot/Dockerfile

@@ -7,12 +7,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && apt-get update && apt-get install -
 WORKDIR /work
 COPY sprout.efi /work/${EFI_NAME}.EFI
 COPY sprout.toml /work/SPROUT.TOML
-COPY kernel.efi /work/KERNEL.EFI
+COPY kernel.efi /work/VMLINUZ
 COPY shell.efi /work/SHELL.EFI
 COPY xen.efi /work/XEN.EFI
 COPY xen.cfg /work/XEN.CFG
 COPY initramfs /work/INITRAMFS
-COPY edera-splash.png /work/EDERA-SPLASH.PNG
 COPY bls.conf /work/BLS.CONF
 RUN truncate -s128MiB sprout.img && \
     parted --script sprout.img mklabel gpt > /dev/null 2>&1 && \
@@ -24,12 +23,11 @@ RUN truncate -s128MiB sprout.img && \
     mmd -i sprout.img ::/LOADER && \
     mmd -i sprout.img ::/LOADER/ENTRIES && \
     mcopy -i sprout.img ${EFI_NAME}.EFI ::/EFI/BOOT/ && \
-    mcopy -i sprout.img KERNEL.EFI ::/EFI/BOOT/ && \
+    mcopy -i sprout.img VMLINUZ ::/VMLINUZ && \
     mcopy -i sprout.img SHELL.EFI ::/EFI/BOOT/ && \
     mcopy -i sprout.img XEN.EFI ::/EFI/BOOT/ && \
     mcopy -i sprout.img XEN.CFG ::/EFI/BOOT/ && \
     mcopy -i sprout.img SPROUT.TOML ::/ && \
-    mcopy -i sprout.img EDERA-SPLASH.PNG ::/ && \
     mcopy -i sprout.img INITRAMFS ::/ && \
     mcopy -i sprout.img BLS.CONF ::/LOADER/ENTRIES/ && \
     mv sprout.img /sprout.img

hack/dev/build.sh

@@ -107,7 +107,6 @@ if [ "${SKIP_SPROUT_BUILD}" != "1" ]; then
 
 	cp "hack/dev/configs/${SPROUT_CONFIG_NAME}.sprout.toml" "${FINAL_DIR}/sprout.toml"
 	cp "hack/dev/configs/xen.cfg" "${FINAL_DIR}/xen.cfg"
-	cp "hack/dev/assets/edera-splash.png" "${FINAL_DIR}/edera-splash.png"
 	cp "hack/dev/configs/bls.conf" "${FINAL_DIR}/bls.conf"
 
 	mkdir -p "${FINAL_DIR}/efi/EFI/BOOT"
@@ -125,7 +124,6 @@ if [ "${SKIP_SPROUT_BUILD}" != "1" ]; then
 		cp "${FINAL_DIR}/xen.cfg" "${FINAL_DIR}/efi/EFI/BOOT/XEN.CFG"
 	fi
 	cp "${FINAL_DIR}/sprout.toml" "${FINAL_DIR}/efi/SPROUT.TOML"
-	cp "${FINAL_DIR}/edera-splash.png" "${FINAL_DIR}/efi/EDERA-SPLASH.PNG"
 	cp "${FINAL_DIR}/initramfs" "${FINAL_DIR}/efi/INITRAMFS"
 fi
 

hack/dev/configs/all.sprout.toml

@@ -4,10 +4,10 @@ version = 1
 default-entry = "kernel"
 
 [extractors.boot.filesystem-device-match]
-has-item = "\\EFI\\BOOT\\kernel.efi"
+has-item = "\\vmlinuz"
 
 [actions.chainload-kernel]
-chainload.path = "$boot\\EFI\\BOOT\\kernel.efi"
+chainload.path = "$boot\\vmlinuz"
 chainload.options = ["console=hvc0"]
 chainload.linux-initrd = "$boot\\initramfs"
 

hack/dev/configs/bls.conf

@@ -1,4 +1,4 @@
 title Boot Linux
-linux /efi/boot/kernel.efi
+linux /vmlinuz
 options console=hvc0
 initrd /initramfs

hack/dev/configs/kernel.sprout.toml

@@ -5,10 +5,10 @@ default-entry = "kernel"
 menu-timeout = 0
 
 [extractors.boot.filesystem-device-match]
-has-item = "\\EFI\\BOOT\\kernel.efi"
+has-item = "\\vmlinuz"
 
 [actions.chainload-kernel]
-chainload.path = "$boot\\EFI\\BOOT\\kernel.efi"
+chainload.path = "$boot\\vmlinuz"
 chainload.options = ["console=hvc0"]
 chainload.linux-initrd = "$boot\\initramfs"
 

src/actions/chainload.rs

@@ -1,125 +0,0 @@
-use crate::context::SproutContext;
-use crate::utils;
-use crate::utils::media_loader::MediaLoaderHandle;
-use crate::utils::media_loader::constants::linux::LINUX_EFI_INITRD_MEDIA_GUID;
-use anyhow::{Context, Result, bail};
-use log::error;
-use serde::{Deserialize, Serialize};
-use std::rc::Rc;
-use uefi::CString16;
-use uefi::proto::loaded_image::LoadedImage;
-
-/// The configuration of the chainload action.
-#[derive(Serialize, Deserialize, Debug, Default, Clone)]
-pub struct ChainloadConfiguration {
-    /// The path to the image to chainload.
-    /// This can be a Linux EFI stub (vmlinuz usually) or a standard EFI executable.
-    pub path: String,
-    /// The options to pass to the image.
-    /// The options are concatenated by a space and then passed to the EFI application.
-    #[serde(default)]
-    pub options: Vec<String>,
-    /// An optional path to a Linux initrd.
-    /// This uses the [LINUX_EFI_INITRD_MEDIA_GUID] mechanism to load the initrd into the EFI stack.
-    /// For Linux, you can also use initrd=\path\to\initrd as an option, but this option is
-    /// generally better and safer as it can support additional load options in the future.
-    #[serde(default, rename = "linux-initrd")]
-    pub linux_initrd: Option<String>,
-}
-
-/// Executes the chainload action using the specified `configuration` inside the provided `context`.
-pub fn chainload(context: Rc<SproutContext>, configuration: &ChainloadConfiguration) -> Result<()> {
-    // Retrieve the current image handle of sprout.
-    let sprout_image = uefi::boot::image_handle();
-
-    // Resolve the path to the image to chainload.
-    let resolved = utils::resolve_path(
-        context.root().loaded_image_path()?,
-        &context.stamp(&configuration.path),
-    )
-    .context("unable to resolve chainload path")?;
-
-    // Load the image to chainload.
-    let image = uefi::boot::load_image(
-        sprout_image,
-        uefi::boot::LoadImageSource::FromDevicePath {
-            device_path: &resolved.full_path,
-            boot_policy: uefi::proto::BootPolicy::ExactMatch,
-        },
-    )
-    .context("unable to load image")?;
-
-    // Open the LoadedImage protocol of the image to chainload.
-    let mut loaded_image_protocol = uefi::boot::open_protocol_exclusive::<LoadedImage>(image)
-        .context("unable to open loaded image protocol")?;
-
-    // Stamp and combine the options to pass to the image.
-    let options =
-        utils::combine_options(configuration.options.iter().map(|item| context.stamp(item)));
-
-    // Pass the options to the image, if any are provided.
-    // The holder must drop at the end of this function to ensure the options are not leaked,
-    // and the holder here ensures it outlives the if block here, as a pointer has to be
-    // passed to the image.
-    // SAFETY: The options outlive the usage of the image, and the image is not used after this.
-    let mut options_holder: Option<Box<CString16>> = None;
-    if !options.is_empty() {
-        let options = Box::new(
-            CString16::try_from(&options[..])
-                .context("unable to convert chainloader options to CString16")?,
-        );
-
-        if options.num_bytes() > u32::MAX as usize {
-            bail!("chainloader options too large");
-        }
-
-        // SAFETY: option size is checked to validate it is safe to pass.
-        // Additionally, the pointer is allocated and retained on heap, which makes
-        // passing the `options` pointer safe to the next image.
-        unsafe {
-            loaded_image_protocol
-                .set_load_options(options.as_ptr() as *const u8, options.num_bytes() as u32);
-        }
-        options_holder = Some(options);
-    }
-
-    // Stamp the initrd path, if provided.
-    let initrd = configuration
-        .linux_initrd
-        .as_ref()
-        .map(|item| context.stamp(item));
-    // The initrd can be None or empty, so we need to collapse that into a single Option.
-    let initrd = utils::empty_is_none(initrd);
-
-    // If an initrd is provided, register it with the EFI stack.
-    let mut initrd_handle = None;
-    if let Some(linux_initrd) = initrd {
-        let content = utils::read_file_contents(context.root().loaded_image_path()?, &linux_initrd)
-            .context("unable to read linux initrd")?;
-        let handle =
-            MediaLoaderHandle::register(LINUX_EFI_INITRD_MEDIA_GUID, content.into_boxed_slice())
-                .context("unable to register linux initrd")?;
-        initrd_handle = Some(handle);
-    }
-
-    // Start the loaded image.
-    // This call might return, or it may pass full control to another image that will never return.
-    // Capture the result to ensure we can return an error if the image fails to start, but only
-    // after the optional initrd has been unregistered.
-    let result = uefi::boot::start_image(image);
-
-    // Unregister the initrd if it was registered.
-    if let Some(initrd_handle) = initrd_handle
-        && let Err(error) = initrd_handle.unregister()
-    {
-        error!("unable to unregister linux initrd: {}", error);
-    }
-
-    // Assert there was no error starting the image.
-    result.context("unable to start image")?;
-    // Explicitly drop the option holder to clarify the lifetime.
-    drop(options_holder);
-
-    // Return control to sprout.
-    Ok(())
-}

src/actions/splash.rs

@@ -1,159 +0,0 @@
-use crate::context::SproutContext;
-use crate::utils::framebuffer::Framebuffer;
-use crate::utils::read_file_contents;
-use anyhow::{Context, Result};
-use image::imageops::{FilterType, resize};
-use image::math::Rect;
-use image::{DynamicImage, ImageBuffer, ImageFormat, ImageReader, Rgba};
-use serde::{Deserialize, Serialize};
-use std::io::Cursor;
-use std::rc::Rc;
-use std::time::Duration;
-use uefi::boot::ScopedProtocol;
-use uefi::proto::console::gop::GraphicsOutput;
-
-const DEFAULT_SPLASH_TIME: u32 = 0;
-
-/// The configuration of the splash action.
-#[derive(Serialize, Deserialize, Debug, Default, Clone)]
-pub struct SplashConfiguration {
-    /// The path to the image to display.
-    /// Currently, only PNG images are supported.
-    pub image: String,
-    /// The time to display the splash image without interruption, in seconds.
-    /// The default value is `0` which will display the image and let everything
-    /// continue.
-    #[serde(default = "default_splash_time")]
-    pub time: u32,
-}
-
-fn default_splash_time() -> u32 {
-    DEFAULT_SPLASH_TIME
-}
-
-/// Acquire the [GraphicsOutput]. We will find the first graphics output only.
-fn setup_graphics() -> Result<ScopedProtocol<GraphicsOutput>> {
-    // Grab the handle for the graphics output protocol.
-    let gop_handle = uefi::boot::get_handle_for_protocol::<GraphicsOutput>()
-        .context("unable to get graphics output")?;
-    // Open the graphics output protocol exclusively.
-    uefi::boot::open_protocol_exclusive::<GraphicsOutput>(gop_handle)
-        .context("unable to open graphics output")
-}
-
-/// Produces a [Rect] that fits the `image` inside the specified `frame`.
-/// The output [Rect] should be used to resize the image.
-fn fit_to_frame(image: &DynamicImage, frame: Rect) -> Rect {
-    // Convert the image dimensions to a [Rect].
-    let input = Rect {
-        x: 0,
-        y: 0,
-        width: image.width(),
-        height: image.height(),
-    };
-
-    // Handle the case where the image is zero-sized.
-    if input.height == 0 || input.width == 0 {
-        return input;
-    }
-
-    // Calculate the ratio of the image dimensions.
-    let input_ratio = input.width as f32 / input.height as f32;
-
-    // Calculate the ratio of the frame dimensions.
-    let frame_ratio = frame.width as f32 / frame.height as f32;
-
-    // Create [Rect] to store the output dimensions.
-    let mut output = Rect {
-        x: 0,
-        y: 0,
-        width: frame.width,
-        height: frame.height,
-    };
-
-    // Handle the case where the output is zero-sized.
-    if output.height == 0 || output.width == 0 {
-        return output;
-    }
-
-    if input_ratio < frame_ratio {
-        output.width = (frame.height as f32 * input_ratio).floor() as u32;
-        output.height = frame.height;
-        output.x = frame.x + (frame.width - output.width) / 2;
-        output.y = frame.y;
-    } else {
-        output.width = frame.width;
-        output.height = (frame.width as f32 / input_ratio).floor() as u32;
-        output.x = frame.x;
-        output.y = frame.y + (frame.height - output.height) / 2;
-    }
-
-    output
-}
-
-/// Resize the input `image` to fit the `frame`.
-fn resize_to_fit(image: &DynamicImage, frame: Rect) -> ImageBuffer<Rgba<u8>, Vec<u8>> {
-    let image = image.to_rgba8();
-    resize(&image, frame.width, frame.height, FilterType::Lanczos3)
-}
-
-/// Draw the `image` on the screen using [GraphicsOutput].
-fn draw(image: DynamicImage) -> Result<()> {
-    // Acquire the [GraphicsOutput] protocol.
-    let mut gop = setup_graphics()?;
-
-    // Acquire the current screen size.
-    let (width, height) = gop.current_mode_info().resolution();
-
-    // Create a display frame.
-    let display_frame = Rect {
-        x: 0,
-        y: 0,
-        width: width as _,
-        height: height as _,
-    };
-
-    // Fit the image to the display frame.
-    let fit = fit_to_frame(&image, display_frame);
-
-    // Resize the image to fit the display frame.
-    let image = resize_to_fit(&image, fit);
-
-    // Create a framebuffer to draw the image on.
-    let mut framebuffer =
-        Framebuffer::new(width, height).context("unable to create framebuffer")?;
-
-    // Iterate over the pixels in the image and put them on the framebuffer.
-    for (x, y, pixel) in image.enumerate_pixels() {
-        let Some(fb) = framebuffer.pixel((x + fit.x) as usize, (fit.y + y) as usize) else {
-            continue;
-        };
-        fb.red = pixel[0];
-        fb.green = pixel[1];
-        fb.blue = pixel[2];
-    }
-
-    // Blit the framebuffer to the screen.
-    framebuffer.blit(&mut gop)?;
-    Ok(())
-}
-
-/// Runs the splash action with the specified `configuration` inside the provided `context`.
-pub fn splash(context: Rc<SproutContext>, configuration: &SplashConfiguration) -> Result<()> {
-    // Stamp the image path value.
-    let image = context.stamp(&configuration.image);
-    // Read the image contents.
-    let image = read_file_contents(context.root().loaded_image_path()?, &image)?;
-    // Decode the image as a PNG.
-    let image = ImageReader::with_format(Cursor::new(image), ImageFormat::Png)
-        .decode()
-        .context("unable to decode splash image")?;
-    // Draw the image on the screen.
-    draw(image)?;
-
-    // Sleep for the specified time.
-    std::thread::sleep(Duration::from_secs(configuration.time as u64));
-
-    // Return control to sprout.
-    Ok(())
-}

src/generators/bls.rs

@@ -1,138 +0,0 @@
-use crate::context::SproutContext;
-use crate::entries::{BootableEntry, EntryDeclaration};
-use crate::generators::bls::entry::BlsEntry;
-use crate::utils;
-use anyhow::{Context, Result};
-use serde::{Deserialize, Serialize};
-use std::rc::Rc;
-use std::str::FromStr;
-use uefi::cstr16;
-use uefi::fs::{FileSystem, PathBuf};
-use uefi::proto::device_path::text::{AllowShortcuts, DisplayOnly};
-use uefi::proto::media::fs::SimpleFileSystem;
-
-/// BLS entry parser.
-mod entry;
-
-/// The default path to the BLS directory.
-const BLS_TEMPLATE_PATH: &str = "\\loader";
-
-/// The configuration of the BLS generator.
-/// The BLS uses the Bootloader Specification to produce
-/// entries from an input template.
-#[derive(Serialize, Deserialize, Debug, Default, Clone)]
-pub struct BlsConfiguration {
-    /// The entry to use for as a template.
-    pub entry: EntryDeclaration,
-    /// The path to the BLS directory.
-    #[serde(default = "default_bls_path")]
-    pub path: String,
-}
-
-fn default_bls_path() -> String {
-    BLS_TEMPLATE_PATH.to_string()
-}
-
-// TODO(azenla): remove this once variable substitution is implemented.
-/// This function is used to remove the `tuned_initrd` variable from entry values.
-/// Fedora uses tuned which adds an initrd that shouldn't be used.
-fn quirk_initrd_remove_tuned(input: String) -> String {
-    input.replace("$tuned_initrd", "").trim().to_string()
-}
-
-/// Generates entries from the BLS entries directory using the specified `bls` configuration and
-/// `context`. The BLS conversion is best-effort and will ignore any unsupported entries.
-pub fn generate(context: Rc<SproutContext>, bls: &BlsConfiguration) -> Result<Vec<BootableEntry>> {
-    let mut entries = Vec::new();
-
-    // Stamp the path to the BLS directory.
-    let path = context.stamp(&bls.path);
-
-    // Resolve the path to the BLS directory.
-    let bls_resolved = utils::resolve_path(context.root().loaded_image_path()?, &path)
-        .context("unable to resolve bls path")?;
-
-    // Construct a filesystem path to the BLS entries directory.
-    let mut entries_path = PathBuf::from(
-        bls_resolved
-            .sub_path
-            .to_string(DisplayOnly(false), AllowShortcuts(false))
-            .context("unable to convert bls path to string")?,
-    );
-    entries_path.push(cstr16!("entries"));
-
-    // Open exclusive access to the BLS filesystem.
-    let fs =
-        uefi::boot::open_protocol_exclusive::<SimpleFileSystem>(bls_resolved.filesystem_handle)
-            .context("unable to open bls filesystem")?;
-    let mut fs = FileSystem::new(fs);
-
-    // Read the BLS entries directory.
-    let entries_iter = fs
-        .read_dir(&entries_path)
-        .context("unable to read bls entries")?;
-
-    // For each entry in the BLS entries directory, parse the entry and add it to the list.
-    for entry in entries_iter {
-        // Unwrap the entry file info.
-        let entry = entry.context("unable to read bls item entry")?;
-
-        // Skip items that are not regular files.
-        if !entry.is_regular_file() {
-            continue;
-        }
-
-        // Get the file name of the filesystem item.
-        let name = entry.file_name().to_string();
-
-        // Ignore files that are not .conf files.
-        if !name.to_lowercase().ends_with(".conf") {
-            continue;
-        }
-
-        // Create a mutable path so we can append the file name to produce the full path.
-        let mut full_entry_path = entries_path.to_path_buf();
-        full_entry_path.push(entry.file_name());
-
-        // Read the entry file.
-        let content = fs
-            .read(full_entry_path)
-            .context("unable to read bls file")?;
-
-        // Parse the entry file as a UTF-8 string.
-        let content = String::from_utf8(content).context("unable to read bls entry as utf8")?;
-
-        // Parse the entry file as a BLS entry.
-        let entry = BlsEntry::from_str(&content).context("unable to parse bls entry")?;
-
-        // Ignore entries that are not valid for Sprout.
-        if !entry.is_valid() {
-            continue;
-        }
-
-        // Produce a new sprout context for the entry with the extracted values.
-        let mut context = context.fork();
-
-        let title = entry.title().unwrap_or_else(|| name.clone());
-        let chainload = entry.chainload_path().unwrap_or_default();
-        let options = entry.options().unwrap_or_default();
-
-        // Put the initrd through a quirk modifier to support Fedora.
-        let initrd = quirk_initrd_remove_tuned(entry.initrd_path().unwrap_or_default());
-
-        context.set("title", title);
-        context.set("chainload", chainload);
-        context.set("options", options);
-        context.set("initrd", initrd);
-
-        // Add the entry to the list with a frozen context.
-        entries.push(BootableEntry::new(
-            name,
-            bls.entry.title.clone(),
-            context.freeze(),
-            bls.entry.clone(),
-        ));
-    }
-
-    Ok(entries)
-}