sprout: version 0.0.29 (#99 )

fix(autoconfigure): skip filesystems that can't be opened
If the device path or filesystem protocol of any detected filesystem could not be opened, autoconfiguration failed entirely and boot was aborted. Log a warning and skip that filesystem instead, so the other filesystems are still autoconfigured.
2026-11-04 22:42:21 +00:00 · 2026-09-26 19:07:20 -07:00 · 2026-09-26 18:58:54 -07:00 · 2026-09-26 18:58:54 -07:00 · 2026-09-26 18:58:54 -07:00 · 2026-09-26 18:58:54 -07:00
108 changed files with 3323 additions and 1900 deletions
@@ -1,10 +1,12 @@
 name: zizmor
 on:
  push:
    branches: ["main"]
  pull_request:
-    branches: ["**"]
+    branches:
    - main
  push:
    branches:
    - main
 permissions:
  contents: read # Needed to checkout the repository.
@@ -23,17 +25,17 @@ jobs:
      actions: read # Needed to analyze action metadata.
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit
    - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
    - name: setup uv
-      uses: astral-sh/setup-uv@2ddd2b9cb38ad8efd50337e8ab201519a34c9f24 # v7.1.1
+      uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
    - name: zizmor
      run: uvx zizmor --pedantic --format sarif . > results.sarif
@@ -41,7 +43,7 @@ jobs:
        GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
    - name: upload
-      uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
+      uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
      with:
        sarif_file: results.sarif
        category: zizmor
@@ -21,12 +21,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit
    - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
@@ -51,12 +51,12 @@ jobs:
    name: 'build ${{ matrix.arch }}'
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit
    - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
@@ -80,12 +80,12 @@ jobs:
    name: 'clippy ${{ matrix.arch }}'
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit
    - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
@@ -1,10 +1,12 @@
 name: codeql
 on:
  push:
    branches: [ "main" ]
  pull_request:
-    branches: [ "main" ]
+    branches:
    - main
  push:
    branches:
    - main
  schedule:
  - cron: '33 16 * * 0'
@@ -35,23 +37,23 @@ jobs:
          build-mode: none
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit
    - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
    - name: initialize codeql
-      uses: github/codeql-action/init@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
+      uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
      with:
        languages: ${{ matrix.language }}
        build-mode: ${{ matrix.build-mode }}
        config-file: ./.github/codeql/codeql-config.yaml
    - name: perform codeql analysis
-      uses: github/codeql-action/analyze@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
+      uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
      with:
        category: "/language:${{matrix.language}}"
@@ -1,19 +1,12 @@
 name: publish
 on:
  push:
    branches:
    - main
  pull_request:
    branches:
    - main
-    paths:
+  push:
-    - bin/**
+    branches:
-    - src/**
+    - main
    - Cargo.*
    - rust-toolchain.toml
    - .github/workflows/publish.yaml
 permissions:
  contents: read # Needed to checkout the repository.
@@ -32,12 +25,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit
    - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
@@ -50,13 +43,14 @@ jobs:
    - name: 'upload artifacts'
      id: upload
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: artifacts
        path: target/assemble/*
    - name: 'attest artifacts'
-      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+      uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
      with:
        subject-name: artifacts.zip
        subject-digest: "sha256:${{ steps.upload.outputs.artifact-digest }}"
      if: github.event_name != 'pull_request'
@@ -25,12 +25,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit
    - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
@@ -42,16 +42,19 @@ jobs:
      run: ./hack/assemble.sh
    - name: 'attest release artifacts'
-      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+      uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
      with:
        subject-path: target/assemble/*
    - name: 'generate cultivator token'
-      uses: actions/create-github-app-token@bf559f85448f9380bcfa2899dbdc01eb5b37be3a # v3.0.0-beta.2
+      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.0.0-beta.2
      id: generate-token
      with:
        app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
        private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
        # Scope to what uploading assets and `gh release edit` need: write to
        # release contents.
        permission-contents: write
      if: ${{ github.event.inputs.release-tag != '' }}
    - name: 'upload release artifacts'
@@ -4,9 +4,9 @@ version = 4
 [[package]]
 name = "anyhow"
-version = "1.0.100"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 [[package]]
 name = "bit_field"
@@ -16,86 +16,109 @@ checksum = "1e4b40c7323adcfc0a41c4b88143ed58346ff65a288fc144329c5c45e05d70c6"
 [[package]]
 name = "bitflags"
-version = "2.10.0"
+version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
 [[package]]
 name = "block-buffer"
-version = "0.10.4"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
 dependencies = [
- "generic-array",
+ "hybrid-array",
 ]
 [[package]]
 name = "cfg-if"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
 [[package]]
 name = "cpufeatures"
-version = "0.2.17"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
 dependencies = [
 "libc",
 ]
 [[package]]
 name = "crypto-common"
-version = "0.1.6"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
- "generic-array",
+ "hybrid-array",
 "typenum",
 ]
 [[package]]
 name = "digest"
-version = "0.10.7"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
 "block-buffer",
 "crypto-common",
 ]
 [[package]]
-name = "edera-sprout"
+name = "edera-sprout-bls"
-version = "0.0.21"
+version = "0.0.29"
 dependencies = [
 "anyhow",
- "bitflags",
+]
 [[package]]
 name = "edera-sprout-boot"
 version = "0.0.29"
 dependencies = [
 "anyhow",
 "edera-sprout-bls",
 "edera-sprout-build",
 "edera-sprout-config",
 "edera-sprout-eficore",
 "edera-sprout-parsing",
 "hex",
 "jaarg",
 "log",
 "sha2",
 "shlex",
 "spin",
 "toml",
 "uefi",
 "uefi-raw",
 ]
 [[package]]
 name = "edera-sprout-build"
 version = "0.0.29"
 [[package]]
 name = "edera-sprout-config"
-version = "0.0.21"
+version = "0.0.29"
 dependencies = [
 "serde",
 ]
 [[package]]
-name = "generic-array"
+name = "edera-sprout-eficore"
-version = "0.14.9"
+version = "0.0.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4bb6743198531e02858aeaea5398fcc883e71851fcbcb5a2f773e2fb6cb1edf2"
 dependencies = [
- "typenum",
+ "anyhow",
- "version_check",
+ "bitflags",
 "log",
 "shlex",
 "spin",
 "uefi",
 "uefi-raw",
 ]
 [[package]]
 name = "edera-sprout-parsing"
 version = "0.0.29"
 dependencies = [
 "hex",
 "sha2",
 ]
 [[package]]
@@ -105,10 +128,25 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 [[package]]
-name = "libc"
+name = "hybrid-array"
-version = "0.2.177"
+version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
+checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
 dependencies = [
 "typenum",
 ]
 [[package]]
 name = "jaarg"
 version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "534d589df1ef528a238f4bc4b1db081a1280f3aedf2695fd8971e9853a7fa4f6"
 [[package]]
 name = "libc"
 version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 [[package]]
 name = "lock_api"
@@ -121,33 +159,33 @@ dependencies = [
 [[package]]
 name = "log"
-version = "0.4.28"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 [[package]]
 name = "proc-macro2"
-version = "1.0.103"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
 dependencies = [
 "unicode-ident",
 ]
 [[package]]
 name = "ptr_meta"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b9a0cf95a1196af61d4f1cbdab967179516d9a4a4312af1f31948f8f6224a79"
+checksum = "743da816b98c921cdbe8628ef7381b76f25ecf4da599fc80aca90eae7ef70cc0"
 dependencies = [
 "ptr_meta_derive",
 ]
 [[package]]
 name = "ptr_meta_derive"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7347867d0a7e1208d93b46767be83e2b8f978c3dad35f775ac8d8847551d6fe1"
+checksum = "1c8d9ca532f185d5d4db7a7c9d51420b452168ea1c2b913953281bd6fe1fcbd0"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -156,9 +194,9 @@ dependencies = [
 [[package]]
 name = "quote"
-version = "1.0.41"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce25767e7b499d1b604768e7cde645d14cc8584231ea6b295e9c9eb22c02e1d1"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
 dependencies = [
 "proc-macro2",
 ]
@@ -171,9 +209,9 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 [[package]]
 name = "serde"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
 dependencies = [
 "serde_core",
 "serde_derive",
@@ -181,18 +219,18 @@ dependencies = [
 [[package]]
 name = "serde_core"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
 dependencies = [
 "serde_derive",
 ]
 [[package]]
 name = "serde_derive"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -201,18 +239,18 @@ dependencies = [
 [[package]]
 name = "serde_spanned"
-version = "1.0.3"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e24345aa0fe688594e73770a5f6d1b216508b4f93484c0026d521acd30134392"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
 dependencies = [
 "serde_core",
 ]
 [[package]]
 name = "sha2"
-version = "0.10.9"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
 dependencies = [
 "cfg-if",
 "cpufeatures",
@@ -221,24 +259,24 @@ dependencies = [
 [[package]]
 name = "shlex"
-version = "1.3.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 [[package]]
 name = "spin"
-version = "0.10.0"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5fe4ccb98d9c292d56fec89a5e07da7fc4cf0dc11e156b41793132775d3e591"
+checksum = "0134f9043ed38b087ac4f7d4af44c79e2c9e5094421fe3164f435ce585953b10"
 dependencies = [
 "lock_api",
 ]
 [[package]]
 name = "syn"
-version = "2.0.108"
+version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da58917d35242480a05c2897064da0a80589a2a0476c9a3f2fdc83b53502e917"
+checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -247,9 +285,9 @@ dependencies = [
 [[package]]
 name = "toml"
-version = "0.9.8"
+version = "1.1.6+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0dc8b1fb61449e27716ec0e1bdf0f6b8f3e8f6b05391e8497b8b6d7804ea6d8"
+checksum = "920602543f0911ab71da12c50d59701da54c196d1a2bf5cb4b75667f137a406a"
 dependencies = [
 "serde_core",
 "serde_spanned",
@@ -260,27 +298,27 @@ dependencies = [
 [[package]]
 name = "toml_datetime"
-version = "0.7.3"
+version = "1.1.1+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2cdb639ebbc97961c51720f858597f7f24c4fc295327923af55b74c3c724533"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
 dependencies = [
 "serde_core",
 ]
 [[package]]
 name = "toml_parser"
-version = "1.0.4"
+version = "1.1.3+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0cbe268d35bdb4bb5a56a2de88d0ad0eb70af5384a99d648cd4b3d04039800e"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
 dependencies = [
 "winnow",
 ]
 [[package]]
 name = "typenum"
-version = "1.19.0"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 [[package]]
 name = "ucs2"
@@ -293,9 +331,9 @@ dependencies = [
 [[package]]
 name = "uefi"
-version = "0.36.0"
+version = "0.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f123e69767fc287c44d70ee19af3b39d1bfb735dbaff5090e95b5b13cd656d16"
+checksum = "368cef7d94514897e6dad4350945c7910a9f5bf9021191d1c58ee3ec09962697"
 dependencies = [
 "bitflags",
 "cfg-if",
@@ -309,9 +347,9 @@ dependencies = [
 [[package]]
 name = "uefi-macros"
-version = "0.19.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4687412b5ac74d245d5bfb1733ede50c31be19bf8a4b6a967a29b451bab49e67"
+checksum = "643efa8b64be89780bc498b290fab04337c7c4d171cc82cce2e133a74616dcc4"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -320,9 +358,9 @@ dependencies = [
 [[package]]
 name = "uefi-raw"
-version = "0.12.0"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8aff2f4f2b556a36a201d335a1e0a57754967a96857b1f47a52d5a23825cac84"
+checksum = "3636327a6d88a38c0f2567fb695ec7ba27b3483d1877730486605aa0866da201"
 dependencies = [
 "bitflags",
 "uguid",
@@ -336,18 +374,12 @@ checksum = "0c8352f8c05e47892e7eaf13b34abd76a7f4aeaf817b716e88789381927f199c"
 [[package]]
 name = "unicode-ident"
-version = "1.0.22"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
+checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"
 [[package]]
 name = "version_check"
 version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 [[package]]
 name = "winnow"
-version = "0.7.13"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21a0236b59786fed61e2a80582dd500fe61f18b5dca67a4a067d0bc9039339cf"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
@@ -1,26 +1,29 @@
 [workspace]
 members = [
  "crates/boot",
  "crates/build",
  "crates/config",
-  "crates/sprout",
+  "crates/eficore",
  "crates/bls",
  "crates/parsing",
 ]
 resolver = "3"
 [workspace.package]
 license = "Apache-2.0"
-version = "0.0.21"
+version = "0.0.29"
 homepage = "https://sprout.edera.dev"
 repository = "https://github.com/edera-dev/sprout"
 edition = "2024"
 [workspace.dependencies]
-bitflags = "2.10.0"
+bitflags = "2.13.2"
-log = "0.4.28"
+log = "0.4.34"
-spin = "0.10.0"
+spin = "0.12.3"
-uefi = "0.36.0"
+uefi-raw = "0.17.0"
 uefi-raw = "0.12.0"
 [workspace.dependencies.anyhow]
-version = "1.0.100"
+version = "1.0.104"
 default-features = false
 [workspace.dependencies.hex]
@@ -28,24 +31,34 @@ version = "0.4.3"
 default-features = false
 features = ["alloc"]
 [workspace.dependencies.jaarg]
 version = "0.2.2"
 default-features = false
 features = ["alloc"]
 [workspace.dependencies.serde]
-version = "1.0.228"
+version = "1.0.229"
 default-features = false
 features = ["alloc", "derive"]
 [workspace.dependencies.sha2]
-version = "0.10.9"
+version = "0.11.0"
 default-features = false
 [workspace.dependencies.shlex]
-version = "1.3.0"
+version = "2.0.1"
 default-features = false
 [workspace.dependencies.toml]
-version = "0.9.8"
+version = "1.1.6"
 default-features = false
 features = ["serde", "parse"]
 [workspace.dependencies.uefi]
 version = "0.41.0"
 default-features = false
 features = ["alloc", "global_allocator", "panic_handler"]
 # Common build profiles
 # NOTE: We have to compile everything for opt-level = 2 due to optimization passes
 # which don't handle the UEFI target properly.
@@ -11,6 +11,17 @@ We currently only support `x86_64-unknown-uefi` and `aarch64-unknown-uefi` targe
 To test your changes in QEMU, please run `./hack/dev/boot.sh`, you can specify `x86_64` or `aarch64`
 as an argument to boot.sh to boot the specified architecture.
 ## Crate Structure
 Sprout is split into multiple crates:
 - `edera-sprout-boot` as `crates/boot`: Bootloader entrypoint for Sprout.
 - `edera-sprout-build` at `crates/build`: Build logic for Sprout.
 - `edera-sprout-config` at `crates/config`: Serialization structures for the Sprout configuration file.
 - `edera-sprout-eficore` at `crates/eficore`: Core library for Sprout EFI code.
 It is intended that overtime Sprout will be split into even more crates.
 ## Hack Scripts
 You can use the `./hack` scripts to run common development tasks:
@@ -1,8 +1,7 @@
 # syntax=docker/dockerfile:1.7-labs
 ARG RUST_PROFILE=release
 ARG RUST_TARGET_SUBDIR=release
-FROM --platform=$BUILDPLATFORM rustlang/rust:nightly-alpine@sha256:34532121803db17008af0cdc4e2e1210466cb257cc9d3840dac42d706640fee5 AS build
+FROM --platform=$BUILDPLATFORM rust:1.98.1-alpine@sha256:7cc1c22d77d9432f7fe012a70e6d3e555af54c2a6832700ed7d553f1769ae89f AS build
 RUN apk --no-cache add musl-dev busybox-static
 ARG RUST_PROFILE
 RUN adduser -S -s /bin/sh build
@@ -47,8 +47,10 @@ We recommend running Sprout without Secure Boot for development, and with Secure
 | Operating System | Secure Boot Enabled | Link                                                  |
 |------------------|---------------------|-------------------------------------------------------|
-| Ubuntu           | ✅                   | [Setup Guide](./docs/setup/signed/ubuntu.md)          |
+| Fedora           | ✅                   | [Setup Guide](./docs/setup/signed/fedora.md)          |
 | Debian           | ✅                   | [Setup Guide](./docs/setup/signed/debian.md)          |
 | Ubuntu           | ✅                   | [Setup Guide](./docs/setup/signed/ubuntu.md)          |
 | openSUSE         | ✅                   | [Setup Guide](./docs/setup/signed/opensuse.md)        |
 | Fedora           | ❌                   | [Setup Guide](./docs/setup/unsigned/fedora.md)        |
 | Alpine Edge      | ❌                   | [Setup Guide](./docs/setup/unsigned/alpine-edge.md)   |
 | Generic Linux    | ❌                   | [Setup Guide](./docs/setup/unsigned/generic-linux.md) |
@@ -0,0 +1,18 @@
 # This crate explicitly does not have uefi/uefi-raw dependencies,
 # so that the contents can be unit-testable on non-UEFI target hosts.
 # Do not add uefi or uefi-raw as dependencies.
 [package]
 name = "edera-sprout-bls"
 description = "Sprout BLS Utilities (UEFI-free)"
 license.workspace = true
 version.workspace = true
 homepage.workspace = true
 repository.workspace = true
 edition.workspace = true
 [dependencies]
 anyhow.workspace = true
 [lib]
 name = "edera_sprout_bls"
 path = "src/lib.rs"
@@ -0,0 +1,800 @@
 #![no_std]
 extern crate alloc;
 use alloc::string::{String, ToString};
 use anyhow::{Error, Result};
 use core::{cmp::Ordering, iter::Peekable, str::FromStr};
 /// Represents a parsed BLS entry.
 /// Fields unrelated to Sprout are not included.
 #[derive(Default, Debug, Clone)]
 pub struct BlsEntry {
    /// The title of the entry.
    pub title: Option<String>,
    /// The options to pass to the entry.
    pub options: Option<String>,
    /// The path to the linux kernel.
    pub linux: Option<String>,
    /// The path to the initrd.
    pub initrd: Option<String>,
    /// The path to an EFI image.
    pub efi: Option<String>,
    /// The sort key for the entry.
    pub sort_key: Option<String>,
    /// The version of the entry.
    pub version: Option<String>,
    /// The machine id of the entry.
    pub machine_id: Option<String>,
 }
 /// Parser for a BLS entry.
 impl FromStr for BlsEntry {
    type Err = Error;
    /// Parses the `input` as a BLS entry file.
    fn from_str(input: &str) -> Result<Self> {
        // All the fields in a BLS entry we understand.
        // Set all to None initially.
        let mut title: Option<String> = None;
        let mut options: Option<String> = None;
        let mut linux: Option<String> = None;
        let mut initrd: Option<String> = None;
        let mut efi: Option<String> = None;
        let mut sort_key: Option<String> = None;
        let mut version: Option<String> = None;
        let mut machine_id: Option<String> = None;
        // Iterate over each line in the input and parse it.
        for line in input.lines() {
            let line = line.trim();
            // Skip over empty lines and comments.
            if line.is_empty() || line.starts_with('#') {
                continue;
            }
            // Split the line once by whitespace. This technically includes newlines but since
            // the lines iterator is used, there should never be a newline here.
            let Some((key, value)) = line.split_once(char::is_whitespace) else {
                continue;
            };
            // Match the key to a field we understand.
            match key {
                // The title of the entry.
                "title" => {
                    title = Some(value.trim().to_string());
                }
                // The options to pass to the entry.
                "options" => {
                    options = Some(value.trim().to_string());
                }
                // The path to the linux kernel.
                "linux" => {
                    linux = Some(value.trim().to_string());
                }
                // The path to the initrd.
                "initrd" => {
                    initrd = Some(value.trim().to_string());
                }
                // The path to an EFI image.
                "efi" => {
                    efi = Some(value.trim().to_string());
                }
                "sort-key" => {
                    sort_key = Some(value.trim().to_string());
                }
                "version" => {
                    version = Some(value.trim().to_string());
                }
                "machine-id" => {
                    machine_id = Some(value.trim().to_string());
                }
                // Ignore any other key.
                _ => {
                    continue;
                }
            }
        }
        // Produce a BLS entry from the parsed fields.
        Ok(Self {
            title,
            options,
            linux,
            initrd,
            efi,
            sort_key,
            version,
            machine_id,
        })
    }
 }
 impl BlsEntry {
    /// Checks if this BLS entry is something we can actually boot in Sprout.
    pub fn is_valid(&self) -> bool {
        self.linux.is_some() || self.efi.is_some()
    }
    /// Fetches the path to an EFI bootable image to boot, if any.
    /// This prioritizes the linux field over efi.
    /// It also converts / to \\ to match EFI path style.
    pub fn chainload_path(&self) -> Option<String> {
        self.linux
            .clone()
            .or(self.efi.clone())
            .map(|path| path.replace('/', "\\").trim_start_matches('\\').to_string())
    }
    /// Fetches the path to an initrd to pass to the kernel, if any.
    /// It also converts / to \\ to match EFI path style.
    pub fn initrd_path(&self) -> Option<String> {
        self.initrd
            .clone()
            .map(|path| path.replace('/', "\\").trim_start_matches('\\').to_string())
    }
    /// Fetches the options to pass to the kernel, if any.
    pub fn options(&self) -> Option<String> {
        self.options.clone()
    }
    /// Fetches the title of the entry, if any.
    pub fn title(&self) -> Option<String> {
        self.title.clone()
    }
    /// Fetches the sort key of the entry, if any.
    pub fn sort_key(&self) -> Option<String> {
        self.sort_key.clone()
    }
    /// Fetches the version of the entry, if any.
    pub fn version(&self) -> Option<String> {
        self.version.clone()
    }
    /// Fetches the machine id of the entry, if any.
    pub fn machine_id(&self) -> Option<String> {
        self.machine_id.clone()
    }
 }
 /// Sorts two BLS entries according to the BLS sort system.
 /// `a_name` and `b_name` are the entry filenames (without `.conf`) used as the
 /// final tiebreaker when all other fields are equal.
 /// Reference: <https://uapi-group.org/specifications/specs/boot_loader_specification/#sorting>
 pub fn sort_bls(a_bls: &BlsEntry, a_name: &str, b_bls: &BlsEntry, b_name: &str) -> Ordering {
    // Grab the sort keys from both entries.
    let a_sort_key = a_bls.sort_key();
    let b_sort_key = b_bls.sort_key();
    // Sort keys, machine-id and version are only considered when both entries have a sort key.
    // If only one entry has a sort key, that entry sorts first.
    let ordering = match (a_sort_key, b_sort_key) {
        (Some(a_sort_key), Some(b_sort_key)) => a_sort_key
            .cmp(&b_sort_key)
            // If the sort keys are equal, sort by machine-id.
            .then_with(|| a_bls.machine_id().cmp(&b_bls.machine_id()))
            // If the machine-id values are equal, sort by version, sorting newer versions first.
            .then_with(|| {
                compare_versions_optional(a_bls.version().as_deref(), b_bls.version().as_deref())
                    .reverse()
            }),
        (Some(_), None) => Ordering::Less,
        (None, Some(_)) => Ordering::Greater,
        (None, None) => Ordering::Equal,
    };
    // If all else is equal, compare the file names of both entries, sorting newer entries first.
    ordering.then_with(|| compare_versions(a_name, b_name).reverse())
 }
 /// Handles single character advancement and comparison.
 macro_rules! handle_single_char {
    ($ca: expr, $cb:expr, $a_chars:expr, $b_chars:expr, $c:expr) => {
        match ($ca == $c, $cb == $c) {
            (true, false) => return Ordering::Less,
            (false, true) => return Ordering::Greater,
            (true, true) => {
                $a_chars.next();
                $b_chars.next();
                continue;
            }
            _ => {}
        }
    };
 }
 /// Compares two strings using the BLS version comparison specification.
 /// Handles optional values as well by comparing only if both are specified.
 /// A missing value is considered older than any specified value.
 pub fn compare_versions_optional(a: Option<&str>, b: Option<&str>) -> Ordering {
    match (a, b) {
        // If both have values, compare them.
        (Some(a), Some(b)) => compare_versions(a, b),
        // If the second value is None, then `a` is greater than `b`.
        (Some(_a), None) => Ordering::Greater,
        // If the first value is None, the `a` is less than `b`.
        (None, Some(_b)) => Ordering::Less,
        // If both values are None, return that they are equal.
        (None, None) => Ordering::Equal,
    }
 }
 /// Compares two strings using the BLS version comparison specification.
 /// See: <https://uapi-group.org/specifications/specs/version_format_specification/>
 pub fn compare_versions(a: &str, b: &str) -> Ordering {
    // An empty string is older than any other string.
    if a.is_empty() || b.is_empty() {
        return a.len().cmp(&b.len());
    }
    // Acquire a peekable iterator for each string.
    let mut a_chars = a.chars().peekable();
    let mut b_chars = b.chars().peekable();
    // Loop until we have reached the end of one of the strings.
    loop {
        // Skip invalid characters in both strings.
        skip_invalid(&mut a_chars);
        skip_invalid(&mut b_chars);
        // Handle the ~ character. This must happen before the end of string check,
        // as a string with ~ is older than a string that has ended (1~rc1 < 1).
        match (a_chars.peek() == Some(&'~'), b_chars.peek() == Some(&'~')) {
            (true, false) => return Ordering::Less,
            (false, true) => return Ordering::Greater,
            (true, true) => {
                a_chars.next();
                b_chars.next();
                continue;
            }
            (false, false) => {}
        }
        // Check if either string has ended.
        match (a_chars.peek(), b_chars.peek()) {
            // No more characters in either string.
            (None, None) => return Ordering::Equal,
            // One string has ended, the other hasn't.
            (None, Some(_)) => return Ordering::Less,
            (Some(_), None) => return Ordering::Greater,
            // Both strings have characters left.
            (Some(&ca), Some(&cb)) => {
                // Handle '-' character.
                handle_single_char!(ca, cb, a_chars, b_chars, '-');
                // Handle the '^' character.
                handle_single_char!(ca, cb, a_chars, b_chars, '^');
                // Handle the '.' character.
                handle_single_char!(ca, cb, a_chars, b_chars, '.');
                // Handle digits with numerical comparison.
                // If only one string has digits at this position, that string is newer.
                if ca.is_ascii_digit() || cb.is_ascii_digit() {
                    if !ca.is_ascii_digit() {
                        return Ordering::Less;
                    }
                    if !cb.is_ascii_digit() {
                        return Ordering::Greater;
                    }
                    let result = compare_numeric(&mut a_chars, &mut b_chars);
                    if result != Ordering::Equal {
                        return result;
                    }
                    continue;
                }
                // Handle letters with alphabetical comparison.
                // We key off of the A character being alphabetical intentionally as we presume
                // this indicates it will be the same at this position.
                if ca.is_ascii_alphabetic() || cb.is_ascii_alphabetic() {
                    let result = compare_alphabetic(&mut a_chars, &mut b_chars);
                    if result != Ordering::Equal {
                        return result;
                    }
                    continue;
                }
            }
        }
    }
 }
 /// Skips characters that are not in the valid character set.
 fn skip_invalid<I: Iterator<Item = char>>(iter: &mut Peekable<I>) {
    while let Some(&c) = iter.peek() {
        if is_valid_char(c) {
            break;
        }
        iter.next();
    }
 }
 /// Checks if a character is in the valid character set for comparison.
 fn is_valid_char(c: char) -> bool {
    matches!(c, 'a'..='z' | 'A'..='Z' | '0'..='9' | '-' | '.' | '~' | '^')
 }
 /// Compares numerical prefixes by extracting numbers.
 /// Numbers are compared by their digit count first and then digit by digit,
 /// which supports numbers of any length.
 fn compare_numeric<I: Iterator<Item = char>>(
    iter_a: &mut Peekable<I>,
    iter_b: &mut Peekable<I>,
 ) -> Ordering {
    let num_a = extract_number(iter_a);
    let num_b = extract_number(iter_b);
    num_a
        .len()
        .cmp(&num_b.len())
        .then_with(|| num_a.cmp(&num_b))
 }
 /// Extracts the digits of a number from the iterator, skipping leading zeros.
 fn extract_number<I: Iterator<Item = char>>(iter: &mut Peekable<I>) -> String {
    // Skip leading zeros
    while let Some(&'0') = iter.peek() {
        iter.next();
    }
    let mut num = String::new();
    while let Some(&c) = iter.peek() {
        if c.is_ascii_digit() {
            iter.next();
            num.push(c);
        } else {
            break;
        }
    }
    num
 }
 /// Compares alphabetical prefixes.
 /// Capital letters compare lower than lowercase letters (B < a).
 fn compare_alphabetic<I: Iterator<Item = char>>(
    iter_a: &mut Peekable<I>,
    iter_b: &mut Peekable<I>,
 ) -> Ordering {
    loop {
        return match (iter_a.peek(), iter_b.peek()) {
            (Some(&ca), Some(&cb)) if ca.is_ascii_alphabetic() && cb.is_ascii_alphabetic() => {
                if ca == cb {
                    // Same character, we should continue.
                    iter_a.next();
                    iter_b.next();
                    continue;
                }
                // Different characters found.
                // All capital letters compare lower than lowercase letters.
                match (ca.is_ascii_uppercase(), cb.is_ascii_uppercase()) {
                    (true, false) => Ordering::Less,    // uppercase < lowercase
                    (false, true) => Ordering::Greater, // lowercase > uppercase
                    (true, true) => ca.cmp(&cb),        // both are uppercase
                    (false, false) => ca.cmp(&cb),      // both are lowercase
                }
            }
            (Some(&ca), Some(_)) if ca.is_ascii_alphabetic() => {
                // a has letters, b doesn't
                Ordering::Greater
            }
            (Some(_), Some(&cb)) if cb.is_ascii_alphabetic() => {
                // b has letters, a doesn't
                Ordering::Less
            }
            (Some(&ca), None) if ca.is_ascii_alphabetic() => Ordering::Greater,
            (None, Some(&cb)) if cb.is_ascii_alphabetic() => Ordering::Less,
            _ => Ordering::Equal,
        };
    }
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use core::cmp::Ordering;
    fn sort_entry(
        sort_key: Option<&str>,
        machine_id: Option<&str>,
        version: Option<&str>,
    ) -> BlsEntry {
        BlsEntry {
            sort_key: sort_key.map(|s| s.to_string()),
            machine_id: machine_id.map(|s| s.to_string()),
            version: version.map(|s| s.to_string()),
            linux: Some("/vmlinuz".to_string()),
            ..BlsEntry::default()
        }
    }
    #[test]
    fn parse_empty_input_gives_all_none() {
        let entry: BlsEntry = "".parse().unwrap();
        assert!(entry.title.is_none());
        assert!(entry.linux.is_none());
        assert!(entry.efi.is_none());
        assert!(entry.initrd.is_none());
        assert!(entry.options.is_none());
        assert!(entry.sort_key.is_none());
        assert!(entry.version.is_none());
        assert!(entry.machine_id.is_none());
    }
    #[test]
    fn parse_all_known_fields() {
        let input = "\
 title      Fedora Linux 6.5.6
 version    6.5.6-300.fc39.x86_64
 machine-id abc123def456
 linux      /boot/vmlinuz-6.5.6
 initrd     /boot/initrd-6.5.6.img
 options    root=/dev/sda1 ro quiet
 sort-key   fedora
 efi        /EFI/fedora/shimx64.efi
 ";
        let entry: BlsEntry = input.parse().unwrap();
        assert_eq!(entry.title.as_deref(), Some("Fedora Linux 6.5.6"));
        assert_eq!(entry.version.as_deref(), Some("6.5.6-300.fc39.x86_64"));
        assert_eq!(entry.machine_id.as_deref(), Some("abc123def456"));
        assert_eq!(entry.linux.as_deref(), Some("/boot/vmlinuz-6.5.6"));
        assert_eq!(entry.initrd.as_deref(), Some("/boot/initrd-6.5.6.img"));
        assert_eq!(entry.options.as_deref(), Some("root=/dev/sda1 ro quiet"));
        assert_eq!(entry.sort_key.as_deref(), Some("fedora"));
        assert_eq!(entry.efi.as_deref(), Some("/EFI/fedora/shimx64.efi"));
    }
    #[test]
    fn parse_skips_blank_lines() {
        let input = "\n\ntitle   My Entry\n\n\nlinux /vmlinuz\n\n";
        let entry: BlsEntry = input.parse().unwrap();
        assert_eq!(entry.title.as_deref(), Some("My Entry"));
        assert_eq!(entry.linux.as_deref(), Some("/vmlinuz"));
    }
    #[test]
    fn parse_skips_comment_lines() {
        let input = "# this is a comment\ntitle My Entry\n# another comment\nlinux /vmlinuz\n";
        let entry: BlsEntry = input.parse().unwrap();
        assert_eq!(entry.title.as_deref(), Some("My Entry"));
        assert_eq!(entry.linux.as_deref(), Some("/vmlinuz"));
    }
    #[test]
    fn parse_trims_leading_whitespace_from_value() {
        let input = "title    Padded Title\nlinux    /boot/vmlinuz\n";
        let entry: BlsEntry = input.parse().unwrap();
        assert_eq!(entry.title.as_deref(), Some("Padded Title"));
        assert_eq!(entry.linux.as_deref(), Some("/boot/vmlinuz"));
    }
    #[test]
    fn parse_ignores_unknown_keys() {
        let input = "title My Entry\nunknown-key some-value\nfuture-field value\nlinux /vmlinuz\n";
        let entry: BlsEntry = input.parse().unwrap();
        assert_eq!(entry.title.as_deref(), Some("My Entry"));
        assert_eq!(entry.linux.as_deref(), Some("/vmlinuz"));
    }
    #[test]
    fn parse_skips_lines_without_whitespace_separator() {
        // A line with no whitespace cannot be split into key+value, so it is skipped
        let input = "title My Entry\nnovalueline\nlinux /vmlinuz\n";
        let entry: BlsEntry = input.parse().unwrap();
        assert_eq!(entry.title.as_deref(), Some("My Entry"));
        assert_eq!(entry.linux.as_deref(), Some("/vmlinuz"));
    }
    #[test]
    fn is_valid_when_linux_present() {
        let entry: BlsEntry = "linux /vmlinuz\n".parse().unwrap();
        assert!(entry.is_valid());
    }
    #[test]
    fn is_valid_when_efi_present() {
        let entry: BlsEntry = "efi /EFI/boot/bootx64.efi\n".parse().unwrap();
        assert!(entry.is_valid());
    }
    #[test]
    fn not_valid_without_linux_or_efi() {
        let entry: BlsEntry = "title Just a Title\noptions quiet\n".parse().unwrap();
        assert!(!entry.is_valid());
    }
    #[test]
    fn chainload_path_normalises_forward_slashes_to_backslashes() {
        let entry: BlsEntry = "linux /boot/vmlinuz\n".parse().unwrap();
        assert_eq!(entry.chainload_path().as_deref(), Some("boot\\vmlinuz"));
    }
    #[test]
    fn chainload_path_strips_leading_backslash() {
        let entry: BlsEntry = "linux \\EFI\\boot\\kernel\n".parse().unwrap();
        assert_eq!(entry.chainload_path().as_deref(), Some("EFI\\boot\\kernel"));
    }
    #[test]
    fn chainload_path_prefers_linux_over_efi() {
        let input = "linux /boot/vmlinuz\nefi /EFI/boot/bootx64.efi\n";
        let entry: BlsEntry = input.parse().unwrap();
        assert_eq!(entry.chainload_path().as_deref(), Some("boot\\vmlinuz"));
    }
    #[test]
    fn chainload_path_falls_back_to_efi_when_no_linux() {
        let entry: BlsEntry = "efi /EFI/Microsoft/Boot/bootmgfw.efi\n".parse().unwrap();
        assert_eq!(
            entry.chainload_path().as_deref(),
            Some("EFI\\Microsoft\\Boot\\bootmgfw.efi")
        );
    }
    #[test]
    fn chainload_path_none_when_neither_linux_nor_efi() {
        let entry: BlsEntry = "title Only Title\n".parse().unwrap();
        assert!(entry.chainload_path().is_none());
    }
    #[test]
    fn initrd_path_normalises_slashes() {
        let entry: BlsEntry = "linux /vmlinuz\ninitrd /boot/initrd.img\n".parse().unwrap();
        assert_eq!(entry.initrd_path().as_deref(), Some("boot\\initrd.img"));
    }
    #[test]
    fn initrd_path_none_when_not_set() {
        let entry: BlsEntry = "linux /vmlinuz\n".parse().unwrap();
        assert!(entry.initrd_path().is_none());
    }
    #[test]
    fn sort_key_is_primary_criterion() {
        let a = sort_entry(Some("alpine"), None, None);
        let b = sort_entry(Some("fedora"), None, None);
        assert_eq!(sort_bls(&a, "a", &b, "b"), Ordering::Less);
        assert_eq!(sort_bls(&b, "b", &a, "a"), Ordering::Greater);
    }
    #[test]
    fn machine_id_is_secondary_criterion() {
        let a = sort_entry(Some("linux"), Some("aaa"), None);
        let b = sort_entry(Some("linux"), Some("bbb"), None);
        assert_eq!(sort_bls(&a, "a", &b, "b"), Ordering::Less);
        assert_eq!(sort_bls(&b, "b", &a, "a"), Ordering::Greater);
    }
    #[test]
    fn version_is_tertiary_criterion_newer_first() {
        let a = sort_entry(Some("linux"), Some("abc"), Some("6.5.0"));
        let b = sort_entry(Some("linux"), Some("abc"), Some("6.4.0"));
        // newer version (a) sorts before older version (b), so a < b in sort order
        assert_eq!(sort_bls(&a, "a", &b, "b"), Ordering::Less);
        assert_eq!(sort_bls(&b, "b", &a, "a"), Ordering::Greater);
    }
    #[test]
    fn name_is_final_tiebreaker_newer_first() {
        let a = sort_entry(Some("linux"), Some("abc"), Some("6.5.0"));
        let b = sort_entry(Some("linux"), Some("abc"), Some("6.5.0"));
        // name comparison via compare_versions, reversed — higher name sorts first
        assert_eq!(sort_bls(&a, "entry-2", &b, "entry-1"), Ordering::Less);
        assert_eq!(sort_bls(&a, "entry-1", &b, "entry-2"), Ordering::Greater);
    }
    #[test]
    fn identical_entries_are_equal() {
        let a = sort_entry(Some("linux"), Some("abc"), Some("6.5.0"));
        let b = sort_entry(Some("linux"), Some("abc"), Some("6.5.0"));
        assert_eq!(sort_bls(&a, "entry-1", &b, "entry-1"), Ordering::Equal);
    }
    #[test]
    fn equal_strings_are_equal() {
        assert_eq!(compare_versions("1.0.0", "1.0.0"), Ordering::Equal);
    }
    #[test]
    fn empty_strings_are_equal() {
        assert_eq!(compare_versions("", ""), Ordering::Equal);
    }
    #[test]
    fn simple_numeric_less() {
        assert_eq!(compare_versions("1", "2"), Ordering::Less);
    }
    #[test]
    fn simple_numeric_greater() {
        assert_eq!(compare_versions("2", "1"), Ordering::Greater);
    }
    #[test]
    fn numeric_is_not_lexicographic() {
        // "10" > "9", not "10" < "9" as in lexicographic order
        assert_eq!(compare_versions("10", "9"), Ordering::Greater);
        assert_eq!(compare_versions("1.10", "1.9"), Ordering::Greater);
    }
    #[test]
    fn leading_zeros_are_ignored() {
        assert_eq!(compare_versions("01", "1"), Ordering::Equal);
        assert_eq!(compare_versions("1.00", "1.0"), Ordering::Equal);
        assert_eq!(compare_versions("007", "7"), Ordering::Equal);
    }
    #[test]
    fn multi_component_comparison() {
        assert_eq!(compare_versions("1.0.0", "1.0.1"), Ordering::Less);
        assert_eq!(compare_versions("1.0.1", "1.0.0"), Ordering::Greater);
        assert_eq!(compare_versions("2.0.0", "1.9.9"), Ordering::Greater);
    }
    #[test]
    fn more_components_is_greater() {
        assert_eq!(compare_versions("1.0.0", "1.0"), Ordering::Greater);
        assert_eq!(compare_versions("1.0", "1.0.0"), Ordering::Less);
        assert_eq!(compare_versions("1.0.0.0", "1.0.0"), Ordering::Greater);
    }
    #[test]
    fn alphabetic_sections_compare_lexicographically() {
        assert_eq!(compare_versions("1.0a", "1.0b"), Ordering::Less);
        assert_eq!(compare_versions("1.0b", "1.0a"), Ordering::Greater);
        assert_eq!(compare_versions("1.0abc", "1.0abd"), Ordering::Less);
    }
    #[test]
    fn uppercase_letters_sort_below_lowercase() {
        // Capital letters compare lower than lowercase (B < a)
        assert_eq!(compare_versions("B", "a"), Ordering::Less);
        assert_eq!(compare_versions("a", "B"), Ordering::Greater);
        assert_eq!(compare_versions("Z", "a"), Ordering::Less);
    }
    #[test]
    fn uppercase_letters_compare_among_themselves() {
        assert_eq!(compare_versions("A", "B"), Ordering::Less);
        assert_eq!(compare_versions("B", "A"), Ordering::Greater);
        assert_eq!(compare_versions("A", "A"), Ordering::Equal);
    }
    #[test]
    fn invalid_characters_are_skipped() {
        // Characters not in [a-zA-Z0-9.-~^] are skipped before comparison
        assert_eq!(compare_versions("##1.0", "1.0"), Ordering::Equal);
        assert_eq!(compare_versions("1.0##", "1.0"), Ordering::Equal);
    }
    #[test]
    fn tilde_between_two_present_tilde_strings() {
        // When both have ~ at the same position, they are consumed and comparison continues
        assert_eq!(compare_versions("1~alpha", "1~beta"), Ordering::Less);
        assert_eq!(compare_versions("1~rc1", "1~rc2"), Ordering::Less);
        assert_eq!(compare_versions("1~rc1", "1~rc1"), Ordering::Equal);
    }
    #[test]
    fn tilde_when_only_one_side_has_it() {
        // When a has ~ but b doesn't at the same position, a < b
        assert_eq!(compare_versions("1~rc1", "1.0"), Ordering::Less);
        // When b has ~ but a doesn't, a > b
        assert_eq!(compare_versions("1.0", "1~rc1"), Ordering::Greater);
    }
    #[test]
    fn tilde_is_older_than_end_of_string() {
        // A pre-release is older than the release it precedes.
        assert_eq!(compare_versions("1~rc1", "1"), Ordering::Less);
        assert_eq!(compare_versions("1", "1~rc1"), Ordering::Greater);
        assert_eq!(compare_versions("6.1~rc3", "6.1"), Ordering::Less);
    }
    #[test]
    fn empty_string_is_oldest() {
        assert_eq!(compare_versions("", "~1"), Ordering::Less);
        assert_eq!(compare_versions("~1", ""), Ordering::Greater);
        assert_eq!(compare_versions("", "1"), Ordering::Less);
    }
    #[test]
    fn digits_are_newer_than_letters() {
        assert_eq!(compare_versions("0", "a"), Ordering::Greater);
        assert_eq!(compare_versions("a", "0"), Ordering::Less);
        assert_eq!(compare_versions("1.0", "1.a"), Ordering::Greater);
        assert_eq!(compare_versions("1.a", "1.0"), Ordering::Less);
    }
    #[test]
    fn large_numbers_do_not_saturate() {
        assert_eq!(
            compare_versions("99999999999999999999", "99999999999999999998"),
            Ordering::Greater
        );
        assert_eq!(
            compare_versions("1.99999999999999999998", "1.99999999999999999999"),
            Ordering::Less
        );
    }
    #[test]
    fn entry_with_sort_key_sorts_before_entry_without() {
        let with_key = sort_entry(Some("fedora"), None, None);
        let without_key = sort_entry(None, None, None);
        assert_eq!(sort_bls(&with_key, "a", &without_key, "b"), Ordering::Less);
        assert_eq!(
            sort_bls(&without_key, "b", &with_key, "a"),
            Ordering::Greater
        );
    }
    #[test]
    fn entries_without_sort_key_sort_by_name_only() {
        // Without a sort key, machine-id and version are ignored.
        let a = sort_entry(None, Some("aaa"), Some("1.0"));
        let b = sort_entry(None, Some("bbb"), Some("2.0"));
        assert_eq!(sort_bls(&a, "entry-2", &b, "entry-1"), Ordering::Less);
        assert_eq!(sort_bls(&b, "entry-1", &a, "entry-2"), Ordering::Greater);
    }
    #[test]
    fn entry_with_version_sorts_before_entry_without() {
        let a = sort_entry(Some("linux"), Some("abc"), Some("6.5.0"));
        let b = sort_entry(Some("linux"), Some("abc"), None);
        assert_eq!(sort_bls(&a, "a", &b, "b"), Ordering::Less);
        assert_eq!(sort_bls(&b, "b", &a, "a"), Ordering::Greater);
    }
    #[test]
    fn optional_both_none_equal() {
        assert_eq!(compare_versions_optional(None, None), Ordering::Equal);
    }
    #[test]
    fn optional_some_vs_none_is_greater() {
        // A missing version is older than any specified version.
        assert_eq!(
            compare_versions_optional(Some("1.0"), None),
            Ordering::Greater
        );
    }
    #[test]
    fn optional_none_vs_some_is_less() {
        assert_eq!(compare_versions_optional(None, Some("1.0")), Ordering::Less);
    }
    #[test]
    fn optional_both_some_delegates_to_compare_versions() {
        assert_eq!(
            compare_versions_optional(Some("1.0"), Some("2.0")),
            Ordering::Less
        );
        assert_eq!(
            compare_versions_optional(Some("2.0"), Some("1.0")),
            Ordering::Greater
        );
        assert_eq!(
            compare_versions_optional(Some("1.0"), Some("1.0")),
            Ordering::Equal
        );
    }
 }
@@ -1,6 +1,6 @@
 [package]
-name = "edera-sprout"
+name = "edera-sprout-boot"
-description = "Modern UEFI bootloader"
+description = "Sprout: Modern UEFI Bootloader"
 license.workspace = true
 version.workspace = true
 homepage.workspace = true
@@ -9,22 +9,22 @@ edition.workspace = true
 [dependencies]
 anyhow.workspace = true
 bitflags.workspace = true
 edera-sprout-config.path = "../config"
 edera-sprout-eficore.path = "../eficore"
 edera-sprout-bls.path = "../bls"
 edera-sprout-parsing.path = "../parsing"
 hex.workspace = true
 jaarg.workspace = true
 sha2.workspace = true
 shlex.workspace = true
 spin.workspace = true
 toml.workspace = true
 log.workspace = true
 uefi.workspace = true
 uefi-raw.workspace = true
-[dependencies.uefi]
+[build-dependencies]
-workspace = true
+edera-sprout-build.path = "../build"
 features = ["alloc", "global_allocator", "logger", "panic_handler"]
 [dependencies.uefi-raw]
 workspace = true
 [[bin]]
 name = "sprout"
 path = "src/main.rs"
 test = false
@@ -0,0 +1,7 @@
 use edera_sprout_build::generate_sbat_module;
 /// Build script entry point for Sprout.
 fn main() {
    // Generate the sbat.generated.rs file.
    generate_sbat_module();
 }
@@ -0,0 +1,127 @@
 use crate::context::SproutContext;
 use crate::phases::before_handoff;
 use alloc::boxed::Box;
 use alloc::rc::Rc;
 use anyhow::{Context, Result, bail};
 use edera_sprout_config::actions::chainload::ChainloadConfiguration;
 use edera_sprout_parsing::{combine_options, empty_is_none};
 use eficore::bootloader_interface::BootloaderInterface;
 use eficore::loader::source::ImageSource;
 use eficore::loader::{ImageLoadRequest, ImageLoader};
 use eficore::media_loader::MediaLoaderHandle;
 use eficore::media_loader::constants::linux::LINUX_EFI_INITRD_MEDIA_GUID;
 use uefi::CString16;
 use uefi::proto::loaded_image::LoadedImage;
 /// Executes the chainload action using the specified `configuration` inside the provided `context`.
 pub fn chainload(context: Rc<SproutContext>, configuration: &ChainloadConfiguration) -> Result<()> {
    // Retrieve the current image handle of sprout.
    let sprout_image = uefi::boot::image_handle();
    // Resolve the path to the image to chainload.
    let resolved = eficore::path::resolve_path(
        Some(context.root().loaded_image_path()?),
        context.stamp(&configuration.path),
    )
    .context("unable to resolve chainload path")?;
    // Create a new image load request with the current image and the resolved path.
    let request = ImageLoadRequest::new(sprout_image, ImageSource::ResolvedPath(&resolved));
    // Load the image to chainload using the image loader support module.
    // It will determine if the image needs to be loaded via the shim or can be loaded directly.
    let image = ImageLoader::load(request)?;
    // Stamp and combine the options to pass to the image.
    let options = combine_options(context.stamp_iter(configuration.options.iter()));
    // Pass the load options to the image.
    // If no options are provided, the resulting string will be empty.
    // The options are pinned and boxed to ensure that they are valid for the lifetime of this
    // function, which ensures the lifetime of the options for the image runtime.
    let options = Box::pin(
        CString16::try_from(&options[..])
            .context("unable to convert chainloader options to CString16")?,
    );
    // Ensure the chainloader options limit is not exceeded.
    if options.num_bytes() > u32::MAX as usize {
        bail!("chainloader options too large");
    }
    // Open the LoadedImage protocol of the image to chainload to pass the load options.
    // This is done in a block to release the protocol before the image is started, as the
    // image may itself need to open its LoadedImage protocol exclusively.
    {
        let mut loaded_image_protocol =
            uefi::boot::open_protocol_exclusive::<LoadedImage>(*image.handle())
                .context("unable to open loaded image protocol")?;
        // SAFETY: option size is checked to validate it is safe to pass.
        // Additionally, the pointer is allocated and retained on heap, which makes
        // passing the `options` pointer safe to the next image.
        unsafe {
            loaded_image_protocol
                .set_load_options(options.as_ptr() as *const u8, options.num_bytes() as u32);
        }
    }
    // Stamp the initrd path, if provided.
    let initrd = configuration
        .linux_initrd
        .as_ref()
        .map(|item| context.stamp(item));
    // The initrd can be None or empty, so we need to collapse that into a single Option.
    let initrd = empty_is_none(initrd);
    // If an initrd is provided, register it with the EFI stack.
    let mut initrd_handle = None;
    if let Some(linux_initrd) = initrd {
        let resolved_initrd =
            eficore::path::resolve_path(Some(context.root().loaded_image_path()?), &linux_initrd)
                .context("unable to resolve linux initrd path")?;
        // A path without a file component refers to the root of the filesystem, not an initrd.
        // This happens when a path template like "$root\\$initrd" is stamped with an empty
        // initrd value, such as a BLS entry without an initrd.
        let initrd_subpath = eficore::path::device_path_subpath(&resolved_initrd.full_path)
            .context("unable to get linux initrd subpath")?;
        if !initrd_subpath.trim_matches('\\').is_empty() {
            let content = resolved_initrd
                .read_file()
                .context("unable to read linux initrd")?;
            let handle = MediaLoaderHandle::register(
                LINUX_EFI_INITRD_MEDIA_GUID,
                content.into_boxed_slice(),
            )
            .context("unable to register linux initrd")?;
            initrd_handle = Some(handle);
        }
    }
    // Mark execution of an entry in the bootloader interface.
    BootloaderInterface::mark_exec(context.root().timer())
        .context("unable to mark execution of boot entry in bootloader interface")?;
    // Since we are about to hand off control to another image, we need to execute the handoff hook.
    // This will perform operations like clearing the screen.
    before_handoff(&context).context("unable to execute before handoff hook")?;
    // Start the loaded image.
    // This call might return, or it may pass full control to another image that will never return.
    // Capture the result to ensure we can return an error if the image fails to start, but only
    // after the optional initrd has been unregistered.
    let result = uefi::boot::start_image(*image.handle());
    // Assert there was no error starting the image.
    result.context("unable to start image")?;
    // Explicitly drop the options to clarify the lifetime.
    drop(options);
    // Explicitly drop the initrd handle to clarify when it should be unregistered.
    drop(initrd_handle);
    // Return control to sprout.
    Ok(())
 }
@@ -0,0 +1,122 @@
 use crate::{actions, context::SproutContext};
 use alloc::rc::Rc;
 use alloc::vec::Vec;
 use alloc::{format, vec};
 use anyhow::{Context, Result};
 use edera_sprout_config::actions::chainload::ChainloadConfiguration;
 use edera_sprout_config::actions::edera::EderaConfiguration;
 use edera_sprout_parsing::{build_xen_config, combine_options, empty_is_none};
 use eficore::media_loader::{
    MediaLoaderHandle,
    constants::xen::{
        XEN_EFI_CONFIG_MEDIA_GUID, XEN_EFI_KERNEL_MEDIA_GUID, XEN_EFI_RAMDISK_MEDIA_GUID,
    },
 };
 use eficore::platform::tpm::PlatformTpm;
 use uefi::Guid;
 /// Register a media loader for the provided `bytes` with the vendor `guid`.
 /// `what` should indicate some identifying value for error messages
 /// like `config` or `kernel`.
 /// Provides a [MediaLoaderHandle] that can be used to unregister the media loader.
 fn register_media_loader_bytes(
    guid: Guid,
    what: &str,
    bytes: Vec<u8>,
 ) -> Result<MediaLoaderHandle> {
    MediaLoaderHandle::register(guid, bytes.into_boxed_slice())
        .context(format!("unable to register {} media loader", what))
 }
 /// Read the contents of the loader payload at `path` relative to the sprout image.
 /// `what` should indicate some identifying value for error messages
 /// like `kernel` or `initrd`.
 fn read_loader_payload(context: &Rc<SproutContext>, what: &str, path: &str) -> Result<Vec<u8>> {
    let path = context.stamp(path);
    eficore::path::read_file_contents(Some(context.root().loaded_image_path()?), &path)
        .context(format!("unable to read {} file", what))
 }
 /// Executes the edera action which will boot the Edera hypervisor with the specified
 /// `configuration` and `context`. This action uses Edera-specific Xen EFI stub functionality.
 pub fn edera(context: Rc<SproutContext>, configuration: &EderaConfiguration) -> Result<()> {
    // Only register the initrd media loader if the user actually configured one.
    let xen_opts = combine_options(context.stamp_iter(configuration.xen_options.iter()));
    let dom0_args = combine_options(context.stamp_iter(configuration.kernel_options.iter()));
    // Measure xen options and dom0 cmdline into PCR 12 in a fixed order.
    PlatformTpm::log_event(
        PlatformTpm::PCR_KERNEL_PARAMETERS,
        xen_opts.as_bytes(),
        "sprout: xen options",
    )
    .context("unable to measure xen options into the TPM")?;
    PlatformTpm::log_event(
        PlatformTpm::PCR_KERNEL_PARAMETERS,
        dom0_args.as_bytes(),
        "sprout: dom0 cmdline",
    )
    .context("unable to measure dom0 cmdline into the TPM")?;
    // Build the Xen config text and register it as the config media loader. The
    // assembled text is a derived artifact, intentionally not measured.
    let config_handle = register_media_loader_bytes(
        XEN_EFI_CONFIG_MEDIA_GUID,
        "config",
        build_xen_config(&xen_opts, &dom0_args).into_bytes(),
    )
    .context("unable to register config media loader")?;
    // Read the dom0 kernel, measure it into PCR 11, then register the kernel
    // media loader.
    let kernel_bytes = read_loader_payload(&context, "kernel", &configuration.kernel)?;
    PlatformTpm::log_event(
        PlatformTpm::PCR_KERNEL,
        &kernel_bytes,
        "sprout: dom0 kernel",
    )
    .context("unable to measure dom0 kernel into the TPM")?;
    let kernel_handle =
        register_media_loader_bytes(XEN_EFI_KERNEL_MEDIA_GUID, "kernel", kernel_bytes)
            .context("unable to register kernel media loader")?;
    // Extend PCR 9 with the initrd bytes (empty when no initrd is
    // configured).
    let initrd_bytes = match empty_is_none(configuration.initrd.as_ref()) {
        Some(p) => read_loader_payload(&context, "initrd", p)?,
        None => Vec::new(),
    };
    PlatformTpm::log_event(
        PlatformTpm::PCR_INITRD,
        &initrd_bytes,
        "sprout: dom0 initrd",
    )
    .context("unable to measure dom0 initrd into the TPM")?;
    // Create a vector of media loaders to drop them only after this function completes.
    let mut media_loaders = vec![config_handle, kernel_handle];
    // Register the initrd if it is provided.
    if !initrd_bytes.is_empty() {
        let initrd_handle =
            register_media_loader_bytes(XEN_EFI_RAMDISK_MEDIA_GUID, "initrd", initrd_bytes)
                .context("unable to register initrd media loader")?;
        media_loaders.push(initrd_handle);
    }
    // Chainload to the Xen EFI stub.
    let result = actions::chainload::chainload(
        context.clone(),
        &ChainloadConfiguration {
            path: configuration.xen.clone(),
            options: vec![],
            linux_initrd: None,
        },
    )
    .context("unable to chainload to xen");
    // Explicitly drop the media loaders to clarify when they should be unregistered.
    drop(media_loaders);
    result
 }
@@ -1,5 +1,6 @@
 use anyhow::{Context, Result};
 use edera_sprout_config::RootConfiguration;
 use log::warn;
 use uefi::fs::FileSystem;
 use uefi::proto::device_path::DevicePath;
 use uefi::proto::media::fs::SimpleFileSystem;
@@ -25,15 +26,24 @@ pub fn autoconfigure(config: &mut RootConfiguration) -> Result<()> {
    // For each filesystem that was detected, scan it for supported autoconfig mechanisms.
    for handle in filesystem_handles {
        // Acquire the device path root for the filesystem.
-        let root = {
+        // A filesystem that can't be opened is skipped, as it should not prevent
-            uefi::boot::open_protocol_exclusive::<DevicePath>(handle)
+        // autoconfiguring the other filesystems.
-                .context("unable to get root for filesystem")?
+        let root = match uefi::boot::open_protocol_exclusive::<DevicePath>(handle) {
-                .to_boxed()
+            Ok(root) => root.to_boxed(),
            Err(error) => {
                warn!("skipping filesystem, unable to get its root: {}", error);
                continue;
            }
        };
        // Open the filesystem that was detected.
-        let filesystem = uefi::boot::open_protocol_exclusive::<SimpleFileSystem>(handle)
+        let filesystem = match uefi::boot::open_protocol_exclusive::<SimpleFileSystem>(handle) {
-            .context("unable to open filesystem")?;
+            Ok(filesystem) => filesystem,
            Err(error) => {
                warn!("skipping filesystem, unable to open it: {}", error);
                continue;
            }
        };
        // Trade the filesystem protocol for the uefi filesystem helper.
        let mut filesystem = FileSystem::new(filesystem);
@@ -1,4 +1,3 @@
 use crate::utils;
 use alloc::string::ToString;
 use alloc::{format, vec};
 use anyhow::{Context, Result};
@@ -8,6 +7,7 @@ use edera_sprout_config::actions::chainload::ChainloadConfiguration;
 use edera_sprout_config::entries::EntryDeclaration;
 use edera_sprout_config::generators::GeneratorDeclaration;
 use edera_sprout_config::generators::bls::BlsConfiguration;
 use edera_sprout_parsing::unique_hash;
 use uefi::cstr16;
 use uefi::fs::{FileSystem, Path};
 use uefi::proto::device_path::DevicePath;
@@ -30,14 +30,14 @@ pub fn scan(
    // Convert the device path root to a string we can use in the configuration.
    let mut root = root
-        .to_string(DisplayOnly(false), AllowShortcuts(false))
+        .to_string16(DisplayOnly(false), AllowShortcuts(false))
        .context("unable to convert device root to string")?
        .to_string();
    // Add a trailing forward-slash to the root to ensure the device root is completed.
    root.push('/');
    // Generate a unique hash of the root path.
-    let root_unique_hash = utils::unique_hash(&root);
+    let root_unique_hash = unique_hash(&root);
    // Whether we have a loader.conf file.
    let has_loader_conf = filesystem
@@ -1,5 +1,3 @@
 use crate::utils;
 use crate::utils::vercmp;
 use alloc::collections::BTreeMap;
 use alloc::string::{String, ToString};
 use alloc::vec::Vec;
@@ -11,6 +9,10 @@ use edera_sprout_config::actions::chainload::ChainloadConfiguration;
 use edera_sprout_config::entries::EntryDeclaration;
 use edera_sprout_config::generators::GeneratorDeclaration;
 use edera_sprout_config::generators::list::ListConfiguration;
 use edera_sprout_parsing::{
    LINUX_INITRAMFS_PREFIXES, LINUX_KERNEL_PREFIXES, initramfs_candidates, match_kernel_prefix,
    unique_hash,
 };
 use uefi::CString16;
 use uefi::fs::{FileSystem, Path, PathBuf};
 use uefi::proto::device_path::DevicePath;
@@ -24,12 +26,6 @@ const LINUX_CHAINLOAD_ACTION_PREFIX: &str = "linux-chainload-";
 /// The empty string represents the root of the filesystem.
 const SCAN_LOCATIONS: &[&str] = &["\\boot", "\\"];
 /// Prefixes of kernel files to scan for.
 const KERNEL_PREFIXES: &[&str] = &["vmlinuz"];
 /// Prefixes of initramfs files to match to.
 const INITRAMFS_PREFIXES: &[&str] = &["initramfs", "initrd", "initrd.img"];
 /// This is really silly, but if what we are booting is the Canonical stubble stub,
 /// there is a chance it will assert that the load options are non-empty.
 /// Technically speaking, load options can be empty. However, it assumes load options
@@ -37,9 +33,9 @@ const INITRAMFS_PREFIXES: &[&str] = &["initramfs", "initrd", "initrd.img"];
 /// and then uses that code improperly by asserting that the pointer is non-null.
 /// To give a good user experience, we place a placeholder value here to ensure it's non-empty.
 /// For stubble, this code ensures the command line pointer becomes null:
-/// https://github.com/ubuntu/stubble/blob/e56643979addfb98982266018e08921c07424a0c/stub.c#L61-L64
+/// <https://github.com/ubuntu/stubble/blob/e56643979addfb98982266018e08921c07424a0c/stub.c#L61-L64>
 /// Then this code asserts on it, stopping the boot process:
-/// https://github.com/ubuntu/stubble/blob/e56643979addfb98982266018e08921c07424a0c/stub.c#L27
+/// <https://github.com/ubuntu/stubble/blob/e56643979addfb98982266018e08921c07424a0c/stub.c#L27>
 const DEFAULT_LINUX_OPTIONS: &str = "placeholder";
 /// Pair of kernel and initramfs.
@@ -109,9 +105,7 @@ fn scan_directory(filesystem: &mut FileSystem, path: &str) -> Result<Vec<KernelP
        // Find a kernel prefix that matches, if any.
        // This is case-insensitive to ensure we pick up all possibilities.
-        let Some(prefix) = KERNEL_PREFIXES.iter().find(|prefix| {
+        let Some(prefix) = match_kernel_prefix(&name_for_match, LINUX_KERNEL_PREFIXES) else {
            name_for_match == **prefix || name_for_match.starts_with(&format!("{}-", prefix))
        }) else {
            // Skip over anything that doesn't match a kernel prefix.
            continue;
        };
@@ -119,15 +113,14 @@ fn scan_directory(filesystem: &mut FileSystem, path: &str) -> Result<Vec<KernelP
        // Acquire the suffix of the name, this will be used to match an initramfs.
        let suffix = &name[prefix.len()..];
-        // Find a matching initramfs, if any.
+        // Find a matching initramfs by trying each candidate name, if any.
-        let mut initramfs_prefix_iter = INITRAMFS_PREFIXES.iter();
+        let mut candidates = initramfs_candidates(suffix, LINUX_INITRAMFS_PREFIXES);
        let matched_initramfs_path = loop {
-            let Some(prefix) = initramfs_prefix_iter.next() else {
+            let Some(candidate) = candidates.next() else {
                break None;
            };
            // Construct an initramfs path.
-            let initramfs = format!("{}{}", prefix, suffix);
+            let initramfs = CString16::try_from(candidate.as_str())
            let initramfs = CString16::try_from(initramfs.as_str())
                .context("unable to convert initramfs name to CString16")?;
            let mut initramfs_path = path_for_join.clone();
            initramfs_path.push(Path::new(&initramfs));
@@ -165,14 +158,14 @@ pub fn scan(
    // Convert the device path root to a string we can use in the configuration.
    let mut root = root
-        .to_string(DisplayOnly(false), AllowShortcuts(false))
+        .to_string16(DisplayOnly(false), AllowShortcuts(false))
        .context("unable to convert device root to string")?
        .to_string();
    // Add a trailing forward-slash to the root to ensure the device root is completed.
    root.push('/');
    // Generate a unique hash of the root path.
-    let root_unique_hash = utils::unique_hash(&root);
+    let root_unique_hash = unique_hash(&root);
    // Scan all locations for kernel pairs, adding them to the list.
    for location in SCAN_LOCATIONS {
@@ -186,17 +179,15 @@ pub fn scan(
        return Ok(false);
    }
    // Sort the kernel pairs by kernel version, if it has one, newer kernels first.
    pairs.sort_by(|a, b| vercmp::compare_versions(&a.kernel, &b.kernel).reverse());
    // Generate a unique name for the linux chainload action.
-    let chainload_action_name = format!("{}{}", LINUX_CHAINLOAD_ACTION_PREFIX, root_unique_hash,);
+    let chainload_action_name = format!("{}{}", LINUX_CHAINLOAD_ACTION_PREFIX, root_unique_hash);
    // Kernel pairs are detected, generate a list configuration for it.
    let generator = ListConfiguration {
        entry: EntryDeclaration {
            title: "Boot Linux $name".to_string(),
            actions: vec![chainload_action_name.clone()],
            sort_key: Some("$kernel".to_string()),
            ..Default::default()
        },
        values: pairs
@@ -1,4 +1,3 @@
 use crate::utils;
 use alloc::string::ToString;
 use alloc::{format, vec};
 use anyhow::{Context, Result};
@@ -6,6 +5,7 @@ use edera_sprout_config::RootConfiguration;
 use edera_sprout_config::actions::ActionDeclaration;
 use edera_sprout_config::actions::chainload::ChainloadConfiguration;
 use edera_sprout_config::entries::EntryDeclaration;
 use edera_sprout_parsing::unique_hash;
 use uefi::CString16;
 use uefi::fs::{FileSystem, Path};
 use uefi::proto::device_path::DevicePath;
@@ -38,26 +38,27 @@ pub fn scan(
    // Convert the device path root to a string we can use in the configuration.
    let mut root = root
-        .to_string(DisplayOnly(false), AllowShortcuts(false))
+        .to_string16(DisplayOnly(false), AllowShortcuts(false))
        .context("unable to convert device root to string")?
        .to_string();
    // Add a trailing forward-slash to the root to ensure the device root is completed.
    root.push('/');
    // Generate a unique hash of the root path.
-    let root_unique_hash = utils::unique_hash(&root);
+    let root_unique_hash = unique_hash(&root);
    // Generate a unique name for the Windows chainload action.
    let chainload_action_name = format!("{}{}", WINDOWS_CHAINLOAD_ACTION_PREFIX, root_unique_hash,);
    // Generate an entry name for Windows.
-    let entry_name = format!("auto-windows-{}", root_unique_hash,);
+    let entry_name = format!("auto-windows-{}", root_unique_hash);
    // Create an entry for Windows and insert it into the configuration.
    let entry = EntryDeclaration {
        title: "Boot Windows".to_string(),
        actions: vec![chainload_action_name.clone()],
        values: Default::default(),
        sort_key: None, // Use the default sort key.
    };
    config.entries.insert(entry_name, entry);
@@ -1,10 +1,9 @@
 use crate::options::SproutOptions;
 use crate::platform::tpm::PlatformTpm;
 use crate::utils;
 use alloc::vec::Vec;
 use anyhow::{Context, Result, bail};
 use core::ops::Deref;
 use edera_sprout_config::{RootConfiguration, latest_version};
 use eficore::platform::tpm::PlatformTpm;
 use log::info;
 use toml::Value;
 use uefi::proto::device_path::LoadedImageDevicePath;
@@ -21,7 +20,7 @@ fn load_raw_config(options: &SproutOptions) -> Result<Vec<u8>> {
    info!("configuration file: {}", options.config);
    // Read the contents of the sprout config file.
-    let content = utils::read_file_contents(Some(&path), &options.config)
+    let content = eficore::path::read_file_contents(Some(&path), &options.config)
        .context("unable to read sprout config file")?;
    // Measure the sprout.toml into the TPM, if needed and possible.
@@ -1,15 +1,14 @@
 use crate::options::SproutOptions;
 use crate::platform::timer::PlatformTimer;
 use alloc::boxed::Box;
 use alloc::collections::{BTreeMap, BTreeSet};
 use alloc::format;
 use alloc::rc::Rc;
 use alloc::string::{String, ToString};
 use alloc::vec::Vec;
 use anyhow::anyhow;
 use anyhow::{Result, bail};
 use core::cmp::Reverse;
 use edera_sprout_config::actions::ActionDeclaration;
 use edera_sprout_parsing::stamp_values;
 use eficore::platform::timer::PlatformTimer;
 use uefi::proto::device_path::DevicePath;
 /// The maximum number of iterations that can be performed in [SproutContext::finalize].
@@ -197,7 +196,7 @@ impl SproutContext {
            let mut did_change = false;
            let mut values = BTreeMap::new();
            for (key, value) in &current_values {
-                let (changed, result) = Self::stamp_values(&current_values, value);
+                let (changed, result) = stamp_values(&current_values, value);
                if changed {
                    // If the value changed, we need to re-stamp it.
                    did_change = true;
@@ -221,52 +220,20 @@ impl SproutContext {
        })
    }
    /// Stamps the `text` value with the specified `values` map. The returned value indicates
    /// whether the `text` has been changed and the value that was stamped and changed.
    ///
    /// Stamping works like this:
    /// - Start with the input text.
    /// - Sort all the keys in reverse length order (longest keys first)
    /// - For each key, if the key is not empty, replace $KEY in the text.
    /// - Each follow-up iteration acts upon the last iterations result.
    /// - We keep track if the text changes during the replacement.
    /// - We return both whether the text changed during any iteration and the final result.
    fn stamp_values(values: &BTreeMap<String, String>, text: impl AsRef<str>) -> (bool, String) {
        let mut result = text.as_ref().to_string();
        let mut did_change = false;
        // Sort the keys by length. This is to ensure that we stamp the longest keys first.
        // If we did not do this, "$abc" could be stamped by "$a" into an invalid result.
        let mut keys = values.keys().collect::<Vec<_>>();
        // Sort by key length, reversed. This results in the longest keys appearing first.
        keys.sort_by_key(|key| Reverse(key.len()));
        for key in keys {
            // Empty keys are not supported.
            if key.is_empty() {
                continue;
            }
            // We can fetch the value from the map. It is verifiable that the key exists.
            let Some(value) = values.get(key) else {
                unreachable!("keys iterated over is collected on a map that cannot be modified");
            };
            let next_result = result.replace(&format!("${key}"), value);
            if result != next_result {
                did_change = true;
            }
            result = next_result;
        }
        (did_change, result)
    }
    /// Stamps the input `text` with all the values in this [SproutContext] and it's parents.
    /// For example, if this context contains {"a":"b"}, and the text "hello\\$a", it will produce
    /// "hello\\b" as an output string.
    pub fn stamp(&self, text: impl AsRef<str>) -> String {
-        Self::stamp_values(&self.all_values(), text.as_ref()).1
+        stamp_values(&self.all_values(), text.as_ref()).1
    }
    /// Stamps all the items from the iterator `input` with all the values in this [SproutContext]
    /// and it's parents. This calls [self.stamp] on each item.
    pub fn stamp_iter(
        &self,
        input: impl Iterator<Item = impl AsRef<str>>,
    ) -> impl Iterator<Item = String> {
        input.map(|item| self.stamp(item))
    }
    /// Unloads a [SproutContext] back into an owned context. This
@@ -1,12 +1,12 @@
 use crate::context::SproutContext;
 use crate::integrations::shim::{ShimInput, ShimSupport};
 use crate::utils;
 use alloc::collections::BTreeMap;
 use alloc::format;
 use alloc::rc::Rc;
 use alloc::string::String;
 use anyhow::{Context, Result};
 use edera_sprout_config::drivers::DriverDeclaration;
 use eficore::loader::source::ImageSource;
 use eficore::loader::{ImageLoadRequest, ImageLoader};
 use log::info;
 use uefi::boot::SearchType;
@@ -16,20 +16,23 @@ fn load_driver(context: Rc<SproutContext>, driver: &DriverDeclaration) -> Result
    let sprout_image = uefi::boot::image_handle();
    // Resolve the path to the driver image.
-    let resolved = utils::resolve_path(
+    let resolved = eficore::path::resolve_path(
        Some(context.root().loaded_image_path()?),
-        &context.stamp(&driver.path),
+        context.stamp(&driver.path),
    )
    .context("unable to resolve path to driver")?;
-    // Load the driver image using the shim support integration.
+    // Create an image load request with the current image and the resolved path.
    let request = ImageLoadRequest::new(sprout_image, ImageSource::ResolvedPath(&resolved));
    // Load the driver image using the image loader support module.
    // It will determine if the image needs to be loaded via the shim or can be loaded directly.
-    let image = ShimSupport::load(sprout_image, ShimInput::ResolvedPath(&resolved))?;
+    let image = ImageLoader::load(request)?;
    // Start the driver image, this is expected to return control to sprout.
    // There is no guarantee that the driver will actually return control as it is
    // just a standard EFI image.
-    uefi::boot::start_image(image).context("unable to start driver image")?;
+    uefi::boot::start_image(*image.handle()).context("unable to start driver image")?;
    Ok(())
 }
@@ -46,7 +49,7 @@ fn reconnect() -> Result<()> {
    for handle in handles.iter() {
        // Ignore the result as there is nothing we can do if reconnecting a controller fails.
        // This is also likely to fail in some cases but should fail safely.
-        let _ = uefi::boot::connect_controller(*handle, None, None, true);
+        let _ = uefi::boot::connect_controller(*handle, &[], None, true);
    }
    Ok(())
@@ -12,6 +12,7 @@ pub struct BootableEntry {
    declaration: EntryDeclaration,
    default: bool,
    pin_name: bool,
    sort_key: Option<String>,
 }
 impl BootableEntry {
@@ -29,6 +30,7 @@ impl BootableEntry {
            declaration,
            default: false,
            pin_name: false,
            sort_key: None,
        }
    }
@@ -93,10 +95,36 @@ impl BootableEntry {
    }
    /// Determine if this entry matches `needle` by comparing to the name or title of the entry.
    /// If `needle` ends with *, we will match a partial match.
    pub fn is_match(&self, needle: &str) -> bool {
        // If the needle ends with '*', we will accept a partial match.
        if needle.ends_with("*") {
            // Strip off any '*' at the end.
            let partial = needle.trim_end_matches("*");
            // Check if the name or title start with the partial match.
            return self.name.starts_with(partial) || self.title.starts_with(partial);
        }
        // Standard quality matching rules.
        self.name == needle || self.title == needle
    }
    /// Set the sort key of the entry. This is used to sort entries via version comparison.
    pub fn set_sort_key(&mut self, sort_key: String) {
        self.sort_key = Some(sort_key);
    }
    /// Retrieve a reference to the sort key of the entry. If one is not specified, we will use the
    /// name of the entry.
    pub fn sort_key(&self) -> &str {
        // Use the sort key specified in the bootable entry, or use the declaration sort key,
        // or use the name of the entry.
        self.sort_key
            .as_deref()
            .or(self.declaration.sort_key.as_deref())
            .unwrap_or(&self.name)
    }
    /// Find an entry by `needle` inside the entry iterator `haystack`.
    /// This will search for an entry by name, title, or index.
    pub fn find<'a>(
@@ -1,11 +1,11 @@
 use crate::context::SproutContext;
 use crate::utils;
 use alloc::rc::Rc;
 use alloc::string::String;
 use anyhow::{Context, Result, anyhow, bail};
 use core::ops::Deref;
 use core::str::FromStr;
 use edera_sprout_config::extractors::filesystem_device_match::FilesystemDeviceMatchExtractor;
 use eficore::partition::PartitionGuidForm;
 use uefi::fs::{FileSystem, Path};
 use uefi::proto::device_path::DevicePath;
 use uefi::proto::media::file::{File, FileSystemVolumeLabel};
@@ -48,8 +48,9 @@ pub fn extract(
                .to_boxed();
            // Fetch the partition uuid for this filesystem.
-            let partition_uuid = utils::partition_guid(&root, utils::PartitionGuidForm::Partition)
+            let partition_uuid =
-                .context("unable to fetch the partition uuid of the filesystem")?;
+                eficore::partition::partition_guid(&root, PartitionGuidForm::Partition)
                    .context("unable to fetch the partition uuid of the filesystem")?;
            // Compare the partition uuid to the parsed uuid.
            // If it does not match, continue to the next filesystem.
@@ -73,7 +74,7 @@ pub fn extract(
            // Fetch the partition type uuid for this filesystem.
            let partition_type_uuid =
-                utils::partition_guid(&root, utils::PartitionGuidForm::PartitionType)
+                eficore::partition::partition_guid(&root, PartitionGuidForm::PartitionType)
                    .context("unable to fetch the partition uuid of the filesystem")?;
            // Compare the partition type uuid to the parsed uuid.
            // If it does not match, continue to the next filesystem.
@@ -133,7 +134,7 @@ pub fn extract(
            .context("unable to open filesystem device path")?;
        let path = path.deref();
        // Acquire the device path root as a string.
-        return utils::device_path_root(path).context("unable to get device path root");
+        return eficore::path::device_path_root(path).context("unable to get device path root");
    }
    // If there is a fallback value, use it at this point.
@@ -1,23 +1,22 @@
 use crate::context::SproutContext;
 use crate::entries::BootableEntry;
-use crate::generators::bls::entry::BlsEntry;
+use alloc::{
-use crate::utils;
+    format,
-use crate::utils::vercmp;
+    rc::Rc,
-use alloc::format;
+    string::{String, ToString},
-use alloc::rc::Rc;
+    vec::Vec,
-use alloc::string::{String, ToString};
+};
 use alloc::vec::Vec;
 use anyhow::{Context, Result};
-use core::cmp::Ordering;
+use core::{cmp::Ordering, str::FromStr};
-use core::str::FromStr;
+use edera_sprout_bls::{BlsEntry, sort_bls};
 use edera_sprout_config::generators::bls::BlsConfiguration;
-use uefi::cstr16;
+use log::warn;
-use uefi::fs::{FileSystem, PathBuf};
+use uefi::{
-use uefi::proto::device_path::text::{AllowShortcuts, DisplayOnly};
+    cstr16,
-use uefi::proto::media::fs::SimpleFileSystem;
+    fs::{FileSystem, PathBuf},
-
+    proto::device_path::text::{AllowShortcuts, DisplayOnly},
-/// BLS entry parser.
+    proto::media::fs::SimpleFileSystem,
-mod entry;
+};
 // TODO(azenla): remove this once variable substitution is implemented.
 /// This function is used to remove the `tuned_initrd` variable from entry values.
@@ -27,57 +26,11 @@ fn quirk_initrd_remove_tuned(input: String) -> String {
 }
 /// Sorts two entries according to the BLS sort system.
-/// Reference: https://uapi-group.org/specifications/specs/boot_loader_specification/#sorting
+/// Reference: <https://uapi-group.org/specifications/specs/boot_loader_specification/#sorting>
 fn sort_entries(a: &(BlsEntry, BootableEntry), b: &(BlsEntry, BootableEntry)) -> Ordering {
    // Grab the components of both entries.
    let (a_bls, a_boot) = a;
    let (b_bls, b_boot) = b;
-
+    sort_bls(a_bls, a_boot.name(), b_bls, b_boot.name())
    // Grab the sort keys from both entries.
    let a_sort_key = a_bls.sort_key();
    let b_sort_key = b_bls.sort_key();
    // Compare the sort keys of both entries.
    match a_sort_key.cmp(&b_sort_key) {
        // If A and B sort keys are equal, sort by machine-id.
        Ordering::Equal => {
            // Grab the machine-id from both entries.
            let a_machine_id = a_bls.machine_id();
            let b_machine_id = b_bls.machine_id();
            // Compare the machine-id of both entries.
            match a_machine_id.cmp(&b_machine_id) {
                // If both machine-id values are equal, sort by version.
                Ordering::Equal => {
                    // Grab the version from both entries.
                    let a_version = a_bls.version();
                    let b_version = b_bls.version();
                    // Compare the version of both entries, sorting newer versions first.
                    match vercmp::compare_versions_optional(
                        a_version.as_deref(),
                        b_version.as_deref(),
                    )
                    .reverse()
                    {
                        // If both versions are equal, sort by file name in reverse order.
                        Ordering::Equal => {
                            // Grab the file name from both entries.
                            let a_name = a_boot.name();
                            let b_name = b_boot.name();
                            // Compare the file names of both entries, sorting newer entries first.
                            vercmp::compare_versions(a_name, b_name).reverse()
                        }
                        other => other,
                    }
                }
                other => other,
            }
        }
        other => other,
    }
 }
 /// Generates entries from the BLS entries directory using the specified `bls` configuration and
@@ -89,14 +42,15 @@ pub fn generate(context: Rc<SproutContext>, bls: &BlsConfiguration) -> Result<Ve
    let path = context.stamp(&bls.path);
    // Resolve the path to the BLS directory.
-    let bls_resolved = utils::resolve_path(Some(context.root().loaded_image_path()?), &path)
+    let bls_resolved =
-        .context("unable to resolve bls path")?;
+        eficore::path::resolve_path(Some(context.root().loaded_image_path()?), &path)
            .context("unable to resolve bls path")?;
    // Construct a filesystem path to the BLS entries directory.
    let mut entries_path = PathBuf::from(
        bls_resolved
            .sub_path
-            .to_string(DisplayOnly(false), AllowShortcuts(false))
+            .to_string16(DisplayOnly(false), AllowShortcuts(false))
            .context("unable to convert bls path to string")?,
    );
    entries_path.push(cstr16!("entries"));
@@ -107,6 +61,15 @@ pub fn generate(context: Rc<SproutContext>, bls: &BlsConfiguration) -> Result<Ve
            .context("unable to open bls filesystem")?;
    let mut fs = FileSystem::new(fs);
    // The entries directory is optional, as a BLS directory may only contain a loader.conf file.
    // If it does not exist, there are no entries to generate.
    if !fs
        .try_exists(&entries_path)
        .context("unable to check for bls entries directory")?
    {
        return Ok(Vec::new());
    }
    // Read the BLS entries directory.
    let entries_iter = fs
        .read_dir(&entries_path)
@@ -143,15 +106,33 @@ pub fn generate(context: Rc<SproutContext>, bls: &BlsConfiguration) -> Result<Ve
        full_entry_path.push(entry.file_name());
        // Read the entry file.
-        let content = fs
+        // Entries that can't be read or parsed are skipped, as one broken entry
-            .read(full_entry_path)
+        // should not prevent booting any of the other entries.
-            .context("unable to read bls file")?;
+        let content = match fs.read(full_entry_path) {
            Ok(content) => content,
            Err(error) => {
                warn!("unable to read bls entry {}: {}", name, error);
                continue;
            }
        };
        // Parse the entry file as a UTF-8 string.
-        let content = String::from_utf8(content).context("unable to read bls entry as utf8")?;
+        let content = match String::from_utf8(content) {
            Ok(content) => content,
            Err(error) => {
                warn!("unable to read bls entry {} as utf8: {}", name, error);
                continue;
            }
        };
        // Parse the entry file as a BLS entry.
-        let entry = BlsEntry::from_str(&content).context("unable to parse bls entry")?;
+        let entry = match BlsEntry::from_str(&content) {
            Ok(entry) => entry,
            Err(error) => {
                warn!("unable to parse bls entry {}: {}", name, error);
                continue;
            }
        };
        // Ignore entries that are not valid for Sprout.
        if !entry.is_valid() {
@@ -206,6 +187,16 @@ pub fn generate(context: Rc<SproutContext>, bls: &BlsConfiguration) -> Result<Ve
    // Sort all the entries according to the BLS sort system.
    entries.sort_by(sort_entries);
    // Grab the number of entries that we have, so we can calculate a reverse index.
    let entry_count = entries.len();
    // Set the sort keys of all the bootable entries to a semi-unique prefix + the BLS sort order.
    // The final comparison happens using version comparison, so this will sort
    // things properly.
    for (idx, (_bls, boot)) in entries.iter_mut().enumerate() {
        boot.set_sort_key(format!("bls-{}-{}", path, entry_count - idx - 1));
    }
    // Collect all the bootable entries and return them.
    Ok(entries.into_iter().map(|(_, boot)| boot).collect())
 }
@@ -22,11 +22,10 @@ pub fn generate(
        // Stamp the entry title and actions from the template.
        let mut entry = list.entry.clone();
-        entry.actions = entry
+
-            .actions
+        // Stamp all the actions this entry references.
-            .into_iter()
+        entry.actions = context.stamp_iter(entry.actions.into_iter()).collect();
-            .map(|action| context.stamp(action))
+
            .collect();
        // Push the entry into the list with the new context.
        entries.push(BootableEntry::new(
            index.to_string(),
@@ -0,0 +1,26 @@
 use crate::context::SproutContext;
 use crate::entries::BootableEntry;
 use crate::generators::list;
 use alloc::rc::Rc;
 use alloc::vec::Vec;
 use anyhow::Result;
 use edera_sprout_config::generators::list::ListConfiguration;
 use edera_sprout_config::generators::matrix::MatrixConfiguration;
 use edera_sprout_parsing::build_matrix;
 /// Generates a set of entries using the specified `matrix` configuration in the `context`.
 pub fn generate(
    context: Rc<SproutContext>,
    matrix: &MatrixConfiguration,
 ) -> Result<Vec<BootableEntry>> {
    // Produce all the combinations of the input values.
    let combinations = build_matrix(&matrix.values);
    // Use the list generator to generate entries for each combination.
    list::generate(
        context,
        &ListConfiguration {
            entry: matrix.entry.clone(),
            values: combinations,
        },
    )
 }
@@ -1,30 +1,28 @@
 #![doc = include_str!("../README.md")]
 #![no_std]
 #![no_main]
 extern crate alloc;
-use crate::context::{RootContext, SproutContext};
+use crate::{
-use crate::entries::BootableEntry;
+    context::{RootContext, SproutContext},
-use crate::integrations::bootloader_interface::{BootloaderInterface, BootloaderInterfaceTimeout};
+    entries::BootableEntry,
-use crate::options::SproutOptions;
+    options::SproutOptions,
-use crate::options::parser::OptionsRepresentable;
+    phases::phase,
-use crate::phases::phase;
+};
-use crate::platform::timer::PlatformTimer;
+use alloc::{collections::BTreeMap, format, string::ToString, vec::Vec};
 use crate::platform::tpm::PlatformTpm;
 use crate::secure::SecureBoot;
 use crate::utils::PartitionGuidForm;
 use alloc::collections::BTreeMap;
 use alloc::format;
 use alloc::string::ToString;
 use alloc::vec::Vec;
 use anyhow::{Context, Result, bail};
-use core::ops::Deref;
+use core::{ops::Deref, time::Duration};
-use core::time::Duration;
+use edera_sprout_bls::compare_versions;
 use edera_sprout_config::RootConfiguration;
 use eficore::{
    bootloader_interface::{BootloaderInterface, BootloaderInterfaceTimeout},
    partition::PartitionGuidForm,
    platform::{timer::PlatformTimer, tpm::PlatformTpm},
    secure::SecureBoot,
    setup,
 };
 use log::{error, info, warn};
-use uefi::entry;
+use uefi::{entry, proto::device_path::LoadedImageDevicePath};
 use uefi::proto::device_path::LoadedImageDevicePath;
 use uefi_raw::Status;
 /// actions: Code that can be configured and executed by Sprout.
@@ -51,14 +49,11 @@ pub mod extractors;
 /// generators: Runtime code that can generate entries with specific values.
 pub mod generators;
 /// platform: Integration or support code for specific hardware platforms.
 pub mod platform;
 /// menu: Display a boot menu to select an entry to boot.
 pub mod menu;
-/// integrations: Code that interacts with other systems.
+/// options: Parse the options of the Sprout executable.
-pub mod integrations;
+pub mod options;
 /// phases: Hooks into specific parts of the boot process.
 pub mod phases;
@@ -66,18 +61,6 @@ pub mod phases;
 /// sbat: Secure Boot Attestation section.
 pub mod sbat;
 /// secure: Secure Boot support.
 pub mod secure;
 /// setup: Code that initializes the UEFI environment for Sprout.
 pub mod setup;
 /// options: Parse the options of the Sprout executable.
 pub mod options;
 /// utils: Utility functions that are used by other parts of Sprout.
 pub mod utils;
 /// The delay to wait for when an error occurs in Sprout.
 const DELAY_ON_ERROR: Duration = Duration::from_secs(10);
@@ -85,7 +68,7 @@ const DELAY_ON_ERROR: Duration = Duration::from_secs(10);
 fn run() -> Result<()> {
    // For safety reasons, we will note that Secure Boot is in beta on Sprout.
    if SecureBoot::enabled().context("unable to determine Secure Boot status")? {
-        warn!("Secure Boot is enabled. Sprout Secure Boot is in beta.");
+        warn!("Sprout Secure Boot is in beta. Some functionality may not work as expected.");
    }
    // Start the platform timer.
@@ -136,7 +119,7 @@ fn run() -> Result<()> {
    // Grab the partition GUID of the ESP that sprout was loaded from.
    let loaded_image_partition_guid =
-        utils::partition_guid(&loaded_image_path, PartitionGuidForm::Partition)
+        eficore::partition::partition_guid(&loaded_image_path, PartitionGuidForm::Partition)
            .context("unable to retrieve loaded image partition guid")?;
    // Set the partition GUID of the ESP that sprout was loaded from in the bootloader interface.
@@ -270,13 +253,14 @@ fn run() -> Result<()> {
        }
    }
    // Sort the entries by their sort key, finalizing the order to show entries. This happens
    // in reverse order so that entries that would come last show up first in the menu.
    entries.sort_by(|a, b| compare_versions(a.sort_key(), b.sort_key()).reverse());
    // Tell the bootloader interface what entries are available.
    BootloaderInterface::set_entries(entries.iter().map(|entry| entry.name()))
        .context("unable to set entries in bootloader interface")?;
    // Execute the late phase.
    phase(context.clone(), &config.phases.late).context("unable to execute late phase")?;
    // Acquire the timeout setting from the bootloader interface.
    let bootloader_interface_timeout =
        BootloaderInterface::get_timeout().context("unable to get bootloader interface timeout")?;
@@ -368,6 +352,9 @@ fn run() -> Result<()> {
    BootloaderInterface::set_selected_entry(entry.name().to_string())
        .context("unable to set selected entry in bootloader interface")?;
    // Execute the late phase, now that the entry is chosen but before its actions are executed.
    phase(context.clone(), &config.phases.late).context("unable to execute late phase")?;
    // Execute all the actions for the selected entry.
    for action in &entry.declaration().actions {
        let action = entry.context().stamp(action);
@@ -385,6 +372,9 @@ fn run() -> Result<()> {
 fn efi_main() -> Status {
    // Initialize the basic UEFI environment.
    // If initialization fails, we will return ABORTED.
    // NOTE: This function will also initialize the logger.
    // The logger will panic if it is unable to initialize.
    // It is guaranteed that if this returns, the logger is initialized.
    if let Err(error) = setup::init() {
        error!("unable to initialize environment: {}", error);
        return Status::ABORTED;
@@ -394,7 +384,7 @@ fn efi_main() -> Status {
    let result = run();
    if let Err(ref error) = result {
        // Print an error trace.
-        error!("sprout encountered an error");
+        error!("sprout encountered an error: {}", error);
        for (index, stack) in error.chain().enumerate() {
            error!("[{}]: {}", index, stack);
        }
@@ -1,9 +1,9 @@
 use crate::entries::BootableEntry;
 use crate::integrations::bootloader_interface::BootloaderInterface;
 use crate::platform::timer::PlatformTimer;
 use alloc::vec;
-use anyhow::{Context, Result, bail};
+use anyhow::{Context, Result};
 use core::time::Duration;
 use eficore::bootloader_interface::BootloaderInterface;
 use eficore::platform::timer::PlatformTimer;
 use log::{info, warn};
 use uefi::ResultExt;
 use uefi::boot::TimerTrigger;
@@ -44,28 +44,21 @@ fn read(input: &mut Input, timeout: &Duration) -> Result<MenuOperation> {
            .context("unable to create timer event")?
    };
    // The timeout is in increments of 100 nanoseconds.
    let timeout_hundred_nanos = timeout.as_nanos() / 100;
    // Check if the timeout is too large to fit into an u64.
    if timeout_hundred_nanos > u64::MAX as u128 {
        bail!("timeout duration overflow");
    }
    // Set a timer to trigger after the specified duration.
-    let trigger = TimerTrigger::Relative(timeout_hundred_nanos as u64);
+    let trigger = TimerTrigger::Relative(*timeout);
    uefi::boot::set_timer(&timer_event, trigger).context("unable to set timeout timer")?;
-    let mut events = vec![timer_event, key_event];
+    let events = vec![timer_event, key_event];
    // Wait for either the timer event or the key event to trigger.
    // Store the result so that we can free the timer event.
-    let event_result = uefi::boot::wait_for_event(&mut events)
+    let event_result = uefi::boot::wait_for_event(&events)
        .discard_errdata()
        .context("unable to wait for event");
    // Close the timer event that we acquired.
    // We don't need to close the key event because it is owned globally.
    // This should always be called in practice as events are not modified by wait_for_event.
    if let Some(timer_event) = events.into_iter().next() {
        // Store the result of the close event so we can determine if we can safely assert it.
        let close_event_result =
@@ -93,8 +86,10 @@ fn read(input: &mut Input, timeout: &Duration) -> Result<MenuOperation> {
    }
    // If we reach here, there is a key event.
    // Some firmware signals the key event without a key being available,
    // in which case there is nothing to do.
    let Some(key) = input.read_key().context("unable to read key")? else {
-        bail!("no key was pressed");
+        return Ok(MenuOperation::Nop);
    };
    match key {
@@ -0,0 +1,146 @@
 use alloc::string::{String, ToString};
 use anyhow::{Context, Result, anyhow};
 use core::ptr::null_mut;
 use jaarg::{
    ErrorUsageWriter, ErrorUsageWriterContext, HelpWriter, HelpWriterContext, Opt, Opts,
    ParseControl, ParseResult, StandardErrorUsageWriter, StandardFullHelpWriter,
 };
 use log::{error, info};
 use uefi_raw::Status;
 /// Default configuration file path.
 const DEFAULT_CONFIG_PATH: &str = "\\sprout.toml";
 /// The parsed options of sprout.
 #[derive(Debug)]
 pub struct SproutOptions {
    /// Configures Sprout automatically based on the environment.
    pub autoconfigure: bool,
    /// Path to a configuration file to load.
    pub config: String,
    /// Entry to boot without showing the boot menu.
    pub boot: Option<String>,
    /// Force display of the boot menu.
    pub force_menu: bool,
    /// The timeout for the boot menu in seconds.
    pub menu_timeout: Option<u64>,
    /// Retains the boot console before boot.
    pub retain_boot_console: bool,
 }
 /// The default Sprout options.
 impl Default for SproutOptions {
    fn default() -> Self {
        Self {
            autoconfigure: false,
            config: DEFAULT_CONFIG_PATH.to_string(),
            boot: None,
            force_menu: false,
            menu_timeout: None,
            retain_boot_console: false,
        }
    }
 }
 /// The options parser mechanism for Sprout.
 impl SproutOptions {
    /// Produces [SproutOptions] from the arguments provided by the UEFI core.
    /// Internally, we use the `jaarg` argument parser which has excellent no_std support.
    pub fn parse() -> Result<Self> {
        enum ArgID {
            Help,
            AutoConfigure,
            Config,
            Boot,
            ForceMenu,
            MenuTimeout,
            RetainBootConsole,
        }
        // All the options for the Sprout executable.
        const OPTIONS: Opts<ArgID> = Opts::new(&[
            Opt::help_flag(ArgID::Help, &["--help"]).help_text("Display Sprout Help"),
            Opt::flag(ArgID::AutoConfigure, &["--autoconfigure"])
                .help_text("Enable Sprout autoconfiguration"),
            Opt::value(ArgID::Config, &["--config"], "PATH")
                .help_text("Path to Sprout configuration file"),
            Opt::value(ArgID::Boot, &["--boot"], "ENTRY")
                .help_text("Entry to boot, bypassing the menu"),
            Opt::flag(ArgID::ForceMenu, &["--force-menu"]).help_text("Force showing the boot menu"),
            Opt::value(ArgID::MenuTimeout, &["--menu-timeout"], "TIMEOUT")
                .help_text("Boot menu timeout, in seconds"),
            Opt::flag(ArgID::RetainBootConsole, &["--retain-boot-console"])
                .help_text("Retain boot console before boot"),
        ]);
        // Acquire the arguments as determined by the UEFI core.
        let args = eficore::env::args()?;
        // Use the default value of sprout options and have the raw options be parsed into it.
        let mut result = Self::default();
        // Parse the OPTIONS into a map using jaarg.
        match OPTIONS.parse(
            "sprout",
            args.iter(),
            |program_name, id, _opt, _name, value| {
                match id {
                    ArgID::AutoConfigure => {
                        // Enable autoconfiguration.
                        result.autoconfigure = true;
                    }
                    ArgID::Config => {
                        // The configuration file to load.
                        result.config = value.into();
                    }
                    ArgID::Boot => {
                        // The entry to boot.
                        result.boot = Some(value.into());
                    }
                    ArgID::ForceMenu => {
                        // Force showing of the boot menu.
                        result.force_menu = true;
                    }
                    ArgID::MenuTimeout => {
                        // The timeout for the boot menu in seconds.
                        result.menu_timeout = Some(value.parse::<u64>()?);
                    }
                    ArgID::RetainBootConsole => {
                        // Retain the boot console before booting.
                        result.retain_boot_console = true;
                    }
                    ArgID::Help => {
                        let ctx = HelpWriterContext {
                            options: &OPTIONS,
                            program_name,
                        };
                        info!("{}", StandardFullHelpWriter::new(ctx));
                        return Ok(ParseControl::Quit);
                    }
                }
                Ok(ParseControl::Continue)
            },
            |program_name, error| {
                let ctx = ErrorUsageWriterContext {
                    options: &OPTIONS,
                    program_name,
                    error,
                };
                error!("{}", StandardErrorUsageWriter::new(ctx));
            },
        ) {
            ParseResult::ContinueSuccess => Ok(result),
            ParseResult::ExitSuccess => unsafe {
                uefi::boot::exit(uefi::boot::image_handle(), Status::SUCCESS, 0, null_mut())
                    .context("unable to exit")?;
                Err(anyhow!("unable to exit"))
            },
            ParseResult::ExitError => unsafe {
                uefi::boot::exit(uefi::boot::image_handle(), Status::ABORTED, 0, null_mut())
                    .context("unable to exit")?;
                Err(anyhow!("unable to exit"))
            },
        }
    }
 }
@@ -6,7 +6,7 @@ use anyhow::{Context, Result};
 use edera_sprout_config::phases::PhaseConfiguration;
 /// Executes the specified [phase] of the boot process.
-/// The value [phase] should be a reference of a specific phase in the [PhasesConfiguration].
+/// The value [phase] should be a reference of a specific phase in the `PhasesConfiguration`.
 /// Any error from the actions is propagated into the [Result] and will interrupt further
 /// execution of phase actions.
 pub fn phase(context: Rc<SproutContext>, phase: &[PhaseConfiguration]) -> Result<()> {
@@ -24,3 +24,18 @@ pub fn phase(context: Rc<SproutContext>, phase: &[PhaseConfiguration]) -> Result
    }
    Ok(())
 }
 /// Manual hook called by code in the bootloader that hands off to another image.
 /// This is used to perform actions like clearing the screen.
 pub fn before_handoff(context: &SproutContext) -> Result<()> {
    // If we have not been asked to retain the boot console, then we should clear the screen.
    if !context.root().options().retain_boot_console {
        // Clear the screen. We use clear here instead of reset because some firmware,
        // particularly Dell firmware, does not clear the screen on reset.
        // We clear both stdout and stderr because it's not guaranteed that they are the same
        // text output.
        uefi::system::with_stdout(|stdout| stdout.clear()).context("unable to clear screen")?;
        uefi::system::with_stderr(|stderr| stderr.clear()).context("unable to clear screen")?;
    }
    Ok(())
 }