sprout: version 0.0.29 (#99 )

fix(autoconfigure): skip filesystems that can't be opened
If the device path or filesystem protocol of any detected filesystem could not be opened, autoconfiguration failed entirely and boot was aborted. Log a warning and skip that filesystem instead, so the other filesystems are still autoconfigured.
2026-11-04 19:52:22 +00:00 · 2026-09-26 19:07:20 -07:00 · 2026-09-26 18:58:54 -07:00 · 2026-09-26 18:58:54 -07:00 · 2026-09-26 18:58:54 -07:00 · 2026-09-26 18:58:54 -07:00
69 changed files with 2193 additions and 1198 deletions
@@ -25,17 +25,17 @@ jobs:
      actions: read # Needed to analyze action metadata.
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

    - name: setup uv
-      uses: astral-sh/setup-uv@2ddd2b9cb38ad8efd50337e8ab201519a34c9f24 # v7.1.1
+      uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0

    - name: zizmor
      run: uvx zizmor --pedantic --format sarif . > results.sarif
@@ -43,7 +43,7 @@ jobs:
        GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

    - name: upload
-      uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
+      uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
      with:
        sarif_file: results.sarif
        category: zizmor
@@ -21,12 +21,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

@@ -51,12 +51,12 @@ jobs:
    name: 'build ${{ matrix.arch }}'
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

@@ -80,12 +80,12 @@ jobs:
    name: 'clippy ${{ matrix.arch }}'
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

@@ -37,23 +37,23 @@ jobs:
          build-mode: none
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

    - name: initialize codeql
-      uses: github/codeql-action/init@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
+      uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
      with:
        languages: ${{ matrix.language }}
        build-mode: ${{ matrix.build-mode }}
        config-file: ./.github/codeql/codeql-config.yaml

    - name: perform codeql analysis
-      uses: github/codeql-action/analyze@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
+      uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
      with:
        category: "/language:${{matrix.language}}"
@@ -25,12 +25,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

@@ -43,13 +43,14 @@ jobs:

    - name: 'upload artifacts'
      id: upload
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: artifacts
        path: target/assemble/*

    - name: 'attest artifacts'
-      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+      uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
      with:
        subject-name: artifacts.zip
        subject-digest: "sha256:${{ steps.upload.outputs.artifact-digest }}"
+      if: github.event_name != 'pull_request'
@@ -25,12 +25,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

@@ -42,16 +42,19 @@ jobs:
      run: ./hack/assemble.sh

    - name: 'attest release artifacts'
-      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+      uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
      with:
        subject-path: target/assemble/*

    - name: 'generate cultivator token'
-      uses: actions/create-github-app-token@bf559f85448f9380bcfa2899dbdc01eb5b37be3a # v3.0.0-beta.2
+      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.0.0-beta.2
      id: generate-token
      with:
        app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
        private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
+        # Scope to what uploading assets and `gh release edit` need: write to
+        # release contents.
+        permission-contents: write
      if: ${{ github.event.inputs.release-tag != '' }}

    - name: 'upload release artifacts'
@@ -4,9 +4,9 @@ version = 4

 [[package]]
 name = "anyhow"
-version = "1.0.100"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"

 [[package]]
 name = "bit_field"
@@ -16,63 +16,72 @@ checksum = "1e4b40c7323adcfc0a41c4b88143ed58346ff65a288fc144329c5c45e05d70c6"

 [[package]]
 name = "bitflags"
-version = "2.10.0"
+version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"

 [[package]]
 name = "block-buffer"
-version = "0.10.4"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
 dependencies = [
- "generic-array",
+ "hybrid-array",
 ]

 [[package]]
 name = "cfg-if"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"

 [[package]]
 name = "cpufeatures"
-version = "0.2.17"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
 dependencies = [
 "libc",
 ]

 [[package]]
 name = "crypto-common"
-version = "0.1.6"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
- "generic-array",
- "typenum",
+ "hybrid-array",
 ]

 [[package]]
 name = "digest"
-version = "0.10.7"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
 "block-buffer",
 "crypto-common",
 ]

 [[package]]
-name = "edera-sprout-boot"
-version = "0.0.24"
+name = "edera-sprout-bls"
+version = "0.0.29"
 dependencies = [
 "anyhow",
+]
+
+[[package]]
+name = "edera-sprout-boot"
+version = "0.0.29"
+dependencies = [
+ "anyhow",
+ "edera-sprout-bls",
 "edera-sprout-build",
 "edera-sprout-config",
 "edera-sprout-eficore",
+ "edera-sprout-parsing",
 "hex",
+ "jaarg",
 "log",
 "sha2",
 "toml",
@@ -82,18 +91,18 @@ dependencies = [

 [[package]]
 name = "edera-sprout-build"
-version = "0.0.24"
+version = "0.0.29"

 [[package]]
 name = "edera-sprout-config"
-version = "0.0.24"
+version = "0.0.29"
 dependencies = [
 "serde",
 ]

 [[package]]
 name = "edera-sprout-eficore"
-version = "0.0.24"
+version = "0.0.29"
 dependencies = [
 "anyhow",
 "bitflags",
@@ -105,13 +114,11 @@ dependencies = [
 ]

 [[package]]
-name = "generic-array"
-version = "0.14.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bb6743198531e02858aeaea5398fcc883e71851fcbcb5a2f773e2fb6cb1edf2"
+name = "edera-sprout-parsing"
+version = "0.0.29"
 dependencies = [
- "typenum",
- "version_check",
+ "hex",
+ "sha2",
 ]

 [[package]]
@@ -121,10 +128,25 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"

 [[package]]
-name = "libc"
-version = "0.2.177"
+name = "hybrid-array"
+version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
+checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
+dependencies = [
+ "typenum",
+]
+
+[[package]]
+name = "jaarg"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "534d589df1ef528a238f4bc4b1db081a1280f3aedf2695fd8971e9853a7fa4f6"
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"

 [[package]]
 name = "lock_api"
@@ -137,33 +159,33 @@ dependencies = [

 [[package]]
 name = "log"
-version = "0.4.28"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"

 [[package]]
 name = "proc-macro2"
-version = "1.0.103"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
 dependencies = [
 "unicode-ident",
 ]

 [[package]]
 name = "ptr_meta"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b9a0cf95a1196af61d4f1cbdab967179516d9a4a4312af1f31948f8f6224a79"
+checksum = "743da816b98c921cdbe8628ef7381b76f25ecf4da599fc80aca90eae7ef70cc0"
 dependencies = [
 "ptr_meta_derive",
 ]

 [[package]]
 name = "ptr_meta_derive"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7347867d0a7e1208d93b46767be83e2b8f978c3dad35f775ac8d8847551d6fe1"
+checksum = "1c8d9ca532f185d5d4db7a7c9d51420b452168ea1c2b913953281bd6fe1fcbd0"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -172,9 +194,9 @@ dependencies = [

 [[package]]
 name = "quote"
-version = "1.0.41"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce25767e7b499d1b604768e7cde645d14cc8584231ea6b295e9c9eb22c02e1d1"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
 dependencies = [
 "proc-macro2",
 ]
@@ -187,9 +209,9 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"

 [[package]]
 name = "serde"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
 dependencies = [
 "serde_core",
 "serde_derive",
@@ -197,18 +219,18 @@ dependencies = [

 [[package]]
 name = "serde_core"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -217,18 +239,18 @@ dependencies = [

 [[package]]
 name = "serde_spanned"
-version = "1.0.3"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e24345aa0fe688594e73770a5f6d1b216508b4f93484c0026d521acd30134392"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
 dependencies = [
 "serde_core",
 ]

 [[package]]
 name = "sha2"
-version = "0.10.9"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
 dependencies = [
 "cfg-if",
 "cpufeatures",
@@ -237,24 +259,24 @@ dependencies = [

 [[package]]
 name = "shlex"
-version = "1.3.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"

 [[package]]
 name = "spin"
-version = "0.10.0"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5fe4ccb98d9c292d56fec89a5e07da7fc4cf0dc11e156b41793132775d3e591"
+checksum = "0134f9043ed38b087ac4f7d4af44c79e2c9e5094421fe3164f435ce585953b10"
 dependencies = [
 "lock_api",
 ]

 [[package]]
 name = "syn"
-version = "2.0.108"
+version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da58917d35242480a05c2897064da0a80589a2a0476c9a3f2fdc83b53502e917"
+checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -263,9 +285,9 @@ dependencies = [

 [[package]]
 name = "toml"
-version = "0.9.8"
+version = "1.1.6+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0dc8b1fb61449e27716ec0e1bdf0f6b8f3e8f6b05391e8497b8b6d7804ea6d8"
+checksum = "920602543f0911ab71da12c50d59701da54c196d1a2bf5cb4b75667f137a406a"
 dependencies = [
 "serde_core",
 "serde_spanned",
@@ -276,27 +298,27 @@ dependencies = [

 [[package]]
 name = "toml_datetime"
-version = "0.7.3"
+version = "1.1.1+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2cdb639ebbc97961c51720f858597f7f24c4fc295327923af55b74c3c724533"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
 dependencies = [
 "serde_core",
 ]

 [[package]]
 name = "toml_parser"
-version = "1.0.4"
+version = "1.1.3+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0cbe268d35bdb4bb5a56a2de88d0ad0eb70af5384a99d648cd4b3d04039800e"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
 dependencies = [
 "winnow",
 ]

 [[package]]
 name = "typenum"
-version = "1.19.0"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"

 [[package]]
 name = "ucs2"
@@ -309,9 +331,9 @@ dependencies = [

 [[package]]
 name = "uefi"
-version = "0.36.1"
+version = "0.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71fe9058b73ee2b6559524af9e33199c13b2485ddbf3ad1181b68051cdc50c17"
+checksum = "368cef7d94514897e6dad4350945c7910a9f5bf9021191d1c58ee3ec09962697"
 dependencies = [
 "bitflags",
 "cfg-if",
@@ -325,9 +347,9 @@ dependencies = [

 [[package]]
 name = "uefi-macros"
-version = "0.19.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4687412b5ac74d245d5bfb1733ede50c31be19bf8a4b6a967a29b451bab49e67"
+checksum = "643efa8b64be89780bc498b290fab04337c7c4d171cc82cce2e133a74616dcc4"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -336,9 +358,9 @@ dependencies = [

 [[package]]
 name = "uefi-raw"
-version = "0.13.0"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f64fe59e11af447d12fd60a403c74106eb104309f34b4c6dbce6e927d97da9d"
+checksum = "3636327a6d88a38c0f2567fb695ec7ba27b3483d1877730486605aa0866da201"
 dependencies = [
 "bitflags",
 "uguid",
@@ -352,18 +374,12 @@ checksum = "0c8352f8c05e47892e7eaf13b34abd76a7f4aeaf817b716e88789381927f199c"

 [[package]]
 name = "unicode-ident"
-version = "1.0.22"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
-
-[[package]]
-name = "version_check"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"

 [[package]]
 name = "winnow"
-version = "0.7.13"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21a0236b59786fed61e2a80582dd500fe61f18b5dca67a4a067d0bc9039339cf"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
@@ -4,24 +4,26 @@ members = [
  "crates/build",
  "crates/config",
  "crates/eficore",
+  "crates/bls",
+  "crates/parsing",
 ]
 resolver = "3"

 [workspace.package]
 license = "Apache-2.0"
-version = "0.0.24"
+version = "0.0.29"
 homepage = "https://sprout.edera.dev"
 repository = "https://github.com/edera-dev/sprout"
 edition = "2024"

 [workspace.dependencies]
-bitflags = "2.10.0"
-log = "0.4.28"
-spin = "0.10.0"
-uefi-raw = "0.13.0"
+bitflags = "2.13.2"
+log = "0.4.34"
+spin = "0.12.3"
+uefi-raw = "0.17.0"

 [workspace.dependencies.anyhow]
-version = "1.0.100"
+version = "1.0.104"
 default-features = false

 [workspace.dependencies.hex]
@@ -29,26 +31,31 @@ version = "0.4.3"
 default-features = false
 features = ["alloc"]

+[workspace.dependencies.jaarg]
+version = "0.2.2"
+default-features = false
+features = ["alloc"]
+
 [workspace.dependencies.serde]
-version = "1.0.228"
+version = "1.0.229"
 default-features = false
 features = ["alloc", "derive"]

 [workspace.dependencies.sha2]
-version = "0.10.9"
+version = "0.11.0"
 default-features = false

 [workspace.dependencies.shlex]
-version = "1.3.0"
+version = "2.0.1"
 default-features = false

 [workspace.dependencies.toml]
-version = "0.9.8"
+version = "1.1.6"
 default-features = false
 features = ["serde", "parse"]

 [workspace.dependencies.uefi]
-version = "0.36.1"
+version = "0.41.0"
 default-features = false
 features = ["alloc", "global_allocator", "panic_handler"]

@@ -1,8 +1,7 @@
-# syntax=docker/dockerfile:1.7-labs
 ARG RUST_PROFILE=release
 ARG RUST_TARGET_SUBDIR=release

-FROM --platform=$BUILDPLATFORM rust:1.91.0-alpine@sha256:a3e3d30122c08c0ed85dcd8867d956f066be23c32ed67a0453bc04ce478ad69b AS build
+FROM --platform=$BUILDPLATFORM rust:1.98.1-alpine@sha256:7cc1c22d77d9432f7fe012a70e6d3e555af54c2a6832700ed7d553f1769ae89f AS build
 RUN apk --no-cache add musl-dev busybox-static
 ARG RUST_PROFILE
 RUN adduser -S -s /bin/sh build
@@ -47,8 +47,9 @@ We recommend running Sprout without Secure Boot for development, and with Secure

 | Operating System | Secure Boot Enabled | Link                                                  |
 |------------------|---------------------|-------------------------------------------------------|
-| Ubuntu           | ✅                   | [Setup Guide](./docs/setup/signed/ubuntu.md)          |
+| Fedora           | ✅                   | [Setup Guide](./docs/setup/signed/fedora.md)          |
 | Debian           | ✅                   | [Setup Guide](./docs/setup/signed/debian.md)          |
+| Ubuntu           | ✅                   | [Setup Guide](./docs/setup/signed/ubuntu.md)          |
 | openSUSE         | ✅                   | [Setup Guide](./docs/setup/signed/opensuse.md)        |
 | Fedora           | ❌                   | [Setup Guide](./docs/setup/unsigned/fedora.md)        |
 | Alpine Edge      | ❌                   | [Setup Guide](./docs/setup/unsigned/alpine-edge.md)   |
@@ -0,0 +1,18 @@
+# This crate explicitly does not have uefi/uefi-raw dependencies,
+# so that the contents can be unit-testable on non-UEFI target hosts.
+# Do not add uefi or uefi-raw as dependencies.
+[package]
+name = "edera-sprout-bls"
+description = "Sprout BLS Utilities (UEFI-free)"
+license.workspace = true
+version.workspace = true
+homepage.workspace = true
+repository.workspace = true
+edition.workspace = true
+
+[dependencies]
+anyhow.workspace = true
+
+[lib]
+name = "edera_sprout_bls"
+path = "src/lib.rs"
@@ -0,0 +1,800 @@
+#![no_std]
+extern crate alloc;
+
+use alloc::string::{String, ToString};
+use anyhow::{Error, Result};
+use core::{cmp::Ordering, iter::Peekable, str::FromStr};
+
+/// Represents a parsed BLS entry.
+/// Fields unrelated to Sprout are not included.
+#[derive(Default, Debug, Clone)]
+pub struct BlsEntry {
+    /// The title of the entry.
+    pub title: Option<String>,
+    /// The options to pass to the entry.
+    pub options: Option<String>,
+    /// The path to the linux kernel.
+    pub linux: Option<String>,
+    /// The path to the initrd.
+    pub initrd: Option<String>,
+    /// The path to an EFI image.
+    pub efi: Option<String>,
+    /// The sort key for the entry.
+    pub sort_key: Option<String>,
+    /// The version of the entry.
+    pub version: Option<String>,
+    /// The machine id of the entry.
+    pub machine_id: Option<String>,
+}
+
+/// Parser for a BLS entry.
+impl FromStr for BlsEntry {
+    type Err = Error;
+
+    /// Parses the `input` as a BLS entry file.
+    fn from_str(input: &str) -> Result<Self> {
+        // All the fields in a BLS entry we understand.
+        // Set all to None initially.
+        let mut title: Option<String> = None;
+        let mut options: Option<String> = None;
+        let mut linux: Option<String> = None;
+        let mut initrd: Option<String> = None;
+        let mut efi: Option<String> = None;
+        let mut sort_key: Option<String> = None;
+        let mut version: Option<String> = None;
+        let mut machine_id: Option<String> = None;
+
+        // Iterate over each line in the input and parse it.
+        for line in input.lines() {
+            let line = line.trim();
+            // Skip over empty lines and comments.
+            if line.is_empty() || line.starts_with('#') {
+                continue;
+            }
+
+            // Split the line once by whitespace. This technically includes newlines but since
+            // the lines iterator is used, there should never be a newline here.
+            let Some((key, value)) = line.split_once(char::is_whitespace) else {
+                continue;
+            };
+
+            // Match the key to a field we understand.
+            match key {
+                // The title of the entry.
+                "title" => {
+                    title = Some(value.trim().to_string());
+                }
+
+                // The options to pass to the entry.
+                "options" => {
+                    options = Some(value.trim().to_string());
+                }
+
+                // The path to the linux kernel.
+                "linux" => {
+                    linux = Some(value.trim().to_string());
+                }
+
+                // The path to the initrd.
+                "initrd" => {
+                    initrd = Some(value.trim().to_string());
+                }
+
+                // The path to an EFI image.
+                "efi" => {
+                    efi = Some(value.trim().to_string());
+                }
+
+                "sort-key" => {
+                    sort_key = Some(value.trim().to_string());
+                }
+
+                "version" => {
+                    version = Some(value.trim().to_string());
+                }
+
+                "machine-id" => {
+                    machine_id = Some(value.trim().to_string());
+                }
+
+                // Ignore any other key.
+                _ => {
+                    continue;
+                }
+            }
+        }
+
+        // Produce a BLS entry from the parsed fields.
+        Ok(Self {
+            title,
+            options,
+            linux,
+            initrd,
+            efi,
+            sort_key,
+            version,
+            machine_id,
+        })
+    }
+}
+
+impl BlsEntry {
+    /// Checks if this BLS entry is something we can actually boot in Sprout.
+    pub fn is_valid(&self) -> bool {
+        self.linux.is_some() || self.efi.is_some()
+    }
+
+    /// Fetches the path to an EFI bootable image to boot, if any.
+    /// This prioritizes the linux field over efi.
+    /// It also converts / to \\ to match EFI path style.
+    pub fn chainload_path(&self) -> Option<String> {
+        self.linux
+            .clone()
+            .or(self.efi.clone())
+            .map(|path| path.replace('/', "\\").trim_start_matches('\\').to_string())
+    }
+
+    /// Fetches the path to an initrd to pass to the kernel, if any.
+    /// It also converts / to \\ to match EFI path style.
+    pub fn initrd_path(&self) -> Option<String> {
+        self.initrd
+            .clone()
+            .map(|path| path.replace('/', "\\").trim_start_matches('\\').to_string())
+    }
+
+    /// Fetches the options to pass to the kernel, if any.
+    pub fn options(&self) -> Option<String> {
+        self.options.clone()
+    }
+
+    /// Fetches the title of the entry, if any.
+    pub fn title(&self) -> Option<String> {
+        self.title.clone()
+    }
+
+    /// Fetches the sort key of the entry, if any.
+    pub fn sort_key(&self) -> Option<String> {
+        self.sort_key.clone()
+    }
+
+    /// Fetches the version of the entry, if any.
+    pub fn version(&self) -> Option<String> {
+        self.version.clone()
+    }
+
+    /// Fetches the machine id of the entry, if any.
+    pub fn machine_id(&self) -> Option<String> {
+        self.machine_id.clone()
+    }
+}
+
+/// Sorts two BLS entries according to the BLS sort system.
+/// `a_name` and `b_name` are the entry filenames (without `.conf`) used as the
+/// final tiebreaker when all other fields are equal.
+/// Reference: <https://uapi-group.org/specifications/specs/boot_loader_specification/#sorting>
+pub fn sort_bls(a_bls: &BlsEntry, a_name: &str, b_bls: &BlsEntry, b_name: &str) -> Ordering {
+    // Grab the sort keys from both entries.
+    let a_sort_key = a_bls.sort_key();
+    let b_sort_key = b_bls.sort_key();
+
+    // Sort keys, machine-id and version are only considered when both entries have a sort key.
+    // If only one entry has a sort key, that entry sorts first.
+    let ordering = match (a_sort_key, b_sort_key) {
+        (Some(a_sort_key), Some(b_sort_key)) => a_sort_key
+            .cmp(&b_sort_key)
+            // If the sort keys are equal, sort by machine-id.
+            .then_with(|| a_bls.machine_id().cmp(&b_bls.machine_id()))
+            // If the machine-id values are equal, sort by version, sorting newer versions first.
+            .then_with(|| {
+                compare_versions_optional(a_bls.version().as_deref(), b_bls.version().as_deref())
+                    .reverse()
+            }),
+        (Some(_), None) => Ordering::Less,
+        (None, Some(_)) => Ordering::Greater,
+        (None, None) => Ordering::Equal,
+    };
+
+    // If all else is equal, compare the file names of both entries, sorting newer entries first.
+    ordering.then_with(|| compare_versions(a_name, b_name).reverse())
+}
+
+/// Handles single character advancement and comparison.
+macro_rules! handle_single_char {
+    ($ca: expr, $cb:expr, $a_chars:expr, $b_chars:expr, $c:expr) => {
+        match ($ca == $c, $cb == $c) {
+            (true, false) => return Ordering::Less,
+            (false, true) => return Ordering::Greater,
+            (true, true) => {
+                $a_chars.next();
+                $b_chars.next();
+                continue;
+            }
+            _ => {}
+        }
+    };
+}
+
+/// Compares two strings using the BLS version comparison specification.
+/// Handles optional values as well by comparing only if both are specified.
+/// A missing value is considered older than any specified value.
+pub fn compare_versions_optional(a: Option<&str>, b: Option<&str>) -> Ordering {
+    match (a, b) {
+        // If both have values, compare them.
+        (Some(a), Some(b)) => compare_versions(a, b),
+        // If the second value is None, then `a` is greater than `b`.
+        (Some(_a), None) => Ordering::Greater,
+        // If the first value is None, the `a` is less than `b`.
+        (None, Some(_b)) => Ordering::Less,
+        // If both values are None, return that they are equal.
+        (None, None) => Ordering::Equal,
+    }
+}
+
+/// Compares two strings using the BLS version comparison specification.
+/// See: <https://uapi-group.org/specifications/specs/version_format_specification/>
+pub fn compare_versions(a: &str, b: &str) -> Ordering {
+    // An empty string is older than any other string.
+    if a.is_empty() || b.is_empty() {
+        return a.len().cmp(&b.len());
+    }
+
+    // Acquire a peekable iterator for each string.
+    let mut a_chars = a.chars().peekable();
+    let mut b_chars = b.chars().peekable();
+
+    // Loop until we have reached the end of one of the strings.
+    loop {
+        // Skip invalid characters in both strings.
+        skip_invalid(&mut a_chars);
+        skip_invalid(&mut b_chars);
+
+        // Handle the ~ character. This must happen before the end of string check,
+        // as a string with ~ is older than a string that has ended (1~rc1 < 1).
+        match (a_chars.peek() == Some(&'~'), b_chars.peek() == Some(&'~')) {
+            (true, false) => return Ordering::Less,
+            (false, true) => return Ordering::Greater,
+            (true, true) => {
+                a_chars.next();
+                b_chars.next();
+                continue;
+            }
+            (false, false) => {}
+        }
+
+        // Check if either string has ended.
+        match (a_chars.peek(), b_chars.peek()) {
+            // No more characters in either string.
+            (None, None) => return Ordering::Equal,
+            // One string has ended, the other hasn't.
+            (None, Some(_)) => return Ordering::Less,
+            (Some(_), None) => return Ordering::Greater,
+            // Both strings have characters left.
+            (Some(&ca), Some(&cb)) => {
+                // Handle '-' character.
+                handle_single_char!(ca, cb, a_chars, b_chars, '-');
+
+                // Handle the '^' character.
+                handle_single_char!(ca, cb, a_chars, b_chars, '^');
+
+                // Handle the '.' character.
+                handle_single_char!(ca, cb, a_chars, b_chars, '.');
+
+                // Handle digits with numerical comparison.
+                // If only one string has digits at this position, that string is newer.
+                if ca.is_ascii_digit() || cb.is_ascii_digit() {
+                    if !ca.is_ascii_digit() {
+                        return Ordering::Less;
+                    }
+                    if !cb.is_ascii_digit() {
+                        return Ordering::Greater;
+                    }
+                    let result = compare_numeric(&mut a_chars, &mut b_chars);
+                    if result != Ordering::Equal {
+                        return result;
+                    }
+                    continue;
+                }
+
+                // Handle letters with alphabetical comparison.
+                // We key off of the A character being alphabetical intentionally as we presume
+                // this indicates it will be the same at this position.
+                if ca.is_ascii_alphabetic() || cb.is_ascii_alphabetic() {
+                    let result = compare_alphabetic(&mut a_chars, &mut b_chars);
+                    if result != Ordering::Equal {
+                        return result;
+                    }
+                    continue;
+                }
+            }
+        }
+    }
+}
+
+/// Skips characters that are not in the valid character set.
+fn skip_invalid<I: Iterator<Item = char>>(iter: &mut Peekable<I>) {
+    while let Some(&c) = iter.peek() {
+        if is_valid_char(c) {
+            break;
+        }
+        iter.next();
+    }
+}
+
+/// Checks if a character is in the valid character set for comparison.
+fn is_valid_char(c: char) -> bool {
+    matches!(c, 'a'..='z' | 'A'..='Z' | '0'..='9' | '-' | '.' | '~' | '^')
+}
+
+/// Compares numerical prefixes by extracting numbers.
+/// Numbers are compared by their digit count first and then digit by digit,
+/// which supports numbers of any length.
+fn compare_numeric<I: Iterator<Item = char>>(
+    iter_a: &mut Peekable<I>,
+    iter_b: &mut Peekable<I>,
+) -> Ordering {
+    let num_a = extract_number(iter_a);
+    let num_b = extract_number(iter_b);
+
+    num_a
+        .len()
+        .cmp(&num_b.len())
+        .then_with(|| num_a.cmp(&num_b))
+}
+
+/// Extracts the digits of a number from the iterator, skipping leading zeros.
+fn extract_number<I: Iterator<Item = char>>(iter: &mut Peekable<I>) -> String {
+    // Skip leading zeros
+    while let Some(&'0') = iter.peek() {
+        iter.next();
+    }
+
+    let mut num = String::new();
+    while let Some(&c) = iter.peek() {
+        if c.is_ascii_digit() {
+            iter.next();
+            num.push(c);
+        } else {
+            break;
+        }
+    }
+
+    num
+}
+
+/// Compares alphabetical prefixes.
+/// Capital letters compare lower than lowercase letters (B < a).
+fn compare_alphabetic<I: Iterator<Item = char>>(
+    iter_a: &mut Peekable<I>,
+    iter_b: &mut Peekable<I>,
+) -> Ordering {
+    loop {
+        return match (iter_a.peek(), iter_b.peek()) {
+            (Some(&ca), Some(&cb)) if ca.is_ascii_alphabetic() && cb.is_ascii_alphabetic() => {
+                if ca == cb {
+                    // Same character, we should continue.
+                    iter_a.next();
+                    iter_b.next();
+                    continue;
+                }
+
+                // Different characters found.
+                // All capital letters compare lower than lowercase letters.
+                match (ca.is_ascii_uppercase(), cb.is_ascii_uppercase()) {
+                    (true, false) => Ordering::Less,    // uppercase < lowercase
+                    (false, true) => Ordering::Greater, // lowercase > uppercase
+                    (true, true) => ca.cmp(&cb),        // both are uppercase
+                    (false, false) => ca.cmp(&cb),      // both are lowercase
+                }
+            }
+
+            (Some(&ca), Some(_)) if ca.is_ascii_alphabetic() => {
+                // a has letters, b doesn't
+                Ordering::Greater
+            }
+
+            (Some(_), Some(&cb)) if cb.is_ascii_alphabetic() => {
+                // b has letters, a doesn't
+                Ordering::Less
+            }
+
+            (Some(&ca), None) if ca.is_ascii_alphabetic() => Ordering::Greater,
+
+            (None, Some(&cb)) if cb.is_ascii_alphabetic() => Ordering::Less,
+
+            _ => Ordering::Equal,
+        };
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use core::cmp::Ordering;
+
+    fn sort_entry(
+        sort_key: Option<&str>,
+        machine_id: Option<&str>,
+        version: Option<&str>,
+    ) -> BlsEntry {
+        BlsEntry {
+            sort_key: sort_key.map(|s| s.to_string()),
+            machine_id: machine_id.map(|s| s.to_string()),
+            version: version.map(|s| s.to_string()),
+            linux: Some("/vmlinuz".to_string()),
+            ..BlsEntry::default()
+        }
+    }
+
+    #[test]
+    fn parse_empty_input_gives_all_none() {
+        let entry: BlsEntry = "".parse().unwrap();
+        assert!(entry.title.is_none());
+        assert!(entry.linux.is_none());
+        assert!(entry.efi.is_none());
+        assert!(entry.initrd.is_none());
+        assert!(entry.options.is_none());
+        assert!(entry.sort_key.is_none());
+        assert!(entry.version.is_none());
+        assert!(entry.machine_id.is_none());
+    }
+
+    #[test]
+    fn parse_all_known_fields() {
+        let input = "\
+title      Fedora Linux 6.5.6
+version    6.5.6-300.fc39.x86_64
+machine-id abc123def456
+linux      /boot/vmlinuz-6.5.6
+initrd     /boot/initrd-6.5.6.img
+options    root=/dev/sda1 ro quiet
+sort-key   fedora
+efi        /EFI/fedora/shimx64.efi
+";
+        let entry: BlsEntry = input.parse().unwrap();
+        assert_eq!(entry.title.as_deref(), Some("Fedora Linux 6.5.6"));
+        assert_eq!(entry.version.as_deref(), Some("6.5.6-300.fc39.x86_64"));
+        assert_eq!(entry.machine_id.as_deref(), Some("abc123def456"));
+        assert_eq!(entry.linux.as_deref(), Some("/boot/vmlinuz-6.5.6"));
+        assert_eq!(entry.initrd.as_deref(), Some("/boot/initrd-6.5.6.img"));
+        assert_eq!(entry.options.as_deref(), Some("root=/dev/sda1 ro quiet"));
+        assert_eq!(entry.sort_key.as_deref(), Some("fedora"));
+        assert_eq!(entry.efi.as_deref(), Some("/EFI/fedora/shimx64.efi"));
+    }
+
+    #[test]
+    fn parse_skips_blank_lines() {
+        let input = "\n\ntitle   My Entry\n\n\nlinux /vmlinuz\n\n";
+        let entry: BlsEntry = input.parse().unwrap();
+        assert_eq!(entry.title.as_deref(), Some("My Entry"));
+        assert_eq!(entry.linux.as_deref(), Some("/vmlinuz"));
+    }
+
+    #[test]
+    fn parse_skips_comment_lines() {
+        let input = "# this is a comment\ntitle My Entry\n# another comment\nlinux /vmlinuz\n";
+        let entry: BlsEntry = input.parse().unwrap();
+        assert_eq!(entry.title.as_deref(), Some("My Entry"));
+        assert_eq!(entry.linux.as_deref(), Some("/vmlinuz"));
+    }
+
+    #[test]
+    fn parse_trims_leading_whitespace_from_value() {
+        let input = "title    Padded Title\nlinux    /boot/vmlinuz\n";
+        let entry: BlsEntry = input.parse().unwrap();
+        assert_eq!(entry.title.as_deref(), Some("Padded Title"));
+        assert_eq!(entry.linux.as_deref(), Some("/boot/vmlinuz"));
+    }
+
+    #[test]
+    fn parse_ignores_unknown_keys() {
+        let input = "title My Entry\nunknown-key some-value\nfuture-field value\nlinux /vmlinuz\n";
+        let entry: BlsEntry = input.parse().unwrap();
+        assert_eq!(entry.title.as_deref(), Some("My Entry"));
+        assert_eq!(entry.linux.as_deref(), Some("/vmlinuz"));
+    }
+
+    #[test]
+    fn parse_skips_lines_without_whitespace_separator() {
+        // A line with no whitespace cannot be split into key+value, so it is skipped
+        let input = "title My Entry\nnovalueline\nlinux /vmlinuz\n";
+        let entry: BlsEntry = input.parse().unwrap();
+        assert_eq!(entry.title.as_deref(), Some("My Entry"));
+        assert_eq!(entry.linux.as_deref(), Some("/vmlinuz"));
+    }
+
+    #[test]
+    fn is_valid_when_linux_present() {
+        let entry: BlsEntry = "linux /vmlinuz\n".parse().unwrap();
+        assert!(entry.is_valid());
+    }
+
+    #[test]
+    fn is_valid_when_efi_present() {
+        let entry: BlsEntry = "efi /EFI/boot/bootx64.efi\n".parse().unwrap();
+        assert!(entry.is_valid());
+    }
+
+    #[test]
+    fn not_valid_without_linux_or_efi() {
+        let entry: BlsEntry = "title Just a Title\noptions quiet\n".parse().unwrap();
+        assert!(!entry.is_valid());
+    }
+
+    #[test]
+    fn chainload_path_normalises_forward_slashes_to_backslashes() {
+        let entry: BlsEntry = "linux /boot/vmlinuz\n".parse().unwrap();
+        assert_eq!(entry.chainload_path().as_deref(), Some("boot\\vmlinuz"));
+    }
+
+    #[test]
+    fn chainload_path_strips_leading_backslash() {
+        let entry: BlsEntry = "linux \\EFI\\boot\\kernel\n".parse().unwrap();
+        assert_eq!(entry.chainload_path().as_deref(), Some("EFI\\boot\\kernel"));
+    }
+
+    #[test]
+    fn chainload_path_prefers_linux_over_efi() {
+        let input = "linux /boot/vmlinuz\nefi /EFI/boot/bootx64.efi\n";
+        let entry: BlsEntry = input.parse().unwrap();
+        assert_eq!(entry.chainload_path().as_deref(), Some("boot\\vmlinuz"));
+    }
+
+    #[test]
+    fn chainload_path_falls_back_to_efi_when_no_linux() {
+        let entry: BlsEntry = "efi /EFI/Microsoft/Boot/bootmgfw.efi\n".parse().unwrap();
+        assert_eq!(
+            entry.chainload_path().as_deref(),
+            Some("EFI\\Microsoft\\Boot\\bootmgfw.efi")
+        );
+    }
+
+    #[test]
+    fn chainload_path_none_when_neither_linux_nor_efi() {
+        let entry: BlsEntry = "title Only Title\n".parse().unwrap();
+        assert!(entry.chainload_path().is_none());
+    }
+
+    #[test]
+    fn initrd_path_normalises_slashes() {
+        let entry: BlsEntry = "linux /vmlinuz\ninitrd /boot/initrd.img\n".parse().unwrap();
+        assert_eq!(entry.initrd_path().as_deref(), Some("boot\\initrd.img"));
+    }
+
+    #[test]
+    fn initrd_path_none_when_not_set() {
+        let entry: BlsEntry = "linux /vmlinuz\n".parse().unwrap();
+        assert!(entry.initrd_path().is_none());
+    }
+
+    #[test]
+    fn sort_key_is_primary_criterion() {
+        let a = sort_entry(Some("alpine"), None, None);
+        let b = sort_entry(Some("fedora"), None, None);
+        assert_eq!(sort_bls(&a, "a", &b, "b"), Ordering::Less);
+        assert_eq!(sort_bls(&b, "b", &a, "a"), Ordering::Greater);
+    }
+
+    #[test]
+    fn machine_id_is_secondary_criterion() {
+        let a = sort_entry(Some("linux"), Some("aaa"), None);
+        let b = sort_entry(Some("linux"), Some("bbb"), None);
+        assert_eq!(sort_bls(&a, "a", &b, "b"), Ordering::Less);
+        assert_eq!(sort_bls(&b, "b", &a, "a"), Ordering::Greater);
+    }
+
+    #[test]
+    fn version_is_tertiary_criterion_newer_first() {
+        let a = sort_entry(Some("linux"), Some("abc"), Some("6.5.0"));
+        let b = sort_entry(Some("linux"), Some("abc"), Some("6.4.0"));
+        // newer version (a) sorts before older version (b), so a < b in sort order
+        assert_eq!(sort_bls(&a, "a", &b, "b"), Ordering::Less);
+        assert_eq!(sort_bls(&b, "b", &a, "a"), Ordering::Greater);
+    }
+
+    #[test]
+    fn name_is_final_tiebreaker_newer_first() {
+        let a = sort_entry(Some("linux"), Some("abc"), Some("6.5.0"));
+        let b = sort_entry(Some("linux"), Some("abc"), Some("6.5.0"));
+        // name comparison via compare_versions, reversed — higher name sorts first
+        assert_eq!(sort_bls(&a, "entry-2", &b, "entry-1"), Ordering::Less);
+        assert_eq!(sort_bls(&a, "entry-1", &b, "entry-2"), Ordering::Greater);
+    }
+
+    #[test]
+    fn identical_entries_are_equal() {
+        let a = sort_entry(Some("linux"), Some("abc"), Some("6.5.0"));
+        let b = sort_entry(Some("linux"), Some("abc"), Some("6.5.0"));
+        assert_eq!(sort_bls(&a, "entry-1", &b, "entry-1"), Ordering::Equal);
+    }
+
+    #[test]
+    fn equal_strings_are_equal() {
+        assert_eq!(compare_versions("1.0.0", "1.0.0"), Ordering::Equal);
+    }
+
+    #[test]
+    fn empty_strings_are_equal() {
+        assert_eq!(compare_versions("", ""), Ordering::Equal);
+    }
+
+    #[test]
+    fn simple_numeric_less() {
+        assert_eq!(compare_versions("1", "2"), Ordering::Less);
+    }
+
+    #[test]
+    fn simple_numeric_greater() {
+        assert_eq!(compare_versions("2", "1"), Ordering::Greater);
+    }
+
+    #[test]
+    fn numeric_is_not_lexicographic() {
+        // "10" > "9", not "10" < "9" as in lexicographic order
+        assert_eq!(compare_versions("10", "9"), Ordering::Greater);
+        assert_eq!(compare_versions("1.10", "1.9"), Ordering::Greater);
+    }
+
+    #[test]
+    fn leading_zeros_are_ignored() {
+        assert_eq!(compare_versions("01", "1"), Ordering::Equal);
+        assert_eq!(compare_versions("1.00", "1.0"), Ordering::Equal);
+        assert_eq!(compare_versions("007", "7"), Ordering::Equal);
+    }
+
+    #[test]
+    fn multi_component_comparison() {
+        assert_eq!(compare_versions("1.0.0", "1.0.1"), Ordering::Less);
+        assert_eq!(compare_versions("1.0.1", "1.0.0"), Ordering::Greater);
+        assert_eq!(compare_versions("2.0.0", "1.9.9"), Ordering::Greater);
+    }
+
+    #[test]
+    fn more_components_is_greater() {
+        assert_eq!(compare_versions("1.0.0", "1.0"), Ordering::Greater);
+        assert_eq!(compare_versions("1.0", "1.0.0"), Ordering::Less);
+        assert_eq!(compare_versions("1.0.0.0", "1.0.0"), Ordering::Greater);
+    }
+
+    #[test]
+    fn alphabetic_sections_compare_lexicographically() {
+        assert_eq!(compare_versions("1.0a", "1.0b"), Ordering::Less);
+        assert_eq!(compare_versions("1.0b", "1.0a"), Ordering::Greater);
+        assert_eq!(compare_versions("1.0abc", "1.0abd"), Ordering::Less);
+    }
+
+    #[test]
+    fn uppercase_letters_sort_below_lowercase() {
+        // Capital letters compare lower than lowercase (B < a)
+        assert_eq!(compare_versions("B", "a"), Ordering::Less);
+        assert_eq!(compare_versions("a", "B"), Ordering::Greater);
+        assert_eq!(compare_versions("Z", "a"), Ordering::Less);
+    }
+
+    #[test]
+    fn uppercase_letters_compare_among_themselves() {
+        assert_eq!(compare_versions("A", "B"), Ordering::Less);
+        assert_eq!(compare_versions("B", "A"), Ordering::Greater);
+        assert_eq!(compare_versions("A", "A"), Ordering::Equal);
+    }
+
+    #[test]
+    fn invalid_characters_are_skipped() {
+        // Characters not in [a-zA-Z0-9.-~^] are skipped before comparison
+        assert_eq!(compare_versions("##1.0", "1.0"), Ordering::Equal);
+        assert_eq!(compare_versions("1.0##", "1.0"), Ordering::Equal);
+    }
+
+    #[test]
+    fn tilde_between_two_present_tilde_strings() {
+        // When both have ~ at the same position, they are consumed and comparison continues
+        assert_eq!(compare_versions("1~alpha", "1~beta"), Ordering::Less);
+        assert_eq!(compare_versions("1~rc1", "1~rc2"), Ordering::Less);
+        assert_eq!(compare_versions("1~rc1", "1~rc1"), Ordering::Equal);
+    }
+
+    #[test]
+    fn tilde_when_only_one_side_has_it() {
+        // When a has ~ but b doesn't at the same position, a < b
+        assert_eq!(compare_versions("1~rc1", "1.0"), Ordering::Less);
+        // When b has ~ but a doesn't, a > b
+        assert_eq!(compare_versions("1.0", "1~rc1"), Ordering::Greater);
+    }
+
+    #[test]
+    fn tilde_is_older_than_end_of_string() {
+        // A pre-release is older than the release it precedes.
+        assert_eq!(compare_versions("1~rc1", "1"), Ordering::Less);
+        assert_eq!(compare_versions("1", "1~rc1"), Ordering::Greater);
+        assert_eq!(compare_versions("6.1~rc3", "6.1"), Ordering::Less);
+    }
+
+    #[test]
+    fn empty_string_is_oldest() {
+        assert_eq!(compare_versions("", "~1"), Ordering::Less);
+        assert_eq!(compare_versions("~1", ""), Ordering::Greater);
+        assert_eq!(compare_versions("", "1"), Ordering::Less);
+    }
+
+    #[test]
+    fn digits_are_newer_than_letters() {
+        assert_eq!(compare_versions("0", "a"), Ordering::Greater);
+        assert_eq!(compare_versions("a", "0"), Ordering::Less);
+        assert_eq!(compare_versions("1.0", "1.a"), Ordering::Greater);
+        assert_eq!(compare_versions("1.a", "1.0"), Ordering::Less);
+    }
+
+    #[test]
+    fn large_numbers_do_not_saturate() {
+        assert_eq!(
+            compare_versions("99999999999999999999", "99999999999999999998"),
+            Ordering::Greater
+        );
+        assert_eq!(
+            compare_versions("1.99999999999999999998", "1.99999999999999999999"),
+            Ordering::Less
+        );
+    }
+
+    #[test]
+    fn entry_with_sort_key_sorts_before_entry_without() {
+        let with_key = sort_entry(Some("fedora"), None, None);
+        let without_key = sort_entry(None, None, None);
+        assert_eq!(sort_bls(&with_key, "a", &without_key, "b"), Ordering::Less);
+        assert_eq!(
+            sort_bls(&without_key, "b", &with_key, "a"),
+            Ordering::Greater
+        );
+    }
+
+    #[test]
+    fn entries_without_sort_key_sort_by_name_only() {
+        // Without a sort key, machine-id and version are ignored.
+        let a = sort_entry(None, Some("aaa"), Some("1.0"));
+        let b = sort_entry(None, Some("bbb"), Some("2.0"));
+        assert_eq!(sort_bls(&a, "entry-2", &b, "entry-1"), Ordering::Less);
+        assert_eq!(sort_bls(&b, "entry-1", &a, "entry-2"), Ordering::Greater);
+    }
+
+    #[test]
+    fn entry_with_version_sorts_before_entry_without() {
+        let a = sort_entry(Some("linux"), Some("abc"), Some("6.5.0"));
+        let b = sort_entry(Some("linux"), Some("abc"), None);
+        assert_eq!(sort_bls(&a, "a", &b, "b"), Ordering::Less);
+        assert_eq!(sort_bls(&b, "b", &a, "a"), Ordering::Greater);
+    }
+
+    #[test]
+    fn optional_both_none_equal() {
+        assert_eq!(compare_versions_optional(None, None), Ordering::Equal);
+    }
+
+    #[test]
+    fn optional_some_vs_none_is_greater() {
+        // A missing version is older than any specified version.
+        assert_eq!(
+            compare_versions_optional(Some("1.0"), None),
+            Ordering::Greater
+        );
+    }
+
+    #[test]
+    fn optional_none_vs_some_is_less() {
+        assert_eq!(compare_versions_optional(None, Some("1.0")), Ordering::Less);
+    }
+
+    #[test]
+    fn optional_both_some_delegates_to_compare_versions() {
+        assert_eq!(
+            compare_versions_optional(Some("1.0"), Some("2.0")),
+            Ordering::Less
+        );
+        assert_eq!(
+            compare_versions_optional(Some("2.0"), Some("1.0")),
+            Ordering::Greater
+        );
+        assert_eq!(
+            compare_versions_optional(Some("1.0"), Some("1.0")),
+            Ordering::Equal
+        );
+    }
+}
@@ -11,7 +11,10 @@ edition.workspace = true
 anyhow.workspace = true
 edera-sprout-config.path = "../config"
 edera-sprout-eficore.path = "../eficore"
+edera-sprout-bls.path = "../bls"
+edera-sprout-parsing.path = "../parsing"
 hex.workspace = true
+jaarg.workspace = true
 sha2.workspace = true
 toml.workspace = true
 log.workspace = true
@@ -24,3 +27,4 @@ edera-sprout-build.path = "../build"
 [[bin]]
 name = "sprout"
 path = "src/main.rs"
+test = false
@@ -1,15 +1,15 @@
 use crate::context::SproutContext;
-use crate::utils;
+use crate::phases::before_handoff;
 use alloc::boxed::Box;
 use alloc::rc::Rc;
 use anyhow::{Context, Result, bail};
 use edera_sprout_config::actions::chainload::ChainloadConfiguration;
+use edera_sprout_parsing::{combine_options, empty_is_none};
 use eficore::bootloader_interface::BootloaderInterface;
 use eficore::loader::source::ImageSource;
 use eficore::loader::{ImageLoadRequest, ImageLoader};
 use eficore::media_loader::MediaLoaderHandle;
 use eficore::media_loader::constants::linux::LINUX_EFI_INITRD_MEDIA_GUID;
-use log::error;
 use uefi::CString16;
 use uefi::proto::loaded_image::LoadedImage;

@@ -21,7 +21,7 @@ pub fn chainload(context: Rc<SproutContext>, configuration: &ChainloadConfigurat
    // Resolve the path to the image to chainload.
    let resolved = eficore::path::resolve_path(
        Some(context.root().loaded_image_path()?),
-        &context.stamp(&configuration.path),
+        context.stamp(&configuration.path),
    )
    .context("unable to resolve chainload path")?;

@@ -32,14 +32,8 @@ pub fn chainload(context: Rc<SproutContext>, configuration: &ChainloadConfigurat
    // It will determine if the image needs to be loaded via the shim or can be loaded directly.
    let image = ImageLoader::load(request)?;

-    // Open the LoadedImage protocol of the image to chainload.
-    let mut loaded_image_protocol =
-        uefi::boot::open_protocol_exclusive::<LoadedImage>(*image.handle())
-            .context("unable to open loaded image protocol")?;
-
    // Stamp and combine the options to pass to the image.
-    let options =
-        utils::combine_options(configuration.options.iter().map(|item| context.stamp(item)));
+    let options = combine_options(context.stamp_iter(configuration.options.iter()));

    // Pass the load options to the image.
    // If no options are provided, the resulting string will be empty.
@@ -50,16 +44,26 @@ pub fn chainload(context: Rc<SproutContext>, configuration: &ChainloadConfigurat
            .context("unable to convert chainloader options to CString16")?,
    );

+    // Ensure the chainloader options limit is not exceeded.
    if options.num_bytes() > u32::MAX as usize {
        bail!("chainloader options too large");
    }

-    // SAFETY: option size is checked to validate it is safe to pass.
-    // Additionally, the pointer is allocated and retained on heap, which makes
-    // passing the `options` pointer safe to the next image.
-    unsafe {
-        loaded_image_protocol
-            .set_load_options(options.as_ptr() as *const u8, options.num_bytes() as u32);
+    // Open the LoadedImage protocol of the image to chainload to pass the load options.
+    // This is done in a block to release the protocol before the image is started, as the
+    // image may itself need to open its LoadedImage protocol exclusively.
+    {
+        let mut loaded_image_protocol =
+            uefi::boot::open_protocol_exclusive::<LoadedImage>(*image.handle())
+                .context("unable to open loaded image protocol")?;
+
+        // SAFETY: option size is checked to validate it is safe to pass.
+        // Additionally, the pointer is allocated and retained on heap, which makes
+        // passing the `options` pointer safe to the next image.
+        unsafe {
+            loaded_image_protocol
+                .set_load_options(options.as_ptr() as *const u8, options.num_bytes() as u32);
+        }
    }

    // Stamp the initrd path, if provided.
@@ -68,45 +72,56 @@ pub fn chainload(context: Rc<SproutContext>, configuration: &ChainloadConfigurat
        .as_ref()
        .map(|item| context.stamp(item));
    // The initrd can be None or empty, so we need to collapse that into a single Option.
-    let initrd = utils::empty_is_none(initrd);
+    let initrd = empty_is_none(initrd);

    // If an initrd is provided, register it with the EFI stack.
    let mut initrd_handle = None;
    if let Some(linux_initrd) = initrd {
-        let content = eficore::path::read_file_contents(
-            Some(context.root().loaded_image_path()?),
-            &linux_initrd,
-        )
-        .context("unable to read linux initrd")?;
-        let handle =
-            MediaLoaderHandle::register(LINUX_EFI_INITRD_MEDIA_GUID, content.into_boxed_slice())
-                .context("unable to register linux initrd")?;
-        initrd_handle = Some(handle);
+        let resolved_initrd =
+            eficore::path::resolve_path(Some(context.root().loaded_image_path()?), &linux_initrd)
+                .context("unable to resolve linux initrd path")?;
+
+        // A path without a file component refers to the root of the filesystem, not an initrd.
+        // This happens when a path template like "$root\\$initrd" is stamped with an empty
+        // initrd value, such as a BLS entry without an initrd.
+        let initrd_subpath = eficore::path::device_path_subpath(&resolved_initrd.full_path)
+            .context("unable to get linux initrd subpath")?;
+        if !initrd_subpath.trim_matches('\\').is_empty() {
+            let content = resolved_initrd
+                .read_file()
+                .context("unable to read linux initrd")?;
+            let handle = MediaLoaderHandle::register(
+                LINUX_EFI_INITRD_MEDIA_GUID,
+                content.into_boxed_slice(),
+            )
+            .context("unable to register linux initrd")?;
+            initrd_handle = Some(handle);
+        }
    }

    // Mark execution of an entry in the bootloader interface.
    BootloaderInterface::mark_exec(context.root().timer())
        .context("unable to mark execution of boot entry in bootloader interface")?;

+    // Since we are about to hand off control to another image, we need to execute the handoff hook.
+    // This will perform operations like clearing the screen.
+    before_handoff(&context).context("unable to execute before handoff hook")?;
+
    // Start the loaded image.
    // This call might return, or it may pass full control to another image that will never return.
    // Capture the result to ensure we can return an error if the image fails to start, but only
    // after the optional initrd has been unregistered.
    let result = uefi::boot::start_image(*image.handle());

-    // Unregister the initrd if it was registered.
-    if let Some(initrd_handle) = initrd_handle
-        && let Err(error) = initrd_handle.unregister()
-    {
-        error!("unable to unregister linux initrd: {}", error);
-    }
-
    // Assert there was no error starting the image.
    result.context("unable to start image")?;

    // Explicitly drop the options to clarify the lifetime.
    drop(options);

+    // Explicitly drop the initrd handle to clarify when it should be unregistered.
+    drop(initrd_handle);
+
    // Return control to sprout.
    Ok(())
 }
@@ -1,119 +1,107 @@
-use crate::{
-    actions,
-    context::SproutContext,
-    utils::{self},
-};
+use crate::{actions, context::SproutContext};
 use alloc::rc::Rc;
-use alloc::string::{String, ToString};
+use alloc::vec::Vec;
 use alloc::{format, vec};
 use anyhow::{Context, Result};
 use edera_sprout_config::actions::chainload::ChainloadConfiguration;
 use edera_sprout_config::actions::edera::EderaConfiguration;
+use edera_sprout_parsing::{build_xen_config, combine_options, empty_is_none};
 use eficore::media_loader::{
    MediaLoaderHandle,
    constants::xen::{
        XEN_EFI_CONFIG_MEDIA_GUID, XEN_EFI_KERNEL_MEDIA_GUID, XEN_EFI_RAMDISK_MEDIA_GUID,
    },
 };
-use log::error;
+use eficore::platform::tpm::PlatformTpm;
 use uefi::Guid;

-/// Builds a configuration string for the Xen EFI stub using the specified `configuration`.
-fn build_xen_config(context: Rc<SproutContext>, configuration: &EderaConfiguration) -> String {
-    // Stamp xen options and combine them.
-    let xen_options = utils::combine_options(
-        configuration
-            .xen_options
-            .iter()
-            .map(|item| context.stamp(item)),
-    );
-
-    // Stamp kernel options and combine them.
-    let kernel_options = utils::combine_options(
-        configuration
-            .kernel_options
-            .iter()
-            .map(|item| context.stamp(item)),
-    );
-
-    // xen config file format is ini-like
-    [
-        // global section
-        "[global]".to_string(),
-        // default configuration section
-        "default=sprout".to_string(),
-        // configuration section for sprout
-        "[sprout]".to_string(),
-        // xen options
-        format!("options={}", xen_options),
-        // kernel options, stub replaces the kernel path
-        // the kernel is provided via media loader
-        format!("kernel=stub {}", kernel_options),
-        // required or else the last line will be ignored
-        "".to_string(),
-    ]
-    .join("\n")
-}
-
-/// Register a media loader for some `text` with the vendor `guid`.
+/// Register a media loader for the provided `bytes` with the vendor `guid`.
 /// `what` should indicate some identifying value for error messages
 /// like `config` or `kernel`.
 /// Provides a [MediaLoaderHandle] that can be used to unregister the media loader.
-fn register_media_loader_text(guid: Guid, what: &str, text: String) -> Result<MediaLoaderHandle> {
-    MediaLoaderHandle::register(guid, text.as_bytes().to_vec().into_boxed_slice())
-        .context(format!("unable to register {} media loader", what)) /*  */
-}
-
-/// Register a media loader for the file `path` with the vendor `guid`.
-/// `what` should indicate some identifying value for error messages
-/// like `config` or `kernel`.
-/// Provides a [MediaLoaderHandle] that can be used to unregister the media loader.
-fn register_media_loader_file(
-    context: &Rc<SproutContext>,
+fn register_media_loader_bytes(
    guid: Guid,
    what: &str,
-    path: &str,
+    bytes: Vec<u8>,
 ) -> Result<MediaLoaderHandle> {
-    // Stamp the path to the file.
+    MediaLoaderHandle::register(guid, bytes.into_boxed_slice())
+        .context(format!("unable to register {} media loader", what))
+}
+
+/// Read the contents of the loader payload at `path` relative to the sprout image.
+/// `what` should indicate some identifying value for error messages
+/// like `kernel` or `initrd`.
+fn read_loader_payload(context: &Rc<SproutContext>, what: &str, path: &str) -> Result<Vec<u8>> {
    let path = context.stamp(path);
-    // Read the file contents.
-    let content =
-        eficore::path::read_file_contents(Some(context.root().loaded_image_path()?), &path)
-            .context(format!("unable to read {} file", what))?;
-    // Register the media loader.
-    let handle = MediaLoaderHandle::register(guid, content.into_boxed_slice())
-        .context(format!("unable to register {} media loader", what))?;
-    Ok(handle)
+    eficore::path::read_file_contents(Some(context.root().loaded_image_path()?), &path)
+        .context(format!("unable to read {} file", what))
 }

 /// Executes the edera action which will boot the Edera hypervisor with the specified
 /// `configuration` and `context`. This action uses Edera-specific Xen EFI stub functionality.
 pub fn edera(context: Rc<SproutContext>, configuration: &EderaConfiguration) -> Result<()> {
-    // Build the Xen config file content for this configuration.
-    let config = build_xen_config(context.clone(), configuration);
+    // Only register the initrd media loader if the user actually configured one.
+    let xen_opts = combine_options(context.stamp_iter(configuration.xen_options.iter()));
+    let dom0_args = combine_options(context.stamp_iter(configuration.kernel_options.iter()));

-    // Register the media loader for the config.
-    let config = register_media_loader_text(XEN_EFI_CONFIG_MEDIA_GUID, "config", config)
-        .context("unable to register config media loader")?;
-
-    // Register the media loaders for the kernel.
-    let kernel = register_media_loader_file(
-        &context,
-        XEN_EFI_KERNEL_MEDIA_GUID,
-        "kernel",
-        &configuration.kernel,
+    // Measure xen options and dom0 cmdline into PCR 12 in a fixed order.
+    PlatformTpm::log_event(
+        PlatformTpm::PCR_KERNEL_PARAMETERS,
+        xen_opts.as_bytes(),
+        "sprout: xen options",
    )
-    .context("unable to register kernel media loader")?;
+    .context("unable to measure xen options into the TPM")?;
+    PlatformTpm::log_event(
+        PlatformTpm::PCR_KERNEL_PARAMETERS,
+        dom0_args.as_bytes(),
+        "sprout: dom0 cmdline",
+    )
+    .context("unable to measure dom0 cmdline into the TPM")?;

-    // Create a vector of media loaders to unregister on error.
-    let mut media_loaders = vec![config, kernel];
+    // Build the Xen config text and register it as the config media loader. The
+    // assembled text is a derived artifact, intentionally not measured.
+    let config_handle = register_media_loader_bytes(
+        XEN_EFI_CONFIG_MEDIA_GUID,
+        "config",
+        build_xen_config(&xen_opts, &dom0_args).into_bytes(),
+    )
+    .context("unable to register config media loader")?;
+
+    // Read the dom0 kernel, measure it into PCR 11, then register the kernel
+    // media loader.
+    let kernel_bytes = read_loader_payload(&context, "kernel", &configuration.kernel)?;
+    PlatformTpm::log_event(
+        PlatformTpm::PCR_KERNEL,
+        &kernel_bytes,
+        "sprout: dom0 kernel",
+    )
+    .context("unable to measure dom0 kernel into the TPM")?;
+    let kernel_handle =
+        register_media_loader_bytes(XEN_EFI_KERNEL_MEDIA_GUID, "kernel", kernel_bytes)
+            .context("unable to register kernel media loader")?;
+
+    // Extend PCR 9 with the initrd bytes (empty when no initrd is
+    // configured).
+    let initrd_bytes = match empty_is_none(configuration.initrd.as_ref()) {
+        Some(p) => read_loader_payload(&context, "initrd", p)?,
+        None => Vec::new(),
+    };
+    PlatformTpm::log_event(
+        PlatformTpm::PCR_INITRD,
+        &initrd_bytes,
+        "sprout: dom0 initrd",
+    )
+    .context("unable to measure dom0 initrd into the TPM")?;
+
+    // Create a vector of media loaders to drop them only after this function completes.
+    let mut media_loaders = vec![config_handle, kernel_handle];

    // Register the initrd if it is provided.
-    if let Some(initrd) = utils::empty_is_none(configuration.initrd.as_ref()) {
-        let initrd =
-            register_media_loader_file(&context, XEN_EFI_RAMDISK_MEDIA_GUID, "initrd", initrd)
+    if !initrd_bytes.is_empty() {
+        let initrd_handle =
+            register_media_loader_bytes(XEN_EFI_RAMDISK_MEDIA_GUID, "initrd", initrd_bytes)
                .context("unable to register initrd media loader")?;
-        media_loaders.push(initrd);
+        media_loaders.push(initrd_handle);
    }

    // Chainload to the Xen EFI stub.
@@ -127,12 +115,8 @@ pub fn edera(context: Rc<SproutContext>, configuration: &EderaConfiguration) ->
    )
    .context("unable to chainload to xen");

-    // Unregister the media loaders when an error happens.
-    for media_loader in media_loaders {
-        if let Err(error) = media_loader.unregister() {
-            error!("unable to unregister media loader: {}", error);
-        }
-    }
+    // Explicitly drop the media loaders to clarify when they should be unregistered.
+    drop(media_loaders);

    result
 }
@@ -1,5 +1,6 @@
 use anyhow::{Context, Result};
 use edera_sprout_config::RootConfiguration;
+use log::warn;
 use uefi::fs::FileSystem;
 use uefi::proto::device_path::DevicePath;
 use uefi::proto::media::fs::SimpleFileSystem;
@@ -25,15 +26,24 @@ pub fn autoconfigure(config: &mut RootConfiguration) -> Result<()> {
    // For each filesystem that was detected, scan it for supported autoconfig mechanisms.
    for handle in filesystem_handles {
        // Acquire the device path root for the filesystem.
-        let root = {
-            uefi::boot::open_protocol_exclusive::<DevicePath>(handle)
-                .context("unable to get root for filesystem")?
-                .to_boxed()
+        // A filesystem that can't be opened is skipped, as it should not prevent
+        // autoconfiguring the other filesystems.
+        let root = match uefi::boot::open_protocol_exclusive::<DevicePath>(handle) {
+            Ok(root) => root.to_boxed(),
+            Err(error) => {
+                warn!("skipping filesystem, unable to get its root: {}", error);
+                continue;
+            }
        };

        // Open the filesystem that was detected.
-        let filesystem = uefi::boot::open_protocol_exclusive::<SimpleFileSystem>(handle)
-            .context("unable to open filesystem")?;
+        let filesystem = match uefi::boot::open_protocol_exclusive::<SimpleFileSystem>(handle) {
+            Ok(filesystem) => filesystem,
+            Err(error) => {
+                warn!("skipping filesystem, unable to open it: {}", error);
+                continue;
+            }
+        };

        // Trade the filesystem protocol for the uefi filesystem helper.
        let mut filesystem = FileSystem::new(filesystem);
@@ -1,4 +1,3 @@
-use crate::utils;
 use alloc::string::ToString;
 use alloc::{format, vec};
 use anyhow::{Context, Result};
@@ -8,6 +7,7 @@ use edera_sprout_config::actions::chainload::ChainloadConfiguration;
 use edera_sprout_config::entries::EntryDeclaration;
 use edera_sprout_config::generators::GeneratorDeclaration;
 use edera_sprout_config::generators::bls::BlsConfiguration;
+use edera_sprout_parsing::unique_hash;
 use uefi::cstr16;
 use uefi::fs::{FileSystem, Path};
 use uefi::proto::device_path::DevicePath;
@@ -30,14 +30,14 @@ pub fn scan(

    // Convert the device path root to a string we can use in the configuration.
    let mut root = root
-        .to_string(DisplayOnly(false), AllowShortcuts(false))
+        .to_string16(DisplayOnly(false), AllowShortcuts(false))
        .context("unable to convert device root to string")?
        .to_string();
    // Add a trailing forward-slash to the root to ensure the device root is completed.
    root.push('/');

    // Generate a unique hash of the root path.
-    let root_unique_hash = utils::unique_hash(&root);
+    let root_unique_hash = unique_hash(&root);

    // Whether we have a loader.conf file.
    let has_loader_conf = filesystem
@@ -1,5 +1,3 @@
-use crate::utils;
-use crate::utils::vercmp;
 use alloc::collections::BTreeMap;
 use alloc::string::{String, ToString};
 use alloc::vec::Vec;
@@ -11,6 +9,10 @@ use edera_sprout_config::actions::chainload::ChainloadConfiguration;
 use edera_sprout_config::entries::EntryDeclaration;
 use edera_sprout_config::generators::GeneratorDeclaration;
 use edera_sprout_config::generators::list::ListConfiguration;
+use edera_sprout_parsing::{
+    LINUX_INITRAMFS_PREFIXES, LINUX_KERNEL_PREFIXES, initramfs_candidates, match_kernel_prefix,
+    unique_hash,
+};
 use uefi::CString16;
 use uefi::fs::{FileSystem, Path, PathBuf};
 use uefi::proto::device_path::DevicePath;
@@ -24,12 +26,6 @@ const LINUX_CHAINLOAD_ACTION_PREFIX: &str = "linux-chainload-";
 /// The empty string represents the root of the filesystem.
 const SCAN_LOCATIONS: &[&str] = &["\\boot", "\\"];

-/// Prefixes of kernel files to scan for.
-const KERNEL_PREFIXES: &[&str] = &["vmlinuz"];
-
-/// Prefixes of initramfs files to match to.
-const INITRAMFS_PREFIXES: &[&str] = &["initramfs", "initrd", "initrd.img"];
-
 /// This is really silly, but if what we are booting is the Canonical stubble stub,
 /// there is a chance it will assert that the load options are non-empty.
 /// Technically speaking, load options can be empty. However, it assumes load options
@@ -37,9 +33,9 @@ const INITRAMFS_PREFIXES: &[&str] = &["initramfs", "initrd", "initrd.img"];
 /// and then uses that code improperly by asserting that the pointer is non-null.
 /// To give a good user experience, we place a placeholder value here to ensure it's non-empty.
 /// For stubble, this code ensures the command line pointer becomes null:
-/// https://github.com/ubuntu/stubble/blob/e56643979addfb98982266018e08921c07424a0c/stub.c#L61-L64
+/// <https://github.com/ubuntu/stubble/blob/e56643979addfb98982266018e08921c07424a0c/stub.c#L61-L64>
 /// Then this code asserts on it, stopping the boot process:
-/// https://github.com/ubuntu/stubble/blob/e56643979addfb98982266018e08921c07424a0c/stub.c#L27
+/// <https://github.com/ubuntu/stubble/blob/e56643979addfb98982266018e08921c07424a0c/stub.c#L27>
 const DEFAULT_LINUX_OPTIONS: &str = "placeholder";

 /// Pair of kernel and initramfs.
@@ -109,9 +105,7 @@ fn scan_directory(filesystem: &mut FileSystem, path: &str) -> Result<Vec<KernelP

        // Find a kernel prefix that matches, if any.
        // This is case-insensitive to ensure we pick up all possibilities.
-        let Some(prefix) = KERNEL_PREFIXES.iter().find(|prefix| {
-            name_for_match == **prefix || name_for_match.starts_with(&format!("{}-", prefix))
-        }) else {
+        let Some(prefix) = match_kernel_prefix(&name_for_match, LINUX_KERNEL_PREFIXES) else {
            // Skip over anything that doesn't match a kernel prefix.
            continue;
        };
@@ -119,15 +113,14 @@ fn scan_directory(filesystem: &mut FileSystem, path: &str) -> Result<Vec<KernelP
        // Acquire the suffix of the name, this will be used to match an initramfs.
        let suffix = &name[prefix.len()..];

-        // Find a matching initramfs, if any.
-        let mut initramfs_prefix_iter = INITRAMFS_PREFIXES.iter();
+        // Find a matching initramfs by trying each candidate name, if any.
+        let mut candidates = initramfs_candidates(suffix, LINUX_INITRAMFS_PREFIXES);
        let matched_initramfs_path = loop {
-            let Some(prefix) = initramfs_prefix_iter.next() else {
+            let Some(candidate) = candidates.next() else {
                break None;
            };
            // Construct an initramfs path.
-            let initramfs = format!("{}{}", prefix, suffix);
-            let initramfs = CString16::try_from(initramfs.as_str())
+            let initramfs = CString16::try_from(candidate.as_str())
                .context("unable to convert initramfs name to CString16")?;
            let mut initramfs_path = path_for_join.clone();
            initramfs_path.push(Path::new(&initramfs));
@@ -165,14 +158,14 @@ pub fn scan(

    // Convert the device path root to a string we can use in the configuration.
    let mut root = root
-        .to_string(DisplayOnly(false), AllowShortcuts(false))
+        .to_string16(DisplayOnly(false), AllowShortcuts(false))
        .context("unable to convert device root to string")?
        .to_string();
    // Add a trailing forward-slash to the root to ensure the device root is completed.
    root.push('/');

    // Generate a unique hash of the root path.
-    let root_unique_hash = utils::unique_hash(&root);
+    let root_unique_hash = unique_hash(&root);

    // Scan all locations for kernel pairs, adding them to the list.
    for location in SCAN_LOCATIONS {
@@ -186,17 +179,15 @@ pub fn scan(
        return Ok(false);
    }

-    // Sort the kernel pairs by kernel version, if it has one, newer kernels first.
-    pairs.sort_by(|a, b| vercmp::compare_versions(&a.kernel, &b.kernel).reverse());
-
    // Generate a unique name for the linux chainload action.
-    let chainload_action_name = format!("{}{}", LINUX_CHAINLOAD_ACTION_PREFIX, root_unique_hash,);
+    let chainload_action_name = format!("{}{}", LINUX_CHAINLOAD_ACTION_PREFIX, root_unique_hash);

    // Kernel pairs are detected, generate a list configuration for it.
    let generator = ListConfiguration {
        entry: EntryDeclaration {
            title: "Boot Linux $name".to_string(),
            actions: vec![chainload_action_name.clone()],
+            sort_key: Some("$kernel".to_string()),
            ..Default::default()
        },
        values: pairs
@@ -1,4 +1,3 @@
-use crate::utils;
 use alloc::string::ToString;
 use alloc::{format, vec};
 use anyhow::{Context, Result};
@@ -6,6 +5,7 @@ use edera_sprout_config::RootConfiguration;
 use edera_sprout_config::actions::ActionDeclaration;
 use edera_sprout_config::actions::chainload::ChainloadConfiguration;
 use edera_sprout_config::entries::EntryDeclaration;
+use edera_sprout_parsing::unique_hash;
 use uefi::CString16;
 use uefi::fs::{FileSystem, Path};
 use uefi::proto::device_path::DevicePath;
@@ -38,26 +38,27 @@ pub fn scan(

    // Convert the device path root to a string we can use in the configuration.
    let mut root = root
-        .to_string(DisplayOnly(false), AllowShortcuts(false))
+        .to_string16(DisplayOnly(false), AllowShortcuts(false))
        .context("unable to convert device root to string")?
        .to_string();
    // Add a trailing forward-slash to the root to ensure the device root is completed.
    root.push('/');

    // Generate a unique hash of the root path.
-    let root_unique_hash = utils::unique_hash(&root);
+    let root_unique_hash = unique_hash(&root);

    // Generate a unique name for the Windows chainload action.
    let chainload_action_name = format!("{}{}", WINDOWS_CHAINLOAD_ACTION_PREFIX, root_unique_hash,);

    // Generate an entry name for Windows.
-    let entry_name = format!("auto-windows-{}", root_unique_hash,);
+    let entry_name = format!("auto-windows-{}", root_unique_hash);

    // Create an entry for Windows and insert it into the configuration.
    let entry = EntryDeclaration {
        title: "Boot Windows".to_string(),
        actions: vec![chainload_action_name.clone()],
        values: Default::default(),
+        sort_key: None, // Use the default sort key.
    };
    config.entries.insert(entry_name, entry);

@@ -1,14 +1,13 @@
 use crate::options::SproutOptions;
 use alloc::boxed::Box;
 use alloc::collections::{BTreeMap, BTreeSet};
-use alloc::format;
 use alloc::rc::Rc;
 use alloc::string::{String, ToString};
 use alloc::vec::Vec;
 use anyhow::anyhow;
 use anyhow::{Result, bail};
-use core::cmp::Reverse;
 use edera_sprout_config::actions::ActionDeclaration;
+use edera_sprout_parsing::stamp_values;
 use eficore::platform::timer::PlatformTimer;
 use uefi::proto::device_path::DevicePath;

@@ -197,7 +196,7 @@ impl SproutContext {
            let mut did_change = false;
            let mut values = BTreeMap::new();
            for (key, value) in &current_values {
-                let (changed, result) = Self::stamp_values(&current_values, value);
+                let (changed, result) = stamp_values(&current_values, value);
                if changed {
                    // If the value changed, we need to re-stamp it.
                    did_change = true;
@@ -221,52 +220,20 @@ impl SproutContext {
        })
    }

-    /// Stamps the `text` value with the specified `values` map. The returned value indicates
-    /// whether the `text` has been changed and the value that was stamped and changed.
-    ///
-    /// Stamping works like this:
-    /// - Start with the input text.
-    /// - Sort all the keys in reverse length order (longest keys first)
-    /// - For each key, if the key is not empty, replace $KEY in the text.
-    /// - Each follow-up iteration acts upon the last iterations result.
-    /// - We keep track if the text changes during the replacement.
-    /// - We return both whether the text changed during any iteration and the final result.
-    fn stamp_values(values: &BTreeMap<String, String>, text: impl AsRef<str>) -> (bool, String) {
-        let mut result = text.as_ref().to_string();
-        let mut did_change = false;
-
-        // Sort the keys by length. This is to ensure that we stamp the longest keys first.
-        // If we did not do this, "$abc" could be stamped by "$a" into an invalid result.
-        let mut keys = values.keys().collect::<Vec<_>>();
-
-        // Sort by key length, reversed. This results in the longest keys appearing first.
-        keys.sort_by_key(|key| Reverse(key.len()));
-
-        for key in keys {
-            // Empty keys are not supported.
-            if key.is_empty() {
-                continue;
-            }
-
-            // We can fetch the value from the map. It is verifiable that the key exists.
-            let Some(value) = values.get(key) else {
-                unreachable!("keys iterated over is collected on a map that cannot be modified");
-            };
-
-            let next_result = result.replace(&format!("${key}"), value);
-            if result != next_result {
-                did_change = true;
-            }
-            result = next_result;
-        }
-        (did_change, result)
-    }
-
    /// Stamps the input `text` with all the values in this [SproutContext] and it's parents.
    /// For example, if this context contains {"a":"b"}, and the text "hello\\$a", it will produce
    /// "hello\\b" as an output string.
    pub fn stamp(&self, text: impl AsRef<str>) -> String {
-        Self::stamp_values(&self.all_values(), text.as_ref()).1
+        stamp_values(&self.all_values(), text.as_ref()).1
+    }
+
+    /// Stamps all the items from the iterator `input` with all the values in this [SproutContext]
+    /// and it's parents. This calls [self.stamp] on each item.
+    pub fn stamp_iter(
+        &self,
+        input: impl Iterator<Item = impl AsRef<str>>,
+    ) -> impl Iterator<Item = String> {
+        input.map(|item| self.stamp(item))
    }

    /// Unloads a [SproutContext] back into an owned context. This
@@ -18,7 +18,7 @@ fn load_driver(context: Rc<SproutContext>, driver: &DriverDeclaration) -> Result
    // Resolve the path to the driver image.
    let resolved = eficore::path::resolve_path(
        Some(context.root().loaded_image_path()?),
-        &context.stamp(&driver.path),
+        context.stamp(&driver.path),
    )
    .context("unable to resolve path to driver")?;

@@ -49,7 +49,7 @@ fn reconnect() -> Result<()> {
    for handle in handles.iter() {
        // Ignore the result as there is nothing we can do if reconnecting a controller fails.
        // This is also likely to fail in some cases but should fail safely.
-        let _ = uefi::boot::connect_controller(*handle, None, None, true);
+        let _ = uefi::boot::connect_controller(*handle, &[], None, true);
    }

    Ok(())
@@ -12,6 +12,7 @@ pub struct BootableEntry {
    declaration: EntryDeclaration,
    default: bool,
    pin_name: bool,
+    sort_key: Option<String>,
 }

 impl BootableEntry {
@@ -29,6 +30,7 @@ impl BootableEntry {
            declaration,
            default: false,
            pin_name: false,
+            sort_key: None,
        }
    }

@@ -93,10 +95,36 @@ impl BootableEntry {
    }

    /// Determine if this entry matches `needle` by comparing to the name or title of the entry.
+    /// If `needle` ends with *, we will match a partial match.
    pub fn is_match(&self, needle: &str) -> bool {
+        // If the needle ends with '*', we will accept a partial match.
+        if needle.ends_with("*") {
+            // Strip off any '*' at the end.
+            let partial = needle.trim_end_matches("*");
+            // Check if the name or title start with the partial match.
+            return self.name.starts_with(partial) || self.title.starts_with(partial);
+        }
+
+        // Standard quality matching rules.
        self.name == needle || self.title == needle
    }

+    /// Set the sort key of the entry. This is used to sort entries via version comparison.
+    pub fn set_sort_key(&mut self, sort_key: String) {
+        self.sort_key = Some(sort_key);
+    }
+
+    /// Retrieve a reference to the sort key of the entry. If one is not specified, we will use the
+    /// name of the entry.
+    pub fn sort_key(&self) -> &str {
+        // Use the sort key specified in the bootable entry, or use the declaration sort key,
+        // or use the name of the entry.
+        self.sort_key
+            .as_deref()
+            .or(self.declaration.sort_key.as_deref())
+            .unwrap_or(&self.name)
+    }
+
    /// Find an entry by `needle` inside the entry iterator `haystack`.
    /// This will search for an entry by name, title, or index.
    pub fn find<'a>(
@@ -1,22 +1,22 @@
 use crate::context::SproutContext;
 use crate::entries::BootableEntry;
-use crate::generators::bls::entry::BlsEntry;
-use crate::utils::vercmp;
-use alloc::format;
-use alloc::rc::Rc;
-use alloc::string::{String, ToString};
-use alloc::vec::Vec;
+use alloc::{
+    format,
+    rc::Rc,
+    string::{String, ToString},
+    vec::Vec,
+};
 use anyhow::{Context, Result};
-use core::cmp::Ordering;
-use core::str::FromStr;
+use core::{cmp::Ordering, str::FromStr};
+use edera_sprout_bls::{BlsEntry, sort_bls};
 use edera_sprout_config::generators::bls::BlsConfiguration;
-use uefi::cstr16;
-use uefi::fs::{FileSystem, PathBuf};
-use uefi::proto::device_path::text::{AllowShortcuts, DisplayOnly};
-use uefi::proto::media::fs::SimpleFileSystem;
-
-/// BLS entry parser.
-mod entry;
+use log::warn;
+use uefi::{
+    cstr16,
+    fs::{FileSystem, PathBuf},
+    proto::device_path::text::{AllowShortcuts, DisplayOnly},
+    proto::media::fs::SimpleFileSystem,
+};

 // TODO(azenla): remove this once variable substitution is implemented.
 /// This function is used to remove the `tuned_initrd` variable from entry values.
@@ -26,57 +26,11 @@ fn quirk_initrd_remove_tuned(input: String) -> String {
 }

 /// Sorts two entries according to the BLS sort system.
-/// Reference: https://uapi-group.org/specifications/specs/boot_loader_specification/#sorting
+/// Reference: <https://uapi-group.org/specifications/specs/boot_loader_specification/#sorting>
 fn sort_entries(a: &(BlsEntry, BootableEntry), b: &(BlsEntry, BootableEntry)) -> Ordering {
-    // Grab the components of both entries.
    let (a_bls, a_boot) = a;
    let (b_bls, b_boot) = b;
-
-    // Grab the sort keys from both entries.
-    let a_sort_key = a_bls.sort_key();
-    let b_sort_key = b_bls.sort_key();
-
-    // Compare the sort keys of both entries.
-    match a_sort_key.cmp(&b_sort_key) {
-        // If A and B sort keys are equal, sort by machine-id.
-        Ordering::Equal => {
-            // Grab the machine-id from both entries.
-            let a_machine_id = a_bls.machine_id();
-            let b_machine_id = b_bls.machine_id();
-
-            // Compare the machine-id of both entries.
-            match a_machine_id.cmp(&b_machine_id) {
-                // If both machine-id values are equal, sort by version.
-                Ordering::Equal => {
-                    // Grab the version from both entries.
-                    let a_version = a_bls.version();
-                    let b_version = b_bls.version();
-
-                    // Compare the version of both entries, sorting newer versions first.
-                    match vercmp::compare_versions_optional(
-                        a_version.as_deref(),
-                        b_version.as_deref(),
-                    )
-                    .reverse()
-                    {
-                        // If both versions are equal, sort by file name in reverse order.
-                        Ordering::Equal => {
-                            // Grab the file name from both entries.
-                            let a_name = a_boot.name();
-                            let b_name = b_boot.name();
-
-                            // Compare the file names of both entries, sorting newer entries first.
-                            vercmp::compare_versions(a_name, b_name).reverse()
-                        }
-                        other => other,
-                    }
-                }
-                other => other,
-            }
-        }
-
-        other => other,
-    }
+    sort_bls(a_bls, a_boot.name(), b_bls, b_boot.name())
 }

 /// Generates entries from the BLS entries directory using the specified `bls` configuration and
@@ -96,7 +50,7 @@ pub fn generate(context: Rc<SproutContext>, bls: &BlsConfiguration) -> Result<Ve
    let mut entries_path = PathBuf::from(
        bls_resolved
            .sub_path
-            .to_string(DisplayOnly(false), AllowShortcuts(false))
+            .to_string16(DisplayOnly(false), AllowShortcuts(false))
            .context("unable to convert bls path to string")?,
    );
    entries_path.push(cstr16!("entries"));
@@ -107,6 +61,15 @@ pub fn generate(context: Rc<SproutContext>, bls: &BlsConfiguration) -> Result<Ve
            .context("unable to open bls filesystem")?;
    let mut fs = FileSystem::new(fs);

+    // The entries directory is optional, as a BLS directory may only contain a loader.conf file.
+    // If it does not exist, there are no entries to generate.
+    if !fs
+        .try_exists(&entries_path)
+        .context("unable to check for bls entries directory")?
+    {
+        return Ok(Vec::new());
+    }
+
    // Read the BLS entries directory.
    let entries_iter = fs
        .read_dir(&entries_path)
@@ -143,15 +106,33 @@ pub fn generate(context: Rc<SproutContext>, bls: &BlsConfiguration) -> Result<Ve
        full_entry_path.push(entry.file_name());

        // Read the entry file.
-        let content = fs
-            .read(full_entry_path)
-            .context("unable to read bls file")?;
+        // Entries that can't be read or parsed are skipped, as one broken entry
+        // should not prevent booting any of the other entries.
+        let content = match fs.read(full_entry_path) {
+            Ok(content) => content,
+            Err(error) => {
+                warn!("unable to read bls entry {}: {}", name, error);
+                continue;
+            }
+        };

        // Parse the entry file as a UTF-8 string.
-        let content = String::from_utf8(content).context("unable to read bls entry as utf8")?;
+        let content = match String::from_utf8(content) {
+            Ok(content) => content,
+            Err(error) => {
+                warn!("unable to read bls entry {} as utf8: {}", name, error);
+                continue;
+            }
+        };

        // Parse the entry file as a BLS entry.
-        let entry = BlsEntry::from_str(&content).context("unable to parse bls entry")?;
+        let entry = match BlsEntry::from_str(&content) {
+            Ok(entry) => entry,
+            Err(error) => {
+                warn!("unable to parse bls entry {}: {}", name, error);
+                continue;
+            }
+        };

        // Ignore entries that are not valid for Sprout.
        if !entry.is_valid() {
@@ -206,6 +187,16 @@ pub fn generate(context: Rc<SproutContext>, bls: &BlsConfiguration) -> Result<Ve
    // Sort all the entries according to the BLS sort system.
    entries.sort_by(sort_entries);

+    // Grab the number of entries that we have, so we can calculate a reverse index.
+    let entry_count = entries.len();
+
+    // Set the sort keys of all the bootable entries to a semi-unique prefix + the BLS sort order.
+    // The final comparison happens using version comparison, so this will sort
+    // things properly.
+    for (idx, (_bls, boot)) in entries.iter_mut().enumerate() {
+        boot.set_sort_key(format!("bls-{}-{}", path, entry_count - idx - 1));
+    }
+
    // Collect all the bootable entries and return them.
    Ok(entries.into_iter().map(|(_, boot)| boot).collect())
 }
@@ -1,168 +0,0 @@
-use alloc::string::{String, ToString};
-use anyhow::{Error, Result};
-use core::str::FromStr;
-
-/// Represents a parsed BLS entry.
-/// Fields unrelated to Sprout are not included.
-#[derive(Default, Debug, Clone)]
-pub struct BlsEntry {
-    /// The title of the entry.
-    pub title: Option<String>,
-    /// The options to pass to the entry.
-    pub options: Option<String>,
-    /// The path to the linux kernel.
-    pub linux: Option<String>,
-    /// The path to the initrd.
-    pub initrd: Option<String>,
-    /// The path to an EFI image.
-    pub efi: Option<String>,
-    /// The sort key for the entry.
-    pub sort_key: Option<String>,
-    /// The version of the entry.
-    pub version: Option<String>,
-    /// The machine id of the entry.
-    pub machine_id: Option<String>,
-}
-
-/// Parser for a BLS entry.
-impl FromStr for BlsEntry {
-    type Err = Error;
-
-    /// Parses the `input` as a BLS entry file.
-    fn from_str(input: &str) -> Result<Self> {
-        // All the fields in a BLS entry we understand.
-        // Set all to None initially.
-        let mut title: Option<String> = None;
-        let mut options: Option<String> = None;
-        let mut linux: Option<String> = None;
-        let mut initrd: Option<String> = None;
-        let mut efi: Option<String> = None;
-        let mut sort_key: Option<String> = None;
-        let mut version: Option<String> = None;
-        let mut machine_id: Option<String> = None;
-
-        // Iterate over each line in the input and parse it.
-        for line in input.lines() {
-            // Trim the line.
-            let line = line.trim();
-
-            // Skip over empty lines and comments.
-            if line.is_empty() || line.starts_with('#') {
-                continue;
-            }
-
-            // Split the line once by whitespace. This technically includes newlines but since
-            // the lines iterator is used, there should never be a newline here.
-            let Some((key, value)) = line.split_once(char::is_whitespace) else {
-                continue;
-            };
-
-            // Match the key to a field we understand.
-            match key {
-                // The title of the entry.
-                "title" => {
-                    title = Some(value.trim().to_string());
-                }
-
-                // The options to pass to the entry.
-                "options" => {
-                    options = Some(value.trim().to_string());
-                }
-
-                // The path to the linux kernel.
-                "linux" => {
-                    linux = Some(value.trim().to_string());
-                }
-
-                // The path to the initrd.
-                "initrd" => {
-                    initrd = Some(value.trim().to_string());
-                }
-
-                // The path to an EFI image.
-                "efi" => {
-                    efi = Some(value.trim().to_string());
-                }
-
-                "sort-key" => {
-                    sort_key = Some(value.trim().to_string());
-                }
-
-                "version" => {
-                    version = Some(value.trim().to_string());
-                }
-
-                "machine-id" => {
-                    machine_id = Some(value.trim().to_string());
-                }
-
-                // Ignore any other key.
-                _ => {
-                    continue;
-                }
-            }
-        }
-
-        // Produce a BLS entry from the parsed fields.
-        Ok(Self {
-            title,
-            options,
-            linux,
-            initrd,
-            efi,
-            sort_key,
-            version,
-            machine_id,
-        })
-    }
-}
-
-impl BlsEntry {
-    /// Checks if this BLS entry is something we can actually boot in Sprout.
-    pub fn is_valid(&self) -> bool {
-        self.linux.is_some() || self.efi.is_some()
-    }
-
-    /// Fetches the path to an EFI bootable image to boot, if any.
-    /// This prioritizes the linux field over efi.
-    /// It also converts / to \\ to match EFI path style.
-    pub fn chainload_path(&self) -> Option<String> {
-        self.linux
-            .clone()
-            .or(self.efi.clone())
-            .map(|path| path.replace('/', "\\").trim_start_matches('\\').to_string())
-    }
-
-    /// Fetches the path to an initrd to pass to the kernel, if any.
-    /// It also converts / to \\ to match EFI path style.
-    pub fn initrd_path(&self) -> Option<String> {
-        self.initrd
-            .clone()
-            .map(|path| path.replace('/', "\\").trim_start_matches('\\').to_string())
-    }
-
-    /// Fetches the options to pass to the kernel, if any.
-    pub fn options(&self) -> Option<String> {
-        self.options.clone()
-    }
-
-    /// Fetches the title of the entry, if any.
-    pub fn title(&self) -> Option<String> {
-        self.title.clone()
-    }
-
-    /// Fetches the sort key of the entry, if any.
-    pub fn sort_key(&self) -> Option<String> {
-        self.sort_key.clone()
-    }
-
-    /// Fetches the version of the entry, if any.
-    pub fn version(&self) -> Option<String> {
-        self.version.clone()
-    }
-
-    /// Fetches the machine id of the entry, if any.
-    pub fn machine_id(&self) -> Option<String> {
-        self.machine_id.clone()
-    }
-}
@@ -22,11 +22,10 @@ pub fn generate(

        // Stamp the entry title and actions from the template.
        let mut entry = list.entry.clone();
-        entry.actions = entry
-            .actions
-            .into_iter()
-            .map(|action| context.stamp(action))
-            .collect();
+
+        // Stamp all the actions this entry references.
+        entry.actions = context.stamp_iter(entry.actions.into_iter()).collect();
+
        // Push the entry into the list with the new context.
        entries.push(BootableEntry::new(
            index.to_string(),
@@ -1,46 +1,12 @@
 use crate::context::SproutContext;
 use crate::entries::BootableEntry;
 use crate::generators::list;
-use alloc::collections::BTreeMap;
 use alloc::rc::Rc;
-use alloc::string::String;
-use alloc::vec;
 use alloc::vec::Vec;
 use anyhow::Result;
 use edera_sprout_config::generators::list::ListConfiguration;
 use edera_sprout_config::generators::matrix::MatrixConfiguration;
-
-/// Builds out multiple generations of `input` based on a matrix style.
-/// For example, if input is: {"x": ["a", "b"], "y": ["c", "d"]}
-/// It will produce:
-/// x: a, y: c
-/// x: a, y: d
-/// x: b, y: c
-/// x: b, y: d
-fn build_matrix(input: &BTreeMap<String, Vec<String>>) -> Vec<BTreeMap<String, String>> {
-    // Convert the input into a vector of tuples.
-    let items: Vec<(String, Vec<String>)> = input.clone().into_iter().collect();
-
-    // The result is a vector of maps.
-    let mut result: Vec<BTreeMap<String, String>> = vec![BTreeMap::new()];
-
-    for (key, values) in items {
-        let mut new_result = Vec::new();
-
-        // Produce all the combinations of the input values.
-        for combination in &result {
-            for value in &values {
-                let mut new_combination = combination.clone();
-                new_combination.insert(key.clone(), value.clone());
-                new_result.push(new_combination);
-            }
-        }
-
-        result = new_result;
-    }
-
-    result.into_iter().filter(|item| !item.is_empty()).collect()
-}
+use edera_sprout_parsing::build_matrix;

 /// Generates a set of entries using the specified `matrix` configuration in the `context`.
 pub fn generate(
@@ -3,28 +3,26 @@
 #![no_main]
 extern crate alloc;

-use crate::context::{RootContext, SproutContext};
-use crate::entries::BootableEntry;
-use crate::options::SproutOptions;
-use crate::options::parser::OptionsRepresentable;
-use crate::phases::phase;
-use alloc::collections::BTreeMap;
-use alloc::format;
-use alloc::string::ToString;
-use alloc::vec::Vec;
+use crate::{
+    context::{RootContext, SproutContext},
+    entries::BootableEntry,
+    options::SproutOptions,
+    phases::phase,
+};
+use alloc::{collections::BTreeMap, format, string::ToString, vec::Vec};
 use anyhow::{Context, Result, bail};
-use core::ops::Deref;
-use core::time::Duration;
+use core::{ops::Deref, time::Duration};
+use edera_sprout_bls::compare_versions;
 use edera_sprout_config::RootConfiguration;
-use eficore::bootloader_interface::{BootloaderInterface, BootloaderInterfaceTimeout};
-use eficore::partition::PartitionGuidForm;
-use eficore::platform::timer::PlatformTimer;
-use eficore::platform::tpm::PlatformTpm;
-use eficore::secure::SecureBoot;
-use eficore::setup;
+use eficore::{
+    bootloader_interface::{BootloaderInterface, BootloaderInterfaceTimeout},
+    partition::PartitionGuidForm,
+    platform::{timer::PlatformTimer, tpm::PlatformTpm},
+    secure::SecureBoot,
+    setup,
+};
 use log::{error, info, warn};
-use uefi::entry;
-use uefi::proto::device_path::LoadedImageDevicePath;
+use uefi::{entry, proto::device_path::LoadedImageDevicePath};
 use uefi_raw::Status;

 /// actions: Code that can be configured and executed by Sprout.
@@ -63,9 +61,6 @@ pub mod phases;
 /// sbat: Secure Boot Attestation section.
 pub mod sbat;

-/// utils: Utility functions that are used by other parts of Sprout.
-pub mod utils;
-
 /// The delay to wait for when an error occurs in Sprout.
 const DELAY_ON_ERROR: Duration = Duration::from_secs(10);

@@ -258,13 +253,14 @@ fn run() -> Result<()> {
        }
    }

+    // Sort the entries by their sort key, finalizing the order to show entries. This happens
+    // in reverse order so that entries that would come last show up first in the menu.
+    entries.sort_by(|a, b| compare_versions(a.sort_key(), b.sort_key()).reverse());
+
    // Tell the bootloader interface what entries are available.
    BootloaderInterface::set_entries(entries.iter().map(|entry| entry.name()))
        .context("unable to set entries in bootloader interface")?;

-    // Execute the late phase.
-    phase(context.clone(), &config.phases.late).context("unable to execute late phase")?;
-
    // Acquire the timeout setting from the bootloader interface.
    let bootloader_interface_timeout =
        BootloaderInterface::get_timeout().context("unable to get bootloader interface timeout")?;
@@ -356,6 +352,9 @@ fn run() -> Result<()> {
    BootloaderInterface::set_selected_entry(entry.name().to_string())
        .context("unable to set selected entry in bootloader interface")?;

+    // Execute the late phase, now that the entry is chosen but before its actions are executed.
+    phase(context.clone(), &config.phases.late).context("unable to execute late phase")?;
+
    // Execute all the actions for the selected entry.
    for action in &entry.declaration().actions {
        let action = entry.context().stamp(action);
@@ -385,7 +384,7 @@ fn efi_main() -> Status {
    let result = run();
    if let Err(ref error) = result {
        // Print an error trace.
-        error!("sprout encountered an error:");
+        error!("sprout encountered an error: {}", error);
        for (index, stack) in error.chain().enumerate() {
            error!("[{}]: {}", index, stack);
        }
@@ -1,6 +1,6 @@
 use crate::entries::BootableEntry;
 use alloc::vec;
-use anyhow::{Context, Result, bail};
+use anyhow::{Context, Result};
 use core::time::Duration;
 use eficore::bootloader_interface::BootloaderInterface;
 use eficore::platform::timer::PlatformTimer;
@@ -44,23 +44,15 @@ fn read(input: &mut Input, timeout: &Duration) -> Result<MenuOperation> {
            .context("unable to create timer event")?
    };

-    // The timeout is in increments of 100 nanoseconds.
-    let timeout_hundred_nanos = timeout.as_nanos() / 100;
-
-    // Check if the timeout is too large to fit into an u64.
-    if timeout_hundred_nanos > u64::MAX as u128 {
-        bail!("timeout duration overflow");
-    }
-
    // Set a timer to trigger after the specified duration.
-    let trigger = TimerTrigger::Relative(timeout_hundred_nanos as u64);
+    let trigger = TimerTrigger::Relative(*timeout);
    uefi::boot::set_timer(&timer_event, trigger).context("unable to set timeout timer")?;

-    let mut events = vec![timer_event, key_event];
+    let events = vec![timer_event, key_event];

    // Wait for either the timer event or the key event to trigger.
    // Store the result so that we can free the timer event.
-    let event_result = uefi::boot::wait_for_event(&mut events)
+    let event_result = uefi::boot::wait_for_event(&events)
        .discard_errdata()
        .context("unable to wait for event");

@@ -94,8 +86,10 @@ fn read(input: &mut Input, timeout: &Duration) -> Result<MenuOperation> {
    }

    // If we reach here, there is a key event.
+    // Some firmware signals the key event without a key being available,
+    // in which case there is nothing to do.
    let Some(key) = input.read_key().context("unable to read key")? else {
-        bail!("no key was pressed");
+        return Ok(MenuOperation::Nop);
    };

    match key {
@@ -1,10 +1,12 @@
-use crate::options::parser::{OptionDescription, OptionForm, OptionsRepresentable};
-use alloc::collections::BTreeMap;
 use alloc::string::{String, ToString};
-use anyhow::{Context, Result, bail};
-
-/// The Sprout options parser.
-pub mod parser;
+use anyhow::{Context, Result, anyhow};
+use core::ptr::null_mut;
+use jaarg::{
+    ErrorUsageWriter, ErrorUsageWriterContext, HelpWriter, HelpWriterContext, Opt, Opts,
+    ParseControl, ParseResult, StandardErrorUsageWriter, StandardFullHelpWriter,
+};
+use log::{error, info};
+use uefi_raw::Status;

 /// Default configuration file path.
 const DEFAULT_CONFIG_PATH: &str = "\\sprout.toml";
@@ -22,6 +24,8 @@ pub struct SproutOptions {
    pub force_menu: bool,
    /// The timeout for the boot menu in seconds.
    pub menu_timeout: Option<u64>,
+    /// Retains the boot console before boot.
+    pub retain_boot_console: bool,
 }

 /// The default Sprout options.
@@ -33,102 +37,110 @@ impl Default for SproutOptions {
            boot: None,
            force_menu: false,
            menu_timeout: None,
+            retain_boot_console: false,
        }
    }
 }

 /// The options parser mechanism for Sprout.
-impl OptionsRepresentable for SproutOptions {
-    /// Produce the [SproutOptions] structure.
-    type Output = Self;
+impl SproutOptions {
+    /// Produces [SproutOptions] from the arguments provided by the UEFI core.
+    /// Internally, we use the `jaarg` argument parser which has excellent no_std support.
+    pub fn parse() -> Result<Self> {
+        enum ArgID {
+            Help,
+            AutoConfigure,
+            Config,
+            Boot,
+            ForceMenu,
+            MenuTimeout,
+            RetainBootConsole,
+        }

-    /// All the Sprout options that are defined.
-    fn options() -> &'static [(&'static str, OptionDescription<'static>)] {
-        &[
-            (
-                "autoconfigure",
-                OptionDescription {
-                    description: "Enable Sprout Autoconfiguration",
-                    form: OptionForm::Flag,
-                },
-            ),
-            (
-                "config",
-                OptionDescription {
-                    description: "Path to Sprout configuration file",
-                    form: OptionForm::Value,
-                },
-            ),
-            (
-                "boot",
-                OptionDescription {
-                    description: "Entry to boot, bypassing the menu",
-                    form: OptionForm::Value,
-                },
-            ),
-            (
-                "force-menu",
-                OptionDescription {
-                    description: "Force showing of the boot menu",
-                    form: OptionForm::Flag,
-                },
-            ),
-            (
-                "menu-timeout",
-                OptionDescription {
-                    description: "Boot menu timeout, in seconds",
-                    form: OptionForm::Value,
-                },
-            ),
-            (
-                "help",
-                OptionDescription {
-                    description: "Display Sprout Help",
-                    form: OptionForm::Help,
-                },
-            ),
-        ]
-    }
+        // All the options for the Sprout executable.
+        const OPTIONS: Opts<ArgID> = Opts::new(&[
+            Opt::help_flag(ArgID::Help, &["--help"]).help_text("Display Sprout Help"),
+            Opt::flag(ArgID::AutoConfigure, &["--autoconfigure"])
+                .help_text("Enable Sprout autoconfiguration"),
+            Opt::value(ArgID::Config, &["--config"], "PATH")
+                .help_text("Path to Sprout configuration file"),
+            Opt::value(ArgID::Boot, &["--boot"], "ENTRY")
+                .help_text("Entry to boot, bypassing the menu"),
+            Opt::flag(ArgID::ForceMenu, &["--force-menu"]).help_text("Force showing the boot menu"),
+            Opt::value(ArgID::MenuTimeout, &["--menu-timeout"], "TIMEOUT")
+                .help_text("Boot menu timeout, in seconds"),
+            Opt::flag(ArgID::RetainBootConsole, &["--retain-boot-console"])
+                .help_text("Retain boot console before boot"),
+        ]);
+
+        // Acquire the arguments as determined by the UEFI core.
+        let args = eficore::env::args()?;

-    /// Produces [SproutOptions] from the parsed raw `options` map.
-    fn produce(options: BTreeMap<String, Option<String>>) -> Result<Self> {
        // Use the default value of sprout options and have the raw options be parsed into it.
        let mut result = Self::default();

-        for (key, value) in options {
-            match key.as_str() {
-                "autoconfigure" => {
-                    // Enable autoconfiguration.
-                    result.autoconfigure = true;
+        // Parse the OPTIONS into a map using jaarg.
+        match OPTIONS.parse(
+            "sprout",
+            args.iter(),
+            |program_name, id, _opt, _name, value| {
+                match id {
+                    ArgID::AutoConfigure => {
+                        // Enable autoconfiguration.
+                        result.autoconfigure = true;
+                    }
+                    ArgID::Config => {
+                        // The configuration file to load.
+                        result.config = value.into();
+                    }
+                    ArgID::Boot => {
+                        // The entry to boot.
+                        result.boot = Some(value.into());
+                    }
+                    ArgID::ForceMenu => {
+                        // Force showing of the boot menu.
+                        result.force_menu = true;
+                    }
+                    ArgID::MenuTimeout => {
+                        // The timeout for the boot menu in seconds.
+                        result.menu_timeout = Some(value.parse::<u64>()?);
+                    }
+                    ArgID::RetainBootConsole => {
+                        // Retain the boot console before booting.
+                        result.retain_boot_console = true;
+                    }
+                    ArgID::Help => {
+                        let ctx = HelpWriterContext {
+                            options: &OPTIONS,
+                            program_name,
+                        };
+                        info!("{}", StandardFullHelpWriter::new(ctx));
+                        return Ok(ParseControl::Quit);
+                    }
                }
+                Ok(ParseControl::Continue)
+            },
+            |program_name, error| {
+                let ctx = ErrorUsageWriterContext {
+                    options: &OPTIONS,
+                    program_name,
+                    error,
+                };
+                error!("{}", StandardErrorUsageWriter::new(ctx));
+            },
+        ) {
+            ParseResult::ContinueSuccess => Ok(result),
+            ParseResult::ExitSuccess => unsafe {
+                uefi::boot::exit(uefi::boot::image_handle(), Status::SUCCESS, 0, null_mut())
+                    .context("unable to exit")?;
+                Err(anyhow!("unable to exit"))
+            },

-                "config" => {
-                    // The configuration file to load.
-                    result.config = value.context("--config option requires a value")?;
-                }
-
-                "boot" => {
-                    // The entry to boot.
-                    result.boot = Some(value.context("--boot option requires a value")?);
-                }
-
-                "force-menu" => {
-                    // Force showing of the boot menu.
-                    result.force_menu = true;
-                }
-
-                "menu-timeout" => {
-                    // The timeout for the boot menu in seconds.
-                    let value = value.context("--menu-timeout option requires a value")?;
-                    let value = value
-                        .parse::<u64>()
-                        .context("menu-timeout must be a number")?;
-                    result.menu_timeout = Some(value);
-                }
-
-                _ => bail!("unknown option: --{key}"),
-            }
+            ParseResult::ExitError => unsafe {
+                uefi::boot::exit(uefi::boot::image_handle(), Status::ABORTED, 0, null_mut())
+                    .context("unable to exit")?;
+                Err(anyhow!("unable to exit"))
+            },
        }
-        Ok(result)
    }
 }
@@ -1,153 +0,0 @@
-use alloc::collections::BTreeMap;
-use alloc::string::{String, ToString};
-use anyhow::{Context, Result, bail};
-use core::ptr::null_mut;
-use eficore::env;
-use log::info;
-use uefi_raw::Status;
-
-/// The type of option. This disambiguates different behavior
-/// of how options are handled.
-#[derive(Debug, Clone, Ord, PartialOrd, Eq, PartialEq)]
-pub enum OptionForm {
-    /// A flag, like --verbose.
-    Flag,
-    /// A value, in the form --abc 123 or --abc=123.
-    Value,
-    /// Help flag, like --help.
-    Help,
-}
-
-/// The description of an option, used in the option parser
-/// to make decisions about how to progress.
-#[derive(Debug, Clone)]
-pub struct OptionDescription<'a> {
-    /// The description of the option.
-    pub description: &'a str,
-    /// The type of option to parse as.
-    pub form: OptionForm,
-}
-
-/// Represents a type that can be parsed from command line arguments.
-/// This is a super minimal options parser mechanism just for Sprout.
-pub trait OptionsRepresentable {
-    /// The output type that parsing will produce.
-    type Output;
-
-    /// The configured options for this type. This should describe all the options
-    /// that are valid to produce the type. The left-hand side is the name of the option,
-    /// and the right-hand side is the description.
-    fn options() -> &'static [(&'static str, OptionDescription<'static>)];
-
-    /// Produces the type by taking the `options` and processing it into the output.
-    fn produce(options: BTreeMap<String, Option<String>>) -> Result<Self::Output>;
-
-    /// For minimalism, we don't want a full argument parser. Instead, we use
-    /// a simple --xyz = xyz: None and --abc 123 = abc: Some("123") format.
-    /// We also support the format: --abc=123
-    fn parse_raw() -> Result<BTreeMap<String, Option<String>>> {
-        // Access the configured options for this type.
-        let configured: BTreeMap<_, _> = BTreeMap::from_iter(Self::options().to_vec());
-
-        // Collect all the arguments to Sprout.
-        // Skip the first argument, which is the path to our executable.
-        let args = env::args()?;
-
-        // Represent options as key-value pairs.
-        let mut options = BTreeMap::new();
-
-        // Iterators makes this way easier.
-        let mut iterator = args.into_iter().peekable();
-
-        loop {
-            // Consume the next option, if any.
-            let Some(option) = iterator.next() else {
-                break;
-            };
-
-            // If the option doesn't start with --, that is invalid.
-            if !option.starts_with("--") {
-                bail!("invalid option: {option}");
-            }
-
-            // Strip the -- prefix off.
-            let mut option = option["--".len()..].trim().to_string();
-
-            // An optional value.
-            let mut value = None;
-
-            // Check if the option is of the form --abc=123
-            if let Some((part_key, part_value)) = option.split_once('=') {
-                let part_key = part_key.to_string();
-                let part_value = part_value.to_string();
-                option = part_key;
-                value = Some(part_value);
-            }
-
-            // Error on empty option names.
-            if option.is_empty() {
-                bail!("invalid empty option");
-            }
-
-            // Find the description of the configured option, if any.
-            let Some(description) = configured.get(option.as_str()) else {
-                bail!("invalid option: --{option}");
-            };
-
-            // Check if the option requires a value and error if none was provided.
-            if description.form == OptionForm::Value && value.is_none() {
-                // Check for the next value.
-                let maybe_next = iterator.peek();
-
-                // If the next value isn't another option, set the value to the next value.
-                // Otherwise, it is None.
-                value = if let Some(next) = maybe_next
-                    && !next.starts_with("--")
-                {
-                    iterator.next()
-                } else {
-                    None
-                };
-            }
-
-            // If the option form does not support a value and there is a value, error.
-            if description.form != OptionForm::Value && value.is_some() {
-                bail!("option --{} does not take a value", option);
-            }
-
-            // Handle the --help flag case.
-            if description.form == OptionForm::Help {
-                // Generic configured options output.
-                info!("Configured Options:");
-                for (name, description) in &configured {
-                    info!(
-                        "  --{}{}: {}",
-                        name,
-                        if description.form == OptionForm::Value {
-                            " <value>"
-                        } else {
-                            ""
-                        },
-                        description.description
-                    );
-                }
-                // Exit because the help has been displayed.
-                unsafe {
-                    uefi::boot::exit(uefi::boot::image_handle(), Status::SUCCESS, 0, null_mut());
-                };
-            }
-
-            // Insert the option and the value into the map.
-            options.insert(option, value);
-        }
-        Ok(options)
-    }
-
-    /// Parses the program arguments as a [Self::Output], calling [Self::parse_raw] and [Self::produce].
-    fn parse() -> Result<Self::Output> {
-        // Parse the program arguments into a raw map.
-        let options = Self::parse_raw().context("unable to parse options")?;
-        // Produce the options from the map.
-        Self::produce(options)
-    }
-}
@@ -6,7 +6,7 @@ use anyhow::{Context, Result};
 use edera_sprout_config::phases::PhaseConfiguration;

 /// Executes the specified [phase] of the boot process.
-/// The value [phase] should be a reference of a specific phase in the [PhasesConfiguration].
+/// The value [phase] should be a reference of a specific phase in the `PhasesConfiguration`.
 /// Any error from the actions is propagated into the [Result] and will interrupt further
 /// execution of phase actions.
 pub fn phase(context: Rc<SproutContext>, phase: &[PhaseConfiguration]) -> Result<()> {
@@ -24,3 +24,18 @@ pub fn phase(context: Rc<SproutContext>, phase: &[PhaseConfiguration]) -> Result
    }
    Ok(())
 }
+
+/// Manual hook called by code in the bootloader that hands off to another image.
+/// This is used to perform actions like clearing the screen.
+pub fn before_handoff(context: &SproutContext) -> Result<()> {
+    // If we have not been asked to retain the boot console, then we should clear the screen.
+    if !context.root().options().retain_boot_console {
+        // Clear the screen. We use clear here instead of reset because some firmware,
+        // particularly Dell firmware, does not clear the screen on reset.
+        // We clear both stdout and stderr because it's not guaranteed that they are the same
+        // text output.
+        uefi::system::with_stdout(|stdout| stdout.clear()).context("unable to clear screen")?;
+        uefi::system::with_stderr(|stderr| stderr.clear()).context("unable to clear screen")?;
+    }
+    Ok(())
+}
@@ -1,26 +0,0 @@
-use alloc::string::{String, ToString};
-use alloc::vec::Vec;
-use sha2::{Digest, Sha256};
-
-/// Implements a version comparison algorithm according to the BLS specification.
-pub mod vercmp;
-
-/// Combine a sequence of strings into a single string, separated by spaces, ignoring empty strings.
-pub fn combine_options<T: AsRef<str>>(options: impl Iterator<Item = T>) -> String {
-    options
-        .flat_map(|item| empty_is_none(Some(item)))
-        .map(|item| item.as_ref().to_string())
-        .collect::<Vec<_>>()
-        .join(" ")
-}
-
-/// Produce a unique hash for the input.
-/// This uses SHA-256, which is unique enough but relatively short.
-pub fn unique_hash(input: &str) -> String {
-    hex::encode(Sha256::digest(input.as_bytes()))
-}
-
-/// Filter a string-like Option `input` such that an empty string is [None].
-pub fn empty_is_none<T: AsRef<str>>(input: Option<T>) -> Option<T> {
-    input.filter(|input| !input.as_ref().is_empty())
-}
@@ -1,184 +0,0 @@
-use core::cmp::Ordering;
-use core::iter::Peekable;
-
-/// Handles single character advancement and comparison.
-macro_rules! handle_single_char {
-    ($ca: expr, $cb:expr, $a_chars:expr, $b_chars:expr, $c:expr) => {
-        match ($ca == $c, $cb == $c) {
-            (true, false) => return Ordering::Less,
-            (false, true) => return Ordering::Greater,
-            (true, true) => {
-                $a_chars.next();
-                $b_chars.next();
-                continue;
-            }
-            _ => {}
-        }
-    };
-}
-
-/// Compares two strings using the BLS version comparison specification.
-/// Handles optional values as well by comparing only if both are specified.
-pub fn compare_versions_optional(a: Option<&str>, b: Option<&str>) -> Ordering {
-    match (a, b) {
-        // If both have values, compare them.
-        (Some(a), Some(b)) => compare_versions(a, b),
-        // If the second value is None, then `a` is less than `b`.
-        (Some(_a), None) => Ordering::Less,
-        // If the first value is None, the `a` is greater than `b`.
-        (None, Some(_b)) => Ordering::Greater,
-        // If both values are None, return that they are equal.
-        (None, None) => Ordering::Equal,
-    }
-}
-
-/// Compares two strings using the BLS version comparison specification.
-/// See: https://uapi-group.org/specifications/specs/version_format_specification/
-pub fn compare_versions(a: &str, b: &str) -> Ordering {
-    // Acquire a peekable iterator for each string.
-    let mut a_chars = a.chars().peekable();
-    let mut b_chars = b.chars().peekable();
-
-    // Loop until we have reached the end of one of the strings.
-    loop {
-        // Skip invalid characters in both strings.
-        skip_invalid(&mut a_chars);
-        skip_invalid(&mut b_chars);
-
-        // Check if either string has ended.
-        match (a_chars.peek(), b_chars.peek()) {
-            // No more characters in either string.
-            (None, None) => return Ordering::Equal,
-            // One string has ended, the other hasn't.
-            (None, Some(_)) => return Ordering::Less,
-            (Some(_), None) => return Ordering::Greater,
-            // Both strings have characters left.
-            (Some(&ca), Some(&cb)) => {
-                // Handle the ~ character.
-                handle_single_char!(ca, cb, a_chars, b_chars, '~');
-
-                // Handle '-' character.
-                handle_single_char!(ca, cb, a_chars, b_chars, '-');
-
-                // Handle the '^' character.
-                handle_single_char!(ca, cb, a_chars, b_chars, '^');
-
-                // Handle the '.' character.
-                handle_single_char!(ca, cb, a_chars, b_chars, '.');
-
-                // Handle digits with numerical comparison.
-                // We key off of the A character being a digit intentionally as we presume
-                // this indicates it will be the same at this position.
-                if ca.is_ascii_digit() || cb.is_ascii_digit() {
-                    let result = compare_numeric(&mut a_chars, &mut b_chars);
-                    if result != Ordering::Equal {
-                        return result;
-                    }
-                    continue;
-                }
-
-                // Handle letters with alphabetical comparison.
-                // We key off of the A character being alphabetical intentionally as we presume
-                // this indicates it will be the same at this position.
-                if ca.is_ascii_alphabetic() || cb.is_ascii_alphabetic() {
-                    let result = compare_alphabetic(&mut a_chars, &mut b_chars);
-                    if result != Ordering::Equal {
-                        return result;
-                    }
-                    continue;
-                }
-            }
-        }
-    }
-}
-
-/// Skips characters that are not in the valid character set.
-fn skip_invalid<I: Iterator<Item = char>>(iter: &mut Peekable<I>) {
-    while let Some(&c) = iter.peek() {
-        if is_valid_char(c) {
-            break;
-        }
-        iter.next();
-    }
-}
-
-/// Checks if a character is in the valid character set for comparison.
-fn is_valid_char(c: char) -> bool {
-    matches!(c, 'a'..='z' | 'A'..='Z' | '0'..='9' | '-' | '.' | '~' | '^')
-}
-
-/// Compares numerical prefixes by extracting numbers.
-fn compare_numeric<I: Iterator<Item = char>>(
-    iter_a: &mut Peekable<I>,
-    iter_b: &mut Peekable<I>,
-) -> Ordering {
-    let num_a = extract_number(iter_a);
-    let num_b = extract_number(iter_b);
-
-    num_a.cmp(&num_b)
-}
-
-/// Extracts a number from the iterator, skipping leading zeros.
-fn extract_number<I: Iterator<Item = char>>(iter: &mut Peekable<I>) -> u64 {
-    // Skip leading zeros
-    while let Some(&'0') = iter.peek() {
-        iter.next();
-    }
-
-    let mut num = 0u64;
-    while let Some(&c) = iter.peek() {
-        if c.is_ascii_digit() {
-            iter.next();
-            num = num.saturating_mul(10).saturating_add(c as u64 - '0' as u64);
-        } else {
-            break;
-        }
-    }
-
-    num
-}
-
-/// Compares alphabetical prefixes
-/// Capital letters compare lower than lowercase letters (B < a)
-fn compare_alphabetic<I: Iterator<Item = char>>(
-    iter_a: &mut Peekable<I>,
-    iter_b: &mut Peekable<I>,
-) -> Ordering {
-    loop {
-        return match (iter_a.peek(), iter_b.peek()) {
-            (Some(&ca), Some(&cb)) if ca.is_ascii_alphabetic() && cb.is_ascii_alphabetic() => {
-                if ca == cb {
-                    // Same character, we should continue.
-                    iter_a.next();
-                    iter_b.next();
-                    continue;
-                }
-
-                // Different characters found.
-                // All capital letters compare lower than lowercase letters.
-                match (ca.is_ascii_uppercase(), cb.is_ascii_uppercase()) {
-                    (true, false) => Ordering::Less,    // uppercase < lowercase
-                    (false, true) => Ordering::Greater, // lowercase > uppercase
-                    (true, true) => ca.cmp(&cb),        // both are uppercase
-                    (false, false) => ca.cmp(&cb),      // both are lowercase
-                }
-            }
-
-            (Some(&ca), Some(_)) if ca.is_ascii_alphabetic() => {
-                // a has letters, b doesn't
-                Ordering::Greater
-            }
-
-            (Some(_), Some(&cb)) if cb.is_ascii_alphabetic() => {
-                // b has letters, a doesn't
-                Ordering::Less
-            }
-
-            (Some(&ca), None) if ca.is_ascii_alphabetic() => Ordering::Greater,
-
-            (None, Some(&cb)) if cb.is_ascii_alphabetic() => Ordering::Less,
-
-            _ => Ordering::Equal,
-        };
-    }
-}
@@ -1,5 +1,5 @@
 /// Define the SBAT attestation by including the sbat.csv file.
-/// See this document for more details: https://github.com/rhboot/shim/blob/main/SBAT.md
+/// See this document for more details: <https://github.com/rhboot/shim/blob/main/SBAT.md>
 /// NOTE: This data must be aligned by 512 bytes.
 #[used]
 #[unsafe(link_section = ".sbat")]
@@ -13,7 +13,7 @@ pub struct ChainloadConfiguration {
    #[serde(default)]
    pub options: Vec<String>,
    /// An optional path to a Linux initrd.
-    /// This uses the [LINUX_EFI_INITRD_MEDIA_GUID] mechanism to load the initrd into the EFI stack.
+    /// This uses the `LINUX_EFI_INITRD_MEDIA_GUID` mechanism to load the initrd into the EFI stack.
    /// For Linux, you can also use initrd=\path\to\initrd as an option, but this option is
    /// generally better and safer as it can support additional load options in the future.
    #[serde(default, rename = "linux-initrd")]
@@ -18,4 +18,7 @@ pub struct EntryDeclaration {
    /// The values to insert into the context when the entry is selected.
    #[serde(default)]
    pub values: BTreeMap<String, String>,
+    /// The key to sort entries, via version comparison.
+    #[serde(default, rename = "sort-key")]
+    pub sort_key: Option<String>,
 }
@@ -78,8 +78,7 @@ pub struct RootConfiguration {
 /// Options configuration for Sprout, used when the corresponding options are not specified.
 #[derive(Serialize, Deserialize, Debug, Default, Clone)]
 pub struct OptionsConfiguration {
-    /// The entry to boot without showing the boot menu.
-    /// If not specified, a boot menu is shown.
+    /// The entry to mark as the default entry, instead of the first entry.
    #[serde(rename = "default-entry", default)]
    pub default_entry: Option<String>,
    /// The timeout of the boot menu.
@@ -19,3 +19,4 @@ uefi-raw.workspace = true
 [lib]
 name = "eficore"
 path = "src/lib.rs"
+test = false
@@ -5,6 +5,7 @@ use alloc::format;
 use alloc::string::{String, ToString};
 use alloc::vec::Vec;
 use anyhow::{Context, Result};
+use log::warn;
 use uefi::proto::device_path::DevicePath;
 use uefi::{Guid, guid};
 use uefi_raw::table::runtime::VariableVendor;
@@ -245,9 +246,14 @@ impl BootloaderInterface {
        }

        // Parse the value as a u64 to decode an numeric value.
-        let value = value
-            .parse::<u64>()
-            .context("unable to parse timeout value")?;
+        // An invalid value is ignored, as a bad variable should not prevent booting.
+        let value = match value.parse::<u64>() {
+            Ok(value) => value,
+            Err(error) => {
+                warn!("ignoring invalid {} value '{}': {}", key, value, error);
+                return Ok(None);
+            }
+        };

        // The specification says that a value of 0 means that the menu should be hidden.
        if value == 0 {
@@ -289,9 +295,11 @@ impl BootloaderInterface {

    /// Get the default entry set by the bootloader interface.
    pub fn get_default_entry() -> Result<Option<String>> {
-        Self::VENDOR
+        // An empty value is treated as if the default entry was not set.
+        Ok(Self::VENDOR
            .get_cstr16("LoaderEntryDefault")
-            .context("unable to get default entry from bootloader interface")
+            .context("unable to get default entry from bootloader interface")?
+            .filter(|value| !value.is_empty()))
    }

    /// Get the oneshot entry set by the bootloader interface.
@@ -312,6 +320,7 @@ impl BootloaderInterface {
            .context("unable to remove oneshot entry")?;

        // Return the oneshot value.
-        Ok(Some(value))
+        // An empty value is treated as if the oneshot entry was not set.
+        Ok(Some(value).filter(|value| !value.is_empty()))
    }
 }
@@ -52,7 +52,7 @@ pub fn args() -> Result<Vec<String>> {
                .next()
                // Filter out unprintable characters and backticks.
                // Both of which have been observed in the wild.
-                .map(|c| c < 0x1f as char || c == '`')
+                .map(|c| c.is_ascii_control() || c == '`')
                .unwrap_or(false)
        })
        .collect();
@@ -1,5 +1,8 @@
-//! Sprout EFI Core.
-//! This crate provides tools for working with the EFI environment.
+//! Sprout EFI core.
+//! This crate provides core EFI functionality for Sprout.
+
+// For some reason this triggers, and I can't figure out why.
+#![allow(rustdoc::bare_urls)]
 #![no_std]
 extern crate alloc;

@@ -83,16 +83,6 @@ impl ImageLoader {
        // If the image loader is installed, we can skip over the security hook.
        let requires_security_hook = secure_boot && shim_loaded && !shim_loader_available;

-        // If the security hook is required, we will bail for now.
-        if requires_security_hook {
-            // Install the security hook, if possible. If it's not, this is necessary to continue,
-            // so we should bail.
-            let installed = SecurityHook::install().context("unable to install security hook")?;
-            if !installed {
-                bail!("unable to install security hook required for this platform");
-            }
-        }
-
        // If the shim is loaded, we will need to retain the shim protocol to allow
        // loading multiple images.
        if shim_loaded {
@@ -114,6 +104,18 @@ impl ImageLoader {
            file_path: input.file_path(),
        };

+        // If the security hook is required, install it right before loading the image.
+        // Installing it here ensures that an error while preparing the image can't
+        // return without uninstalling the hook.
+        if requires_security_hook {
+            // Install the security hook, if possible. If it's not, this is necessary to continue,
+            // so we should bail.
+            let installed = SecurityHook::install().context("unable to install security hook")?;
+            if !installed {
+                bail!("unable to install security hook required for this platform");
+            }
+        }
+
        // Loads the image using Boot Services LoadImage function.
        let result = uefi::boot::load_image(current_image, source).context("unable to load image");

@@ -3,6 +3,7 @@ use alloc::vec::Vec;
 use anyhow::{Context, Result, bail};
 use core::ffi::c_void;
 use core::ptr;
+use log::error;
 use uefi::proto::device_path::DevicePath;
 use uefi::proto::device_path::build::DevicePathBuilder;
 use uefi::proto::device_path::build::media::Vendor;
@@ -33,8 +34,7 @@ struct MediaLoaderProtocol {
 }

 /// Represents a media loader which has been registered in the UEFI stack.
-/// You MUST call [MediaLoaderHandle::unregister] when ready to unregister.
-/// [Drop] is not implemented for this type.
+/// Calling `drop` on this handle will unregister the media loader.
 pub struct MediaLoaderHandle {
    /// The handle of the media loader in the UEFI stack.
    handle: Handle,
@@ -255,7 +255,7 @@ impl MediaLoaderHandle {

    /// Unregisters a media loader from the UEFI stack.
    /// This will free the memory allocated by the passed data.
-    pub fn unregister(self) -> Result<()> {
+    fn unregister(&self) -> Result<()> {
        // SAFETY: We know that the media loader is registered if the handle is valid,
        // so we can safely uninstall it.
        // We should have allocated the pointers involved, so we can safely free them.
@@ -293,3 +293,14 @@ impl MediaLoaderHandle {
        Ok(())
    }
 }
+
+/// Implement drop for the handle to automatically unregister the media loader.
+impl Drop for MediaLoaderHandle {
+    fn drop(&mut self) {
+        // If unregister fails, print an error to the log.
+        // This may leak stuff, but the only other option is to panic.
+        if let Err(error) = self.unregister() {
+            error!("unable to unregister media loader: {}", error);
+        }
+    }
+}
@@ -34,7 +34,7 @@ impl ResolvedPath {
        let mut fs = FileSystem::new(fs);
        let path = self
            .sub_path
-            .to_string(DisplayOnly(false), AllowShortcuts(false))?;
+            .to_string16(DisplayOnly(false), AllowShortcuts(false))?;
        let content = fs.read(Path::new(&path));
        content.context("unable to read file contents")
    }
@@ -48,8 +48,8 @@ fn cstring16_contains_char(string: &CString16, c: char) -> bool {

 /// Parses the input `path` as a [DevicePath].
 /// Uses the [DevicePathFromText] protocol exclusively, and will fail if it cannot acquire the protocol.
-pub fn text_to_device_path(path: &str) -> Result<PoolDevicePath> {
-    let path = CString16::try_from(path).context("unable to convert path to CString16")?;
+pub fn text_to_device_path(path: impl AsRef<str>) -> Result<PoolDevicePath> {
+    let path = CString16::try_from(path.as_ref()).context("unable to convert path to CString16")?;
    let device_path_from_text = uefi::boot::open_protocol_exclusive::<DevicePathFromText>(
        uefi::boot::get_handle_for_protocol::<DevicePathFromText>()
            .context("no device path from text protocol")?,
@@ -68,7 +68,7 @@ pub fn device_path_root(path: &DevicePath) -> Result<String> {
    let mut path = path
        .node_iter()
        .filter_map(|item| {
-            let item = item.to_string(DisplayOnly(false), AllowShortcuts(false));
+            let item = item.to_string16(DisplayOnly(false), AllowShortcuts(false));
            if item
                .as_ref()
                .map(|item| cstring16_contains_char(item, '('))
@@ -93,7 +93,7 @@ pub fn device_path_subpath(path: &DevicePath) -> Result<String> {
    let path = path
        .node_iter()
        .filter_map(|item| {
-            let item = item.to_string(DisplayOnly(false), AllowShortcuts(false));
+            let item = item.to_string16(DisplayOnly(false), AllowShortcuts(false));
            if item
                .as_ref()
                .map(|item| cstring16_contains_char(item, '('))
@@ -113,19 +113,23 @@ pub fn device_path_subpath(path: &DevicePath) -> Result<String> {
 /// Resolve a path specified by `input` to its various components.
 /// Uses `default_root_path` as the base root if one is not specified in the path.
 /// Returns [ResolvedPath] which contains the resolved components.
-pub fn resolve_path(default_root_path: Option<&DevicePath>, input: &str) -> Result<ResolvedPath> {
-    let mut path = text_to_device_path(input).context("unable to convert text to path")?;
+pub fn resolve_path(
+    default_root_path: Option<&DevicePath>,
+    input: impl ToString,
+) -> Result<ResolvedPath> {
+    let mut input = input.to_string();
+
+    let mut path = text_to_device_path(&input).context("unable to convert text to path")?;
    let path_has_device = path
        .node_iter()
        .next()
        .map(|it| {
-            it.to_string(DisplayOnly(false), AllowShortcuts(false))
+            it.to_string16(DisplayOnly(false), AllowShortcuts(false))
                .unwrap_or_default()
        })
        .map(|it| it.to_string().contains('('))
        .unwrap_or(false);
    if !path_has_device {
-        let mut input = input.to_string();
        if !input.starts_with('\\') {
            input.insert(0, '\\');
        }
@@ -38,6 +38,15 @@ impl PlatformTpm {
    /// The PCR for measuring the bootloader configuration into.
    pub const PCR_BOOT_LOADER_CONFIG: PcrIndex = PcrIndex(5);

+    /// The PCR for measuring the dom0 initrd payload into.
+    pub const PCR_INITRD: PcrIndex = PcrIndex(9);
+
+    /// The PCR for measuring the dom0 kernel payload into.
+    pub const PCR_KERNEL: PcrIndex = PcrIndex(11);
+
+    /// The PCR for measuring kernel command line and xen options into.
+    pub const PCR_KERNEL_PARAMETERS: PcrIndex = PcrIndex(12);
+
    /// Acquire access to the TPM protocol handle, if possible.
    /// Returns None if TPM is not available.
    fn protocol() -> Result<Option<TpmProtocolHandle>> {
@@ -82,9 +82,9 @@ impl<'a> ShimInput<'a> {
                };
                // Convert the underlying path to a string.
                let path = path
-                    .to_string(DisplayOnly(false), AllowShortcuts(false))
+                    .to_string16(DisplayOnly(false), AllowShortcuts(false))
                    .context("unable to convert device path to string")?;
-                let path = crate::path::resolve_path(None, &path.to_string())
+                let path = crate::path::resolve_path(None, path.to_string())
                    .context("unable to resolve path")?;
                // Read the file path.
                let data = path.read_file()?;
@@ -2,11 +2,11 @@ use crate::shim::{ShimInput, ShimSupport, ShimVerificationOutput};
 use anyhow::{Context, Result};
 use core::slice;
 use log::warn;
-use spin::{Lazy, Mutex};
+use spin::{LazyLock, Mutex};
 use uefi::proto::device_path::FfiDevicePath;
 use uefi::proto::unsafe_protocol;
 use uefi::{Guid, guid};
-use uefi_raw::Status;
+use uefi_raw::{Boolean, Status};

 /// GUID for the EFI_SECURITY_ARCH protocol.
 const SECURITY_ARCH_GUID: Guid = guid!("a46423e3-4617-49f1-b9ff-d1bfa9115839");
@@ -33,7 +33,7 @@ pub struct SecurityArch2Protocol {
        path: *const FfiDevicePath,
        file_buffer: *const u8,
        file_size: usize,
-        boot_policy: bool,
+        boot_policy: Boolean,
    ) -> Status,
 }

@@ -45,7 +45,8 @@ struct SecurityHookState {

 /// Global state for the security hook.
 /// This is messy, but it is safe given the mutex.
-static GLOBAL_HOOK_STATE: Lazy<Mutex<Option<SecurityHookState>>> = Lazy::new(|| Mutex::new(None));
+static GLOBAL_HOOK_STATE: LazyLock<Mutex<Option<SecurityHookState>>> =
+    LazyLock::new(|| Mutex::new(None));

 /// Security hook helper.
 pub struct SecurityHook;
@@ -136,7 +137,7 @@ impl SecurityHook {
        path: *const FfiDevicePath,
        file_buffer: *const u8,
        file_size: usize,
-        boot_policy: bool,
+        boot_policy: Boolean,
    ) -> Status {
        // Verify the path and file buffer are not null.
        if path.is_null() || file_buffer.is_null() {
@@ -144,7 +145,7 @@ impl SecurityHook {
        }

        // If the boot policy is true, we can't continue as we don't support that.
-        if boot_policy {
+        if bool::from(boot_policy) {
            return Status::INVALID_PARAMETER;
        }

@@ -215,6 +216,13 @@ impl SecurityHook {

        // Acquire the lock to the global state and replace it.
        let mut global_state = GLOBAL_HOOK_STATE.lock();
+
+        // If the hook is already installed, the protocols contain our hooks.
+        // Storing them as the original hooks would cause infinite recursion on
+        // verification failure, so keep the existing state instead.
+        if global_state.is_some() {
+            return Ok(true);
+        }
        global_state.replace(state);

        // Install the hooks into the UEFI stack.
@@ -10,13 +10,21 @@ pub fn utf16_bytes_to_cstring16(bytes: &[u8]) -> Result<CString16> {
    }

    // Convert the bytes to UTF-16 data.
-    let data = bytes
+    let mut data = bytes
        // Chunk everything into two bytes.
-        .chunks_exact(2)
+        .as_chunks::<2>()
+        .0
+        .iter()
        // Reinterpret the bytes as u16 little-endian.
        .map(|chunk| u16::from_le_bytes([chunk[0], chunk[1]]))
+        // Stop at the first null terminator, if any.
+        // This ignores any trailing data, such as extra null padding.
+        .take_while(|c| *c != 0)
        // Collect the result into a vector.
        .collect::<Vec<_>>();

+    // Add the null terminator, as the input is not guaranteed to be null-terminated.
+    data.push(0);
+
    CString16::try_from(data).context("unable to convert utf16 bytes to CString16")
 }
@@ -0,0 +1,19 @@
+# This crate explicitly does not have uefi/uefi-raw dependencies,
+# so that the contents can be unit-testable on non-UEFI target hosts.
+# Do not add uefi or uefi-raw as dependencies.
+[package]
+name = "edera-sprout-parsing"
+description = "Sprout Parsing Utilities (UEFI-free)"
+license.workspace = true
+version.workspace = true
+homepage.workspace = true
+repository.workspace = true
+edition.workspace = true
+
+[dependencies]
+hex.workspace = true
+sha2.workspace = true
+
+[lib]
+name = "edera_sprout_parsing"
+path = "src/lib.rs"
@@ -0,0 +1,417 @@
+#![no_std]
+extern crate alloc;
+
+use alloc::collections::BTreeMap;
+use alloc::format;
+use alloc::string::{String, ToString};
+use alloc::vec::Vec;
+use core::cmp::Reverse;
+use sha2::{Digest, Sha256};
+
+/// Stamps the `text` value with the specified `values` map. The returned value indicates
+/// whether the `text` has been changed and the value that was stamped and changed.
+///
+/// Stamping works like this:
+/// - Start with the input text.
+/// - Sort all the keys in reverse length order (longest keys first)
+/// - For each key, if the key is not empty, replace $KEY in the text.
+/// - Each follow-up iteration acts upon the last iterations result.
+/// - We keep track if the text changes during the replacement.
+/// - We return both whether the text changed during any iteration and the final result.
+pub fn stamp_values(values: &BTreeMap<String, String>, text: impl AsRef<str>) -> (bool, String) {
+    let mut result = text.as_ref().to_string();
+    let mut did_change = false;
+
+    // Sort the keys by length. This is to ensure that we stamp the longest keys first.
+    // If we did not do this, "$abc" could be stamped by "$a" into an invalid result.
+    let mut keys = values.keys().collect::<Vec<_>>();
+
+    // Sort by key length, reversed. This results in the longest keys appearing first.
+    keys.sort_by_key(|key| Reverse(key.len()));
+
+    for key in keys {
+        // Empty keys are not supported.
+        if key.is_empty() {
+            continue;
+        }
+
+        // We can fetch the value from the map. It is verifiable that the key exists.
+        let Some(value) = values.get(key) else {
+            unreachable!("keys iterated over is collected on a map that cannot be modified");
+        };
+
+        let next_result = result.replace(&format!("${key}"), value);
+        if result != next_result {
+            did_change = true;
+        }
+        result = next_result;
+    }
+    (did_change, result)
+}
+
+/// Builds out multiple generations of `input` based on a matrix style.
+/// For example, if input is: {"x": ["a", "b"], "y": ["c", "d"]}
+/// It will produce:
+/// x: a, y: c
+/// x: a, y: d
+/// x: b, y: c
+/// x: b, y: d
+pub fn build_matrix(input: &BTreeMap<String, Vec<String>>) -> Vec<BTreeMap<String, String>> {
+    // Convert the input into a vector of tuples.
+    let items: Vec<(String, Vec<String>)> = input.clone().into_iter().collect();
+
+    // The result is a vector of maps.
+    let mut result: Vec<BTreeMap<String, String>> = alloc::vec![BTreeMap::new()];
+
+    for (key, values) in items {
+        let mut new_result = Vec::new();
+
+        // Produce all the combinations of the input values.
+        for combination in &result {
+            for value in &values {
+                let mut new_combination = combination.clone();
+                new_combination.insert(key.clone(), value.clone());
+                new_result.push(new_combination);
+            }
+        }
+
+        result = new_result;
+    }
+
+    result.into_iter().filter(|item| !item.is_empty()).collect()
+}
+
+/// Combine a sequence of strings into a single string, separated by spaces, ignoring empty strings.
+pub fn combine_options<T: AsRef<str>>(options: impl Iterator<Item = T>) -> String {
+    options
+        .flat_map(|item| empty_is_none(Some(item)))
+        .map(|item| item.as_ref().to_string())
+        .collect::<Vec<_>>()
+        .join(" ")
+}
+
+/// Produce a unique hash for the input.
+/// This uses SHA-256, which is unique enough but relatively short.
+pub fn unique_hash(input: &str) -> String {
+    hex::encode(Sha256::digest(input.as_bytes()))
+}
+
+/// Filter a string-like Option `input` such that an empty string is [None].
+pub fn empty_is_none<T: AsRef<str>>(input: Option<T>) -> Option<T> {
+    input.filter(|input| !input.as_ref().is_empty())
+}
+
+/// Build a Xen EFI stub configuration file from pre-stamped `xen_options` and `kernel_options`.
+/// The returned string is in the Xen ini-like config file format.
+pub fn build_xen_config(xen_options: &str, kernel_options: &str) -> String {
+    [
+        // global section
+        "[global]",
+        // default configuration section
+        "default=sprout",
+        // configuration section for sprout
+        "[sprout]",
+        // xen options
+        &format!("options={}", xen_options),
+        // kernel options, stub replaces the kernel path
+        // the kernel is provided via media loader
+        &format!("kernel=stub {}", kernel_options),
+        // required or else the last line will be ignored
+        "",
+    ]
+    .join("\n")
+}
+
+/// Filename prefixes used to identify Linux kernel images.
+/// These must be lowercase, as file names are lowercased before matching.
+pub const LINUX_KERNEL_PREFIXES: &[&str] = &["vmlinuz", "image"];
+
+/// Filename prefixes used to identify initramfs images paired with a kernel.
+pub const LINUX_INITRAMFS_PREFIXES: &[&str] = &["initramfs", "initrd", "initrd.img"];
+
+/// Check whether `name` (already lowercased) matches one of the `kernel_prefixes`,
+/// either exactly or as a dash-separated prefix (e.g. `"vmlinuz-6.1"`).
+/// Returns the matched prefix string if found.
+pub fn match_kernel_prefix<'a>(name: &str, kernel_prefixes: &[&'a str]) -> Option<&'a str> {
+    kernel_prefixes
+        .iter()
+        .find(|prefix| name == **prefix || name.starts_with(&format!("{}-", prefix)))
+        .copied()
+}
+
+/// Generate initramfs candidate filenames by combining each entry of `initramfs_prefixes`
+/// with `suffix`. The caller is expected to check which candidates actually exist.
+pub fn initramfs_candidates<'a>(
+    suffix: &'a str,
+    initramfs_prefixes: &'a [&'a str],
+) -> impl Iterator<Item = String> + 'a {
+    initramfs_prefixes
+        .iter()
+        .map(move |prefix| format!("{}{}", prefix, suffix))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn map(pairs: &[(&str, &str)]) -> BTreeMap<String, String> {
+        pairs
+            .iter()
+            .map(|(k, v)| (k.to_string(), v.to_string()))
+            .collect()
+    }
+
+    #[test]
+    fn stamp_replaces_known_key() {
+        let values = map(&[("name", "world")]);
+        let (changed, result) = stamp_values(&values, "hello $name");
+        assert!(changed);
+        assert_eq!(result, "hello world");
+    }
+
+    #[test]
+    fn stamp_no_match_returns_unchanged() {
+        let values = map(&[("name", "world")]);
+        let (changed, result) = stamp_values(&values, "hello there");
+        assert!(!changed);
+        assert_eq!(result, "hello there");
+    }
+
+    #[test]
+    fn stamp_longer_key_takes_precedence_over_shorter() {
+        // Without longest-first ordering, "$ab" would be partially matched by "$a"
+        let values = map(&[("a", "WRONG"), ("ab", "RIGHT")]);
+        let (changed, result) = stamp_values(&values, "$ab");
+        assert!(changed);
+        assert_eq!(result, "RIGHT");
+    }
+
+    #[test]
+    fn stamp_empty_key_is_skipped() {
+        let values = map(&[("", "should-not-appear"), ("x", "val")]);
+        let (_, result) = stamp_values(&values, "$x");
+        assert_eq!(result, "val");
+        assert!(!result.contains("should-not-appear"));
+    }
+
+    #[test]
+    fn stamp_multiple_keys_replaced() {
+        let values = map(&[("a", "foo"), ("b", "bar")]);
+        let (changed, result) = stamp_values(&values, "$a and $b");
+        assert!(changed);
+        assert_eq!(result, "foo and bar");
+    }
+
+    #[test]
+    fn stamp_empty_text_returns_empty() {
+        let values = map(&[("a", "foo")]);
+        let (changed, result) = stamp_values(&values, "");
+        assert!(!changed);
+        assert_eq!(result, "");
+    }
+
+    #[test]
+    fn stamp_empty_map_returns_unchanged() {
+        let values = map(&[]);
+        let (changed, result) = stamp_values(&values, "hello $name");
+        assert!(!changed);
+        assert_eq!(result, "hello $name");
+    }
+
+    fn matrix_map(pairs: &[(&str, &[&str])]) -> BTreeMap<String, Vec<String>> {
+        pairs
+            .iter()
+            .map(|(k, vs)| (k.to_string(), vs.iter().map(|v| v.to_string()).collect()))
+            .collect()
+    }
+
+    #[test]
+    fn matrix_single_key_produces_one_entry_per_value() {
+        let input = matrix_map(&[("x", &["a", "b", "c"])]);
+        let result = build_matrix(&input);
+        assert_eq!(result.len(), 3);
+    }
+
+    #[test]
+    fn matrix_two_keys_produces_cartesian_product() {
+        let input = matrix_map(&[("x", &["a", "b"]), ("y", &["c", "d"])]);
+        let result = build_matrix(&input);
+        assert_eq!(result.len(), 4);
+        // Every combination of x and y should be present.
+        for x in &["a", "b"] {
+            for y in &["c", "d"] {
+                assert!(
+                    result
+                        .iter()
+                        .any(|m| m.get("x").map(|s| s.as_str()) == Some(x)
+                            && m.get("y").map(|s| s.as_str()) == Some(y))
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn matrix_empty_input_produces_no_entries() {
+        let input = matrix_map(&[]);
+        let result = build_matrix(&input);
+        assert!(result.is_empty());
+    }
+
+    #[test]
+    fn matrix_key_with_empty_values_produces_no_entries() {
+        let input = matrix_map(&[("x", &[])]);
+        let result = build_matrix(&input);
+        assert!(result.is_empty());
+    }
+
+    #[test]
+    fn combine_options_joins_with_space() {
+        let result = combine_options(["a", "b", "c"].iter().copied());
+        assert_eq!(result, "a b c");
+    }
+
+    #[test]
+    fn combine_options_skips_empty_strings() {
+        let result = combine_options(["a", "", "b"].iter().copied());
+        assert_eq!(result, "a b");
+    }
+
+    #[test]
+    fn combine_options_all_empty_returns_empty() {
+        let result = combine_options(["", ""].iter().copied());
+        assert_eq!(result, "");
+    }
+
+    #[test]
+    fn combine_options_empty_iterator_returns_empty() {
+        let result = combine_options(core::iter::empty::<&str>());
+        assert_eq!(result, "");
+    }
+
+    #[test]
+    fn empty_is_none_returns_none_for_empty_string() {
+        assert!(empty_is_none(Some("")).is_none());
+    }
+
+    #[test]
+    fn empty_is_none_returns_some_for_nonempty_string() {
+        assert_eq!(empty_is_none(Some("x")), Some("x"));
+    }
+
+    #[test]
+    fn empty_is_none_passthrough_on_none() {
+        assert!(empty_is_none(None::<&str>).is_none());
+    }
+
+    #[test]
+    fn unique_hash_is_deterministic() {
+        assert_eq!(unique_hash("hello"), unique_hash("hello"));
+    }
+
+    #[test]
+    fn unique_hash_differs_for_different_inputs() {
+        assert_ne!(unique_hash("hello"), unique_hash("world"));
+    }
+
+    #[test]
+    fn unique_hash_empty_string() {
+        // SHA-256 of "" is well-known; just check it produces a non-empty hex string.
+        let h = unique_hash("");
+        assert!(!h.is_empty());
+        assert!(h.chars().all(|c| c.is_ascii_hexdigit()));
+    }
+
+    #[test]
+    fn xen_config_contains_global_and_sprout_sections() {
+        let config = build_xen_config("", "");
+        assert!(config.contains("[global]"));
+        assert!(config.contains("[sprout]"));
+        assert!(config.contains("default=sprout"));
+    }
+
+    #[test]
+    fn xen_config_embeds_xen_options() {
+        let config = build_xen_config("--no-real-mode --iommu=no", "");
+        assert!(config.contains("options=--no-real-mode --iommu=no"));
+    }
+
+    #[test]
+    fn xen_config_embeds_kernel_options() {
+        let config = build_xen_config("", "quiet splash");
+        assert!(config.contains("kernel=stub quiet splash"));
+    }
+
+    #[test]
+    fn xen_config_ends_with_newline() {
+        // Required or the last line will be ignored by the Xen config parser.
+        let config = build_xen_config("", "");
+        assert!(config.ends_with('\n'));
+    }
+
+    #[test]
+    fn kernel_prefix_exact_match() {
+        assert_eq!(
+            match_kernel_prefix("vmlinuz", LINUX_KERNEL_PREFIXES),
+            Some("vmlinuz")
+        );
+    }
+
+    #[test]
+    fn kernel_prefix_dash_suffix_match() {
+        assert_eq!(
+            match_kernel_prefix("vmlinuz-6.1.0", LINUX_KERNEL_PREFIXES),
+            Some("vmlinuz")
+        );
+    }
+
+    #[test]
+    fn kernel_prefix_matches_lowercased_arm64_image() {
+        // Callers lowercase file names before matching, so "Image-6.1" arrives as "image-6.1".
+        assert_eq!(
+            match_kernel_prefix("image-6.1", LINUX_KERNEL_PREFIXES),
+            Some("image")
+        );
+        assert_eq!(
+            match_kernel_prefix("image", LINUX_KERNEL_PREFIXES),
+            Some("image")
+        );
+    }
+
+    #[test]
+    fn kernel_prefix_case_sensitive_no_match() {
+        // match_kernel_prefix expects the caller to lowercase first; uppercase input won't match.
+        assert!(match_kernel_prefix("VMLINUZ-6.1", LINUX_KERNEL_PREFIXES).is_none());
+    }
+
+    #[test]
+    fn kernel_prefix_no_match() {
+        assert!(match_kernel_prefix("initramfs-6.1", LINUX_KERNEL_PREFIXES).is_none());
+    }
+
+    #[test]
+    fn kernel_prefix_partial_no_match() {
+        // "vmlinuz6.1" has no dash separator — should not match.
+        assert!(match_kernel_prefix("vmlinuz6.1", LINUX_KERNEL_PREFIXES).is_none());
+    }
+
+    #[test]
+    fn initramfs_candidates_with_suffix() {
+        let candidates: Vec<_> = initramfs_candidates("-6.1.0", LINUX_INITRAMFS_PREFIXES).collect();
+        assert_eq!(
+            candidates,
+            &["initramfs-6.1.0", "initrd-6.1.0", "initrd.img-6.1.0"]
+        );
+    }
+
+    #[test]
+    fn initramfs_candidates_empty_suffix() {
+        let candidates: Vec<_> = initramfs_candidates("", LINUX_INITRAMFS_PREFIXES).collect();
+        assert_eq!(candidates, &["initramfs", "initrd", "initrd.img"]);
+    }
+
+    #[test]
+    fn initramfs_candidates_empty_prefixes() {
+        let candidates: Vec<_> = initramfs_candidates("-6.1.0", &[]).collect();
+        assert!(candidates.is_empty());
+    }
+}
@@ -60,7 +60,7 @@ Copy the downloaded `sprout.efi` file to `/boot/efi/EFI/sprout/sprout.unsigned.e
 ## Step 4: Sign Sprout for Secure Boot

 ```bash
-# For x86_64, sign the unsigned Sprout artifact and name it grubaa64.efi which is what the shim will call.
+# For x86_64, sign the unsigned Sprout artifact and name it grubx64.efi which is what the shim will call.
 $ sbsign \
    --key /etc/sprout/secure-boot/mok.key \
    --cert /etc/sprout/secure-boot/mok.crt \
@@ -120,8 +120,8 @@ path = "\\EFI\\sprout\\ext4.efi"

 # global options.
 [options]
-# enable autoconfiguration by detecting bls enabled
-# filesystems and generating boot entries for them.
+# enable autoconfiguration by detecting installed kernels
+# generating boot entries for them.
 autoconfigure = true
 ```

@@ -130,14 +130,16 @@ If you do not have any drivers, exclude the drivers section entirely.

 ## Step 7: Configure Sprout Boot Entry

-In the following commands, replace /dev/ESP_PARTITION with the actual path to the ESP partition block device.
+In the following commands, replace /dev/BLOCK_DEVICE with the device that houses your GPT partition table,
+and PARTITION_NUMBER with the partition number of the EFI System Partition. For example, if your EFI System Partition is
+`/dev/sda1`, the BLOCK_DEVICE would be `/dev/sda` and the PARTITION_NUMBER would be `1`

 ```bash
 # For x86_64, run this command to add Sprout as the default boot entry.
-$ efibootmgr -d /dev/ESP_PARTITION -c -L 'Sprout' -l '\EFI\sprout\shimx64.efi'
+$ efibootmgr -d /dev/BLOCK_DEVICE -p PARTITION_NUMBER -c -L 'Sprout' -l '\EFI\sprout\shimx64.efi'

 # For aarch64, run this command to add Sprout as the default boot entry.
-$ efibootmgr -d /dev/ESP_PARTITION -c -L 'Sprout' -l '\EFI\sprout\shimaa64.efi'
+$ efibootmgr -d /dev/BLOCK_DEVICE -p PARTITION_NUMBER -c -L 'Sprout' -l '\EFI\sprout\shimaa64.efi'
 ```

 Reboot your machine and it should boot into Sprout.
@@ -0,0 +1,172 @@
+# Setup Sprout for Fedora with Secure Boot
+
+## Prerequisites
+
+- Modern Fedora release: tested on Fedora 43 x86_64.
+- EFI System Partition mounted on `/boot/efi` (the default)
+- You will need the following packages installed: `openssl`, `mokutil`, `sbsigntools`, `efibootmgr`
+
+**NOTE**: Fedora on ARM64 itself does not support Secure Boot consistently.
+
+## Step 1: Generate and Install Secure Boot Key
+
+```bash
+# Create a directory to store the Secure Boot MOK key and certificates.
+$ mkdir -p /etc/sprout/secure-boot
+# Change to the created directory.
+$ cd /etc/sprout/secure-boot
+# Generate a MOK key and certificate.
+$ openssl req \
+    -newkey rsa:4096 -nodes -keyout mok.key \
+    -new -x509 -sha256 -days 3650 -subj '/CN=Sprout Secure Boot/' \
+    -out mok.crt
+# Generate a DER encoded certificate for enrollment.
+$ openssl x509 -outform DER -in mok.crt -out mok.cer
+# Import the certificate into the Secure Boot environment.
+# This will ask you to make a password that will be used during enrollment.
+$ mokutil --import mok.cer
+# Reboot your machine.
+# During boot, MOK enrollment should appear. If it doesn't, ensure you are booting into the shim.
+# Press any key to begin MOK management. Select "Enroll MOK".
+# Select "View key 0", and ensure the subject says "CN=Sprout Secure Boot".
+# If the subject does not match, something has gone wrong with MOK enrollment.
+# Press Enter to continue, then select the "Continue" option.
+# When it asks to enroll the key, select the "Yes" option.
+# Enter the password that you created during the mokutil --import step.
+# Select "Reboot" to boot back into your Operating System.
+```
+
+## Step 2: Prepare the Secure Boot Environment
+
+```bash
+# Create a directory for Sprout EFI artifacts.
+$ mkdir -p /boot/efi/EFI/sprout
+
+# For x86_64, copy the following artifacts to the Sprout EFI directory.
+$ cp /boot/efi/EFI/fedora/shimx64.efi /boot/efi/EFI/sprout/shimx64.efi
+$ cp /boot/efi/EFI/fedora/mmx64.efi /boot/efi/EFI/sprout/mmx64.efi
+
+# For aarch64, copy the following artifacts to the Sprout EFI directory.
+$ cp /boot/efi/EFI/fedora/shimaa64.efi /boot/efi/EFI/sprout/shimaa64.efi
+$ cp /boot/efi/EFI/fedora/mmaa64.efi /boot/efi/EFI/sprout/mmaa64.efi
+```
+
+## Step 3: Install Unsigned Sprout
+
+Download the latest sprout.efi release from the [GitHub releases page](https://github.com/edera-dev/sprout/releases).
+For x86_64 systems, download the `sprout-x86_64.efi` file, and for ARM64 systems, download the `sprout-aarch64.efi` file.
+Copy the downloaded `sprout.efi` file to `/boot/efi/EFI/sprout/sprout.unsigned.efi` on your EFI System Partition.
+
+## Step 4: Sign Sprout for Secure Boot
+
+```bash
+# For x86_64, sign the unsigned Sprout artifact and name it grubx64.efi which is what the shim will call.
+$ sbsign \
+    --key /etc/sprout/secure-boot/mok.key \
+    --cert /etc/sprout/secure-boot/mok.crt \
+    --output /boot/efi/EFI/sprout/grubx64.efi \
+    /boot/efi/EFI/sprout/sprout.unsigned.efi
+
+# For aarch64, sign the unsigned Sprout artifact and name it grubaa64.efi which is what the shim will call.
+$ sbsign \
+    --key /etc/sprout/secure-boot/mok.key \
+    --cert /etc/sprout/secure-boot/mok.crt \
+    --output /boot/efi/EFI/sprout/grubaa64.efi \
+    /boot/efi/EFI/sprout/sprout.unsigned.efi
+```
+
+## Step 5: Install and Sign EFI Drivers
+
+You will need a filesystem EFI driver if `/boot` is not FAT32 or ExFAT.
+
+### ext4
+
+Most Fedora systems use an ext4 filesystem for `/boot`, if that is the case, use the ext4 instructions here:
+
+Install the necessary `edk2-ext4` package:
+
+```bash
+# Install the ext4 driver from the package manager.
+$ dnf install edk2-ext4
+```
+
+Copy the ext4 driver to `/boot/efi/EFI/sprout/ext4.unsigned.efi`:
+
+```bash
+# For x86_64, copy the ext4x64.efi driver to the Sprout EFI directory.
+$ cp /usr/share/edk2/drivers/ext4x64.efi /boot/efi/EFI/sprout/ext4.unsigned.efi
+
+# For aarch64, copy the ext4aa64.efi driver to the Sprout EFI directory.
+$ cp /usr/share/edk2/drivers/ext4aa64.efi /boot/efi/EFI/sprout/ext4.unsigned.efi
+```
+
+```bash
+# Sign the ext4 driver at ext4.unsigned.efi, placing it at ext4.efi, which will be used in the configuration.
+$ sbsign \
+    --key /etc/sprout/secure-boot/mok.key \
+    --cert /etc/sprout/secure-boot/mok.crt \
+    --output /boot/efi/EFI/sprout/ext4.efi \
+    /boot/efi/EFI/sprout/ext4.unsigned.efi
+```
+
+### Other Filesystems
+
+If you need another driver, you can download EFI filesystem drivers from [EfiFs releases](https://github.com/pbatard/EfiFs/releases).
+Copy the driver to `/boot/efi/EFI/sprout/DRIVER_NAME.unsigned.efi` for signing, then sign it like this:
+
+```bash
+# Sign your driver, placing it at DRIVER_NAME.efi, which will be used in the configuration.
+$ sbsign \
+    --key /etc/sprout/secure-boot/mok.key \
+    --cert /etc/sprout/secure-boot/mok.crt \
+    --output /boot/efi/EFI/sprout/DRIVER_NAME.efi \
+    /boot/efi/EFI/sprout/DRIVER_NAME.unsigned.efi
+```
+
+You will add the driver in your Sprout configuration below, like this:
+
+```toml
+[drivers.DRIVER_NAME]
+path = "\\EFI\\sprout\\DRIVER_NAME.efi"
+```
+
+## Step 6: Create Sprout Configuration
+
+Write the following to the file `/boot/efi/sprout.toml`:
+
+```toml
+# sprout configuration: version 1
+version = 1
+
+# load an ext4 EFI driver.
+# skip this if you do not have a filesystem driver.
+# if your filesystem driver is not named ext4, change accordingly.
+[drivers.ext4]
+path = "\\EFI\\sprout\\ext4.efi"
+
+# global options.
+[options]
+# enable autoconfiguration by detecting bls enabled
+# filesystems and generating boot entries for them.
+autoconfigure = true
+```
+
+Ensure you add the signed driver paths to the configuration, not the unsigned ones.
+If you do not have any drivers, exclude the drivers section entirely.
+
+## Step 7: Configure Sprout Boot Entry
+
+In the following commands, replace /dev/BLOCK_DEVICE with the device that houses your GPT partition table,
+and PARTITION_NUMBER with the partition number of the EFI System Partition. For example, if your EFI System Partition is
+`/dev/sda1`, the BLOCK_DEVICE would be `/dev/sda` and the PARTITION_NUMBER would be `1`
+
+```bash
+# For x86_64, run this command to add Sprout as the default boot entry.
+$ efibootmgr -d /dev/BLOCK_DEVICE -p PARTITION_NUMBER -c -L 'Sprout' -l '\EFI\sprout\shimx64.efi'
+
+# For aarch64, run this command to add Sprout as the default boot entry.
+$ efibootmgr -d /dev/BLOCK_DEVICE -p PARTITION_NUMBER -c -L 'Sprout' -l '\EFI\sprout\shimaa64.efi'
+```
+
+Reboot your machine and it should boot into Sprout.
+If Sprout fails to boot, it should boot into the original bootloader.
@@ -128,11 +128,13 @@ If you do not have any drivers, exclude the drivers section entirely.

 ## Step 7: Configure Sprout Boot Entry

-In the following commands, replace /dev/ESP_PARTITION with the actual path to the ESP partition block device.
+In the following commands, replace /dev/BLOCK_DEVICE with the device that houses your GPT partition table,
+and PARTITION_NUMBER with the partition number of the EFI System Partition. For example, if your EFI System Partition is
+`/dev/sda1`, the BLOCK_DEVICE would be `/dev/sda` and the PARTITION_NUMBER would be `1`

 ```bash
 # Run this command to add Sprout as the default boot entry.
-$ efibootmgr -d /dev/ESP_PARTITION -c -L 'Sprout' -l '\EFI\sprout\shim.efi'
+$ efibootmgr -d /dev/BLOCK_DEVICE -p PARTITION_NUMBER -c -L 'Sprout' -l '\EFI\sprout\shim.efi'
 ```

 Reboot your machine and it should boot into Sprout.
@@ -59,7 +59,7 @@ Copy the downloaded `sprout.efi` file to `/boot/efi/EFI/sprout/sprout.unsigned.e
 ## Step 4: Sign Sprout for Secure Boot

 ```bash
-# For x86_64, sign the unsigned Sprout artifact and name it grubaa64.efi which is what the shim will call.
+# For x86_64, sign the unsigned Sprout artifact and name it grubx64.efi which is what the shim will call.
 $ sbsign \
    --key /etc/sprout/secure-boot/mok.key \
    --cert /etc/sprout/secure-boot/mok.crt \
@@ -119,8 +119,8 @@ path = "\\EFI\\sprout\\ext4.efi"

 # global options.
 [options]
-# enable autoconfiguration by detecting bls enabled
-# filesystems and generating boot entries for them.
+# enable autoconfiguration by detecting installed kernels
+# generating boot entries for them.
 autoconfigure = true
 ```

@@ -129,14 +129,18 @@ If you do not have any drivers, exclude the drivers section entirely.

 ## Step 7: Configure Sprout Boot Entry

-In the following commands, replace /dev/ESP_PARTITION with the actual path to the ESP partition block device.
+## Step 7: Configure Sprout Boot Entry
+
+In the following commands, replace /dev/BLOCK_DEVICE with the device that houses your GPT partition table,
+and PARTITION_NUMBER with the partition number of the EFI System Partition. For example, if your EFI System Partition is
+`/dev/sda1`, the BLOCK_DEVICE would be `/dev/sda` and the PARTITION_NUMBER would be `1`

 ```bash
 # For x86_64, run this command to add Sprout as the default boot entry.
-$ efibootmgr -d /dev/ESP_PARTITION -c -L 'Sprout' -l '\EFI\sprout\shimx64.efi'
+$ efibootmgr -d /dev/BLOCK_DEVICE -p PARTITION_NUMBER -c -L 'Sprout' -l '\EFI\sprout\shimx64.efi'

 # For aarch64, run this command to add Sprout as the default boot entry.
-$ efibootmgr -d /dev/ESP_PARTITION -c -L 'Sprout' -l '\EFI\sprout\shimaa64.efi'
+$ efibootmgr -d /dev/BLOCK_DEVICE -p PARTITION_NUMBER -c -L 'Sprout' -l '\EFI\sprout\shimaa64.efi'
 ```

 Reboot your machine and it should boot into Sprout.
@@ -30,9 +30,9 @@ if [ "${QEMU_GDB_WAIT}" = "1" ]; then
 	set -- "${@}" "-S"
 fi

-set -- "${@}" -smp 2 -m 4096
+set -- "${@}" -nodefaults -smp 2 -m 4096

-if [ "${NO_GRAPHICAL_BOOT}" = "1" ]; then
+if [ "${NO_GRAPHICAL}" = "1" ]; then
 	set -- "${@}" -nographic
 else
 	if [ "${GRAPHICAL_ONLY}" != "1" ]; then
@@ -40,9 +40,9 @@ else
 			set -- "${@}" -serial stdio
 		else
 			set -- "${@}" \
-				-device virtio-serial-pci,id=vs0 \
-				-chardev stdio,id=stdio0 \
-				-device virtconsole,chardev=stdio0,id=console0
+				-device 'virtio-serial-pci,id=vs0' \
+				-chardev 'stdio,id=stdio0,signal=off' \
+				-device 'virtconsole,chardev=stdio0,id=console0,name=alpine'
 		fi
 	fi

@@ -62,6 +62,12 @@ if [ "${NO_INPUT}" != "1" ]; then
 		-device usb-mouse
 fi

+if [ "${NO_NETWORK}" != "1" ]; then
+	set -- "${@}" \
+		-netdev 'user,id=network0' \
+		-device 'virtio-net-pci,netdev=network0'
+fi
+
 rm -f "${FINAL_DIR}/ovmf-boot.fd"
 cp "${FINAL_DIR}/ovmf.fd" "${FINAL_DIR}/ovmf-boot.fd"
 if [ "${TARGET_ARCH}" = "aarch64" ]; then
@@ -70,7 +76,7 @@ fi
 # shellcheck disable=SC2086
 set -- "${@}" \
 	-drive "if=pflash,file=${FINAL_DIR}/ovmf-boot.fd,format=raw,readonly=on" \
-	-device nvme,drive=disk1,serial=cafebabe
+	-device 'nvme,drive=disk1,serial=cafebabe'

 set -- "${@}" \
 	-drive "if=none,file=${FINAL_DIR}/sprout.img,format=raw,id=disk1,readonly=on"
@@ -1,4 +1,4 @@
-FROM --platform=$BUILDPLATFORM debian:trixie@sha256:fd8f5a1df07b5195613e4b9a0b6a947d3772a151b81975db27d47f093f60c6e6 AS build
+FROM --platform=$BUILDPLATFORM debian:trixie@sha256:9cc080028c43b27d2074d63a5f9caf7166d731494965616c1a6d2827a004585c AS build
 ARG BUILDPLATFORM
 ARG EFI_NAME
 RUN export DEBIAN_FRONTEND=noninteractive && apt-get update && apt-get install -y \
@@ -48,7 +48,7 @@ copy_from_image_polyfill() {
 	SOURCE="${2}"
 	TARGET="${3}"

-	docker build -t "${IMAGE}-copy-polyfill:${DOCKER_TAG}" --build-arg "TARGET_IMAGE=${IMAGE}:${DOCKER_TAG}" \
+	docker build --platform="${DOCKER_TARGET}" -t "${IMAGE}-copy-polyfill:${DOCKER_TAG}" --build-arg "TARGET_IMAGE=${IMAGE}:${DOCKER_TAG}" \
 		-f hack/dev/utils/Dockerfile.copy-polyfill hack
 	# note: the -w '//' is a workaround for Git Bash where / is magically rewritten.
 	docker run --rm -i -w '//' "${IMAGE}-copy-polyfill:${DOCKER_TAG}" cat "image/${SOURCE}" >"${TARGET}"
@@ -72,6 +72,7 @@ if [ "${SKIP_KERNEL_BUILD}" != "1" ]; then
 	fi

 	copy_from_image "${DOCKER_PREFIX}/sprout-kernel-${TARGET_ARCH}" "kernel.efi" "${FINAL_DIR}/kernel.efi"
+	copy_from_image "${DOCKER_PREFIX}/sprout-kernel-${TARGET_ARCH}" "kernel.modules.tgz" "${FINAL_DIR}/kernel.modules.tgz"
 fi

 if [ "${SKIP_VM_BUILD}" != "1" ]; then
@@ -80,8 +81,12 @@ if [ "${SKIP_VM_BUILD}" != "1" ]; then
 		-f hack/dev/vm/Dockerfile.ovmf "${FINAL_DIR}"
 	copy_from_image "${DOCKER_PREFIX}/sprout-ovmf-${TARGET_ARCH}" "ovmf.fd" "${FINAL_DIR}/ovmf.fd"
 	copy_from_image "${DOCKER_PREFIX}/sprout-ovmf-${TARGET_ARCH}" "shell.efi" "${FINAL_DIR}/shell.efi"
+	rm -rf "${FINAL_DIR}/initramfs.build"
+	mkdir -p "${FINAL_DIR}/initramfs.build"
+	cp -r "hack/dev/vm/files" "${FINAL_DIR}/initramfs.build/files"
+	cp "${FINAL_DIR}/kernel.modules.tgz" "${FINAL_DIR}/initramfs.build/kernel.modules.tgz"
 	docker build --platform="${DOCKER_TARGET}" -t "${DOCKER_PREFIX}/sprout-initramfs-${TARGET_ARCH}:${DOCKER_TAG}" \
-		-f hack/dev/vm/Dockerfile.initramfs "${FINAL_DIR}"
+		-f hack/dev/vm/Dockerfile.initramfs "${FINAL_DIR}/initramfs.build"
 	copy_from_image "${DOCKER_PREFIX}/sprout-initramfs-${TARGET_ARCH}" "initramfs" "${FINAL_DIR}/initramfs"

 	if [ -n "${SPROUT_XEN_EFI_OVERRIDE}" ]; then
@@ -108,23 +113,6 @@ if [ "${SKIP_SPROUT_BUILD}" != "1" ]; then
 	cp "hack/dev/configs/${SPROUT_CONFIG_NAME}.sprout.toml" "${FINAL_DIR}/sprout.toml"
 	cp "hack/dev/configs/xen.cfg" "${FINAL_DIR}/xen.cfg"
 	cp "hack/dev/configs/bls.conf" "${FINAL_DIR}/bls.conf"
-
-	mkdir -p "${FINAL_DIR}/efi/EFI/BOOT"
-	cp "${FINAL_DIR}/sprout.efi" "${FINAL_DIR}/efi/EFI/BOOT/${EFI_NAME}.EFI"
-	if [ -f "${FINAL_DIR}/kernel.efi" ]; then
-		cp "${FINAL_DIR}/kernel.efi" "${FINAL_DIR}/efi/EFI/BOOT/KERNEL.EFI"
-	fi
-	if [ -f "${FINAL_DIR}/shell.efi" ]; then
-		cp "${FINAL_DIR}/shell.efi" "${FINAL_DIR}/efi/EFI/BOOT/SHELL.EFI"
-	fi
-	if [ -f "${FINAL_DIR}/xen.efi" ]; then
-		cp "${FINAL_DIR}/xen.efi" "${FINAL_DIR}/efi/EFI/BOOT/XEN.EFI"
-	fi
-	if [ -f "${FINAL_DIR}/xen.cfg" ]; then
-		cp "${FINAL_DIR}/xen.cfg" "${FINAL_DIR}/efi/EFI/BOOT/XEN.CFG"
-	fi
-	cp "${FINAL_DIR}/sprout.toml" "${FINAL_DIR}/efi/SPROUT.TOML"
-	cp "${FINAL_DIR}/initramfs" "${FINAL_DIR}/efi/INITRAMFS"
 fi

 if [ "${SKIP_BOOT_BUILD}" != "1" ]; then
@@ -8,7 +8,7 @@ has-item = "\\vmlinuz"

 [actions.chainload-kernel]
 chainload.path = "$boot\\vmlinuz"
-chainload.options = ["console=hvc0"]
+chainload.options = ["console=hvc0", "overlaytmpfs=yes"]
 chainload.linux-initrd = "$boot\\initramfs"

 [entries.kernel]
@@ -9,7 +9,7 @@ has-item = "\\vmlinuz"

 [actions.chainload-kernel]
 chainload.path = "$boot\\vmlinuz"
-chainload.options = ["console=hvc0"]
+chainload.options = ["console=hvc0", "overlaytmpfs=yes"]
 chainload.linux-initrd = "$boot\\initramfs"

 [entries.kernel]
@@ -3,5 +3,5 @@ default=sprout

 [sprout]
 options=clocksource=tsc smp=on smt=on ioapic_ack=new dom0_vcpus_pin=on spec-ctrl=gds-mit=no noreboot console=com1
-kernel=\EFI\BOOT\KERNEL.EFI console=hvc0
-ramdisk=\initramfs
+kernel=\VMLINUZ console=hvc0
+ramdisk=\INITRAMFS
@@ -1,7 +1,7 @@
-ARG KERNEL_SOURCE_URL=https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.17.2.tar.xz
-ARG KERNEL_CHECKSUM=sha256:fdebcb065065f5c1b8dc68a6fb59cda50cdddbf9103d207c2196d55ea764f57f
+ARG KERNEL_SOURCE_URL=https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.54.tar.xz
+ARG KERNEL_CHECKSUM=sha256:9df30b02dd8102bbd0be52556288ef6889ddbe7f1ddb96fbf847d0becf3eacac

-FROM --platform=$BUILDPLATFORM debian:trixie@sha256:fd8f5a1df07b5195613e4b9a0b6a947d3772a151b81975db27d47f093f60c6e6 AS buildenv
+FROM --platform=$BUILDPLATFORM debian:trixie@sha256:9cc080028c43b27d2074d63a5f9caf7166d731494965616c1a6d2827a004585c AS buildenv
 RUN export DEBIAN_FRONTEND=noninteractive && apt-get update && apt-get install -y \
      build-essential squashfs-tools python3-yaml \
      patch diffutils sed mawk findutils zstd \
@@ -32,6 +32,9 @@ ENV BUILDPLATFORM=${BUILDPLATFORM}
 ENV TARGETPLATFORM=${TARGETPLATFORM}
 WORKDIR /build/src
 RUN /build/docker-build.sh
+COPY --chown=build:build docker-install.sh /build/docker-install.sh
+RUN /build/docker-install.sh

 FROM scratch AS final
 COPY --from=build /build/src/kernel.image /kernel.efi
+COPY --from=build /build/src/kernel.modules.tgz /kernel.modules.tgz
@@ -28,21 +28,39 @@ else
 	exit 1
 fi

+echo "CROSS_COMPILE=${MAYBE_CROSS_COMPILE}" > kernel.buildenv
+echo "TARGET_KARCH=${TARGET_KARCH}" >> kernel.buildenv
+
 make CROSS_COMPILE="${MAYBE_CROSS_COMPILE}" ARCH="${TARGET_KARCH}" defconfig
 if [ "${TARGET_KARCH}" = "x86_64" ]; then
 	make CROSS_COMPILE="${MAYBE_CROSS_COMPILE}" ARCH="${TARGET_KARCH}" xen.config
 	./scripts/config -e XEN_PV
 	./scripts/config -e XEN_PV_DOM0
 fi
-make CROSS_COMPILE="${MAYBE_CROSS_COMPILE}" ARCH="${TARGET_KARCH}" mod2yesconfig
+
+./scripts/config -e IPV6
+
+./scripts/config -e BPF_SYSCALL
+
+./scripts/config -e UEVENT_HELPER
+./scripts/config --set-str UEVENT_HELPER_PATH "/sbin/hotplug"
+
+./scripts/config -e SYN_COOKIES
+
+./scripts/config -d DEBUG_STACK_USAGE

 ./scripts/config -e DRM_VIRTIO_GPU
 ./scripts/config -e FRAMEBUFFER_CONSOLE
 ./scripts/config -e FRAMEBUFFER_CONSOLE_DETECT_PRIMARY
+./scripts/config -e LOGO
+
 ./scripts/config -e XEN_DOM0

+make CROSS_COMPILE="${MAYBE_CROSS_COMPILE}" ARCH="${TARGET_KARCH}" mod2noconfig
+
 make "-j$(nproc)" CROSS_COMPILE="${MAYBE_CROSS_COMPILE}" ARCH="${TARGET_KARCH}"

 [ -f "arch/x86/boot/bzImage" ] && cp "arch/x86/boot/bzImage" kernel.image
 [ -f "arch/arm64/boot/Image.gz" ] && gzip -d <"arch/arm64/boot/Image.gz" >kernel.image
+
 exit 0
@@ -0,0 +1,11 @@
+#!/bin/sh
+set -e
+
+. /build/src/kernel.buildenv
+
+[ -f "arch/x86/boot/bzImage" ] && cp "arch/x86/boot/bzImage" kernel.image
+[ -f "arch/arm64/boot/Image.gz" ] && gzip -d <"arch/arm64/boot/Image.gz" >kernel.image
+
+make CROSS_COMPILE="${MAYBE_CROSS_COMPILE}" ARCH="${TARGET_KARCH}" INSTALL_MOD_PATH="/build/install" modules_install
+cd /build/install
+tar czpf /build/src/kernel.modules.tgz .
@@ -1 +1 @@
-FROM --platform=$BUILDPLATFORM debian:trixie@sha256:fd8f5a1df07b5195613e4b9a0b6a947d3772a151b81975db27d47f093f60c6e6
+FROM --platform=$BUILDPLATFORM debian:trixie@sha256:9cc080028c43b27d2074d63a5f9caf7166d731494965616c1a6d2827a004585c
@@ -1,4 +1,4 @@
 ARG TARGET_IMAGE=scratch
 FROM ${TARGET_IMAGE} AS image
-FROM --platform=$BUILDPLATFORM debian:trixie@sha256:fd8f5a1df07b5195613e4b9a0b6a947d3772a151b81975db27d47f093f60c6e6 AS final
+FROM --platform=$BUILDPLATFORM debian:trixie@sha256:9cc080028c43b27d2074d63a5f9caf7166d731494965616c1a6d2827a004585c AS final
 COPY --from=image / /image
@@ -1,5 +1,5 @@
-FROM alpine:3.22@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1 AS rootfs
-RUN apk --no-cache add alpine-base tzdata
+FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS rootfs
+RUN apk --no-cache add alpine-base tzdata wireless-regdb ifupdown-ng agetty
 RUN rc-update add devfs sysinit && \
    rc-update add dmesg sysinit && \
    rc-update add mdev sysinit && \
@@ -7,6 +7,7 @@ RUN rc-update add devfs sysinit && \
    rc-update add sysctl boot && \
    rc-update add hostname boot && \
    rc-update add bootmisc boot && \
+    rc-update add networking boot && \
    rc-update add syslog boot && \
    rc-update add mount-ro shutdown && \
    rc-update add killprocs shutdown && \
@@ -14,11 +15,13 @@ RUN rc-update add devfs sysinit && \
    ln -s /sbin/init /init && \
    echo 'root:root' | chpasswd && \
    echo 'sprout' > /etc/hostname && \
-    echo '' > /etc/motd && \
+    rm /etc/motd && \
    ln -s /usr/share/zoneinfo/UTC /etc/localtime && \
-    echo 'hvc0::respawn:/sbin/getty -L hvc0 115200 vt100' >> /etc/inittab
+    echo 'hvc0::respawn:/sbin/agetty --autologin root -L hvc0 115200 vt100' >> /etc/inittab
+ADD kernel.modules.tgz /
+COPY files/interfaces /etc/network/interfaces

-FROM alpine:3.22@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1 AS build
+FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS build
 COPY --from=rootfs / /rootfs
 WORKDIR /rootfs
 RUN find . | cpio -R 0:0 --ignore-devno --renumber-inodes -o -H newc --quiet > /initramfs
@@ -1,4 +1,4 @@
-FROM alpine:3.22@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1 AS build
+FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS build
 ARG TARGETPLATFORM
 RUN if [ "${TARGETPLATFORM}" = "linux/amd64" ] || [ "${TARGETPLATFORM}" = "linux/x86_64" ]; then \
      apk --no-cache add ovmf edk2-shell; cp /usr/share/ovmf/bios.bin /ovmf.fd; fi
@@ -1,4 +1,4 @@
-FROM alpine:3.22@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1 AS build
+FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS build
 ARG TARGETPLATFORM
 RUN apk add --no-cache xen-hypervisor && cp /usr/lib/efi/xen.efi /xen.efi

@@ -0,0 +1,3 @@
+auto eth0
+iface eth0
+    use dhcp
@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.91.0"
+channel = "1.98.1"
 components = ["rustfmt", "clippy"]
 targets = ["x86_64-unknown-uefi", "aarch64-unknown-uefi"]