sprout: version 0.0.29 (#99 )

fix(autoconfigure): skip filesystems that can't be opened
If the device path or filesystem protocol of any detected filesystem could not be opened, autoconfiguration failed entirely and boot was aborted. Log a warning and skip that filesystem instead, so the other filesystems are still autoconfigured.
2026-11-04 22:42:21 +00:00 · 2026-09-26 19:07:20 -07:00 · 2026-09-26 18:58:54 -07:00 · 2026-09-26 18:58:54 -07:00 · 2026-09-26 18:58:54 -07:00 · 2026-09-26 18:58:54 -07:00
47 changed files with 1720 additions and 873 deletions
@@ -25,17 +25,17 @@ jobs:
      actions: read # Needed to analyze action metadata.
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: checkout
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

    - name: setup uv
-      uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
+      uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0

    - name: zizmor
      run: uvx zizmor --pedantic --format sarif . > results.sarif
@@ -43,7 +43,7 @@ jobs:
        GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

    - name: upload
-      uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
+      uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
      with:
        sarif_file: results.sarif
        category: zizmor
@@ -21,12 +21,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: checkout
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

@@ -51,12 +51,12 @@ jobs:
    name: 'build ${{ matrix.arch }}'
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: checkout
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

@@ -80,12 +80,12 @@ jobs:
    name: 'clippy ${{ matrix.arch }}'
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: checkout
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

@@ -37,23 +37,23 @@ jobs:
          build-mode: none
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: checkout
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

    - name: initialize codeql
-      uses: github/codeql-action/init@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
+      uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
      with:
        languages: ${{ matrix.language }}
        build-mode: ${{ matrix.build-mode }}
        config-file: ./.github/codeql/codeql-config.yaml

    - name: perform codeql analysis
-      uses: github/codeql-action/analyze@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
+      uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
      with:
        category: "/language:${{matrix.language}}"
@@ -25,12 +25,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: checkout
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

@@ -43,13 +43,13 @@ jobs:

    - name: 'upload artifacts'
      id: upload
-      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: artifacts
        path: target/assemble/*

    - name: 'attest artifacts'
-      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+      uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
      with:
        subject-name: artifacts.zip
        subject-digest: "sha256:${{ steps.upload.outputs.artifact-digest }}"
@@ -25,12 +25,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: checkout
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

@@ -42,16 +42,19 @@ jobs:
      run: ./hack/assemble.sh

    - name: 'attest release artifacts'
-      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+      uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
      with:
        subject-path: target/assemble/*

    - name: 'generate cultivator token'
-      uses: actions/create-github-app-token@bf559f85448f9380bcfa2899dbdc01eb5b37be3a # v3.0.0-beta.2
+      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.0.0-beta.2
      id: generate-token
      with:
        app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
        private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
+        # Scope to what uploading assets and `gh release edit` need: write to
+        # release contents.
+        permission-contents: write
      if: ${{ github.event.inputs.release-tag != '' }}

    - name: 'upload release artifacts'
@@ -4,9 +4,9 @@ version = 4

 [[package]]
 name = "anyhow"
-version = "1.0.100"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"

 [[package]]
 name = "bit_field"
@@ -16,62 +16,70 @@ checksum = "1e4b40c7323adcfc0a41c4b88143ed58346ff65a288fc144329c5c45e05d70c6"

 [[package]]
 name = "bitflags"
-version = "2.10.0"
+version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"

 [[package]]
 name = "block-buffer"
-version = "0.10.4"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
 dependencies = [
- "generic-array",
+ "hybrid-array",
 ]

 [[package]]
 name = "cfg-if"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"

 [[package]]
 name = "cpufeatures"
-version = "0.2.17"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
 dependencies = [
 "libc",
 ]

 [[package]]
 name = "crypto-common"
-version = "0.1.7"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
- "generic-array",
- "typenum",
+ "hybrid-array",
 ]

 [[package]]
 name = "digest"
-version = "0.10.7"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
 "block-buffer",
 "crypto-common",
 ]

 [[package]]
-name = "edera-sprout-boot"
-version = "0.0.27"
+name = "edera-sprout-bls"
+version = "0.0.29"
 dependencies = [
 "anyhow",
+]
+
+[[package]]
+name = "edera-sprout-boot"
+version = "0.0.29"
+dependencies = [
+ "anyhow",
+ "edera-sprout-bls",
 "edera-sprout-build",
 "edera-sprout-config",
 "edera-sprout-eficore",
+ "edera-sprout-parsing",
 "hex",
 "jaarg",
 "log",
@@ -83,18 +91,18 @@ dependencies = [

 [[package]]
 name = "edera-sprout-build"
-version = "0.0.27"
+version = "0.0.29"

 [[package]]
 name = "edera-sprout-config"
-version = "0.0.27"
+version = "0.0.29"
 dependencies = [
 "serde",
 ]

 [[package]]
 name = "edera-sprout-eficore"
-version = "0.0.27"
+version = "0.0.29"
 dependencies = [
 "anyhow",
 "bitflags",
@@ -106,13 +114,11 @@ dependencies = [
 ]

 [[package]]
-name = "generic-array"
-version = "0.14.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+name = "edera-sprout-parsing"
+version = "0.0.29"
 dependencies = [
- "typenum",
- "version_check",
+ "hex",
+ "sha2",
 ]

 [[package]]
@@ -121,6 +127,15 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"

+[[package]]
+name = "hybrid-array"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
+dependencies = [
+ "typenum",
+]
+
 [[package]]
 name = "jaarg"
 version = "0.2.2"
@@ -129,9 +144,9 @@ checksum = "534d589df1ef528a238f4bc4b1db081a1280f3aedf2695fd8971e9853a7fa4f6"

 [[package]]
 name = "libc"
-version = "0.2.178"
+version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37c93d8daa9d8a012fd8ab92f088405fb202ea0b6ab73ee2482ae66af4f42091"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"

 [[package]]
 name = "lock_api"
@@ -144,33 +159,33 @@ dependencies = [

 [[package]]
 name = "log"
-version = "0.4.29"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"

 [[package]]
 name = "proc-macro2"
-version = "1.0.103"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
 dependencies = [
 "unicode-ident",
 ]

 [[package]]
 name = "ptr_meta"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b9a0cf95a1196af61d4f1cbdab967179516d9a4a4312af1f31948f8f6224a79"
+checksum = "743da816b98c921cdbe8628ef7381b76f25ecf4da599fc80aca90eae7ef70cc0"
 dependencies = [
 "ptr_meta_derive",
 ]

 [[package]]
 name = "ptr_meta_derive"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7347867d0a7e1208d93b46767be83e2b8f978c3dad35f775ac8d8847551d6fe1"
+checksum = "1c8d9ca532f185d5d4db7a7c9d51420b452168ea1c2b913953281bd6fe1fcbd0"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -179,9 +194,9 @@ dependencies = [

 [[package]]
 name = "quote"
-version = "1.0.42"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
 dependencies = [
 "proc-macro2",
 ]
@@ -194,9 +209,9 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"

 [[package]]
 name = "serde"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
 dependencies = [
 "serde_core",
 "serde_derive",
@@ -204,18 +219,18 @@ dependencies = [

 [[package]]
 name = "serde_core"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -224,18 +239,18 @@ dependencies = [

 [[package]]
 name = "serde_spanned"
-version = "1.0.4"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8bbf91e5a4d6315eee45e704372590b30e260ee83af6639d64557f51b067776"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
 dependencies = [
 "serde_core",
 ]

 [[package]]
 name = "sha2"
-version = "0.10.9"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
 dependencies = [
 "cfg-if",
 "cpufeatures",
@@ -244,24 +259,24 @@ dependencies = [

 [[package]]
 name = "shlex"
-version = "1.3.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"

 [[package]]
 name = "spin"
-version = "0.10.0"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5fe4ccb98d9c292d56fec89a5e07da7fc4cf0dc11e156b41793132775d3e591"
+checksum = "0134f9043ed38b087ac4f7d4af44c79e2c9e5094421fe3164f435ce585953b10"
 dependencies = [
 "lock_api",
 ]

 [[package]]
 name = "syn"
-version = "2.0.111"
+version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "390cc9a294ab71bdb1aa2e99d13be9c753cd2d7bd6560c77118597410c4d2e87"
+checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -270,9 +285,9 @@ dependencies = [

 [[package]]
 name = "toml"
-version = "0.9.10+spec-1.1.0"
+version = "1.1.6+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0825052159284a1a8b4d6c0c86cbc801f2da5afd2b225fa548c72f2e74002f48"
+checksum = "920602543f0911ab71da12c50d59701da54c196d1a2bf5cb4b75667f137a406a"
 dependencies = [
 "serde_core",
 "serde_spanned",
@@ -283,27 +298,27 @@ dependencies = [

 [[package]]
 name = "toml_datetime"
-version = "0.7.5+spec-1.1.0"
+version = "1.1.1+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
 dependencies = [
 "serde_core",
 ]

 [[package]]
 name = "toml_parser"
-version = "1.0.6+spec-1.1.0"
+version = "1.1.3+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3198b4b0a8e11f09dd03e133c0280504d0801269e9afa46362ffde1cbeebf44"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
 dependencies = [
 "winnow",
 ]

 [[package]]
 name = "typenum"
-version = "1.19.0"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"

 [[package]]
 name = "ucs2"
@@ -316,9 +331,9 @@ dependencies = [

 [[package]]
 name = "uefi"
-version = "0.36.1"
+version = "0.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71fe9058b73ee2b6559524af9e33199c13b2485ddbf3ad1181b68051cdc50c17"
+checksum = "368cef7d94514897e6dad4350945c7910a9f5bf9021191d1c58ee3ec09962697"
 dependencies = [
 "bitflags",
 "cfg-if",
@@ -332,9 +347,9 @@ dependencies = [

 [[package]]
 name = "uefi-macros"
-version = "0.19.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4687412b5ac74d245d5bfb1733ede50c31be19bf8a4b6a967a29b451bab49e67"
+checksum = "643efa8b64be89780bc498b290fab04337c7c4d171cc82cce2e133a74616dcc4"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -343,9 +358,9 @@ dependencies = [

 [[package]]
 name = "uefi-raw"
-version = "0.13.0"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f64fe59e11af447d12fd60a403c74106eb104309f34b4c6dbce6e927d97da9d"
+checksum = "3636327a6d88a38c0f2567fb695ec7ba27b3483d1877730486605aa0866da201"
 dependencies = [
 "bitflags",
 "uguid",
@@ -359,18 +374,12 @@ checksum = "0c8352f8c05e47892e7eaf13b34abd76a7f4aeaf817b716e88789381927f199c"

 [[package]]
 name = "unicode-ident"
-version = "1.0.22"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
-
-[[package]]
-name = "version_check"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"

 [[package]]
 name = "winnow"
-version = "0.7.14"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
@@ -4,24 +4,26 @@ members = [
  "crates/build",
  "crates/config",
  "crates/eficore",
+  "crates/bls",
+  "crates/parsing",
 ]
 resolver = "3"

 [workspace.package]
 license = "Apache-2.0"
-version = "0.0.27"
+version = "0.0.29"
 homepage = "https://sprout.edera.dev"
 repository = "https://github.com/edera-dev/sprout"
 edition = "2024"

 [workspace.dependencies]
-bitflags = "2.10.0"
-log = "0.4.29"
-spin = "0.10.0"
-uefi-raw = "0.13.0"
+bitflags = "2.13.2"
+log = "0.4.34"
+spin = "0.12.3"
+uefi-raw = "0.17.0"

 [workspace.dependencies.anyhow]
-version = "1.0.100"
+version = "1.0.104"
 default-features = false

 [workspace.dependencies.hex]
@@ -35,25 +37,25 @@ default-features = false
 features = ["alloc"]

 [workspace.dependencies.serde]
-version = "1.0.228"
+version = "1.0.229"
 default-features = false
 features = ["alloc", "derive"]

 [workspace.dependencies.sha2]
-version = "0.10.9"
+version = "0.11.0"
 default-features = false

 [workspace.dependencies.shlex]
-version = "1.3.0"
+version = "2.0.1"
 default-features = false

 [workspace.dependencies.toml]
-version = "0.9.10"
+version = "1.1.6"
 default-features = false
 features = ["serde", "parse"]

 [workspace.dependencies.uefi]
-version = "0.36.1"
+version = "0.41.0"
 default-features = false
 features = ["alloc", "global_allocator", "panic_handler"]

@@ -1,8 +1,7 @@
-# syntax=docker/dockerfile:1.7-labs
 ARG RUST_PROFILE=release
 ARG RUST_TARGET_SUBDIR=release

-FROM --platform=$BUILDPLATFORM rust:1.92.0-alpine@sha256:f6c22e0a256c05d44fca23bf530120b5d4a6249a393734884281ca80782329bc AS build
+FROM --platform=$BUILDPLATFORM rust:1.98.1-alpine@sha256:7cc1c22d77d9432f7fe012a70e6d3e555af54c2a6832700ed7d553f1769ae89f AS build
 RUN apk --no-cache add musl-dev busybox-static
 ARG RUST_PROFILE
 RUN adduser -S -s /bin/sh build
@@ -0,0 +1,18 @@
+# This crate explicitly does not have uefi/uefi-raw dependencies,
+# so that the contents can be unit-testable on non-UEFI target hosts.
+# Do not add uefi or uefi-raw as dependencies.
+[package]
+name = "edera-sprout-bls"
+description = "Sprout BLS Utilities (UEFI-free)"
+license.workspace = true
+version.workspace = true
+homepage.workspace = true
+repository.workspace = true
+edition.workspace = true
+
+[dependencies]
+anyhow.workspace = true
+
+[lib]
+name = "edera_sprout_bls"
+path = "src/lib.rs"
@@ -0,0 +1,800 @@
+#![no_std]
+extern crate alloc;
+
+use alloc::string::{String, ToString};
+use anyhow::{Error, Result};
+use core::{cmp::Ordering, iter::Peekable, str::FromStr};
+
+/// Represents a parsed BLS entry.
+/// Fields unrelated to Sprout are not included.
+#[derive(Default, Debug, Clone)]
+pub struct BlsEntry {
+    /// The title of the entry.
+    pub title: Option<String>,
+    /// The options to pass to the entry.
+    pub options: Option<String>,
+    /// The path to the linux kernel.
+    pub linux: Option<String>,
+    /// The path to the initrd.
+    pub initrd: Option<String>,
+    /// The path to an EFI image.
+    pub efi: Option<String>,
+    /// The sort key for the entry.
+    pub sort_key: Option<String>,
+    /// The version of the entry.
+    pub version: Option<String>,
+    /// The machine id of the entry.
+    pub machine_id: Option<String>,
+}
+
+/// Parser for a BLS entry.
+impl FromStr for BlsEntry {
+    type Err = Error;
+
+    /// Parses the `input` as a BLS entry file.
+    fn from_str(input: &str) -> Result<Self> {
+        // All the fields in a BLS entry we understand.
+        // Set all to None initially.
+        let mut title: Option<String> = None;
+        let mut options: Option<String> = None;
+        let mut linux: Option<String> = None;
+        let mut initrd: Option<String> = None;
+        let mut efi: Option<String> = None;
+        let mut sort_key: Option<String> = None;
+        let mut version: Option<String> = None;
+        let mut machine_id: Option<String> = None;
+
+        // Iterate over each line in the input and parse it.
+        for line in input.lines() {
+            let line = line.trim();
+            // Skip over empty lines and comments.
+            if line.is_empty() || line.starts_with('#') {
+                continue;
+            }
+
+            // Split the line once by whitespace. This technically includes newlines but since
+            // the lines iterator is used, there should never be a newline here.
+            let Some((key, value)) = line.split_once(char::is_whitespace) else {
+                continue;
+            };
+
+            // Match the key to a field we understand.
+            match key {
+                // The title of the entry.
+                "title" => {
+                    title = Some(value.trim().to_string());
+                }
+
+                // The options to pass to the entry.
+                "options" => {
+                    options = Some(value.trim().to_string());
+                }
+
+                // The path to the linux kernel.
+                "linux" => {
+                    linux = Some(value.trim().to_string());
+                }
+
+                // The path to the initrd.
+                "initrd" => {
+                    initrd = Some(value.trim().to_string());
+                }
+
+                // The path to an EFI image.
+                "efi" => {
+                    efi = Some(value.trim().to_string());
+                }
+
+                "sort-key" => {
+                    sort_key = Some(value.trim().to_string());
+                }
+
+                "version" => {
+                    version = Some(value.trim().to_string());
+                }
+
+                "machine-id" => {
+                    machine_id = Some(value.trim().to_string());
+                }
+
+                // Ignore any other key.
+                _ => {
+                    continue;
+                }
+            }
+        }
+
+        // Produce a BLS entry from the parsed fields.
+        Ok(Self {
+            title,
+            options,
+            linux,
+            initrd,
+            efi,
+            sort_key,
+            version,
+            machine_id,
+        })
+    }
+}
+
+impl BlsEntry {
+    /// Checks if this BLS entry is something we can actually boot in Sprout.
+    pub fn is_valid(&self) -> bool {
+        self.linux.is_some() || self.efi.is_some()
+    }
+
+    /// Fetches the path to an EFI bootable image to boot, if any.
+    /// This prioritizes the linux field over efi.
+    /// It also converts / to \\ to match EFI path style.
+    pub fn chainload_path(&self) -> Option<String> {
+        self.linux
+            .clone()
+            .or(self.efi.clone())
+            .map(|path| path.replace('/', "\\").trim_start_matches('\\').to_string())
+    }
+
+    /// Fetches the path to an initrd to pass to the kernel, if any.
+    /// It also converts / to \\ to match EFI path style.
+    pub fn initrd_path(&self) -> Option<String> {
+        self.initrd
+            .clone()
+            .map(|path| path.replace('/', "\\").trim_start_matches('\\').to_string())
+    }
+
+    /// Fetches the options to pass to the kernel, if any.
+    pub fn options(&self) -> Option<String> {
+        self.options.clone()
+    }
+
+    /// Fetches the title of the entry, if any.
+    pub fn title(&self) -> Option<String> {
+        self.title.clone()
+    }
+
+    /// Fetches the sort key of the entry, if any.
+    pub fn sort_key(&self) -> Option<String> {
+        self.sort_key.clone()
+    }
+
+    /// Fetches the version of the entry, if any.
+    pub fn version(&self) -> Option<String> {
+        self.version.clone()
+    }
+
+    /// Fetches the machine id of the entry, if any.
+    pub fn machine_id(&self) -> Option<String> {
+        self.machine_id.clone()
+    }
+}
+
+/// Sorts two BLS entries according to the BLS sort system.
+/// `a_name` and `b_name` are the entry filenames (without `.conf`) used as the
+/// final tiebreaker when all other fields are equal.
+/// Reference: <https://uapi-group.org/specifications/specs/boot_loader_specification/#sorting>
+pub fn sort_bls(a_bls: &BlsEntry, a_name: &str, b_bls: &BlsEntry, b_name: &str) -> Ordering {
+    // Grab the sort keys from both entries.
+    let a_sort_key = a_bls.sort_key();
+    let b_sort_key = b_bls.sort_key();
+
+    // Sort keys, machine-id and version are only considered when both entries have a sort key.
+    // If only one entry has a sort key, that entry sorts first.
+    let ordering = match (a_sort_key, b_sort_key) {
+        (Some(a_sort_key), Some(b_sort_key)) => a_sort_key
+            .cmp(&b_sort_key)
+            // If the sort keys are equal, sort by machine-id.
+            .then_with(|| a_bls.machine_id().cmp(&b_bls.machine_id()))
+            // If the machine-id values are equal, sort by version, sorting newer versions first.
+            .then_with(|| {
+                compare_versions_optional(a_bls.version().as_deref(), b_bls.version().as_deref())
+                    .reverse()
+            }),
+        (Some(_), None) => Ordering::Less,
+        (None, Some(_)) => Ordering::Greater,
+        (None, None) => Ordering::Equal,
+    };
+
+    // If all else is equal, compare the file names of both entries, sorting newer entries first.
+    ordering.then_with(|| compare_versions(a_name, b_name).reverse())
+}
+
+/// Handles single character advancement and comparison.
+macro_rules! handle_single_char {
+    ($ca: expr, $cb:expr, $a_chars:expr, $b_chars:expr, $c:expr) => {
+        match ($ca == $c, $cb == $c) {
+            (true, false) => return Ordering::Less,
+            (false, true) => return Ordering::Greater,
+            (true, true) => {
+                $a_chars.next();
+                $b_chars.next();
+                continue;
+            }
+            _ => {}
+        }
+    };
+}
+
+/// Compares two strings using the BLS version comparison specification.
+/// Handles optional values as well by comparing only if both are specified.
+/// A missing value is considered older than any specified value.
+pub fn compare_versions_optional(a: Option<&str>, b: Option<&str>) -> Ordering {
+    match (a, b) {
+        // If both have values, compare them.
+        (Some(a), Some(b)) => compare_versions(a, b),
+        // If the second value is None, then `a` is greater than `b`.
+        (Some(_a), None) => Ordering::Greater,
+        // If the first value is None, the `a` is less than `b`.
+        (None, Some(_b)) => Ordering::Less,
+        // If both values are None, return that they are equal.
+        (None, None) => Ordering::Equal,
+    }
+}
+
+/// Compares two strings using the BLS version comparison specification.
+/// See: <https://uapi-group.org/specifications/specs/version_format_specification/>
+pub fn compare_versions(a: &str, b: &str) -> Ordering {
+    // An empty string is older than any other string.
+    if a.is_empty() || b.is_empty() {
+        return a.len().cmp(&b.len());
+    }
+
+    // Acquire a peekable iterator for each string.
+    let mut a_chars = a.chars().peekable();
+    let mut b_chars = b.chars().peekable();
+
+    // Loop until we have reached the end of one of the strings.
+    loop {
+        // Skip invalid characters in both strings.
+        skip_invalid(&mut a_chars);
+        skip_invalid(&mut b_chars);
+
+        // Handle the ~ character. This must happen before the end of string check,
+        // as a string with ~ is older than a string that has ended (1~rc1 < 1).
+        match (a_chars.peek() == Some(&'~'), b_chars.peek() == Some(&'~')) {
+            (true, false) => return Ordering::Less,
+            (false, true) => return Ordering::Greater,
+            (true, true) => {
+                a_chars.next();
+                b_chars.next();
+                continue;
+            }
+            (false, false) => {}
+        }
+
+        // Check if either string has ended.
+        match (a_chars.peek(), b_chars.peek()) {
+            // No more characters in either string.
+            (None, None) => return Ordering::Equal,
+            // One string has ended, the other hasn't.
+            (None, Some(_)) => return Ordering::Less,
+            (Some(_), None) => return Ordering::Greater,
+            // Both strings have characters left.
+            (Some(&ca), Some(&cb)) => {
+                // Handle '-' character.
+                handle_single_char!(ca, cb, a_chars, b_chars, '-');
+
+                // Handle the '^' character.
+                handle_single_char!(ca, cb, a_chars, b_chars, '^');
+
+                // Handle the '.' character.
+                handle_single_char!(ca, cb, a_chars, b_chars, '.');
+
+                // Handle digits with numerical comparison.
+                // If only one string has digits at this position, that string is newer.
+                if ca.is_ascii_digit() || cb.is_ascii_digit() {
+                    if !ca.is_ascii_digit() {
+                        return Ordering::Less;
+                    }
+                    if !cb.is_ascii_digit() {
+                        return Ordering::Greater;
+                    }
+                    let result = compare_numeric(&mut a_chars, &mut b_chars);
+                    if result != Ordering::Equal {
+                        return result;
+                    }
+                    continue;
+                }
+
+                // Handle letters with alphabetical comparison.
+                // We key off of the A character being alphabetical intentionally as we presume
+                // this indicates it will be the same at this position.
+                if ca.is_ascii_alphabetic() || cb.is_ascii_alphabetic() {
+                    let result = compare_alphabetic(&mut a_chars, &mut b_chars);
+                    if result != Ordering::Equal {
+                        return result;
+                    }
+                    continue;
+                }
+            }
+        }
+    }
+}
+
+/// Skips characters that are not in the valid character set.
+fn skip_invalid<I: Iterator<Item = char>>(iter: &mut Peekable<I>) {
+    while let Some(&c) = iter.peek() {
+        if is_valid_char(c) {
+            break;
+        }
+        iter.next();
+    }
+}
+
+/// Checks if a character is in the valid character set for comparison.
+fn is_valid_char(c: char) -> bool {
+    matches!(c, 'a'..='z' | 'A'..='Z' | '0'..='9' | '-' | '.' | '~' | '^')
+}
+
+/// Compares numerical prefixes by extracting numbers.
+/// Numbers are compared by their digit count first and then digit by digit,
+/// which supports numbers of any length.
+fn compare_numeric<I: Iterator<Item = char>>(
+    iter_a: &mut Peekable<I>,
+    iter_b: &mut Peekable<I>,
+) -> Ordering {
+    let num_a = extract_number(iter_a);
+    let num_b = extract_number(iter_b);
+
+    num_a
+        .len()
+        .cmp(&num_b.len())
+        .then_with(|| num_a.cmp(&num_b))
+}
+
+/// Extracts the digits of a number from the iterator, skipping leading zeros.
+fn extract_number<I: Iterator<Item = char>>(iter: &mut Peekable<I>) -> String {
+    // Skip leading zeros
+    while let Some(&'0') = iter.peek() {
+        iter.next();
+    }
+
+    let mut num = String::new();
+    while let Some(&c) = iter.peek() {
+        if c.is_ascii_digit() {
+            iter.next();
+            num.push(c);
+        } else {
+            break;
+        }
+    }
+
+    num
+}
+
+/// Compares alphabetical prefixes.
+/// Capital letters compare lower than lowercase letters (B < a).
+fn compare_alphabetic<I: Iterator<Item = char>>(
+    iter_a: &mut Peekable<I>,
+    iter_b: &mut Peekable<I>,
+) -> Ordering {
+    loop {
+        return match (iter_a.peek(), iter_b.peek()) {
+            (Some(&ca), Some(&cb)) if ca.is_ascii_alphabetic() && cb.is_ascii_alphabetic() => {
+                if ca == cb {
+                    // Same character, we should continue.
+                    iter_a.next();
+                    iter_b.next();
+                    continue;
+                }
+
+                // Different characters found.
+                // All capital letters compare lower than lowercase letters.
+                match (ca.is_ascii_uppercase(), cb.is_ascii_uppercase()) {
+                    (true, false) => Ordering::Less,    // uppercase < lowercase
+                    (false, true) => Ordering::Greater, // lowercase > uppercase
+                    (true, true) => ca.cmp(&cb),        // both are uppercase
+                    (false, false) => ca.cmp(&cb),      // both are lowercase
+                }
+            }
+
+            (Some(&ca), Some(_)) if ca.is_ascii_alphabetic() => {
+                // a has letters, b doesn't
+                Ordering::Greater
+            }
+
+            (Some(_), Some(&cb)) if cb.is_ascii_alphabetic() => {
+                // b has letters, a doesn't
+                Ordering::Less
+            }
+
+            (Some(&ca), None) if ca.is_ascii_alphabetic() => Ordering::Greater,
+
+            (None, Some(&cb)) if cb.is_ascii_alphabetic() => Ordering::Less,
+
+            _ => Ordering::Equal,
+        };
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use core::cmp::Ordering;
+
+    fn sort_entry(
+        sort_key: Option<&str>,
+        machine_id: Option<&str>,
+        version: Option<&str>,
+    ) -> BlsEntry {
+        BlsEntry {
+            sort_key: sort_key.map(|s| s.to_string()),
+            machine_id: machine_id.map(|s| s.to_string()),
+            version: version.map(|s| s.to_string()),
+            linux: Some("/vmlinuz".to_string()),
+            ..BlsEntry::default()
+        }
+    }
+
+    #[test]
+    fn parse_empty_input_gives_all_none() {
+        let entry: BlsEntry = "".parse().unwrap();
+        assert!(entry.title.is_none());
+        assert!(entry.linux.is_none());
+        assert!(entry.efi.is_none());
+        assert!(entry.initrd.is_none());
+        assert!(entry.options.is_none());
+        assert!(entry.sort_key.is_none());
+        assert!(entry.version.is_none());
+        assert!(entry.machine_id.is_none());
+    }
+
+    #[test]
+    fn parse_all_known_fields() {
+        let input = "\
+title      Fedora Linux 6.5.6
+version    6.5.6-300.fc39.x86_64
+machine-id abc123def456
+linux      /boot/vmlinuz-6.5.6
+initrd     /boot/initrd-6.5.6.img
+options    root=/dev/sda1 ro quiet
+sort-key   fedora
+efi        /EFI/fedora/shimx64.efi
+";
+        let entry: BlsEntry = input.parse().unwrap();
+        assert_eq!(entry.title.as_deref(), Some("Fedora Linux 6.5.6"));
+        assert_eq!(entry.version.as_deref(), Some("6.5.6-300.fc39.x86_64"));
+        assert_eq!(entry.machine_id.as_deref(), Some("abc123def456"));
+        assert_eq!(entry.linux.as_deref(), Some("/boot/vmlinuz-6.5.6"));
+        assert_eq!(entry.initrd.as_deref(), Some("/boot/initrd-6.5.6.img"));
+        assert_eq!(entry.options.as_deref(), Some("root=/dev/sda1 ro quiet"));
+        assert_eq!(entry.sort_key.as_deref(), Some("fedora"));
+        assert_eq!(entry.efi.as_deref(), Some("/EFI/fedora/shimx64.efi"));
+    }
+
+    #[test]
+    fn parse_skips_blank_lines() {
+        let input = "\n\ntitle   My Entry\n\n\nlinux /vmlinuz\n\n";
+        let entry: BlsEntry = input.parse().unwrap();
+        assert_eq!(entry.title.as_deref(), Some("My Entry"));
+        assert_eq!(entry.linux.as_deref(), Some("/vmlinuz"));
+    }
+
+    #[test]
+    fn parse_skips_comment_lines() {
+        let input = "# this is a comment\ntitle My Entry\n# another comment\nlinux /vmlinuz\n";
+        let entry: BlsEntry = input.parse().unwrap();
+        assert_eq!(entry.title.as_deref(), Some("My Entry"));
+        assert_eq!(entry.linux.as_deref(), Some("/vmlinuz"));
+    }
+
+    #[test]
+    fn parse_trims_leading_whitespace_from_value() {
+        let input = "title    Padded Title\nlinux    /boot/vmlinuz\n";
+        let entry: BlsEntry = input.parse().unwrap();
+        assert_eq!(entry.title.as_deref(), Some("Padded Title"));
+        assert_eq!(entry.linux.as_deref(), Some("/boot/vmlinuz"));
+    }
+
+    #[test]
+    fn parse_ignores_unknown_keys() {
+        let input = "title My Entry\nunknown-key some-value\nfuture-field value\nlinux /vmlinuz\n";
+        let entry: BlsEntry = input.parse().unwrap();
+        assert_eq!(entry.title.as_deref(), Some("My Entry"));
+        assert_eq!(entry.linux.as_deref(), Some("/vmlinuz"));
+    }
+
+    #[test]
+    fn parse_skips_lines_without_whitespace_separator() {
+        // A line with no whitespace cannot be split into key+value, so it is skipped
+        let input = "title My Entry\nnovalueline\nlinux /vmlinuz\n";
+        let entry: BlsEntry = input.parse().unwrap();
+        assert_eq!(entry.title.as_deref(), Some("My Entry"));
+        assert_eq!(entry.linux.as_deref(), Some("/vmlinuz"));
+    }
+
+    #[test]
+    fn is_valid_when_linux_present() {
+        let entry: BlsEntry = "linux /vmlinuz\n".parse().unwrap();
+        assert!(entry.is_valid());
+    }
+
+    #[test]
+    fn is_valid_when_efi_present() {
+        let entry: BlsEntry = "efi /EFI/boot/bootx64.efi\n".parse().unwrap();
+        assert!(entry.is_valid());
+    }
+
+    #[test]
+    fn not_valid_without_linux_or_efi() {
+        let entry: BlsEntry = "title Just a Title\noptions quiet\n".parse().unwrap();
+        assert!(!entry.is_valid());
+    }
+
+    #[test]
+    fn chainload_path_normalises_forward_slashes_to_backslashes() {
+        let entry: BlsEntry = "linux /boot/vmlinuz\n".parse().unwrap();
+        assert_eq!(entry.chainload_path().as_deref(), Some("boot\\vmlinuz"));
+    }
+
+    #[test]
+    fn chainload_path_strips_leading_backslash() {
+        let entry: BlsEntry = "linux \\EFI\\boot\\kernel\n".parse().unwrap();
+        assert_eq!(entry.chainload_path().as_deref(), Some("EFI\\boot\\kernel"));
+    }
+
+    #[test]
+    fn chainload_path_prefers_linux_over_efi() {
+        let input = "linux /boot/vmlinuz\nefi /EFI/boot/bootx64.efi\n";
+        let entry: BlsEntry = input.parse().unwrap();
+        assert_eq!(entry.chainload_path().as_deref(), Some("boot\\vmlinuz"));
+    }
+
+    #[test]
+    fn chainload_path_falls_back_to_efi_when_no_linux() {
+        let entry: BlsEntry = "efi /EFI/Microsoft/Boot/bootmgfw.efi\n".parse().unwrap();
+        assert_eq!(
+            entry.chainload_path().as_deref(),
+            Some("EFI\\Microsoft\\Boot\\bootmgfw.efi")
+        );
+    }
+
+    #[test]
+    fn chainload_path_none_when_neither_linux_nor_efi() {
+        let entry: BlsEntry = "title Only Title\n".parse().unwrap();
+        assert!(entry.chainload_path().is_none());
+    }
+
+    #[test]
+    fn initrd_path_normalises_slashes() {
+        let entry: BlsEntry = "linux /vmlinuz\ninitrd /boot/initrd.img\n".parse().unwrap();
+        assert_eq!(entry.initrd_path().as_deref(), Some("boot\\initrd.img"));
+    }
+
+    #[test]
+    fn initrd_path_none_when_not_set() {
+        let entry: BlsEntry = "linux /vmlinuz\n".parse().unwrap();
+        assert!(entry.initrd_path().is_none());
+    }
+
+    #[test]
+    fn sort_key_is_primary_criterion() {
+        let a = sort_entry(Some("alpine"), None, None);
+        let b = sort_entry(Some("fedora"), None, None);
+        assert_eq!(sort_bls(&a, "a", &b, "b"), Ordering::Less);
+        assert_eq!(sort_bls(&b, "b", &a, "a"), Ordering::Greater);
+    }
+
+    #[test]
+    fn machine_id_is_secondary_criterion() {
+        let a = sort_entry(Some("linux"), Some("aaa"), None);
+        let b = sort_entry(Some("linux"), Some("bbb"), None);
+        assert_eq!(sort_bls(&a, "a", &b, "b"), Ordering::Less);
+        assert_eq!(sort_bls(&b, "b", &a, "a"), Ordering::Greater);
+    }
+
+    #[test]
+    fn version_is_tertiary_criterion_newer_first() {
+        let a = sort_entry(Some("linux"), Some("abc"), Some("6.5.0"));
+        let b = sort_entry(Some("linux"), Some("abc"), Some("6.4.0"));
+        // newer version (a) sorts before older version (b), so a < b in sort order
+        assert_eq!(sort_bls(&a, "a", &b, "b"), Ordering::Less);
+        assert_eq!(sort_bls(&b, "b", &a, "a"), Ordering::Greater);
+    }
+
+    #[test]
+    fn name_is_final_tiebreaker_newer_first() {
+        let a = sort_entry(Some("linux"), Some("abc"), Some("6.5.0"));
+        let b = sort_entry(Some("linux"), Some("abc"), Some("6.5.0"));
+        // name comparison via compare_versions, reversed — higher name sorts first
+        assert_eq!(sort_bls(&a, "entry-2", &b, "entry-1"), Ordering::Less);
+        assert_eq!(sort_bls(&a, "entry-1", &b, "entry-2"), Ordering::Greater);
+    }
+
+    #[test]
+    fn identical_entries_are_equal() {
+        let a = sort_entry(Some("linux"), Some("abc"), Some("6.5.0"));
+        let b = sort_entry(Some("linux"), Some("abc"), Some("6.5.0"));
+        assert_eq!(sort_bls(&a, "entry-1", &b, "entry-1"), Ordering::Equal);
+    }
+
+    #[test]
+    fn equal_strings_are_equal() {
+        assert_eq!(compare_versions("1.0.0", "1.0.0"), Ordering::Equal);
+    }
+
+    #[test]
+    fn empty_strings_are_equal() {
+        assert_eq!(compare_versions("", ""), Ordering::Equal);
+    }
+
+    #[test]
+    fn simple_numeric_less() {
+        assert_eq!(compare_versions("1", "2"), Ordering::Less);
+    }
+
+    #[test]
+    fn simple_numeric_greater() {
+        assert_eq!(compare_versions("2", "1"), Ordering::Greater);
+    }
+
+    #[test]
+    fn numeric_is_not_lexicographic() {
+        // "10" > "9", not "10" < "9" as in lexicographic order
+        assert_eq!(compare_versions("10", "9"), Ordering::Greater);
+        assert_eq!(compare_versions("1.10", "1.9"), Ordering::Greater);
+    }
+
+    #[test]
+    fn leading_zeros_are_ignored() {
+        assert_eq!(compare_versions("01", "1"), Ordering::Equal);
+        assert_eq!(compare_versions("1.00", "1.0"), Ordering::Equal);
+        assert_eq!(compare_versions("007", "7"), Ordering::Equal);
+    }
+
+    #[test]
+    fn multi_component_comparison() {
+        assert_eq!(compare_versions("1.0.0", "1.0.1"), Ordering::Less);
+        assert_eq!(compare_versions("1.0.1", "1.0.0"), Ordering::Greater);
+        assert_eq!(compare_versions("2.0.0", "1.9.9"), Ordering::Greater);
+    }
+
+    #[test]
+    fn more_components_is_greater() {
+        assert_eq!(compare_versions("1.0.0", "1.0"), Ordering::Greater);
+        assert_eq!(compare_versions("1.0", "1.0.0"), Ordering::Less);
+        assert_eq!(compare_versions("1.0.0.0", "1.0.0"), Ordering::Greater);
+    }
+
+    #[test]
+    fn alphabetic_sections_compare_lexicographically() {
+        assert_eq!(compare_versions("1.0a", "1.0b"), Ordering::Less);
+        assert_eq!(compare_versions("1.0b", "1.0a"), Ordering::Greater);
+        assert_eq!(compare_versions("1.0abc", "1.0abd"), Ordering::Less);
+    }
+
+    #[test]
+    fn uppercase_letters_sort_below_lowercase() {
+        // Capital letters compare lower than lowercase (B < a)
+        assert_eq!(compare_versions("B", "a"), Ordering::Less);
+        assert_eq!(compare_versions("a", "B"), Ordering::Greater);
+        assert_eq!(compare_versions("Z", "a"), Ordering::Less);
+    }
+
+    #[test]
+    fn uppercase_letters_compare_among_themselves() {
+        assert_eq!(compare_versions("A", "B"), Ordering::Less);
+        assert_eq!(compare_versions("B", "A"), Ordering::Greater);
+        assert_eq!(compare_versions("A", "A"), Ordering::Equal);
+    }
+
+    #[test]
+    fn invalid_characters_are_skipped() {
+        // Characters not in [a-zA-Z0-9.-~^] are skipped before comparison
+        assert_eq!(compare_versions("##1.0", "1.0"), Ordering::Equal);
+        assert_eq!(compare_versions("1.0##", "1.0"), Ordering::Equal);
+    }
+
+    #[test]
+    fn tilde_between_two_present_tilde_strings() {
+        // When both have ~ at the same position, they are consumed and comparison continues
+        assert_eq!(compare_versions("1~alpha", "1~beta"), Ordering::Less);
+        assert_eq!(compare_versions("1~rc1", "1~rc2"), Ordering::Less);
+        assert_eq!(compare_versions("1~rc1", "1~rc1"), Ordering::Equal);
+    }
+
+    #[test]
+    fn tilde_when_only_one_side_has_it() {
+        // When a has ~ but b doesn't at the same position, a < b
+        assert_eq!(compare_versions("1~rc1", "1.0"), Ordering::Less);
+        // When b has ~ but a doesn't, a > b
+        assert_eq!(compare_versions("1.0", "1~rc1"), Ordering::Greater);
+    }
+
+    #[test]
+    fn tilde_is_older_than_end_of_string() {
+        // A pre-release is older than the release it precedes.
+        assert_eq!(compare_versions("1~rc1", "1"), Ordering::Less);
+        assert_eq!(compare_versions("1", "1~rc1"), Ordering::Greater);
+        assert_eq!(compare_versions("6.1~rc3", "6.1"), Ordering::Less);
+    }
+
+    #[test]
+    fn empty_string_is_oldest() {
+        assert_eq!(compare_versions("", "~1"), Ordering::Less);
+        assert_eq!(compare_versions("~1", ""), Ordering::Greater);
+        assert_eq!(compare_versions("", "1"), Ordering::Less);
+    }
+
+    #[test]
+    fn digits_are_newer_than_letters() {
+        assert_eq!(compare_versions("0", "a"), Ordering::Greater);
+        assert_eq!(compare_versions("a", "0"), Ordering::Less);
+        assert_eq!(compare_versions("1.0", "1.a"), Ordering::Greater);
+        assert_eq!(compare_versions("1.a", "1.0"), Ordering::Less);
+    }
+
+    #[test]
+    fn large_numbers_do_not_saturate() {
+        assert_eq!(
+            compare_versions("99999999999999999999", "99999999999999999998"),
+            Ordering::Greater
+        );
+        assert_eq!(
+            compare_versions("1.99999999999999999998", "1.99999999999999999999"),
+            Ordering::Less
+        );
+    }
+
+    #[test]
+    fn entry_with_sort_key_sorts_before_entry_without() {
+        let with_key = sort_entry(Some("fedora"), None, None);
+        let without_key = sort_entry(None, None, None);
+        assert_eq!(sort_bls(&with_key, "a", &without_key, "b"), Ordering::Less);
+        assert_eq!(
+            sort_bls(&without_key, "b", &with_key, "a"),
+            Ordering::Greater
+        );
+    }
+
+    #[test]
+    fn entries_without_sort_key_sort_by_name_only() {
+        // Without a sort key, machine-id and version are ignored.
+        let a = sort_entry(None, Some("aaa"), Some("1.0"));
+        let b = sort_entry(None, Some("bbb"), Some("2.0"));
+        assert_eq!(sort_bls(&a, "entry-2", &b, "entry-1"), Ordering::Less);
+        assert_eq!(sort_bls(&b, "entry-1", &a, "entry-2"), Ordering::Greater);
+    }
+
+    #[test]
+    fn entry_with_version_sorts_before_entry_without() {
+        let a = sort_entry(Some("linux"), Some("abc"), Some("6.5.0"));
+        let b = sort_entry(Some("linux"), Some("abc"), None);
+        assert_eq!(sort_bls(&a, "a", &b, "b"), Ordering::Less);
+        assert_eq!(sort_bls(&b, "b", &a, "a"), Ordering::Greater);
+    }
+
+    #[test]
+    fn optional_both_none_equal() {
+        assert_eq!(compare_versions_optional(None, None), Ordering::Equal);
+    }
+
+    #[test]
+    fn optional_some_vs_none_is_greater() {
+        // A missing version is older than any specified version.
+        assert_eq!(
+            compare_versions_optional(Some("1.0"), None),
+            Ordering::Greater
+        );
+    }
+
+    #[test]
+    fn optional_none_vs_some_is_less() {
+        assert_eq!(compare_versions_optional(None, Some("1.0")), Ordering::Less);
+    }
+
+    #[test]
+    fn optional_both_some_delegates_to_compare_versions() {
+        assert_eq!(
+            compare_versions_optional(Some("1.0"), Some("2.0")),
+            Ordering::Less
+        );
+        assert_eq!(
+            compare_versions_optional(Some("2.0"), Some("1.0")),
+            Ordering::Greater
+        );
+        assert_eq!(
+            compare_versions_optional(Some("1.0"), Some("1.0")),
+            Ordering::Equal
+        );
+    }
+}
@@ -11,6 +11,8 @@ edition.workspace = true
 anyhow.workspace = true
 edera-sprout-config.path = "../config"
 edera-sprout-eficore.path = "../eficore"
+edera-sprout-bls.path = "../bls"
+edera-sprout-parsing.path = "../parsing"
 hex.workspace = true
 jaarg.workspace = true
 sha2.workspace = true
@@ -25,3 +27,4 @@ edera-sprout-build.path = "../build"
 [[bin]]
 name = "sprout"
 path = "src/main.rs"
+test = false
@@ -1,10 +1,10 @@
 use crate::context::SproutContext;
 use crate::phases::before_handoff;
-use crate::utils;
 use alloc::boxed::Box;
 use alloc::rc::Rc;
 use anyhow::{Context, Result, bail};
 use edera_sprout_config::actions::chainload::ChainloadConfiguration;
+use edera_sprout_parsing::{combine_options, empty_is_none};
 use eficore::bootloader_interface::BootloaderInterface;
 use eficore::loader::source::ImageSource;
 use eficore::loader::{ImageLoadRequest, ImageLoader};
@@ -21,7 +21,7 @@ pub fn chainload(context: Rc<SproutContext>, configuration: &ChainloadConfigurat
    // Resolve the path to the image to chainload.
    let resolved = eficore::path::resolve_path(
        Some(context.root().loaded_image_path()?),
-        &context.stamp(&configuration.path),
+        context.stamp(&configuration.path),
    )
    .context("unable to resolve chainload path")?;

@@ -32,14 +32,8 @@ pub fn chainload(context: Rc<SproutContext>, configuration: &ChainloadConfigurat
    // It will determine if the image needs to be loaded via the shim or can be loaded directly.
    let image = ImageLoader::load(request)?;

-    // Open the LoadedImage protocol of the image to chainload.
-    let mut loaded_image_protocol =
-        uefi::boot::open_protocol_exclusive::<LoadedImage>(*image.handle())
-            .context("unable to open loaded image protocol")?;
-
    // Stamp and combine the options to pass to the image.
-    let options =
-        utils::combine_options(configuration.options.iter().map(|item| context.stamp(item)));
+    let options = combine_options(context.stamp_iter(configuration.options.iter()));

    // Pass the load options to the image.
    // If no options are provided, the resulting string will be empty.
@@ -50,16 +44,26 @@ pub fn chainload(context: Rc<SproutContext>, configuration: &ChainloadConfigurat
            .context("unable to convert chainloader options to CString16")?,
    );

+    // Ensure the chainloader options limit is not exceeded.
    if options.num_bytes() > u32::MAX as usize {
        bail!("chainloader options too large");
    }

-    // SAFETY: option size is checked to validate it is safe to pass.
-    // Additionally, the pointer is allocated and retained on heap, which makes
-    // passing the `options` pointer safe to the next image.
-    unsafe {
-        loaded_image_protocol
-            .set_load_options(options.as_ptr() as *const u8, options.num_bytes() as u32);
+    // Open the LoadedImage protocol of the image to chainload to pass the load options.
+    // This is done in a block to release the protocol before the image is started, as the
+    // image may itself need to open its LoadedImage protocol exclusively.
+    {
+        let mut loaded_image_protocol =
+            uefi::boot::open_protocol_exclusive::<LoadedImage>(*image.handle())
+                .context("unable to open loaded image protocol")?;
+
+        // SAFETY: option size is checked to validate it is safe to pass.
+        // Additionally, the pointer is allocated and retained on heap, which makes
+        // passing the `options` pointer safe to the next image.
+        unsafe {
+            loaded_image_protocol
+                .set_load_options(options.as_ptr() as *const u8, options.num_bytes() as u32);
+        }
    }

    // Stamp the initrd path, if provided.
@@ -68,20 +72,31 @@ pub fn chainload(context: Rc<SproutContext>, configuration: &ChainloadConfigurat
        .as_ref()
        .map(|item| context.stamp(item));
    // The initrd can be None or empty, so we need to collapse that into a single Option.
-    let initrd = utils::empty_is_none(initrd);
+    let initrd = empty_is_none(initrd);

    // If an initrd is provided, register it with the EFI stack.
    let mut initrd_handle = None;
    if let Some(linux_initrd) = initrd {
-        let content = eficore::path::read_file_contents(
-            Some(context.root().loaded_image_path()?),
-            &linux_initrd,
-        )
-        .context("unable to read linux initrd")?;
-        let handle =
-            MediaLoaderHandle::register(LINUX_EFI_INITRD_MEDIA_GUID, content.into_boxed_slice())
-                .context("unable to register linux initrd")?;
-        initrd_handle = Some(handle);
+        let resolved_initrd =
+            eficore::path::resolve_path(Some(context.root().loaded_image_path()?), &linux_initrd)
+                .context("unable to resolve linux initrd path")?;
+
+        // A path without a file component refers to the root of the filesystem, not an initrd.
+        // This happens when a path template like "$root\\$initrd" is stamped with an empty
+        // initrd value, such as a BLS entry without an initrd.
+        let initrd_subpath = eficore::path::device_path_subpath(&resolved_initrd.full_path)
+            .context("unable to get linux initrd subpath")?;
+        if !initrd_subpath.trim_matches('\\').is_empty() {
+            let content = resolved_initrd
+                .read_file()
+                .context("unable to read linux initrd")?;
+            let handle = MediaLoaderHandle::register(
+                LINUX_EFI_INITRD_MEDIA_GUID,
+                content.into_boxed_slice(),
+            )
+            .context("unable to register linux initrd")?;
+            initrd_handle = Some(handle);
+        }
    }

    // Mark execution of an entry in the bootloader interface.
@@ -1,118 +1,107 @@
-use crate::{
-    actions,
-    context::SproutContext,
-    utils::{self},
-};
+use crate::{actions, context::SproutContext};
 use alloc::rc::Rc;
-use alloc::string::{String, ToString};
+use alloc::vec::Vec;
 use alloc::{format, vec};
 use anyhow::{Context, Result};
 use edera_sprout_config::actions::chainload::ChainloadConfiguration;
 use edera_sprout_config::actions::edera::EderaConfiguration;
+use edera_sprout_parsing::{build_xen_config, combine_options, empty_is_none};
 use eficore::media_loader::{
    MediaLoaderHandle,
    constants::xen::{
        XEN_EFI_CONFIG_MEDIA_GUID, XEN_EFI_KERNEL_MEDIA_GUID, XEN_EFI_RAMDISK_MEDIA_GUID,
    },
 };
+use eficore::platform::tpm::PlatformTpm;
 use uefi::Guid;

-/// Builds a configuration string for the Xen EFI stub using the specified `configuration`.
-fn build_xen_config(context: Rc<SproutContext>, configuration: &EderaConfiguration) -> String {
-    // Stamp xen options and combine them.
-    let xen_options = utils::combine_options(
-        configuration
-            .xen_options
-            .iter()
-            .map(|item| context.stamp(item)),
-    );
-
-    // Stamp kernel options and combine them.
-    let kernel_options = utils::combine_options(
-        configuration
-            .kernel_options
-            .iter()
-            .map(|item| context.stamp(item)),
-    );
-
-    // xen config file format is ini-like
-    [
-        // global section
-        "[global]".to_string(),
-        // default configuration section
-        "default=sprout".to_string(),
-        // configuration section for sprout
-        "[sprout]".to_string(),
-        // xen options
-        format!("options={}", xen_options),
-        // kernel options, stub replaces the kernel path
-        // the kernel is provided via media loader
-        format!("kernel=stub {}", kernel_options),
-        // required or else the last line will be ignored
-        "".to_string(),
-    ]
-    .join("\n")
-}
-
-/// Register a media loader for some `text` with the vendor `guid`.
+/// Register a media loader for the provided `bytes` with the vendor `guid`.
 /// `what` should indicate some identifying value for error messages
 /// like `config` or `kernel`.
 /// Provides a [MediaLoaderHandle] that can be used to unregister the media loader.
-fn register_media_loader_text(guid: Guid, what: &str, text: String) -> Result<MediaLoaderHandle> {
-    MediaLoaderHandle::register(guid, text.as_bytes().to_vec().into_boxed_slice())
-        .context(format!("unable to register {} media loader", what)) /*  */
-}
-
-/// Register a media loader for the file `path` with the vendor `guid`.
-/// `what` should indicate some identifying value for error messages
-/// like `config` or `kernel`.
-/// Provides a [MediaLoaderHandle] that can be used to unregister the media loader.
-fn register_media_loader_file(
-    context: &Rc<SproutContext>,
+fn register_media_loader_bytes(
    guid: Guid,
    what: &str,
-    path: &str,
+    bytes: Vec<u8>,
 ) -> Result<MediaLoaderHandle> {
-    // Stamp the path to the file.
+    MediaLoaderHandle::register(guid, bytes.into_boxed_slice())
+        .context(format!("unable to register {} media loader", what))
+}
+
+/// Read the contents of the loader payload at `path` relative to the sprout image.
+/// `what` should indicate some identifying value for error messages
+/// like `kernel` or `initrd`.
+fn read_loader_payload(context: &Rc<SproutContext>, what: &str, path: &str) -> Result<Vec<u8>> {
    let path = context.stamp(path);
-    // Read the file contents.
-    let content =
-        eficore::path::read_file_contents(Some(context.root().loaded_image_path()?), &path)
-            .context(format!("unable to read {} file", what))?;
-    // Register the media loader.
-    let handle = MediaLoaderHandle::register(guid, content.into_boxed_slice())
-        .context(format!("unable to register {} media loader", what))?;
-    Ok(handle)
+    eficore::path::read_file_contents(Some(context.root().loaded_image_path()?), &path)
+        .context(format!("unable to read {} file", what))
 }

 /// Executes the edera action which will boot the Edera hypervisor with the specified
 /// `configuration` and `context`. This action uses Edera-specific Xen EFI stub functionality.
 pub fn edera(context: Rc<SproutContext>, configuration: &EderaConfiguration) -> Result<()> {
-    // Build the Xen config file content for this configuration.
-    let config = build_xen_config(context.clone(), configuration);
+    // Only register the initrd media loader if the user actually configured one.
+    let xen_opts = combine_options(context.stamp_iter(configuration.xen_options.iter()));
+    let dom0_args = combine_options(context.stamp_iter(configuration.kernel_options.iter()));

-    // Register the media loader for the config.
-    let config = register_media_loader_text(XEN_EFI_CONFIG_MEDIA_GUID, "config", config)
-        .context("unable to register config media loader")?;
-
-    // Register the media loaders for the kernel.
-    let kernel = register_media_loader_file(
-        &context,
-        XEN_EFI_KERNEL_MEDIA_GUID,
-        "kernel",
-        &configuration.kernel,
+    // Measure xen options and dom0 cmdline into PCR 12 in a fixed order.
+    PlatformTpm::log_event(
+        PlatformTpm::PCR_KERNEL_PARAMETERS,
+        xen_opts.as_bytes(),
+        "sprout: xen options",
    )
-    .context("unable to register kernel media loader")?;
+    .context("unable to measure xen options into the TPM")?;
+    PlatformTpm::log_event(
+        PlatformTpm::PCR_KERNEL_PARAMETERS,
+        dom0_args.as_bytes(),
+        "sprout: dom0 cmdline",
+    )
+    .context("unable to measure dom0 cmdline into the TPM")?;
+
+    // Build the Xen config text and register it as the config media loader. The
+    // assembled text is a derived artifact, intentionally not measured.
+    let config_handle = register_media_loader_bytes(
+        XEN_EFI_CONFIG_MEDIA_GUID,
+        "config",
+        build_xen_config(&xen_opts, &dom0_args).into_bytes(),
+    )
+    .context("unable to register config media loader")?;
+
+    // Read the dom0 kernel, measure it into PCR 11, then register the kernel
+    // media loader.
+    let kernel_bytes = read_loader_payload(&context, "kernel", &configuration.kernel)?;
+    PlatformTpm::log_event(
+        PlatformTpm::PCR_KERNEL,
+        &kernel_bytes,
+        "sprout: dom0 kernel",
+    )
+    .context("unable to measure dom0 kernel into the TPM")?;
+    let kernel_handle =
+        register_media_loader_bytes(XEN_EFI_KERNEL_MEDIA_GUID, "kernel", kernel_bytes)
+            .context("unable to register kernel media loader")?;
+
+    // Extend PCR 9 with the initrd bytes (empty when no initrd is
+    // configured).
+    let initrd_bytes = match empty_is_none(configuration.initrd.as_ref()) {
+        Some(p) => read_loader_payload(&context, "initrd", p)?,
+        None => Vec::new(),
+    };
+    PlatformTpm::log_event(
+        PlatformTpm::PCR_INITRD,
+        &initrd_bytes,
+        "sprout: dom0 initrd",
+    )
+    .context("unable to measure dom0 initrd into the TPM")?;

    // Create a vector of media loaders to drop them only after this function completes.
-    let mut media_loaders = vec![config, kernel];
+    let mut media_loaders = vec![config_handle, kernel_handle];

    // Register the initrd if it is provided.
-    if let Some(initrd) = utils::empty_is_none(configuration.initrd.as_ref()) {
-        let initrd =
-            register_media_loader_file(&context, XEN_EFI_RAMDISK_MEDIA_GUID, "initrd", initrd)
+    if !initrd_bytes.is_empty() {
+        let initrd_handle =
+            register_media_loader_bytes(XEN_EFI_RAMDISK_MEDIA_GUID, "initrd", initrd_bytes)
                .context("unable to register initrd media loader")?;
-        media_loaders.push(initrd);
+        media_loaders.push(initrd_handle);
    }

    // Chainload to the Xen EFI stub.
@@ -1,5 +1,6 @@
 use anyhow::{Context, Result};
 use edera_sprout_config::RootConfiguration;
+use log::warn;
 use uefi::fs::FileSystem;
 use uefi::proto::device_path::DevicePath;
 use uefi::proto::media::fs::SimpleFileSystem;
@@ -25,15 +26,24 @@ pub fn autoconfigure(config: &mut RootConfiguration) -> Result<()> {
    // For each filesystem that was detected, scan it for supported autoconfig mechanisms.
    for handle in filesystem_handles {
        // Acquire the device path root for the filesystem.
-        let root = {
-            uefi::boot::open_protocol_exclusive::<DevicePath>(handle)
-                .context("unable to get root for filesystem")?
-                .to_boxed()
+        // A filesystem that can't be opened is skipped, as it should not prevent
+        // autoconfiguring the other filesystems.
+        let root = match uefi::boot::open_protocol_exclusive::<DevicePath>(handle) {
+            Ok(root) => root.to_boxed(),
+            Err(error) => {
+                warn!("skipping filesystem, unable to get its root: {}", error);
+                continue;
+            }
        };

        // Open the filesystem that was detected.
-        let filesystem = uefi::boot::open_protocol_exclusive::<SimpleFileSystem>(handle)
-            .context("unable to open filesystem")?;
+        let filesystem = match uefi::boot::open_protocol_exclusive::<SimpleFileSystem>(handle) {
+            Ok(filesystem) => filesystem,
+            Err(error) => {
+                warn!("skipping filesystem, unable to open it: {}", error);
+                continue;
+            }
+        };

        // Trade the filesystem protocol for the uefi filesystem helper.
        let mut filesystem = FileSystem::new(filesystem);
@@ -1,4 +1,3 @@
-use crate::utils;
 use alloc::string::ToString;
 use alloc::{format, vec};
 use anyhow::{Context, Result};
@@ -8,6 +7,7 @@ use edera_sprout_config::actions::chainload::ChainloadConfiguration;
 use edera_sprout_config::entries::EntryDeclaration;
 use edera_sprout_config::generators::GeneratorDeclaration;
 use edera_sprout_config::generators::bls::BlsConfiguration;
+use edera_sprout_parsing::unique_hash;
 use uefi::cstr16;
 use uefi::fs::{FileSystem, Path};
 use uefi::proto::device_path::DevicePath;
@@ -30,14 +30,14 @@ pub fn scan(

    // Convert the device path root to a string we can use in the configuration.
    let mut root = root
-        .to_string(DisplayOnly(false), AllowShortcuts(false))
+        .to_string16(DisplayOnly(false), AllowShortcuts(false))
        .context("unable to convert device root to string")?
        .to_string();
    // Add a trailing forward-slash to the root to ensure the device root is completed.
    root.push('/');

    // Generate a unique hash of the root path.
-    let root_unique_hash = utils::unique_hash(&root);
+    let root_unique_hash = unique_hash(&root);

    // Whether we have a loader.conf file.
    let has_loader_conf = filesystem
@@ -1,4 +1,3 @@
-use crate::utils;
 use alloc::collections::BTreeMap;
 use alloc::string::{String, ToString};
 use alloc::vec::Vec;
@@ -10,6 +9,10 @@ use edera_sprout_config::actions::chainload::ChainloadConfiguration;
 use edera_sprout_config::entries::EntryDeclaration;
 use edera_sprout_config::generators::GeneratorDeclaration;
 use edera_sprout_config::generators::list::ListConfiguration;
+use edera_sprout_parsing::{
+    LINUX_INITRAMFS_PREFIXES, LINUX_KERNEL_PREFIXES, initramfs_candidates, match_kernel_prefix,
+    unique_hash,
+};
 use uefi::CString16;
 use uefi::fs::{FileSystem, Path, PathBuf};
 use uefi::proto::device_path::DevicePath;
@@ -23,12 +26,6 @@ const LINUX_CHAINLOAD_ACTION_PREFIX: &str = "linux-chainload-";
 /// The empty string represents the root of the filesystem.
 const SCAN_LOCATIONS: &[&str] = &["\\boot", "\\"];

-/// Prefixes of kernel files to scan for.
-const KERNEL_PREFIXES: &[&str] = &["vmlinuz", "Image"];
-
-/// Prefixes of initramfs files to match to.
-const INITRAMFS_PREFIXES: &[&str] = &["initramfs", "initrd", "initrd.img"];
-
 /// This is really silly, but if what we are booting is the Canonical stubble stub,
 /// there is a chance it will assert that the load options are non-empty.
 /// Technically speaking, load options can be empty. However, it assumes load options
@@ -108,9 +105,7 @@ fn scan_directory(filesystem: &mut FileSystem, path: &str) -> Result<Vec<KernelP

        // Find a kernel prefix that matches, if any.
        // This is case-insensitive to ensure we pick up all possibilities.
-        let Some(prefix) = KERNEL_PREFIXES.iter().find(|prefix| {
-            name_for_match == **prefix || name_for_match.starts_with(&format!("{}-", prefix))
-        }) else {
+        let Some(prefix) = match_kernel_prefix(&name_for_match, LINUX_KERNEL_PREFIXES) else {
            // Skip over anything that doesn't match a kernel prefix.
            continue;
        };
@@ -118,15 +113,14 @@ fn scan_directory(filesystem: &mut FileSystem, path: &str) -> Result<Vec<KernelP
        // Acquire the suffix of the name, this will be used to match an initramfs.
        let suffix = &name[prefix.len()..];

-        // Find a matching initramfs, if any.
-        let mut initramfs_prefix_iter = INITRAMFS_PREFIXES.iter();
+        // Find a matching initramfs by trying each candidate name, if any.
+        let mut candidates = initramfs_candidates(suffix, LINUX_INITRAMFS_PREFIXES);
        let matched_initramfs_path = loop {
-            let Some(prefix) = initramfs_prefix_iter.next() else {
+            let Some(candidate) = candidates.next() else {
                break None;
            };
            // Construct an initramfs path.
-            let initramfs = format!("{}{}", prefix, suffix);
-            let initramfs = CString16::try_from(initramfs.as_str())
+            let initramfs = CString16::try_from(candidate.as_str())
                .context("unable to convert initramfs name to CString16")?;
            let mut initramfs_path = path_for_join.clone();
            initramfs_path.push(Path::new(&initramfs));
@@ -164,14 +158,14 @@ pub fn scan(

    // Convert the device path root to a string we can use in the configuration.
    let mut root = root
-        .to_string(DisplayOnly(false), AllowShortcuts(false))
+        .to_string16(DisplayOnly(false), AllowShortcuts(false))
        .context("unable to convert device root to string")?
        .to_string();
    // Add a trailing forward-slash to the root to ensure the device root is completed.
    root.push('/');

    // Generate a unique hash of the root path.
-    let root_unique_hash = utils::unique_hash(&root);
+    let root_unique_hash = unique_hash(&root);

    // Scan all locations for kernel pairs, adding them to the list.
    for location in SCAN_LOCATIONS {
@@ -1,4 +1,3 @@
-use crate::utils;
 use alloc::string::ToString;
 use alloc::{format, vec};
 use anyhow::{Context, Result};
@@ -6,6 +5,7 @@ use edera_sprout_config::RootConfiguration;
 use edera_sprout_config::actions::ActionDeclaration;
 use edera_sprout_config::actions::chainload::ChainloadConfiguration;
 use edera_sprout_config::entries::EntryDeclaration;
+use edera_sprout_parsing::unique_hash;
 use uefi::CString16;
 use uefi::fs::{FileSystem, Path};
 use uefi::proto::device_path::DevicePath;
@@ -38,14 +38,14 @@ pub fn scan(

    // Convert the device path root to a string we can use in the configuration.
    let mut root = root
-        .to_string(DisplayOnly(false), AllowShortcuts(false))
+        .to_string16(DisplayOnly(false), AllowShortcuts(false))
        .context("unable to convert device root to string")?
        .to_string();
    // Add a trailing forward-slash to the root to ensure the device root is completed.
    root.push('/');

    // Generate a unique hash of the root path.
-    let root_unique_hash = utils::unique_hash(&root);
+    let root_unique_hash = unique_hash(&root);

    // Generate a unique name for the Windows chainload action.
    let chainload_action_name = format!("{}{}", WINDOWS_CHAINLOAD_ACTION_PREFIX, root_unique_hash,);
@@ -1,14 +1,13 @@
 use crate::options::SproutOptions;
 use alloc::boxed::Box;
 use alloc::collections::{BTreeMap, BTreeSet};
-use alloc::format;
 use alloc::rc::Rc;
 use alloc::string::{String, ToString};
 use alloc::vec::Vec;
 use anyhow::anyhow;
 use anyhow::{Result, bail};
-use core::cmp::Reverse;
 use edera_sprout_config::actions::ActionDeclaration;
+use edera_sprout_parsing::stamp_values;
 use eficore::platform::timer::PlatformTimer;
 use uefi::proto::device_path::DevicePath;

@@ -197,7 +196,7 @@ impl SproutContext {
            let mut did_change = false;
            let mut values = BTreeMap::new();
            for (key, value) in &current_values {
-                let (changed, result) = Self::stamp_values(&current_values, value);
+                let (changed, result) = stamp_values(&current_values, value);
                if changed {
                    // If the value changed, we need to re-stamp it.
                    did_change = true;
@@ -221,52 +220,20 @@ impl SproutContext {
        })
    }

-    /// Stamps the `text` value with the specified `values` map. The returned value indicates
-    /// whether the `text` has been changed and the value that was stamped and changed.
-    ///
-    /// Stamping works like this:
-    /// - Start with the input text.
-    /// - Sort all the keys in reverse length order (longest keys first)
-    /// - For each key, if the key is not empty, replace $KEY in the text.
-    /// - Each follow-up iteration acts upon the last iterations result.
-    /// - We keep track if the text changes during the replacement.
-    /// - We return both whether the text changed during any iteration and the final result.
-    fn stamp_values(values: &BTreeMap<String, String>, text: impl AsRef<str>) -> (bool, String) {
-        let mut result = text.as_ref().to_string();
-        let mut did_change = false;
-
-        // Sort the keys by length. This is to ensure that we stamp the longest keys first.
-        // If we did not do this, "$abc" could be stamped by "$a" into an invalid result.
-        let mut keys = values.keys().collect::<Vec<_>>();
-
-        // Sort by key length, reversed. This results in the longest keys appearing first.
-        keys.sort_by_key(|key| Reverse(key.len()));
-
-        for key in keys {
-            // Empty keys are not supported.
-            if key.is_empty() {
-                continue;
-            }
-
-            // We can fetch the value from the map. It is verifiable that the key exists.
-            let Some(value) = values.get(key) else {
-                unreachable!("keys iterated over is collected on a map that cannot be modified");
-            };
-
-            let next_result = result.replace(&format!("${key}"), value);
-            if result != next_result {
-                did_change = true;
-            }
-            result = next_result;
-        }
-        (did_change, result)
-    }
-
    /// Stamps the input `text` with all the values in this [SproutContext] and it's parents.
    /// For example, if this context contains {"a":"b"}, and the text "hello\\$a", it will produce
    /// "hello\\b" as an output string.
    pub fn stamp(&self, text: impl AsRef<str>) -> String {
-        Self::stamp_values(&self.all_values(), text.as_ref()).1
+        stamp_values(&self.all_values(), text.as_ref()).1
+    }
+
+    /// Stamps all the items from the iterator `input` with all the values in this [SproutContext]
+    /// and it's parents. This calls [self.stamp] on each item.
+    pub fn stamp_iter(
+        &self,
+        input: impl Iterator<Item = impl AsRef<str>>,
+    ) -> impl Iterator<Item = String> {
+        input.map(|item| self.stamp(item))
    }

    /// Unloads a [SproutContext] back into an owned context. This
@@ -18,7 +18,7 @@ fn load_driver(context: Rc<SproutContext>, driver: &DriverDeclaration) -> Result
    // Resolve the path to the driver image.
    let resolved = eficore::path::resolve_path(
        Some(context.root().loaded_image_path()?),
-        &context.stamp(&driver.path),
+        context.stamp(&driver.path),
    )
    .context("unable to resolve path to driver")?;

@@ -49,7 +49,7 @@ fn reconnect() -> Result<()> {
    for handle in handles.iter() {
        // Ignore the result as there is nothing we can do if reconnecting a controller fails.
        // This is also likely to fail in some cases but should fail safely.
-        let _ = uefi::boot::connect_controller(*handle, None, None, true);
+        let _ = uefi::boot::connect_controller(*handle, &[], None, true);
    }

    Ok(())
@@ -1,22 +1,22 @@
 use crate::context::SproutContext;
 use crate::entries::BootableEntry;
-use crate::generators::bls::entry::BlsEntry;
-use crate::utils::vercmp;
-use alloc::format;
-use alloc::rc::Rc;
-use alloc::string::{String, ToString};
-use alloc::vec::Vec;
+use alloc::{
+    format,
+    rc::Rc,
+    string::{String, ToString},
+    vec::Vec,
+};
 use anyhow::{Context, Result};
-use core::cmp::Ordering;
-use core::str::FromStr;
+use core::{cmp::Ordering, str::FromStr};
+use edera_sprout_bls::{BlsEntry, sort_bls};
 use edera_sprout_config::generators::bls::BlsConfiguration;
-use uefi::cstr16;
-use uefi::fs::{FileSystem, PathBuf};
-use uefi::proto::device_path::text::{AllowShortcuts, DisplayOnly};
-use uefi::proto::media::fs::SimpleFileSystem;
-
-/// BLS entry parser.
-mod entry;
+use log::warn;
+use uefi::{
+    cstr16,
+    fs::{FileSystem, PathBuf},
+    proto::device_path::text::{AllowShortcuts, DisplayOnly},
+    proto::media::fs::SimpleFileSystem,
+};

 // TODO(azenla): remove this once variable substitution is implemented.
 /// This function is used to remove the `tuned_initrd` variable from entry values.
@@ -28,55 +28,9 @@ fn quirk_initrd_remove_tuned(input: String) -> String {
 /// Sorts two entries according to the BLS sort system.
 /// Reference: <https://uapi-group.org/specifications/specs/boot_loader_specification/#sorting>
 fn sort_entries(a: &(BlsEntry, BootableEntry), b: &(BlsEntry, BootableEntry)) -> Ordering {
-    // Grab the components of both entries.
    let (a_bls, a_boot) = a;
    let (b_bls, b_boot) = b;
-
-    // Grab the sort keys from both entries.
-    let a_sort_key = a_bls.sort_key();
-    let b_sort_key = b_bls.sort_key();
-
-    // Compare the sort keys of both entries.
-    match a_sort_key.cmp(&b_sort_key) {
-        // If A and B sort keys are equal, sort by machine-id.
-        Ordering::Equal => {
-            // Grab the machine-id from both entries.
-            let a_machine_id = a_bls.machine_id();
-            let b_machine_id = b_bls.machine_id();
-
-            // Compare the machine-id of both entries.
-            match a_machine_id.cmp(&b_machine_id) {
-                // If both machine-id values are equal, sort by version.
-                Ordering::Equal => {
-                    // Grab the version from both entries.
-                    let a_version = a_bls.version();
-                    let b_version = b_bls.version();
-
-                    // Compare the version of both entries, sorting newer versions first.
-                    match vercmp::compare_versions_optional(
-                        a_version.as_deref(),
-                        b_version.as_deref(),
-                    )
-                    .reverse()
-                    {
-                        // If both versions are equal, sort by file name in reverse order.
-                        Ordering::Equal => {
-                            // Grab the file name from both entries.
-                            let a_name = a_boot.name();
-                            let b_name = b_boot.name();
-
-                            // Compare the file names of both entries, sorting newer entries first.
-                            vercmp::compare_versions(a_name, b_name).reverse()
-                        }
-                        other => other,
-                    }
-                }
-                other => other,
-            }
-        }
-
-        other => other,
-    }
+    sort_bls(a_bls, a_boot.name(), b_bls, b_boot.name())
 }

 /// Generates entries from the BLS entries directory using the specified `bls` configuration and
@@ -96,7 +50,7 @@ pub fn generate(context: Rc<SproutContext>, bls: &BlsConfiguration) -> Result<Ve
    let mut entries_path = PathBuf::from(
        bls_resolved
            .sub_path
-            .to_string(DisplayOnly(false), AllowShortcuts(false))
+            .to_string16(DisplayOnly(false), AllowShortcuts(false))
            .context("unable to convert bls path to string")?,
    );
    entries_path.push(cstr16!("entries"));
@@ -107,6 +61,15 @@ pub fn generate(context: Rc<SproutContext>, bls: &BlsConfiguration) -> Result<Ve
            .context("unable to open bls filesystem")?;
    let mut fs = FileSystem::new(fs);

+    // The entries directory is optional, as a BLS directory may only contain a loader.conf file.
+    // If it does not exist, there are no entries to generate.
+    if !fs
+        .try_exists(&entries_path)
+        .context("unable to check for bls entries directory")?
+    {
+        return Ok(Vec::new());
+    }
+
    // Read the BLS entries directory.
    let entries_iter = fs
        .read_dir(&entries_path)
@@ -143,15 +106,33 @@ pub fn generate(context: Rc<SproutContext>, bls: &BlsConfiguration) -> Result<Ve
        full_entry_path.push(entry.file_name());

        // Read the entry file.
-        let content = fs
-            .read(full_entry_path)
-            .context("unable to read bls file")?;
+        // Entries that can't be read or parsed are skipped, as one broken entry
+        // should not prevent booting any of the other entries.
+        let content = match fs.read(full_entry_path) {
+            Ok(content) => content,
+            Err(error) => {
+                warn!("unable to read bls entry {}: {}", name, error);
+                continue;
+            }
+        };

        // Parse the entry file as a UTF-8 string.
-        let content = String::from_utf8(content).context("unable to read bls entry as utf8")?;
+        let content = match String::from_utf8(content) {
+            Ok(content) => content,
+            Err(error) => {
+                warn!("unable to read bls entry {} as utf8: {}", name, error);
+                continue;
+            }
+        };

        // Parse the entry file as a BLS entry.
-        let entry = BlsEntry::from_str(&content).context("unable to parse bls entry")?;
+        let entry = match BlsEntry::from_str(&content) {
+            Ok(entry) => entry,
+            Err(error) => {
+                warn!("unable to parse bls entry {}: {}", name, error);
+                continue;
+            }
+        };

        // Ignore entries that are not valid for Sprout.
        if !entry.is_valid() {
@@ -1,168 +0,0 @@
-use alloc::string::{String, ToString};
-use anyhow::{Error, Result};
-use core::str::FromStr;
-
-/// Represents a parsed BLS entry.
-/// Fields unrelated to Sprout are not included.
-#[derive(Default, Debug, Clone)]
-pub struct BlsEntry {
-    /// The title of the entry.
-    pub title: Option<String>,
-    /// The options to pass to the entry.
-    pub options: Option<String>,
-    /// The path to the linux kernel.
-    pub linux: Option<String>,
-    /// The path to the initrd.
-    pub initrd: Option<String>,
-    /// The path to an EFI image.
-    pub efi: Option<String>,
-    /// The sort key for the entry.
-    pub sort_key: Option<String>,
-    /// The version of the entry.
-    pub version: Option<String>,
-    /// The machine id of the entry.
-    pub machine_id: Option<String>,
-}
-
-/// Parser for a BLS entry.
-impl FromStr for BlsEntry {
-    type Err = Error;
-
-    /// Parses the `input` as a BLS entry file.
-    fn from_str(input: &str) -> Result<Self> {
-        // All the fields in a BLS entry we understand.
-        // Set all to None initially.
-        let mut title: Option<String> = None;
-        let mut options: Option<String> = None;
-        let mut linux: Option<String> = None;
-        let mut initrd: Option<String> = None;
-        let mut efi: Option<String> = None;
-        let mut sort_key: Option<String> = None;
-        let mut version: Option<String> = None;
-        let mut machine_id: Option<String> = None;
-
-        // Iterate over each line in the input and parse it.
-        for line in input.lines() {
-            // Trim the line.
-            let line = line.trim();
-
-            // Skip over empty lines and comments.
-            if line.is_empty() || line.starts_with('#') {
-                continue;
-            }
-
-            // Split the line once by whitespace. This technically includes newlines but since
-            // the lines iterator is used, there should never be a newline here.
-            let Some((key, value)) = line.split_once(char::is_whitespace) else {
-                continue;
-            };
-
-            // Match the key to a field we understand.
-            match key {
-                // The title of the entry.
-                "title" => {
-                    title = Some(value.trim().to_string());
-                }
-
-                // The options to pass to the entry.
-                "options" => {
-                    options = Some(value.trim().to_string());
-                }
-
-                // The path to the linux kernel.
-                "linux" => {
-                    linux = Some(value.trim().to_string());
-                }
-
-                // The path to the initrd.
-                "initrd" => {
-                    initrd = Some(value.trim().to_string());
-                }
-
-                // The path to an EFI image.
-                "efi" => {
-                    efi = Some(value.trim().to_string());
-                }
-
-                "sort-key" => {
-                    sort_key = Some(value.trim().to_string());
-                }
-
-                "version" => {
-                    version = Some(value.trim().to_string());
-                }
-
-                "machine-id" => {
-                    machine_id = Some(value.trim().to_string());
-                }
-
-                // Ignore any other key.
-                _ => {
-                    continue;
-                }
-            }
-        }
-
-        // Produce a BLS entry from the parsed fields.
-        Ok(Self {
-            title,
-            options,
-            linux,
-            initrd,
-            efi,
-            sort_key,
-            version,
-            machine_id,
-        })
-    }
-}
-
-impl BlsEntry {
-    /// Checks if this BLS entry is something we can actually boot in Sprout.
-    pub fn is_valid(&self) -> bool {
-        self.linux.is_some() || self.efi.is_some()
-    }
-
-    /// Fetches the path to an EFI bootable image to boot, if any.
-    /// This prioritizes the linux field over efi.
-    /// It also converts / to \\ to match EFI path style.
-    pub fn chainload_path(&self) -> Option<String> {
-        self.linux
-            .clone()
-            .or(self.efi.clone())
-            .map(|path| path.replace('/', "\\").trim_start_matches('\\').to_string())
-    }
-
-    /// Fetches the path to an initrd to pass to the kernel, if any.
-    /// It also converts / to \\ to match EFI path style.
-    pub fn initrd_path(&self) -> Option<String> {
-        self.initrd
-            .clone()
-            .map(|path| path.replace('/', "\\").trim_start_matches('\\').to_string())
-    }
-
-    /// Fetches the options to pass to the kernel, if any.
-    pub fn options(&self) -> Option<String> {
-        self.options.clone()
-    }
-
-    /// Fetches the title of the entry, if any.
-    pub fn title(&self) -> Option<String> {
-        self.title.clone()
-    }
-
-    /// Fetches the sort key of the entry, if any.
-    pub fn sort_key(&self) -> Option<String> {
-        self.sort_key.clone()
-    }
-
-    /// Fetches the version of the entry, if any.
-    pub fn version(&self) -> Option<String> {
-        self.version.clone()
-    }
-
-    /// Fetches the machine id of the entry, if any.
-    pub fn machine_id(&self) -> Option<String> {
-        self.machine_id.clone()
-    }
-}
@@ -22,11 +22,10 @@ pub fn generate(

        // Stamp the entry title and actions from the template.
        let mut entry = list.entry.clone();
-        entry.actions = entry
-            .actions
-            .into_iter()
-            .map(|action| context.stamp(action))
-            .collect();
+
+        // Stamp all the actions this entry references.
+        entry.actions = context.stamp_iter(entry.actions.into_iter()).collect();
+
        // Push the entry into the list with the new context.
        entries.push(BootableEntry::new(
            index.to_string(),
@@ -1,46 +1,12 @@
 use crate::context::SproutContext;
 use crate::entries::BootableEntry;
 use crate::generators::list;
-use alloc::collections::BTreeMap;
 use alloc::rc::Rc;
-use alloc::string::String;
-use alloc::vec;
 use alloc::vec::Vec;
 use anyhow::Result;
 use edera_sprout_config::generators::list::ListConfiguration;
 use edera_sprout_config::generators::matrix::MatrixConfiguration;
-
-/// Builds out multiple generations of `input` based on a matrix style.
-/// For example, if input is: {"x": ["a", "b"], "y": ["c", "d"]}
-/// It will produce:
-/// x: a, y: c
-/// x: a, y: d
-/// x: b, y: c
-/// x: b, y: d
-fn build_matrix(input: &BTreeMap<String, Vec<String>>) -> Vec<BTreeMap<String, String>> {
-    // Convert the input into a vector of tuples.
-    let items: Vec<(String, Vec<String>)> = input.clone().into_iter().collect();
-
-    // The result is a vector of maps.
-    let mut result: Vec<BTreeMap<String, String>> = vec![BTreeMap::new()];
-
-    for (key, values) in items {
-        let mut new_result = Vec::new();
-
-        // Produce all the combinations of the input values.
-        for combination in &result {
-            for value in &values {
-                let mut new_combination = combination.clone();
-                new_combination.insert(key.clone(), value.clone());
-                new_result.push(new_combination);
-            }
-        }
-
-        result = new_result;
-    }
-
-    result.into_iter().filter(|item| !item.is_empty()).collect()
-}
+use edera_sprout_parsing::build_matrix;

 /// Generates a set of entries using the specified `matrix` configuration in the `context`.
 pub fn generate(
@@ -3,28 +3,26 @@
 #![no_main]
 extern crate alloc;

-use crate::context::{RootContext, SproutContext};
-use crate::entries::BootableEntry;
-use crate::options::SproutOptions;
-use crate::phases::phase;
-use crate::utils::vercmp::compare_versions;
-use alloc::collections::BTreeMap;
-use alloc::format;
-use alloc::string::ToString;
-use alloc::vec::Vec;
+use crate::{
+    context::{RootContext, SproutContext},
+    entries::BootableEntry,
+    options::SproutOptions,
+    phases::phase,
+};
+use alloc::{collections::BTreeMap, format, string::ToString, vec::Vec};
 use anyhow::{Context, Result, bail};
-use core::ops::Deref;
-use core::time::Duration;
+use core::{ops::Deref, time::Duration};
+use edera_sprout_bls::compare_versions;
 use edera_sprout_config::RootConfiguration;
-use eficore::bootloader_interface::{BootloaderInterface, BootloaderInterfaceTimeout};
-use eficore::partition::PartitionGuidForm;
-use eficore::platform::timer::PlatformTimer;
-use eficore::platform::tpm::PlatformTpm;
-use eficore::secure::SecureBoot;
-use eficore::setup;
+use eficore::{
+    bootloader_interface::{BootloaderInterface, BootloaderInterfaceTimeout},
+    partition::PartitionGuidForm,
+    platform::{timer::PlatformTimer, tpm::PlatformTpm},
+    secure::SecureBoot,
+    setup,
+};
 use log::{error, info, warn};
-use uefi::entry;
-use uefi::proto::device_path::LoadedImageDevicePath;
+use uefi::{entry, proto::device_path::LoadedImageDevicePath};
 use uefi_raw::Status;

 /// actions: Code that can be configured and executed by Sprout.
@@ -63,9 +61,6 @@ pub mod phases;
 /// sbat: Secure Boot Attestation section.
 pub mod sbat;

-/// utils: Utility functions that are used by other parts of Sprout.
-pub mod utils;
-
 /// The delay to wait for when an error occurs in Sprout.
 const DELAY_ON_ERROR: Duration = Duration::from_secs(10);

@@ -266,9 +261,6 @@ fn run() -> Result<()> {
    BootloaderInterface::set_entries(entries.iter().map(|entry| entry.name()))
        .context("unable to set entries in bootloader interface")?;

-    // Execute the late phase.
-    phase(context.clone(), &config.phases.late).context("unable to execute late phase")?;
-
    // Acquire the timeout setting from the bootloader interface.
    let bootloader_interface_timeout =
        BootloaderInterface::get_timeout().context("unable to get bootloader interface timeout")?;
@@ -360,6 +352,9 @@ fn run() -> Result<()> {
    BootloaderInterface::set_selected_entry(entry.name().to_string())
        .context("unable to set selected entry in bootloader interface")?;

+    // Execute the late phase, now that the entry is chosen but before its actions are executed.
+    phase(context.clone(), &config.phases.late).context("unable to execute late phase")?;
+
    // Execute all the actions for the selected entry.
    for action in &entry.declaration().actions {
        let action = entry.context().stamp(action);
@@ -1,6 +1,6 @@
 use crate::entries::BootableEntry;
 use alloc::vec;
-use anyhow::{Context, Result, bail};
+use anyhow::{Context, Result};
 use core::time::Duration;
 use eficore::bootloader_interface::BootloaderInterface;
 use eficore::platform::timer::PlatformTimer;
@@ -44,23 +44,15 @@ fn read(input: &mut Input, timeout: &Duration) -> Result<MenuOperation> {
            .context("unable to create timer event")?
    };

-    // The timeout is in increments of 100 nanoseconds.
-    let timeout_hundred_nanos = timeout.as_nanos() / 100;
-
-    // Check if the timeout is too large to fit into an u64.
-    if timeout_hundred_nanos > u64::MAX as u128 {
-        bail!("timeout duration overflow");
-    }
-
    // Set a timer to trigger after the specified duration.
-    let trigger = TimerTrigger::Relative(timeout_hundred_nanos as u64);
+    let trigger = TimerTrigger::Relative(*timeout);
    uefi::boot::set_timer(&timer_event, trigger).context("unable to set timeout timer")?;

-    let mut events = vec![timer_event, key_event];
+    let events = vec![timer_event, key_event];

    // Wait for either the timer event or the key event to trigger.
    // Store the result so that we can free the timer event.
-    let event_result = uefi::boot::wait_for_event(&mut events)
+    let event_result = uefi::boot::wait_for_event(&events)
        .discard_errdata()
        .context("unable to wait for event");

@@ -94,8 +86,10 @@ fn read(input: &mut Input, timeout: &Duration) -> Result<MenuOperation> {
    }

    // If we reach here, there is a key event.
+    // Some firmware signals the key event without a key being available,
+    // in which case there is nothing to do.
    let Some(key) = input.read_key().context("unable to read key")? else {
-        bail!("no key was pressed");
+        return Ok(MenuOperation::Nop);
    };

    match key {
@@ -1,5 +1,5 @@
 use alloc::string::{String, ToString};
-use anyhow::Result;
+use anyhow::{Context, Result, anyhow};
 use core::ptr::null_mut;
 use jaarg::{
    ErrorUsageWriter, ErrorUsageWriterContext, HelpWriter, HelpWriterContext, Opt, Opts,
@@ -131,11 +131,15 @@ impl SproutOptions {
        ) {
            ParseResult::ContinueSuccess => Ok(result),
            ParseResult::ExitSuccess => unsafe {
-                uefi::boot::exit(uefi::boot::image_handle(), Status::SUCCESS, 0, null_mut());
+                uefi::boot::exit(uefi::boot::image_handle(), Status::SUCCESS, 0, null_mut())
+                    .context("unable to exit")?;
+                Err(anyhow!("unable to exit"))
            },

            ParseResult::ExitError => unsafe {
-                uefi::boot::exit(uefi::boot::image_handle(), Status::ABORTED, 0, null_mut());
+                uefi::boot::exit(uefi::boot::image_handle(), Status::ABORTED, 0, null_mut())
+                    .context("unable to exit")?;
+                Err(anyhow!("unable to exit"))
            },
        }
    }
@@ -1,26 +0,0 @@
-use alloc::string::{String, ToString};
-use alloc::vec::Vec;
-use sha2::{Digest, Sha256};
-
-/// Implements a version comparison algorithm according to the BLS specification.
-pub mod vercmp;
-
-/// Combine a sequence of strings into a single string, separated by spaces, ignoring empty strings.
-pub fn combine_options<T: AsRef<str>>(options: impl Iterator<Item = T>) -> String {
-    options
-        .flat_map(|item| empty_is_none(Some(item)))
-        .map(|item| item.as_ref().to_string())
-        .collect::<Vec<_>>()
-        .join(" ")
-}
-
-/// Produce a unique hash for the input.
-/// This uses SHA-256, which is unique enough but relatively short.
-pub fn unique_hash(input: &str) -> String {
-    hex::encode(Sha256::digest(input.as_bytes()))
-}
-
-/// Filter a string-like Option `input` such that an empty string is [None].
-pub fn empty_is_none<T: AsRef<str>>(input: Option<T>) -> Option<T> {
-    input.filter(|input| !input.as_ref().is_empty())
-}
@@ -1,184 +0,0 @@
-use core::cmp::Ordering;
-use core::iter::Peekable;
-
-/// Handles single character advancement and comparison.
-macro_rules! handle_single_char {
-    ($ca: expr, $cb:expr, $a_chars:expr, $b_chars:expr, $c:expr) => {
-        match ($ca == $c, $cb == $c) {
-            (true, false) => return Ordering::Less,
-            (false, true) => return Ordering::Greater,
-            (true, true) => {
-                $a_chars.next();
-                $b_chars.next();
-                continue;
-            }
-            _ => {}
-        }
-    };
-}
-
-/// Compares two strings using the BLS version comparison specification.
-/// Handles optional values as well by comparing only if both are specified.
-pub fn compare_versions_optional(a: Option<&str>, b: Option<&str>) -> Ordering {
-    match (a, b) {
-        // If both have values, compare them.
-        (Some(a), Some(b)) => compare_versions(a, b),
-        // If the second value is None, then `a` is less than `b`.
-        (Some(_a), None) => Ordering::Less,
-        // If the first value is None, the `a` is greater than `b`.
-        (None, Some(_b)) => Ordering::Greater,
-        // If both values are None, return that they are equal.
-        (None, None) => Ordering::Equal,
-    }
-}
-
-/// Compares two strings using the BLS version comparison specification.
-/// See: <https://uapi-group.org/specifications/specs/version_format_specification/>
-pub fn compare_versions(a: &str, b: &str) -> Ordering {
-    // Acquire a peekable iterator for each string.
-    let mut a_chars = a.chars().peekable();
-    let mut b_chars = b.chars().peekable();
-
-    // Loop until we have reached the end of one of the strings.
-    loop {
-        // Skip invalid characters in both strings.
-        skip_invalid(&mut a_chars);
-        skip_invalid(&mut b_chars);
-
-        // Check if either string has ended.
-        match (a_chars.peek(), b_chars.peek()) {
-            // No more characters in either string.
-            (None, None) => return Ordering::Equal,
-            // One string has ended, the other hasn't.
-            (None, Some(_)) => return Ordering::Less,
-            (Some(_), None) => return Ordering::Greater,
-            // Both strings have characters left.
-            (Some(&ca), Some(&cb)) => {
-                // Handle the ~ character.
-                handle_single_char!(ca, cb, a_chars, b_chars, '~');
-
-                // Handle '-' character.
-                handle_single_char!(ca, cb, a_chars, b_chars, '-');
-
-                // Handle the '^' character.
-                handle_single_char!(ca, cb, a_chars, b_chars, '^');
-
-                // Handle the '.' character.
-                handle_single_char!(ca, cb, a_chars, b_chars, '.');
-
-                // Handle digits with numerical comparison.
-                // We key off of the A character being a digit intentionally as we presume
-                // this indicates it will be the same at this position.
-                if ca.is_ascii_digit() || cb.is_ascii_digit() {
-                    let result = compare_numeric(&mut a_chars, &mut b_chars);
-                    if result != Ordering::Equal {
-                        return result;
-                    }
-                    continue;
-                }
-
-                // Handle letters with alphabetical comparison.
-                // We key off of the A character being alphabetical intentionally as we presume
-                // this indicates it will be the same at this position.
-                if ca.is_ascii_alphabetic() || cb.is_ascii_alphabetic() {
-                    let result = compare_alphabetic(&mut a_chars, &mut b_chars);
-                    if result != Ordering::Equal {
-                        return result;
-                    }
-                    continue;
-                }
-            }
-        }
-    }
-}
-
-/// Skips characters that are not in the valid character set.
-fn skip_invalid<I: Iterator<Item = char>>(iter: &mut Peekable<I>) {
-    while let Some(&c) = iter.peek() {
-        if is_valid_char(c) {
-            break;
-        }
-        iter.next();
-    }
-}
-
-/// Checks if a character is in the valid character set for comparison.
-fn is_valid_char(c: char) -> bool {
-    matches!(c, 'a'..='z' | 'A'..='Z' | '0'..='9' | '-' | '.' | '~' | '^')
-}
-
-/// Compares numerical prefixes by extracting numbers.
-fn compare_numeric<I: Iterator<Item = char>>(
-    iter_a: &mut Peekable<I>,
-    iter_b: &mut Peekable<I>,
-) -> Ordering {
-    let num_a = extract_number(iter_a);
-    let num_b = extract_number(iter_b);
-
-    num_a.cmp(&num_b)
-}
-
-/// Extracts a number from the iterator, skipping leading zeros.
-fn extract_number<I: Iterator<Item = char>>(iter: &mut Peekable<I>) -> u64 {
-    // Skip leading zeros
-    while let Some(&'0') = iter.peek() {
-        iter.next();
-    }
-
-    let mut num = 0u64;
-    while let Some(&c) = iter.peek() {
-        if c.is_ascii_digit() {
-            iter.next();
-            num = num.saturating_mul(10).saturating_add(c as u64 - '0' as u64);
-        } else {
-            break;
-        }
-    }
-
-    num
-}
-
-/// Compares alphabetical prefixes
-/// Capital letters compare lower than lowercase letters (B < a)
-fn compare_alphabetic<I: Iterator<Item = char>>(
-    iter_a: &mut Peekable<I>,
-    iter_b: &mut Peekable<I>,
-) -> Ordering {
-    loop {
-        return match (iter_a.peek(), iter_b.peek()) {
-            (Some(&ca), Some(&cb)) if ca.is_ascii_alphabetic() && cb.is_ascii_alphabetic() => {
-                if ca == cb {
-                    // Same character, we should continue.
-                    iter_a.next();
-                    iter_b.next();
-                    continue;
-                }
-
-                // Different characters found.
-                // All capital letters compare lower than lowercase letters.
-                match (ca.is_ascii_uppercase(), cb.is_ascii_uppercase()) {
-                    (true, false) => Ordering::Less,    // uppercase < lowercase
-                    (false, true) => Ordering::Greater, // lowercase > uppercase
-                    (true, true) => ca.cmp(&cb),        // both are uppercase
-                    (false, false) => ca.cmp(&cb),      // both are lowercase
-                }
-            }
-
-            (Some(&ca), Some(_)) if ca.is_ascii_alphabetic() => {
-                // a has letters, b doesn't
-                Ordering::Greater
-            }
-
-            (Some(_), Some(&cb)) if cb.is_ascii_alphabetic() => {
-                // b has letters, a doesn't
-                Ordering::Less
-            }
-
-            (Some(&ca), None) if ca.is_ascii_alphabetic() => Ordering::Greater,
-
-            (None, Some(&cb)) if cb.is_ascii_alphabetic() => Ordering::Less,
-
-            _ => Ordering::Equal,
-        };
-    }
-}
@@ -19,3 +19,4 @@ uefi-raw.workspace = true
 [lib]
 name = "eficore"
 path = "src/lib.rs"
+test = false
@@ -5,6 +5,7 @@ use alloc::format;
 use alloc::string::{String, ToString};
 use alloc::vec::Vec;
 use anyhow::{Context, Result};
+use log::warn;
 use uefi::proto::device_path::DevicePath;
 use uefi::{Guid, guid};
 use uefi_raw::table::runtime::VariableVendor;
@@ -245,9 +246,14 @@ impl BootloaderInterface {
        }

        // Parse the value as a u64 to decode an numeric value.
-        let value = value
-            .parse::<u64>()
-            .context("unable to parse timeout value")?;
+        // An invalid value is ignored, as a bad variable should not prevent booting.
+        let value = match value.parse::<u64>() {
+            Ok(value) => value,
+            Err(error) => {
+                warn!("ignoring invalid {} value '{}': {}", key, value, error);
+                return Ok(None);
+            }
+        };

        // The specification says that a value of 0 means that the menu should be hidden.
        if value == 0 {
@@ -289,9 +295,11 @@ impl BootloaderInterface {

    /// Get the default entry set by the bootloader interface.
    pub fn get_default_entry() -> Result<Option<String>> {
-        Self::VENDOR
+        // An empty value is treated as if the default entry was not set.
+        Ok(Self::VENDOR
            .get_cstr16("LoaderEntryDefault")
-            .context("unable to get default entry from bootloader interface")
+            .context("unable to get default entry from bootloader interface")?
+            .filter(|value| !value.is_empty()))
    }

    /// Get the oneshot entry set by the bootloader interface.
@@ -312,6 +320,7 @@ impl BootloaderInterface {
            .context("unable to remove oneshot entry")?;

        // Return the oneshot value.
-        Ok(Some(value))
+        // An empty value is treated as if the oneshot entry was not set.
+        Ok(Some(value).filter(|value| !value.is_empty()))
    }
 }
@@ -52,7 +52,7 @@ pub fn args() -> Result<Vec<String>> {
                .next()
                // Filter out unprintable characters and backticks.
                // Both of which have been observed in the wild.
-                .map(|c| c < 0x1f as char || c == '`')
+                .map(|c| c.is_ascii_control() || c == '`')
                .unwrap_or(false)
        })
        .collect();
@@ -83,16 +83,6 @@ impl ImageLoader {
        // If the image loader is installed, we can skip over the security hook.
        let requires_security_hook = secure_boot && shim_loaded && !shim_loader_available;

-        // If the security hook is required, we will bail for now.
-        if requires_security_hook {
-            // Install the security hook, if possible. If it's not, this is necessary to continue,
-            // so we should bail.
-            let installed = SecurityHook::install().context("unable to install security hook")?;
-            if !installed {
-                bail!("unable to install security hook required for this platform");
-            }
-        }
-
        // If the shim is loaded, we will need to retain the shim protocol to allow
        // loading multiple images.
        if shim_loaded {
@@ -114,6 +104,18 @@ impl ImageLoader {
            file_path: input.file_path(),
        };

+        // If the security hook is required, install it right before loading the image.
+        // Installing it here ensures that an error while preparing the image can't
+        // return without uninstalling the hook.
+        if requires_security_hook {
+            // Install the security hook, if possible. If it's not, this is necessary to continue,
+            // so we should bail.
+            let installed = SecurityHook::install().context("unable to install security hook")?;
+            if !installed {
+                bail!("unable to install security hook required for this platform");
+            }
+        }
+
        // Loads the image using Boot Services LoadImage function.
        let result = uefi::boot::load_image(current_image, source).context("unable to load image");

@@ -34,7 +34,7 @@ impl ResolvedPath {
        let mut fs = FileSystem::new(fs);
        let path = self
            .sub_path
-            .to_string(DisplayOnly(false), AllowShortcuts(false))?;
+            .to_string16(DisplayOnly(false), AllowShortcuts(false))?;
        let content = fs.read(Path::new(&path));
        content.context("unable to read file contents")
    }
@@ -48,8 +48,8 @@ fn cstring16_contains_char(string: &CString16, c: char) -> bool {

 /// Parses the input `path` as a [DevicePath].
 /// Uses the [DevicePathFromText] protocol exclusively, and will fail if it cannot acquire the protocol.
-pub fn text_to_device_path(path: &str) -> Result<PoolDevicePath> {
-    let path = CString16::try_from(path).context("unable to convert path to CString16")?;
+pub fn text_to_device_path(path: impl AsRef<str>) -> Result<PoolDevicePath> {
+    let path = CString16::try_from(path.as_ref()).context("unable to convert path to CString16")?;
    let device_path_from_text = uefi::boot::open_protocol_exclusive::<DevicePathFromText>(
        uefi::boot::get_handle_for_protocol::<DevicePathFromText>()
            .context("no device path from text protocol")?,
@@ -68,7 +68,7 @@ pub fn device_path_root(path: &DevicePath) -> Result<String> {
    let mut path = path
        .node_iter()
        .filter_map(|item| {
-            let item = item.to_string(DisplayOnly(false), AllowShortcuts(false));
+            let item = item.to_string16(DisplayOnly(false), AllowShortcuts(false));
            if item
                .as_ref()
                .map(|item| cstring16_contains_char(item, '('))
@@ -93,7 +93,7 @@ pub fn device_path_subpath(path: &DevicePath) -> Result<String> {
    let path = path
        .node_iter()
        .filter_map(|item| {
-            let item = item.to_string(DisplayOnly(false), AllowShortcuts(false));
+            let item = item.to_string16(DisplayOnly(false), AllowShortcuts(false));
            if item
                .as_ref()
                .map(|item| cstring16_contains_char(item, '('))
@@ -113,19 +113,23 @@ pub fn device_path_subpath(path: &DevicePath) -> Result<String> {
 /// Resolve a path specified by `input` to its various components.
 /// Uses `default_root_path` as the base root if one is not specified in the path.
 /// Returns [ResolvedPath] which contains the resolved components.
-pub fn resolve_path(default_root_path: Option<&DevicePath>, input: &str) -> Result<ResolvedPath> {
-    let mut path = text_to_device_path(input).context("unable to convert text to path")?;
+pub fn resolve_path(
+    default_root_path: Option<&DevicePath>,
+    input: impl ToString,
+) -> Result<ResolvedPath> {
+    let mut input = input.to_string();
+
+    let mut path = text_to_device_path(&input).context("unable to convert text to path")?;
    let path_has_device = path
        .node_iter()
        .next()
        .map(|it| {
-            it.to_string(DisplayOnly(false), AllowShortcuts(false))
+            it.to_string16(DisplayOnly(false), AllowShortcuts(false))
                .unwrap_or_default()
        })
        .map(|it| it.to_string().contains('('))
        .unwrap_or(false);
    if !path_has_device {
-        let mut input = input.to_string();
        if !input.starts_with('\\') {
            input.insert(0, '\\');
        }
@@ -38,6 +38,15 @@ impl PlatformTpm {
    /// The PCR for measuring the bootloader configuration into.
    pub const PCR_BOOT_LOADER_CONFIG: PcrIndex = PcrIndex(5);

+    /// The PCR for measuring the dom0 initrd payload into.
+    pub const PCR_INITRD: PcrIndex = PcrIndex(9);
+
+    /// The PCR for measuring the dom0 kernel payload into.
+    pub const PCR_KERNEL: PcrIndex = PcrIndex(11);
+
+    /// The PCR for measuring kernel command line and xen options into.
+    pub const PCR_KERNEL_PARAMETERS: PcrIndex = PcrIndex(12);
+
    /// Acquire access to the TPM protocol handle, if possible.
    /// Returns None if TPM is not available.
    fn protocol() -> Result<Option<TpmProtocolHandle>> {
@@ -82,9 +82,9 @@ impl<'a> ShimInput<'a> {
                };
                // Convert the underlying path to a string.
                let path = path
-                    .to_string(DisplayOnly(false), AllowShortcuts(false))
+                    .to_string16(DisplayOnly(false), AllowShortcuts(false))
                    .context("unable to convert device path to string")?;
-                let path = crate::path::resolve_path(None, &path.to_string())
+                let path = crate::path::resolve_path(None, path.to_string())
                    .context("unable to resolve path")?;
                // Read the file path.
                let data = path.read_file()?;
@@ -2,11 +2,11 @@ use crate::shim::{ShimInput, ShimSupport, ShimVerificationOutput};
 use anyhow::{Context, Result};
 use core::slice;
 use log::warn;
-use spin::{Lazy, Mutex};
+use spin::{LazyLock, Mutex};
 use uefi::proto::device_path::FfiDevicePath;
 use uefi::proto::unsafe_protocol;
 use uefi::{Guid, guid};
-use uefi_raw::Status;
+use uefi_raw::{Boolean, Status};

 /// GUID for the EFI_SECURITY_ARCH protocol.
 const SECURITY_ARCH_GUID: Guid = guid!("a46423e3-4617-49f1-b9ff-d1bfa9115839");
@@ -33,7 +33,7 @@ pub struct SecurityArch2Protocol {
        path: *const FfiDevicePath,
        file_buffer: *const u8,
        file_size: usize,
-        boot_policy: bool,
+        boot_policy: Boolean,
    ) -> Status,
 }

@@ -45,7 +45,8 @@ struct SecurityHookState {

 /// Global state for the security hook.
 /// This is messy, but it is safe given the mutex.
-static GLOBAL_HOOK_STATE: Lazy<Mutex<Option<SecurityHookState>>> = Lazy::new(|| Mutex::new(None));
+static GLOBAL_HOOK_STATE: LazyLock<Mutex<Option<SecurityHookState>>> =
+    LazyLock::new(|| Mutex::new(None));

 /// Security hook helper.
 pub struct SecurityHook;
@@ -136,7 +137,7 @@ impl SecurityHook {
        path: *const FfiDevicePath,
        file_buffer: *const u8,
        file_size: usize,
-        boot_policy: bool,
+        boot_policy: Boolean,
    ) -> Status {
        // Verify the path and file buffer are not null.
        if path.is_null() || file_buffer.is_null() {
@@ -144,7 +145,7 @@ impl SecurityHook {
        }

        // If the boot policy is true, we can't continue as we don't support that.
-        if boot_policy {
+        if bool::from(boot_policy) {
            return Status::INVALID_PARAMETER;
        }

@@ -215,6 +216,13 @@ impl SecurityHook {

        // Acquire the lock to the global state and replace it.
        let mut global_state = GLOBAL_HOOK_STATE.lock();
+
+        // If the hook is already installed, the protocols contain our hooks.
+        // Storing them as the original hooks would cause infinite recursion on
+        // verification failure, so keep the existing state instead.
+        if global_state.is_some() {
+            return Ok(true);
+        }
        global_state.replace(state);

        // Install the hooks into the UEFI stack.
@@ -10,13 +10,21 @@ pub fn utf16_bytes_to_cstring16(bytes: &[u8]) -> Result<CString16> {
    }

    // Convert the bytes to UTF-16 data.
-    let data = bytes
+    let mut data = bytes
        // Chunk everything into two bytes.
-        .chunks_exact(2)
+        .as_chunks::<2>()
+        .0
+        .iter()
        // Reinterpret the bytes as u16 little-endian.
        .map(|chunk| u16::from_le_bytes([chunk[0], chunk[1]]))
+        // Stop at the first null terminator, if any.
+        // This ignores any trailing data, such as extra null padding.
+        .take_while(|c| *c != 0)
        // Collect the result into a vector.
        .collect::<Vec<_>>();

+    // Add the null terminator, as the input is not guaranteed to be null-terminated.
+    data.push(0);
+
    CString16::try_from(data).context("unable to convert utf16 bytes to CString16")
 }
@@ -0,0 +1,19 @@
+# This crate explicitly does not have uefi/uefi-raw dependencies,
+# so that the contents can be unit-testable on non-UEFI target hosts.
+# Do not add uefi or uefi-raw as dependencies.
+[package]
+name = "edera-sprout-parsing"
+description = "Sprout Parsing Utilities (UEFI-free)"
+license.workspace = true
+version.workspace = true
+homepage.workspace = true
+repository.workspace = true
+edition.workspace = true
+
+[dependencies]
+hex.workspace = true
+sha2.workspace = true
+
+[lib]
+name = "edera_sprout_parsing"
+path = "src/lib.rs"
@@ -0,0 +1,417 @@
+#![no_std]
+extern crate alloc;
+
+use alloc::collections::BTreeMap;
+use alloc::format;
+use alloc::string::{String, ToString};
+use alloc::vec::Vec;
+use core::cmp::Reverse;
+use sha2::{Digest, Sha256};
+
+/// Stamps the `text` value with the specified `values` map. The returned value indicates
+/// whether the `text` has been changed and the value that was stamped and changed.
+///
+/// Stamping works like this:
+/// - Start with the input text.
+/// - Sort all the keys in reverse length order (longest keys first)
+/// - For each key, if the key is not empty, replace $KEY in the text.
+/// - Each follow-up iteration acts upon the last iterations result.
+/// - We keep track if the text changes during the replacement.
+/// - We return both whether the text changed during any iteration and the final result.
+pub fn stamp_values(values: &BTreeMap<String, String>, text: impl AsRef<str>) -> (bool, String) {
+    let mut result = text.as_ref().to_string();
+    let mut did_change = false;
+
+    // Sort the keys by length. This is to ensure that we stamp the longest keys first.
+    // If we did not do this, "$abc" could be stamped by "$a" into an invalid result.
+    let mut keys = values.keys().collect::<Vec<_>>();
+
+    // Sort by key length, reversed. This results in the longest keys appearing first.
+    keys.sort_by_key(|key| Reverse(key.len()));
+
+    for key in keys {
+        // Empty keys are not supported.
+        if key.is_empty() {
+            continue;
+        }
+
+        // We can fetch the value from the map. It is verifiable that the key exists.
+        let Some(value) = values.get(key) else {
+            unreachable!("keys iterated over is collected on a map that cannot be modified");
+        };
+
+        let next_result = result.replace(&format!("${key}"), value);
+        if result != next_result {
+            did_change = true;
+        }
+        result = next_result;
+    }
+    (did_change, result)
+}
+
+/// Builds out multiple generations of `input` based on a matrix style.
+/// For example, if input is: {"x": ["a", "b"], "y": ["c", "d"]}
+/// It will produce:
+/// x: a, y: c
+/// x: a, y: d
+/// x: b, y: c
+/// x: b, y: d
+pub fn build_matrix(input: &BTreeMap<String, Vec<String>>) -> Vec<BTreeMap<String, String>> {
+    // Convert the input into a vector of tuples.
+    let items: Vec<(String, Vec<String>)> = input.clone().into_iter().collect();
+
+    // The result is a vector of maps.
+    let mut result: Vec<BTreeMap<String, String>> = alloc::vec![BTreeMap::new()];
+
+    for (key, values) in items {
+        let mut new_result = Vec::new();
+
+        // Produce all the combinations of the input values.
+        for combination in &result {
+            for value in &values {
+                let mut new_combination = combination.clone();
+                new_combination.insert(key.clone(), value.clone());
+                new_result.push(new_combination);
+            }
+        }
+
+        result = new_result;
+    }
+
+    result.into_iter().filter(|item| !item.is_empty()).collect()
+}
+
+/// Combine a sequence of strings into a single string, separated by spaces, ignoring empty strings.
+pub fn combine_options<T: AsRef<str>>(options: impl Iterator<Item = T>) -> String {
+    options
+        .flat_map(|item| empty_is_none(Some(item)))
+        .map(|item| item.as_ref().to_string())
+        .collect::<Vec<_>>()
+        .join(" ")
+}
+
+/// Produce a unique hash for the input.
+/// This uses SHA-256, which is unique enough but relatively short.
+pub fn unique_hash(input: &str) -> String {
+    hex::encode(Sha256::digest(input.as_bytes()))
+}
+
+/// Filter a string-like Option `input` such that an empty string is [None].
+pub fn empty_is_none<T: AsRef<str>>(input: Option<T>) -> Option<T> {
+    input.filter(|input| !input.as_ref().is_empty())
+}
+
+/// Build a Xen EFI stub configuration file from pre-stamped `xen_options` and `kernel_options`.
+/// The returned string is in the Xen ini-like config file format.
+pub fn build_xen_config(xen_options: &str, kernel_options: &str) -> String {
+    [
+        // global section
+        "[global]",
+        // default configuration section
+        "default=sprout",
+        // configuration section for sprout
+        "[sprout]",
+        // xen options
+        &format!("options={}", xen_options),
+        // kernel options, stub replaces the kernel path
+        // the kernel is provided via media loader
+        &format!("kernel=stub {}", kernel_options),
+        // required or else the last line will be ignored
+        "",
+    ]
+    .join("\n")
+}
+
+/// Filename prefixes used to identify Linux kernel images.
+/// These must be lowercase, as file names are lowercased before matching.
+pub const LINUX_KERNEL_PREFIXES: &[&str] = &["vmlinuz", "image"];
+
+/// Filename prefixes used to identify initramfs images paired with a kernel.
+pub const LINUX_INITRAMFS_PREFIXES: &[&str] = &["initramfs", "initrd", "initrd.img"];
+
+/// Check whether `name` (already lowercased) matches one of the `kernel_prefixes`,
+/// either exactly or as a dash-separated prefix (e.g. `"vmlinuz-6.1"`).
+/// Returns the matched prefix string if found.
+pub fn match_kernel_prefix<'a>(name: &str, kernel_prefixes: &[&'a str]) -> Option<&'a str> {
+    kernel_prefixes
+        .iter()
+        .find(|prefix| name == **prefix || name.starts_with(&format!("{}-", prefix)))
+        .copied()
+}
+
+/// Generate initramfs candidate filenames by combining each entry of `initramfs_prefixes`
+/// with `suffix`. The caller is expected to check which candidates actually exist.
+pub fn initramfs_candidates<'a>(
+    suffix: &'a str,
+    initramfs_prefixes: &'a [&'a str],
+) -> impl Iterator<Item = String> + 'a {
+    initramfs_prefixes
+        .iter()
+        .map(move |prefix| format!("{}{}", prefix, suffix))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn map(pairs: &[(&str, &str)]) -> BTreeMap<String, String> {
+        pairs
+            .iter()
+            .map(|(k, v)| (k.to_string(), v.to_string()))
+            .collect()
+    }
+
+    #[test]
+    fn stamp_replaces_known_key() {
+        let values = map(&[("name", "world")]);
+        let (changed, result) = stamp_values(&values, "hello $name");
+        assert!(changed);
+        assert_eq!(result, "hello world");
+    }
+
+    #[test]
+    fn stamp_no_match_returns_unchanged() {
+        let values = map(&[("name", "world")]);
+        let (changed, result) = stamp_values(&values, "hello there");
+        assert!(!changed);
+        assert_eq!(result, "hello there");
+    }
+
+    #[test]
+    fn stamp_longer_key_takes_precedence_over_shorter() {
+        // Without longest-first ordering, "$ab" would be partially matched by "$a"
+        let values = map(&[("a", "WRONG"), ("ab", "RIGHT")]);
+        let (changed, result) = stamp_values(&values, "$ab");
+        assert!(changed);
+        assert_eq!(result, "RIGHT");
+    }
+
+    #[test]
+    fn stamp_empty_key_is_skipped() {
+        let values = map(&[("", "should-not-appear"), ("x", "val")]);
+        let (_, result) = stamp_values(&values, "$x");
+        assert_eq!(result, "val");
+        assert!(!result.contains("should-not-appear"));
+    }
+
+    #[test]
+    fn stamp_multiple_keys_replaced() {
+        let values = map(&[("a", "foo"), ("b", "bar")]);
+        let (changed, result) = stamp_values(&values, "$a and $b");
+        assert!(changed);
+        assert_eq!(result, "foo and bar");
+    }
+
+    #[test]
+    fn stamp_empty_text_returns_empty() {
+        let values = map(&[("a", "foo")]);
+        let (changed, result) = stamp_values(&values, "");
+        assert!(!changed);
+        assert_eq!(result, "");
+    }
+
+    #[test]
+    fn stamp_empty_map_returns_unchanged() {
+        let values = map(&[]);
+        let (changed, result) = stamp_values(&values, "hello $name");
+        assert!(!changed);
+        assert_eq!(result, "hello $name");
+    }
+
+    fn matrix_map(pairs: &[(&str, &[&str])]) -> BTreeMap<String, Vec<String>> {
+        pairs
+            .iter()
+            .map(|(k, vs)| (k.to_string(), vs.iter().map(|v| v.to_string()).collect()))
+            .collect()
+    }
+
+    #[test]
+    fn matrix_single_key_produces_one_entry_per_value() {
+        let input = matrix_map(&[("x", &["a", "b", "c"])]);
+        let result = build_matrix(&input);
+        assert_eq!(result.len(), 3);
+    }
+
+    #[test]
+    fn matrix_two_keys_produces_cartesian_product() {
+        let input = matrix_map(&[("x", &["a", "b"]), ("y", &["c", "d"])]);
+        let result = build_matrix(&input);
+        assert_eq!(result.len(), 4);
+        // Every combination of x and y should be present.
+        for x in &["a", "b"] {
+            for y in &["c", "d"] {
+                assert!(
+                    result
+                        .iter()
+                        .any(|m| m.get("x").map(|s| s.as_str()) == Some(x)
+                            && m.get("y").map(|s| s.as_str()) == Some(y))
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn matrix_empty_input_produces_no_entries() {
+        let input = matrix_map(&[]);
+        let result = build_matrix(&input);
+        assert!(result.is_empty());
+    }
+
+    #[test]
+    fn matrix_key_with_empty_values_produces_no_entries() {
+        let input = matrix_map(&[("x", &[])]);
+        let result = build_matrix(&input);
+        assert!(result.is_empty());
+    }
+
+    #[test]
+    fn combine_options_joins_with_space() {
+        let result = combine_options(["a", "b", "c"].iter().copied());
+        assert_eq!(result, "a b c");
+    }
+
+    #[test]
+    fn combine_options_skips_empty_strings() {
+        let result = combine_options(["a", "", "b"].iter().copied());
+        assert_eq!(result, "a b");
+    }
+
+    #[test]
+    fn combine_options_all_empty_returns_empty() {
+        let result = combine_options(["", ""].iter().copied());
+        assert_eq!(result, "");
+    }
+
+    #[test]
+    fn combine_options_empty_iterator_returns_empty() {
+        let result = combine_options(core::iter::empty::<&str>());
+        assert_eq!(result, "");
+    }
+
+    #[test]
+    fn empty_is_none_returns_none_for_empty_string() {
+        assert!(empty_is_none(Some("")).is_none());
+    }
+
+    #[test]
+    fn empty_is_none_returns_some_for_nonempty_string() {
+        assert_eq!(empty_is_none(Some("x")), Some("x"));
+    }
+
+    #[test]
+    fn empty_is_none_passthrough_on_none() {
+        assert!(empty_is_none(None::<&str>).is_none());
+    }
+
+    #[test]
+    fn unique_hash_is_deterministic() {
+        assert_eq!(unique_hash("hello"), unique_hash("hello"));
+    }
+
+    #[test]
+    fn unique_hash_differs_for_different_inputs() {
+        assert_ne!(unique_hash("hello"), unique_hash("world"));
+    }
+
+    #[test]
+    fn unique_hash_empty_string() {
+        // SHA-256 of "" is well-known; just check it produces a non-empty hex string.
+        let h = unique_hash("");
+        assert!(!h.is_empty());
+        assert!(h.chars().all(|c| c.is_ascii_hexdigit()));
+    }
+
+    #[test]
+    fn xen_config_contains_global_and_sprout_sections() {
+        let config = build_xen_config("", "");
+        assert!(config.contains("[global]"));
+        assert!(config.contains("[sprout]"));
+        assert!(config.contains("default=sprout"));
+    }
+
+    #[test]
+    fn xen_config_embeds_xen_options() {
+        let config = build_xen_config("--no-real-mode --iommu=no", "");
+        assert!(config.contains("options=--no-real-mode --iommu=no"));
+    }
+
+    #[test]
+    fn xen_config_embeds_kernel_options() {
+        let config = build_xen_config("", "quiet splash");
+        assert!(config.contains("kernel=stub quiet splash"));
+    }
+
+    #[test]
+    fn xen_config_ends_with_newline() {
+        // Required or the last line will be ignored by the Xen config parser.
+        let config = build_xen_config("", "");
+        assert!(config.ends_with('\n'));
+    }
+
+    #[test]
+    fn kernel_prefix_exact_match() {
+        assert_eq!(
+            match_kernel_prefix("vmlinuz", LINUX_KERNEL_PREFIXES),
+            Some("vmlinuz")
+        );
+    }
+
+    #[test]
+    fn kernel_prefix_dash_suffix_match() {
+        assert_eq!(
+            match_kernel_prefix("vmlinuz-6.1.0", LINUX_KERNEL_PREFIXES),
+            Some("vmlinuz")
+        );
+    }
+
+    #[test]
+    fn kernel_prefix_matches_lowercased_arm64_image() {
+        // Callers lowercase file names before matching, so "Image-6.1" arrives as "image-6.1".
+        assert_eq!(
+            match_kernel_prefix("image-6.1", LINUX_KERNEL_PREFIXES),
+            Some("image")
+        );
+        assert_eq!(
+            match_kernel_prefix("image", LINUX_KERNEL_PREFIXES),
+            Some("image")
+        );
+    }
+
+    #[test]
+    fn kernel_prefix_case_sensitive_no_match() {
+        // match_kernel_prefix expects the caller to lowercase first; uppercase input won't match.
+        assert!(match_kernel_prefix("VMLINUZ-6.1", LINUX_KERNEL_PREFIXES).is_none());
+    }
+
+    #[test]
+    fn kernel_prefix_no_match() {
+        assert!(match_kernel_prefix("initramfs-6.1", LINUX_KERNEL_PREFIXES).is_none());
+    }
+
+    #[test]
+    fn kernel_prefix_partial_no_match() {
+        // "vmlinuz6.1" has no dash separator — should not match.
+        assert!(match_kernel_prefix("vmlinuz6.1", LINUX_KERNEL_PREFIXES).is_none());
+    }
+
+    #[test]
+    fn initramfs_candidates_with_suffix() {
+        let candidates: Vec<_> = initramfs_candidates("-6.1.0", LINUX_INITRAMFS_PREFIXES).collect();
+        assert_eq!(
+            candidates,
+            &["initramfs-6.1.0", "initrd-6.1.0", "initrd.img-6.1.0"]
+        );
+    }
+
+    #[test]
+    fn initramfs_candidates_empty_suffix() {
+        let candidates: Vec<_> = initramfs_candidates("", LINUX_INITRAMFS_PREFIXES).collect();
+        assert_eq!(candidates, &["initramfs", "initrd", "initrd.img"]);
+    }
+
+    #[test]
+    fn initramfs_candidates_empty_prefixes() {
+        let candidates: Vec<_> = initramfs_candidates("-6.1.0", &[]).collect();
+        assert!(candidates.is_empty());
+    }
+}
@@ -1,4 +1,4 @@
-FROM --platform=$BUILDPLATFORM debian:trixie@sha256:0d01188e8dd0ac63bf155900fad49279131a876a1ea7fac917c62e87ccb2732d AS build
+FROM --platform=$BUILDPLATFORM debian:trixie@sha256:9cc080028c43b27d2074d63a5f9caf7166d731494965616c1a6d2827a004585c AS build
 ARG BUILDPLATFORM
 ARG EFI_NAME
 RUN export DEBIAN_FRONTEND=noninteractive && apt-get update && apt-get install -y \
@@ -1,7 +1,7 @@
-ARG KERNEL_SOURCE_URL=https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.2.tar.xz
-ARG KERNEL_CHECKSUM=sha256:558c6bbab749492b34f99827fe807b0039a744693c21d3a7e03b3a48edaab96a
+ARG KERNEL_SOURCE_URL=https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.54.tar.xz
+ARG KERNEL_CHECKSUM=sha256:9df30b02dd8102bbd0be52556288ef6889ddbe7f1ddb96fbf847d0becf3eacac

-FROM --platform=$BUILDPLATFORM debian:trixie@sha256:0d01188e8dd0ac63bf155900fad49279131a876a1ea7fac917c62e87ccb2732d AS buildenv
+FROM --platform=$BUILDPLATFORM debian:trixie@sha256:9cc080028c43b27d2074d63a5f9caf7166d731494965616c1a6d2827a004585c AS buildenv
 RUN export DEBIAN_FRONTEND=noninteractive && apt-get update && apt-get install -y \
      build-essential squashfs-tools python3-yaml \
      patch diffutils sed mawk findutils zstd \
@@ -1 +1 @@
-FROM --platform=$BUILDPLATFORM debian:trixie@sha256:0d01188e8dd0ac63bf155900fad49279131a876a1ea7fac917c62e87ccb2732d
+FROM --platform=$BUILDPLATFORM debian:trixie@sha256:9cc080028c43b27d2074d63a5f9caf7166d731494965616c1a6d2827a004585c
@@ -1,4 +1,4 @@
 ARG TARGET_IMAGE=scratch
 FROM ${TARGET_IMAGE} AS image
-FROM --platform=$BUILDPLATFORM debian:trixie@sha256:0d01188e8dd0ac63bf155900fad49279131a876a1ea7fac917c62e87ccb2732d AS final
+FROM --platform=$BUILDPLATFORM debian:trixie@sha256:9cc080028c43b27d2074d63a5f9caf7166d731494965616c1a6d2827a004585c AS final
 COPY --from=image / /image
@@ -1,4 +1,4 @@
-FROM alpine:3.23@sha256:865b95f46d98cf867a156fe4a135ad3fe50d2056aa3f25ed31662dff6da4eb62 AS rootfs
+FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS rootfs
 RUN apk --no-cache add alpine-base tzdata wireless-regdb ifupdown-ng agetty
 RUN rc-update add devfs sysinit && \
    rc-update add dmesg sysinit && \
@@ -21,7 +21,7 @@ RUN rc-update add devfs sysinit && \
 ADD kernel.modules.tgz /
 COPY files/interfaces /etc/network/interfaces

-FROM alpine:3.23@sha256:865b95f46d98cf867a156fe4a135ad3fe50d2056aa3f25ed31662dff6da4eb62 AS build
+FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS build
 COPY --from=rootfs / /rootfs
 WORKDIR /rootfs
 RUN find . | cpio -R 0:0 --ignore-devno --renumber-inodes -o -H newc --quiet > /initramfs
@@ -1,4 +1,4 @@
-FROM alpine:3.23@sha256:865b95f46d98cf867a156fe4a135ad3fe50d2056aa3f25ed31662dff6da4eb62 AS build
+FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS build
 ARG TARGETPLATFORM
 RUN if [ "${TARGETPLATFORM}" = "linux/amd64" ] || [ "${TARGETPLATFORM}" = "linux/x86_64" ]; then \
      apk --no-cache add ovmf edk2-shell; cp /usr/share/ovmf/bios.bin /ovmf.fd; fi
@@ -1,4 +1,4 @@
-FROM alpine:3.23@sha256:865b95f46d98cf867a156fe4a135ad3fe50d2056aa3f25ed31662dff6da4eb62 AS build
+FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS build
 ARG TARGETPLATFORM
 RUN apk add --no-cache xen-hypervisor && cp /usr/lib/efi/xen.efi /xen.efi

@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.92.0"
+channel = "1.98.1"
 components = ["rustfmt", "clippy"]
 targets = ["x86_64-unknown-uefi", "aarch64-unknown-uefi"]