Repository navigation
Conversation
Every trial ended with forget and then ensure, and ensure appended the committed slot's entry last in BootOrder. A firmware that lists network boot after the disks put Kryptik behind it, so each boot waited on the network first, and every update undid an order set in the firmware's setup. kryptik-efiboot gains keep SLOT [ESP]: forget, then the entry where Kryptik's first entry stood. It exits 1 when the forgetting failed and 3 when only the entry did, so boot-success and kryptik-recover keep their two messages. A new entry, from ensure or set-next, goes after the last BootOrder entry that does not boot from the network (a MAC, IPv4, IPv6 or URI node), and so never ahead of another system's entry.
DevomB
marked this pull request as ready for review
October 29, 2026 15:10
DevomB
added a commit
that referenced
this pull request
Oct 29, 2026
…e in the boot order its slot's entry had, rather than going last
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every trial ended with
kryptik-efiboot forgetand thenensure.ensureappended the committed slot's entry last in BootOrder (kryptik-efiboot.c:338-347before this change). A firmware that lists its network boot after the disks therefore put Kryptik's entry behind it, so each boot waited on the network first. Every update also undid any order the user had set in the firmware's setup.kryptik-efiboot keep SLOT [ESP]runs forget, then puts the committed slot's entry where Kryptik's first entry stood in BootOrder, counted among the entries left. The entry is attempted even when forgetting fails, as forget-then-ensure did. It exits 1 when forgetting failed, 3 when only the entry failed, and 2 for a slot other than a or b, before anything is touched.ensure,set-next, orkeepwith no Kryptik entry in the order, goes after the last BootOrder entry that does not boot from the network. An entry counts as network boot when its device path has a MAC, IPv4, IPv6 or URI node (type 3, subtype 11/12/13/24). So a new entry lands ahead of network boot that ends the order, but never ahead of another system's entry, wherever that entry is listed.boot-success.sh(forget_entries) andkryptik-recover(commit_slot) callkeepand map its status to their two existing messages. kryptik-recover runs underset -e, so it captures the status rather than letting a non-zero exit end the script. The installer still runs forget and then ensure, so a fresh install's entry gets the new placement.tools/tests/efiboot.sh: a new entry goes ahead of two network entries, behind another system's entry listed after the network, and first in an order that holds only network boot.tools/tests/efiboot.sh: a trial entry goes behind the committed one, and after the commit slot b stands where slot a stood. An entry the user moved first stays first.keepexits 3 when the entry can't be made and 2 for slotc.tools/tests/boot-success.sh: the stub takeskeep, and the recorded calls are nowefiboot keep a.docs/design/boot-and-updates.mddescribes both rules.The writes are the same as before (one BootOrder write for the forget, one for the entry), so what PCR 1 sees per trial is unchanged (
tpm-unlock.md). Secure Boot, BOOTX64.EFI and BootNext handling are untouched.Testing on physical hardware is planned for October 2026.