docs: clarify the _stage1 args / LoadOptions model#4
Merged
Conversation
Document the argument model the boot-path audit clarified; no code change (stage0 already behaves this way): - _stage1.args / signed args_url set the booted EFI program's UEFI LoadOptions, the generic contract for any EFI stage1. They come only from metadata / the signed URL; stage0 never forwards its own firmware/shell invocation args to stage1. - For a Linux UKI stage1, the kernel cmdline is baked into the signed, measured UKI and is authoritative; under Secure Boot the stub ignores LoadOptions, so _stage1.args cannot alter the UKI cmdline (a replace would also escape PCR 14). Operator config for a UKI flows through _stage2, not the kernel cmdline. Touches config.rs module + args field docs, set_load_options in main.rs, and the README _stage1 reference. All args/args_url/set_load_options/ fetch_signed_args code is unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documentation only -- no code change. Records the argument model the boot-path audit clarified (stage0 already behaves exactly this way).
_stage1.args/ signedargs_urlset the booted EFI program's UEFI LoadOptions -- the generic contract for any EFI stage1. They come only from the metadata / signed URL; stage0 never forwards its own firmware/shell invocation arguments to stage1._stage1.argscannot alter the UKI cmdline (a replace would also escape PCR 14). Production runs Secure Boot on; operator config for a UKI flows through_stage2, not the kernel cmdline. A non-UKI EFI stage1 may read these LoadOptions as its args.Touches
config.rs(module +argsfield docs),set_load_optionsinmain.rs, and the README_stage1reference. Allargs/args_url/set_load_options/fetch_signed_argscode is unchanged. Verified:stage0.efistill compiles in-container; the diff adds only comment/doc lines.Pairs with lockboot/stage1#14 (the stage1 config-on-stdin + args-model docs).
🤖 Generated with Claude Code