stage0: fallback URL lists for _stage1 admission (mirror resiliency)

[HarryR]

Gives stage0's _stage1 the same UrlList fallback that stage1 has for _stage2, so the UKI hop can list mirrors. http-only (stage0 has no TLS); the payload stays cryptographically pinned, so any mirror that yields verifying bytes is admitted and a dead/wrong mirror is skipped.

Changes

• config.rs: url and sig_url/args_url/args_sig_url become a UrlList (a JSON string or a list). Deserialize-only (no_std), http-only + printable-ASCII per entry; Verify carries the lists.
• main.rs: the single-URL download becomes admit_payload / admit_from / download_first — try each URL until one downloads AND admits — mirroring stage1's loop. {sha256} is substituted per entry; the signed-args fetch is list-aware. Admission stays a gate; only PCR 14 (the payload hash) is measured.
• Makefile: boot-% gains FALLBACK=1 (a [dead 10.0.2.1:9, real] url list) to exercise the loop.

Verification

• x86_64 UEFI build clean (arch-agnostic change; aarch64 builds the same via the Makefile's ena-first ordering).
• QEMU boot in stage0's own harness: baseline (ed25519) verifies + measures + chain-loads; FALLBACK=1 rejects the dead mirror fast (RST ~8ms), falls through to the real mirror (DNS-resolved), verifies, extends PCR 14, and chain-loads.

Prereq for the upcoming host-side deploy tool, which emits _stage1 (+ _stage2) with mirror lists.

🤖 Generated with Claude Code

[HarryR]

Gives stage0's _stage1 the same UrlList fallback that stage1 has for _stage2, so the UKI hop can list mirrors. http-only (stage0 has no TLS); the payload stays cryptographically pinned, so any mirror that yields verifying bytes is admitted and a dead/wrong mirror is skipped.

Changes

• config.rs: url and sig_url/args_url/args_sig_url become a UrlList (a JSON string or a list). Deserialize-only (no_std), http-only + printable-ASCII per entry; Verify carries the lists.
• main.rs: the single-URL download becomes admit_payload / admit_from / download_first — try each URL until one downloads AND admits — mirroring stage1's loop. {sha256} is substituted per entry; the signed-args fetch is list-aware. Admission stays a gate; only PCR 14 (the payload hash) is measured.
• Makefile: boot-% gains FALLBACK=1 (a [dead 10.0.2.1:9, real] url list) to exercise the loop.

Verification

• x86_64 UEFI build clean (arch-agnostic change; aarch64 builds the same via the Makefile's ena-first ordering).
• QEMU boot in stage0's own harness: baseline (ed25519) verifies + measures + chain-loads; FALLBACK=1 rejects the dead mirror fast (RST ~8ms), falls through to the real mirror (DNS-resolved), verifies, extends PCR 14, and chain-loads.

Prereq for the upcoming host-side deploy tool, which emits _stage1 (+ _stage2) with mirror lists.

🤖 Generated with Claude Code

[HarryR]

Gives stage0's _stage1 the same UrlList fallback that stage1 has for _stage2, so the UKI hop can list mirrors. http-only (stage0 has no TLS); the payload stays cryptographically pinned, so any mirror that yields verifying bytes is admitted and a dead/wrong mirror is skipped.

Changes

• config.rs: url and sig_url/args_url/args_sig_url become a UrlList (a JSON string or a list). Deserialize-only (no_std), http-only + printable-ASCII per entry; Verify carries the lists.
• main.rs: the single-URL download becomes admit_payload / admit_from / download_first — try each URL until one downloads AND admits — mirroring stage1's loop. {sha256} is substituted per entry; the signed-args fetch is list-aware. Admission stays a gate; only PCR 14 (the payload hash) is measured.
• Makefile: boot-% gains FALLBACK=1 (a [dead 10.0.2.1:9, real] url list) to exercise the loop.

Verification

• x86_64 UEFI build clean (arch-agnostic change; aarch64 builds the same via the Makefile's ena-first ordering).
• QEMU boot in stage0's own harness: baseline (ed25519) verifies + measures + chain-loads; FALLBACK=1 rejects the dead mirror fast (RST ~8ms), falls through to the real mirror (DNS-resolved), verifies, extends PCR 14, and chain-loads.

Prereq for the upcoming host-side deploy tool, which emits _stage1 (+ _stage2) with mirror lists.

🤖 Generated with Claude Code

[HarryR]

Gives stage0's _stage1 the same UrlList fallback that stage1 has for _stage2, so the UKI hop can list mirrors. http-only (stage0 has no TLS); the payload stays cryptographically pinned, so any mirror that yields verifying bytes is admitted and a dead/wrong mirror is skipped.

Changes

• config.rs: url and sig_url/args_url/args_sig_url become a UrlList (a JSON string or a list). Deserialize-only (no_std), http-only + printable-ASCII per entry; Verify carries the lists.
• main.rs: the single-URL download becomes admit_payload / admit_from / download_first — try each URL until one downloads AND admits — mirroring stage1's loop. {sha256} is substituted per entry; the signed-args fetch is list-aware. Admission stays a gate; only PCR 14 (the payload hash) is measured.
• Makefile: boot-% gains FALLBACK=1 (a [dead 10.0.2.1:9, real] url list) to exercise the loop.

Verification

• x86_64 UEFI build clean (arch-agnostic change; aarch64 builds the same via the Makefile's ena-first ordering).
• QEMU boot in stage0's own harness: baseline (ed25519) verifies + measures + chain-loads; FALLBACK=1 rejects the dead mirror fast (RST ~8ms), falls through to the real mirror (DNS-resolved), verifies, extends PCR 14, and chain-loads.

Prereq for the upcoming host-side deploy tool, which emits _stage1 (+ _stage2) with mirror lists.

🤖 Generated with Claude Code

[HarryR]

Gives stage0's _stage1 the same UrlList fallback that stage1 has for _stage2, so the UKI hop can list mirrors. http-only (stage0 has no TLS); the payload stays cryptographically pinned, so any mirror that yields verifying bytes is admitted and a dead/wrong mirror is skipped.

Changes

• config.rs: url and sig_url/args_url/args_sig_url become a UrlList (a JSON string or a list). Deserialize-only (no_std), http-only + printable-ASCII per entry; Verify carries the lists.
• main.rs: the single-URL download becomes admit_payload / admit_from / download_first — try each URL until one downloads AND admits — mirroring stage1's loop. {sha256} is substituted per entry; the signed-args fetch is list-aware. Admission stays a gate; only PCR 14 (the payload hash) is measured.
• Makefile: boot-% gains FALLBACK=1 (a [dead 10.0.2.1:9, real] url list) to exercise the loop.

Verification

• x86_64 UEFI build clean (arch-agnostic change; aarch64 builds the same via the Makefile's ena-first ordering).
• QEMU boot in stage0's own harness: baseline (ed25519) verifies + measures + chain-loads; FALLBACK=1 rejects the dead mirror fast (RST ~8ms), falls through to the real mirror (DNS-resolved), verifies, extends PCR 14, and chain-loads.

Prereq for the upcoming host-side deploy tool, which emits _stage1 (+ _stage2) with mirror lists.

🤖 Generated with Claude Code

[HarryR]

Gives stage0's _stage1 the same UrlList fallback that stage1 has for _stage2, so the UKI hop can list mirrors. http-only (stage0 has no TLS); the payload stays cryptographically pinned, so any mirror that yields verifying bytes is admitted and a dead/wrong mirror is skipped.

Changes

• config.rs: url and sig_url/args_url/args_sig_url become a UrlList (a JSON string or a list). Deserialize-only (no_std), http-only + printable-ASCII per entry; Verify carries the lists.
• main.rs: the single-URL download becomes admit_payload / admit_from / download_first — try each URL until one downloads AND admits — mirroring stage1's loop. {sha256} is substituted per entry; the signed-args fetch is list-aware. Admission stays a gate; only PCR 14 (the payload hash) is measured.
• Makefile: boot-% gains FALLBACK=1 (a [dead 10.0.2.1:9, real] url list) to exercise the loop.

Verification

• x86_64 UEFI build clean (arch-agnostic change; aarch64 builds the same via the Makefile's ena-first ordering).
• QEMU boot in stage0's own harness: baseline (ed25519) verifies + measures + chain-loads; FALLBACK=1 rejects the dead mirror fast (RST ~8ms), falls through to the real mirror (DNS-resolved), verifies, extends PCR 14, and chain-loads.

Prereq for the upcoming host-side deploy tool, which emits _stage1 (+ _stage2) with mirror lists.

🤖 Generated with Claude Code

[HarryR]

Gives stage0's _stage1 the same UrlList fallback that stage1 has for _stage2, so the UKI hop can list mirrors. http-only (stage0 has no TLS); the payload stays cryptographically pinned, so any mirror that yields verifying bytes is admitted and a dead/wrong mirror is skipped.

Changes

• config.rs: url and sig_url/args_url/args_sig_url become a UrlList (a JSON string or a list). Deserialize-only (no_std), http-only + printable-ASCII per entry; Verify carries the lists.
• main.rs: the single-URL download becomes admit_payload / admit_from / download_first — try each URL until one downloads AND admits — mirroring stage1's loop. {sha256} is substituted per entry; the signed-args fetch is list-aware. Admission stays a gate; only PCR 14 (the payload hash) is measured.
• Makefile: boot-% gains FALLBACK=1 (a [dead 10.0.2.1:9, real] url list) to exercise the loop.

Verification

• x86_64 UEFI build clean (arch-agnostic change; aarch64 builds the same via the Makefile's ena-first ordering).
• QEMU boot in stage0's own harness: baseline (ed25519) verifies + measures + chain-loads; FALLBACK=1 rejects the dead mirror fast (RST ~8ms), falls through to the real mirror (DNS-resolved), verifies, extends PCR 14, and chain-loads.

Prereq for the upcoming host-side deploy tool, which emits _stage1 (+ _stage2) with mirror lists.

🤖 Generated with Claude Code

[HarryR]

Gives stage0's _stage1 the same UrlList fallback that stage1 has for _stage2, so the UKI hop can list mirrors. http-only (stage0 has no TLS); the payload stays cryptographically pinned, so any mirror that yields verifying bytes is admitted and a dead/wrong mirror is skipped.

Changes

• config.rs: url and sig_url/args_url/args_sig_url become a UrlList (a JSON string or a list). Deserialize-only (no_std), http-only + printable-ASCII per entry; Verify carries the lists.
• main.rs: the single-URL download becomes admit_payload / admit_from / download_first — try each URL until one downloads AND admits — mirroring stage1's loop. {sha256} is substituted per entry; the signed-args fetch is list-aware. Admission stays a gate; only PCR 14 (the payload hash) is measured.
• Makefile: boot-% gains FALLBACK=1 (a [dead 10.0.2.1:9, real] url list) to exercise the loop.

Verification

• x86_64 UEFI build clean (arch-agnostic change; aarch64 builds the same via the Makefile's ena-first ordering).
• QEMU boot in stage0's own harness: baseline (ed25519) verifies + measures + chain-loads; FALLBACK=1 rejects the dead mirror fast (RST ~8ms), falls through to the real mirror (DNS-resolved), verifies, extends PCR 14, and chain-loads.

Prereq for the upcoming host-side deploy tool, which emits _stage1 (+ _stage2) with mirror lists.

🤖 Generated with Claude Code