Skip to main content

max / alloy

alloy-boot-entry: add --report, so the NVRAM write can be looked at first The helper had no read-only mode. Reading NVRAM needs no privilege and writing it needs root, so the only way to find out what it would do on a given machine was to let it do it -- and it is the last stage of an install, where that is exactly the wrong time to find out. --report runs every read the write path runs and stops at the first efibootmgr write, so the plan it prints is the one the write would follow rather than a second implementation of it. The no-argument call plan.rs makes is unchanged. Verified on fw12, which has the condition, as an unprivileged user: would rename: Boot0000 -> a new entry "Alloy" (\EFI\fedora\shimx64.efi on /dev/nvme0n1 partition 2), then delete Boot0000 would rename: Boot0001 -> a new entry "Alloy" (\EFI\fedora\shim.efi ...) nothing was written Boot0001 naming shim.efi rather than shimx64.efi is visible only because of this, and is unverified: fw12's ESP is not mounted, so whether that loader exists cannot be read without root.
Co-Authored-By
Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session
https://claude.ai/code/session_01WFBzMprSmNCfvdj2cGZyka
Author: Max Johnson <me@maxj.phd> · 2026-09-08 01:41 UTC
Signed with PGP, not checked
Commit: 7374868af02ed166c1c0808fcf71bbe78760f691
Parent: 77a0b7f
1 file changed, +40 insertions, -0 deletions
@@ -31,10 +31,32 @@
31 31 # good install over. So every reason to do nothing -- not an EFI boot, no
32 32 # efibootmgr, nothing left to rename -- exits 0. A non-zero exit means NVRAM was
33 33 # left worse than it was found, which is the only outcome worth stopping for.
34 + #
35 + # --report EXISTS SO THE WRITE CAN BE LOOKED AT FIRST. Reading NVRAM needs no
36 + # privilege and writing it needs root, so without a read-only mode the only way
37 + # to find out what this would do was to let it do it. Everything up to the first
38 + # efibootmgr write runs identically in both modes, so a report is the plan and
39 + # not a second implementation of it.
34 40
35 41 set -eu
36 42
37 43 NAME="Alloy"
44 + DRY=0
45 +
46 + usage() {
47 + sed -n '2,39p' "$0"
48 + echo
49 + echo "Usage: alloy-boot-entry [--report]"
50 + echo " --report, -n say what would change and write nothing. Needs no root."
51 + }
52 +
53 + while [ $# -gt 0 ]; do
54 + case "$1" in
55 + --report|--dry-run|-n) DRY=1; shift ;;
56 + -h|--help) usage; exit 0 ;;
57 + *) printf 'error: unknown argument %s\n' "$1" >&2; exit 2 ;;
58 + esac
59 + done
38 60
39 61 [ -d /sys/firmware/efi ] || { echo "not an EFI boot; no entry to name"; exit 0; }
40 62 command -v efibootmgr >/dev/null 2>&1 || { echo "no efibootmgr; leaving the boot entry alone"; exit 0; }
@@ -83,6 +105,15 @@
83 105 partn="$(cat "/sys/class/block/$(basename "$dev")/partition" 2>/dev/null || true)"
84 106 [ -b "$disk" ] && [ -n "$partn" ] || { echo "could not place $dev; leaving Boot$num alone" >&2; continue; }
85 107
108 + # The last point both modes share. Everything above is a read; everything
109 + # below writes NVRAM, so the report stops exactly here and the plan it
110 + # prints is the one the write would follow.
111 + if [ "$DRY" -eq 1 ]; then
112 + printf 'would rename: Boot%s -> a new entry "%s" (%s on %s partition %s), then delete Boot%s\n' \
113 + "$num" "$NAME" "$loader" "$disk" "$partn" "$num"
114 + continue
115 + fi
116 +
86 117 before="$(efibootmgr | sed -nE 's/^Boot([0-9A-Fa-f]{4})\*?.*/\1/p' | sort -u)"
87 118 efibootmgr -q -c -d "$disk" -p "$partn" -L "$NAME" -l "$loader"
88 119 after="$(efibootmgr | sed -nE 's/^Boot([0-9A-Fa-f]{4})\*?.*/\1/p' | sort -u)"
@@ -109,6 +140,15 @@
109 140 new_order="$(printf '%s' "$new_order" | sed "s/\b$num\b/$created/I")"
110 141 done < "$entries"
111 142
143 + if [ "$DRY" -eq 1 ]; then
144 + # The new numbers are assigned by the firmware at creation, so a report
145 + # cannot name the order it would write. It can say the slots are kept,
146 + # which is the property worth checking.
147 + echo "boot order: $order, each renamed entry taking the slot of the one it replaces"
148 + echo "nothing was written"
149 + exit 0
150 + fi
151 +
112 152 if [ -n "$new_order" ] && [ "$new_order" != "$order" ]; then
113 153 efibootmgr -q -o "$new_order"
114 154 echo "boot order: $order -> $new_order"