pbatard/uefi-shell

1. This repository is primarily a release-and-build wrapper, not a large application codebase. Its purpose is to publish pre-built UEFI Shell binaries and bootable ISO images derived from upstream EDK2.

2. The main source boundary is the edk2 git submodule. That submodule points at the official Tianocore EDK2 repository and is the actual upstream source used to produce the shell binaries. The local repo itself mostly pins that dependency and automates packaging.

3. The second major subsystem is GitHub Actions, specifically .github/workflows/linux_gcc_edk2.yml. This is the build pipeline that checks out the repo plus submodules, builds the UEFI Shell on Linux with GCC, computes hashes, and publishes artifacts.

4. The build output boundary is release artifacts, not a deployed service. The pipeline produces individual .efi binaries for supported UEFI architectures and bootable .iso images intended for USB or optical media creation. These artifacts are what end users consume.

5. There is an explicit packaging step for boot media convenience: the ISO is the primary distribution format, while the individual EFI binaries are a secondary output for manual FAT-partition boot media use. So the data flow is: upstream EDK2 source -> CI build -> signed/hashed binary outputs -> GitHub Releases.

6. The repository also includes an optional bundled tool, Mosby, starting with release 24H2. It is packaged into the ISO as an extra command available from the UEFI Shell, but it is not part of the shell itself and does not change the core shell build path.

7. Security and trust validation are a prominent architectural concern. The README describes a reproducible-trust workflow: verify the Git commit used by the build, verify the edk2 submodule commit, inspect the workflow definition, and compare logged SHA-256 values against the downloaded release files.

8. GitHub Releases is the distribution endpoint. The repo’s published binaries are expected to be identical to the CI-produced outputs, and the build log SHA-256 values are the integrity link between source, CI, and downloadable artifacts.

9. The runtime environment is UEFI firmware, not a traditional operating-system process. End users boot the ISO or FAT media on hardware whose firmware supports the architecture of the published shell build. Secure Boot is intentionally excluded because the external shell is not Microsoft-signed.

10. In architecture-diagram terms, the important nodes are: public upstream EDK2, this repository as a pinned integration/build wrapper, GitHub Actions as the automated build-and-verify system, and GitHub Releases as the artifact store. The arrows are source pinning, build/packaging, checksum verification, and release publication.