Engineering notes

• EC2 ships no driver for its own NIC. So one had to be written.
  2026-06-24
  EC2's UEFI firmware has no driver for the network card AWS put in the instance, so a firmware-level netboot has no network at all. Here is a clean-room Rust UEFI driver for the ENA adapter, the 24-reboot hunt for the one undocumented register that gates it, and the pile of confident theories that were all wrong.
• stage0: netboot the cloud from a signed URL
  2026-06-13
  A ~150 KB UEFI loader that pulls, verifies, measures and boots a signed payload over HTTP. Configure a fleet once, publish new builds to a signed release channel, and machines roll forward on the next boot — no re-imaging, no metadata changes.
• Pragmatic cloud trust with vTPMs
  2026-02-11
  How lockboot establishes trust using cloud vTPMs — the generic boot model, provider-specific trust chains for AWS Nitro and GCP, and what this doesn't protect against.
• lockboot v0.2.0
  2026-02-10
  Dynamic VMA calculation, aarch64 PE vmlinuz support, and QEMU test harness improvements.