addSections = pkgs.writeShellScriptBin "add-sections" ''
    set -euo pipefail
    stub="$1"
    image="$2"

    stub_line=$(${pkgs.binutils}/bin/objdump -h "$stub" | tail -2 | head -1)
    stub_size=0x$(echo "$stub_line" | awk '{print $3}')
    stub_offs=0x$(echo "$stub_line" | awk '{print $4}')
    next_offs=$((stub_size + stub_offs))
    args=()

    while read sectionName contentsFile; do
      contentsFile="$(readlink -f "$contentsFile")"
      args+=(--add-section "$sectionName"="$contentsFile")
      args+=(--change-section-vma "$sectionName"=$(printf 0x%x $next_offs))
      next_offs=$((next_offs + $(stat -c%s "$contentsFile")))
    done

    set -x
    exec ${pkgs.binutils}/bin/objcopy "''${args[@]}" "$stub" "$image"
  '';
  stub = pkgs.runCommand "stub" {nativeBuildInputs = [addSections];} ''
    mkdir $out
    add-sections ${nixosConfig}/systemd/lib/systemd/boot/efi/linuxx64.efi.stub $out/foo-unsigned.efi <<EOF
      .osrel ${osRelease}
      .linux ${nixosConfig}/kernel
      .initrd ${nixosConfig}/initrd
    EOF
  '';