diff --git a/docs/TODO b/docs/TODO
index b9c32c7..046b0a8 100644
--- a/docs/TODO
+++ b/docs/TODO
@@ -6,8 +6,6 @@
 -- https://github.com/akopytov/sysbench
 -- (http://blog.due.io/2014/linode-digitalocean-and-vultr-comparison/ etc.)
 -package in AUR
--DBAN?
---better just add nwipe to pkgs instead: http://www.andybev.com/index.php/Nwipe
 
 
 ## NETWORKING ##
@@ -25,12 +23,14 @@
 ## Building ##
 
 -WISH: Better logging[0]
+-WISH: signing for secureboot releases (PreLoader and gummiboot handle this okay, but require manual intervention
 -use manual chrooting functions ONLY if distro not detected as arch. if /usr/bin/systemd-nspawn exists, use that instead
 --does arch-chroot work across all distros? see https://wiki.archlinux.org/index.php/Install_bundled_32-bit_system_in_Arch64 and https://wiki.archlinux.org/index.php/Chroot
 --i think this might be unnecessary. testing across other major distros is necessary, but i think i can just use the chroot'd arch-chroot
 -tweak build.conf (and build.conf.sample) to source the pwd and set as BASEDIR ***if*** the project resources are present in pwd, otherwise throw warning
 --this is half-done;PWD is currently used by default.
 -does gummiboot? loader? wtfever it's called support splash backgrounds? can i implement that differently somehow?
+--yes, see e.g. https://www.reddit.com/r/archlinux/comments/3bwgf0/where_put_the_splasharchbmp_to_splash_screen_boot/
 -strip out/remove unnecessary and orphan packages (e.g. gcc, make, automake, etc.)
 -incorporate iPXE tweaks:
 --http://ipxe.org/crypto
@@ -41,14 +41,12 @@
 --what distros are supported?
 --automatically install what we need for buildtime
 ---need to finish pkg lists and then test, but meta files should be done as well as lib script
---hardcode list of runtime (e.g. live media) dependencies (e.g. openssh, vim, etc.)
---...and create separate list for after-the-fact e.g. goodies
--test (and fix, if not working) UEFI secureboot via shim
 -enable mirror= kernel commandline.
 --if mirror_(NAME) is present, use that as repo name.
 --if it starts with /, treat as mirrorlist (Include); otherwise use Server = 
 --if it has mirror_SIG-X, set signature options e.g. _SIG-N would be "SigLevel = Never"
 -iPXE background support. sed -rf "${BASEDIR}/src/ipxe_local/script.sed" ${SRCDIR}/ipxe/src/config/general.h ; sed -rf "${BASEDIR}/src/ipxe_local/script2.sed" ${SRCDIR}/ipxe/src/config/console.h
+--note that iPXE VESAFB console is not (yet) supported in EFI, so this is on hold.
 
 ## Split into Separate Tools CD ##
 
diff --git a/extra/packages.both b/extra/packages.both
index f2d77ba..697f759 100644
--- a/extra/packages.both
+++ b/extra/packages.both
@@ -308,6 +308,7 @@ xmlto
 xorg
 xorg-drivers
 xorg-xinit
+xterm
 zerofree
 zip
 zsh
diff --git a/extra/packages.both.AUDITME b/extra/packages.both.AUDITME
deleted file mode 100644
index 8765f95..0000000
--- a/extra/packages.both.AUDITME
+++ /dev/null
@@ -1,313 +0,0 @@
-# You can include comments, such as this. AUR packages are allowed.
-# We need to install all X drivers.
-abs
-acpi
-#acpidump
-afflib
-aircrack-ng
-apr
-apr-util
-arj
-asciidoc
-atop
-autopsy
-autossh
-backuppc
-#bacula ## TODO: grab all the bacula packages in here
-beep
-bin86
-bind-tools
-binutils
-bluez-utils
-bonnie++
-boxbackup-client
-boxbackup-server
-bozocrack-git
-bridge-utils
-burp-backup-git
-btrfs-progs
-cabextract
-cdrtools
-cdw
-cfv
-chapcrack-git
-chntpw
-cifs-utils
-ckermit
-clamav
-clonezilla
-cmospwd
-colordiff
-cowpatty
-cpio
-cpuburn
-cpupower
-crackpkcs12
-#cryptcat
-cryptsetup
-csync2
-customizepkg-scripting
-dar
-dcfldd
-ddrescue
-dd_rescue
-dd_rhelp
-debianutils
-debootstrap
-dialog
-diffutils
-djohn
-dmidecode
-dnssec-anchors
-dnstracer
-#dnsutils #replaced by bind-tools, https://www.archlinux.org/packages/extra/x86_64/bind-tools/
-dos2unix
-dropbear
-dstat
-dump
-dumpet
-duplicity
-dvd+rw-tools
-e2fsprogs
-ecryptfs-utils
-ed
-elfutils
-#elilo-efi
-elinks
-etc-update
-ethtool
-exfat-utils
-ext3grep
-extundelete
-f2fs-tools
-fang
-fbset
-fcgi
-fcgiwrap
-fcrackzip
-fdupes
-file
-findmyhash
-findutils
-firefox
-flac
-flashrom
-foremost
-fsarchiver
-fuse
-gd
-git
-gnu-efi-libs
-gnu-netcat
-gpart
-gparted
-gperftools
-gpm
-gptfdisk
-gst-libav
-gst-plugins-ugly
-hashcat
-hddtemp
-hdparm
-hexcurse
-hexedit
-hfsprogs
-hfsutils
-htop
-httping
-hwdetect
-hwinfo
-hydra
-idnkit
-ifenslave
-iftop
-inetutils
-iotop
-iozone
-ipcalc
-iperf
-iperf3
-ipsec-tools
-iptraf-ng
-irssi
-iso-codes
-isomaster
-jasper
-jfsutils
-#john-mpi
-john
-keyutils
-kismet-allplugins
-lftp
-links
-#logkeys
-logkeys-keymaps
-lm_sensors
-lrzsz
-lshw
-lsiutil
-lsof
-lsscsi
-lxde
-lynx
-#lzip
-macchanger
-magicrescue
-mbr
-mbuffer
-mcelog
-md5deep
-mdadm
-mdcrack
-megaraid-cli
-memtester
-mfoc
-minicom
-mondo
-mtd-utils
-mtr
-mtree
-#mtx
-multipath-tools
-myrescue
-nbd
-ncftp
-ncompress
-ncrack
-net-snmp
-netselect
-nettle
-networkmanager-pptp
-nginx-devel
-ngrep
-nmap
-nmon
-ntfs-3g
-ntfsfixboot
-nwipe
-obnam
-open-iscsi
-openipmi
-ophcrack
-os-prober
-p7zip
-pack
-par2cmdline
-partclone
-partclone-utils
-parted
-partimage
-pax-utils
-pciutils
-pcmciautils
-pdfcrack
-perf
-php
-php-fpm
-php-gd
-php-mcrypt
-#phrasendrescher
-pigz
-pkgfile
-pkgtools
-ppp
-pptpclient
-prebootloader
-procinfo-ng
-procps-ng
-progsreiserfs
-psmisc
-pwgen
-pixz
-pyrit-svn
-python2-gnuplot
-python2-pyx
-rarcrack
-rcracki_mt
-rdiff-backup
-read-edid
-reaver-wps-fork-t6x-git
-rename
-rfkill
-rp-pppoe
-rpcbind
-rpmextract
-rp-pppoe
-rsnapshot
-rygel
-safecopy
-samba
-scapy
-screen
-scrounge-ntfs
-scrub
-scsiadd
-sdparm
-setserial
-sg3_utils
-sharutils
-sipcalc
-sipcrack
-smartmontools
-smbclient
-s-nail
-socat
-#star ## do people even USE tape packups anymore?
-strace
-stress
-sucrack
-symlinks
-sysstat
-tcpdump
-tcpslice
-tcptraceroute
-testdisk
-tftp-hpa
-thin-provisioning-tools
-thttpd
-tmon
-tmux
-tre
-truecrack-svn
-truecrypt
-tor
-udftools
-#udpcast
-unace
-unison
-unrar
-unshield
-unzip
-usb_modeswitch
-usbip
-usbutils
-vim-a
-vim-bufexplorer
-vim-indent-object
-vim-minibufexpl
-vim-nerdtree
-vim-syntastic
-vim-workspace
-vlc
-vncrack
-vnstat
-vpnc
-weplab
-whdd
-whois
-wifite-mod-pixiewps-git
-wipe
-wireshark-cli
-wpscrack
-wput
-x11vnc
-xfburn
-xfsdump
-xfsprogs
-xmlto
-xorg
-xorg-drivers
-xorg-xinit
-zerofree
-zip
-zsh
diff --git a/extra/packages.both.AUDITME.broken b/extra/packages.both.AUDITME.broken
deleted file mode 100644
index 4b986ff..0000000
--- a/extra/packages.both.AUDITME.broken
+++ /dev/null
@@ -1,22 +0,0 @@
-boxbackup-client
-boxbackup-server
-burp-backup-git
-chapcrack-git
-debianutils
-djohn
-httping
-iozone
-kismet-allplugins
-mbr
-mdcrack
-memtester
-mondo
-pack
-rcracki_mt
-scrounge-ntfs
-sipcrack
-sucrack
-truecrack-svn
-weplab
-wifite-mod-pixiewps-git
-wpscrack
diff --git a/lib/08-will_it_blend.func.sh b/lib/08-will_it_blend.func.sh
index 6fca319..6ef0c56 100644
--- a/lib/08-will_it_blend.func.sh
+++ b/lib/08-will_it_blend.func.sh
@@ -75,7 +75,10 @@ function will_it_blend () {
   # and now we copy stuff into the live directories
   echo "[${ARCHSUFFIX}-bit] Copying files for PXE, and ISO building, please be patient."
   #rm -rf ${TEMPDIR}/*
-  cat ${BASEDIR}/extra/bdisk.png > ${BASEDIR}/extra/${UXNAME}.png
+  if [ ! -f ${BASEDIR}/extra/${UXNAME}.png ];
+  then
+    cat ${BASEDIR}/extra/bdisk.png > ${BASEDIR}/extra/${UXNAME}.png
+  fi
   cp -af ${BASEDIR}/extra/${UXNAME}.png ${TEMPDIR}/.
   cp -af ${BASEDIR}/extra/${UXNAME}.png ${TFTPDIR}/.
   mkdir -p ${TEMPDIR}/boot
diff --git a/lib/prereqs/Gentoo/meta b/lib/prereqs/Gentoo/meta
index aa004a2..5c1b9dc 100644
--- a/lib/prereqs/Gentoo/meta
+++ b/lib/prereqs/Gentoo/meta
@@ -1,5 +1,5 @@
 NAME='Gentoo'
-SUPPORTED='untested'
+SUPPORTED='yes'
 CHECK_METHOD='egrep "^Gentoo\ Base\ System" /etc/gentoo-release'
 PKG_MGR='emerge -q1Dn ${pkgname}'
 PRE_RUN='emerge -q --sync'
diff --git a/lib/prereqs/Gentoo/pkgs b/lib/prereqs/Gentoo/pkgs
index d7c67c1..5706c4c 100644
--- a/lib/prereqs/Gentoo/pkgs
+++ b/lib/prereqs/Gentoo/pkgs
@@ -1,5 +1,6 @@
 sys-devel/binutils
 net-misc/curl
+sys-fs/dosfstools
 sys-devel/gcc
 dev-vcs/git
 dev-libs/libisoburn
diff --git a/overlay/etc/bash.bashrc b/overlay/etc/bash.bashrc
index ed05b0c..741a391 100644
--- a/overlay/etc/bash.bashrc
+++ b/overlay/etc/bash.bashrc
@@ -51,7 +51,7 @@ date
 if [ -n "${DEFROUTEIF}" ];
 then
  IPADDR=$(ip a s dev ${DEFROUTEIF} | egrep '^[[:space:]]*inet\ ' | awk '{print $2}' | cut -f1 -d"/")
- HWADDR=$(ip l show dev ${DEFROUTEIF} | egrep '^[[:space:]]*link\ ' | awk '{print $2}')
+ HWADDR=$(ip l show dev ${DEFROUTEIF} | egrep '^[[:space:]]*link' | awk '{print $2}')
  echo
  echo -n "${DEFROUTEIF} (${HWADDR}) is: ${IPADDR}"
 fi
diff --git a/src/ipxe b/src/ipxe
index ba36953..c522c11 160000
--- a/src/ipxe
+++ b/src/ipxe
@@ -1 +1 @@
-Subproject commit ba3695353add020b686547699ba5e259c339bfa6
+Subproject commit c522c11c7b7adedf0bf339b954e30951f02d568f
diff --git a/src/ipxe_local/00-general.sed b/src/ipxe_local/00-general.sed
new file mode 100644
index 0000000..60c671e
--- /dev/null
+++ b/src/ipxe_local/00-general.sed
@@ -0,0 +1,7 @@
+s/^#undef([[:space:]]*NET_PROTO_IPV6)/#define\1/g
+s/^#undef([[:space:]]*DOWNLOAD_PROTO_HTTPS)/#define\1/g
+s/^#undef([[:space:]]*DOWNLOAD_PROTO_FTP)/#define\1/g
+## Currently broken for EFI building
+#s@^//(#define[[:space:]]*CONSOLE_CMD)@\1@g
+#s@^//(#define[[:space:]]*IMAGE_PNG@\1@g
+s@^//(#define[[:space:]]*IMAGE_TRUST_CMD@\1@g
diff --git a/src/ipxe_local/01-console.sed b/src/ipxe_local/01-console.sed
new file mode 100644
index 0000000..3eb558e
--- /dev/null
+++ b/src/ipxe_local/01-console.sed
@@ -0,0 +1,2 @@
+## Currently broken on EFI systems
+#s@^//(#define[[:space:]]*CONSOLE_VESAFB)@\1@g
diff --git a/src/ipxe_local/script.sed b/src/ipxe_local/script.sed
deleted file mode 100644
index 1fb8c57..0000000
--- a/src/ipxe_local/script.sed
+++ /dev/null
@@ -1,12 +0,0 @@
-s/^#undef([[:space:]]*NET_PROTO_IPV6)/#define\1/g
-## currently broken for EFI building
-#s/^#undef([[:space:]]*DOWNLOAD_PROTO_HTTPS)/#define\1/g
-s/^#undef([[:space:]]*DOWNLOAD_PROTO_FTP)/#define\1/g
-s@^//(#define[[:space:]]*CONSOLE_CMD)@\1@g
-# causing hangs? seems to cause linux kernels to crash
-#s@^//(#define[[:space:]]*IMAGE_MULTIBOOT)@\1@g
-# still have no idea what this does.
-#s@^//(#define[[:space:]]*IMAGE_SCRIPT@\1@g
-s@^//(#define[[:space:]]*IMAGE_PNG@\1@g
-# save this for when we enable signed/trusted loading
-#s@^//(#define[[:space:]]*IMAGE_TRUST_CMD@\1@g
diff --git a/src/ipxe_local/script2.sed b/src/ipxe_local/script2.sed
deleted file mode 100644
index 6075890..0000000
--- a/src/ipxe_local/script2.sed
+++ /dev/null
@@ -1 +0,0 @@
-s@^//(#define[[:space:]]*CONSOLE_VESAFB)@\1@g