coreboot

Legacy format is simple, it always uses SHA1 and its entries can be described by a C structure, with one field of variable length at the end.

Crypto agile format is slightly more complicated. There can be more than one digest in entry, and their sizes depend on algorithm. There is code for marshaling of required structures in security/tpm/tss/tcg-2.0, but it assumes TPM endianness (BE), while entries in event log are always LE.

Headers for both formats have vendorInfo field, which can be used to hold additional data, not described by specification. An example of such may be offset to next entry to be added, which saves code from walking through all entries (possibly with different sizes) for each new entry.