Lanzaboote – NixOS Secure Boot

Secure boot protects against evil maid attacks, but no one would ever need use an evil maid attack on a NixOS user because anyone can merge whatever they want to NixOS without signature or review, particularly given that any maintainer can merge their own commits from their own pseudonyms.

NixOS is always one compromised Github API token away from a backdoor into everything built with NixOS.

I cannot imagine a threat model that would need secure boot yet accept the risks of NixOS.

That looks like a really nice hackathon! That said, the fact that they probably had a majority of the best NixOS developers in the world under one roof and they weren't solely focused on NixOS error messages is borderline criminal...

> We plan on streamlining this as much as possible, but so far this has not happened yet.

Probably integrating something like sbctl (https://github.com/Foxboron/sbctl#sbctl---secure-boot-manage...) would do the trick, it's making the whole signing and key management dance easy.

Seems to already work together with limine on NixOS too: https://search.nixos.org/options?channel=25.11&query=sbctl#s...

Lanzaboote is great, I've been using it for almost a year now in a dual boot with Windows 11 for full secure boot on my desktop. It is quite stable (notably was set and forget) and the initial setup was relatively easy.

Huh, as a Lanaboote user I’m surprised to see this on the front page. I use this in combination with sbctl for key generation. I’m mostly using it because I wanted to set up full disk encryption with TPM2 auth.

This needs a (2022).

Browsing the internet about secure boot and NixOS, I found the article of one of the creators

this is how Microsoft wins the war against general computing

you must not join it, refuse to lockdown your computer

[dead]