Lanzaboote - Revision history

Klinger: Category:Booting added

2025-12-29T12:00:36Z

← Older revision		Revision as of 12:00, 29 December 2025
Line 36:		Line 36:
	Tracking the feature parity with `systemd-stub` can be done in this issue: https://github.com/nix-community/lanzaboote/issues/94.		Tracking the feature parity with `systemd-stub` can be done in this issue: https://github.com/nix-community/lanzaboote/issues/94.
	</translate>		</translate>

			[[Category:Booting]]

Ben9986: Remove stray translation marker from previous page

2025-12-09T22:24:06Z

Remove stray translation marker from previous page

← Older revision		Revision as of 22:24, 9 December 2025
Line 17:		Line 17:
	Boot into FW: supported		Boot into FW: supported

	~~<!--T:11-->~~
	Current Boot Loader:		Current Boot Loader:
	Product: systemd-boot 251.7		Product: systemd-boot 251.7

Ben9986: Add translation correctly

2025-12-08T23:32:22Z

Add translation correctly

← Older revision		Revision as of 23:32, 8 December 2025
Line 1:		Line 1:
	~~__INDEX__~~		<translate>

	The Lanzaboote project allows [[Secure Boot]] to be enabled on NixOS with relative ease.		The Lanzaboote project allows [[Secure Boot]] to be enabled on NixOS with relative ease.
Line 36:		Line 36:

	Tracking the feature parity with `systemd-stub` can be done in this issue: https://github.com/nix-community/lanzaboote/issues/94.		Tracking the feature parity with `systemd-stub` can be done in this issue: https://github.com/nix-community/lanzaboote/issues/94.
			</translate>

Ben9986: Undo revision 28899 by Ben9986 (talk)

2025-12-08T23:31:20Z

Undo revision 28899 by Ben9986 (talk)

← Older revision		Revision as of 23:31, 8 December 2025
Line 1:		Line 1:
	__INDEX__		__INDEX__

	~~<nowiki><translate></nowiki>~~

	The Lanzaboote project allows [[Secure Boot]] to be enabled on NixOS with relative ease.		The Lanzaboote project allows [[Secure Boot]] to be enabled on NixOS with relative ease.
Line 38:		Line 36:

	Tracking the feature parity with `systemd-stub` can be done in this issue: https://github.com/nix-community/lanzaboote/issues/94.		Tracking the feature parity with `systemd-stub` can be done in this issue: https://github.com/nix-community/lanzaboote/issues/94.

	~~<nowiki></translate></nowiki>~~

Ben9986: Mark for Translation

2025-12-08T23:30:33Z

Mark for Translation

← Older revision		Revision as of 23:30, 8 December 2025
Line 1:		Line 1:
	__INDEX__		__INDEX__

			<nowiki><translate></nowiki>

	The Lanzaboote project allows [[Secure Boot]] to be enabled on NixOS with relative ease.		The Lanzaboote project allows [[Secure Boot]] to be enabled on NixOS with relative ease.
Line 36:		Line 38:

	Tracking the feature parity with `systemd-stub` can be done in this issue: https://github.com/nix-community/lanzaboote/issues/94.		Tracking the feature parity with `systemd-stub` can be done in this issue: https://github.com/nix-community/lanzaboote/issues/94.

			<nowiki></translate></nowiki>

Ben9986: Move content from Secure Boot page to here. Remove redirect to secure page. Removed translation markers for now

2025-12-08T23:12:13Z

Move content from Secure Boot page to here. Remove redirect to secure page. Removed translation markers for now

← Older revision		Revision as of 23:12, 8 December 2025
Line 1:		Line 1:
	~~#REDIRECT~~ [[Secure Boot~~#Lanzaboote~~]]		__INDEX__

			The Lanzaboote project allows [[Secure Boot]] to be enabled on NixOS with relative ease.

			It has two main components: <code>lzbt</code> and <code>stub</code>.

	~~__INDEX__~~		<code>lzbt</code> is the command line that signs and installs the boot files on the ESP.

			<code>stub</code> is a UEFI application that loads the kernel and initrd from the ESP, it's different from systemd-stub, see [[Lanzaboote#Differences with `systemd-stub`\|below]] to see precise differences.{{warning\|Lanzaboote is still in development and requires some prerequisites and precautions. Currently it's only available for nixos-unstable. For more information, please see the GitHub repository or the Quick Start guide.}}

			=== Requirements ===
			The Secure Boot implementation of Lanzaboote requires a system installed in UEFI mode together with systemd-boot enabled. This can be checked by running <code>bootctl status</code>:<syntaxhighlight lang="console">$ bootctl status
			System:
			Firmware: UEFI 2.70 (Lenovo 0.4720)
			Secure Boot: disabled (disabled)
			TPM2 Support: yes
			Boot into FW: supported

			<!--T:11-->
			Current Boot Loader:
			Product: systemd-boot 251.7
			...</syntaxhighlight>

			=== Setup ===
			Follow the instructions in the [https://github.com/nix-community/lanzaboote/blob/master/docs/getting-started/prepare-your-system.md Quick Start guide].

			=== Key management ===
			At the time of writing, Lanzaboote offers only local storage of the keyring, otherwise, it is not possible to rebuild the system and sign the new resulting files.

			In the future, Lanzaboote will offer two new signature backends: remote signing (an HTTP server which receives signature requests and answers with signatures) and PKCS#11-based signing (that is, bringing an HSM-like device, e.g. YubiKey, NitroKey, etc.).{{Warning\|Key management is a hard problem which is out of scope for Lanzaboote project, many recipes exist and there is no single perfect solution. Taking the time to learn how to key manage and figure out the right level of threat protection is crucial to achieve an effective boot protection.}}

			=== Differences with `systemd-stub` ===
			systemd and distribution upstream have an existing solution called `systemd-stub` but this is not a realistic solution for NixOS as there's too many generations on a system.

			Using `systemd-stub`, a kernel and an initrd has to be duplicated for '''each generation''', using Lanzaboote's stub, a kernel and initrd can be '''deduplicated''' without compromising on the security.

			Tracking the feature parity with `systemd-stub` can be done in this issue: https://github.com/nix-community/lanzaboote/issues/94.

Ben9986: Correct redirect URL

2025-12-08T22:18:55Z

Correct redirect URL

← Older revision		Revision as of 22:18, 8 December 2025
Line 1:		Line 1:
	#REDIRECT [[~~https://wiki.nixos.org/wiki/Secure Boot#Lanzaboote]]~~		#REDIRECT [[Secure Boot#Lanzaboote]]
	~~#REDIRECT [[https://wiki.nixos.org/wiki/~~Secure Boot#Lanzaboote]]

	__INDEX__		__INDEX__

Ben9986 at 22:15, 8 December 2025

2025-12-08T22:15:50Z

← Older revision		Revision as of 22:15, 8 December 2025
Line 1:		Line 1:
			#REDIRECT [[https://wiki.nixos.org/wiki/Secure Boot#Lanzaboote]]
	#REDIRECT [[https://wiki.nixos.org/wiki/Secure Boot#Lanzaboote]]		#REDIRECT [[https://wiki.nixos.org/wiki/Secure Boot#Lanzaboote]]

	__INDEX__		__INDEX__

Ben9986: Create page as redirect to Secure_Boot#Lanzaboote. Possibly will move this section here depending on new content added

2025-12-08T22:14:58Z

Create page as redirect to Secure_Boot#Lanzaboote. Possibly will move this section here depending on new content added

New page

#REDIRECT [[https://wiki.nixos.org/wiki/Secure Boot#Lanzaboote]]

__INDEX__