Lanzaboote: Difference between revisions

(4 intermediate revisions by 3 users not shown)

Line 1:

~~__INDEX__~~

The Lanzaboote project allows [[Secure Boot]] to be enabled on NixOS with relative ease.

Line 17:

Boot into FW: supported

~~~~

Current Boot Loader:

Product: systemd-boot 251.7

Line 23:

Line 22:

=== Setup ===

Follow the instructions in the [https:/~~/github.com~~/nix-community/lanzaboote~~/blob/master/docs~~/getting-started/prepare-your-system.md Quick Start guide].

Follow the instructions in the [https://nix-community.github.io/lanzaboote/getting-started/prepare-your-system.html Quick Start guide].

=== Key management ===

Line 30:

Line 29:

In the future, Lanzaboote will offer two new signature backends: remote signing (an HTTP server which receives signature requests and answers with signatures) and PKCS#11-based signing (that is, bringing an HSM-like device, e.g. YubiKey, NitroKey, etc.).{{Warning|Key management is a hard problem which is out of scope for Lanzaboote project, many recipes exist and there is no single perfect solution. Taking the time to learn how to key manage and figure out the right level of threat protection is crucial to achieve an effective boot protection.}}

=== Differences with `systemd-stub` ===

=== Differences with <code>systemd-stub</code> ===

systemd and distribution upstream have an existing solution called `systemd-stub` but this is not a realistic solution for NixOS as there's too many generations on a system.

systemd and distribution upstream have an existing solution called <code>systemd-stub</code> but this is not a realistic solution for NixOS as there's too many generations on a system.

Using `systemd-stub`, a kernel and an initrd has to be duplicated for '''each generation''', using Lanzaboote's stub, a kernel and initrd can be '''deduplicated''' without compromising on the security.

Using <code>systemd-stub</code>, a kernel and an initrd has to be duplicated for '''each generation''', using Lanzaboote's stub, a kernel and initrd can be '''deduplicated''' without compromising on the security.

Tracking the feature parity with `systemd-stub` can be done in this issue: ~~https://github.com~~/nix-community/lanzaboote/~~issues/94.~~

Tracking the feature parity with <code>systemd-stub</code> can be done in this issue: {{Issue|94|nix-community/lanzaboote#94|repo=nix-community/lanzaboote}}

</translate>

[[Category:Booting]]

@@ Line 1: / Line 1: @@
-__INDEX__
+<translate>
 The Lanzaboote project allows [[Secure Boot]] to be enabled on NixOS with relative ease.
@@ Line 17: / Line 17: @@
   Boot into FW: supported
-<!--T:11-->
 Current Boot Loader:
        Product: systemd-boot 251.7
@@ Line 23: / Line 22: @@
 === Setup ===
-Follow the instructions in the [https://github.com/nix-community/lanzaboote/blob/master/docs/getting-started/prepare-your-system.md Quick Start guide].
+Follow the instructions in the [https://nix-community.github.io/lanzaboote/getting-started/prepare-your-system.html Quick Start guide].
 === Key management ===
@@ Line 30: / Line 29: @@
 In the future, Lanzaboote will offer two new signature backends: remote signing (an HTTP server which receives signature requests and answers with signatures) and PKCS#11-based signing (that is, bringing an HSM-like device, e.g. YubiKey, NitroKey, etc.).{{Warning|Key management is a hard problem which is out of scope for Lanzaboote project, many recipes exist and there is no single perfect solution. Taking the time to learn how to key manage and figure out the right level of threat protection is crucial to achieve an effective boot protection.}}
-=== Differences with `systemd-stub` ===
+=== Differences with <code>systemd-stub</code> ===
-systemd and distribution upstream have an existing solution called `systemd-stub` but this is not a realistic solution for NixOS as there's too many generations on a system.
+systemd and distribution upstream have an existing solution called <code>systemd-stub</code> but this is not a realistic solution for NixOS as there's too many generations on a system.
-Using `systemd-stub`, a kernel and an initrd has to be duplicated for '''each generation''', using Lanzaboote's stub, a kernel and initrd can be '''deduplicated''' without compromising on the security.
+Using <code>systemd-stub</code>, a kernel and an initrd has to be duplicated for '''each generation''', using Lanzaboote's stub, a kernel and initrd can be '''deduplicated''' without compromising on the security.
-Tracking the feature parity with `systemd-stub` can be done in this issue: https://github.com/nix-community/lanzaboote/issues/94.
+Tracking the feature parity with <code>systemd-stub</code> can be done in this issue: {{Issue|94|nix-community/lanzaboote#94|repo=nix-community/lanzaboote}}
+</translate>
+[[Category:Booting]]