Lanzaboote is a custom UEFI stub developed in Rust that brings Secure Boot support to NixOS. Because NixOS users maintain many system generations, the standard UKI approach of bundling kernel and initrd into a single signed binary would quickly exhaust the EFI system partition. Lanzaboote solves this by conforming to the UKI spec while keeping kernel and initrd separate, deferring signature verification to UEFI's LoadImage. The project also includes lanzatool for assembling UKIs, signing binaries, and populating the ESP, plus NixOS modules and integration tests. A remaining challenge is establishing a chain of trust from default firmware keys, requiring users to generate and enroll their own keys — a process the team plans to streamline.
Table of contents
Secure Boot with systemd-bootNixOS-specific Problems and SolutionsLanzaboote: A EFI UKI Stub for NixOSIntegration in NixpkgsRoot of TrustGet Involved290 Impressions