(How) should secure boot support be added to the limine nixos module?

Development
1

Hi, i would like to discuss, if and how secure boot support should be added to the limine nixos module.

My current idea of adding support would be to:

  • add a boot.loader.limine.enableSecureBoot option
  • check that enrollConfig & panicOnChecksumMismatch are set
  • sign the limine efi application if the option is set

This approach isn’t fully declarative and would require the user manually creating and enrolling the keys.
Creating the keys can’t really be avoided, but the keys could automatically be enrolled (if setup mode is active that is)

I need further thoughts and opinions on this.

1 Like
2

Maybe it’s better to start this conversation in lanzaboote, as there are plans to upstream it someday. Currently there’s just systemd-boot as a backend, but there were efforts to make it work with GRUB, so you can use it as a base. Also, there’s an issue requesting limine support already.

3

I would like to do this in nixpkgs.

4

Currently, there’s no infraestructure to sign kernels in nixpkgs, this is what lanzaboote is trying to become.